@theokit/sdk 5.0.1 → 5.1.0

package/dist/{chunk-UFPUHJWS.js → chunk-IUMAQURF.js}

@@ -80,6 +80,11 @@ async function judgeCallImpl(ctx, options, deps) {
       model: { id: judgeModel },
       tools: [],
       local: {},
+      // #581 — `tools: []` READS as "no tools" and is not: a `shell` tool is always registered on a
+      // local agent, this line included. This judge is sandboxed (unlike the scorer's), so the
+      // exposure is smaller — but it still held a capability it never asked for, and whose absence
+      // the line above appears to declare. Withholding is what actually declares it.
+      withheldBuiltinTools: ["shell"],
       metadata: { forkOrigin: "judge" }
     });
     const run = await auxAgent.send(prompt);
@@ -121,5 +126,5 @@ Be strict. If unclear, prefer CONTINUE.`;
 }
 
 export { JudgeCredentialError, composeJudgePrompt, judgeCallImpl };
-//# sourceMappingURL=chunk-UFPUHJWS.js.map
-//# sourceMappingURL=chunk-UFPUHJWS.js.map
+//# sourceMappingURL=chunk-IUMAQURF.js.map
+//# sourceMappingURL=chunk-IUMAQURF.js.map

package/dist/chunk-IUMAQURF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/judge/parse-verdict.ts","../src/internal/judge/judge-call.ts"],"names":[],"mappings":";;;AAaA,IAAM,WAAA,GAAc,OAAA;AACpB,IAAM,eAAA,GAAkB,WAAA;AACxB,IAAM,cAAA,GAAiB,UAAA;AAEvB,IAAM,cAAA,GAAiB,UAAA;AAEhB,SAAS,aAAa,IAAA,EAA2B;AACtD,EAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAE1B,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,WAAW,CAAA,EAAG;AACnC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,MAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,WAAA,CAAY,MAAM,EAAE,IAAA,EAAK;AAAA,MAC/C,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,eAAe,CAAA,EAAG;AACvC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,eAAA,CAAgB,MAAM,EAAE,IAAA,EAAK;AAAA,MACnD,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,cAAc,CAAA,EAAG;AACtC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,SAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,MAAM,EAAE,IAAA,EAAK;AAAA,MAClD,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,cAAc,CAAA,EAAG;AACtC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,SAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,MAAM,EAAE,IAAA,EAAK;AAAA,MAClD,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AAKA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,UAAA;AAAA,IACT,QAAQ,CAAA,2BAAA,EAA8B,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,IAC3D,WAAA,EAAa;AAAA,GACf;AACF;;;ACIO,IAAM,oBAAA,GAAN,cAAmC,iBAAA,CAAkB;AAAA,EAG1D,WAAA,CACW,UAAA,EACA,UAAA,EACT,KAAA,EACA;AACA,IAAA,KAAA;AAAA,MACE,CAAA,0BAAA,EAA6B,UAAU,CAAA,WAAA,EAAc,MAAA,CAAO,UAAU,CAAC,CAAA,iIAAA,CAAA;AAAA,MAGvE,EAAE,IAAA,EAAM,kBAAA,EAAoB,KAAA,EAAO,aAAa,KAAA;AAAM,KACxD;AATS,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EASX;AAAA,EAVW,UAAA;AAAA,EACA,UAAA;AAAA,EAJO,IAAA,GAAO,sBAAA;AAc3B;AAGA,SAAS,aAAa,GAAA,EAAkC;AACtD,EAAA,MAAM,CAAA,GACH,GAAA,CAAmD,MAAA,IACnD,GAAA,CAAiC,UAAA;AACpC,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AAClC,EAAA,MAAM,CAAA,GAAI,oBAAoB,IAAA,CAAK,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AACnF,EAAA,OAAO,CAAA,GAAI,CAAC,CAAA,KAAM,MAAA,GAAY,OAAO,CAAA,CAAE,CAAC,CAAC,CAAA,GAAI,MAAA;AAC/C;AAgBA,eAAsB,aAAA,CACpB,GAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,MAAA,GAAS,mBAAmB,GAAG,CAAA;AAErC,EAAA,MAAM,MAAA,GAAS,OAAA,EAAS,MAAA,IAAU,OAAA,CAAQ,GAAA,CAAI,kBAAA;AAC9C,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,MAAA,EACE,yFAAA;AAAA,MACF,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AAIA,EAAA,MAAM,UAAA,GAAa,OAAA,EAAS,UAAA,IAAc,OAAA,EAAS,UAAA,IAAc,oBAAA;AACjE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,KAAK,MAAA,CAAO;AAAA,MAC3B,MAAA;AAAA,MACA,KAAA,EAAO,EAAE,EAAA,EAAI,UAAA,EAAW;AAAA,MACxB,OAAO,EAAC;AAAA,MACR,OAAO,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAKR,oBAAA,EAAsB,CAAC,OAAO,CAAA;AAAA,MAC9B,QAAA,EAAU,EAAE,UAAA,EAAY,OAAA;AAAQ,KACjB,CAAA;AACjB,IAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,IAAA,CAAK,MAAM,CAAA;AACtC,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,IAAA,OAAO,YAAA,CAAa,MAAA,CAAO,MAAA,IAAU,EAAE,CAAA;AAAA,EACzC,SAAS,GAAA,EAAK;AAIZ,IAAA,MAAM,MAAA,GAAS,aAAa,GAAG,CAAA;AAC/B,IAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,IAAO,WAAW,GAAA,EAAK;AACtD,MAAA,MAAM,IAAI,oBAAA,CAAqB,MAAA,EAAQ,UAAA,EAAY,GAAG,CAAA;AAAA,IACxD;AACA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,MAAA,EAAQ,sBAAsB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC9E,WAAA,EAAa;AAAA,KACf;AAAA,EACF,CAAA,SAAE;AACA,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,SAAS,OAAA,EAAQ;AAAA,MACzB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AAOO,SAAS,mBAAmB,GAAA,EAA2B;AAC5D,EAAA,MAAM,QAAA,GACJ,GAAA,CAAI,QAAA,KAAa,MAAA,IAAa,GAAA,CAAI,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,GAAA,CAAI,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,GAAI,QAAA;AACpF,EAAA,OAAO,CAAA;;AAAA,MAAA,EAED,IAAI,IAAI;AAAA,UAAA,EACJ,QAAQ;AAAA,qBAAA,EACG,IAAI,YAAY;;AAAA;AAAA;AAAA;AAAA;;AAAA,uCAAA,CAAA;AAQvC","file":"chunk-IUMAQURF.js","sourcesContent":["/**\n * Pure verdict parser (T2.1, ADRs D120-D121).\n *\n * Strict prefix matching against `DONE:`, `CONTINUE:`, `SKIPPED:`. Reason\n * is the suffix, trimmed. Anything else is fail-safe: verdict = `continue`,\n * `parseFailed: true` — caller's max-consecutive-failure cap stops the\n * loop after N flakes.\n *\n * @internal\n */\n\nimport type { JudgeResult } from \"../../types/goal-events.js\";\n\nconst DONE_PREFIX = \"DONE:\";\nconst CONTINUE_PREFIX = \"CONTINUE:\";\nconst SKIPPED_PREFIX = \"SKIPPED:\";\n/** M80 — the judge can now declare impossibility, not just \"continue\". */\nconst BLOCKED_PREFIX = \"BLOCKED:\";\n\nexport function parseVerdict(text: string): JudgeResult {\n  const trimmed = text.trim();\n\n  if (trimmed.startsWith(DONE_PREFIX)) {\n    return {\n      verdict: \"done\",\n      reason: trimmed.slice(DONE_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n  if (trimmed.startsWith(CONTINUE_PREFIX)) {\n    return {\n      verdict: \"continue\",\n      reason: trimmed.slice(CONTINUE_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n  if (trimmed.startsWith(BLOCKED_PREFIX)) {\n    return {\n      verdict: \"blocked\",\n      reason: trimmed.slice(BLOCKED_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n  if (trimmed.startsWith(SKIPPED_PREFIX)) {\n    return {\n      verdict: \"skipped\",\n      reason: trimmed.slice(SKIPPED_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n\n  // Fail-safe: ADR D121 — prefer \"continue\" so we don't stop prematurely.\n  // The runUntil loop counts consecutive parseFailed responses and bails\n  // after `maxConsecutiveJudgeFailures` (default 3).\n  return {\n    verdict: \"continue\",\n    reason: `judge response malformed: \"${trimmed.slice(0, 100)}\"`,\n    parseFailed: true,\n  };\n}\n","import { TheokitAgentError } from \"../../errors.js\";\n/**\n * Judge call primitive (T2.2, ADRs D119-D121).\n *\n * Instantiates a short-lived auxiliary agent that evaluates whether a\n * goal is satisfied. The auxiliary judge runs with `tools: []` and a\n * cheap model (default `openai/gpt-4o-mini`) — see ADR D119. The judge\n * model needs only API access; we read `OPENROUTER_API_KEY` directly\n * from the environment (EC-A — single source of truth) and let the\n * caller override via {@link JudgeOptions.apiKey} for Anthropic or\n * direct-OpenAI environments.\n *\n * NOTE: judge aux agents created from inside a `forkAgent` context will\n * inherit the parent fork's whitelist via AsyncLocalStorage (EC-J).\n * `tools: []` keeps this benign today; future callers that add tools to\n * a judge should be aware.\n *\n * @internal\n */\n\nimport type { AgentOptions, SDKAgent } from \"../../types/agent.js\";\nimport type { JudgeResult } from \"../../types/goal-events.js\";\nimport { parseVerdict } from \"./parse-verdict.js\";\n\n/** Inputs to the judge — pure data. */\nexport interface JudgeContext {\n  goal: string;\n  lastResponse: string;\n  subgoals?: string[];\n}\n\n/** Caller-supplied tuning knobs for the judge call. */\nexport interface JudgeOptions {\n  /**\n   * Judge model identifier. When absent, it DERIVES from {@link agentModel} — and only falls back to the literal\n   * `\"openai/gpt-4o-mini\"` when neither is provided.\n   *\n   * M80 — the fixed default was provider-blind: it only resolves on OpenRouter. With an Anthropic key it gives\n   * 404, with an OAuth bearer it gives 401, and in both the goal burned 3 whole turns before failing with\n   * a misleading reason. The agent-builder already worked around this by deriving on its own; the knowledge\n   * belongs here.\n   */\n  judgeModel?: string;\n  /**\n   * M80 — the DRIVEN agent's model. It is the basis of the derivation: a judge running on the same model as the\n   * chat works wherever chat works.\n   */\n  agentModel?: string;\n  /** Override env. Default `process.env.OPENROUTER_API_KEY` (EC-A). */\n  apiKey?: string;\n}\n\n/**\n * M80 — the judge's credential or model does not work: 401/404.\n *\n * Fails FAST by design. `rules/error-handling.md` § 2 separates recoverable from unrecoverable, and a\n * nonexistent model does not start existing on retry — folding that into `{parseFailed: true}` made the loop\n * try three times and report \"failed\" on a consecutive-failure limit, hiding that the cause was the\n * credential. A slow, opaque failure traded for a fast, clear one.\n *\n * PARSE failures and network errors stay folded: they are recoverable, and the loop already decides on\n * in a row.\n */\nexport class JudgeCredentialError extends TheokitAgentError {\n  override readonly name = \"JudgeCredentialError\";\n\n  constructor(\n    readonly httpStatus: number,\n    readonly judgeModel: string,\n    cause: unknown,\n  ) {\n    super(\n      `judge unavailable: model \"${judgeModel}\" returned ${String(httpStatus)}. ` +\n        \"Pass `judgeModel`/`apiKey` that resolve for this provider, or omit `judgeModel` to derive \" +\n        \"it from the agent being driven.\",\n      { code: \"judge_credential\", cause, isRetryable: false },\n    );\n  }\n}\n\n/** Extracts the HTTP status from a provider error, when it carries one. */\nfunction httpStatusOf(err: unknown): number | undefined {\n  const s =\n    (err as { status?: unknown; statusCode?: unknown }).status ??\n    (err as { statusCode?: unknown }).statusCode;\n  if (typeof s === \"number\") return s;\n  const m = /\\b(401|403|404)\\b/.exec(err instanceof Error ? err.message : String(err));\n  return m?.[1] !== undefined ? Number(m[1]) : undefined;\n}\n\n/** Dependencies injected so `judge-call.ts` stays free of `Agent` import. */\nexport interface JudgeDeps {\n  create: (options: AgentOptions) => Promise<SDKAgent>;\n}\n\n/**\n * Run the judge auxiliary agent and parse the verdict. Always returns a\n * `JudgeResult` — failures are folded into `{ parseFailed: true,\n * verdict: \"continue\" }` so the loop can decide based on consecutive\n * failures (ADR D121).\n *\n * @internal\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: judge call must (1) check env or override, (2) catch errors as fail-safe, (3) ensure aux dispose runs once regardless of outcome — three concerns linearly arranged, harm clarity to extract.\nexport async function judgeCallImpl(\n  ctx: JudgeContext,\n  options: JudgeOptions | undefined,\n  deps: JudgeDeps,\n): Promise<JudgeResult> {\n  const prompt = composeJudgePrompt(ctx);\n  // EC-A: single env source — OpenRouter only. No multi-provider fallback.\n  const apiKey = options?.apiKey ?? process.env.OPENROUTER_API_KEY;\n  if (apiKey === undefined) {\n    return {\n      verdict: \"continue\",\n      reason:\n        \"judge unavailable: OPENROUTER_API_KEY missing and no override passed via options.apiKey\",\n      parseFailed: true,\n    };\n  }\n\n  // M80 — precedence: explicit > driven agent's model > the historical literal. The literal only\n  // survives as a last resort, so as not to break callers who never passed either.\n  const judgeModel = options?.judgeModel ?? options?.agentModel ?? \"openai/gpt-4o-mini\";\n  let auxAgent: SDKAgent | undefined;\n  try {\n    auxAgent = await deps.create({\n      apiKey,\n      model: { id: judgeModel },\n      tools: [],\n      local: {},\n      // #581 — `tools: []` READS as \"no tools\" and is not: a `shell` tool is always registered on a\n      // local agent, this line included. This judge is sandboxed (unlike the scorer's), so the\n      // exposure is smaller — but it still held a capability it never asked for, and whose absence\n      // the line above appears to declare. Withholding is what actually declares it.\n      withheldBuiltinTools: [\"shell\"],\n      metadata: { forkOrigin: \"judge\" },\n    } as AgentOptions);\n    const run = await auxAgent.send(prompt);\n    const result = await run.wait();\n    return parseVerdict(result.result ?? \"\");\n  } catch (err) {\n    // M80 — 401/403/404 are credential/model errors: unrecoverable, failing fast and typed. Everything\n    // else (network, timeout, 5xx) stays folded, because it IS recoverable and the loop already decides on\n    // in a row.\n    const status = httpStatusOf(err);\n    if (status === 401 || status === 403 || status === 404) {\n      throw new JudgeCredentialError(status, judgeModel, err);\n    }\n    return {\n      verdict: \"continue\",\n      reason: `judge call failed: ${err instanceof Error ? err.message : String(err)}`,\n      parseFailed: true,\n    };\n  } finally {\n    if (auxAgent !== undefined) {\n      try {\n        await auxAgent.dispose();\n      } catch {\n        // dispose errors are non-fatal; judge result is already prepared\n      }\n    }\n  }\n}\n\n/**\n * Build the strict-format prompt the judge expects.\n *\n * @internal\n */\nexport function composeJudgePrompt(ctx: JudgeContext): string {\n  const subgoals =\n    ctx.subgoals !== undefined && ctx.subgoals.length > 0 ? ctx.subgoals.join(\", \") : \"(none)\";\n  return `You are a goal judge. Determine if this goal is satisfied.\n\nGoal: ${ctx.goal}\nSubgoals: ${subgoals}\nLast agent response: ${ctx.lastResponse}\n\nRespond with EXACTLY one of:\n- DONE: <reason>\n- CONTINUE: <what's left>\n- SKIPPED: <why not applicable>\n\nBe strict. If unclear, prefer CONTINUE.`;\n}\n"]}

package/dist/{chunk-LTLPBGHC.cjs → chunk-KGANQYP7.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkDLRP7BI6_cjs = require('./chunk-DLRP7BI6.cjs');
+var chunkNYQ3IS7K_cjs = require('./chunk-NYQ3IS7K.cjs');
 var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
 var chunk6LHQPOMI_cjs = require('./chunk-6LHQPOMI.cjs');
 var async_hooks = require('async_hooks');
@@ -29,7 +29,7 @@ async function loadHookConfig(cwd, compatSources = []) {
     sawAny = true;
     mergeInto(merged, stampSource(await readHookFile(path), path));
   }
-  if (!sawAny && fs.existsSync(path.join(chunkDLRP7BI6_cjs.theokitConfigRoot(cwd), "hooks"))) {
+  if (!sawAny && fs.existsSync(path.join(chunkNYQ3IS7K_cjs.theokitConfigRoot(cwd), "hooks"))) {
     warnOnce(
       "hooks-md-unsupported",
       "[theokit-sdk] .theokit/hooks/*.md hooks are no longer supported (ADR 0016) \u2014 migrate to a Claude-Code-shaped .theokit/hooks.json"
@@ -38,7 +38,7 @@ async function loadHookConfig(cwd, compatSources = []) {
   return merged;
 }
 function hookConfigCandidates(cwd, compatSources) {
-  const roots = chunkDLRP7BI6_cjs.projectConfigRoots(cwd, compatSources, "hooks");
+  const roots = chunkNYQ3IS7K_cjs.projectConfigRoots(cwd, compatSources, "hooks");
   return [
     ...roots.map((root) => path.join(root, "hooks.json")),
     ...roots.map((root) => path.join(root, "settings.json")),
@@ -168,5 +168,5 @@ exports.loadHookConfig = loadHookConfig;
 exports.warnOnce = warnOnce;
 exports.warnPersonalitySwitchInsideFork = warnPersonalitySwitchInsideFork;
 exports.withPersonalityContext = withPersonalityContext;
-//# sourceMappingURL=chunk-LTLPBGHC.cjs.map
-//# sourceMappingURL=chunk-LTLPBGHC.cjs.map
+//# sourceMappingURL=chunk-KGANQYP7.cjs.map
+//# sourceMappingURL=chunk-KGANQYP7.cjs.map

