@theokit/sdk 5.3.3 → 5.4.0

package/dist/{chunk-Y46VI73J.cjs → chunk-UALC6Q3J.cjs}

@@ -1,15 +1,15 @@
 'use strict';
 
 var chunkKVSAY6NZ_cjs = require('./chunk-KVSAY6NZ.cjs');
-var chunkY2KYR2ED_cjs = require('./chunk-Y2KYR2ED.cjs');
+var chunkDZG77WU7_cjs = require('./chunk-DZG77WU7.cjs');
 var chunkZ2JFX372_cjs = require('./chunk-Z2JFX372.cjs');
-var chunk65UMH5V3_cjs = require('./chunk-65UMH5V3.cjs');
+var chunk3FDU5JFE_cjs = require('./chunk-3FDU5JFE.cjs');
 var chunkBV2MWEMV_cjs = require('./chunk-BV2MWEMV.cjs');
 var chunkD6POWE7E_cjs = require('./chunk-D6POWE7E.cjs');
 var chunkTMKTSYDS_cjs = require('./chunk-TMKTSYDS.cjs');
 var chunkNQTNSHSB_cjs = require('./chunk-NQTNSHSB.cjs');
 var chunk7FDKWDA2_cjs = require('./chunk-7FDKWDA2.cjs');
-var chunk2HPNT6HH_cjs = require('./chunk-2HPNT6HH.cjs');
+var chunkC4ZQPWXJ_cjs = require('./chunk-C4ZQPWXJ.cjs');
 var chunk2ZPEDVLM_cjs = require('./chunk-2ZPEDVLM.cjs');
 var chunkIU5N5224_cjs = require('./chunk-IU5N5224.cjs');
 var chunkRQMCOFAI_cjs = require('./chunk-RQMCOFAI.cjs');
@@ -26,8 +26,8 @@ var chunkGZV6AVRL_cjs = require('./chunk-GZV6AVRL.cjs');
 var chunkBJUJT5ED_cjs = require('./chunk-BJUJT5ED.cjs');
 var chunkZF2LDKQQ_cjs = require('./chunk-ZF2LDKQQ.cjs');
 var chunkJLRLCBJ4_cjs = require('./chunk-JLRLCBJ4.cjs');
-var chunkIQBDR5YZ_cjs = require('./chunk-IQBDR5YZ.cjs');
-var chunkDWB3CN46_cjs = require('./chunk-DWB3CN46.cjs');
+var chunkAYA65JA5_cjs = require('./chunk-AYA65JA5.cjs');
+var chunk43YXGD3P_cjs = require('./chunk-43YXGD3P.cjs');
 var chunkHW7SEELD_cjs = require('./chunk-HW7SEELD.cjs');
 var chunkATT276RD_cjs = require('./chunk-ATT276RD.cjs');
 var chunk3EE6LVWT_cjs = require('./chunk-3EE6LVWT.cjs');
@@ -383,7 +383,7 @@ function serializeAgents(agents2) {
   return out;
 }
 function registryPath(cwd) {
-  return path.join(chunkDWB3CN46_cjs.theokitConfigRoot(cwd), REGISTRY_RELATIVE_SUFFIX);
+  return path.join(chunk43YXGD3P_cjs.theokitConfigRoot(cwd), REGISTRY_RELATIVE_SUFFIX);
 }
 async function loadRegistry(cwd) {
   void chunkJLRLCBJ4_cjs.sweepStaleAtomicTemps(registryPath(cwd)).catch(() => void 0);
@@ -1560,7 +1560,7 @@ function createRealCloudRun(options) {
     conversation: []
   };
   const apiKey = chunk6LHQPOMI_cjs.resolveApiKey(options.agentOptions.apiKey);
-  const baseUrl = chunk2HPNT6HH_cjs.getConfiguredBaseUrl();
+  const baseUrl = chunkC4ZQPWXJ_cjs.getConfiguredBaseUrl();
   const handle = new RealCloudRun(
     {
       id,
@@ -1643,7 +1643,7 @@ var RealCloudRun = class extends FixtureRunBase {
   async consumeStream(response) {
     let finalStatus = "finished";
     let finalText = "";
-    for await (const record of chunk2HPNT6HH_cjs.parseSseStream(response.body, this.controller.signal)) {
+    for await (const record of chunkC4ZQPWXJ_cjs.parseSseStream(response.body, this.controller.signal)) {
       const parsed = safeParse(record.data);
       if (parsed === void 0) continue;
       const update = this.applyRecord(record.event, parsed);
@@ -1810,7 +1810,7 @@ var CloudAgent = class _CloudAgent {
    */
   isFixtureMode() {
     const apiKey = chunk6LHQPOMI_cjs.resolveApiKey(this.options.apiKey);
-    return chunk2HPNT6HH_cjs.isFixtureApiKey(apiKey) && chunk2HPNT6HH_cjs.getConfiguredBaseUrl() === void 0;
+    return chunkC4ZQPWXJ_cjs.isFixtureApiKey(apiKey) && chunkC4ZQPWXJ_cjs.getConfiguredBaseUrl() === void 0;
   }
   // SE9 — integrated structured output; delegates to the shared helper.
