@theokit/sdk 5.4.0 → 5.6.0

package/dist/{chunk-IKBLU7ZS.js → chunk-2UXQASTX.js}

@@ -1,21 +1,21 @@
 import { submit, emitRunEvent } from './chunk-K2VMFZQ5.js';
 import { enqueueSessionWrite, hydrateSession, persistTurnToTranscript, flushSessionWrites, appendSessionMessage, getSessionMessages, discardSession, clearSession } from './chunk-2QKV4CGK.js';
-import { IndexManager } from './chunk-7SZAV6QG.js';
-import { loadHookConfig, warnOnce, currentPersonalityContext, warnPersonalitySwitchInsideFork } from './chunk-XD3FS5OI.js';
+import { IndexManager } from './chunk-7MMTZBTT.js';
+import { warnFailureOnce, loadHookConfig, warnOnce, currentPersonalityContext, warnPersonalitySwitchInsideFork } from './chunk-N2KAIZ5D.js';
 import { extractCodePlugins } from './chunk-2SFBB54R.js';
 import { createOpenAiCompatibleRuntime } from './chunk-55GB6JYQ.js';
 import { persistActiveMemoryTranscript } from './chunk-OR6XIWLB.js';
-import { writeSessionSummary, resolveMemoryRoot, MEMORY_KINDS, appendFact, readFacts, legacyMemoryJsonPath, memoryMdPath, appendFactToMarkdown } from './chunk-SADXXGWU.js';
+import { writeSessionSummary, resolveMemoryRoot, MEMORY_KINDS, appendFact, readFacts, legacyMemoryJsonPath, memoryMdPath, appendFactToMarkdown } from './chunk-BZ3YMAMP.js';
 import { FsSessionStore } from './chunk-AAEZSPTC.js';
 import { discoverProviderPlugins, validateApiKeyShape, getConfiguredBaseUrl, httpRequest, isFixtureApiKey, presentProviderCredentialEnvVars, buildDefaultSummarizer, shouldUseRealLocalRuntime, parseSseStream, CircuitBreaker, resolveRunProvider, mergeExplicitApiKey, resolveProviderChain, abortError, tryFirstEvent, relayStream, renderToolResultContentText } from './chunk-KZSKIUXZ.js';
 import { resolveChildEnv } from './chunk-HKCKOAIO.js';
-import { DEFAULT_MAX_BYTES_PER_FILE, runDiscovery, truncateWithMarker } from './chunk-N6OOOYFZ.js';
+import { DEFAULT_MAX_BYTES_PER_FILE, runDiscovery, truncateWithMarker } from './chunk-HUDNLFY4.js';
 import { readVersionedJson, writeVersionedJson } from './chunk-SVQIW5RJ.js';
 import { toJsonSchema } from './chunk-7I5Z3UBJ.js';
 import { sanitizeToolInput } from './chunk-FJWQP6EE.js';
 import { withInheritedSubAgentCredentials, subAgentToolsFromDefinitions } from './chunk-CFE6QF2Q.js';
 import { setAgentFacade } from './chunk-6X6ID4MO.js';
-import { escapeBlockBody, buildSkillsBlock, discoverSkills, stripSkillFrontmatter } from './chunk-LX7SEXOQ.js';
+import { escapeBlockBody, buildSkillsBlock, discoverSkills, stripSkillFrontmatter } from './chunk-CA5VUAP3.js';
 import { withToolWhitelist, checkToolWhitelist } from './chunk-SAGRF4IB.js';
 import { validateArtifactPath, PathTraversalError, safePathJoin } from './chunk-EH6XD3FY.js';
 import { insideRoot, atOrInsideRoot } from './chunk-UKMBRMGT.js';
@@ -24,9 +24,9 @@ import { expandTilde, defaultBaseDir } from './chunk-JOFVLOFY.js';
 import { withFileLock } from './chunk-TA3K7SBK.js';
 import { withCwdMutex } from './chunk-Q5EWJPRY.js';
 import { sweepStaleAtomicTemps, atomicWriteJson } from './chunk-3JHIFQ4I.js';
-import { loadSubagents, pluginBundleDirs } from './chunk-O7L7M42F.js';
-import { reportUndeclaredSources, theokitConfigRoot, undefinedVariablesIn, getTheokitHome, adapterForConfigPath, projectConfigRoots, pluginBundleRoots } from './chunk-NSLHPAC7.js';
-import { readWorkspaceDir, parseSimpleYaml } from './chunk-JNAA4G4H.js';
+import { loadSubagents, pluginBundleDirs } from './chunk-T3ZDEYTJ.js';
