@theokit/sdk 4.41.0 → 4.41.1

package/dist/cron.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkY33IGXCJ_cjs = require('./chunk-Y33IGXCJ.cjs');
-require('./chunk-F5DSDDBY.cjs');
+var chunkGTLH2NI2_cjs = require('./chunk-GTLH2NI2.cjs');
+require('./chunk-RPL3POFZ.cjs');
 require('./chunk-BV2MWEMV.cjs');
 require('./chunk-KCQUYQ3V.cjs');
 require('./chunk-BUUUWQMB.cjs');
@@ -50,7 +50,7 @@ require('./chunk-ZHPET3LZ.cjs');
 
 Object.defineProperty(exports, "Cron", {
   enumerable: true,
-  get: function () { return chunkY33IGXCJ_cjs.Cron; }
+  get: function () { return chunkGTLH2NI2_cjs.Cron; }
 });
 //# sourceMappingURL=cron.cjs.map
 //# sourceMappingURL=cron.cjs.map

package/dist/cron.js

@@ -1,5 +1,5 @@
-export { Cron } from './chunk-BHWHE453.js';
-import './chunk-DCKIS53K.js';
+export { Cron } from './chunk-AUMSEL33.js';
+import './chunk-DHLVOLUX.js';
 import './chunk-2SFBB54R.js';
 import './chunk-GNMPCZNN.js';
 import './chunk-K2BQQ445.js';

package/dist/eval.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
 var chunkR3CKCRK3_cjs = require('./chunk-R3CKCRK3.cjs');
-var chunkF5DSDDBY_cjs = require('./chunk-F5DSDDBY.cjs');
+var chunkRPL3POFZ_cjs = require('./chunk-RPL3POFZ.cjs');
 require('./chunk-BV2MWEMV.cjs');
 require('./chunk-KCQUYQ3V.cjs');
 var chunkBUUUWQMB_cjs = require('./chunk-BUUUWQMB.cjs');
@@ -773,7 +773,7 @@ function makeDefaultEmbedder(opts) {
   let runtime;
   return (texts) => {
     if (runtime === void 0) {
-      runtime = chunkF5DSDDBY_cjs.openRouterMemoryEmbeddingProviderAdapter.create(embedderCreateOptions(opts));
+      runtime = chunkRPL3POFZ_cjs.openRouterMemoryEmbeddingProviderAdapter.create(embedderCreateOptions(opts));
     }
     return runtime.then((rt) => rt.embed(texts));
   };

package/dist/eval.js

@@ -1,5 +1,5 @@
 import { shellEscapePosix, LocalSandbox } from './chunk-DEZ75ET5.js';
-import { openRouterMemoryEmbeddingProviderAdapter } from './chunk-DCKIS53K.js';
+import { openRouterMemoryEmbeddingProviderAdapter } from './chunk-DHLVOLUX.js';
 import './chunk-2SFBB54R.js';
 import './chunk-GNMPCZNN.js';
 import { getTracer } from './chunk-K2BQQ445.js';