   generate(message, options) {
@@ -1862,7 +1862,7 @@ var CloudAgent = class _CloudAgent {
     const userText = typeof message === "string" ? message : message.text;
     const systemPrompt = await this.resolveSystemPromptForSend(userText, options);
     const apiKey = chunk6LHQPOMI_cjs.resolveApiKey(this.options.apiKey);
-    const useRealRuntime = apiKey !== void 0 && !chunk2HPNT6HH_cjs.isFixtureApiKey(apiKey) && chunk2HPNT6HH_cjs.getConfiguredBaseUrl() !== void 0;
+    const useRealRuntime = apiKey !== void 0 && !chunkC4ZQPWXJ_cjs.isFixtureApiKey(apiKey) && chunkC4ZQPWXJ_cjs.getConfiguredBaseUrl() !== void 0;
     return useRealRuntime ? createRealCloudRun({
       agentId: this.agentId,
       model: this.model ?? { id: DEFAULT_AGENTIC_MODEL_ID },
@@ -2122,14 +2122,14 @@ async function readState(filePath) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    chunk65UMH5V3_cjs.warnOnce(
+    chunk3FDU5JFE_cjs.warnOnce(
       "personality-store-json-parse",
       "[theokit-sdk] personality.json is malformed; treating as empty"
     );
     return emptyState();
   }
   if (!isStateV1(parsed)) {
-    chunk65UMH5V3_cjs.warnOnce(
+    chunk3FDU5JFE_cjs.warnOnce(
       "personality-store-bad-version",
       `[theokit-sdk] personality.json has unknown version; treating as empty (file kept untouched)`
     );
@@ -2160,7 +2160,7 @@ var PersonalityStore = class {
       try {
         await this.#persist(agentId, slug);
       } catch (err) {
-        chunk65UMH5V3_cjs.warnOnce(
+        chunk3FDU5JFE_cjs.warnOnce(
           `personality-store-persist-failure-${agentId}`,
           `[theokit-sdk] personality persist failed for ${chunk6LHQPOMI_cjs.redactSecrets(agentId)}: ${chunk6LHQPOMI_cjs.redactSecrets(
             err.message
@@ -2177,7 +2177,7 @@ var PersonalityStore = class {
     try {
       state = await readState(filePath);
     } catch (err) {
-      chunk65UMH5V3_cjs.warnOnce(
+      chunk3FDU5JFE_cjs.warnOnce(
         `personality-store-hydrate-failure-${agentId}`,
         `[theokit-sdk] personality hydrate failed for ${chunk6LHQPOMI_cjs.redactSecrets(agentId)}: ${chunk6LHQPOMI_cjs.redactSecrets(
           err.message
@@ -2206,7 +2206,7 @@ var PersonalityStore = class {
     });
   }
   #filePath() {
-    return path.join(chunkDWB3CN46_cjs.getTheokitHome(this.#cwd), FILE_NAME);
+    return path.join(chunk43YXGD3P_cjs.getTheokitHome(this.#cwd), FILE_NAME);
   }
 };
 
@@ -2523,7 +2523,7 @@ function removeAll(arr, toRemove) {
   }
 }
 function readCompatConfigFile(cwd) {
-  const path$1 = path.join(chunkDWB3CN46_cjs.theokitConfigRoot(cwd), "config.json");
+  const path$1 = path.join(chunk43YXGD3P_cjs.theokitConfigRoot(cwd), "config.json");
   if (!fs.existsSync(path$1)) return [];
   let raw;
   try {
@@ -2603,19 +2603,21 @@ function spawnAndCollect(options) {
 
 // src/internal/runtime/hooks/hooks-executor.ts
 var HooksExecutor = class {
-  constructor(cwd, compatSources = []) {
+  constructor(cwd, compatSources = [], gate = void 0) {
     this.cwd = cwd;
     this.compatSources = compatSources;
+    this.gate = gate;
   }
   cwd;
   compatSources;
+  gate;
   config = {};
   async initialize(settingSourcesIncludeProject) {
     if (!settingSourcesIncludeProject) {
       this.config = {};
       return;
     }
-    this.config = await chunk65UMH5V3_cjs.loadHookConfig(this.cwd, this.compatSources);
+    this.config = await chunk3FDU5JFE_cjs.loadHookConfig(this.cwd, this.compatSources);
   }
   /** Fire every hook registered for `event` and aggregate the decisions. */
   async run(payload) {
@@ -2648,7 +2650,27 @@ var HooksExecutor = class {
       }
     });
   }
+  /**
+   * #631 — the consumer's gate, consulted at the ONLY point a hook is spawned.
+   *
+   * Here and not at the caller on purpose: a check anywhere else could be reached around by a
+   * second execution path later, and this one cannot — `spawnAndCollect` is called for a hook from
+   * exactly one place.
+   *
+   * No gate means no refusal, which is what every consumer gets today.
+   */
+  async refusedByConsumer(command, payload) {
+    if (this.gate?.approve === void 0) return false;
+    const request = {
+      command: command.command,
+      event: payload.event,
+      ...command.sourcePath === void 0 ? {} : { sourcePath: command.sourcePath },
+      ...command.matcher === void 0 ? {} : { matcher: command.matcher }
+    };
+    return !await this.gate.approve(request);
+  }
   async executeOne(command, payload) {
+    if (await this.refusedByConsumer(command, payload)) return { decision: "allow" };
     const timeoutMs = command.timeoutMs ?? 3e4;
     const env = runtimeEnvFor(command.sourcePath, this.cwd);
     const result = await spawnAndCollect({
@@ -2659,28 +2681,36 @@ var HooksExecutor = class {
       timeoutMs,
       stdin: JSON.stringify(payload)
     });
-    if (result.timedOut) {
-      return { decision: "deny", reason: `Hook timed out after ${timeoutMs}ms` };
-    }
+    const failure = this.decisionFromFailure(result, command, env, timeoutMs);
+    return failure ?? parseDecisionFromStdout(result.stdout);
+  }
+  /**
+   * A run that did not succeed, turned into a decision. `undefined` when it did.
