@theokit/sdk 5.12.0 → 5.13.0

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # Changelog
 
+## 5.13.0
+
+### Minor Changes
+
+- [#783](https://github.com/usetheokit/theokit-sdk/pull/783) [`a390f10`](https://github.com/usetheokit/theokit-sdk/commit/a390f101a28e7207fdff9b50891b1defcb89bcde) Thanks [@usetheodev](https://github.com/usetheodev)! - The manifest plugin entry of a trusted workspace plugin folder is now imported. A folder under `<cwd>/.theokit/plugins/<folder>/` whose `PLUGIN.md` names an `entry` used to be listed by `agent.plugins.list()` and never imported, so the tools its `register` adds never reached a run. With `local.settingSources` including `"plugins"`, `Agent.create` now imports that entry and registers its default export, which must be a `kind: "general"` plugin, alongside `AgentOptions.plugins`.
+  
+  Trust is by the folder's absolute realpath, in a trust record of its own: `~/.theokit/plugins/trusted-workspace-plugins.json`, a JSON array of folder realpaths, read on every `Agent.create`. The provider trust list (`trusted-providers.json`, `THEOKIT_TRUSTED_PROVIDERS`) does not authorize a workspace folder, so a repository you cloned cannot get its code run by naming a folder after a provider you trust. A relative entry is discarded with a warning, and a record that is not a valid JSON array trusts nothing. An untrusted folder is listed, never imported, and diagnosed once per process with the realpath to add. Plugins found under a foreign root (`compatSources`, such as `.claude/plugins`) are never imported, and neither `agent.reload()` nor a manifest without an `entry` imports anything. A changed entry needs a process restart, since Node caches the module.
+  
+  The provider trust gate is now read on every `Agent.create` too: a provider plugin trusted between two creates is imported by the second, and each provider is still imported at most once per process. The untrusted-provider warning no longer says to restart.
+  
+  A trusted entry that cannot be used fails `Agent.create` with a `ConfigurationError` naming the plugin: `plugin_entry_import_failed` when the module throws on import (the thrown error is the `cause`), and `plugin_entry_shape` when its default export is not a general plugin with a `name` and a `register` function.
+
+- [#801](https://github.com/usetheokit/theokit-sdk/pull/801) [`bcac0e7`](https://github.com/usetheokit/theokit-sdk/commit/bcac0e702d99bb7e2a491c5c96e5f14b051cef2c) Thanks [@usetheodev](https://github.com/usetheodev)! - Add `denyReadPaths` to the `@theokit/sdk/sandbox` backends (`LinuxSandbox`, `createSandboxBackend`, `interactiveWrapCommand`, `wrapCommandForSandbox` and `buildBwrapArgv`) so a `workspace-write` or `read-only` shell cannot read named absolute paths. A directory is masked with `--tmpfs` and reads as empty, a file with `--ro-bind /dev/null` and reads as permission denied; the mask is placed after the writable binds, so it also hides a path inside the workspace or `/tmp`. A masked file still appears in the listing of its directory. A list that cannot be honoured throws instead of running unconfined: `TypeError` for a relative or missing path, a path that contains the workspace, `/tmp` or `/`, or any list under `danger-full-access`, and `SandboxNotAvailableError` when bubblewrap is absent. Without the option nothing changes.
+
+- [#805](https://github.com/usetheokit/theokit-sdk/pull/805) [`742f101`](https://github.com/usetheokit/theokit-sdk/commit/742f101d28034188070b0da822cdee414fdefbde) Thanks [@usetheodev](https://github.com/usetheodev)! - A custom `SandboxBackend` can now release what it holds with `dispose()` (a no-op by default, safe to call twice) and state its egress with an optional `networkPolicy` of type `SandboxNetworkPolicy`; `LocalSandbox` declares `unrestricted` and `LinuxSandbox` declares `none` when the network is unshared (`usetheokit/theokit#1130`). `@theokit/sdk/sandbox` also exports `shellEscapePosix`, so a command line built outside a backend subclass can quote its arguments (`usetheokit/theokit#1131`).
+
+- [#793](https://github.com/usetheokit/theokit-sdk/pull/793) [`2e5c1e4`](https://github.com/usetheokit/theokit-sdk/commit/2e5c1e4e8c04509606e4c3b96191a96751b1b73b) Thanks [@usetheodev](https://github.com/usetheodev)! - `Agent.generateObject` and `Agent.streamObject` accept `withheldBuiltinTools` and `memory`, forwarded to the transient agent each call creates. Pass `withheldBuiltinTools: ["shell"]` and `memory: { enabled: false }` for a JSON-only step that must hold no shell and write no transcript; the `output` tool stays available. With `structuringModel`, the reasoning-phase agent receives the same options. Without them nothing changes: the transient agent holds `shell` and writes a transcript as before.
+
+- [#791](https://github.com/usetheokit/theokit-sdk/pull/791) [`3fba608`](https://github.com/usetheokit/theokit-sdk/commit/3fba60809c872395bc26525ad8bdad6655caefc0) Thanks [@usetheodev](https://github.com/usetheodev)! - A model can now continue a suspended workflow run. `workflowAsTool` used to raise `WorkflowToolError`
