@theokit/sdk 4.15.0 → 4.15.2

package/dist/index.cjs

@@ -11522,14 +11522,14 @@ var PluginsManager = class {
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: MD-first + JSON fallback + both-present detection per plugin folder — branch table is clearer inlined.
   async refresh() {
     this.plugins = [];
-    const pluginsRoot = path.join(this.cwd, ".theokit", "plugins");
-    const entries = await readWorkspaceDir(pluginsRoot, "plugins_read_error", "plugins directory");
+    const pluginsRoot2 = path.join(this.cwd, ".theokit", "plugins");
+    const entries = await readWorkspaceDir(pluginsRoot2, "plugins_read_error", "plugins directory");
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       const folderName = entry.name;
-      const mdPath = path.join(pluginsRoot, folderName, "PLUGIN.md");
-      const jsonPath = path.join(pluginsRoot, folderName, "plugin.json");
-      const metadata = fs.existsSync(mdPath) ? await loadPluginManifestFromMarkdown(pluginsRoot, folderName) : await loadPluginManifestFromJson(jsonPath, folderName);
+      const mdPath = path.join(pluginsRoot2, folderName, "PLUGIN.md");
+      const jsonPath = path.join(pluginsRoot2, folderName, "plugin.json");
+      const metadata = fs.existsSync(mdPath) ? await loadPluginManifestFromMarkdown(pluginsRoot2, folderName) : await loadPluginManifestFromJson(jsonPath, folderName);
       if (fs.existsSync(mdPath) && fs.existsSync(jsonPath)) {
         warnOnce(
           `plugin-${folderName}-both`,
@@ -11608,8 +11608,8 @@ async function loadPluginManifestFromJson(manifestPath, folderName) {
   if (typeof record.entry === "string") metadata.entry = record.entry;
   return metadata;
 }
-async function loadPluginManifestFromMarkdown(pluginsRoot, folderName) {
-  const mdPath = path.join(pluginsRoot, folderName, "PLUGIN.md");
+async function loadPluginManifestFromMarkdown(pluginsRoot2, folderName) {
+  const mdPath = path.join(pluginsRoot2, folderName, "PLUGIN.md");
   let raw;
   try {
     raw = await promises.readFile(mdPath, "utf8");
@@ -11619,7 +11619,7 @@ async function loadPluginManifestFromMarkdown(pluginsRoot, folderName) {
       cause
     });
   }
-  const fakeDir = path.join(pluginsRoot, folderName);
+  const fakeDir = path.join(pluginsRoot2, folderName);
   const entities = await loadMarkdownEntities({
     dir: fakeDir,
     schema: PluginFrontmatterSchema,
@@ -14635,6 +14635,103 @@ function registerBuiltins() {
   registerProvider(CEREBRAS);
   registerCatalogProviders();
 }
+function globalSingleton3(key2, create) {
+  const g = globalThis;
+  const sym = Symbol.for(key2);
+  if (g[sym] === void 0) g[sym] = create();
+  return g[sym];
+}
+var discoveryState = globalSingleton3("theokit-sdk.providers.discovered", () => ({
+  done: false
+}));
+function pluginsRoot() {
+  return path.join(os.homedir(), ".theokit", "plugins", "model-providers");
+}
+function trustFilePath() {
+  return path.join(os.homedir(), ".theokit", "plugins", "trusted-providers.json");
+}
+function loadTrustedNames() {
+  const trusted = /* @__PURE__ */ new Set();
+  const path = trustFilePath();
+  if (fs.existsSync(path)) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(path, "utf-8"));
+      if (Array.isArray(parsed)) {
+        let discarded = 0;
+        for (const name of parsed) {
+          if (typeof name === "string" && name.length > 0) trusted.add(name);
+          else discarded += 1;
+        }
+        if (discarded > 0) {
+          process.stderr.write(
+            `[theokit-sdk] WARN: ${path} contains ${discarded} non-string entr${discarded === 1 ? "y" : "ies"} \u2014 discarded (entries must be plugin-name strings)
+`
+          );
+        }
+      } else {
+        process.stderr.write(
+          `[theokit-sdk] WARN: ${path} is not a JSON array \u2014 trusting NO provider plugins (fail-closed)
+`
+        );
+      }
+    } catch {
+      process.stderr.write(
+        `[theokit-sdk] WARN: ${path} is not valid JSON \u2014 trusting NO provider plugins (fail-closed)
+`
+      );
+    }
+  }
+  for (const name of (process.env.THEOKIT_TRUSTED_PROVIDERS ?? "").split(",")) {
+    const trimmed = name.trim();
+    if (trimmed.length > 0) trusted.add(trimmed);
+  }
+  return trusted;
+}
+async function discoverProviderPlugins() {
+  if (discoveryState.done) return;
+  discoveryState.done = true;
+  const root = pluginsRoot();
+  if (!fs.existsSync(root)) return;
+  let entries;
+  try {
+    entries = await promises.readdir(root);
+  } catch {
+    return;
+  }
+  const trusted = loadTrustedNames();
+  for (const entry of entries) {
+    if (!trusted.has(entry)) {
+      process.stderr.write(
+        `[theokit-sdk] WARN: provider plugin "${entry}" is present but NOT trusted \u2014 skipped. To trust it, add "${entry}" to ${trustFilePath()} (JSON array of names) or THEOKIT_TRUSTED_PROVIDERS (comma-separated), then restart the process.
+`
+      );
+      continue;
+    }
+    await loadOne(path.join(root, entry), entry);
+  }
+}
+async function loadOne(dir, entryName) {
+  for (const ext of ["index.mjs", "index.js"]) {
+    const indexPath = path.join(dir, ext);
+    if (!fs.existsSync(indexPath)) continue;
+    try {
+      const mod = await import(url.pathToFileURL(indexPath).href);
+      const plugin = mod.default ?? mod[entryName] ?? mod;
+      if (plugin !== null && typeof plugin === "object" && plugin.kind === "model-provider") {
+        const profile = plugin.profile;
+        if (profile !== void 0 && typeof profile === "object") {
+          registerProvider(profile);
+        }
+      }
+      return;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[theokit-sdk] failed to load provider plugin "${entryName}": ${msg}
+`);
+      return;
+    }
+  }
+}
 
 // src/internal/llm/anthropic.ts
 init_errors();
@@ -20237,6 +20334,7 @@ function resolveAgentPersistenceCwd(options) {
   return process.cwd();
 }
 async function rehydrateExistingAgent(agentId, existing, options) {
+  await discoverProviderPlugins();
   await validateRehydratedAgent(agentId, existing);
   const mergedLocal = options.local !== void 0 && existing.options.local !== void 0 ? { ...existing.options.local, ...options.local } : options.local ?? existing.options.local;
   const mergedOptions = {
@@ -20366,6 +20464,7 @@ var Agent = class _Agent {
       pluginCount: enabledPluginNames(options.plugins).length
     });
     try {
+      await discoverProviderPlugins();
       const agent = await runCreateUnderSpan(options, span);
       return agent;
     } catch (err) {
@@ -23314,6 +23413,7 @@ var Theokit = class {
 };
 async function maybeListLocalModels(providerName) {
   registerBuiltins();
+  await discoverProviderPlugins();
   const profile = getProviderProfile(providerName);
   if (profile === void 0) return void 0;
   if (profile.authType !== "none") return void 0;