+   *
+   * Extracted from `executeOne` when the approval gate pushed that function past the complexity
+   * gate. The seam is not arbitrary — every branch here answers one question, "the command did not
+   * run cleanly, so what does this hook decide?", and none of them knows how the command was
+   * spawned.
+   */
+  decisionFromFailure(result, command, env, timeoutMs) {
+    if (result.timedOut) return { decision: "deny", reason: `Hook timed out after ${timeoutMs}ms` };
     if (result.spawnError !== void 0) {
       return { decision: "deny", reason: `Hook spawn failed: ${result.spawnError.message}` };
     }
-    if (result.exitCode !== 0) {
-      const stderr = result.stderr.trim();
-      const base = stderr.length > 0 ? stderr : `Hook exited with code ${result.exitCode}`;
-      const missing = chunkDWB3CN46_cjs.undefinedVariablesIn(command.command, env);
-      if (missing.length === 0) return { decision: "deny", reason: base };
-      return {
-        decision: "deny",
-        reason: `${base} \u2014 this hook came from ${command.sourcePath ?? "an unrecorded source"} and uses ${missing.map((n) => `$${n}`).join(", ")}, which nothing defines here. A variable this runtime does not supply expands to the empty string, so the error above names a path rather than the cause.`
-      };
-    }
-    return parseDecisionFromStdout(result.stdout);
+    if (result.exitCode === 0) return void 0;
+    const stderr = result.stderr.trim();
+    const base = stderr.length > 0 ? stderr : `Hook exited with code ${result.exitCode}`;
+    const missing = chunk43YXGD3P_cjs.undefinedVariablesIn(command.command, env);
+    if (missing.length === 0) return { decision: "deny", reason: base };
+    return {
+      decision: "deny",
+      reason: `${base} \u2014 this hook came from ${command.sourcePath ?? "an unrecorded source"} and uses ${missing.map((n) => `$${n}`).join(", ")}, which nothing defines here. A variable this runtime does not supply expands to the empty string, so the error above names a path rather than the cause.`
+    };
   }
 };
 function runtimeEnvFor(sourcePath, cwd) {
   if (sourcePath === void 0) return {};
-  return chunkDWB3CN46_cjs.adapterForConfigPath(sourcePath)?.runtimeEnv(cwd) ?? {};
+  return chunk43YXGD3P_cjs.adapterForConfigPath(sourcePath)?.runtimeEnv(cwd) ?? {};
 }
 function parseDecisionFromStdout(stdout) {
   const trimmed = stdout.trim();
@@ -2739,7 +2769,7 @@ async function runPostRunLifecycle(inputs) {
     try {
       const partial = await safeConversation(run);
       if (partial !== void 0) {
-        chunkY2KYR2ED_cjs.persistTurnToTranscript(sessionStore, { cwd: workspaceCwd, agentId, model }, agentId, {
+        chunkDZG77WU7_cjs.persistTurnToTranscript(sessionStore, { cwd: workspaceCwd, agentId, model }, agentId, {
           userText,
           conversation: partial
         });
@@ -2749,11 +2779,11 @@ async function runPostRunLifecycle(inputs) {
       chunk6LHQPOMI_cjs.diag(`[theokit-sdk] partial transcript write failed (${agentId}): ${msg}
 `);
     }
-    await chunkY2KYR2ED_cjs.flushSessionWrites();
+    await chunkDZG77WU7_cjs.flushSessionWrites();
     return;
   }
   if (result.result !== void 0) {
-    chunkY2KYR2ED_cjs.appendSessionMessage(agentId, { role: "assistant", text: result.result });
+    chunkDZG77WU7_cjs.appendSessionMessage(agentId, { role: "assistant", text: result.result });
   }
   const conversation = await safeConversation(run);
   const resolvedWindow = resolveWindowForRun(model, contextWindow);
@@ -2764,7 +2794,7 @@ async function runPostRunLifecycle(inputs) {
   }
   const lastRequestUsage = result.usage?.requests?.at(-1)?.totalTokens;
   const usageForTrigger = lastRequestUsage ?? result.usage?.totalTokens;
-  chunkY2KYR2ED_cjs.persistTurnToTranscript(
+  chunkDZG77WU7_cjs.persistTurnToTranscript(
     sessionStore,
     { cwd: workspaceCwd, agentId, model },
     agentId,
@@ -2776,7 +2806,7 @@ async function runPostRunLifecycle(inputs) {
         // The EFFECTIVE window (after override, clamp and margin) — not the declared one. Swapping for
         // `contextWindow` here would budget against a number the clamp already rejected.