+  for a run that suspended and never handed the model the run id, and no tool called `Workflow.resume`.
+  Its spec gains an opt-in `reportSuspended`: a suspended run then returns
+  `{"status":"suspended","runId":"…","stepId":"…"}`, ids only, never the suspended payload. The new
+  `workflowResumeTool(workflow, { name, description, reportSuspended? })`, exported from
+  `@theokit/sdk/workflow`, resumes that run by id with an optional payload validated against the suspend
+  step's schema, and returns the run's output. The run id stays the same across resumes, so a second
+  suspension is told apart by its `stepId`. Without the opt-in a suspended run still raises. The tool
+  resumes any run id it is given: who may approve a run is the host's decision. The default snapshot
+  store is in memory and process-local.
+  
+  `Workflow.resume`, and so the resume tool, now refuses a run id whose snapshot was written by a
+  workflow of another name with the typed `WorkflowResumeWorkflowMismatchError` and leaves the snapshot
+  for the workflow that suspended it. Before, a workflow sharing the suspended step id ran its own tail on
+  the other workflow's input. A report's `stepId` is `null` for a run that carries no step result.
+
+### Patch Changes
+
+- [#781](https://github.com/usetheokit/theokit-sdk/pull/781) [`c300464`](https://github.com/usetheokit/theokit-sdk/commit/c3004649223dcddb5582746977a622f0aef03d09) Thanks [@usetheodev](https://github.com/usetheodev)! - A local run cancelled while its MCP servers start up no longer starts the MCP servers after the one whose handshake was in progress. Until now every remaining server was still initialized, and each stdio server spawned its child process, after the cancel. The handshake already in progress still finishes, and the run still closes every MCP client it owns.
+
+- [#785](https://github.com/usetheokit/theokit-sdk/pull/785) [`4a9ab1c`](https://github.com/usetheokit/theokit-sdk/commit/4a9ab1c608fdb2903837054ed59ad3976e2e2906) Thanks [@usetheodev](https://github.com/usetheodev)! - The seccomp temp-dir cleanup of `seccompPathForArch` and `restrictedSeccompPath` no longer cuts off a host's shutdown handler registered with `process.once`: it runs first, removes its directory, and leaves the ending to the host. The directory is now gone before the host's handler starts; a process with no handler of its own still ends by the signal. One order is not covered: a host that itself prepends a `once` handler (`process.prependOnceListener`) after the first sandboxed command runs before the cleanup and is not counted, so the signal is raised again while its shutdown runs.
+
+## 5.12.1
+
+### Patch Changes
+
+- [#773](https://github.com/usetheokit/theokit-sdk/pull/773) [`ecfabd8`](https://github.com/usetheokit/theokit-sdk/commit/ecfabd8639da45573bb4283a2b6b0a6c98daf97a) Thanks [@usetheodev](https://github.com/usetheodev)! - Security: a command confined by `LinuxSandbox` or `interactiveWrapCommand` can no longer weaken the
+  seccomp filter that later confined commands load. The filter used to be read from a temp file under
+  `/tmp`, which `workspace-write` commands can write, so one command could replace it with an
+  allow-all program. Both wraps now pipe the program to bubblewrap from memory, and no file holds it.
+  
+  `wrapCommandForSandbox` takes a new optional `seccompProgram` (the program's bytes, a positive
+  multiple of 8; a `TypeError` otherwise). It wins over `seccompPath` when both are given.
+  
+  `seccompPath`, `restrictedSeccompPath` and `seccompPathForArch` are deprecated in favour of
+  `seccompProgram`, and keep working. A `seccompPath` that `restrictedSeccompPath` or
+  `seccompPathForArch` returned is now piped from the bytes the process wrote, so a sandbox started
+  without the filter (a network-open one mounts `/tmp` writable) can replace the file without effect.
+  For any other path the wrap binds the filter's directory read-only, or the file where the directory
+  is a writable root or contains one. That is only a partial fix: the bind guards the file only from
+  the command that loads it, a temp dir nested inside a writable root can still be swapped by renaming
+  an ancestor, and where only the file is bound its parent can be renamed. Code that reads the
+  helper's file itself is not covered either.
+  
+  The piped wrap passes the program, bubblewrap's arguments and the command to `/bin/sh` as
+  positional arguments, so each is shell-escaped once. Every sandbox wrap also writes a backslash that
+  precedes a quote, a backslash or the end of a word outside the single quotes, so the wrap parses to
+  the same words under fish as under sh. Before, when the PTY's `$SHELL` was fish, a command containing
+  `\'` could end the quoting early and run its tail in the host shell, outside bubblewrap.
+
 ## 5.12.0
 
