@theokit/sdk 5.5.0 → 5.7.0

package/dist/index.js

@@ -1,36 +1,37 @@
 export { StreamObjectError } from './chunk-5WKQDIGO.js';
 export { GOAL_CONTINUATION_MARKER } from './chunk-PY2RQOA7.js';
 export { JudgeCredentialError } from './chunk-IUMAQURF.js';
-import { migrateSqliteToLance, appendDiaryEntry } from './chunk-WS5ULCL4.js';
+import { migrateSqliteToLance, appendDiaryEntry } from './chunk-YRLI5DVC.js';
 export { GenerateObjectError } from './chunk-44I6UYVH.js';
 import './chunk-47TF32NQ.js';
 import { Workflow, agentStep } from './chunk-HFEJE7AC.js';
 export { Workflow, agentStep, fn } from './chunk-HFEJE7AC.js';
 import './chunk-GBCVPKHE.js';
 import './chunk-HY66GLM6.js';
-export { Cron } from './chunk-M3ZGRGOG.js';
-import { MEMORY_EMBEDDING_ADAPTERS, resolveSessionDir, DEFAULT_AGENTIC_MODEL_ID, Agent } from './chunk-ODBID5TG.js';
-export { Agent, AgentBuilder, Tool, ToolError, UsageAccumulator, computeCost, getPricingEntry } from './chunk-ODBID5TG.js';
+export { Cron } from './chunk-6JG2RFGK.js';
+import { MEMORY_EMBEDDING_ADAPTERS, resolveSessionDir, DEFAULT_AGENTIC_MODEL_ID, Agent } from './chunk-FUUSIT2T.js';
+export { Agent, AgentBuilder, Tool, ToolError, UsageAccumulator, computeCost, getPricingEntry, managedSettingsPathFor, readManagedSettings } from './chunk-FUUSIT2T.js';
 import { configure, submit, list, get, cancel, subscribe } from './chunk-K2VMFZQ5.js';
 export { emitRunEvent } from './chunk-K2VMFZQ5.js';
-import './chunk-2QKV4CGK.js';
+import './chunk-CZWN4C6A.js';
 import './chunk-K2BQQ445.js';
-import './chunk-7SZAV6QG.js';
-import './chunk-S6B5XYC3.js';
+import './chunk-P5S3WCSZ.js';
+import './chunk-DQNI52VV.js';
 import './chunk-2SFBB54R.js';
 import './chunk-55GB6JYQ.js';
 import './chunk-H73MEMQB.js';
 import './chunk-OR6XIWLB.js';
-import { resolveMemoryRoot, readFactsFromMarkdown } from './chunk-SADXXGWU.js';
+import { resolveMemoryRoot, readFactsFromMarkdown } from './chunk-R3LBRQAN.js';
 import { FsSessionStore } from './chunk-AAEZSPTC.js';
-import { discoverProviderPlugins, shouldUseFixtureMode, isFixtureApiKey, httpRequest, mapOllamaTransportError, readErrorResponseBody, mapOllamaHttpError } from './chunk-KZSKIUXZ.js';
+import { discoverProviderPlugins, shouldUseFixtureMode, isFixtureApiKey, httpRequest, mapOllamaTransportError, readErrorResponseBody, mapOllamaHttpError } from './chunk-N7VAE6DZ.js';
 import './chunk-UBR5PWD7.js';
 import './chunk-2XC6KDJM.js';
 import './chunk-XB4GI5RZ.js';
 import './chunk-24MGQDK3.js';
 import { readSessionMessages } from './chunk-2WXHA33T.js';
 import './chunk-HKCKOAIO.js';
-import './chunk-N6OOOYFZ.js';
+import './chunk-3VXQEQE4.js';
+import './chunk-7C3HWGCW.js';
 import './chunk-KVNWIAO4.js';
 import './chunk-SVQIW5RJ.js';
 import './chunk-FD2UT76F.js';
@@ -39,8 +40,8 @@ import './chunk-FJWQP6EE.js';
 import './chunk-NAF4L3T6.js';
 import './chunk-CFE6QF2Q.js';
 import './chunk-6X6ID4MO.js';
-import './chunk-LX7SEXOQ.js';
-import './chunk-2XRAWOZZ.js';
+import { stripSkillFrontmatter } from './chunk-CA5VUAP3.js';
+import './chunk-A6PDYH55.js';
 import './chunk-SAGRF4IB.js';
 import './chunk-EH6XD3FY.js';
 import './chunk-UKMBRMGT.js';
@@ -55,9 +56,9 @@ import { withCwdMutex } from './chunk-Q5EWJPRY.js';
 export { withCwdMutex } from './chunk-Q5EWJPRY.js';
 export { TASK_RESERVED_PREFIXES, isValidTaskId } from './chunk-EIQFAOFD.js';
 import { replaceFileAtomic } from './chunk-3JHIFQ4I.js';
-import './chunk-O7L7M42F.js';
-import './chunk-NSLHPAC7.js';
-import './chunk-JNAA4G4H.js';