         contextWindow: effectiveWindow,
-        summarize: chunk2HPNT6HH_cjs.buildDefaultSummarizer({
+        summarize: chunkC4ZQPWXJ_cjs.buildDefaultSummarizer({
           agentModel: model,
           ...inputs.apiKey !== void 0 ? { apiKey: inputs.apiKey } : {}
         })
@@ -2818,7 +2848,7 @@ async function runPostRunLifecycle(inputs) {
     agentId,
     runId: result.id
   });
-  await chunkY2KYR2ED_cjs.flushSessionWrites();
+  await chunkDZG77WU7_cjs.flushSessionWrites();
 }
 async function safeConversation(run) {
   try {
@@ -2853,10 +2883,10 @@ var SkillsManager = class {
   }
   async refresh() {
     const roots = this.skillsDir === void 0 ? [
-      ...chunkDWB3CN46_cjs.projectConfigRoots(this.cwd, this.compatSources, "skills").map(
+      ...chunk43YXGD3P_cjs.projectConfigRoots(this.cwd, this.compatSources, "skills").map(
         (root) => path.join(root, "skills")
       ),
-      ...(await chunkIQBDR5YZ_cjs.pluginBundleDirs(this.cwd, this.compatSources)).map((b) => path.join(b, "skills"))
+      ...(await chunkAYA65JA5_cjs.pluginBundleDirs(this.cwd, this.compatSources)).map((b) => path.join(b, "skills"))
     ] : [this.skillsDir];
     const discovered = [];
     const seen = /* @__PURE__ */ new Set();
@@ -3440,7 +3470,7 @@ var HISTOGRAM_NAMES = {
 };
 function safeRequire(moduleName) {
   try {
-    const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-Y46VI73J.cjs', document.baseURI).href)));
+    const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-UALC6Q3J.cjs', document.baseURI).href)));
     return r(moduleName);
   } catch {
     return void 0;
@@ -3683,7 +3713,7 @@ var cachedOtel;
 function loadOtel() {
   if (cachedOtel === void 0) {
     try {
-      const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-Y46VI73J.cjs', document.baseURI).href)));
+      const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-UALC6Q3J.cjs', document.baseURI).href)));
       const mod = r("@opentelemetry/api");
       cachedOtel = mod;
     } catch {
@@ -4137,8 +4167,8 @@ var FileContextManager = class {
   }
 };
 async function loadContextConfig(cwd) {
-  const mdDir = path.join(chunkDWB3CN46_cjs.theokitConfigRoot(cwd), "context");
-  const jsonPath = path.join(chunkDWB3CN46_cjs.theokitConfigRoot(cwd), "context.json");
+  const mdDir = path.join(chunk43YXGD3P_cjs.theokitConfigRoot(cwd), "context");
+  const jsonPath = path.join(chunk43YXGD3P_cjs.theokitConfigRoot(cwd), "context.json");
   const mdEntities = await loadMarkdownEntities({
     dir: mdDir,
     schema: ContextSourceFrontmatterSchema,
@@ -4147,7 +4177,7 @@ async function loadContextConfig(cwd) {
   });
   if (mdEntities.length > 0) {
     if (fs.existsSync(jsonPath)) {
-      chunk65UMH5V3_cjs.warnOnce(
+      chunk3FDU5JFE_cjs.warnOnce(
         "context-both-present",
         "[theokit-sdk] both .theokit/context/ and .theokit/context.json detected \u2014 using markdown; remove context.json"
       );
@@ -4157,7 +4187,7 @@ async function loadContextConfig(cwd) {
     };
   }
   if (!fs.existsSync(jsonPath)) return { sources: [] };
-  chunk65UMH5V3_cjs.warnOnce(
+  chunk3FDU5JFE_cjs.warnOnce(
     "context-json-deprecated",
     // Names no command: `theokit-migrate-config` was unpublished with the `bin` entry, and a warning
     // that tells you to run something the package does not ship is worse than one that tells you
@@ -4298,7 +4328,7 @@ var PluginsManager = class {
   }
   async refresh() {
     this.plugins = [];
-    for (const pluginsRoot of chunkDWB3CN46_cjs.pluginBundleRoots(this.cwd, this.compatSources)) {
+    for (const pluginsRoot of chunk43YXGD3P_cjs.pluginBundleRoots(this.cwd, this.compatSources)) {
       await this.refreshRoot(pluginsRoot);
     }
   }
@@ -4320,13 +4350,13 @@ var PluginsManager = class {
       const jsonPath = path.join(pluginsRoot, folderName, "plugin.json");
       const metadata = fs.existsSync(mdPath) ? await loadPluginManifestFromMarkdown(this.cwd, pluginsRoot, folderName) : await loadPluginManifestFromJson(this.cwd, jsonPath, folderName);
       if (fs.existsSync(mdPath) && fs.existsSync(jsonPath)) {
-        chunk65UMH5V3_cjs.warnOnce(
+        chunk3FDU5JFE_cjs.warnOnce(
           `plugin-${folderName}-both`,
           `[theokit-sdk] both ${folderName}/PLUGIN.md and ${folderName}/plugin.json detected \u2014 using markdown; remove plugin.json`
         );
       }
       if (!fs.existsSync(mdPath) && fs.existsSync(jsonPath)) {
-        chunk65UMH5V3_cjs.warnOnce(
+        chunk3FDU5JFE_cjs.warnOnce(
           "plugin-json-deprecated",
           // Same reason as the context.json warning: the CLI it used to name is no longer published.
           "[theokit-sdk] plugin.json manifests are deprecated; replace each with a PLUGIN.md"
@@ -6418,7 +6448,7 @@ function applyToolResultGuard(parts, opts) {
     (p) => (
       // SE7 — guard the TEXT of a tool result (string or the text blocks of a
       // structured content); image blocks pass through untouched.