 ### Minor Changes

package/dist/{agent-IG7BP6GN.js → agent-5DSDDH7K.js}

@@ -1,6 +1,6 @@
-export { Agent } from './chunk-BJ7BPLQK.js';
+export { Agent } from './chunk-JX4LB6XO.js';
 import './chunk-HWMGR3HA.js';
-import './chunk-4GUFNDZR.js';
+import './chunk-XOYNB3YN.js';
 import './chunk-K2BQQ445.js';
 import './chunk-2C24NSNV.js';
 import './chunk-HJ2LV464.js';
@@ -10,7 +10,7 @@ import './chunk-H73MEMQB.js';
 import './chunk-QK2ERTO3.js';
 import './chunk-DF77RBF4.js';
 import './chunk-AB4OPJLD.js';
-import './chunk-XJ4C4NFX.js';
+import './chunk-2PRGRYEQ.js';
 import './chunk-5AR6O7GW.js';
 import './chunk-2XC6KDJM.js';
 import './chunk-ZJAYFSVI.js';
@@ -58,5 +58,5 @@ import './chunk-5IUDICRK.js';
 import './chunk-Q7GYMXVC.js';
 import './chunk-TNFOU6SB.js';
 import './chunk-3OY6H3I7.js';
-//# sourceMappingURL=agent-IG7BP6GN.js.map
-//# sourceMappingURL=agent-IG7BP6GN.js.map
+//# sourceMappingURL=agent-5DSDDH7K.js.map
+//# sourceMappingURL=agent-5DSDDH7K.js.map

package/dist/{agent-IG7BP6GN.js.map → agent-5DSDDH7K.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-IG7BP6GN.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-5DSDDH7K.js"}