+import { reportUndeclaredSources, theokitConfigRoot, undefinedVariablesIn, getTheokitHome, adapterForConfigPath, adaptersForSurface, projectConfigRoots, pluginBundleRoots } from './chunk-X7EUUHXU.js';
+import { readWorkspaceDir, parseSimpleYaml } from './chunk-UOLBAPDM.js';
 import { resolveEffectiveContextWindow, CONTEXT_WINDOW_FLOOR, CONTEXT_WINDOW_MARGIN } from './chunk-6M2OIS4Y.js';
 import { parseModelId } from './chunk-R7WIIPUR.js';
 import { getProviderProfile } from './chunk-XYFGKVZ7.js';
@@ -38,6 +38,7 @@ import { stat, mkdir, readFile, readdir, access, unlink } from 'fs/promises';
 import { randomUUID, createHash } from 'crypto';
 import { join, dirname, resolve, relative, isAbsolute } from 'path';
 import { existsSync, readFileSync } from 'fs';
+import { platform } from 'process';
 import { spawn } from 'child_process';
 import { z } from 'zod';
 import { createRequire } from 'module';
@@ -2550,6 +2551,116 @@ function readCompatConfigFile(cwd) {
 function resolveCompatSources(options, cwd) {
   return options.local?.compatSources ?? readCompatConfigFile(cwd);
 }
+var KNOWN_KEYS = /* @__PURE__ */ new Set([
+  "disableAllHooks",
+  "disableSkillShellExecution",
+  "permissions",
+  "permissionMode"
+]);
+function managedSettingsPathFor(root) {
+  if (root !== void 0) return join(root, "claude-code", "managed-settings.json");
+  if (platform === "darwin") {
+    return "/Library/Application Support/ClaudeCode/managed-settings.json";
+  }
+  if (platform === "win32") {
+    const programData = process.env.PROGRAMDATA ?? "C:\\ProgramData";
+    return join(programData, "ClaudeCode", "managed-settings.json");
+  }
+  return "/etc/claude-code/managed-settings.json";
+}
+function readManagedSettings(root) {
+  const path = managedSettingsPathFor(root);
+  const parsed = readPolicyDocument(path);
+  if (parsed === void 0) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    applyPolicyKey(out, key, value, path);
+  }
+  return out;
+}
+function readPolicyDocument(path) {
+  if (!existsSync(path)) return void 0;
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (cause) {
+    diagFailure(
+      `[theokit-sdk] ${path} exists and could not be read (${cause.message}) \u2014 NO operator policy is being applied. Fix the permissions or remove the file.
+`
+    );
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (cause) {
+    diagFailure(
+      `[theokit-sdk] ${path} is not valid JSON (${cause.message}) \u2014 NO operator policy is being applied.
+`
+    );
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    diagFailure(
+      `[theokit-sdk] ${path} is not a JSON object \u2014 NO operator policy is being applied.
+`
+    );
+    return void 0;
+  }
+  return parsed;
+}
+var PERMISSION_MODES = ["default", "plan", "acceptEdits", "bypass"];
+function applyPolicyKey(out, key, value, path) {
+  if (!KNOWN_KEYS.has(key)) {
+    decline(path, key, "this runtime does not enforce it");
+    return;
+  }
+  if (key === "permissionMode") {
+    const mode = readMode(value, path);
+    if (mode !== void 0) out.permissionMode = mode;
+    return;
+  }
+  if (key === "permissions") {
+    const rules = readRuleLists(value, path);
+    if (rules !== void 0) out.permissions = rules;
+    return;
+  }
+  const flag = readBoolean(value, key, path);
+  if (flag === void 0) return;
+  if (key === "disableAllHooks") out.disableAllHooks = flag;
+  if (key === "disableSkillShellExecution") out.disableSkillShellExecution = flag;
+}
+function decline(path, key, reason) {
+  diagFailure(`[theokit-sdk] ${path} declares "${key}" \u2014 ${reason}. It is NOT being applied.