-      p.type === "tool_result" ? { ...p, content: chunk2HPNT6HH_cjs.renderToolResultContentText(p.content, (t) => guardText(t, opts)) } : p
+      p.type === "tool_result" ? { ...p, content: chunkC4ZQPWXJ_cjs.renderToolResultContentText(p.content, (t) => guardText(t, opts)) } : p
     )
   );
 }
@@ -6710,13 +6740,13 @@ var FallbackLlmClient = class {
   async *stream(request, signal) {
     let lastError;
     for (const client of this.clients) {
-      if (signal.aborted) throw chunk2HPNT6HH_cjs.abortError(signal);
-      const attempt = await chunk2HPNT6HH_cjs.tryFirstEvent(client, request, signal, true);
+      if (signal.aborted) throw chunkC4ZQPWXJ_cjs.abortError(signal);
+      const attempt = await chunkC4ZQPWXJ_cjs.tryFirstEvent(client, request, signal, true);
       if (attempt.kind === "handshake_error") {
         lastError = attempt.error;
         continue;
       }
-      return yield* chunk2HPNT6HH_cjs.relayStream(attempt.generator, attempt.firstResult);
+      return yield* chunkC4ZQPWXJ_cjs.relayStream(attempt.generator, attempt.firstResult);
     }
     if (lastError !== void 0) throw lastError;
     throw new chunkJ7J7J2GN_cjs.NetworkError("FallbackLlmClient has no providers configured", {
@@ -7216,7 +7246,7 @@ function applyPersonalityFilter(exposedTools, whitelist, opts) {
     if (exposedSet.has(name)) continue;
     const hint = suggestClosest(name, exposedSet);
     const message = hint !== void 0 ? `[theokit-sdk] personality "${opts?.personalityName ?? "?"}" references unknown tool "${name}"; did you mean "${hint}"?` : `[theokit-sdk] personality "${opts?.personalityName ?? "?"}" references unknown tool "${name}" (not exposed)`;
-    chunk65UMH5V3_cjs.warnOnce(
+    chunk3FDU5JFE_cjs.warnOnce(
       `personality-tool-missing|${opts?.agentId ?? "?"}|${opts?.personalityName ?? "?"}|${name}`,
       message
     );
@@ -7352,9 +7382,9 @@ function buildLoopInputs(options, runId, userText, userImages) {
       { code: "invalid_max_iterations" }
     );
   }
-  const { primary, effectiveModelId } = chunk2HPNT6HH_cjs.resolveRunProvider(options);
+  const { primary, effectiveModelId } = chunkC4ZQPWXJ_cjs.resolveRunProvider(options);
   const fallback = options.agentOptions.providers?.fallback;
-  const apiKeys = chunk2HPNT6HH_cjs.mergeExplicitApiKey(
+  const apiKeys = chunkC4ZQPWXJ_cjs.mergeExplicitApiKey(
     options.agentOptions.providers?.apiKeys,
     primary,
     options.agentOptions.apiKey
@@ -7363,7 +7393,7 @@ function buildLoopInputs(options, runId, userText, userImages) {
   const extractToolCallsFromContent = options.agentOptions.providers?.routes?.[0]?.extractToolCallsFromContent;
   const rateLimitSink = options.sendOptions.onRunEvent;
   const modelBaseUrl = options.model?.url;
-  const chain = chunk2HPNT6HH_cjs.resolveProviderChain({
+  const chain = chunkC4ZQPWXJ_cjs.resolveProviderChain({
     primary,
     ...modelBaseUrl !== void 0 ? { baseUrl: modelBaseUrl } : {},
     ...fallback !== void 0 ? { fallback } : {},
@@ -7623,7 +7653,7 @@ function buildRealRunOptions(args) {
   };
 }
 async function createFixtureRunHelper(args) {
-  const sessionMessages = chunkY2KYR2ED_cjs.getSessionMessages(args.inputs.agentId);
+  const sessionMessages = chunkDZG77WU7_cjs.getSessionMessages(args.inputs.agentId);
   const projectMcpServers = args.inputs.settingSourcesIncludeProject ? await readProjectMcpServers(args.inputs.workspaceCwd) : {};
   return createLocalRun({
     agentId: args.inputs.agentId,
@@ -7642,7 +7672,7 @@ async function createFixtureRunHelper(args) {
 }
 async function dispatchLocalRun(args) {
   const apiKey = chunk6LHQPOMI_cjs.resolveApiKey(args.inputs.options.apiKey);
-  if (chunk2HPNT6HH_cjs.shouldUseRealLocalRuntime(apiKey)) {
+  if (chunkC4ZQPWXJ_cjs.shouldUseRealLocalRuntime(apiKey)) {
     return createRealLocalRun(
       buildRealRunOptions({
         inputs: args.inputs,
@@ -7665,7 +7695,7 @@ async function dispatchLocalRun(args) {
   });
 }
 async function readProjectMcpServers(cwd) {
-  const path$1 = path.join(chunkDWB3CN46_cjs.theokitConfigRoot(cwd), "mcp.json");
+  const path$1 = path.join(chunk43YXGD3P_cjs.theokitConfigRoot(cwd), "mcp.json");
   try {
     const raw = await promises.readFile(path$1, "utf8");
     const parsed = JSON.parse(raw);
@@ -7898,16 +7928,16 @@ async function disposeLocalAgentSession(agent) {
   agent.lifecycleAbortController.abort();