package/dist/{agent-CVzDy_Oj.d.ts → agent-DSMuwADp.d.ts}

@@ -1614,7 +1614,14 @@ interface AgentOptions {
      *
      * - **Named-enable settings** — `{ enabled: ["name", ...] }`. Selects which
      *   file-discovered plugin providers (under `.theokit/plugins/`) are active.
-     *   Plugin sources must also be active via `local.settingSources`.
+     *   Plugin sources must also be active via `local.settingSources`. A folder
+     *   under `<cwd>/.theokit/plugins/` whose `PLUGIN.md` names an `entry` has
+     *   that entry imported and its default export (a `kind: "general"` plugin)
+     *   registered, but only when the folder's absolute realpath is listed in
+     *   `~/.theokit/plugins/trusted-workspace-plugins.json` (a JSON array, read on
+     *   each `Agent.create`). The provider trust list never authorizes a workspace
+     *   folder. An untrusted folder is listed and never imported; foreign roots
+     *   are never imported.
      * - **Code `Plugin` objects** — an array of `Plugin` instances, e.g.
      *   `plugins: [Handoff.asPlugin({ ... })]`. These are registered directly by
      *   the runtime (`extractCodePlugins`); no `settingSources` entry is needed.
@@ -2055,4 +2062,4 @@ interface ListResult<T> {
     nextCursor?: string;
 }
 
-export { type RecordSessionSummaryArgs as $, type AgentOptions as A, type BudgetTracker as B, type CloudOptions as C, type CreateSkillSpec as D, type HookApprovalRequest as E, type HookName as F, type GetAgentOptions as G, type HookApprovalGate as H, type InlineSkill as I, type LlmCallContext as J, type MemoryProviderAgentRef as K, type LocalOptions as L, type MemorySettings as M, type MemoryProviderFactory as N, type MemoryProviderHandle as O, type Plugin as P, type MemoryProviderInitOptions as Q, type PluginContext as R, type SystemPromptResolver as S, type PluginHookDisposer as T, type PostAssistantReplyContext as U, type PostToolCallContext as V, type PreToolCallContext as W, type PreUserSendContext as X, type PreUserSendResult as Y, type ProviderTransform as Z, type ProviderTransformContext as _, type AgentDefinition as a, type SessionLifecycleContext as a0, type SessionRecord as a1, type SessionStore as a2, type SettingSource as a3, Skill as a4, type SkillsResolver as a5, type SkillsResolverContext as a6, type SystemPromptContext as a7, type SystemPromptMemoryFact as a8, type TelemetrySettings as a9, type ToolCallSummary as aa, type ToolContext as ab, type ToolResultTransformContext as ac, type TransformContext as ad, type SkillsSettings as b, type ListAgentsOptions as c, type ListResult as d, type SDKAgentInfo as e, type ListRunsOptions as f, type GetRunOptions as g, type AgentOperationOptions as h, type AgentDescription as i, type ProviderProfile as j, type Skill$1 as k, type MemoryProvider as l, type PreToolCallDecision as m, type ActiveMemoryPassArgs as n, type ActiveMemoryPassResult as o, type AgentSubagentDescription as p, type AgentToolDescription as q, type BudgetCheck as r, type BudgetTotal as s, type BudgetUsageEvent as t, type BuiltinToolName as u, type CloudEnv as v, type CloudRepo as w, type CompatSource as x, type CompatSourceAdapter as y, type CompatSurface as z };
+export { type RecordSessionSummaryArgs as $, type AgentOptions as A, type BuiltinToolName as B, type CloudOptions as C, type CreateSkillSpec as D, type HookApprovalRequest as E, type HookName as F, type GetAgentOptions as G, type HookApprovalGate as H, type InlineSkill as I, type LlmCallContext as J, type MemoryProviderAgentRef as K, type LocalOptions as L, type MemorySettings as M, type MemoryProviderFactory as N, type MemoryProviderHandle as O, type Plugin as P, type MemoryProviderInitOptions as Q, type PluginContext as R, type SystemPromptResolver as S, type PluginHookDisposer as T, type PostAssistantReplyContext as U, type PostToolCallContext as V, type PreToolCallContext as W, type PreUserSendContext as X, type PreUserSendResult as Y, type ProviderTransform as Z, type ProviderTransformContext as _, type AgentDefinition as a, type SessionLifecycleContext as a0, type SessionRecord as a1, type SessionStore as a2, type SettingSource as a3, Skill as a4, type SkillsResolver as a5, type SkillsResolverContext as a6, type SystemPromptContext as a7, type SystemPromptMemoryFact as a8, type TelemetrySettings as a9, type ToolCallSummary as aa, type ToolContext as ab, type ToolResultTransformContext as ac, type TransformContext as ad, type SkillsSettings as b, type ListAgentsOptions as c, type ListResult as d, type SDKAgentInfo as e, type ListRunsOptions as f, type GetRunOptions as g, type AgentOperationOptions as h, type AgentDescription as i, type ProviderProfile as j, type Skill$1 as k, type BudgetTracker as l, type MemoryProvider as m, type PreToolCallDecision as n, type ActiveMemoryPassArgs as o, type ActiveMemoryPassResult as p, type AgentSubagentDescription as q, type AgentToolDescription as r, type BudgetCheck as s, type BudgetTotal as t, type BudgetUsageEvent as u, type CloudEnv as v, type CloudRepo as w, type CompatSource as x, type CompatSourceAdapter as y, type CompatSurface as z };