package/dist/{chunk-LTLPBGHC.cjs.map → chunk-KGANQYP7.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/runtime/hooks/hooks-source.ts","../src/internal/personality/context.ts"],"names":["diag","existsSync","join","theokitConfigRoot","projectConfigRoots","readFile","ConfigurationError","AsyncLocalStorage"],"mappings":";;;;;;;;;;AAkCA,IAAM,qBAAA,GAA6D;AAAA,EACjE,UAAA,EAAY,YAAA;AAAA,EACZ,WAAA,EAAa,aAAA;AAAA,EACb,gBAAA,EAAkB,QAAA;AAAA,EAClB,IAAA,EAAM;AACR,CAAA;AAqBA,IAAM,MAAA,uBAAa,GAAA,EAAY;AAYxB,SAAS,QAAA,CAAS,KAAa,OAAA,EAAuB;AAC3D,EAAA,IAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,EAAG;AACrB,EAAA,MAAA,CAAO,IAAI,GAAG,CAAA;AACd,EAAAA,sBAAA,CAAK,GAAG,OAAO;AAAA,CAAI,CAAA;AACrB;AAcA,eAAsB,cAAA,CACpB,GAAA,EACA,aAAA,GAAoD,EAAC,EAChC;AACrB,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,oBAAA,CAAqB,GAAA,EAAK,aAAa,CAAA,EAAG;AAC3D,IAAA,IAAI,CAACC,aAAA,CAAW,IAAI,CAAA,EAAG;AACvB,IAAA,MAAA,GAAS,IAAA;AAIT,IAAA,SAAA,CAAU,QAAQ,WAAA,CAAY,MAAM,aAAa,IAAI,CAAA,EAAG,IAAI,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,CAAC,UAAUA,aAAA,CAAWC,SAAA,CAAKC,oCAAkB,GAAG,CAAA,EAAG,OAAO,CAAC,CAAA,EAAG;AAChE,IAAA,QAAA;AAAA,MACE,sBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAaA,SAAS,oBAAA,CACP,KACA,aAAA,EACU;AACV,EAAA,MAAM,KAAA,GAAQC,oCAAA,CAAmB,GAAA,EAAK,aAAA,EAAe,OAAO,CAAA;AAC5D,EAAA,OAAO;AAAA,IACL,GAAG,MAAM,GAAA,CAAI,CAAC,SAASF,SAAA,CAAK,IAAA,EAAM,YAAY,CAAC,CAAA;AAAA,IAC/C,GAAG,MAAM,GAAA,CAAI,CAAC,SAASA,SAAA,CAAK,IAAA,EAAM,eAAe,CAAC,CAAA;AAAA,IAClD,GAAG,MAAM,GAAA,CAAI,CAAC,SAASA,SAAA,CAAK,IAAA,EAAM,qBAAqB,CAAC;AAAA,GAC1D;AACF;AAQA,SAAS,WAAA,CAAY,QAAoB,UAAA,EAAgC;AACvE,EAAA,IAAI,MAAA,CAAO,KAAA,KAAU,MAAA,EAAW,OAAO,MAAA;AACvC,EAAA,MAAM,QAA0C,EAAC;AACjD,EAAA,KAAA,MAAW,CAAC,OAAO,QAAQ,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA,EAGtD;AACH,IAAA,IAAI,aAAa,MAAA,EAAW;AAC5B,IAAA,KAAA,CAAM,KAAK,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,CAAC,OAAO,EAAE,UAAA,EAAY,GAAG,CAAA,EAAE,CAAE,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,EAAE,KAAA,EAAM;AACjB;AAWA,SAAS,SAAA,CAAU,QAAoB,MAAA,EAA0B;AAC/D,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,QAAQ,CAAA,IAAK,MAAA,CAAO,QAAQ,MAAA,CAAO,KAAA,IAAS,EAAE,CAAA,EAG5D;AACH,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACrD,IAAA,MAAA,CAAO,UAAU,EAAC;AAClB,IAAA,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,GAAI,CAAC,GAAI,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,IAAK,EAAC,EAAI,GAAG,QAAQ,CAAA;AAAA,EACpE;AACF;AAEA,eAAe,aAAa,QAAA,EAAuC;AACjE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMG,iBAAA,CAAS,QAAA,EAAU,MAAM,CAAA;AAAA,EACvC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAIC,oCAAA,CAAmB,CAAA,6BAAA,EAAgC,QAAQ,CAAA,CAAA,EAAI;AAAA,MACvE,IAAA,EAAM,kBAAA;AAAA,MACN;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,8BAAA,EAAiC,QAAQ,CAAA,CAAA,EAAI;AAAA,MACxE,IAAA,EAAM,oBAAA;AAAA,MACN;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,OAAO,qBAAA,CAAsB,QAAQ,QAAQ,CAAA;AAC/C;AAGA,SAAS,QAAA,CAAS,KAAA,EAAgB,IAAA,EAAc,KAAA,EAAwC;AACtF,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACvE,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,6BAAA,EAAgC,KAAK,CAAA,IAAA,EAAO,IAAI,CAAA,CAAA,EAAI;AAAA,MAC/E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,OAAA,CAAQ,KAAA,EAAgB,IAAA,EAAc,KAAA,EAA0B;AACvE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,4BAAA,EAA+B,KAAK,CAAA,IAAA,EAAO,IAAI,CAAA,CAAA,EAAI;AAAA,MAC9E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAQA,SAAS,qBAAA,CAAsB,KAAc,IAAA,EAA0B;AACrE,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,GAAA,EAAK,IAAA,EAAM,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAW,OAAO,EAAC;AACtC,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,IAAA,CAAK,KAAA,EAAO,MAAM,CAAA,OAAA,CAAS,CAAA;AACrD,EAAA,MAAM,UAAqD,EAAC;AAE5D,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,MAAM,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACxD,IAAA,MAAM,KAAA,GAAQ,sBAAsB,OAAO,CAAA;AAC3C,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,QAAA;AAAA,QACE,eAAe,OAAO,CAAA,CAAA;AAAA,QACtB,CAAA,4BAAA,EAA+B,OAAO,CAAA,8CAAA,EAAiD,MAAA,CAAO,KAAK,qBAAqB,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,iBAAA;AAAA,OACtI;AACA,MAAA;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAA,GAAI,CAAC,GAAI,QAAQ,KAAK,CAAA,IAAK,EAAC,EAAI,GAAG,kBAAA,CAAmB,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,EAC3F;AACA,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC1B;AAGA,SAAS,kBAAA,CAAmB,MAAA,EAAiB,IAAA,EAAc,OAAA,EAAgC;AACzF,EAAA,MAAM,WAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,YAAY,OAAA,CAAQ,MAAA,EAAQ,MAAM,CAAA,MAAA,EAAS,OAAO,EAAE,CAAA,EAAG;AAChE,IAAA,MAAM,QAAQ,QAAA,CAAS,QAAA,EAAU,IAAA,EAAM,CAAA,MAAA,EAAS,OAAO,CAAA,EAAA,CAAI,CAAA;AAC3D,IAAA,MAAM,UAAU,KAAA,CAAM,OAAA,KAAY,SAAY,MAAA,GAAY,MAAA,CAAO,MAAM,OAAO,CAAA;AAC9E,IAAA,KAAA,MAAW,MAAA,IAAU,QAAQ,KAAA,CAAM,KAAA,EAAO,MAAM,CAAA,MAAA,EAAS,OAAO,UAAU,CAAA,EAAG;AAC3E,MAAA,QAAA,CAAS,KAAK,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,IACtE;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,sBAAA,CACP,GAAA,EACA,OAAA,EACA,IAAA,EACA,OAAA,EACa;AACb,EAAA,MAAM,MAAM,QAAA,CAAS,GAAA,EAAK,IAAA,EAAM,CAAA,MAAA,EAAS,OAAO,CAAA,UAAA,CAAY,CAAA;AAC5D,EAAA,IAAI,GAAA,CAAI,SAAS,SAAA,EAAW;AAC1B,IAAA,MAAM,IAAIA,oCAAA;AAAA,MACR,uDAAuD,IAAA,CAAK,SAAA,CAAU,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAA,CAAA;AAAA,MAC3F,EAAE,MAAM,wBAAA;AAAyB,KACnC;AAAA,EACF;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,+CAAA,EAAkD,IAAI,CAAA,CAAA,EAAI;AAAA,MACrF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,EAAA,GAAkB,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAQ;AAC/C,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,EAAA,CAAG,OAAA,GAAU,OAAA;AACxC,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IAAY,GAAA,CAAI,UAAU,CAAA,EAAG;AACtD,IAAA,EAAA,CAAG,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,UAAU,GAAI,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,EAAA;AACT;;;ACxPA,IAAM,OAAA,GAAU,IAAIC,6BAAA,EAA0C;AAQvD,SAAS,sBAAA,CACd,KACA,EAAA,EACY;AACZ,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,EAAE,CAAA;AAC5B;AAQO,SAAS,yBAAA,GAAgE;AAC9E,EAAA,OAAO,QAAQ,QAAA,EAAS;AAC1B;AASO,SAAS,gCAAgC,OAAA,EAAuB;AACrE,EAAA,QAAA;AAAA,IACE,8BAA8B,OAAO,CAAA,CAAA;AAAA,IACrC,CAAA,0IAAA;AAAA,GACF;AACF","file":"chunk-LTLPBGHC.cjs","sourcesContent":["/**\n * Single source of truth for loading the hooks config (ADR 0016 — reverses\n * D74/D77 for hooks: JSON is canonical again, in the Claude Code shape).\n *\n * `.theokit/hooks.json` (Claude-Code-shaped JSON) is the only supported form.\n * A stray legacy `.theokit/hooks/*.md` dir (no hooks.json) is NOT loaded — it\n * warns to migrate and yields no hooks. Absent both → empty config.\n *\n * Consumed by `hooks-executor.ts` (runtime dispatch).\n *\n * Config shape (identical to Claude Code's `settings.json` hooks):\n *   { \"hooks\": { \"PreToolUse\": [ { \"matcher\": \"shell\",\n *       \"hooks\": [ { \"type\": \"command\", \"command\": \"…\", \"timeout\": 30 } ] } ] } }\n *\n * @internal\n */\n\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { ConfigurationError } from \"../../../errors.js\";\nimport { diag } from \"../../diagnostics.js\";\nimport { projectConfigRoots, theokitConfigRoot } from \"../../persistence/paths.js\";\nimport type { CompatSourceDeclaration } from \"../compat/foreign-config-sources.js\";\n\n/** The five lifecycle events the SDK runtime actually fires. */\nexport type HookEvent = \"preRun\" | \"postRun\" | \"preToolUse\" | \"postToolUse\" | \"stop\";\n\n/**\n * Claude Code event name → the SDK firing event. Only events the runtime\n * genuinely emits are mapped; a Claude Code event with no SDK firing point\n * (SessionStart / SubagentStop / PreCompact / Notification / SessionEnd) is\n * skipped with a warn rather than silently accepted (it would never run).\n */\nconst CLAUDE_CODE_EVENT_MAP: Readonly<Record<string, HookEvent>> = {\n  PreToolUse: \"preToolUse\",\n  PostToolUse: \"postToolUse\",\n  UserPromptSubmit: \"preRun\",\n  Stop: \"stop\",\n};\n\nexport interface HookCommand {\n  command: string;\n  matcher?: string;\n  timeoutMs?: number;\n  /**\n   * The config file this command was declared in.\n   *\n   * Carried so the executor can supply the runtime contract the declaring DIALECT presumes — a\n   * command from `.claude/settings.json` is written against Claude Code's runtime and expects\n   * `$CLAUDE_PROJECT_DIR` to exist (#522). Absent for a command built in memory, which is native by\n   * construction.\n   */\n  sourcePath?: string;\n}\n\nexport interface HookConfig {\n  hooks?: Partial<Record<HookEvent, HookCommand[]>>;\n}\n\nconst warned = new Set<string>();\n\n/**\n * Emit a stderr warn once per process per unique key. Helps surface the\n * deprecation path without spamming when the loader is called many times\n * during a session (cron + send + skills all hit this).\n *\n * Note: spawned workers (cron, subagent) start fresh processes — warn\n * re-emits there, by design (1 per process boot, not per call).\n *\n * @internal\n */\nexport function warnOnce(key: string, message: string): void {\n  if (warned.has(key)) return;\n  warned.add(key);\n  diag(`${message}\\n`);\n}\n\n/** Reset for tests; not exported via barrel. @internal */\nexport function _resetWarnOnceForTests(): void {\n  warned.clear();\n}\n\n/**\n * Load hooks from `.theokit/hooks.json` (Claude-Code-shaped — the only supported\n * form). A stray legacy `.theokit/hooks/*.md` markdown dir (no `hooks.json`) is\n * NOT loaded — it emits a one-time migration warn and yields no hooks.\n *\n * @internal\n */\nexport async function loadHookConfig(\n  cwd: string,\n  compatSources: readonly CompatSourceDeclaration[] = [],\n): Promise<HookConfig> {\n  const merged: HookConfig = {};\n  let sawAny = false;\n  for (const path of hookConfigCandidates(cwd, compatSources)) {\n    if (!existsSync(path)) continue;\n    sawAny = true;\n    // Stamped at merge, where the file is still known. One line later the commands are pooled per\n    // event and every trace of which dialect declared them is gone — which is how a Claude Code\n    // command came to be run without Claude Code's runtime (#522).\n    mergeInto(merged, stampSource(await readHookFile(path), path));\n  }\n  if (!sawAny && existsSync(join(theokitConfigRoot(cwd), \"hooks\"))) {\n    warnOnce(\n      \"hooks-md-unsupported\",\n      \"[theokit-sdk] .theokit/hooks/*.md hooks are no longer supported (ADR 0016) — migrate to a Claude-Code-shaped .theokit/hooks.json\",\n    );\n  }\n  return merged;\n}\n\n/**\n * Every file that may declare hooks, in precedence order.\n *\n * `hooks.json` under each project config root, then the Claude Code CLI's own settings files — which\n * is where the CLI actually keeps hooks, so a repository set up for it presents its hooks here\n * without being converted. `settings.local.json` is the CLI's personal-override file and sits beside\n * the shared one rather than replacing it.\n *\n * The shape never needed translating: `parseClaudeCodeConfig` reads the `hooks` key off whatever\n * object it is given, and a settings file is that same object with other keys alongside.\n */\nfunction hookConfigCandidates(\n  cwd: string,\n  compatSources: readonly CompatSourceDeclaration[],\n): string[] {\n  const roots = projectConfigRoots(cwd, compatSources, \"hooks\");\n  return [\n    ...roots.map((root) => join(root, \"hooks.json\")),\n    ...roots.map((root) => join(root, \"settings.json\")),\n    ...roots.map((root) => join(root, \"settings.local.json\")),\n  ];\n}\n\n/**\n * Record which file each command came from.\n *\n * A command already carrying a `sourcePath` keeps it: nothing produces that today, and a nested\n * config that declared its own origin would be describing something this function cannot see.\n */\nfunction stampSource(config: HookConfig, sourcePath: string): HookConfig {\n  if (config.hooks === undefined) return config;\n  const hooks: NonNullable<HookConfig[\"hooks\"]> = {};\n  for (const [event, commands] of Object.entries(config.hooks) as [\n    HookEvent,\n    HookCommand[] | undefined,\n  ][]) {\n    if (commands === undefined) continue;\n    hooks[event] = commands.map((c) => ({ sourcePath, ...c }));\n  }\n  return { hooks };\n}\n\n/**\n * Append one source's commands onto the accumulator, per event.\n *\n * MERGED, not first-wins, and the distinction is deliberate. An agent or a skill is a NAMED\n * declaration: two files claiming one name collide, and the explicit namespace should win. Hooks are\n * unnamed lists — two files declaring `PreToolUse` are two sets of commands an operator wrote, and\n * keeping only one drops the other in silence, which is the failure class this package guards\n * against everywhere else.\n */\nfunction mergeInto(target: HookConfig, source: HookConfig): void {\n  for (const [event, commands] of Object.entries(source.hooks ?? {}) as [\n    HookEvent,\n    HookCommand[] | undefined,\n  ][]) {\n    if (commands === undefined || commands.length === 0) continue;\n    target.hooks ??= {};\n    target.hooks[event] = [...(target.hooks[event] ?? []), ...commands];\n  }\n}\n\nasync function readHookFile(jsonPath: string): Promise<HookConfig> {\n  let raw: string;\n  try {\n    raw = await readFile(jsonPath, \"utf8\");\n  } catch (cause) {\n    throw new ConfigurationError(`Failed to read hooks config: ${jsonPath}`, {\n      code: \"hooks_read_error\",\n      cause,\n    });\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (cause) {\n    throw new ConfigurationError(`Invalid JSON in hooks config: ${jsonPath}`, {\n      code: \"hooks_json_invalid\",\n      cause,\n    });\n  }\n  return parseClaudeCodeConfig(parsed, jsonPath);\n}\n\n/** Narrow an unknown to a record, or throw a typed config error. */\nfunction asRecord(value: unknown, path: string, where: string): Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    throw new ConfigurationError(`hooks: expected an object at ${where} in ${path}`, {\n      code: \"hooks_json_invalid\",\n    });\n  }\n  return value as Record<string, unknown>;\n}\n\n/** Narrow an unknown to an array, or throw a typed config error. */\nfunction asArray(value: unknown, path: string, where: string): unknown[] {\n  if (!Array.isArray(value)) {\n    throw new ConfigurationError(`hooks: expected an array at ${where} in ${path}`, {\n      code: \"hooks_json_invalid\",\n    });\n  }\n  return value;\n}\n\n/**\n * Parse Claude Code's nested hooks config into the SDK's flat internal shape:\n * `{ hooks: { PreToolUse: [{ matcher?, hooks: [{ type:\"command\", command, timeout? }] }] } }`\n * → `{ hooks: { preToolUse: [{ command, matcher?, timeoutMs? }] } }`. Each group's\n * `matcher` applies to every command it wraps; `timeout` (seconds) → `timeoutMs`.\n */\nfunction parseClaudeCodeConfig(raw: unknown, path: string): HookConfig {\n  const root = asRecord(raw, path, \"the root\");\n  if (root.hooks === undefined) return {};\n  const hooksRec = asRecord(root.hooks, path, `\"hooks\"`);\n  const grouped: Partial<Record<HookEvent, HookCommand[]>> = {};\n\n  for (const [ccEvent, groups] of Object.entries(hooksRec)) {\n    const event = CLAUDE_CODE_EVENT_MAP[ccEvent];\n    if (event === undefined) {\n      warnOnce(\n        `hooks-event-${ccEvent}`,\n        `[theokit-sdk] hooks: event \"${ccEvent}\" is not fired by the SDK runtime (supported: ${Object.keys(CLAUDE_CODE_EVENT_MAP).join(\", \")}) — skipping`,\n      );\n      continue;\n    }\n    grouped[event] = [...(grouped[event] ?? []), ...flattenEventGroups(groups, path, ccEvent)];\n  }\n  return { hooks: grouped };\n}\n\n/** Flatten one Claude Code event's matcher-groups into internal HookCommands. */\nfunction flattenEventGroups(groups: unknown, path: string, ccEvent: string): HookCommand[] {\n  const commands: HookCommand[] = [];\n  for (const rawGroup of asArray(groups, path, `hooks.${ccEvent}`)) {\n    const group = asRecord(rawGroup, path, `hooks.${ccEvent}[]`);\n    const matcher = group.matcher === undefined ? undefined : String(group.matcher);\n    for (const rawCmd of asArray(group.hooks, path, `hooks.${ccEvent}[].hooks`)) {\n      commands.push(parseClaudeCodeCommand(rawCmd, matcher, path, ccEvent));\n    }\n  }\n  return commands;\n}\n\n/** One `{ type:\"command\", command, timeout? }` entry → an internal HookCommand. */\nfunction parseClaudeCodeCommand(\n  raw: unknown,\n  matcher: string | undefined,\n  path: string,\n  ccEvent: string,\n): HookCommand {\n  const cmd = asRecord(raw, path, `hooks.${ccEvent}[].hooks[]`);\n  if (cmd.type !== \"command\") {\n    throw new ConfigurationError(\n      `hooks: only { \"type\": \"command\" } is supported (got ${JSON.stringify(cmd.type)}) in ${path}`,\n      { code: \"hooks_unsupported_type\" },\n    );\n  }\n  if (typeof cmd.command !== \"string\" || cmd.command.length === 0) {\n    throw new ConfigurationError(`hooks: \"command\" must be a non-empty string in ${path}`, {\n      code: \"hooks_invalid_command\",\n    });\n  }\n  const hc: HookCommand = { command: cmd.command };\n  if (matcher !== undefined) hc.matcher = matcher;\n  if (typeof cmd.timeout === \"number\" && cmd.timeout > 0) {\n    hc.timeoutMs = Math.round(cmd.timeout * 1000);\n  }\n  return hc;\n}\n","/**\n * Personality fork-context (ADR D168 + EC-A snapshot semantic).\n *\n * Uses Node's `AsyncLocalStorage` so a fork's execution chain can know\n * that it is running inside a fork AND can see the slug that was active\n * on the parent **at fork-construction time**.\n *\n * **EC-A:** The slug stored here is captured ONCE at the wrap site\n * (`localAgentFork`) — passing `parentStore.active(parentAgentId)`\n * returns a primitive `string | undefined`, which is then frozen\n * inside the ALS context object. Subsequent `usePersonality` calls on\n * the parent do NOT mutate the fork's view, because the fork reads from\n * its own ALS frame, not from the parent's store.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\nimport { warnOnce } from \"../runtime/hooks/hooks-source.js\";\n\n/**\n * Snapshot data carried into a fork's async context.\n *\n * @internal\n */\nexport interface PersonalityForkContext {\n  /** Parent's active personality slug at fork-construction time. */\n  readonly slug: string | undefined;\n  /** Always `true` inside this scope (used by guards). */\n  readonly isFork: true;\n}\n\nconst storage = new AsyncLocalStorage<PersonalityForkContext>();\n\n/**\n * Run `fn` with `ctx` bound as the active fork context. Nested calls\n * shadow the outer context (EC-22).\n *\n * @internal\n */\nexport function withPersonalityContext<T>(\n  ctx: PersonalityForkContext,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return storage.run(ctx, fn);\n}\n\n/**\n * Return the active fork context, or `undefined` when called outside a\n * fork scope.\n *\n * @internal\n */\nexport function currentPersonalityContext(): PersonalityForkContext | undefined {\n  return storage.getStore();\n}\n\n/**\n * Emit one warning per agentId stating that personality switches inside\n * a fork are no-ops. The fork inherits the parent snapshot — runtime\n * mutation is intentionally rejected to keep fork voice deterministic.\n *\n * @internal\n */\nexport function warnPersonalitySwitchInsideFork(agentId: string): void {\n  warnOnce(\n    `personality-switch-in-fork-${agentId}`,\n    `[theokit-sdk] usePersonality is a no-op inside a fork (D168). Subagents inherit the parent's active personality at fork-construction time.`,\n  );\n}\n"]}