+`);
+}
+function readMode(value, path) {
+  if (typeof value === "string" && PERMISSION_MODES.includes(value)) {
+    return value;
+  }
+  decline(
+    path,
+    "permissionMode",
+    `${JSON.stringify(value)} is not one of ${PERMISSION_MODES.join(", ")}`
+  );
+  return void 0;
+}
+function readRuleLists(value, path) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    return value;
+  }
+  decline(
+    path,
+    "permissions",
+    `it is ${Array.isArray(value) ? "an array" : typeof value}, not an object of rule lists`
+  );
+  return void 0;
+}
+function readBoolean(value, key, path) {
+  if (typeof value === "boolean") return value;
+  decline(path, key, `it is ${typeof value}, not a boolean`);
+  return void 0;
+}
 function spawnAndCollect(options) {
   return new Promise((resolve) => {
     const timeoutMs = options.timeoutMs ?? 3e4;
@@ -2600,16 +2711,26 @@ function spawnAndCollect(options) {
 
 // src/internal/runtime/hooks/hooks-executor.ts
 var HooksExecutor = class {
-  constructor(cwd, compatSources = [], gate = void 0) {
+  constructor(cwd, compatSources = [], gate = void 0, policy = {}) {
     this.cwd = cwd;
     this.compatSources = compatSources;
     this.gate = gate;
+    this.policy = policy;
   }
   cwd;
   compatSources;
   gate;
+  policy;
   config = {};
   async initialize(settingSourcesIncludeProject) {
+    if (readManagedSettings(this.policy.managedSettingsRoot).disableAllHooks === true) {
+      warnFailureOnce(
+        "hooks-disabled-by-policy",
+        "[theokit-sdk] hooks: an operator policy (managed-settings.json) declares disableAllHooks \u2014 NO hook will run, including any this project declared."
+      );
+      this.config = {};
+      return;
+    }
     if (!settingSourcesIncludeProject) {
       this.config = {};
       return;
@@ -2656,19 +2777,24 @@ var HooksExecutor = class {
    *
    * No gate means no refusal, which is what every consumer gets today.
    */
-  async refusedByConsumer(command, payload) {
+  async refusedByConsumer(command, payload, timeoutMs) {
     if (this.gate?.approve === void 0) return false;
     const request = {
       command: command.command,
       event: payload.event,
+      // #637 — the EFFECTIVE timeout, passed in rather than recomputed here, so the number the
+      // consumer is shown and the number `spawnAndCollect` enforces are the same expression.
+      // Recomputing would be one line and would be the place they later diverge.
+      timeoutMs,
+      sourceEvent: command.sourceEvent,
       ...command.sourcePath === void 0 ? {} : { sourcePath: command.sourcePath },
       ...command.matcher === void 0 ? {} : { matcher: command.matcher }
     };
     return !await this.gate.approve(request);
   }
   async executeOne(command, payload) {
-    if (await this.refusedByConsumer(command, payload)) return { decision: "allow" };
     const timeoutMs = command.timeoutMs ?? 3e4;
+    if (await this.refusedByConsumer(command, payload, timeoutMs)) return { decision: "allow" };
     const env = runtimeEnvFor(command.sourcePath, this.cwd);
     const result = await spawnAndCollect({
       command: "sh",
@@ -2676,7 +2802,7 @@ var HooksExecutor = class {
       cwd: this.cwd,
       ...Object.keys(env).length > 0 ? { env } : {},
       timeoutMs,
-      stdin: JSON.stringify(payload)
+      stdin: JSON.stringify(stdinPayloadFor(payload, command, this.cwd))
     });
     const failure = this.decisionFromFailure(result, command, env, timeoutMs);
     return failure ?? parseDecisionFromStdout(result.stdout);
@@ -2690,9 +2816,16 @@ var HooksExecutor = class {
    * spawned.
    */
   decisionFromFailure(result, command, env, timeoutMs) {
-    if (result.timedOut) return { decision: "deny", reason: `Hook timed out after ${timeoutMs}ms` };
+    if (result.timedOut)
+      return {
+        decision: "deny",
+        reason: `Hook timed out after ${timeoutMs}ms`
+      };
     if (result.spawnError !== void 0) {
-      return { decision: "deny", reason: `Hook spawn failed: ${result.spawnError.message}` };
+      return {
+        decision: "deny",
+        reason: `Hook spawn failed: ${result.spawnError.message}`
+      };
     }
     if (result.exitCode === 0) return void 0;
     const stderr = result.stderr.trim();
@@ -2705,6 +2838,16 @@ var HooksExecutor = class {
     };
   }
 };
+function stdinPayloadFor(payload, command, cwd) {
+  return {
+    ...payload,
+    cwd,
+    ...command.sourceEvent === void 0 ? {} : { hook_event_name: command.sourceEvent },
+    ...payload.tool === void 0 ? {} : { tool_name: payload.tool },
+    ...payload.input === void 0 ? {} : { tool_input: payload.input },