package/dist/{agent-BVKIUP7F.cjs → agent-WOMRT3KX.cjs}

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunkQ6WT5535_cjs = require('./chunk-Q6WT5535.cjs');
+var chunkKL7ZUMK3_cjs = require('./chunk-KL7ZUMK3.cjs');
 require('./chunk-L7JPXZ2C.cjs');
-require('./chunk-YOVZMN4P.cjs');
+require('./chunk-DVP3YMDA.cjs');
 require('./chunk-BUUUWQMB.cjs');
 require('./chunk-CWQPQTUZ.cjs');
 require('./chunk-7YUPSBDV.cjs');
@@ -12,7 +12,7 @@ require('./chunk-GHX4P3V2.cjs');
 require('./chunk-RS7YQR4X.cjs');
 require('./chunk-SDZ4XDWS.cjs');
 require('./chunk-6OCJWGVD.cjs');
-require('./chunk-LSWHDOCL.cjs');
+require('./chunk-4UYHP6NF.cjs');
 require('./chunk-SXH37C7X.cjs');
 require('./chunk-YJNYDJ2T.cjs');
 require('./chunk-NP362THY.cjs');
@@ -65,7 +65,7 @@ require('./chunk-RNXXYF22.cjs');
 
 Object.defineProperty(exports, "Agent", {
   enumerable: true,
-  get: function () { return chunkQ6WT5535_cjs.Agent; }
+  get: function () { return chunkKL7ZUMK3_cjs.Agent; }
 });
-//# sourceMappingURL=agent-BVKIUP7F.cjs.map
-//# sourceMappingURL=agent-BVKIUP7F.cjs.map
+//# sourceMappingURL=agent-WOMRT3KX.cjs.map
+//# sourceMappingURL=agent-WOMRT3KX.cjs.map

package/dist/{agent-BVKIUP7F.cjs.map → agent-WOMRT3KX.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-BVKIUP7F.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-WOMRT3KX.cjs"}

package/dist/{agent-Cn0sphpA.d.cts → agent-iW5kPpfT.d.cts}

@@ -1614,7 +1614,14 @@ interface AgentOptions {
      *
      * - **Named-enable settings** — `{ enabled: ["name", ...] }`. Selects which
      *   file-discovered plugin providers (under `.theokit/plugins/`) are active.
-     *   Plugin sources must also be active via `local.settingSources`.
+     *   Plugin sources must also be active via `local.settingSources`. A folder
+     *   under `<cwd>/.theokit/plugins/` whose `PLUGIN.md` names an `entry` has
+     *   that entry imported and its default export (a `kind: "general"` plugin)
+     *   registered, but only when the folder's absolute realpath is listed in
+     *   `~/.theokit/plugins/trusted-workspace-plugins.json` (a JSON array, read on
+     *   each `Agent.create`). The provider trust list never authorizes a workspace
+     *   folder. An untrusted folder is listed and never imported; foreign roots
+     *   are never imported.
      * - **Code `Plugin` objects** — an array of `Plugin` instances, e.g.
      *   `plugins: [Handoff.asPlugin({ ... })]`. These are registered directly by
      *   the runtime (`extractCodePlugins`); no `settingSources` entry is needed.
@@ -2055,4 +2062,4 @@ interface ListResult<T> {
     nextCursor?: string;
 }
 