+{"version":3,"sources":["../src/internal/runtime/hooks/hooks-source.ts","../src/internal/personality/context.ts"],"names":["diag","existsSync","join","theokitConfigRoot","projectConfigRoots","readFile","ConfigurationError","AsyncLocalStorage"],"mappings":";;;;;;;;;;AAkCA,IAAM,qBAAA,GAA6D;AAAA,EACjE,UAAA,EAAY,YAAA;AAAA,EACZ,WAAA,EAAa,aAAA;AAAA,EACb,gBAAA,EAAkB,QAAA;AAAA,EAClB,IAAA,EAAM;AACR,CAAA;AAqBA,IAAM,MAAA,uBAAa,GAAA,EAAY;AAYxB,SAAS,QAAA,CAAS,KAAa,OAAA,EAAuB;AAC3D,EAAA,IAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,EAAG;AACrB,EAAA,MAAA,CAAO,IAAI,GAAG,CAAA;AACd,EAAAA,sBAAA,CAAK,GAAG,OAAO;AAAA,CAAI,CAAA;AACrB;AAcA,eAAsB,cAAA,CACpB,GAAA,EACA,aAAA,GAAoD,EAAC,EAChC;AACrB,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,oBAAA,CAAqB,GAAA,EAAK,aAAa,CAAA,EAAG;AAC3D,IAAA,IAAI,CAACC,aAAA,CAAW,IAAI,CAAA,EAAG;AACvB,IAAA,MAAA,GAAS,IAAA;AAIT,IAAA,SAAA,CAAU,QAAQ,WAAA,CAAY,MAAM,aAAa,IAAI,CAAA,EAAG,IAAI,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,CAAC,UAAUA,aAAA,CAAWC,SAAA,CAAKC,oCAAkB,GAAG,CAAA,EAAG,OAAO,CAAC,CAAA,EAAG;AAChE,IAAA,QAAA;AAAA,MACE,sBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAaA,SAAS,oBAAA,CACP,KACA,aAAA,EACU;AACV,EAAA,MAAM,KAAA,GAAQC,oCAAA,CAAmB,GAAA,EAAK,aAAA,EAAe,OAAO,CAAA;AAC5D,EAAA,OAAO;AAAA,IACL,GAAG,MAAM,GAAA,CAAI,CAAC,SAASF,SAAA,CAAK,IAAA,EAAM,YAAY,CAAC,CAAA;AAAA,IAC/C,GAAG,MAAM,GAAA,CAAI,CAAC,SAASA,SAAA,CAAK,IAAA,EAAM,eAAe,CAAC,CAAA;AAAA,IAClD,GAAG,MAAM,GAAA,CAAI,CAAC,SAASA,SAAA,CAAK,IAAA,EAAM,qBAAqB,CAAC;AAAA,GAC1D;AACF;AAQA,SAAS,WAAA,CAAY,QAAoB,UAAA,EAAgC;AACvE,EAAA,IAAI,MAAA,CAAO,KAAA,KAAU,MAAA,EAAW,OAAO,MAAA;AACvC,EAAA,MAAM,QAA0C,EAAC;AACjD,EAAA,KAAA,MAAW,CAAC,OAAO,QAAQ,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA,EAGtD;AACH,IAAA,IAAI,aAAa,MAAA,EAAW;AAC5B,IAAA,KAAA,CAAM,KAAK,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,CAAC,OAAO,EAAE,UAAA,EAAY,GAAG,CAAA,EAAE,CAAE,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,EAAE,KAAA,EAAM;AACjB;AAWA,SAAS,SAAA,CAAU,QAAoB,MAAA,EAA0B;AAC/D,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,QAAQ,CAAA,IAAK,MAAA,CAAO,QAAQ,MAAA,CAAO,KAAA,IAAS,EAAE,CAAA,EAG5D;AACH,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACrD,IAAA,MAAA,CAAO,UAAU,EAAC;AAClB,IAAA,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,GAAI,CAAC,GAAI,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,IAAK,EAAC,EAAI,GAAG,QAAQ,CAAA;AAAA,EACpE;AACF;AAEA,eAAe,aAAa,QAAA,EAAuC;AACjE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMG,iBAAA,CAAS,QAAA,EAAU,MAAM,CAAA;AAAA,EACvC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAIC,oCAAA,CAAmB,CAAA,6BAAA,EAAgC,QAAQ,CAAA,CAAA,EAAI;AAAA,MACvE,IAAA,EAAM,kBAAA;AAAA,MACN;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,8BAAA,EAAiC,QAAQ,CAAA,CAAA,EAAI;AAAA,MACxE,IAAA,EAAM,oBAAA;AAAA,MACN;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,OAAO,qBAAA,CAAsB,QAAQ,QAAQ,CAAA;AAC/C;AAGA,SAAS,QAAA,CAAS,KAAA,EAAgB,IAAA,EAAc,KAAA,EAAwC;AACtF,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACvE,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,6BAAA,EAAgC,KAAK,CAAA,IAAA,EAAO,IAAI,CAAA,CAAA,EAAI;AAAA,MAC/E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,OAAA,CAAQ,KAAA,EAAgB,IAAA,EAAc,KAAA,EAA0B;AACvE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,4BAAA,EAA+B,KAAK,CAAA,IAAA,EAAO,IAAI,CAAA,CAAA,EAAI;AAAA,MAC9E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAQA,SAAS,qBAAA,CAAsB,KAAc,IAAA,EAA0B;AACrE,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,GAAA,EAAK,IAAA,EAAM,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAW,OAAO,EAAC;AACtC,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,IAAA,CAAK,KAAA,EAAO,MAAM,CAAA,OAAA,CAAS,CAAA;AACrD,EAAA,MAAM,UAAqD,EAAC;AAE5D,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,MAAM,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACxD,IAAA,MAAM,KAAA,GAAQ,sBAAsB,OAAO,CAAA;AAC3C,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,QAAA;AAAA,QACE,eAAe,OAAO,CAAA,CAAA;AAAA,QACtB,CAAA,4BAAA,EAA+B,OAAO,CAAA,8CAAA,EAAiD,MAAA,CAAO,KAAK,qBAAqB,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,iBAAA;AAAA,OACtI;AACA,MAAA;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAA,GAAI,CAAC,GAAI,QAAQ,KAAK,CAAA,IAAK,EAAC,EAAI,GAAG,kBAAA,CAAmB,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,EAC3F;AACA,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC1B;AAGA,SAAS,kBAAA,CAAmB,MAAA,EAAiB,IAAA,EAAc,OAAA,EAAgC;AACzF,EAAA,MAAM,WAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,YAAY,OAAA,CAAQ,MAAA,EAAQ,MAAM,CAAA,MAAA,EAAS,OAAO,EAAE,CAAA,EAAG;AAChE,IAAA,MAAM,QAAQ,QAAA,CAAS,QAAA,EAAU,IAAA,EAAM,CAAA,MAAA,EAAS,OAAO,CAAA,EAAA,CAAI,CAAA;AAC3D,IAAA,MAAM,UAAU,KAAA,CAAM,OAAA,KAAY,SAAY,MAAA,GAAY,MAAA,CAAO,MAAM,OAAO,CAAA;AAC9E,IAAA,KAAA,MAAW,MAAA,IAAU,QAAQ,KAAA,CAAM,KAAA,EAAO,MAAM,CAAA,MAAA,EAAS,OAAO,UAAU,CAAA,EAAG;AAC3E,MAAA,QAAA,CAAS,KAAK,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,IACtE;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,sBAAA,CACP,GAAA,EACA,OAAA,EACA,IAAA,EACA,OAAA,EACa;AACb,EAAA,MAAM,MAAM,QAAA,CAAS,GAAA,EAAK,IAAA,EAAM,CAAA,MAAA,EAAS,OAAO,CAAA,UAAA,CAAY,CAAA;AAC5D,EAAA,IAAI,GAAA,CAAI,SAAS,SAAA,EAAW;AAC1B,IAAA,MAAM,IAAIA,oCAAA;AAAA,MACR,uDAAuD,IAAA,CAAK,SAAA,CAAU,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAA,CAAA;AAAA,MAC3F,EAAE,MAAM,wBAAA;AAAyB,KACnC;AAAA,EACF;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,+CAAA,EAAkD,IAAI,CAAA,CAAA,EAAI;AAAA,MACrF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,EAAA,GAAkB,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAQ;AAC/C,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,EAAA,CAAG,OAAA,GAAU,OAAA;AACxC,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IAAY,GAAA,CAAI,UAAU,CAAA,EAAG;AACtD,IAAA,EAAA,CAAG,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,UAAU,GAAI,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,EAAA;AACT;;;ACxPA,IAAM,OAAA,GAAU,IAAIC,6BAAA,EAA0C;AAQvD,SAAS,sBAAA,CACd,KACA,EAAA,EACY;AACZ,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,EAAE,CAAA;AAC5B;AAQO,SAAS,yBAAA,GAAgE;AAC9E,EAAA,OAAO,QAAQ,QAAA,EAAS;AAC1B;AASO,SAAS,gCAAgC,OAAA,EAAuB;AACrE,EAAA,QAAA;AAAA,IACE,8BAA8B,OAAO,CAAA,CAAA;AAAA,IACrC,CAAA,0IAAA;AAAA,GACF;AACF","file":"chunk-KGANQYP7.cjs","sourcesContent":["/**\n * Single source of truth for loading the hooks config (ADR 0016 — reverses\n * D74/D77 for hooks: JSON is canonical again, in the Claude Code shape).\n *\n * `.theokit/hooks.json` (Claude-Code-shaped JSON) is the only supported form.\n * A stray legacy `.theokit/hooks/*.md` dir (no hooks.json) is NOT loaded — it\n * warns to migrate and yields no hooks. Absent both → empty config.\n *\n * Consumed by `hooks-executor.ts` (runtime dispatch).\n *\n * Config shape (identical to Claude Code's `settings.json` hooks):\n *   { \"hooks\": { \"PreToolUse\": [ { \"matcher\": \"shell\",\n *       \"hooks\": [ { \"type\": \"command\", \"command\": \"…\", \"timeout\": 30 } ] } ] } }\n *\n * @internal\n */\n\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { ConfigurationError } from \"../../../errors.js\";\nimport { diag } from \"../../diagnostics.js\";\nimport { projectConfigRoots, theokitConfigRoot } from \"../../persistence/paths.js\";\nimport type { CompatSourceDeclaration } from \"../compat/foreign-config-sources.js\";\n\n/** The five lifecycle events the SDK runtime actually fires. */\nexport type HookEvent = \"preRun\" | \"postRun\" | \"preToolUse\" | \"postToolUse\" | \"stop\";\n\n/**\n * Claude Code event name → the SDK firing event. Only events the runtime\n * genuinely emits are mapped; a Claude Code event with no SDK firing point\n * (SessionStart / SubagentStop / PreCompact / Notification / SessionEnd) is\n * skipped with a warn rather than silently accepted (it would never run).\n */\nconst CLAUDE_CODE_EVENT_MAP: Readonly<Record<string, HookEvent>> = {\n  PreToolUse: \"preToolUse\",\n  PostToolUse: \"postToolUse\",\n  UserPromptSubmit: \"preRun\",\n  Stop: \"stop\",\n};\n\nexport interface HookCommand {\n  command: string;\n  matcher?: string;\n  timeoutMs?: number;\n  /**\n   * The config file this command was declared in.\n   *\n   * Carried so the executor can supply the runtime contract the declaring DIALECT presumes — a\n   * command from `.claude/settings.json` is written against Claude Code's runtime and expects\n   * `$CLAUDE_PROJECT_DIR` to exist (#522). Absent for a command built in memory, which is native by\n   * construction.\n   */\n  sourcePath?: string;\n}\n\nexport interface HookConfig {\n  hooks?: Partial<Record<HookEvent, HookCommand[]>>;\n}\n\nconst warned = new Set<string>();\n\n/**\n * Emit a stderr warn once per process per unique key. Helps surface the\n * deprecation path without spamming when the loader is called many times\n * during a session (cron + send + skills all hit this).\n *\n * Note: spawned workers (cron, subagent) start fresh processes — warn\n * re-emits there, by design (1 per process boot, not per call).\n *\n * @internal\n */\nexport function warnOnce(key: string, message: string): void {\n  if (warned.has(key)) return;\n  warned.add(key);\n  diag(`${message}\\n`);\n}\n\n/** Reset for tests; not exported via barrel. @internal */\nexport function _resetWarnOnceForTests(): void {\n  warned.clear();\n}\n\n/**\n * Load hooks from `.theokit/hooks.json` (Claude-Code-shaped — the only supported\n * form). A stray legacy `.theokit/hooks/*.md` markdown dir (no `hooks.json`) is\n * NOT loaded — it emits a one-time migration warn and yields no hooks.\n *\n * @internal\n */\nexport async function loadHookConfig(\n  cwd: string,\n  compatSources: readonly CompatSourceDeclaration[] = [],\n): Promise<HookConfig> {\n  const merged: HookConfig = {};\n  let sawAny = false;\n  for (const path of hookConfigCandidates(cwd, compatSources)) {\n    if (!existsSync(path)) continue;\n    sawAny = true;\n    // Stamped at merge, where the file is still known. One line later the commands are pooled per\n    // event and every trace of which dialect declared them is gone — which is how a Claude Code\n    // command came to be run without Claude Code's runtime (#522).\n    mergeInto(merged, stampSource(await readHookFile(path), path));\n  }\n  if (!sawAny && existsSync(join(theokitConfigRoot(cwd), \"hooks\"))) {\n    warnOnce(\n      \"hooks-md-unsupported\",\n      \"[theokit-sdk] .theokit/hooks/*.md hooks are no longer supported (ADR 0016) — migrate to a Claude-Code-shaped .theokit/hooks.json\",\n    );\n  }\n  return merged;\n}\n\n/**\n * Every file that may declare hooks, in precedence order.\n *\n * `hooks.json` under each project config root, then the Claude Code CLI's own settings files — which\n * is where the CLI actually keeps hooks, so a repository set up for it presents its hooks here\n * without being converted. `settings.local.json` is the CLI's personal-override file and sits beside\n * the shared one rather than replacing it.\n *\n * The shape never needed translating: `parseClaudeCodeConfig` reads the `hooks` key off whatever\n * object it is given, and a settings file is that same object with other keys alongside.\n */\nfunction hookConfigCandidates(\n  cwd: string,\n  compatSources: readonly CompatSourceDeclaration[],\n): string[] {\n  const roots = projectConfigRoots(cwd, compatSources, \"hooks\");\n  return [\n    ...roots.map((root) => join(root, \"hooks.json\")),\n    ...roots.map((root) => join(root, \"settings.json\")),\n    ...roots.map((root) => join(root, \"settings.local.json\")),\n  ];\n}\n\n/**\n * Record which file each command came from.\n *\n * A command already carrying a `sourcePath` keeps it: nothing produces that today, and a nested\n * config that declared its own origin would be describing something this function cannot see.\n */\nfunction stampSource(config: HookConfig, sourcePath: string): HookConfig {\n  if (config.hooks === undefined) return config;\n  const hooks: NonNullable<HookConfig[\"hooks\"]> = {};\n  for (const [event, commands] of Object.entries(config.hooks) as [\n    HookEvent,\n    HookCommand[] | undefined,\n  ][]) {\n    if (commands === undefined) continue;\n    hooks[event] = commands.map((c) => ({ sourcePath, ...c }));\n  }\n  return { hooks };\n}\n\n/**\n * Append one source's commands onto the accumulator, per event.\n *\n * MERGED, not first-wins, and the distinction is deliberate. An agent or a skill is a NAMED\n * declaration: two files claiming one name collide, and the explicit namespace should win. Hooks are\n * unnamed lists — two files declaring `PreToolUse` are two sets of commands an operator wrote, and\n * keeping only one drops the other in silence, which is the failure class this package guards\n * against everywhere else.\n */\nfunction mergeInto(target: HookConfig, source: HookConfig): void {\n  for (const [event, commands] of Object.entries(source.hooks ?? {}) as [\n    HookEvent,\n    HookCommand[] | undefined,\n  ][]) {\n    if (commands === undefined || commands.length === 0) continue;\n    target.hooks ??= {};\n    target.hooks[event] = [...(target.hooks[event] ?? []), ...commands];\n  }\n}\n\nasync function readHookFile(jsonPath: string): Promise<HookConfig> {\n  let raw: string;\n  try {\n    raw = await readFile(jsonPath, \"utf8\");\n  } catch (cause) {\n    throw new ConfigurationError(`Failed to read hooks config: ${jsonPath}`, {\n      code: \"hooks_read_error\",\n      cause,\n    });\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (cause) {\n    throw new ConfigurationError(`Invalid JSON in hooks config: ${jsonPath}`, {\n      code: \"hooks_json_invalid\",\n      cause,\n    });\n  }\n  return parseClaudeCodeConfig(parsed, jsonPath);\n}\n\n/** Narrow an unknown to a record, or throw a typed config error. */\nfunction asRecord(value: unknown, path: string, where: string): Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    throw new ConfigurationError(`hooks: expected an object at ${where} in ${path}`, {\n      code: \"hooks_json_invalid\",\n    });\n  }\n  return value as Record<string, unknown>;\n}\n\n/** Narrow an unknown to an array, or throw a typed config error. */\nfunction asArray(value: unknown, path: string, where: string): unknown[] {\n  if (!Array.isArray(value)) {\n    throw new ConfigurationError(`hooks: expected an array at ${where} in ${path}`, {\n      code: \"hooks_json_invalid\",\n    });\n  }\n  return value;\n}\n\n/**\n * Parse Claude Code's nested hooks config into the SDK's flat internal shape:\n * `{ hooks: { PreToolUse: [{ matcher?, hooks: [{ type:\"command\", command, timeout? }] }] } }`\n * → `{ hooks: { preToolUse: [{ command, matcher?, timeoutMs? }] } }`. Each group's\n * `matcher` applies to every command it wraps; `timeout` (seconds) → `timeoutMs`.\n */\nfunction parseClaudeCodeConfig(raw: unknown, path: string): HookConfig {\n  const root = asRecord(raw, path, \"the root\");\n  if (root.hooks === undefined) return {};\n  const hooksRec = asRecord(root.hooks, path, `\"hooks\"`);\n  const grouped: Partial<Record<HookEvent, HookCommand[]>> = {};\n\n  for (const [ccEvent, groups] of Object.entries(hooksRec)) {\n    const event = CLAUDE_CODE_EVENT_MAP[ccEvent];\n    if (event === undefined) {\n      warnOnce(\n        `hooks-event-${ccEvent}`,\n        `[theokit-sdk] hooks: event \"${ccEvent}\" is not fired by the SDK runtime (supported: ${Object.keys(CLAUDE_CODE_EVENT_MAP).join(\", \")}) — skipping`,\n      );\n      continue;\n    }\n    grouped[event] = [...(grouped[event] ?? []), ...flattenEventGroups(groups, path, ccEvent)];\n  }\n  return { hooks: grouped };\n}\n\n/** Flatten one Claude Code event's matcher-groups into internal HookCommands. */\nfunction flattenEventGroups(groups: unknown, path: string, ccEvent: string): HookCommand[] {\n  const commands: HookCommand[] = [];\n  for (const rawGroup of asArray(groups, path, `hooks.${ccEvent}`)) {\n    const group = asRecord(rawGroup, path, `hooks.${ccEvent}[]`);\n    const matcher = group.matcher === undefined ? undefined : String(group.matcher);\n    for (const rawCmd of asArray(group.hooks, path, `hooks.${ccEvent}[].hooks`)) {\n      commands.push(parseClaudeCodeCommand(rawCmd, matcher, path, ccEvent));\n    }\n  }\n  return commands;\n}\n\n/** One `{ type:\"command\", command, timeout? }` entry → an internal HookCommand. */\nfunction parseClaudeCodeCommand(\n  raw: unknown,\n  matcher: string | undefined,\n  path: string,\n  ccEvent: string,\n): HookCommand {\n  const cmd = asRecord(raw, path, `hooks.${ccEvent}[].hooks[]`);\n  if (cmd.type !== \"command\") {\n    throw new ConfigurationError(\n      `hooks: only { \"type\": \"command\" } is supported (got ${JSON.stringify(cmd.type)}) in ${path}`,\n      { code: \"hooks_unsupported_type\" },\n    );\n  }\n  if (typeof cmd.command !== \"string\" || cmd.command.length === 0) {\n    throw new ConfigurationError(`hooks: \"command\" must be a non-empty string in ${path}`, {\n      code: \"hooks_invalid_command\",\n    });\n  }\n  const hc: HookCommand = { command: cmd.command };\n  if (matcher !== undefined) hc.matcher = matcher;\n  if (typeof cmd.timeout === \"number\" && cmd.timeout > 0) {\n    hc.timeoutMs = Math.round(cmd.timeout * 1000);\n  }\n  return hc;\n}\n","/**\n * Personality fork-context (ADR D168 + EC-A snapshot semantic).\n *\n * Uses Node's `AsyncLocalStorage` so a fork's execution chain can know\n * that it is running inside a fork AND can see the slug that was active\n * on the parent **at fork-construction time**.\n *\n * **EC-A:** The slug stored here is captured ONCE at the wrap site\n * (`localAgentFork`) — passing `parentStore.active(parentAgentId)`\n * returns a primitive `string | undefined`, which is then frozen\n * inside the ALS context object. Subsequent `usePersonality` calls on\n * the parent do NOT mutate the fork's view, because the fork reads from\n * its own ALS frame, not from the parent's store.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\nimport { warnOnce } from \"../runtime/hooks/hooks-source.js\";\n\n/**\n * Snapshot data carried into a fork's async context.\n *\n * @internal\n */\nexport interface PersonalityForkContext {\n  /** Parent's active personality slug at fork-construction time. */\n  readonly slug: string | undefined;\n  /** Always `true` inside this scope (used by guards). */\n  readonly isFork: true;\n}\n\nconst storage = new AsyncLocalStorage<PersonalityForkContext>();\n\n/**\n * Run `fn` with `ctx` bound as the active fork context. Nested calls\n * shadow the outer context (EC-22).\n *\n * @internal\n */\nexport function withPersonalityContext<T>(\n  ctx: PersonalityForkContext,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return storage.run(ctx, fn);\n}\n\n/**\n * Return the active fork context, or `undefined` when called outside a\n * fork scope.\n *\n * @internal\n */\nexport function currentPersonalityContext(): PersonalityForkContext | undefined {\n  return storage.getStore();\n}\n\n/**\n * Emit one warning per agentId stating that personality switches inside\n * a fork are no-ops. The fork inherits the parent snapshot — runtime\n * mutation is intentionally rejected to keep fork voice deterministic.\n *\n * @internal\n */\nexport function warnPersonalitySwitchInsideFork(agentId: string): void {\n  warnOnce(\n    `personality-switch-in-fork-${agentId}`,\n    `[theokit-sdk] usePersonality is a no-op inside a fork (D168). Subagents inherit the parent's active personality at fork-construction time.`,\n  );\n}\n"]}