+    ...payload.output === void 0 ? {} : { tool_response: payload.output }
+  };
+}
 function runtimeEnvFor(sourcePath, cwd) {
   if (sourcePath === void 0) return {};
   return adapterForConfigPath(sourcePath)?.runtimeEnv(cwd) ?? {};
@@ -2712,19 +2855,35 @@ function runtimeEnvFor(sourcePath, cwd) {
 function parseDecisionFromStdout(stdout) {
   const trimmed = stdout.trim();
   if (trimmed.length === 0) return { decision: "allow" };
+  let parsed;
   try {
-    const parsed = JSON.parse(trimmed);
-    if (parsed.decision === "deny" || parsed.decision === "feedback") {
-      const result = { decision: parsed.decision };
-      if (parsed.reason !== void 0) result.reason = parsed.reason;
-      if (parsed.feedback !== void 0) result.feedback = parsed.feedback;
-      return result;
-    }
-    if (parsed.decision === "allow") return { decision: "allow" };
+    parsed = JSON.parse(trimmed);
   } catch {
     return { decision: "feedback", feedback: trimmed };
   }
-  return { decision: "allow" };
+  return nestedDecision(parsed) ?? flatDecision(parsed) ?? { decision: "allow" };
+}
+function nestedDecision(parsed) {
+  const nested = parsed.hookSpecificOutput;
+  if (nested?.permissionDecision === "allow") return { decision: "allow" };
+  if (nested?.permissionDecision !== "deny" && nested?.permissionDecision !== "ask") {
+    return void 0;
+  }
+  const result = { decision: "deny" };
+  if (nested.permissionDecisionReason !== void 0) {
+    result.reason = nested.permissionDecisionReason;
+  }
+  return result;
+}
+function flatDecision(parsed) {
+  if (parsed.decision === "allow") return { decision: "allow" };
+  if (parsed.decision !== "deny" && parsed.decision !== "block" && parsed.decision !== "feedback") {
+    return void 0;
+  }
+  const result = parsed.decision === "feedback" ? { decision: "feedback" } : { decision: "deny" };
+  if (parsed.reason !== void 0) result.reason = parsed.reason;
+  if (parsed.feedback !== void 0) result.feedback = parsed.feedback;
+  return result;
 }
 
 // src/internal/runtime/lifecycle/context-budget-event.ts
@@ -3038,7 +3197,15 @@ async function buildSystemPromptContext(inputs, userText, memoryFacts, manager =
     agentId: inputs.agentId,
     cwd: inputs.workspaceCwd,
     model: inputs.model,
-    skills: skills.map((skill) => ({ name: skill.name, description: skill.description })),
+    // This is the ONLY place the model learns which skills exist, which is what makes
+    // `disable-model-invocation` enforceable rather than decorative. The scaffold had been writing
+    // authorization frontmatter that the parser discarded, so the default was disclose-all.
+    //
+    // A disclosure rule, not an execution rule: `skills.get(name)` still resolves a hidden skill,
+    // because a caller naming one has already made the decision this field keeps away from the
+    // model. Widening it to execution would break the case the field is FOR — a side-effecting
+    // skill a human may run and the model may not propose.
+    skills: skills.filter((skill) => skill.disableModelInvocation !== true).map((skill) => ({ name: skill.name, description: skill.description })),
     userMessage: userText,
     memory: memoryFacts.map((fact) => ({ text: fact.text }))
   };
@@ -4062,14 +4229,24 @@ var ContextSourceFrontmatterSchema = z.object({
 
 // src/internal/runtime/context/context-manager.ts
 var FileContextManager = class {
-  constructor(cwd, settings, settingSourcesIncludeProject) {
+  /**
+   * @param compatSources - What the consumer declared in `local.compatSources` (or
+   * `.theokit/config.json`), as `resolveCompatSources` resolved it. `undefined` means the caller
+   * did not thread the declaration through at all and every dialect runs — the pre-#652 behaviour,
+   * kept so an internal caller constructing this directly does not silently lose content. An empty
+   * ARRAY is different and is the fix: it means the consumer declared no foreign dialect, so
+   * `.claude/rules/*.md` does not reach the prompt.
+   */
+  constructor(cwd, settings, settingSourcesIncludeProject, compatSources) {
     this.cwd = cwd;
     this.settings = settings;
     this.settingSourcesIncludeProject = settingSourcesIncludeProject;
+    this.compatSources = compatSources;
   }
   cwd;
   settings;
   settingSourcesIncludeProject;
+  compatSources;
   state;
   /**
    * The in-scope file set used by the most recent `refresh`. Tracked so
@@ -4078,6 +4255,19 @@ var FileContextManager = class {
    * snapshot untouched, at zero per-send cost.
    */
   lastScope = [];
+  /**
+   * The dialect kinds granted the `context` surface, or `undefined` when nothing was declared to
+   * this instance.