+import './chunk-T3ZDEYTJ.js';
+import { CLAUDE_DIR_NAME, THEOKIT_DIR_LITERAL } from './chunk-X7EUUHXU.js';
+import './chunk-UOLBAPDM.js';
 import { estimateTokens, CHARS_PER_TOKEN } from './chunk-6M2OIS4Y.js';
 export { estimateTokens } from './chunk-6M2OIS4Y.js';
 import { parseModelId } from './chunk-R7WIIPUR.js';
@@ -72,9 +73,10 @@ export { AgentDisposedError, AgentRunError, AuthenticationError, BudgetExceededE
 import { diag, redactSecrets, addPattern, resolveApiKey } from './chunk-CZJ6Q7CW.js';
 export { setDiagnosticsSink } from './chunk-CZJ6Q7CW.js';
 import { createHash, randomUUID } from 'crypto';
+import { readFile, mkdir, readdir } from 'fs/promises';
+import { resolve, normalize, sep, isAbsolute, parse, relative, dirname, join } from 'path';
 import { z } from 'zod';
-import { mkdir } from 'fs/promises';
-import { join } from 'path';
+import { homedir } from 'os';
 
 // src/agent-factory.ts
 function createAgentFactory(common) {
@@ -691,12 +693,43 @@ var Provider = class _Provider {
     return _Provider.builtins().find((p) => p.name === provider);
   }
 };
+async function resolveBody(skill) {
+  if (typeof skill.instructions === "string") {
+    const inline = skill;
+    return inline.references === void 0 ? { instructions: inline.instructions } : { instructions: inline.instructions, references: inline.references };
+  }
+  const source = skill.source;
+  const skillDir = dirname(source);
+  const body = stripSkillFrontmatter(await readFile(source, "utf8"));
+  const instructions = body.replaceAll(SKILL_DIR_PLACEHOLDER, skillDir);
+  const references = await readReferences(skillDir);
+  return references === void 0 ? { instructions } : { instructions, references };
+}
+var SKILL_DIR_PLACEHOLDER = "${CLAUDE_SKILL_DIR}";
+async function readReferences(skillDir) {
+  const dir = join(skillDir, "references");
+  let names;
+  try {
+    names = await readdir(dir);
+  } catch {
+    return void 0;
+  }
+  const refs = {};
+  for (const name of names) {
+    try {
+      refs[name] = await readFile(join(dir, name), "utf8");
+    } catch {
+    }
+  }
+  return Object.keys(refs).length > 0 ? refs : void 0;
+}
 var SkillReadInputSchema = z.object({
   name: z.string().min(1, "skill_read: `name` is required.")
 });
-function renderSkill(skill) {
-  const parts = [`# Skill: ${skill.name}`, "", skill.instructions];
-  const refs = skill.references;
+async function renderSkill(skill) {
+  const { instructions, references } = await resolveBody(skill);
+  const parts = [`# Skill: ${skill.name}`, "", instructions];
+  const refs = references;
   if (refs !== void 0 && Object.keys(refs).length > 0) {
     parts.push("", "## References");
     for (const [file, content] of Object.entries(refs)) {
@@ -719,6 +752,11 @@ function defineSkillReadTool(skills) {
     name: "skill_read",
     description: "Read a skill's full instructions (and any bundled reference documents) by its name. Use this to load the body of a skill listed in the <skills> block before acting on it.",
     inputSchema: toJsonSchema(SkillReadInputSchema),
+    // NOT `async`. Marking the whole handler async turns the schema's SYNCHRONOUS throw into a
+    // rejected promise, and this module's contract is that malformed input "fails at the trust
+    // boundary via the schema" — measured, two trust-boundary tests went from throwing to
+    // returning `undefined`. Only the body read needs to be asynchronous, so only it returns a
+    // promise: parse and the not-found answer stay exactly as synchronous as they were.