package/dist/{chunk-XDANGA2C.js → chunk-LX7SEXOQ.js}

@@ -129,6 +129,9 @@ function tryParseSkill(raw, fallbackName, source, options) {
     throw cause;
   }
 }
+async function loadSkillInstructions(skill) {
+  return stripSkillFrontmatter(await readFile(skill.source, "utf8"));
+}
 
 // src/internal/runtime/system-prompt/escape.ts
 var escapeBlockBody = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -144,6 +147,6 @@ ${lines.join("\n")}
 </skills>`;
 }
 
-export { buildSkillsBlock, discoverSkills, escapeBlockBody, stripSkillFrontmatter };
-//# sourceMappingURL=chunk-XDANGA2C.js.map
-//# sourceMappingURL=chunk-XDANGA2C.js.map
+export { buildSkillsBlock, discoverSkills, escapeBlockBody, loadSkillInstructions, stripSkillFrontmatter };
+//# sourceMappingURL=chunk-LX7SEXOQ.js.map
+//# sourceMappingURL=chunk-LX7SEXOQ.js.map

package/dist/chunk-LX7SEXOQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/runtime/skills/skill-frontmatter.ts","../src/internal/runtime/skills/discover-skills.ts","../src/internal/runtime/system-prompt/escape.ts","../src/internal/runtime/skills/skills-block.ts"],"names":[],"mappings":";;;;;;;AAMA,SAAS,SAAS,CAAA,EAAqD;AACrE,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AACrC;AAGA,SAAS,eAAe,GAAA,EAAiE;AACvF,EAAA,MAAM,MAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,QAAA,CAAS,CAAC,CAAA;AAC7D,EAAA,OAAO,GAAA;AACT;AA8BO,SAAS,qBAAA,CAAsB,KAAa,YAAA,EAAwC;AACzF,EAAA,MAAM,MAAA,GAAS,0BAAA,CAA2B,GAAA,EAAK,YAAY,CAAA;AAC3D,EAAA,MAAM,IAAA,GAAO,WAAA,CAAY,MAAA,EAAQ,YAAY,CAAA;AAC7C,EAAA,oBAAA,CAAqB,QAAQ,IAAI,CAAA;AACjC,EAAA,OAAO,gBAAA,CAAiB,QAAQ,IAAI,CAAA;AACtC;AAOO,SAAS,sBAAsB,GAAA,EAAqB;AACzD,EAAA,MAAM,KAAA,GAAQ,6BAAA,CAA8B,IAAA,CAAK,GAAG,CAAA;AACpD,EAAA,OAAA,CAAQ,KAAA,KAAU,IAAA,GAAO,GAAA,GAAM,GAAA,CAAI,KAAA,CAAM,MAAM,CAAC,CAAA,CAAE,MAAM,CAAA,EAAG,IAAA,EAAK;AAClE;AAEA,SAAS,0BAAA,CAA2B,KAAa,YAAA,EAAoC;AACnF,EAAA,MAAM,KAAA,GAAQ,+BAAA,CAAgC,IAAA,CAAK,GAAG,CAAA;AACtD,EAAA,IAAI,UAAU,IAAA,EAAM;AAClB,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,MAAA,EAAS,YAAY,CAAA,uBAAA,CAAA,EAA2B;AAAA,MAC3E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AAGhC,EAAA,IAAI;AACF,IAAA,OAAO,cAAA,CAAe,eAAA,CAAgB,WAAW,CAAC,CAAA;AAAA,EACpD,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,SAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACpE,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,CAAA,MAAA,EAAS,YAAY,CAAA,iCAAA,EAAoC,MAAM,CAAA,CAAA;AAAA,MAC/D,EAAE,IAAA,EAAM,gBAAA,EAAkB,KAAA;AAAM,KAClC;AAAA,EACF;AACF;AAEA,SAAS,WAAA,CAAY,QAAsB,YAAA,EAA8B;AACvE,EAAA,IAAI,UAAA,CAAW,MAAA,CAAO,IAAI,CAAA,SAAU,MAAA,CAAO,IAAA;AAC3C,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG,OAAO,YAAA;AACrC,EAAA,MAAM,IAAI,mBAAmB,uDAAA,EAAyD;AAAA,IACpF,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAEA,SAAS,oBAAA,CAAqB,QAAsB,IAAA,EAAoB;AACtE,EAAA,IAAI,CAAC,UAAA,CAAW,MAAA,CAAO,WAAW,CAAA,EAAG;AACnC,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,MAAA,EAAS,IAAI,CAAA,uCAAA,CAAA,EAA2C;AAAA,MACnF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AAEA,SAAS,gBAAA,CAAiB,QAAsB,IAAA,EAAgC;AAC9E,EAAA,MAAM,cAAc,MAAA,CAAO,WAAA;AAC3B,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAE7B,IAAA,MAAM,IAAI,mBAAmB,CAAA,MAAA,EAAS,IAAI,wBAAwB,EAAE,IAAA,EAAM,kBAAkB,CAAA;AAAA,EAC9F;AACA,EAAA,MAAM,MAAA,GAA2B,EAAE,IAAA,EAAM,WAAA,EAAY;AACrD,EAAA,IAAI,WAAW,MAAA,CAAO,QAAQ,CAAA,EAAG,MAAA,CAAO,WAAW,MAAA,CAAO,QAAA;AAC1D,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,MAAA,CAAO,YAAY,CAAA;AAClD,EAAA,IAAI,IAAA,KAAS,MAAA,EAAW,MAAA,CAAO,YAAA,GAAe,IAAA;AAC9C,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,kBAAkB,GAAA,EAA+C;AACxE,EAAA,IAAI,CAAC,UAAA,CAAW,GAAG,CAAA,EAAG,OAAO,MAAA;AAC7B,EAAA,MAAM,OAAQ,GAAA,CACX,KAAA,CAAM,GAAG,CAAA,CACT,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA,GAAS,CAAA,GAAI,IAAA,GAAO,MAAA;AAClC;AAEA,SAAS,WAAW,KAAA,EAA4C;AAC9D,EAAA,OAAO,KAAA,KAAU,MAAA,IAAa,KAAA,CAAM,IAAA,GAAO,MAAA,GAAS,CAAA;AACtD;;;AC7CA,eAAsB,cAAA,CACpB,KACA,OAAA,EACkB;AAClB,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,gBAAA,CAAiB,GAAA,EAAK,mBAAA,EAAqB,kBAAkB,CAAA;AAAA,EAC/E,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,SAAkB,EAAC;AACzB,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,IAAI,CAAC,KAAA,CAAM,WAAA,EAAY,EAAG;AAC1B,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,YAAA,CAAa,GAAA,EAAK,KAAA,CAAM,IAAI,CAAA;AACvC,MAAA,qBAAA,CAAsB,UAAU,GAAG,CAAA;AAAA,IACrC,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,QAAA,EAAU,UAAU,CAAA;AAC3C,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,QAAA,CAAS,SAAA,EAAW,MAAM,CAAA;AAAA,IACxC,CAAA,CAAA,MAAQ;AAEN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,QAAQ,aAAA,CAAc,GAAA,EAAK,KAAA,CAAM,IAAA,EAAM,WAAW,OAAO,CAAA;AAC/D,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,aAAA,CACP,GAAA,EACA,YAAA,EACA,MAAA,EACA,OAAA,EACmB;AACnB,EAAA,IAAI;AACF,IAAA,MAAM,WAAA,GAAc,qBAAA,CAAsB,GAAA,EAAK,YAAY,CAAA;AAC3D,IAAA,MAAM,KAAA,GAAe;AAAA,MACnB,MAAM,WAAA,CAAY,IAAA;AAAA,MAClB,aAAa,WAAA,CAAY,WAAA;AAAA,MACzB;AAAA,KACF;AACA,IAAA,IAAI,WAAA,CAAY,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,WAAW,WAAA,CAAY,QAAA;AACrE,IAAA,IAAI,WAAA,CAAY,YAAA,KAAiB,KAAA,CAAA,EAAW,KAAA,CAAM,eAAe,WAAA,CAAY,YAAA;AAC7E,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,iBAAiB,kBAAA,EAAoB;AACvC,MAAA,OAAA,EAAS,cAAA,GAAiB;AAAA,QACxB,IAAA,EAAM,YAAA;AAAA,QACN,MAAA;AAAA,QACA,IAAA,EAAM,MAAM,IAAA,IAAQ,SAAA;AAAA,QACpB,SAAS,KAAA,CAAM;AAAA,OAChB,CAAA;AACD,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAoCA,eAAsB,sBAAsB,KAAA,EAA+B;AACzE,EAAA,OAAO,sBAAsB,MAAM,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,MAAM,CAAC,CAAA;AACnE;;;AC5KO,IAAM,eAAA,GAAkB,CAAC,CAAA,KAC9B,CAAA,CAAE,QAAQ,IAAA,EAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA,CAAE,OAAA,CAAQ,MAAM,MAAM;;;ACO9D,SAAS,iBACd,MAAA,EACoB;AACpB,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAChC,EAAA,MAAM,QAAQ,MAAA,CAAO,GAAA;AAAA,IACnB,CAAC,KAAA,KAAU,CAAA,IAAA,EAAO,eAAA,CAAgB,KAAA,CAAM,IAAI,CAAC,CAAA,EAAA,EAAK,eAAA,CAAgB,KAAA,CAAM,WAAW,CAAC,CAAA;AAAA,GACtF;AACA,EAAA,OAAO,CAAA;AAAA,EAAa,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,SAAA,CAAA;AACtC","file":"chunk-LX7SEXOQ.js","sourcesContent":["import { ConfigurationError } from \"../../../errors.js\";\nimport { type FrontmatterValue, parseSimpleYaml } from \"../context/yaml-frontmatter.js\";\n\ntype StringFields = Record<string, string | undefined>;\n\n/** Narrow a FrontmatterValue to string; non-strings + undefined → undefined. */\nfunction asString(v: FrontmatterValue | undefined): string | undefined {\n  return typeof v === \"string\" ? v : undefined;\n}\n\n/** Coerce parser output to legacy string-only shape (skill schema is all-string). */\nfunction toStringFields(raw: Record<string, FrontmatterValue | undefined>): StringFields {\n  const out: StringFields = {};\n  for (const [k, v] of Object.entries(raw)) out[k] = asString(v);\n  return out;\n}\n\n/**\n * Strict skill frontmatter schema (ADR D10).\n *\n * Required: `name`, `description`.\n * Optional: `category`, `dependencies` (comma-separated string in the\n * simple-YAML dialect — parsed to `string[]`).\n *\n * Unknown fields are ignored (forward-compat). Malformed YAML or missing\n * required fields surface as `ConfigurationError` with one of the typed\n * codes below.\n *\n * @internal\n */\nexport interface SkillFrontmatter {\n  name: string;\n  description: string;\n  category?: string;\n  dependencies?: string[];\n}\n\n/**\n * Parse a SKILL.md file body into validated frontmatter.\n *\n * @throws ConfigurationError(code: \"missing_frontmatter\") — no `---` block at file head.\n * @throws ConfigurationError(code: \"schema_invalid\") — YAML malformed OR required field missing.\n *\n * @internal\n */\nexport function parseSkillFrontmatter(raw: string, fallbackName: string): SkillFrontmatter {\n  const fields = extractAndParseFrontmatter(raw, fallbackName);\n  const name = resolveName(fields, fallbackName);\n  ensureRequiredFields(fields, name);\n  return buildFrontmatter(fields, name);\n}\n\n/**\n * SE20 — return a SKILL.md's BODY (everything after the frontmatter block), trimmed.\n * When there is no frontmatter block, the whole file is the body. Reuses the same\n * frontmatter regex as {@link parseSkillFrontmatter} (DRY).\n */\nexport function stripSkillFrontmatter(raw: string): string {\n  const match = /^---\\s*\\n[\\s\\S]*?\\n---\\s*\\n/.exec(raw);\n  return (match === null ? raw : raw.slice(match[0].length)).trim();\n}\n\nfunction extractAndParseFrontmatter(raw: string, fallbackName: string): StringFields {\n  const match = /^---\\s*\\n([\\s\\S]*?)\\n---\\s*\\n/.exec(raw);\n  if (match === null) {\n    throw new ConfigurationError(`Skill ${fallbackName} is missing frontmatter`, {\n      code: \"missing_frontmatter\",\n    });\n  }\n  const frontmatter = match[1] ?? \"\";\n  // EC-5: guard against syntactically invalid frontmatter so the loader\n  // surfaces schema_invalid rather than crashing.\n  try {\n    return toStringFields(parseSimpleYaml(frontmatter));\n  } catch (cause) {\n    const detail = cause instanceof Error ? cause.message : String(cause);\n    throw new ConfigurationError(\n      `Skill ${fallbackName} has malformed YAML frontmatter: ${detail}`,\n      { code: \"schema_invalid\", cause },\n    );\n  }\n}\n\nfunction resolveName(fields: StringFields, fallbackName: string): string {\n  if (hasContent(fields.name)) return fields.name;\n  if (hasContent(fallbackName)) return fallbackName;\n  throw new ConfigurationError(\"Skill at unknown path is missing required field: name\", {\n    code: \"schema_invalid\",\n  });\n}\n\nfunction ensureRequiredFields(fields: StringFields, name: string): void {\n  if (!hasContent(fields.description)) {\n    throw new ConfigurationError(`Skill ${name} is missing required field: description`, {\n      code: \"schema_invalid\",\n    });\n  }\n}\n\nfunction buildFrontmatter(fields: StringFields, name: string): SkillFrontmatter {\n  const description = fields.description;\n  if (description === undefined) {\n    // ensureRequiredFields already threw; this is unreachable but satisfies TS\n    throw new ConfigurationError(`Skill ${name} missing description`, { code: \"schema_invalid\" });\n  }\n  const result: SkillFrontmatter = { name, description };\n  if (hasContent(fields.category)) result.category = fields.category;\n  const deps = parseDependencies(fields.dependencies);\n  if (deps !== undefined) result.dependencies = deps;\n  return result;\n}\n\nfunction parseDependencies(raw: string | undefined): string[] | undefined {\n  if (!hasContent(raw)) return undefined;\n  const deps = (raw as string)\n    .split(\",\")\n    .map((s) => s.trim())\n    .filter((s) => s.length > 0);\n  return deps.length > 0 ? deps : undefined;\n}\n\nfunction hasContent(value: string | undefined): value is string {\n  return value !== undefined && value.trim().length > 0;\n}\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { ConfigurationError } from \"../../../errors.js\";\nimport { assertNoSymlinkEscape, safePathJoin } from \"../../security/path-guard.js\";\nimport { readWorkspaceDir } from \"../config/workspace-dir.js\";\nimport { parseSkillFrontmatter, stripSkillFrontmatter } from \"./skill-frontmatter.js\";\n\n/**\n * A discovered skill's metadata. The skill BODY is never included — only the\n * strict frontmatter fields plus the resolved `source` path.\n *\n * Public via `@theokit/sdk/skills`.\n *\n * @public\n */\nexport interface Skill {\n  name: string;\n  description: string;\n  /** Absolute path to the discovered `SKILL.md`. */\n  source: string;\n  category?: string;\n  dependencies?: string[];\n}\n\n/**\n * Information passed to `onInvalidSkill` when a `SKILL.md` is present but its\n * frontmatter is malformed (missing required field or invalid YAML).\n *\n * @public\n */\nexport interface InvalidSkillInfo {\n  /** The skill directory name (used as the fallback skill name). */\n  name: string;\n  /** Absolute path to the offending `SKILL.md`. */\n  source: string;\n  /** Typed reason: `missing_frontmatter` or `schema_invalid`. */\n  code: string;\n  message: string;\n}\n\n/**\n * Options for {@link discoverSkills}.\n *\n * @public\n */\nexport interface DiscoverSkillsOptions {\n  /**\n   * Called once per directory that contains a `SKILL.md` with malformed\n   * frontmatter. The skill is excluded from the result; discovery continues\n   * (strict-frontmatter ADR / EC-5). A directory WITHOUT a `SKILL.md` is NOT a\n   * malformed skill and does not trigger this callback.\n   *\n   * Default: no-op (a library primitive must not write to the consumer's\n   * stderr by default).\n   */\n  onInvalidSkill?: (info: InvalidSkillInfo) => void;\n}\n\n/**\n * Discover `SKILL.md` skills under an arbitrary directory.\n *\n * For each immediate subdirectory `<dir>/<name>/` containing a `SKILL.md`, the\n * file's strict YAML frontmatter is parsed (`name`/`description` required;\n * `category`/`dependencies` optional). Malformed skills are skipped (optionally\n * reported via {@link DiscoverSkillsOptions.onInvalidSkill}); a subdirectory\n * whose realpath escapes `dir` (via symlink) is skipped (symlink-escape guard,\n * reusing `@theokit/sdk/path-safety`).\n *\n * NEVER throws: a missing, unreadable, or non-directory `dir` yields `[]`.\n *\n * Discovery order follows the filesystem `readdir` order (OS-dependent). Sort\n * the result before {@link buildSkillsBlock} if a stable block order matters.\n *\n * Public via `@theokit/sdk/skills`.\n *\n * @public\n */\nexport async function discoverSkills(\n  dir: string,\n  options?: DiscoverSkillsOptions,\n): Promise<Skill[]> {\n  let entries: Awaited<ReturnType<typeof readWorkspaceDir>>;\n  try {\n    entries = await readWorkspaceDir(dir, \"skills_read_error\", \"skills directory\");\n  } catch {\n    // never-throw contract: unreadable / not-a-directory → no skills (EC-1)\n    return [];\n  }\n\n  const skills: Skill[] = [];\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n    let skillDir: string;\n    try {\n      skillDir = safePathJoin(dir, entry.name);\n      assertNoSymlinkEscape(skillDir, dir);\n    } catch {\n      continue;\n    }\n    const skillPath = join(skillDir, \"SKILL.md\");\n    let raw: string;\n    try {\n      raw = await readFile(skillPath, \"utf8\");\n    } catch {\n      // no SKILL.md in this subdir → not a skill, not an error (EC-2)\n      continue;\n    }\n    const skill = tryParseSkill(raw, entry.name, skillPath, options);\n    if (skill !== undefined) skills.push(skill);\n  }\n  return skills;\n}\n\nfunction tryParseSkill(\n  raw: string,\n  fallbackName: string,\n  source: string,\n  options: DiscoverSkillsOptions | undefined,\n): Skill | undefined {\n  try {\n    const frontmatter = parseSkillFrontmatter(raw, fallbackName);\n    const skill: Skill = {\n      name: frontmatter.name,\n      description: frontmatter.description,\n      source,\n    };\n    if (frontmatter.category !== undefined) skill.category = frontmatter.category;\n    if (frontmatter.dependencies !== undefined) skill.dependencies = frontmatter.dependencies;\n    return skill;\n  } catch (cause) {\n    if (cause instanceof ConfigurationError) {\n      options?.onInvalidSkill?.({\n        name: fallbackName,\n        source,\n        code: cause.code ?? \"unknown\",\n        message: cause.message,\n      });\n      return undefined;\n    }\n    throw cause;\n  }\n}\n\n/**\n * Read the BODY of a discovered skill — everything after its frontmatter.\n *\n * A thin selector over {@link discoverSkills} rather than a second reader, which is the same\n * relationship `loadSubagentDefinition` has to `discoverSubagents` in the sibling domain: one\n * parser is the point.\n *\n * ## Why this exists rather than a field on `Skill`\n *\n * `Skill` documents that *\"the skill BODY is never included\"*. That is a written contract with no\n * written reason, and widening it on a guess about the reason is not a trade worth making — a\n * catalog you can put in a prompt without carrying every body is the likely intent, and this keeps\n * that shape intact for whoever relied on it.\n *\n * The body was never expensive to obtain: `discoverSkills` already reads each file in full and\n * discards everything but the frontmatter. What was missing was a door that hands it over.\n *\n * ## What it is for\n *\n * Turning a discovered skill into an inline one — `SkillsSettings.inline` requires `instructions`,\n * and without this the only route was to open `source` and split the frontmatter by hand. That is a\n * second implementation of this module's own convention, and it would fail SILENTLY if the format\n * moved: the frontmatter would land inside the instructions and nothing would say so.\n *\n * Reported by the `theocode` session, which needed exactly that to give an operator's\n * `~/.theokit/skills/` to an agent through the SDK's own parser.\n *\n * @param skill - a record returned by {@link discoverSkills}; its `source` is read.\n * @returns the trimmed body. A file that is all frontmatter yields an empty string.\n * @throws if `source` is unreadable — unlike discovery, which skips what it cannot read, a caller\n *   naming ONE skill has asked about that skill and an empty string would answer a question it did\n *   not ask.\n * @public\n */\nexport async function loadSkillInstructions(skill: Skill): Promise<string> {\n  return stripSkillFrontmatter(await readFile(skill.source, \"utf8\"));\n}\n","/**\n * Block-body XML escape (ADR D9 — prompt-injection defence).\n *\n * Order matters: `&` MUST be escaped first so subsequent `<`/`>` replacements\n * do not double-encode the `&` characters they introduce.\n *\n * @internal\n */\nexport const escapeBlockBody = (s: string): string =>\n  s.replace(/&/g, \"&amp;\").replace(/</g, \"&lt;\").replace(/>/g, \"&gt;\");\n","import { escapeBlockBody } from \"../system-prompt/escape.js\";\n\n/**\n * Render the `<skills>` system-prompt block from a skill list.\n *\n * Input is the structural subset `{ name, description }` — the skill BODY is\n * NOT in the type, so it cannot leak into the prompt. Both fields are passed\n * through `escapeBlockBody` to neutralise prompt-injection vectors hidden in\n * user-controlled SKILL.md frontmatter (injection-escape ADR).\n *\n * Returns `undefined` for an empty list so the caller can omit the block.\n *\n * Public via `@theokit/sdk/skills`.\n *\n * @public\n */\nexport function buildSkillsBlock(\n  skills: ReadonlyArray<{ name: string; description: string }>,\n): string | undefined {\n  if (skills.length === 0) return undefined;\n  const lines = skills.map(\n    (skill) => `  - ${escapeBlockBody(skill.name)}: ${escapeBlockBody(skill.description)}`,\n  );\n  return `<skills>\\n${lines.join(\"\\n\")}\\n</skills>`;\n}\n"]}

package/dist/{chunk-QME6FDFG.cjs → chunk-NQTD6QOW.cjs}

@@ -61,13 +61,29 @@ async function collectChildToolResults(run) {
 ${lines.join("\n")}
 </subagent-tool-results>`;
 }
+function buildChildLocalOptions(sandbox, inherited) {
+  const local = {};
+  if (sandbox !== void 0) local.sandboxOptions = { enabled: sandbox };
+  if (inherited?.settingSources !== void 0) local.settingSources = [...inherited.settingSources];
+  if (inherited?.compatSources !== void 0) local.compatSources = [...inherited.compatSources];
+  return Object.keys(local).length > 0 ? local : void 0;
+}
+function buildChildWithheldBuiltins(spec, inherited) {
+  const own = spec.withheldBuiltinTools;
+  const parent = inherited?.withheldBuiltinTools;
+  if (own === void 0 && parent === void 0) return void 0;
+  return [.../* @__PURE__ */ new Set([...parent ?? [], ...own ?? []])];
+}
 function buildChildCreateOptions(spec, inherited) {
   const model = spec.model !== void 0 ? typeof spec.model === "string" ? { id: spec.model } : spec.model : inherited?.model;
   const sandbox = spec.sandbox ?? inherited?.sandbox;
+  const local = buildChildLocalOptions(sandbox, inherited);
+  const withheld = buildChildWithheldBuiltins(spec, inherited);
   return {
     ...inherited?.apiKey !== void 0 ? { apiKey: inherited.apiKey } : {},
     ...model !== void 0 ? { model } : {},
-    ...sandbox !== void 0 ? { local: { sandboxOptions: { enabled: sandbox } } } : {},
+    ...local !== void 0 ? { local } : {},
+    ...withheld !== void 0 ? { withheldBuiltinTools: withheld } : {},
     ...inherited?.plugins !== void 0 ? { plugins: inherited.plugins } : {},
     systemPrompt: spec.instructions,
     tools: spec.tools ?? []
@@ -206,5 +222,5 @@ exports.MaxDelegationDepthError = MaxDelegationDepthError;
 exports.SubAgent = SubAgent;
 exports.subAgentToolsFromDefinitions = subAgentToolsFromDefinitions;
 exports.withInheritedSubAgentCredentials = withInheritedSubAgentCredentials;
-//# sourceMappingURL=chunk-QME6FDFG.cjs.map
-//# sourceMappingURL=chunk-QME6FDFG.cjs.map
+//# sourceMappingURL=chunk-NQTD6QOW.cjs.map
+//# sourceMappingURL=chunk-NQTD6QOW.cjs.map