+   *
+   * Routed through `adaptersForSurface` rather than reading `.kind` off the declarations, so the
+   * three fail-closed rules #524 established govern this surface identically to the other four: a
+   * bare string admits everything, an object with no `import` admits nothing, and an unrecognised
+   * surface name narrows rather than widens.
+   */
+  grantedContextDialects() {
+    if (this.compatSources === void 0) return void 0;
+    return adaptersForSurface(this.compatSources, "context").map((a) => a.kind);
+  }
   async initialize() {
     if (!this.settingSourcesIncludeProject && this.settings.manager !== "file") {
       this.state = { config: { sources: [] }, loadedSources: [] };
@@ -4105,11 +4295,16 @@ var FileContextManager = class {
     const legacy = await loadSources(config, this.cwd);
     const maxBytesPerFile = this.settings.maxBytesPerFile ?? DEFAULT_MAX_BYTES_PER_FILE;
     const maxBytesTotal = this.settings.maxBytesTotal ?? DEFAULT_MAX_BYTES_TOTAL;
+    const granted = this.grantedContextDialects();
     const discovered = await runDiscovery({
       cwd: this.cwd,
       maxBytesPerFile,
       skipLegacyTheokitContext: true,
-      touchedFiles
+      touchedFiles,
+      // #652 — the grant this path never consulted. Without it, a consumer who enabled project
+      // scope for its OWN `.theokit/` also received a cloned repository's `.claude/rules/*.md`,
+      // through a door the hooks/skills/subagents/plugins gate does not cover.
+      ...granted === void 0 ? {} : { declaredCompatKinds: granted }
     });
     const legacyAsAggregator = legacy.filter((src) => src.status !== "excluded").map((src) => ({
       id: src.name,
@@ -4504,7 +4699,12 @@ function buildContext(args, out) {
   out.context = new FileContextManager(
     args.workspaceCwd,
     args.options.context,
-    args.settingSourcesIncludeProject
+    args.settingSourcesIncludeProject,
+    // #652 — the same declaration `buildSkills` and `buildPlugins` already pass. Omitting it here
+    // is what let a foreign root's instructions into the system prompt while its skills, subagents,
+    // hooks and plugins were correctly withheld: four surfaces failing closed and a fifth nobody
+    // had wired to the gate.
+    resolveCompatSources(args.options, args.workspaceCwd)
   );
 }
 function buildProviders(args, out) {
@@ -9152,7 +9352,7 @@ async function* localAgentStreamToCompletion(agent, message, options) {
 async function localAgentFork(parent, options) {
   const { forkAgentImpl } = await import('./fork-agent-S2EPIML7.js');
   const { getAgentFacade } = await import('./agent-factory-registry-ZVTABLEY.js');
-  const { withPersonalityContext } = await import('./context-EGM6CHXD.js');
+  const { withPersonalityContext } = await import('./context-J5BJ3LBS.js');
   const create = getAgentFacade().create;
   return withPersonalityContext(
     { slug: parent.personalitySlugSnapshot, isFork: true },
@@ -10929,7 +11129,7 @@ var Agent = class _Agent {
    */
   static async describe(agentId) {
     const agent = await getRegisteredAgentOrThrow(agentId);
-    const { loadSubagents: loadSubagents2 } = await import('./subagents-loader-AIVDQ2D5.js');
+    const { loadSubagents: loadSubagents2 } = await import('./subagents-loader-CJFYQQU2.js');
     const settingSources = agent.options.local?.settingSources;
     const subagents = await loadSubagents2(
       agent.cwd ?? process.cwd(),
@@ -11035,6 +11235,6 @@ async function openLocalStore(reg) {
   return { cwd, model, store: new FsSessionStore2({ baseDir, cwd }) };
 }
 
-export { Agent, AgentBuilder, DEFAULT_AGENTIC_MODEL_ID, MEMORY_EMBEDDING_ADAPTERS, Tool, ToolError, UsageAccumulator, computeCost, generateCronId, getPricingEntry, openRouterMemoryEmbeddingProviderAdapter, resolveSessionDir };
-//# sourceMappingURL=chunk-IKBLU7ZS.js.map
-//# sourceMappingURL=chunk-IKBLU7ZS.js.map
+export { Agent, AgentBuilder, DEFAULT_AGENTIC_MODEL_ID, MEMORY_EMBEDDING_ADAPTERS, Tool, ToolError, UsageAccumulator, computeCost, generateCronId, getPricingEntry, managedSettingsPathFor, openRouterMemoryEmbeddingProviderAdapter, readManagedSettings, resolveSessionDir };
+//# sourceMappingURL=chunk-2UXQASTX.js.map
+//# sourceMappingURL=chunk-2UXQASTX.js.map