package/dist/index.cjs

@@ -8,8 +8,8 @@ require('./chunk-WIGJGFH4.cjs');
 var chunkJO76RWCA_cjs = require('./chunk-JO76RWCA.cjs');
 require('./chunk-RBQYHEZD.cjs');
 require('./chunk-PNVDQL5Y.cjs');
-var chunkY33IGXCJ_cjs = require('./chunk-Y33IGXCJ.cjs');
-var chunkF5DSDDBY_cjs = require('./chunk-F5DSDDBY.cjs');
+var chunkGTLH2NI2_cjs = require('./chunk-GTLH2NI2.cjs');
+var chunkRPL3POFZ_cjs = require('./chunk-RPL3POFZ.cjs');
 require('./chunk-BV2MWEMV.cjs');
 var chunkKCQUYQ3V_cjs = require('./chunk-KCQUYQ3V.cjs');
 require('./chunk-BUUUWQMB.cjs');
@@ -62,8 +62,8 @@ var fs = require('fs');
 // src/agent-factory.ts
 function createAgentFactory(common) {
   return {
-    forSession: (agentId, overrides) => chunkF5DSDDBY_cjs.Agent.create(mergeAgentOptions(common, overrides, agentId)),
-    getOrCreate: (agentId, overrides) => chunkF5DSDDBY_cjs.Agent.getOrCreate(agentId, mergeAgentOptions(common, overrides, agentId))
+    forSession: (agentId, overrides) => chunkRPL3POFZ_cjs.Agent.create(mergeAgentOptions(common, overrides, agentId)),
+    getOrCreate: (agentId, overrides) => chunkRPL3POFZ_cjs.Agent.getOrCreate(agentId, mergeAgentOptions(common, overrides, agentId))
   };
 }
 function mergeAgentOptions(common, overrides, agentId) {
@@ -1167,7 +1167,7 @@ var Memory = {
       return await peer.IndexManager.open(openArgs);
     }
     const { IndexManager } = await import('./index-manager-YFFEPISE.cjs');
-    openArgs.embedding = await resolveEmbedding(opts.embedding, chunkF5DSDDBY_cjs.MEMORY_EMBEDDING_ADAPTERS);
+    openArgs.embedding = await resolveEmbedding(opts.embedding, chunkRPL3POFZ_cjs.MEMORY_EMBEDDING_ADAPTERS);
     return await IndexManager.open(openArgs);
   },
   /**
@@ -1178,7 +1178,7 @@ var Memory = {
    */
   async runDreamingSweep(opts) {
     const peer = await tryLoadSdkMemoryPeer();
-    const catalog = peer !== null ? peer.MEMORY_EMBEDDING_ADAPTERS : chunkF5DSDDBY_cjs.MEMORY_EMBEDDING_ADAPTERS;
+    const catalog = peer !== null ? peer.MEMORY_EMBEDDING_ADAPTERS : chunkRPL3POFZ_cjs.MEMORY_EMBEDDING_ADAPTERS;
     const sweepArgs = await buildDreamingSweepArgs(opts, catalog);
     const result = peer !== null ? (
       // biome-ignore lint/suspicious/noExplicitAny: peer is dynamically loaded — structural compat ensured by sdk-memory
@@ -1600,7 +1600,7 @@ function isBuiltAgent(m) {
   return typeof m.send === "function";
 }
 async function materialize(def, index) {
-  const { Agent: Agent2 } = await import('./agent-6C2ODKFU.cjs');
+  const { Agent: Agent2 } = await import('./agent-JDJEBJHU.cjs');
   return Agent2.create({
     // `AgentDefinition.model` admits the sentinel `'inherit'`, which is not a model id. Inheriting
     // here means "declare nothing and let the default apply" — forwarding the literal would create
@@ -1742,7 +1742,7 @@ var FIXTURE_USER = {
 };
 var FIXTURE_MODELS = [
   {
-    id: chunkF5DSDDBY_cjs.DEFAULT_AGENTIC_MODEL_ID,
+    id: chunkRPL3POFZ_cjs.DEFAULT_AGENTIC_MODEL_ID,
     name: "Gemini 2.0 Flash",
     displayName: "Gemini 2.0 Flash",
     parameters: [
@@ -1945,7 +1945,7 @@ var Theokit = class {
         envVars: p.envVars
       }));
     },
-    embeddingAdapters: () => Object.entries(chunkF5DSDDBY_cjs.MEMORY_EMBEDDING_ADAPTERS).map(([id, adapter]) => ({
+    embeddingAdapters: () => Object.entries(chunkRPL3POFZ_cjs.MEMORY_EMBEDDING_ADAPTERS).map(([id, adapter]) => ({
       id,
       transport: adapter.transport,
       defaultModel: adapter.defaultModel
@@ -1977,7 +1977,7 @@ function resolveLocalProviderBaseUrl(providerName, fallback) {
   return fallback;
 }
 async function executeCatalogRequest(request) {
-  const apiKey = chunkF5DSDDBY_cjs.resolveApiKey(request.apiKey);
+  const apiKey = chunkRPL3POFZ_cjs.resolveApiKey(request.apiKey);
   if (apiKey === void 0) {
     throw new chunkYULF6FPB_cjs.AuthenticationError("Missing API key", { code: "missing_api_key" });
   }
@@ -2103,35 +2103,35 @@ Object.defineProperty(exports, "GenerateObjectError", {
 });
 Object.defineProperty(exports, "Cron", {
   enumerable: true,
-  get: function () { return chunkY33IGXCJ_cjs.Cron; }
+  get: function () { return chunkGTLH2NI2_cjs.Cron; }
 });
 Object.defineProperty(exports, "Agent", {
   enumerable: true,
-  get: function () { return chunkF5DSDDBY_cjs.Agent; }
+  get: function () { return chunkRPL3POFZ_cjs.Agent; }
 });
 Object.defineProperty(exports, "AgentBuilder", {
   enumerable: true,
-  get: function () { return chunkF5DSDDBY_cjs.AgentBuilder; }
+  get: function () { return chunkRPL3POFZ_cjs.AgentBuilder; }
 });
 Object.defineProperty(exports, "Tool", {
   enumerable: true,
-  get: function () { return chunkF5DSDDBY_cjs.Tool; }
+  get: function () { return chunkRPL3POFZ_cjs.Tool; }
 });
 Object.defineProperty(exports, "ToolError", {
   enumerable: true,
-  get: function () { return chunkF5DSDDBY_cjs.ToolError; }
+  get: function () { return chunkRPL3POFZ_cjs.ToolError; }
 });
 Object.defineProperty(exports, "UsageAccumulator", {
   enumerable: true,
-  get: function () { return chunkF5DSDDBY_cjs.UsageAccumulator; }
+  get: function () { return chunkRPL3POFZ_cjs.UsageAccumulator; }
 });
 Object.defineProperty(exports, "computeCost", {
   enumerable: true,
-  get: function () { return chunkF5DSDDBY_cjs.computeCost; }
+  get: function () { return chunkRPL3POFZ_cjs.computeCost; }
 });
 Object.defineProperty(exports, "getPricingEntry", {
   enumerable: true,
-  get: function () { return chunkF5DSDDBY_cjs.getPricingEntry; }
+  get: function () { return chunkRPL3POFZ_cjs.getPricingEntry; }
 });
 Object.defineProperty(exports, "emitRunEvent", {
   enumerable: true,