package/dist/chunk-NQTD6QOW.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/concurrency/delegation-depth.ts","../src/internal/concurrency/subagent-credentials.ts","../src/a2a/subagent.ts"],"names":["AsyncLocalStorage","TheokitAgentError","getAgentFacade","z"],"mappings":";;;;;;;AA6BA,IAAM,UAAA,GAAa,IAAIA,6BAAA,EAA0B;AAWjD,eAAsB,mBAAA,CAAuB,OAAe,EAAA,EAAkC;AAC5F,EAAA,OAAO,UAAA,CAAW,GAAA,CAAI,KAAA,EAAO,EAAE,CAAA;AACjC;AAUO,SAAS,sBAAA,GAAiC;AAC/C,EAAA,OAAO,UAAA,CAAW,UAAS,IAAK,CAAA;AAClC;ACkEA,IAAM,gBAAA,GAAmB,IAAIA,6BAAAA,EAAwC;AAUrE,eAAsB,gCAAA,CACpB,aACA,EAAA,EACY;AACZ,EAAA,OAAO,gBAAA,CAAiB,GAAA,CAAI,WAAA,EAAa,EAAE,CAAA;AAC7C;AAWO,SAAS,mCAAA,GAAwE;AACtF,EAAA,OAAO,iBAAiB,QAAA,EAAS;AACnC;;;ACwFO,IAAM,uBAAA,GAAN,cAAsCC,mCAAA,CAAkB;AAAA,EAG7D,WAAA,CACkB,cACA,QAAA,EAChB;AAEA,IAAA,KAAA,CAAM,CAAA,qBAAA,EAAwB,QAAQ,CAAA,oBAAA,EAAuB,YAAY,CAAA,CAAA,CAAA,EAAK;AAAA,MAC5E,IAAA,EAAM,sBAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACd,CAAA;AAPe,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAOlB;AAAA,EARkB,YAAA;AAAA,EACA,QAAA;AAAA,EAJA,IAAA,GAAO,yBAAA;AAAA,EACP,IAAA,GAAO,sBAAA;AAW3B;AAMA,eAAe,oBAAA,CACb,IAAA,EACA,KAAA,EACA,SAAA,EACoE;AACpE,EAAA,IAAI,IAAA,CAAK,iBAAA,KAAsB,MAAA,EAAW,OAAO,EAAE,KAAA,EAAM;AACzD,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,iBAAA,CAAkB,EAAE,OAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,SAAA,EAAW,CAAA;AACnF,EAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,EAAE,KAAA,EAAM;AAC3C,EAAA,IAAI,SAAS,OAAA,KAAY,KAAA;AACvB,IAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,CAAS,eAAA,IAAmB,uBAAA,EAAwB;AACvE,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,SAAS,aAAA,IAAiB,KAAA;AAAA,IACjC,GAAI,SAAS,gBAAA,KAAqB,MAAA,GAAY,EAAE,QAAA,EAAU,QAAA,CAAS,gBAAA,EAAiB,GAAI;AAAC,GAC3F;AACF;AAOA,eAAe,wBAAwB,GAAA,EAA2B;AAChE,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,WAAA,MAAiB,KAAA,IAAS,GAAA,CAAI,MAAA,EAAO,EAAG;AACtC,IAAA,IAAI,KAAA,CAAM,IAAA,KAAS,WAAA,IAAe,KAAA,CAAM,WAAW,WAAA,EAAa;AAC9D,MAAA,MAAM,QAAA,GACJ,OAAO,KAAA,CAAM,MAAA,KAAW,QAAA,GAAW,KAAA,CAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,MAAA,IAAU,IAAI,CAAA;AACvF,MAAA,KAAA,CAAM,KAAK,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAE,CAAA;AAAA,IACzC;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,OAAO;;AAAA;AAAA,EAAgC,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,wBAAA,CAAA;AACzD;AAkBA,SAAS,sBAAA,CACP,SACA,SAAA,EACmC;AACnC,EAAA,MAAM,QAA4C,EAAC;AACnD,EAAA,IAAI,YAAY,MAAA,EAAW,KAAA,CAAM,cAAA,GAAiB,EAAE,SAAS,OAAA,EAAQ;AACrE,EAAA,IAAI,SAAA,EAAW,mBAAmB,MAAA,EAAW,KAAA,CAAM,iBAAiB,CAAC,GAAG,UAAU,cAAc,CAAA;AAChG,EAAA,IAAI,SAAA,EAAW,kBAAkB,MAAA,EAAW,KAAA,CAAM,gBAAgB,CAAC,GAAG,UAAU,aAAa,CAAA;AAC7F,EAAA,OAAO,OAAO,IAAA,CAAK,KAAK,CAAA,CAAE,MAAA,GAAS,IAAI,KAAA,GAAQ,MAAA;AACjD;AAYA,SAAS,0BAAA,CACP,MACA,SAAA,EACwC;AACxC,EAAA,MAAM,MAAM,IAAA,CAAK,oBAAA;AACjB,EAAA,MAAM,SAAS,SAAA,EAAW,oBAAA;AAC1B,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,MAAA,KAAW,MAAA,EAAW,OAAO,MAAA;AACtD,EAAA,OAAO,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAI,MAAA,IAAU,EAAC,EAAI,GAAI,GAAA,IAAO,EAAG,CAAC,CAAC,CAAA;AACzD;AASO,SAAS,uBAAA,CACd,MACA,SAAA,EACc;AAKd,EAAA,MAAM,KAAA,GACJ,IAAA,CAAK,KAAA,KAAU,MAAA,GACX,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,GACpB,EAAE,IAAI,IAAA,CAAK,KAAA,EAAM,GACjB,IAAA,CAAK,QACP,SAAA,EAAW,KAAA;AAGjB,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,IAAW,SAAA,EAAW,OAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,sBAAA,CAAuB,OAAA,EAAS,SAAS,CAAA;AACvD,EAAA,MAAM,QAAA,GAAW,0BAAA,CAA2B,IAAA,EAAM,SAAS,CAAA;AAC3D,EAAA,OAAO;AAAA,IACL,GAAI,WAAW,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,SAAA,CAAU,MAAA,EAAO,GAAI,EAAC;AAAA,IACtE,GAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,KAAU,EAAC;AAAA,IACvC,GAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,KAAU,EAAC;AAAA,IACvC,GAAI,QAAA,KAAa,MAAA,GAAY,EAAE,oBAAA,EAAsB,QAAA,KAAa,EAAC;AAAA,IACnE,GAAI,WAAW,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,SAAA,CAAU,OAAA,EAAQ,GAAI,EAAC;AAAA,IACzE,cAAc,IAAA,CAAK,YAAA;AAAA,IACnB,KAAA,EAAO,IAAA,CAAK,KAAA,IAAS;AAAC,GACxB;AACF;AAQA,eAAe,cACb,IAAA,EACA,KAAA,EACA,MAAA,EACA,QAAA,EACA,WACA,KAAA,EACiB;AAIjB,EAAA,OAAO,mBAAA;AAAA,IAAoB,KAAA;AAAA,IAAO,MAChC,oBAAA,CAAqB,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,UAAU,SAAS;AAAA,GAC/D;AACF;AAEA,eAAe,oBAAA,CACb,IAAA,EACA,KAAA,EACA,MAAA,EACA,UACA,SAAA,EACiB;AAMjB,EAAA,MAAM,KAAA,GAAQ,MAAMC,gCAAA,EAAe,CAAE,OAAO,uBAAA,CAAwB,IAAA,EAAM,SAAS,CAAC,CAAA;AACpF,EAAA,IAAI;AACF,IAAA,MAAM,WAAA,GAIF;AAAA,MACF,GAAI,MAAA,KAAW,KAAA,CAAA,GAAY,EAAE,MAAA,KAAW,EAAC;AAAA,MACzC,GAAI,QAAA,KAAa,KAAA,CAAA,GAAY,EAAE,aAAA,EAAe,QAAA,KAAa,EAAC;AAAA;AAAA,MAE5D,MAAA,EAAQ,EAAE,IAAA,EAAM,aAAA;AAAc,KAChC;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,CAAK,OAAO,WAAW,CAAA;AAC/C,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAG9B,IAAA,IAAI,MAAA,CAAO,WAAW,OAAA,EAAS;AAC7B,MAAA,MAAM,QAAS,MAAA,CAA4C,KAAA;AAC3D,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,aAAa,IAAA,CAAK,IAAI,CAAA,cAAA,EAAiB,KAAA,EAAO,WAAW,eAAe,CAAA,CAAA;AAAA,QACxE,KAAA,KAAU,KAAA,CAAA,GAAY,EAAE,KAAA,EAAM,GAAI,KAAA;AAAA,OACpC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,OAAO,MAAA,IAAU,eAAA;AAE9B,IAAA,OAAO,KAAK,kBAAA,KAAuB,IAAA,GAAO,OAAQ,MAAM,uBAAA,CAAwB,GAAG,CAAA,GAAK,IAAA;AAAA,EAC1F,CAAA,SAAE;AACA,IAAA,KAAA,CAAM,OAAA,EAAQ;AAAA,EAChB;AACF;AAQA,eAAe,qBAAA,CACb,IAAA,EACA,KAAA,EACA,KAAA,EACA,SAAA,EACe;AACf,EAAA,IAAI,IAAA,CAAK,yBAAyB,MAAA,EAAW;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,qBAAqB,EAAE,KAAA,EAAO,MAAM,IAAA,CAAK,IAAA,EAAM,KAAA,EAAO,SAAA,EAAW,CAAA;AAAA,EAC9E,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAQA,SAAS,kBAAA,CACP,IAAA,EACA,KAAA,EACA,QAAA,EACQ;AACR,EAAA,IAAI,IAAA,CAAK,aAAA,KAAkB,MAAA,IAAa,QAAA,KAAa,QAAW,OAAO,KAAA;AACvE,EAAA,MAAM,QAAA,GAAW,KAAK,aAAA,CAAc,EAAE,UAAU,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,CAAA;AACxE,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAClC,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AACzE,EAAA,OAAO,CAAA;AAAA,EAAwB,QAAQ;;AAAA;AAAA,EAAc,KAAK,CAAA,CAAA;AAC5D;AAGA,eAAe,uBAAA,CACb,IAAA,EACA,KAAA,EACA,MAAA,EACA,SAAA,EACiB;AACjB,EAAA,IAAI,IAAA,CAAK,oBAAA,KAAyB,MAAA,EAAW,OAAO,MAAA;AACpD,EAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,oBAAA,CAAqB,EAAE,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAW,CAAA;AAChG,EAAA,OAAO,UAAA,EAAY,QAAA,KAAa,MAAA,GAAY,MAAA,GAAS,WAAW,QAAA,GAAW,MAAA;AAC7E;AAEA,SAAS,cAAA,CAAe,IAAA,EAAoB,YAAA,GAAe,CAAA,EAAe;AACxE,EAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,IAAsB,CAAA;AAM5C,EAAA,IAAI,YAAA,GAAe,IAAI,QAAA,EAAU;AAC/B,IAAA,MAAM,IAAI,uBAAA,CAAwB,YAAA,GAAe,CAAA,EAAG,QAAQ,CAAA;AAAA,EAC9D;AAGA,EAAA,MAAM,QAAA,GAAWC,MAAE,MAAA,CAAO;AAAA,IACxB,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,uBAAuB;AAAA,GACnD,CAAA;AAKD,EAAA,MAAM,WAAA,GAAuC;AAAA,IAC3C,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,uBAAA;AAAwB,KAChE;AAAA,IACA,QAAA,EAAU,CAAC,OAAO,CAAA;AAAA,IAClB,oBAAA,EAAsB;AAAA,GACxB;AAIA,EAAA,IAAI,SAAA,GAAY,CAAA;AAEhB,EAAA,MAAM,IAAA,GAAmB;AAAA,IACvB,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,WAAA;AAAA,IACA,OAAA,EAAS,OACP,QAAA,EACA,GAAA,KAKoB;AACpB,MAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,QAAA,CAAS,MAAM,QAAQ,CAAA;AAMjD,MAAA,MAAM,YAAY,mCAAA,EAAoC;AAItD,MAAA,MAAM,YAAA,GAAe,YAAA,GAAe,sBAAA,EAAuB,GAAI,CAAA;AAC/D,MAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,QAAA,MAAM,IAAI,uBAAA,CAAwB,YAAA,EAAc,QAAQ,CAAA;AAAA,MAC1D;AACA,MAAA,SAAA,IAAa,CAAA;AAIb,MAAA,MAAM,iBAAA,GAAoB,SAAA;AAE1B,MAAA,MAAM,KAAA,GAAQ,MAAM,oBAAA,CAAqB,IAAA,EAAM,QAAQ,iBAAiB,CAAA;AACxE,MAAA,IAAI,QAAA,IAAY,KAAA,EAAO,OAAO,KAAA,CAAM,MAAA;AAEpC,MAAA,MAAM,QAAQ,kBAAA,CAAmB,IAAA,EAAM,KAAA,CAAM,KAAA,EAAO,KAAK,QAAQ,CAAA;AAEjE,MAAA,IAAI,MAAA;AACJ,MAAA,IAAI;AAEF,QAAA,MAAA,GAAS,MAAM,aAAA;AAAA,UACb,IAAA;AAAA,UACA,KAAA;AAAA,UACA,GAAA,EAAK,MAAA;AAAA,UACL,KAAA,CAAM,QAAA;AAAA,UACN,SAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF,SAAS,KAAA,EAAO;AAId,QAAA,MAAM,qBAAA,CAAsB,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,iBAAiB,CAAA;AACjE,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,OAAO,uBAAA,CAAwB,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,iBAAiB,CAAA;AAAA,IACvE;AAAA,GACF;AAKA,EAAA,OAAO,IAAA;AACT;AAMO,IAAM,WAAN,MAAe;AAAA,EACZ,WAAA,GAAc;AAAA,EAAC;AAAA,EACvB,OAAO,MAAA,CAAO,IAAA,EAAoB,WAAA,GAAc,CAAA,EAAe;AAC7D,IAAA,OAAO,cAAA,CAAe,MAAM,WAAW,CAAA;AAAA,EACzC;AACF;AAsBO,SAAS,4BAAA,CACd,QACA,WAAA,EACc;AACd,EAAA,OAAO,MAAA,CAAO,QAAQ,MAAM,CAAA,CAAE,IAAI,CAAC,CAAC,IAAA,EAAM,GAAG,CAAA,KAAM;AACjD,IAAA,MAAM,SAAA,GACJ,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,IAAK,GAAA,CAAI,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,IAAI,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,GAAI,MAAA;AAC1E,IAAA,MAAM,UAAA,GAAa,SAAA,GAAY,WAAA,CAAY,MAAA,CAAO,CAAC,CAAA,KAAM,SAAA,CAAU,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA,GAAI,WAAA;AAClF,IAAA,OAAO,cAAA,CAAe;AAAA,MACpB,IAAA;AAAA,MACA,aAAa,GAAA,CAAI,WAAA;AAAA,MACjB,cAAc,GAAA,CAAI,MAAA;AAAA;AAAA;AAAA,MAGlB,GAAI,GAAA,CAAI,KAAA,KAAU,MAAA,IAAa,GAAA,CAAI,KAAA,KAAU,SAAA,GAAY,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,GAAI,EAAC;AAAA,MACjF,GAAI,IAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAQ,GAAI,EAAC;AAAA,MAC5D,KAAA,EAAO,CAAC,GAAG,UAAU;AAAA,KACtB,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"chunk-NQTD6QOW.cjs","sourcesContent":["/**\n * #364 — how deep the current delegation chain already is, delivered through the CALL.\n *\n * ## The bug this replaces\n *\n * `maxDelegationDepth` was checked once, at tool-CONSTRUCTION time, against a `_parentDepth`\n * argument that nothing in the SDK ever incremented. Constructing a tool says nothing about how\n * deep it will later be invoked, so with the documented call — `SubAgent.create(spec)` — the test\n * was `1 > maxDepth`, false for every spec that did not ask for depth 0. A subagent whose tools\n * include another subagent recursed unbounded, which is precisely what the guard exists to stop.\n * The only path that ever tripped it was a caller threading the number by hand.\n *\n * ## Why the async scope closes it\n *\n * Depth is a property of the RUN, not of the object. A child's run loop — and therefore every tool\n * it dispatches — executes inside the async continuation of its parent's handler, so a value\n * published on that context is exactly what a nested dispatch needs to read. This is the same seam\n * `subagent-credentials.ts` uses, and for the same reason: what survives every layer that rebuilds\n * a tool object is the call, never the object.\n *\n * It is kept in its own module rather than folded into the credentials payload because depth is a\n * separate concern with a separate lifetime — the credentials scope is opened once per run by the\n * run loop, while depth is opened per delegation by the dispatching tool.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\nconst depthStore = new AsyncLocalStorage<number>();\n\n/**\n * Run `fn` with `depth` published as the delegation depth of the current chain.\n *\n * Nested scopes shadow the outer one and the outer is restored on return, so two sibling\n * delegations from the same parent each start from the parent's depth rather than from each\n * other's.\n *\n * @internal\n */\nexport async function withDelegationDepth<T>(depth: number, fn: () => Promise<T>): Promise<T> {\n  return depthStore.run(depth, fn);\n}\n\n/**\n * The delegation depth of the current chain — `0` outside any delegation.\n *\n * `0` is the honest default rather than a fallback to some previous chain's value: a subagent\n * dispatched with no parent delegation IS at depth zero.\n *\n * @internal\n */\nexport function currentDelegationDepth(): number {\n  return depthStore.getStore() ?? 0;\n}\n","/**\n * theokit#148 — the parent's credentials, delivered through the CALL, not through the tool object.\n *\n * ## The class of bug this replaces\n *\n * Credential inheritance used to ride a property installed on the subagent tool object — first a\n * unique `Symbol()`, then `Symbol.for` after #143. Both are the same shape of contract: \"this\n * object will reach the dispatcher with an extra property intact\". Nothing enforces that, and it\n * broke twice for two different reasons:\n *\n *  - **Module duplication** (#142/#143): `tsup splitting: false` inlined a separate copy of the\n *    module into each public entry, so the two copies disagreed on a unique `Symbol()` key. Fixed at\n *    the build level by M78's `splitting: true`, but the fragile contract remained.\n *  - **Object normalization** (#148): any layer that rebuilds the tool from its known fields drops\n *    the property. `@theokit/agents`' `toCompiledTool` does exactly that, and had to add an explicit\n *    `Object.getOwnPropertySymbols` copy loop to compensate — a band-aid the SDK's contract forced\n *    onto a consumer. A named field would have been dropped by the same four-field rebuild, which is\n *    why \"make it a typed field\" alone does not close this.\n *\n * ## Why the async scope closes it\n *\n * What survives a rebuild is not the object — it is the CALL. A normalizing wrapper builds a new\n * object but still invokes the original handler, inside the parent run's async context. So\n * credentials published on that context reach the handler regardless of what the tool object looks\n * like by then. There is no property left for a layer to drop.\n *\n * It also fixes a defect the per-object slot could not: credentials were stored per tool INSTANCE,\n * so one subagent tool shared by two agents got last-writer-wins. The scope is per run.\n *\n * Nothing is exposed to third-party tool code: the store is module-private, credentials never touch\n * a handler's `ctx`, and `currentInheritedSubAgentCredentials` is `@internal`.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n// The PUBLIC, validated shapes — `CompatSource`, not the loose `CompatSourceDeclaration` the\n// internal loader accepts. What travels here is what the parent already resolved, so it is typed\n// against the option it came from and the option it is handed to. Typing it loosely and casting at\n// the destination would hide exactly the mismatch the compiler caught on the first attempt.\nimport type { BuiltinToolName, CompatSource, SettingSource } from \"../../types/agent.js\";\nimport type { ModelSelection } from \"../../types/agent-prims.js\";\nimport type { Plugin } from \"../plugins/types.js\";\n\n/**\n * Credentials a parent agent hands down to its subagent tools so the child inherits the parent's\n * auth (and, absent an explicit `spec.model`, its model).\n *\n * Declared here rather than in `a2a/subagent.ts` so the delivery mechanism owns the payload shape\n * and the dependency runs one way (`a2a/subagent` -> this module). `a2a/subagent.ts` briefly\n * re-exported it \"for back-compat\"; knip proved there was no back-compat surface to preserve — the\n * type was never in the public barrel nor the exports map — so the re-export was deleted.\n *\n * Emitted rather than erased: `a2a/subagent.d.ts` imports it by name, and that entry IS published,\n * so erasing this declaration ships a `.d.ts` that does not compile. Not being in the exports map\n * is what keeps it out of the semver contract; erasure is not what does that.\n */\nexport interface InheritedCredentials {\n  readonly apiKey?: string;\n  readonly model?: ModelSelection;\n  /**\n   * The parent's shell-sandbox posture (`local.sandboxOptions.enabled`), handed down so a delegated\n   * child of a sandboxed parent stays sandboxed unless its role explicitly opts out. Without this a\n   * child ran unsandboxed whenever its role omitted `sandbox` — a default-open the sandbox wiring\n   * exists to prevent.\n   */\n  readonly sandbox?: boolean;\n  /**\n   * #55 — the parent's code-registered plugins (e.g. a `PermissionPlugin`) handed down so the child\n   * runs under the SAME policy. Without this, a delegated child's inner tool calls escape the\n   * parent's argument-level permission gate. First-party delegation path only — never exposed to\n   * third-party tool `ctx`.\n   */\n  readonly plugins?: readonly Plugin[];\n  /**\n   * #578 — the parent's RESOLVED `local.settingSources` / `local.compatSources`, handed down so a\n   * delegated child can see the configuration surfaces its parent was declared to read.\n   *\n   * `compatSources` arrived with #524 and neither carrier was updated, so a parent declaring\n   * `compatSources: [\"claude-code\"]` read `.claude/agents/` and its child did not: a team could\n   * delegate TO a role by name and the child could not resolve the rest of the team.\n   *\n   * ## Why inheriting is safe here, unlike widening\n   *\n   * Every other field on this interface hands DOWN a restriction (the sandbox posture, the\n   * permission plugins) and the danger is a child escaping it. These two are the mirror image: the\n   * child is currently MORE restricted than its parent, so the failure is a missing capability\n   * rather than an open door. Inheritance cannot widen — the child receives what the parent already\n   * resolved, and it runs in the parent's cwd, so it reads no directory the parent could not.\n   *\n   * A role's explicit value still wins; these are the fallback, exactly as `model` and `sandbox` are.\n   */\n  readonly settingSources?: readonly SettingSource[];\n  /** @see {@link InheritedCredentials.settingSources} — carried together, same reasoning. */\n  readonly compatSources?: readonly CompatSource[];\n  /**\n   * #580 — the builtin tools the parent removed from its catalog, handed down so a delegated child\n   * cannot recover one its parent revoked.\n   *\n   * This is the third field here that hands down a RESTRICTION, and it was the one that crossed no\n   * carrier at all: measured, a parent with `withheldBuiltinTools: [\"shell\"]` produced a child whose\n   * value was `undefined`, so the child got the shell back. Delegation widened authority the operator\n   * had revoked — the inverse of #578 and materially worse, because there the child was merely\n   * over-restricted.\n   *\n   * It bites because of a documented default (`types/agent.ts` § LocalOptions): a `shell` tool is\n   * ALWAYS registered on a local agent, including when `tools: []` is passed. Withholding is the only\n   * mechanism that removes it, so a withholding that does not survive delegation leaves no other way\n   * for a child to be without a shell.\n   *\n   * ## The union rule\n   *\n   * A child's own list is UNIONED with this one, never substituted for it — see\n   * {@link buildChildWithheldBuiltins}. Every other field on this interface lets the role's own value\n   * win, and copying that here would let a child un-withhold what its parent revoked: the bug,\n   * reintroduced by its own fix.\n   */\n  readonly withheldBuiltinTools?: readonly BuiltinToolName[];\n}\n\nconst credentialsStore = new AsyncLocalStorage<InheritedCredentials>();\n\n/**\n * Run `fn` with `credentials` published as the delegation credentials of the current run.\n *\n * Nested scopes shadow the outer one and the outer is restored on return, so a delegated child that\n * itself delegates hands down ITS credentials, not its parent's.\n *\n * @internal\n */\nexport async function withInheritedSubAgentCredentials<T>(\n  credentials: InheritedCredentials,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return credentialsStore.run(credentials, fn);\n}\n\n/**\n * The delegation credentials of the current run, or `undefined` outside a run scope.\n *\n * `undefined` is deliberately NOT a fallback to some previous run's value: a subagent dispatched\n * with no parent context must create its child without an inherited key rather than reuse a\n * credential that belonged to someone else.\n *\n * @internal\n */\nexport function currentInheritedSubAgentCredentials(): InheritedCredentials | undefined {\n  return credentialsStore.getStore();\n}\n","/**\n * Subagent delegation — declarative child agent invocable as a tool.\n *\n * Per ADR D2: `defineSubAgent(spec)` returns a `CustomTool` that, when\n * invoked by the LLM, creates a child agent and sends the input as a\n * message. EC-2: delegation depth is tracked across the RUN (#364) — each\n * delegation publishes its depth on the async scope its child executes in, so a\n * subagent that delegates to a subagent is bounded by `maxDelegationDepth`\n * without the caller threading a counter by hand.\n *\n * SE10 — the handler forwards the parent run's `AbortSignal` to the child.\n * SE11 — optional `onDelegationStart` / `onDelegationComplete` lifecycle hooks\n * let the caller reject, rewrite, observe, or annotate a delegation.\n *\n * @public\n */\n\nimport { z } from \"zod\";\nimport { TheokitAgentError } from \"../errors.js\";\nimport {\n  currentDelegationDepth,\n  withDelegationDepth,\n} from \"../internal/concurrency/delegation-depth.js\";\nimport {\n  currentInheritedSubAgentCredentials,\n  type InheritedCredentials,\n} from \"../internal/concurrency/subagent-credentials.js\";\nimport { getAgentFacade } from \"../internal/runtime/registry/agent-factory-registry.js\";\nimport type {\n  AgentDefinition,\n  AgentOptions,\n  BuiltinToolName,\n  CustomTool,\n  ToolContextMessage,\n} from \"../types/agent.js\";\nimport type { ModelSelection } from \"../types/agent-prims.js\";\nimport type { Run } from \"../types/run.js\";\n\n/** Arguments passed to {@link SubAgentSpec.messageFilter} (SE12). */\nexport interface MessageFilterArgs {\n  /** The supervisor transcript (read-only text projection) available to this delegation. */\n  messages: readonly ToolContextMessage[];\n  /** The prompt about to be delegated (after any `onDelegationStart` rewrite). */\n  input: string;\n  /** The subagent's name. */\n  name: string;\n}\n\n/** Context passed to {@link SubAgentSpec.onDelegationStart} before the child runs. */\nexport interface DelegationStartContext {\n  input: string;\n  name: string;\n  /**\n   * SE15 — 1-based count of times THIS subagent tool has been invoked (a\n   * per-`defineSubAgent`-instance counter). Incremented before this hook runs;\n   * a rejected delegation still counts. Enables reject-after-N patterns.\n   */\n  iteration: number;\n}\n\n/**\n * Decision returned from {@link SubAgentSpec.onDelegationStart}. Discriminated on\n * `proceed` so a rejection (`proceed: false` + `rejectionReason`) and an approval\n * (`modifiedInput`) cannot be mixed into one nonsensical object.\n */\nexport type DelegationStartDecision =\n  | { proceed: false; rejectionReason?: string }\n  | {\n      proceed?: true;\n      modifiedInput?: string;\n      /** SE13 — cap the child's iteration count (forwarded as `SendOptions.maxIterations`). */\n      modifiedMaxSteps?: number;\n    };\n\n/** Context passed to {@link SubAgentSpec.onDelegationComplete} after the child settles. */\nexport interface DelegationCompleteContext {\n  input: string;\n  name: string;\n  /** The child's text result (present on success). */\n  result?: string;\n  /** The error the child threw (present on failure); the error is still re-thrown. */\n  error?: unknown;\n  /** SE15 — the same 1-based iteration this delegation's `onDelegationStart` saw. */\n  iteration: number;\n}\n\n/**\n * The return of a delegation hook: a decision, a promise of one, or nothing —\n * `void` lets a side-effect-only callback (`(ctx) => { log(ctx) }`) type-check,\n * which is the common case (mirrors a peer framework's `async ctx => { ... }` hooks).\n */\n// biome-ignore lint/suspicious/noConfusingVoidType: `void` is the idiomatic return for an optional-return callback; the rule false-positives on callback return unions.\ntype DelegationHookResult<T> = T | void | Promise<T | void>;\n\n/** Decision returned from {@link SubAgentSpec.onDelegationComplete}. */\nexport interface DelegationCompleteDecision {\n  /** Appended to the child's result string. */\n  feedback?: string;\n}\n\n/**\n * The declaration of a delegating child agent, handed to `SubAgent.create(spec)`.\n *\n * `name`, `description` and `instructions` are the only required fields: the first\n * two become the tool the supervisor's model sees, the third becomes the child's\n * system prompt. Everything else narrows what the child inherits.\n *\n *   const research = SubAgent.create({\n *     name: \"research\",\n *     description: \"Look a fact up\",\n *     instructions: \"You answer with one sentence.\",\n *   });\n *   const agent = await Agent.create({ tools: [research] });\n *\n * The tool's own input schema is fixed — one required string property, `input`.\n * It is not derived from this spec and cannot be widened here.\n *\n * What the child inherits from the parent AT DISPATCH TIME, not from this object:\n * the API key, the model (unless `model` is set), the parent's plugins, and the\n * parent's sandbox posture (unless `sandbox` is set). An absent `sandbox` inherits;\n * an explicit `sandbox: false` turns confinement OFF for a child of a confined\n * parent, which is not the same thing.