   await chunkZF2LDKQQ_cjs.withCwdMutex(`agent-send:${agent.agentId}`, () => Promise.resolve());
   disposeSessionMcpClients(agent.agentId);
-  await chunkY2KYR2ED_cjs.flushSessionWrites();
+  await chunkDZG77WU7_cjs.flushSessionWrites();
   await flushRegistrySaves(agent.workspaceCwd);
   await disposeSessionStore(agent.sessionStore);
-  chunkY2KYR2ED_cjs.discardSession(agent.workspaceCwd, agent.agentId);
+  chunkDZG77WU7_cjs.discardSession(agent.workspaceCwd, agent.agentId);
 }
 async function reloadLocalAgent(agent) {
   if (agent.context !== void 0) await agent.context.refresh();
   if (agent.skillsManager !== void 0) await agent.skillsManager.refresh();
   if (agent.pluginsManager !== void 0) await agent.pluginsManager.refresh();
-  return await chunkIQBDR5YZ_cjs.loadSubagents(
+  return await chunkAYA65JA5_cjs.loadSubagents(
     agent.workspaceCwd,
     agent.settingSourcesIncludeProject,
     agent.options.agents
@@ -8765,7 +8795,7 @@ var LocalAgentMemory = class {
   async runActiveMemoryIfEnabled(userText, priorMessages, telemetry) {
     const cfg = this.options.memory?.activeRecall;
     if (cfg?.enabled !== true || this.index === void 0) return void 0;
-    if (this.breaker === void 0) this.breaker = new chunk2HPNT6HH_cjs.CircuitBreaker();
+    if (this.breaker === void 0) this.breaker = new chunkC4ZQPWXJ_cjs.CircuitBreaker();
     if (this.cache === void 0) this.cache = new ActiveMemoryCache();
     const result = await runActiveMemory({
       userText,
@@ -8941,7 +8971,7 @@ var PersonalityRegistry = class _PersonalityRegistry {
    * @internal
    */
   static async load(cwd) {
-    const projectDir = path.join(chunkDWB3CN46_cjs.theokitConfigRoot(cwd), PERSONALITIES_SUFFIX);
+    const projectDir = path.join(chunk43YXGD3P_cjs.theokitConfigRoot(cwd), PERSONALITIES_SUFFIX);
     const userDir = path.join(os.homedir(), USER_SUBDIR);
     const [userEntities, projectEntities] = await Promise.all([
       loadMarkdownEntities({
@@ -8993,7 +9023,7 @@ function addEntity(byName, entity, origin, collisionMap) {
     );
   }
   if (origin === "project" && collisionMap?.has(fm.name)) {
-    chunk65UMH5V3_cjs.warnOnce(
+    chunk3FDU5JFE_cjs.warnOnce(
       `personality-collision-${fm.name}`,
       `[theokit-sdk] personality "${fm.name}" overridden by project preset`
     );
@@ -9043,14 +9073,14 @@ async function performPersonalitySwitch(args) {
 
 // src/internal/local-agent/local-agent-personality-extensions.ts
 function resolveActivePersonalityPreset(args) {
-  const forkCtx = chunk65UMH5V3_cjs.currentPersonalityContext();
+  const forkCtx = chunk3FDU5JFE_cjs.currentPersonalityContext();
   const slug = forkCtx !== void 0 ? forkCtx.slug : args.personalityStore.active(args.agentId);
   if (slug === void 0) return void 0;
   return args.personalityRegistry?.get(slug);
 }
 async function ensurePersonalityRegistryIfNeeded(args) {
   if (args.personalityRegistry !== void 0) return args.personalityRegistry;
-  const forkSlug = chunk65UMH5V3_cjs.currentPersonalityContext()?.slug;
+  const forkSlug = chunk3FDU5JFE_cjs.currentPersonalityContext()?.slug;
   const ownSlug = args.personalityStore.active(args.agentId);
   if (forkSlug === void 0 && ownSlug === void 0) return void 0;
   return await PersonalityRegistry.load(args.workspaceCwd);
@@ -9063,8 +9093,8 @@ function applyPersonalityOverlay(preset, base) {
 ${preset.systemPrompt}`;
 }
 async function localAgentUsePersonality(agent, name, opts) {
-  if (chunk65UMH5V3_cjs.currentPersonalityContext() !== void 0) {
-    chunk65UMH5V3_cjs.warnPersonalitySwitchInsideFork(agent.agentId);
+  if (chunk3FDU5JFE_cjs.currentPersonalityContext() !== void 0) {
+    chunk3FDU5JFE_cjs.warnPersonalitySwitchInsideFork(agent.agentId);
     return null;
   }
   if (agent.personalityRegistry === void 0) {
@@ -9080,8 +9110,8 @@ async function localAgentUsePersonality(agent, name, opts) {
       registry,
       store: agent.personalityStore,
       invalidateCache: (reason) => agent.invalidateCache(reason),
-      appendSessionMessage: (msg) => chunkY2KYR2ED_cjs.appendSessionMessage(agent.agentId, msg),
-      clearSession: () => chunkY2KYR2ED_cjs.clearSession(agent.agentId),
+      appendSessionMessage: (msg) => chunkDZG77WU7_cjs.appendSessionMessage(agent.agentId, msg),
+      clearSession: () => chunkDZG77WU7_cjs.clearSession(agent.agentId),
       opts: opts ?? {}
     })
   );
@@ -9125,7 +9155,7 @@ async function* localAgentStreamToCompletion(agent, message, options) {