-export { type RecordSessionSummaryArgs as $, type AgentOptions as A, type BudgetTracker as B, type CloudOptions as C, type CreateSkillSpec as D, type HookApprovalRequest as E, type HookName as F, type GetAgentOptions as G, type HookApprovalGate as H, type InlineSkill as I, type LlmCallContext as J, type MemoryProviderAgentRef as K, type LocalOptions as L, type MemorySettings as M, type MemoryProviderFactory as N, type MemoryProviderHandle as O, type Plugin as P, type MemoryProviderInitOptions as Q, type PluginContext as R, type SystemPromptResolver as S, type PluginHookDisposer as T, type PostAssistantReplyContext as U, type PostToolCallContext as V, type PreToolCallContext as W, type PreUserSendContext as X, type PreUserSendResult as Y, type ProviderTransform as Z, type ProviderTransformContext as _, type AgentDefinition as a, type SessionLifecycleContext as a0, type SessionRecord as a1, type SessionStore as a2, type SettingSource as a3, Skill as a4, type SkillsResolver as a5, type SkillsResolverContext as a6, type SystemPromptContext as a7, type SystemPromptMemoryFact as a8, type TelemetrySettings as a9, type ToolCallSummary as aa, type ToolContext as ab, type ToolResultTransformContext as ac, type TransformContext as ad, type SkillsSettings as b, type ListAgentsOptions as c, type ListResult as d, type SDKAgentInfo as e, type ListRunsOptions as f, type GetRunOptions as g, type AgentOperationOptions as h, type AgentDescription as i, type ProviderProfile as j, type Skill$1 as k, type MemoryProvider as l, type PreToolCallDecision as m, type ActiveMemoryPassArgs as n, type ActiveMemoryPassResult as o, type AgentSubagentDescription as p, type AgentToolDescription as q, type BudgetCheck as r, type BudgetTotal as s, type BudgetUsageEvent as t, type BuiltinToolName as u, type CloudEnv as v, type CloudRepo as w, type CompatSource as x, type CompatSourceAdapter as y, type CompatSurface as z };
+export { type RecordSessionSummaryArgs as $, type AgentOptions as A, type BuiltinToolName as B, type CloudOptions as C, type CreateSkillSpec as D, type HookApprovalRequest as E, type HookName as F, type GetAgentOptions as G, type HookApprovalGate as H, type InlineSkill as I, type LlmCallContext as J, type MemoryProviderAgentRef as K, type LocalOptions as L, type MemorySettings as M, type MemoryProviderFactory as N, type MemoryProviderHandle as O, type Plugin as P, type MemoryProviderInitOptions as Q, type PluginContext as R, type SystemPromptResolver as S, type PluginHookDisposer as T, type PostAssistantReplyContext as U, type PostToolCallContext as V, type PreToolCallContext as W, type PreUserSendContext as X, type PreUserSendResult as Y, type ProviderTransform as Z, type ProviderTransformContext as _, type AgentDefinition as a, type SessionLifecycleContext as a0, type SessionRecord as a1, type SessionStore as a2, type SettingSource as a3, Skill as a4, type SkillsResolver as a5, type SkillsResolverContext as a6, type SystemPromptContext as a7, type SystemPromptMemoryFact as a8, type TelemetrySettings as a9, type ToolCallSummary as aa, type ToolContext as ab, type ToolResultTransformContext as ac, type TransformContext as ad, type SkillsSettings as b, type ListAgentsOptions as c, type ListResult as d, type SDKAgentInfo as e, type ListRunsOptions as f, type GetRunOptions as g, type AgentOperationOptions as h, type AgentDescription as i, type ProviderProfile as j, type Skill$1 as k, type BudgetTracker as l, type MemoryProvider as m, type PreToolCallDecision as n, type ActiveMemoryPassArgs as o, type ActiveMemoryPassResult as p, type AgentSubagentDescription as q, type AgentToolDescription as r, type BudgetCheck as s, type BudgetTotal as t, type BudgetUsageEvent as u, type CloudEnv as v, type CloudRepo as w, type CompatSource as x, type CompatSourceAdapter as y, type CompatSurface as z };