\n *\n * How it fails: the child's failure is re-thrown to the supervisor as a tool error\n * — a run ending in `status: \"error\"` becomes\n * `subagent \"<name>\" run failed: <cause>`. `onDelegationStart` and `messageFilter`\n * propagate their own throws; only a throw from `onDelegationComplete` ON THE\n * ERROR PATH is suppressed, so it cannot mask the real cause.\n *\n * Traps:\n *  - `model` as a bare string drops reasoning parameters. Pass the\n *    {@link ModelSelection} object form when the child needs `params`.\n *  - `maxDelegationDepth` (default 3) bounds the delegation CHAIN, counted at\n *    dispatch across the run (#364) — the depth is not something you thread. The\n *    `parentDepth` argument of `SubAgent.create` still offsets it, for a supervisor\n *    that wants a lower ceiling than the chain it sits in.\n *  - Context isolation is the DEFAULT. Without `messageFilter` the child sees only\n *    the delegated string; without `includeToolResults` the supervisor gets only\n *    the child's final text.\n */\nexport interface SubAgentSpec {\n  name: string;\n  description: string;\n  instructions: string;\n  /**\n   * A bare id string (back-compat) OR a full {@link ModelSelection} carrying\n   * `params` (e.g. `[{ id: \"thinking\", value: \"low\" }]` for reasoning effort). The\n   * object form is required for per-subagent reasoning effort to survive to the child\n   * — the pre-M33 path took only `.id` and dropped params.\n   */\n  model?: string | ModelSelection;\n  tools?: CustomTool[];\n  /** Per-subagent shell sandbox toggle (M33). `true` ⇒ child `local.sandboxOptions.enabled`. */\n  sandbox?: boolean;\n  /**\n   * #580 — builtin tools this role removes from its child's catalog, UNIONED with whatever the\n   * parent already withheld.\n   *\n   * A role declared read-only in prose is not read-only: a `shell` tool is always registered on a\n   * local agent, including when `tools: []` is passed, so withholding is the only mechanism that\n   * removes it — and until #580 a spec could not ask for it and a parent's withholding did not\n   * survive delegation either.\n   *\n   * ## Union, not override — and this is the one field here that works that way\n   *\n   * `model` and `sandbox` let the role's own value WIN, including `sandbox: false` turning\n   * confinement off for a child of a confined parent. That asymmetry is deliberate: a posture is\n   * declared, whereas withholding removes a capability from the catalog. Letting a role override a\n   * withholding would let a child recover a tool its parent revoked, which is the defect #580\n   * reports — so a child may only ever ADD to the set.\n   */\n  withheldBuiltinTools?: readonly BuiltinToolName[];\n  /**\n   * Maximum length of the delegation CHAIN rooted at this tool, counted at dispatch\n   * (default 3). Depth 1 is this subagent; a subagent it delegates to is depth 2.\n   * Exceeding it throws {@link MaxDelegationDepthError} from the tool handler.\n   */\n  maxDelegationDepth?: number;\n  /**\n   * SE11 — called before the supervisor delegates. Return `{ proceed: false }`\n   * to reject (the child never runs and `rejectionReason` becomes the tool\n   * result), or `{ modifiedInput }` to rewrite the delegated prompt. A throwing\n   * hook surfaces (never silently swallowed).\n   */\n  onDelegationStart?: (\n    ctx: DelegationStartContext,\n  ) => DelegationHookResult<DelegationStartDecision>;\n  /**\n   * SE11 — called after the delegation settles. On success `ctx.result` is set\n   * and an optional `{ feedback }` is appended to it. On failure `ctx.error` is\n   * set and the original error is ALWAYS re-thrown after this hook runs — a throw\n   * from this hook on the error path is suppressed so it cannot mask the\n   * delegation's real failure (on the success path a throw does propagate).\n   */\n  onDelegationComplete?: (\n    ctx: DelegationCompleteContext,\n  ) => DelegationHookResult<DelegationCompleteDecision>;\n  /**\n   * SE12 — opt-in parent-context forwarding. When set, the supervisor transcript\n   * (`ctx.messages`, a read-only text projection) is passed to this filter and the\n   * returned subset is forwarded to the child as a role-tagged context preamble\n   * prepended to the delegated input. When ABSENT the child runs input-only —\n   * memory isolation stays the default. A filter returning `[]` forwards nothing.\n   * A throwing filter propagates (fail-fast, never swallowed — same contract as\n   * `onDelegationStart`); the delegation surfaces as a tool error.\n   */\n  messageFilter?: (args: MessageFilterArgs) => readonly ToolContextMessage[];\n  /**\n   * SE14 — opt-in subagent result-context control. When `true`, the child's\n   * completed tool-call results (name + result) are appended to the delegation\n   * payload returned to the supervisor, inside a `<subagent-tool-results>` block.\n   * When absent/`false` the delegation returns the child's final text only —\n   * text-only stays the default (a peer framework's scoped posture). See ADR 0006.\n   */\n  includeToolResults?: boolean;\n}\n\n/**\n * Raised by `SubAgent.create(spec, parentDepth)` when `parentDepth + 1` exceeds\n * `spec.maxDelegationDepth` (default 3). Carries `currentDepth`, `maxDepth` and a\n * stable `code: \"max_delegation_depth\"`.\n *\n * Thrown from the subagent tool's handler when a delegation would exceed\n * `maxDelegationDepth` (default 3), so it surfaces as the tool call's failure —\n * catching it around the dispatching `agent.send()` works.\n *\n * Also thrown eagerly at TOOL-CONSTRUCTION time when a caller threads its own\n * `parentDepth` that is already past the limit; such a tool could never be\n * dispatched, so refusing to build it fails earlier and clearer.\n *\n * Before #364 the construction-time check was the ONLY one, against a depth\n * nothing in the SDK incremented — so under the documented `SubAgent.create(spec)`\n * call this error could not fire at all and nested delegation was unbounded. The\n * chain length now travels with the run (`internal/runtime/concurrency/delegation-depth.ts`),\n * and a caller-threaded `parentDepth` still adds to it.\n */\nexport class MaxDelegationDepthError extends TheokitAgentError {\n  override readonly name = \"MaxDelegationDepthError\";\n  override readonly code = \"max_delegation_depth\" as const;\n  constructor(\n    public readonly currentDepth: number,\n    public readonly maxDepth: number,\n  ) {\n    // Not retryable: the depth is a property of the call graph, and it is the same on a retry.\n    super(`Max delegation depth ${maxDepth} exceeded (current: ${currentDepth})`, {\n      code: \"max_delegation_depth\",\n      isRetryable: false,\n    });\n  }\n}\n\n/**\n * Run the `onDelegationStart` hook; returns either a rejection or the (possibly\n * rewritten) input plus the optional SE13 `maxSteps` cap.\n */\nasync function applyDelegationStart(\n  spec: SubAgentSpec,\n  input: string,\n  iteration: number,\n): Promise<{ reject: string } | { input: string; maxSteps?: number }> {\n  if (spec.onDelegationStart === undefined) return { input };\n  const decision = await spec.onDelegationStart({ input, name: spec.name, iteration });\n  if (decision === undefined) return { input };\n  if (decision.proceed === false)\n    return { reject: decision.rejectionReason ?? \"(delegation rejected)\" };\n  return {\n    input: decision.modifiedInput ?? input,\n    ...(decision.modifiedMaxSteps !== undefined ? { maxSteps: decision.modifiedMaxSteps } : {}),\n  };\n}\n\n/**\n * SE14 — replay the child run's stream (a safe post-`wait()` idiom — the run buffers\n * events, `stream()` replays them) and collect every completed tool-call result into\n * a delimited block. Returns `\"\"` when the child ran no completed tool calls. See ADR 0006.\n */\nasync function collectChildToolResults(run: Run): Promise<string> {\n  const lines: string[] = [];\n  for await (const event of run.stream()) {\n    if (event.type === \"tool_call\" && event.status === \"completed\") {\n      const rendered =\n        typeof event.result === \"string\" ? event.result : JSON.stringify(event.result ?? null);\n      lines.push(`${event.name}: ${rendered}`);\n    }\n  }\n  if (lines.length === 0) return \"\";\n  return `\\n\\n<subagent-tool-results>\\n${lines.join(\"\\n\")}\\n</subagent-tool-results>`;\n}\n\n/**\n * The child's `local` slice, accumulated ONCE from all three contributors — or `undefined` when the\n * parent declared none of them, so the pre-#578 shape (no `local` key at all) is preserved.\n *\n * #578 — this exists as a function rather than three spreads in the return, and the reason is a\n * hazard rather than tidiness. `local` is a single object: the old code wrote it whole from the\n * sandbox posture alone, so adding a second `...{ local: … }` spread beside it would have silently\n * DROPPED that posture — turning a missing-capability bug into a default-open one, which is the\n * wrong direction to trade. One accumulator makes that collision impossible to reintroduce.\n *\n * The configuration surfaces are the parent's RESOLVED values. Inheriting cannot widen: the child\n * receives what the parent already resolved and runs in the parent's cwd, so it reads no directory\n * the parent could not. Without this, a parent declaring `compatSources: [\"claude-code\"]` saw\n * `.claude/agents/` and its child did not — a team could delegate TO a role by name while the child\n * could not resolve the rest of the team.\n */\nfunction buildChildLocalOptions(\n  sandbox: boolean | undefined,\n  inherited: InheritedCredentials | undefined,\n): AgentOptions[\"local\"] | undefined {\n  const local: NonNullable<AgentOptions[\"local\"]> = {};\n  if (sandbox !== undefined) local.sandboxOptions = { enabled: sandbox };\n  if (inherited?.settingSources !== undefined) local.settingSources = [...inherited.settingSources];\n  if (inherited?.compatSources !== undefined) local.compatSources = [...inherited.compatSources];\n  return Object.keys(local).length > 0 ? local : undefined;\n}\n\n/**\n * The builtins withheld from the child: the UNION of the parent's set and the role's own — or\n * `undefined` when neither withheld anything.\n *\n * #580 — union rather than override, and that is the security property rather than a preference.\n * The role's own value wins for `model` and for `sandbox`; copying that here would let a child\n * un-withhold what its parent revoked, which is the defect being fixed, reintroduced by its own fix.\n * **A restriction may be tightened by a child and never loosened.** So `withheldBuiltinTools: []` on\n * a role subtracts nothing — it is an empty contribution to a union, not a reset.\n */\nfunction buildChildWithheldBuiltins(\n  spec: SubAgentSpec,\n  inherited: InheritedCredentials | undefined,\n): readonly BuiltinToolName[] | undefined {\n  const own = spec.withheldBuiltinTools;\n  const parent = inherited?.withheldBuiltinTools;\n  if (own === undefined && parent === undefined) return undefined;\n  return [...new Set([...(parent ?? []), ...(own ?? [])])];\n}\n\n/**\n * Build the child agent's `Agent.create` options: the child inherits the parent's\n * apiKey (else `Agent.create` throws \"Missing API key\"), its model (unless the spec\n * overrides it), — #55 — the parent's plugins (permission gate/guards) so the\n * child's inner tool calls run under the same policy, and — #578 — the configuration\n * surfaces the parent was declared to read (see {@link buildChildLocalOptions}).\n */\nexport function buildChildCreateOptions(\n  spec: SubAgentSpec,\n  inherited: InheritedCredentials | undefined,\n): AgentOptions {\n  // M33 — carry the WHOLE model (a bare id becomes `{ id }`; a ModelSelection with\n  // `params` keeps its reasoning effort). The pre-M33 path wrapped `spec.model` as\n  // `{ id: spec.model }`, which only worked because spec.model was a string and\n  // silently dropped reasoning params.\n  const model: string | ModelSelection | undefined =\n    spec.model !== undefined\n      ? typeof spec.model === \"string\"\n        ? { id: spec.model }\n        : spec.model\n      : inherited?.model;\n  // M33 — the role's own `sandbox` wins; when it omits the field, inherit the parent's posture. A role's\n  // explicit `sandbox: false` therefore confines-OFF a child of a sandboxed parent (distinct from absent).\n  const sandbox = spec.sandbox ?? inherited?.sandbox;\n  const local = buildChildLocalOptions(sandbox, inherited);\n  const withheld = buildChildWithheldBuiltins(spec, inherited);\n  return {\n    ...(inherited?.apiKey !== undefined ? { apiKey: inherited.apiKey } : {}),\n    ...(model !== undefined ? { model } : {}),\n    ...(local !== undefined ? { local } : {}),\n    ...(withheld !== undefined ? { withheldBuiltinTools: withheld } : {}),\n    ...(inherited?.plugins !== undefined ? { plugins: inherited.plugins } : {}),\n    systemPrompt: spec.instructions,\n    tools: spec.tools ?? [],\n  };\n}\n\n/**\n * Create the transient child agent and send the input, composing every forwarded\n * `SendOptions` onto ONE `send` call — SE10 `signal` + SE13 `maxIterations`. Absent\n * every option ⇒ the pre-SE10 single-arg `send(input)` shape. SE14 — when\n * `includeToolResults` is set, append the child's completed tool results. Dispose in `finally`.\n */\nasync function runChildAgent(\n  spec: SubAgentSpec,\n  input: string,\n  signal: AbortSignal | undefined,\n  maxSteps: number | undefined,\n  inherited: InheritedCredentials | undefined,\n  depth: number,\n): Promise<string> {\n  // #364 — publish THIS delegation's depth for the whole child run. The child's loop, and every\n  // tool it dispatches, runs inside this scope, so a nested subagent reads the real chain length\n  // instead of the 0 every construction-time check saw.\n  return withDelegationDepth(depth, () =>\n    runChildAgentInScope(spec, input, signal, maxSteps, inherited),\n  );\n}\n\nasync function runChildAgentInScope(\n  spec: SubAgentSpec,\n  input: string,\n  signal: AbortSignal | undefined,\n  maxSteps: number | undefined,\n  inherited: InheritedCredentials | undefined,\n): Promise<string> {\n  // SE45 cycle 3 — use the registered Agent facade via the DIP seam\n  // (agent-factory-registry) instead of a dynamic `import(\"../agent.js\")`.\n  // This removes the last madge cycle (a2a/subagent -> agent -> ... -> real-local-run-tools\n  // -> a2a/subagent): the facade registers itself at module-init via setAgentFacade,\n  // so subagent depends only on the registry port, never on the facade module.\n  const agent = await getAgentFacade().create(buildChildCreateOptions(spec, inherited));\n  try {\n    const sendOptions: {\n      signal?: AbortSignal;\n      maxIterations?: number;\n      origin?: import(\"../types/run.js\").MessageOrigin;\n    } = {\n      ...(signal !== undefined ? { signal } : {}),\n      ...(maxSteps !== undefined ? { maxIterations: maxSteps } : {}),\n      // SE3 — a delegated child's turn is initiated by the coordinating parent.\n      origin: { kind: \"coordinator\" },\n    };\n    const run = await agent.send(input, sendOptions);\n    const result = await run.wait();\n    // Fail-fast, don't swallow (Rule 8): a child that ended in error must surface — otherwise a real\n    // failure (e.g. `provider_unresolved`) is hidden behind \"(no response)\" and the parent loops on it.\n    if (result.status === \"error\") {\n      const cause = (result as { error?: { message?: string } }).error;\n      throw new Error(\n        `subagent \"${spec.name}\" run failed: ${cause?.message ?? \"unknown error\"}`,\n        cause !== undefined ? { cause } : undefined,\n      );\n    }\n    const text = result.result ?? \"(no response)\";\n    // SE14 — text-only by default; opt-in appends the child's tool results.\n    return spec.includeToolResults === true ? text + (await collectChildToolResults(run)) : text;\n  } finally {\n    agent.dispose();\n  }\n}\n\n/**\n * Best-effort error-path notification: run `onDelegationComplete` with the child's\n * error so the caller can observe the failure. The observer's own throw (sync or\n * async) is suppressed here so it cannot mask the delegation's real error, which the\n * handler re-throws next.\n */\nasync function notifyDelegationError(\n  spec: SubAgentSpec,\n  input: string,\n  error: unknown,\n  iteration: number,\n): Promise<void> {\n  if (spec.onDelegationComplete === undefined) return;\n  try {\n    await spec.onDelegationComplete({ input, name: spec.name, error, iteration });\n  } catch {\n    // Subordinate to `error`; the child's real cause wins.\n  }\n}\n\n/**\n * SE12 — apply `messageFilter` (if set) and prepend the filtered supervisor\n * transcript to the delegated input as a role-tagged context preamble. Absent\n * filter OR no messages OR an empty filtered subset ⇒ the original input\n * (isolation-by-default preserved).\n */\nfunction applyMessageFilter(\n  spec: SubAgentSpec,\n  input: string,\n  messages: readonly ToolContextMessage[] | undefined,\n): string {\n  if (spec.messageFilter === undefined || messages === undefined) return input;\n  const filtered = spec.messageFilter({ messages, input, name: spec.name });\n  if (filtered.length === 0) return input;\n  const preamble = filtered.map((m) => `${m.role}: ${m.content}`).join(\"\\n\");\n  return `Prior conversation:\\n${preamble}\\n\\nTask:\\n${input}`;\n}\n\n/** Run the success-path `onDelegationComplete` hook; appends its `feedback` to the result. */\nasync function applyDelegationComplete(\n  spec: SubAgentSpec,\n  input: string,\n  result: string,\n  iteration: number,\n): Promise<string> {\n  if (spec.onDelegationComplete === undefined) return result;\n  const completion = await spec.onDelegationComplete({ input, name: spec.name, result, iteration });\n  return completion?.feedback !== undefined ? result + completion.feedback : result;\n}\n\nfunction defineSubAgent(spec: SubAgentSpec, _parentDepth = 0): CustomTool {\n  const maxDepth = spec.maxDelegationDepth ?? 3;\n\n  // A caller that threads its own depth still gets the eager failure it always got: a spec that is\n  // already too deep to ever be dispatchable is worth refusing at construction. What this check\n  // CANNOT see is the runtime chain — constructing a tool says nothing about how deep it will later\n  // be invoked — which is why the guard that actually bounds recursion lives at dispatch (#364).\n  if (_parentDepth + 1 > maxDepth) {\n    throw new MaxDelegationDepthError(_parentDepth + 1, maxDepth);\n  }\n\n  // Zod for RUNTIME validation of the tool_use input …\n  const inputZod = z.object({\n    input: z.string().describe(\"Task for the subagent\"),\n  });\n  // … and a real Draft-7 JSON Schema for the LLM. `CustomTool.inputSchema` is sent\n  // to the model verbatim; a raw Zod object would serialize to garbage, so the\n  // model emits malformed input that fails `inputZod.parse` and the delegation\n  // never runs (the previous bug — the schema and the validator are now distinct).\n  const inputSchema: Record<string, unknown> = {\n    type: \"object\",\n    properties: {\n      input: { type: \"string\", description: \"Task for the subagent\" },\n    },\n    required: [\"input\"],\n    additionalProperties: false,\n  };\n\n  // SE15 — per-instance delegation counter, surfaced as `iteration` on the hook\n  // contexts. Incremented once per handler invocation before onDelegationStart.\n  let iteration = 0;\n\n  const tool: CustomTool = {\n    name: spec.name,\n    description: spec.description,\n    inputSchema,\n    handler: async (\n      rawInput: Record<string, unknown>,\n      ctx?: {\n        signal?: AbortSignal;\n        context?: unknown;\n        messages?: readonly ToolContextMessage[];\n      },\n    ): Promise<string> => {\n      const { input: parsed } = inputZod.parse(rawInput);\n      // theokit#148 — read the parent's credentials from the RUN's async scope, at dispatch time.\n      // They used to be stashed on this tool object by the runtime, which meant any layer that\n      // rebuilt the object (e.g. `@theokit/agents`' `toCompiledTool`) silently dropped them and the\n      // child failed with `provider_unresolved`. The scope travels with the call, so nothing about\n      // the object's shape matters — and two concurrent runs sharing one tool each read their own.\n      const inherited = currentInheritedSubAgentCredentials();\n      // #364 — the real bound. `currentDelegationDepth()` is the length of the chain that led here,\n      // published by each ancestor's `runChildAgent`; a caller-threaded `_parentDepth` still adds to\n      // it, so the pre-#364 hand-threaded behaviour is unchanged when the ambient depth is 0.\n      const currentDepth = _parentDepth + currentDelegationDepth() + 1;\n      if (currentDepth > maxDepth) {\n        throw new MaxDelegationDepthError(currentDepth, maxDepth);\n      }\n      iteration += 1; // SE15 — before onDelegationStart; a rejected delegation still counts.\n      // Pin THIS invocation's iteration before any await so a concurrent invocation\n      // bumping the shared counter cannot change the value onDelegationComplete /\n      // notifyDelegationError observe — they see the same iteration onDelegationStart did.\n      const capturedIteration = iteration;\n\n      const start = await applyDelegationStart(spec, parsed, capturedIteration);\n      if (\"reject\" in start) return start.reject;\n      // SE12 — opt-in: forward the filtered supervisor transcript as a preamble.\n      const input = applyMessageFilter(spec, start.input, ctx?.messages);\n\n      let result: string;\n      try {\n        // SE13 — apply the optional onDelegationStart maxSteps cap on the child send.\n        result = await runChildAgent(\n          spec,\n          input,\n          ctx?.signal,\n          start.maxSteps,\n          inherited,\n          currentDepth,\n        );\n      } catch (error) {\n        // SE11 — notify the completion hook of the failure (best-effort observer),\n        // then re-throw the ORIGINAL error (Rule 8: never swallow the delegation's\n        // own failure).\n        await notifyDelegationError(spec, input, error, capturedIteration);\n        throw error;\n      }\n      return applyDelegationComplete(spec, input, result, capturedIteration);\n    },\n  };\n\n  // theokit#148 — nothing is installed on the tool. The credentials arrive through the run's async\n  // scope (see `internal/runtime/concurrency/subagent-credentials.ts`), so there is no extra\n  // property for a normalizing layer to drop.\n  return tool;\n}\n\n/** SE36 — `SubAgent.create` replaces `defineSubAgent` (ADR 0015). @public  *\n * `SubAgent.create` returns a **`CustomTool`** — the sub-agent is exposed to the\n * parent as a callable tool, not as a `SubAgent` instance.\n */\nexport class SubAgent {\n  private constructor() {}\n  static create(spec: SubAgentSpec, parentDepth = 0): CustomTool {\n    return defineSubAgent(spec, parentDepth);\n  }\n}\n\n/**\n * Convert a parent's declarative `agents` map ({@link AgentDefinition} per key)\n * into delegation tools for the LOCAL runtime — the counterpart of the\n * cloud/fixture subagent wiring. Each child inherits the parent's `apiKey`/model\n * from the CALL, not from the tool object: `inheritSubAgentCredentials` used to\n * attach them to the tool, and any layer that rebuilt that object dropped them —\n * including the SDK's own rebuild (theokit#148). Credentials now ride the\n * dispatch, so a rebuilt tool cannot lose them. `def.model` overrides the model\n * (`\"inherit\"` keeps the parent's), and `def.tools` scopes the child to that\n * subset of the parent's tools (absent → the parent's full toolset, per the\n * `AgentDefinition.tools` contract).\n *\n * M33 — per-subagent `model` (with reasoning `params`) and `sandbox` are now wired\n * into local delegation: each is carried onto the {@link SubAgentSpec} and applied to\n * the child in {@link buildChildCreateOptions}. `\"inherit\"` (or an absent field) keeps\n * the parent's value. Per-subagent `mcp` is rejected at load (see subagents-loader) —\n * resolving server names→config on the local path is a follow-up.\n *\n * @internal\n */\nexport function subAgentToolsFromDefinitions(\n  agents: Record<string, AgentDefinition>,\n  parentTools: readonly CustomTool[],\n): CustomTool[] {\n  return Object.entries(agents).map(([name, def]) => {\n    const whitelist =\n      Array.isArray(def.tools) && def.tools.length > 0 ? new Set(def.tools) : undefined;\n    const childTools = whitelist ? parentTools.filter((t) => whitelist.has(t.name)) : parentTools;\n    return defineSubAgent({\n      name,\n      description: def.description,\n      instructions: def.prompt,\n      // Carry the FULL ModelSelection (id + reasoning params), not just the id, so\n      // per-subagent reasoning effort survives to buildChildCreateOptions.\n      ...(def.model !== undefined && def.model !== \"inherit\" ? { model: def.model } : {}),\n      ...(def.sandbox !== undefined ? { sandbox: def.sandbox } : {}),\n      tools: [...childTools],\n    });\n  });\n}\n"]}