 async function localAgentFork(parent, options) {
   const { forkAgentImpl } = await import('./fork-agent-WAEQI2DL.cjs');
   const { getAgentFacade } = await import('./agent-factory-registry-UU46BUMU.cjs');
-  const { withPersonalityContext } = await import('./context-FCCJQ3FN.cjs');
+  const { withPersonalityContext } = await import('./context-4AIK26QB.cjs');
   const create = getAgentFacade().create;
   return withPersonalityContext(
     { slug: parent.personalitySlugSnapshot, isFork: true },
@@ -9635,7 +9665,7 @@ async function executeSendLocked(inputs, message, options) {
   if (inputs.options.onBeforeSend !== void 0) {
     await inputs.options.onBeforeSend({
       conversationId: inputs.agentId,
-      previousMessageCount: chunkY2KYR2ED_cjs.getSessionMessages(inputs.agentId).length
+      previousMessageCount: chunkDZG77WU7_cjs.getSessionMessages(inputs.agentId).length
     });
   }
   await inputs.runPreHook(userText);
@@ -9647,8 +9677,8 @@ async function executeSendLocked(inputs, message, options) {
     userText,
     sendOptions: options
   });
-  const priorMessages = [...chunkY2KYR2ED_cjs.getSessionMessages(inputs.agentId)];
-  chunkY2KYR2ED_cjs.appendSessionMessage(inputs.agentId, { role: "user", text: userText });
+  const priorMessages = [...chunkDZG77WU7_cjs.getSessionMessages(inputs.agentId)];
+  chunkDZG77WU7_cjs.appendSessionMessage(inputs.agentId, { role: "user", text: userText });
   await persistMemoryFactIfWritePrompt(inputs.workspaceCwd, inputs.options.memory, userText);
   const memoryFacts = await readMemoryForSend(inputs.workspaceCwd, inputs.options.memory, userText);
   const memoryTools = void 0;
@@ -9767,6 +9797,7 @@ var KNOWN_LOCAL_OPTION_KEYS = /* @__PURE__ */ new Set([
   "cwd",
   "settingSources",
   "compatSources",
+  "hooks",
   "sandboxOptions",
   "sessionDir",
   "baseDir",
@@ -9917,8 +9948,8 @@ var LocalAgent = class {
     if (sub.plugins !== void 0) this.plugins = sub.plugins;
     reportUnknownLocalOptions(options.local);
     const compatSources = resolveCompatSources(options, this.workspaceCwd);
-    chunkDWB3CN46_cjs.reportUndeclaredSources(this.workspaceCwd, compatSources);
-    this.hooksExecutor = new HooksExecutor(this.workspaceCwd, compatSources);
+    chunk43YXGD3P_cjs.reportUndeclaredSources(this.workspaceCwd, compatSources);
+    this.hooksExecutor = new HooksExecutor(this.workspaceCwd, compatSources, options.local?.hooks);
     this.defaultMemoryProviderForLoop = createLocalAgentMemoryProvider({
       agentOptions: options,
       workspaceCwd: this.workspaceCwd,
@@ -9945,7 +9976,7 @@ var LocalAgent = class {
     if (this.pluginsManager !== void 0) await this.pluginsManager.initialize();
     const codePlugins = chunkBV2MWEMV_cjs.extractCodePlugins(this.options.plugins);
     await this.pluginManagerCode.initialize(codePlugins);
-    this.resolvedSubagents = await chunkIQBDR5YZ_cjs.loadSubagents(
+    this.resolvedSubagents = await chunkAYA65JA5_cjs.loadSubagents(
       this.workspaceCwd,
       this.settingSourcesIncludeProject,
       this.options.agents,
@@ -9953,7 +9984,7 @@ var LocalAgent = class {
     );
     await acquireLeaseIfPossible(this.sessionStore, this.agentId);
     try {
-      await chunkY2KYR2ED_cjs.hydrateSession(this.agentId, { store: this.sessionStore, cwd: this.workspaceCwd });
+      await chunkDZG77WU7_cjs.hydrateSession(this.agentId, { store: this.sessionStore, cwd: this.workspaceCwd });
       await this.personalityStore.hydrate(this.agentId);
     } catch (err) {
       await releaseLeaseIfPossible(this.sessionStore, this.agentId);
@@ -10294,15 +10325,15 @@ async function maybeInjectHandoffTools(options) {
   };
 }
 function keyWillFlowToProvider(apiKey, provider) {
-  if (chunk2HPNT6HH_cjs.isFixtureApiKey(apiKey)) return false;
-  if (chunk2HPNT6HH_cjs.getConfiguredBaseUrl() !== void 0) return false;
+  if (chunkC4ZQPWXJ_cjs.isFixtureApiKey(apiKey)) return false;
+  if (chunkC4ZQPWXJ_cjs.getConfiguredBaseUrl() !== void 0) return false;
   if (provider === void 0) return false;
   const profile = chunkANMJJD6D_cjs.getProviderProfile(provider);
   if (profile === void 0) return false;
   return profile.authType !== "none";
 }
 function missingApiKeyMessage() {
-  const present = chunk2HPNT6HH_cjs.presentProviderCredentialEnvVars();
+  const present = chunkC4ZQPWXJ_cjs.presentProviderCredentialEnvVars();
   const base = `Missing API key \u2014 set ${chunk6LHQPOMI_cjs.API_KEY_ENV_VAR}, or pass \`apiKey\` to Agent.create()`;
