@theokit/sdk 4.15.1 → 4.15.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 4.15.2
+
+### Patch Changes
+
+- fix(providers): M47 adversarial-review fixes on the dynamic-loader trust gate — (F1) `Agent.resume` now runs provider-plugin discovery (a fresh process resuming a persisted agent whose model targets a plugin provider no longer fails resolution); (F2) `Theokit.models.list({provider})` local path runs discovery too (sync surfaces stay builtins-only, documented); (F3) the discovery idempotence flag moved to `globalThis` (`Symbol.for`) matching the registry's M44 B1 pattern — no duplicate discovery per bundle entry; (F4/F7) the NOT-trusted WARN now says "then restart the process" and documents the comma-separated env format; (F5) non-string entries in a valid trust-file array WARN instead of being silently discarded.
+
 ## 4.15.1
 
 ### Patch Changes

package/dist/cron.cjs

@@ -7148,7 +7148,7 @@ var SkillsManager = class {
   }
   async refresh() {
     const skillsRoot = this.skillsDir ?? path.join(this.cwd, ".theokit", "skills");
-    const discovered2 = await discoverSkills(skillsRoot, {
+    const discovered = await discoverSkills(skillsRoot, {
       onInvalidSkill: (info) => {
         process.stderr.write(
           `[theokit-sdk] skill ${info.name} skipped (${info.code}): ${info.message}
@@ -7156,13 +7156,13 @@ var SkillsManager = class {
         );
       }
     });
-    this.skills = this.mergeInline(discovered2);
+    this.skills = this.mergeInline(discovered);
   }
   /** M22 — merge inline skills over discovered ones; inline wins on a name conflict. */
-  mergeInline(discovered2) {
-    if (this.inline === void 0 || this.inline.length === 0) return discovered2;
+  mergeInline(discovered) {
+    if (this.inline === void 0 || this.inline.length === 0) return discovered;
     const inlineNames = new Set(this.inline.map((s) => s.name));
-    return [...discovered2.filter((s) => !inlineNames.has(s.name)), ...this.inline];
+    return [...discovered.filter((s) => !inlineNames.has(s.name)), ...this.inline];
   }
   list() {
     return Promise.resolve(this.skills);
@@ -8720,7 +8720,7 @@ var FileContextManager = class {
     const legacy = await loadSources(config, this.cwd);
     const maxBytesPerFile = this.settings.maxBytesPerFile ?? DEFAULT_MAX_BYTES_PER_FILE;
     const maxBytesTotal = this.settings.maxBytesTotal ?? DEFAULT_MAX_BYTES_TOTAL;
-    const discovered2 = await runDiscovery({
+    const discovered = await runDiscovery({
       cwd: this.cwd,
       maxBytesPerFile,
       touchedFiles
@@ -8733,7 +8733,7 @@ var FileContextManager = class {
       // matches DEFAULT_DISCOVERY_SPECS theokit-context
       truncated: false
     }));
-    const { kept } = applyAggregateCap([...discovered2, ...legacyAsAggregator], maxBytesTotal);
+    const { kept } = applyAggregateCap([...discovered, ...legacyAsAggregator], maxBytesTotal);
     const loadedSources = kept.map((s) => ({
       name: s.id,
       path: s.source,
@@ -12036,7 +12036,15 @@ function registerBuiltins() {
   registerProvider(CEREBRAS);
   registerCatalogProviders();
 }
-var discovered = false;
+function globalSingleton3(key, create) {
+  const g = globalThis;
+  const sym = Symbol.for(key);
+  if (g[sym] === void 0) g[sym] = create();
+  return g[sym];
+}
+var discoveryState = globalSingleton3("theokit-sdk.providers.discovered", () => ({
+  done: false
+}));
 function pluginsRoot() {
   return path.join(os.homedir(), ".theokit", "plugins", "model-providers");
 }
@@ -12050,8 +12058,16 @@ function loadTrustedNames() {
     try {
       const parsed = JSON.parse(fs.readFileSync(path, "utf-8"));
       if (Array.isArray(parsed)) {
+        let discarded = 0;
         for (const name of parsed) {
           if (typeof name === "string" && name.length > 0) trusted.add(name);
+          else discarded += 1;
+        }
+        if (discarded > 0) {
+          process.stderr.write(
+            `[theokit-sdk] WARN: ${path} contains ${discarded} non-string entr${discarded === 1 ? "y" : "ies"} \u2014 discarded (entries must be plugin-name strings)
+`
+          );
         }
       } else {
         process.stderr.write(
@@ -12073,8 +12089,8 @@ function loadTrustedNames() {
   return trusted;
 }
 async function discoverProviderPlugins() {
-  if (discovered) return;
-  discovered = true;
+  if (discoveryState.done) return;
+  discoveryState.done = true;
   const root = pluginsRoot();
   if (!fs.existsSync(root)) return;
   let entries;
@@ -12087,7 +12103,7 @@ async function discoverProviderPlugins() {
   for (const entry of entries) {
     if (!trusted.has(entry)) {
       process.stderr.write(
-        `[theokit-sdk] WARN: provider plugin "${entry}" is present but NOT trusted \u2014 skipped. To trust it, add "${entry}" to ${trustFilePath()} (JSON array) or THEOKIT_TRUSTED_PROVIDERS.
+        `[theokit-sdk] WARN: provider plugin "${entry}" is present but NOT trusted \u2014 skipped. To trust it, add "${entry}" to ${trustFilePath()} (JSON array of names) or THEOKIT_TRUSTED_PROVIDERS (comma-separated), then restart the process.
 `
       );
       continue;
@@ -18665,6 +18681,7 @@ function resolveAgentPersistenceCwd(options) {
   return process.cwd();
 }
 async function rehydrateExistingAgent(agentId, existing, options) {
+  await discoverProviderPlugins();
   await validateRehydratedAgent(agentId, existing);
   const mergedLocal = options.local !== void 0 && existing.options.local !== void 0 ? { ...existing.options.local, ...options.local } : options.local ?? existing.options.local;
   const mergedOptions = {