package/dist/{chunk-DLRP7BI6.cjs → chunk-NYQ3IS7K.cjs}

@@ -78,7 +78,7 @@ function reportUndeclaredSources(cwd, declared) {
     if (reported.has(dir)) continue;
     reported.add(dir);
     chunk6LHQPOMI_cjs.diagFailure(
-      `[theokit] ${adapter.dirName}/ is present but not declared, so its hooks, skills, subagents and plugins are ignored. To read it, pass local: { compatSources: ["${adapter.kind}"] } (usetheokit/theokit-sdk#524).
+      `[theokit] ${adapter.dirName}/ is present but not declared, so its hooks, skills, subagents and plugins are ignored. To read it, add {"compat":{"adapters":["${adapter.kind}"]}} to .theokit/config.json \u2014 or, if you embed this SDK, pass local: { compatSources: ["${adapter.kind}"] } (usetheokit/theokit-sdk#524).
 `
     );
   }
@@ -126,5 +126,5 @@ exports.projectConfigRoots = projectConfigRoots;
 exports.reportUndeclaredSources = reportUndeclaredSources;
 exports.theokitConfigRoot = theokitConfigRoot;
 exports.undefinedVariablesIn = undefinedVariablesIn;
-//# sourceMappingURL=chunk-DLRP7BI6.cjs.map
-//# sourceMappingURL=chunk-DLRP7BI6.cjs.map
+//# sourceMappingURL=chunk-NYQ3IS7K.cjs.map
+//# sourceMappingURL=chunk-NYQ3IS7K.cjs.map