     handler: (input) => {
       const { name } = SkillReadInputSchema.parse(input);
       const skill = skills.find((s) => s.name === name);
@@ -1028,10 +1066,10 @@ var JobQueue = class {
       this.running += 1;
       return Promise.resolve();
     }
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       this.waiting.push(() => {
         this.running += 1;
-        resolve();
+        resolve2();
       });
     });
   }
@@ -1339,7 +1377,7 @@ var Memory = {
       openArgs.embedding = await resolveEmbedding(opts.embedding, peer.MEMORY_EMBEDDING_ADAPTERS);
       return await peer.IndexManager.open(openArgs);
     }
-    const { IndexManager } = await import('./index-manager-W7FDMGEG.js');
+    const { IndexManager } = await import('./index-manager-Z4XMRVWQ.js');
     openArgs.embedding = await resolveEmbedding(opts.embedding, MEMORY_EMBEDDING_ADAPTERS);
     return await IndexManager.open(openArgs);
   },
@@ -1484,6 +1522,111 @@ var PermissionEngine = class {
     return true;
   }
 };
+var PROTECTED_SEGMENTS = [
+  ".git",
+  // The two agent-configuration directories come from the dialect declarations rather than being
+  // spelled again here. A second copy of `.theokit` would drift from the one `paths.ts` resolves
+  // against, and this list would then protect a directory the runtime no longer uses — worse than
+  // not protecting it, because the gap would be invisible.
+  CLAUDE_DIR_NAME,
+  THEOKIT_DIR_LITERAL,
+  ".ssh",
+  ".gnupg"
+];
+var PROTECTED_FILES = [
+  ".envrc",
+  ".npmrc",
+  ".mcp.json",
+  ".pre-commit-config.yaml",
+  ".netrc"
+];
+var WRITING_TOOLS = /^(write|edit|apply_?patch|multi_?edit|notebook_?edit|create)/i;
+var PATH_ARGS = ["file_path", "path", "notebook_path"];
+var COMMAND_ARGS = ["command", "cmd"];
+function permissionFloorReason(toolName, args, context = {}) {
+  const cwd = resolve(context.cwd ?? process.cwd());
+  const home = resolve(context.home ?? homedir());
+  const command = firstString(args, COMMAND_ARGS);
+  if (command !== void 0) {
+    const target = destructiveTargetIn(command, { cwd, home });
+    if (target !== void 0) {
+      return `refused by the critical-path floor: "${command}" is a destructive operation on ${target}. This tier is above every permission rule and every mode \u2014 it is not a rule you can reorder, and nothing in your settings is misconfigured.`;
+    }
+  }
+  if (!WRITING_TOOLS.test(toolName)) return void 0;
+  const path = firstString(args, PATH_ARGS);
+  if (path === void 0) return void 0;
+  const protectedBy = protectedReasonFor(path);
+  if (protectedBy !== void 0) {
+    return `refused by the protected-path floor: writing "${path}" would change ${protectedBy}, which no allow rule can pre-approve. This tier is above every permission rule; nothing in your settings is misconfigured.`;
+  }
+  return void 0;
+}
+function firstString(args, names) {
+  if (args === void 0) return void 0;
+  for (const name of names) {
+    const v = args[name];
+    if (typeof v === "string") return v;
+  }
+  return void 0;
+}
+function protectedReasonFor(path) {
+  const segments = normalize(path).split(/[\\/]+/).filter((s) => s.length > 0);
+  for (const segment of segments) {
+    if (PROTECTED_SEGMENTS.includes(segment)) return `the ${segment} directory`;
+  }
+  const last = segments.at(-1);
+  if (last !== void 0 && PROTECTED_FILES.includes(last)) return `the ${last} file`;
+  return void 0;
+}
+var DESTRUCTIVE = /(?:^|[;&|])\s*(rm|rmdir|shred|mkfs(?:\.[\w.-]{1,32})?|dd)\s/;
+function destructiveTargetIn(command, roots) {
+  if (!DESTRUCTIVE.test(command)) return void 0;
+  if (SUBSTITUTES.test(command)) {
+    return "a target this floor cannot resolve (the command substitutes or expands it)";
+  }
+  const critical = criticalRootsFor(roots);
+  for (const token of command.split(/\s+/)) {
+    const target = absoluteTargetOf(token, roots.home);
+    const hit = target === void 0 ? void 0 : critical.get(target);