   if (present.length === 0) return `${base}.`;
   return `${base}. ${present.join(" and ")} ${present.length === 1 ? "is" : "are"} set, but a provider credential is not read from the environment automatically \u2014 pass it explicitly, e.g. \`Agent.create({ apiKey: process.env.${present[0]}, ... })\`.`;
@@ -10322,7 +10353,7 @@ async function createLocalAgent(options) {
     }
   } else {
     const willFlowToProvider = keyWillFlowToProvider(apiKey, provider);
-    const shape = chunk2HPNT6HH_cjs.validateApiKeyShape(apiKey, {
+    const shape = chunkC4ZQPWXJ_cjs.validateApiKeyShape(apiKey, {
       strict: willFlowToProvider,
       ...willFlowToProvider ? { provider } : {}
     });
@@ -10341,15 +10372,15 @@ async function createCloudAgent(options) {
       code: "missing_api_key"
     });
   }
-  const shape = chunk2HPNT6HH_cjs.validateApiKeyShape(apiKey);
+  const shape = chunkC4ZQPWXJ_cjs.validateApiKeyShape(apiKey);
   if (shape.malformed) {
     throw new chunkJ7J7J2GN_cjs.AuthenticationError(shape.message, { code: "malformed_api_key" });
   }
-  const baseUrl = chunk2HPNT6HH_cjs.getConfiguredBaseUrl();
+  const baseUrl = chunkC4ZQPWXJ_cjs.getConfiguredBaseUrl();
   if (baseUrl === void 0) {
     return new CloudAgent(options);
   }
-  const response = await chunk2HPNT6HH_cjs.httpRequest("/v1/agents", {
+  const response = await chunkC4ZQPWXJ_cjs.httpRequest("/v1/agents", {
     apiKey,
     method: "POST",
     body: {
@@ -10374,7 +10405,7 @@ function resolveAgentPersistenceCwd(options) {
   return process.cwd();
 }
 async function rehydrateExistingAgent(agentId, existing, options) {
-  await chunk2HPNT6HH_cjs.discoverProviderPlugins();
+  await chunkC4ZQPWXJ_cjs.discoverProviderPlugins();
   await validateRehydratedAgent(agentId, existing);
   const mergedLocal = options.local !== void 0 && existing.options.local !== void 0 ? { ...existing.options.local, ...options.local } : options.local ?? existing.options.local;
   const mergedOptions = {
@@ -10525,7 +10556,7 @@ var Agent = class _Agent {
       pluginCount: enabledPluginNames(options.plugins).length
     });
     try {
-      await chunk2HPNT6HH_cjs.discoverProviderPlugins();
+      await chunkC4ZQPWXJ_cjs.discoverProviderPlugins();
       const agent = await runCreateUnderSpan(options, span);
       return agent;
     } catch (err) {
@@ -10823,9 +10854,9 @@ var Agent = class _Agent {
    */
   static async compact(agentId, options = {}) {
     const reg = await requireLocalAgent(agentId, "compact");
-    const { compactSessionTranscript, buildDefaultSummarizer: buildDefaultSummarizer2 } = await import('./compact-session-BHTPCIHA.cjs');
+    const { compactSessionTranscript, buildDefaultSummarizer: buildDefaultSummarizer2 } = await import('./compact-session-7FMYJXQ7.cjs');
     const { cwd, model, store } = await openLocalStore(reg);
-    return chunkY2KYR2ED_cjs.enqueueSessionWrite(
+    return chunkDZG77WU7_cjs.enqueueSessionWrite(
       cwd,
       agentId,
       () => compactSessionTranscript({
@@ -10850,7 +10881,7 @@ var Agent = class _Agent {
    */
   static async injectSessionTurn(agentId, turn) {
     const reg = await requireLocalAgent(agentId, "injectSessionTurn");
-    const { injectSessionTurn } = await import('./inject-session-W6A46J3E.cjs');
+    const { injectSessionTurn } = await import('./inject-session-PC73TMP2.cjs');
     const { cwd, model, store } = await openLocalStore(reg);
     await injectSessionTurn({
       store,
@@ -10901,7 +10932,7 @@ var Agent = class _Agent {
    */
   static async describe(agentId) {
     const agent = await getRegisteredAgentOrThrow(agentId);
-    const { loadSubagents: loadSubagents2 } = await import('./subagents-loader-7G76XOZU.cjs');
+    const { loadSubagents: loadSubagents2 } = await import('./subagents-loader-DN4LETGL.cjs');
     const settingSources = agent.options.local?.settingSources;
     const subagents = await loadSubagents2(
       agent.cwd ?? process.cwd(),
@@ -11019,5 +11050,5 @@ exports.generateCronId = generateCronId;
 exports.getPricingEntry = getPricingEntry;
 exports.openRouterMemoryEmbeddingProviderAdapter = openRouterMemoryEmbeddingProviderAdapter;
 exports.resolveSessionDir = resolveSessionDir;
-//# sourceMappingURL=chunk-Y46VI73J.cjs.map
-//# sourceMappingURL=chunk-Y46VI73J.cjs.map
+//# sourceMappingURL=chunk-UALC6Q3J.cjs.map
+//# sourceMappingURL=chunk-UALC6Q3J.cjs.map