package/dist/{chunk-XJ4C4NFX.js → chunk-2PRGRYEQ.js}

@@ -20,55 +20,62 @@ import { join } from 'path';
 import { pathToFileURL } from 'url';
 import { createRequire } from 'module';
 
-var discoveryState = globalSingleton("theokit-sdk.providers.discovered", () => ({
-  done: false
-}));
-function pluginsRoot() {
-  return join(homedir(), ".theokit", "plugins", "model-providers");
-}
 function trustFilePath() {
   return join(homedir(), ".theokit", "plugins", "trusted-providers.json");
 }
-function loadTrustedNames() {
-  const trusted = /* @__PURE__ */ new Set();
-  const path = trustFilePath();
-  if (existsSync(path)) {
-    try {
-      const parsed = JSON.parse(readFileSync(path, "utf-8"));
-      if (Array.isArray(parsed)) {
-        let discarded = 0;
-        for (const name of parsed) {
-          if (typeof name === "string" && name.length > 0) trusted.add(name);
-          else discarded += 1;
-        }
-        if (discarded > 0) {
-          diag(
-            `[theokit-sdk] WARN: ${path} contains ${discarded} non-string entr${discarded === 1 ? "y" : "ies"} \u2014 discarded (entries must be plugin-name strings)
-`
-          );
-        }
-      } else {
-        diag(
-          `[theokit-sdk] WARN: ${path} is not a JSON array \u2014 trusting NO provider plugins (fail-closed)
-`
-        );
-      }
-    } catch {
-      diag(
-        `[theokit-sdk] WARN: ${path} is not valid JSON \u2014 trusting NO provider plugins (fail-closed)
-`
-      );
-    }
-  }
+function readTrustedNames() {
+  const trusted = new Set(readTrustArray(trustFilePath(), PROVIDER_TRUST));
   for (const name of (process.env.THEOKIT_TRUSTED_PROVIDERS ?? "").split(",")) {
     const trimmed = name.trim();
     if (trimmed.length > 0) trusted.add(trimmed);
   }
   return trusted;
 }
+var PROVIDER_TRUST = {
+  subject: "provider plugins",
+  entries: "plugin-name strings"
+};
+function readTrustArray(path, shape) {
+  if (!existsSync(path)) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    diag(
+      `[theokit-sdk] WARN: ${path} is not valid JSON \u2014 trusting NO ${shape.subject} (fail-closed)
+`
+    );
+    return [];
+  }
+  if (!Array.isArray(parsed)) {
+    diag(
+      `[theokit-sdk] WARN: ${path} is not a JSON array \u2014 trusting NO ${shape.subject} (fail-closed)
+`
+    );
+    return [];
+  }
+  const names = parsed.filter(
+    (name) => typeof name === "string" && name.length > 0
+  );
+  const discarded = parsed.length - names.length;
+  if (discarded > 0) {
+    diag(
+      `[theokit-sdk] WARN: ${path} contains ${discarded} non-string entr${discarded === 1 ? "y" : "ies"} \u2014 discarded (entries must be ${shape.entries})
+`
+    );
+  }
+  return names;
+}
+
+// src/internal/providers/discovery.ts
+var discoveryState = globalSingleton("theokit-sdk.providers.discovered", () => ({
+  loaded: /* @__PURE__ */ new Set(),
+  warned: /* @__PURE__ */ new Set()
+}));
+function pluginsRoot() {
+  return join(homedir(), ".theokit", "plugins", "model-providers");
+}
 async function discoverProviderPlugins() {
-  if (discoveryState.done) return;
-  discoveryState.done = true;
   const root = pluginsRoot();
   if (!existsSync(root)) return;
   let entries;
@@ -77,18 +84,25 @@ async function discoverProviderPlugins() {
   } catch {
     return;
   }
-  const trusted = loadTrustedNames();
+  const trusted = readTrustedNames();
   for (const entry of entries) {
+    if (discoveryState.loaded.has(entry)) continue;
     if (!trusted.has(entry)) {
-      diag(
-        `[theokit-sdk] WARN: provider plugin "${entry}" is present but NOT trusted \u2014 skipped. To trust it, add "${entry}" to ${trustFilePath()} (JSON array of names) or THEOKIT_TRUSTED_PROVIDERS (comma-separated), then restart the process.
-`
-      );
+      warnUntrusted(entry);
       continue;
     }
+    discoveryState.loaded.add(entry);
     await loadOne(join(root, entry), entry);
   }
 }
+function warnUntrusted(entry) {
+  if (discoveryState.warned.has(entry)) return;
+  discoveryState.warned.add(entry);
+  diag(
+    `[theokit-sdk] WARN: provider plugin "${entry}" is present but NOT trusted \u2014 skipped. To trust it, add "${entry}" to ${trustFilePath()} (JSON array of names) or THEOKIT_TRUSTED_PROVIDERS (comma-separated).
+`
+  );
+}
 async function loadOne(dir, entryName) {
   for (const ext of ["index.mjs", "index.js"]) {
     const indexPath = join(dir, ext);
@@ -3481,6 +3495,6 @@ async function autoCompactIfNeeded(opts) {
   }
 }
 