package/dist/chunk-NYQ3IS7K.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/runtime/compat/foreign-config-sources.ts","../src/internal/persistence/paths.ts"],"names":["join","existsSync","diagFailure","homedir"],"mappings":";;;;;;;AAmDO,IAAM,mBAAA,GAAsB,UAAA;AAG5B,IAAM,eAAA,GAAkB,SAAA;AAkBxB,IAAM,aAAA,GAAqC;AAAA,EAChD,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS,mBAAA;AAAA,EACT,UAAA,EAAY,OAAO,EAAC;AACtB,CAAA;AAWO,IAAM,kBAAA,GAA0C;AAAA,EACrD,IAAA,EAAM,aAAA;AAAA,EACN,OAAA,EAAS,eAAA;AAAA,EACT,UAAA,EAAY,CAAC,GAAA,MAAS,EAAE,oBAAoB,GAAA,EAAI;AAClD,CAAA;AAEA,IAAM,eAAA,GAAkD,CAAC,kBAAkB,CAAA;AAE3E,IAAM,cAAwD,IAAI,GAAA;AAAA,EAChE,CAAC,aAAA,EAAe,GAAG,eAAe,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,OAAA,EAAS,CAAC,CAAC;AAC/D,CAAA;AASO,SAAS,YAAY,KAAA,EAAiD;AAC3E,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,eAAA,CAAgB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAC,CAAC,CAAA;AAC9D,EAAA,MAAM,MAA6B,EAAC;AACpC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,OAAA,KAAY,UAAa,CAAC,GAAA,CAAI,SAAS,OAAO,CAAA,EAAG,GAAA,CAAI,IAAA,CAAK,OAAO,CAAA;AAAA,EACvE;AACA,EAAA,OAAO,GAAA;AACT;AAYA,IAAM,eAAA,GAA4C,CAAC,OAAA,EAAS,SAAA,EAAW,UAAU,WAAW,CAAA;AAsBrF,SAAS,kBAAA,CACd,SACA,OAAA,EACuB;AACvB,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,MAAA,QAAA,CAAS,KAAK,MAAM,CAAA;AACpB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,EAAC;AACjC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,KAAM,WAAW,eAAA,CAAgB,QAAA,CAAS,CAAkB,CAAC,CAAA,EAAG;AACrF,MAAA,QAAA,CAAS,IAAA,CAAK,OAAO,IAAI,CAAA;AAAA,IAC3B;AAAA,EACF;AACA,EAAA,OAAO,YAAY,QAAQ,CAAA;AAC7B;AASO,SAAS,qBAAqB,IAAA,EAA+C;AAClF,EAAA,KAAA,MAAW,OAAA,IAAW,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA,EAAG;AACzC,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AACvC,IAAA,IAAI,OAAA,KAAY,QAAW,OAAO,OAAA;AAAA,EACpC;AACA,EAAA,OAAO,MAAA;AACT;AAuBO,SAAS,oBAAA,CACd,OAAA,EACA,QAAA,EACA,GAAA,GAAoD,QAAQ,GAAA,EAClD;AAEV,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA;AAChD,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,KAAA,MAAW,SAAS,QAAA,CAAS,QAAA;AAAA,IAC3B;AAAA,GACF,EAAG;AACD,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,MAAM,CAAC,CAAA;AAChC,IAAA,IAAI,SAAS,MAAA,EAAW;AACxB,IAAA,IAAI,QAAQ,QAAA,EAAU;AACtB,IAAA,IAAI,GAAA,CAAI,IAAI,CAAA,KAAM,MAAA,EAAW;AAC7B,IAAA,KAAA,CAAM,IAAI,IAAI,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,CAAC,GAAG,KAAK,CAAA;AAClB;AAQA,IAAM,QAAA,uBAAe,GAAA,EAAY;AA4C1B,SAAS,uBAAA,CACd,KACA,QAAA,EACM;AAKN,EAAA,MAAM,gBAAgB,IAAI,GAAA;AAAA,IACxB,YAAY,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,CAAA,CAAE,IAAK,CAAC,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI;AAAA,GAC1F;AACA,EAAA,KAAA,MAAW,WAAW,eAAA,EAAiB;AACrC,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACrC,IAAA,MAAM,GAAA,GAAMA,SAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,OAAO,CAAA;AACrC,IAAA,IAAI,CAACC,aAAA,CAAW,GAAG,CAAA,EAAG;AACtB,IAAA,IAAI,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,IAAA,QAAA,CAAS,IAAI,GAAG,CAAA;AAyBhB,IAAAC,6BAAA;AAAA,MACE,CAAA,UAAA,EAAa,QAAQ,OAAO,CAAA,gIAAA,EAEC,QAAQ,IAAI,CAAA,8FAAA,EACK,QAAQ,IAAI,CAAA;AAAA;AAAA,KAE5D;AAAA,EACF;AACF;;;ACjQO,SAAS,eAAe,GAAA,EAAqB;AAClD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,IAAA,EAAK;AAChD,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AACjD,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,OAAOF,SAAAA,CAAK,KAAK,mBAAmB,CAAA;AACtC;AAmBO,SAAS,kBAAkB,GAAA,EAAqB;AACrD,EAAA,OAAOA,SAAAA,CAAK,KAAK,mBAAmB,CAAA;AACtC;AAuBO,SAAS,kBAAA,CACd,GAAA,EACA,OAAA,EACA,OAAA,EACU;AACV,EAAA,OAAO;AAAA,IACL,kBAAkB,GAAG,CAAA;AAAA,IACrB,GAAG,kBAAA,CAAmB,OAAA,EAAS,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,OAAA,KAAYA,SAAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,OAAO,CAAC;AAAA,GACrF;AACF;AAeO,SAAS,iBAAA,CACd,KACA,OAAA,EACU;AAMV,EAAA,OAAO,kBAAA,CAAmB,GAAA,EAAK,OAAA,EAAS,SAAS,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAASA,SAAAA,CAAK,IAAA,EAAM,SAAS,CAAC,CAAA;AACxF;AAeO,SAAS,eAAA,GAA0B;AACxC,EAAA,OAAOA,SAAAA,CAAKG,UAAA,EAAQ,EAAG,mBAAA,EAAqB,UAAU,CAAA;AACxD;AAmBO,SAAS,mBAAmB,GAAA,EAAqB;AACtD,EAAA,MAAM,QAAA,GAAW,eAAe,GAAG,CAAA;AACnC,EAAA,MAAM,OAAOA,UAAA,EAAQ;AACrB,EAAA,IAAI,QAAA,KAAa,MAAM,OAAO,GAAA;AAC9B,EAAA,IAAI,QAAA,CAAS,UAAA,CAAW,CAAA,EAAG,IAAI,GAAG,CAAA,EAAG;AACnC,IAAA,OAAO,CAAA,CAAA,EAAI,QAAA,CAAS,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,QAAA;AACT","file":"chunk-NYQ3IS7K.cjs","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nimport { diagFailure } from \"../../diagnostics.js\";\n\n/*\n * The foreign configuration dialects this SDK can read, and what each one PRESUMES.\n *\n * ## Why a registry and not a list of directory names\n *\n * `projectConfigRoots` returned `[\".theokit\", \".claude\"]` — two paths — and that shape is what\n * usetheokit/theokit-sdk#522 fell through. A path says WHERE a file lives. It does not say how the\n * file is parsed, and it does not say what runtime the commands inside it were written against.\n *\n * Claude Code defines `$CLAUDE_PROJECT_DIR` for the hook commands in its `settings.json`, and its\n * documentation tells authors to reach project files through it — an absolute path would break for\n * every other person on the team, so the shape that failed here is the shape upstream recommends.\n * This SDK read the file and ran the command without the variable. `sh` expands an unset variable to\n * the empty string, so\n *\n *     bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/guard.sh\"   became   bash \"/.claude/hooks/guard.sh\"\n *\n * which does not exist, which a hook runner correctly reads as a refusal. Every turn denied, in any\n * repository that also had Claude Code set up, with a message naming a file that was present and\n * executable all along.\n *\n * Importing a format means accepting the contract that format presumes. An adapter is where that\n * contract is written down, so the next dialect (`.codex/` is the obvious one) declares its own\n * instead of inheriting a hole.\n *\n * ## What an adapter deliberately does NOT do\n *\n * It does not make the foreign source trusted, and it does not make its hooks permissive: a script\n * that exits non-zero is still a refusal. It supplies the variables the format's authors were\n * entitled to assume, and nothing else — `env` here is merged over the scrubbed inherit policy by\n * `spawnAndCollect`, so it adds names rather than widening what a child can see.\n *\n * @internal\n */\n\n/**\n * The project config directory literal.\n *\n * Renamed from `THEOKIT_DIR_NAME` in #410. Sharing a name with the (now removed) sovereign env var\n * was the MECHANISM of that defect, not scenery: every grep for the variable landed on that const\n * and looked answered, so \"is it read?\" returned five hits and nobody checked what they were.\n *\n * Lives here rather than in `persistence/paths.ts` because a directory name is one third of what a\n * dialect is — the other two being how it parses and what it presumes — and splitting the three\n * across two modules is what let the third go unwritten.\n */\nexport const THEOKIT_DIR_LITERAL = \".theokit\";\n\n/** The Claude Code CLI's project configuration directory. */\nexport const CLAUDE_DIR_NAME = \".claude\";\n\n/** A configuration dialect this SDK understands. `theokit` is native; the rest are foreign. */\nexport interface ConfigSourceAdapter {\n  /** Stable identifier, and what a consumer names to opt in. */\n  readonly kind: string;\n  /** The project-relative directory the dialect keeps its configuration in. */\n  readonly dirName: string;\n  /**\n   * Variables the dialect's own runtime defines for commands it executes.\n   *\n   * Empty for the native source: a `.theokit/` hook is written against THIS runtime and inherits it\n   * already. Non-empty is what makes a foreign command runnable rather than silently broken.\n   */\n  runtimeEnv(cwd: string): Record<string, string>;\n}\n\n/** The native source. Always read, never opted into, always first for precedence. */\nexport const NATIVE_SOURCE: ConfigSourceAdapter = {\n  kind: \"theokit\",\n  dirName: THEOKIT_DIR_LITERAL,\n  runtimeEnv: () => ({}),\n};\n\n/**\n * Claude Code.\n *\n * `CLAUDE_PROJECT_DIR` is the documented way for a hook command in `settings.json` to reach a file\n * in the project. Only that one variable is supplied: `$CLAUDE_PLUGIN_ROOT` and the rest of that\n * runtime's surface are NOT defined here, because supplying a name whose value this SDK would have\n * to invent is worse than leaving it unset — an invented root sends a script somewhere real and\n * wrong, where an unset one fails loudly.\n */\nexport const CLAUDE_CODE_SOURCE: ConfigSourceAdapter = {\n  kind: \"claude-code\",\n  dirName: CLAUDE_DIR_NAME,\n  runtimeEnv: (cwd) => ({ CLAUDE_PROJECT_DIR: cwd }),\n};\n\nconst FOREIGN_SOURCES: readonly ConfigSourceAdapter[] = [CLAUDE_CODE_SOURCE];\n\nconst BY_DIR_NAME: ReadonlyMap<string, ConfigSourceAdapter> = new Map(\n  [NATIVE_SOURCE, ...FOREIGN_SOURCES].map((a) => [a.dirName, a]),\n);\n\n/**\n * The adapters a caller declared, in declaration order, skipping any name that names no adapter.\n *\n * An unknown name is DROPPED rather than turned into `<cwd>/<name>`: a typo must fail closed. Making\n * a directory out of an unrecognised string would import a dialect nothing knows how to parse — and\n * the whole reason this exists is that a directory name was never enough to describe a dialect.\n */\nexport function adaptersFor(kinds: readonly string[]): ConfigSourceAdapter[] {\n  const byKind = new Map(FOREIGN_SOURCES.map((a) => [a.kind, a]));\n  const out: ConfigSourceAdapter[] = [];\n  for (const kind of kinds) {\n    const adapter = byKind.get(kind);\n    if (adapter !== undefined && !out.includes(adapter)) out.push(adapter);\n  }\n  return out;\n}\n\n/**\n * A surface a foreign source may be admitted to. The four the SDK reads a project directory for.\n *\n * They are listed separately because they carry very different risk, which is the whole reason\n * #524 asks for per-surface control: a skill is text that enters the system prompt, a hook is\n * command execution, a plugin is code loading. A consumer who wants their skills back has no\n * reason to be handed the other two along with them.\n */\nexport type CompatSurface = \"hooks\" | \"plugins\" | \"skills\" | \"subagents\";\n\nconst COMPAT_SURFACES: readonly CompatSurface[] = [\"hooks\", \"plugins\", \"skills\", \"subagents\"];\n\n/**\n * A declared foreign source: a bare kind, or a kind with the surfaces it may be read for.\n */\nexport type CompatSourceDeclaration =\n  | string\n  | { readonly kind: string; readonly import?: readonly string[] };\n\n/**\n * The adapters admitted to ONE surface.\n *\n * Three rules, and each one fails closed:\n *\n * - A bare string admits every surface. It is what `5.0.0-next.1` published, so narrowing it\n *   silently would turn a working opt-in into a no-op — the exact defect #524 is about, one level\n *   up.\n * - An object with no `import` admits nothing. The issue's own rule, and safe to apply strictly\n *   because the object form is new and nobody can be depending on it.\n * - An unrecognised surface name is dropped rather than matched loosely, for the same reason an\n *   unrecognised KIND is dropped in {@link adaptersFor}: a typo must not silently widen access.\n */\nexport function adaptersForSurface(\n  sources: readonly CompatSourceDeclaration[],\n  surface: CompatSurface,\n): ConfigSourceAdapter[] {\n  const admitted: string[] = [];\n  for (const source of sources) {\n    if (typeof source === \"string\") {\n      admitted.push(source);\n      continue;\n    }\n    const wanted = source.import ?? [];\n    if (wanted.some((s) => s === surface && COMPAT_SURFACES.includes(s as CompatSurface))) {\n      admitted.push(source.kind);\n    }\n  }\n  return adaptersFor(admitted);\n}\n\n/**\n * The adapter whose directory an absolute config path sits under, or `undefined` for a path that\n * belongs to no registered dialect.\n *\n * Matched on the path SEGMENT rather than with `includes`, so a workspace that happens to live under\n * `/home/me/.claude-backups/repo` does not read as a Claude Code source.\n */\nexport function adapterForConfigPath(path: string): ConfigSourceAdapter | undefined {\n  for (const segment of path.split(/[\\\\/]/)) {\n    const adapter = BY_DIR_NAME.get(segment);\n    if (adapter !== undefined) return adapter;\n  }\n  return undefined;\n}\n\n/**\n * Variable references in a shell command that nothing will define.\n *\n * The second half of #522, and the half that cost the debugging session. `sh` expands an unset\n * variable to the empty string and says nothing, so the failure surfaces ten characters later as a\n * path: `bash: /.claude/hooks/guard.sh: No such file or directory` — which reads as \"your script is\n * missing\" while the script is present and executable. Nothing in that message contains the name of\n * the variable that was actually missing, so the reader looks in the wrong place.\n *\n * Checked against BOTH the process environment and the variables the dialect supplies, because\n * either is a legitimate source: a hook may reasonably use `$HOME`.\n *\n * ## What it deliberately does not try to be\n *\n * This is not a shell parser. It finds `$NAME` and `${NAME}` outside single quotes, which is the\n * shape a config file's hook commands take. It does NOT understand `${NAME:-default}` (a default\n * makes the variable optional, so it is not reported), assignments earlier in the same command, or\n * variables a sourced script exports. A false NEGATIVE there costs the old behaviour — the confusing\n * path error — and a false positive would deny a hook that would have worked, so the parse errs\n * toward silence and the check only ever ADDS a name to a failure that already happened.\n */\nexport function undefinedVariablesIn(\n  command: string,\n  supplied: Readonly<Record<string, string>>,\n  env: Readonly<Record<string, string | undefined>> = process.env,\n): string[] {\n  // Single-quoted spans are literal in `sh`: `echo '$FOO'` prints the dollar sign.\n  const unquoted = command.replace(/'[^']*'/g, \" \");\n  const names = new Set<string>();\n  for (const match of unquoted.matchAll(\n    /\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}|\\$([A-Za-z_][A-Za-z0-9_]*)/g,\n  )) {\n    const name = match[1] ?? match[2];\n    if (name === undefined) continue;\n    if (name in supplied) continue;\n    if (env[name] !== undefined) continue;\n    names.add(name);\n  }\n  return [...names];\n}\n\n/**\n * Workspaces already reported, so repeated agent construction in one process says it once.\n *\n * Keyed by the resolved directory rather than by dialect kind, so a long-lived host that drives\n * several workspaces still reports each of them.\n */\nconst reported = new Set<string>();\n\n/**\n * Reports a foreign configuration directory that exists in the workspace and was not declared.\n *\n * ## Why the flip needs a voice\n *\n * Before #524 a `.claude/` was read with no opt-in; after it, the same directory is ignored. From\n * inside the repository the two states are indistinguishable — the hook file is there, it is\n * executable, and it does not run. The only remaining way to learn why is a CHANGELOG entry for a\n * version the reader may not know they crossed.\n *\n * ## Why `diagFailure` rather than `diag` (#563)\n *\n * This used `diag`, on the reasoning that ignoring an undeclared directory is not a failure and\n * that a repository which does NOT want the import should not pay a stderr line for behaving as\n * instructed. The reasoning was sound and rested on a premise nobody checked: that a host would\n * have installed a sink.\n *\n * Measured against the published `5.0.0`. `diag` returns without doing anything when no sink is\n * installed. The SDK installs none — `currentSink()` reads a `globalThis` slot only\n * `setDiagnosticsSink` fills. Neither observable host installs one either: `theocode` renamed the\n * key, and `theokit` exports `installDiagnosticSink` and never calls it. Two hosts out of two, and\n * the SDK itself. So the message the CHANGELOG promised — \"says so once, on the diagnostics\n * channel\" — reached nobody, while the consumer lost hooks, skills, subagents and plugins.\n *\n * A mitigation announced in release notes for a silent loss of capability is not a diagnostic. It\n * is the error path of the breaking change itself, and `diagFailure` exists for exactly the message\n * that must not be swallowed.\n *\n * The cost the old reasoning named is real and is now paid: a repository that wants the directory\n * ignored sees a line. What makes that acceptable — ONCE per directory per process, not per turn\n * (`reported` below); and before #524 that repository was having `.claude/` imported anyway, so the\n * line it now sees confirms the fix it wanted. The asymmetry is one line of text against silently\n * losing four subsystems.\n *\n * A host that installs a sink still owns its render surface: `diagFailure` prefers the sink and\n * only falls back to stderr when there is none.\n *\n * NOT solved here: there is no way to say \"I know, and I want none\". `compatSources: []` would be\n * the natural spelling, but `resolveCompatSources` collapses it into the same `[]` an absent option\n * produces, so this function cannot tell them apart. If the noise turns out to matter, threading\n * that distinction through is the shape of the fix.\n */\nexport function reportUndeclaredSources(\n  cwd: string,\n  declared: readonly CompatSourceDeclaration[],\n): void {\n  // A kind named with a NARROW import list has still been declared: the consumer knows the\n  // directory is there and chose which surfaces to admit. Warning them anyway would be the noise\n  // that gets a warning ignored, and this one has exactly one job — telling somebody who does NOT\n  // know the directory is being skipped.\n  const declaredKinds = new Set(\n    adaptersFor(declared.map((d) => (typeof d === \"string\" ? d : d.kind))).map((a) => a.kind),\n  );\n  for (const adapter of FOREIGN_SOURCES) {\n    if (declaredKinds.has(adapter.kind)) continue;\n    const dir = join(cwd, adapter.dirName);\n    if (!existsSync(dir)) continue;\n    if (reported.has(dir)) continue;\n    reported.add(dir);\n    // THE FILE IS NAMED FIRST because it is the entry point this message's reader can use.\n    //\n    // #524 gives the declaration two entry points for one shape: `.theokit/config.json`'s\n    // `compat.adapters`, and `local.compatSources` in code. Until this change the warning named\n    // only the second — and `local` is an argument the SDK's EMBEDDER passes, not something the\n    // person reading the line can reach. Reported by the `theocode` session against 5.0.1: a user\n    // of a host that embeds this SDK is told to pass an option that does not exist on their\n    // surface, which is advice that is true about the mechanism and unusable as an action.\n    //\n    // The file is writable by anyone holding the workspace, which is exactly who sees this line.\n    //\n    // WHAT THIS LINE CANNOT KNOW, and it is a real limit rather than a caveat for form's sake. It\n    // reports one fact: this SDK is ignoring the directory because nothing declared it. A HOST\n    // embedding the SDK may be withholding the same directory for its own reasons — `theocode`\n    // gates repository configuration on a trust posture — and the SDK cannot see that gate.\n    //\n    // So in a host that is also withholding, following this advice makes the warning stop and\n    // changes nothing the user can do. That silence is honest about the SDK (it did stop ignoring\n    // the directory) and uninformative about the outcome. Measured by the `theocode` session with\n    // the control that settles it: a NATIVE `.theokit/` hook does not fire there either, so the\n    // host's gate — not this declaration — is what holds the capability back.\n    //\n    // Nothing here can fix that. If a host ever gains a way to say \"I am withholding this too\",\n    // this is the line where that belongs.\n    diagFailure(\n      `[theokit] ${adapter.dirName}/ is present but not declared, so its hooks, skills, subagents ` +\n        `and plugins are ignored. To read it, add ` +\n        `{\"compat\":{\"adapters\":[\"${adapter.kind}\"]}} to .theokit/config.json — or, if you embed ` +\n        `this SDK, pass local: { compatSources: [\"${adapter.kind}\"] } ` +\n        `(usetheokit/theokit-sdk#524).\\n`,\n    );\n  }\n}\n","/**\n * Path resolution for SDK state files (ADR D60).\n *\n * Theokit anchors state at `<cwd>/.theokit/` by default (per-cwd). An\n * optional `THEOKIT_HOME` environment variable overrides this, enabling\n * test isolation, profile switching, and multi-tenant deployments.\n *\n * Rules:\n *   - `getTheokitHome(cwd)` is the canonical resolver **for cwd-anchored state**. Never hardcode\n *     `path.join(cwd, \".theokit\")` in callers — use this function so tests\n *     and overrides stay consistent.\n *\n *     M94 — this comment said \"the ONLY canonical resolver\", and stopped being true: the\n *     transcript gained `transcriptRoot()`, which is **home-anchored** (`~/.theokit`) with the same\n *     `THEOKIT_HOME` override. The two defaults differ on purpose — unifying would move the\n *     transcript of everyone who does NOT set the variable, which is a data migration and not a\n *     re-export.\n *\n *     A consequence worth writing down: **without `THEOKIT_HOME` the state stays split in two**\n *     — registry in `<cwd>/.theokit`, transcript in `~/.theokit`. M94 unifies only for those who set\n *     the variable. Unifying both defaults is another milestone's work.\n *   - `getProfilesRoot()` is intentionally home-anchored (not affected by\n *     `THEOKIT_HOME`) so `theokit profile list` discovers all profiles\n *     regardless of which is active.\n *   - `displayTheokitHome(cwd)` returns a human-readable path for logs.\n *\n * @internal\n */\n\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\nimport {\n  adaptersForSurface,\n  type CompatSourceDeclaration,\n  type CompatSurface,\n  THEOKIT_DIR_LITERAL,\n} from \"../runtime/compat/foreign-config-sources.js\";\n\n// The directory names live with the dialect registry that owns them — a name is one third of what a\n// configuration dialect is, and keeping the three together is what stops the next one shipping\n// without its runtime contract (#522).\n\n/**\n * Resolve the directory cwd-anchored SDK state lives in.\n *\n * `THEOKIT_HOME` wins when it is set and not blank after trimming; the trimmed value is used, and\n * it is used VERBATIM — it is not resolved against `cwd`, so a relative value stays relative and\n * `.theokit` is not appended to it. Otherwise the answer is `<cwd>/.theokit`.\n *\n * The environment is read on every call, so a change to the variable takes effect immediately\n * rather than being frozen at import.\n *\n * This creates nothing and checks nothing: the returned path may not exist, and the caller owns\n * the `mkdir`. Call it instead of writing `join(cwd, \".theokit\")` by hand, or the override stops\n * working for that one call site and tests silently touch the real home.\n *\n * Not the whole story about where state lives — the transcript is home-anchored via\n * `transcriptRoot()`, honoring the same variable but defaulting to `~/.theokit`. With\n * `THEOKIT_HOME` unset, state is genuinely split between two roots.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function getTheokitHome(cwd: string): string {\n  const override = process.env.THEOKIT_HOME?.trim();\n  if (override !== undefined && override.length > 0) {\n    return override;\n  }\n  return join(cwd, THEOKIT_DIR_LITERAL);\n}\n\n/**\n * The project's own configuration root: `<cwd>/.theokit`, always — never `THEOKIT_HOME`.\n *\n * `THEOKIT_HOME` relocates cwd-anchored SDK STATE (sessions, credentials). A project's\n * CONFIGURATION belongs to the repository: hooks, MCP servers, context sources, subagents, the\n * personality a project declares, all committed to git and shared by a team. Following the\n * override for any of them would move where a project's declared capabilities come from — a\n * behaviour change wearing the costume of a refactor, which is exactly what this function exists\n * to make impossible to do by accident: every config-class reader calls this instead of writing\n * `join(cwd, \".theokit\")` by hand.\n *\n * NOT for the `.claude/`-style foreign roots {@link adaptersForSurface} adds — those are additive,\n * opt-in, and each has its own directory name.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function theokitConfigRoot(cwd: string): string {\n  return join(cwd, THEOKIT_DIR_LITERAL);\n}\n\n/**\n * Every directory a project's configuration may be read from, in precedence order.\n *\n * `.theokit` first — via {@link theokitConfigRoot}, so it is NEVER affected by `THEOKIT_HOME` for\n * the reason documented there — then `.claude`. The order is the whole contract: a project that\n * declares a skill, agent or rule in both means the explicit namespace to win, and a caller merging\n * these roots must therefore keep the FIRST occurrence of a name rather than the last.\n *\n * `.claude` is read because the formats already agree and only the location did not. Measured\n * 2026-08-26: the SKILL.md frontmatter this SDK requires (`name` + `description`) is exactly what\n * the CLI writes, its hook config is the same JSON shape, and 59 of the CLI's agent declarations\n * parse here unchanged. A repository set up for the CLI was failing on the directory name alone.\n *\n * NOT a rename of `.theokit`, and not a migration. Both are read, so nothing that works today stops\n * working — which is why this returns a LIST and not a single resolved answer.\n *\n * Creates nothing and checks nothing; either path may not exist, and the caller owns that.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function projectConfigRoots(\n  cwd: string,\n  sources: readonly CompatSourceDeclaration[],\n  surface: CompatSurface,\n): string[] {\n  return [\n    theokitConfigRoot(cwd),\n    ...adaptersForSurface(sources, surface).map((adapter) => join(cwd, adapter.dirName)),\n  ];\n}\n\n/**\n * Every directory that may hold a plugin BUNDLE contributed by the Claude Code CLI.\n *\n * A CLI plugin is not a JS entry point — it is a folder whose `skills/` and `agents/` are what it\n * exists to provide. Measured 2026-08-26 on an installed one: seven agents and three skills beside\n * a manifest in `.claude-plugin/plugin.json`. Parsing that manifest and stopping there produced a\n * plugin that loaded and did nothing.\n *\n * Project-scoped deliberately. The CLI also keeps plugins under `~/.claude/plugins/cache`, behind\n * its own installer and enable/disable state — reproducing that is an installation system, not\n * reading a project's configuration, and guessing at someone's enablement would run code they\n * turned off.\n */\nexport function pluginBundleRoots(\n  cwd: string,\n  sources: readonly CompatSourceDeclaration[],\n): string[] {\n  // Always the `plugins` surface, including when the caller wants the SKILLS a bundle carries.\n  // A bundle is code, and its skills arrive attached to it: admitting `skills` alone must not\n  // reach inside a foreign plugin directory, or the narrower permission would silently grant the\n  // wider one. `skills-manager` and `subagents-loader` both read bundle contents and both go\n  // through here, so the rule holds in one place rather than three.\n  return projectConfigRoots(cwd, sources, \"plugins\").map((root) => join(root, \"plugins\"));\n}\n\n/**\n * The directory holding every profile: always `~/.theokit/profiles`, from `os.homedir()`.\n *\n * Deliberately NOT affected by `THEOKIT_HOME`, which is the one thing to remember about it. If it\n * followed the override, a session pointed at one profile would only be able to see that profile,\n * and `theokit profile list` could never enumerate the rest. Profiles are the thing the override\n * switches between, so their index cannot live behind it.\n *\n * Takes no `cwd` for the same reason. Creates nothing; the path may not exist.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function getProfilesRoot(): string {\n  return join(homedir(), THEOKIT_DIR_LITERAL, \"profiles\");\n}\n\n/**\n * The same path `getTheokitHome(cwd)` returns, shortened for display: the home directory prefix\n * collapses to `~`, so `/home/ada/.theokit` prints as `~/.theokit`.\n *\n * For humans only — log lines, CLI output, error messages. The result is NOT a usable path: `~`\n * is a shell convention that `fs` does not expand, so passing this to a filesystem call resolves\n * a literal directory named `~` relative to the process cwd. Use `getTheokitHome` for anything\n * that touches disk.\n *\n * Collapsing is a prefix match on the home directory followed by a literal `/`, so a sibling like\n * `/home/adalovelace` is left alone even though `/home/ada` is a string prefix of it. A path\n * outside the home directory comes back unchanged — and so does a Windows path, where the\n * separator is a backslash and the prefix test therefore never matches.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function displayTheokitHome(cwd: string): string {\n  const resolved = getTheokitHome(cwd);\n  const home = homedir();\n  if (resolved === home) return \"~\";\n  if (resolved.startsWith(`${home}/`)) {\n    return `~${resolved.slice(home.length)}`;\n  }\n  return resolved;\n}\n"]}

package/dist/{chunk-7RHC7HMS.js → chunk-OQRGVTQF.js}

@@ -1,4 +1,4 @@
-import { pluginBundleRoots, projectConfigRoots } from './chunk-GUKPXDGJ.js';
+import { pluginBundleRoots, projectConfigRoots } from './chunk-WMWEI3NS.js';
 import { readWorkspaceDir, parseSimpleYaml } from './chunk-JNAA4G4H.js';
 import { ConfigurationError } from './chunk-ALUN2B4W.js';
 import { diag } from './chunk-CZJ6Q7CW.js';
@@ -165,5 +165,5 @@ function parseFrontmatterFields(frontmatter) {
 }
 
 export { loadSubagents, pluginBundleDirs };
-//# sourceMappingURL=chunk-7RHC7HMS.js.map
-//# sourceMappingURL=chunk-7RHC7HMS.js.map
+//# sourceMappingURL=chunk-OQRGVTQF.js.map
+//# sourceMappingURL=chunk-OQRGVTQF.js.map