package/dist/index.js

@@ -6,9 +6,9 @@ import './chunk-O3IZ7JEL.js';
 import { Workflow, agentStep } from './chunk-EON4YTR6.js';
 import './chunk-HK4HRLWE.js';
 import './chunk-CAH3G4IS.js';
-export { Cron } from './chunk-BHWHE453.js';
-import { MEMORY_EMBEDDING_ADAPTERS, resolveApiKey, DEFAULT_AGENTIC_MODEL_ID, Agent } from './chunk-DCKIS53K.js';
-export { Agent, AgentBuilder, Tool, ToolError, UsageAccumulator, computeCost, getPricingEntry } from './chunk-DCKIS53K.js';
+export { Cron } from './chunk-AUMSEL33.js';
+import { MEMORY_EMBEDDING_ADAPTERS, resolveApiKey, DEFAULT_AGENTIC_MODEL_ID, Agent } from './chunk-DHLVOLUX.js';
+export { Agent, AgentBuilder, Tool, ToolError, UsageAccumulator, computeCost, getPricingEntry } from './chunk-DHLVOLUX.js';
 import './chunk-2SFBB54R.js';
 import { configure, submit, list, get, cancel, subscribe } from './chunk-GNMPCZNN.js';
 export { emitRunEvent } from './chunk-GNMPCZNN.js';
@@ -1603,7 +1603,7 @@ function isBuiltAgent(m) {
   return typeof m.send === "function";
 }
 async function materialize(def, index) {
-  const { Agent: Agent2 } = await import('./agent-35MGOZVH.js');
+  const { Agent: Agent2 } = await import('./agent-LVKAYADR.js');
   return Agent2.create({
     // `AgentDefinition.model` admits the sentinel `'inherit'`, which is not a model id. Inheriting
     // here means "declare nothing and let the default apply" — forwarding the literal would create

package/dist/internal/runtime/context/context-discovery-runner.d.ts

@@ -24,4 +24,13 @@ export interface DiscoveryRunnerOptions {
     readonly touchedFiles?: ReadonlyArray<string>;
     /** When true, skip `theokit-context` spec — caller already handles the legacy path. */
     readonly skipLegacyTheokitContext?: boolean;
+    /**
+     * The root an `@import` may not escape. Defaults to `gitRoot ?? cwd` — the same value
+     * this runner already uses to keep absolute paths out of `<source name="">`.
+     *
+     * Present so an embedder with a trust boundary narrower than the repository can declare
+     * it. Absent, the repository IS the boundary, which is the honest default for a document
+     * discovered by walking the repository.
+     */
+    readonly importRoot?: string;
 }

package/dist/internal/runtime/context/context-import-resolver.d.ts

@@ -21,4 +21,21 @@ export interface ResolveImportsOptions {
     readonly depth: number;
     /** Per-import file cap (EC-D). Forwarded to loadPlainMarkdown. */
     readonly maxBytesPerFile: number;
+    /**
+     * The directory an import may not escape. When set, a target resolving outside it is
+     * refused and replaced with a placeholder.
+     *
+     * The file carrying the import is REPOSITORY-CONTROLLED — `CLAUDE.md` and `GEMINI.md`
+     * are the two default specs with `followImports: true`, and both are found by
+     * `git-root-walk` inside the tree the agent was pointed at. Without a root, a cloned
+     * repository could name `@~/.ssh/id_rsa` or any absolute path and have its contents
+     * inlined into the system prompt, and from there sent to the model provider. The
+     * traversal guard that already existed (`isSafePattern`) guards the discovery PATTERN,
+     * not the import TARGET, so it never saw this.
+     *
+     * OPTIONAL, so a caller outside the discovery path keeps the previous behaviour rather
+     * than breaking on an upgrade. `runDiscovery` always supplies `gitRoot ?? cwd` — the
+     * same value it already uses to keep absolute paths out of `<source name="">`.
+     */
+    readonly projectRoot?: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theokit/sdk",
-  "version": "4.41.0",
+  "version": "4.41.1",
   "description": "TypeScript SDK for the Theo agent harness — same surface, local or cloud.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/usetheodev/theokit-sdk#readme",