-export { COMPACT_SUMMARY_MARKER, COMPACT_USER_MESSAGE_MAX_TOKENS, CircuitBreaker, DEFAULT_PRE_COMPACT_TIMEOUT_MS, abortError, autoCompactIfNeeded, buildDefaultSummarizer, compactSessionTranscript, discoverProviderPlugins, getConfiguredBaseUrl, httpRequest, inferApiMode, isCompactSummary, isFixtureApiKey, mapOllamaHttpError, mapOllamaTransportError, mergeExplicitApiKey, normalizeUsage, parseSseStream, presentProviderCredentialEnvVars, readErrorResponseBody, relayStream, renderToolResultContentText, resolveProviderChain, resolveRunProvider, resolveSummarizerRoute, shouldAutoCompact, shouldUseFixtureMode, shouldUseRealLocalRuntime, tryFirstEvent, validateApiKeyShape };
-//# sourceMappingURL=chunk-XJ4C4NFX.js.map
-//# sourceMappingURL=chunk-XJ4C4NFX.js.map
+export { COMPACT_SUMMARY_MARKER, COMPACT_USER_MESSAGE_MAX_TOKENS, CircuitBreaker, DEFAULT_PRE_COMPACT_TIMEOUT_MS, abortError, autoCompactIfNeeded, buildDefaultSummarizer, compactSessionTranscript, discoverProviderPlugins, getConfiguredBaseUrl, httpRequest, inferApiMode, isCompactSummary, isFixtureApiKey, mapOllamaHttpError, mapOllamaTransportError, mergeExplicitApiKey, normalizeUsage, parseSseStream, presentProviderCredentialEnvVars, readErrorResponseBody, readTrustArray, relayStream, renderToolResultContentText, resolveProviderChain, resolveRunProvider, resolveSummarizerRoute, shouldAutoCompact, shouldUseFixtureMode, shouldUseRealLocalRuntime, trustFilePath, tryFirstEvent, validateApiKeyShape };
+//# sourceMappingURL=chunk-2PRGRYEQ.js.map
+//# sourceMappingURL=chunk-2PRGRYEQ.js.map