+    if (hit !== void 0) return hit;
+  }
+  return void 0;
+}
+var SUBSTITUTES = /\$\(|`|\$\{?\w/;
+function criticalRootsFor(roots) {
+  const map = /* @__PURE__ */ new Map([
+    [resolve("/"), "the filesystem root"],
+    [roots.home, "the home directory"]
+  ]);
+  for (const parent of ancestorsOf(roots.cwd)) {
+    map.set(parent, "a parent of the working directory");
+  }
+  map.set(roots.cwd, "the working directory");
+  return map;
+}
+function absoluteTargetOf(token, home) {
+  const bare = token.replace(/["']/g, "").replace(/\/\*+$/, "");
+  if (bare.length === 0 || bare.startsWith("-")) return void 0;
+  const expanded = bare === "~" || bare.startsWith(`~${sep}`) ? home : bare;
+  return isAbsolute(expanded) ? resolve(expanded) : void 0;
+}
+function ancestorsOf(dir) {
+  const out = [];
+  let current = dir;
+  const { root } = parse(dir);
+  while (current !== root) {
+    const parent = resolve(current, "..");
+    if (parent === current) break;
+    out.push(parent);
+    current = parent;
+  }
+  return out;
+}
+function isInside(parent, child) {
+  const rel = relative(resolve(parent), resolve(child));
+  return rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel);
+}
 
 // src/permission-plugin.ts
 async function resolveAsk(opts, name, args, mode) {
@@ -1507,6 +1650,8 @@ function createPermissionPlugin(engine, opts = {}) {
       ctx.on("pre_tool_call", async (rawCtx) => {
         const { name, args, permissionMode } = rawCtx;
         const mode = permissionMode ?? opts.mode ?? "default";
+        const floor = permissionFloorReason(name, args, {});
+        if (floor !== void 0) return { block: true, message: floor };
         const action = engine.evaluate(name, args, mode);
         if (action === "deny") {
           return { block: true, message: `denied by permission engine: ${name}` };
@@ -1525,6 +1670,85 @@ var PermissionPlugin = class {
   }
 };
 
+// src/permission-rules.ts
+var PRIMARY_ARG_NAMES = ["command", "file_path", "path", "url", "query"];
+function parsePermissionRules(set) {
+  return [
+    ...(set.deny ?? []).flatMap((r) => parseOne(r, "deny")),
+    ...(set.ask ?? []).flatMap((r) => parseOne(r, "ask")),
+    ...(set.allow ?? []).flatMap((r) => parseOne(r, "allow"))
+  ];
+}
+function parseOne(rule, action) {
+  const trimmed = rule.trim();
+  const open = trimmed.indexOf("(");
+  if (open === -1) {
+    if (trimmed.length === 0) {
+      throw new ConfigurationError("permission rule is empty", { code: "permission_rule_invalid" });
+    }
+    return [{ tool: normaliseToolName(trimmed), action }];
+  }
+  if (!trimmed.endsWith(")")) {
+    throw new ConfigurationError(
+      `permission rule "${rule}" opens a specifier and never closes it \u2014 expected Tool(specifier)`,
+      { code: "permission_rule_invalid" }
+    );
+  }
+  const tool = trimmed.slice(0, open).trim();
+  const specifier = trimmed.slice(open + 1, -1);
+  if (tool.length === 0) {
+    throw new ConfigurationError(`permission rule "${rule}" names no tool`, {
+      code: "permission_rule_invalid"
+    });
+  }
+  if (specifier === "*") return [{ tool: normaliseToolName(tool), action }];
+  const test = predicateFor(specifier);
+  const name = normaliseToolName(tool);
+  return PRIMARY_ARG_NAMES.map((arg) => ({ tool: name, action, args: { [arg]: test } }));
+}
+function normaliseToolName(tool) {
+  if (!tool.startsWith("mcp__")) return tool;
+  return `mcp_${tool.slice("mcp__".length).replaceAll("__", "_")}`;
+}
+function predicateFor(specifier) {
+  if (specifier.startsWith("path:")) {
+    const re = globToRegExp(specifier.slice("path:".length));
+    return (v) => typeof v === "string" && re.test(v);
+  }
+  if (specifier.startsWith("domain:")) {
+    const host = specifier.slice("domain:".length).toLowerCase();
+    return (v) => typeof v === "string" && hostOf(v) === host;
+  }
+  if (specifier.endsWith("*")) {
+    const prefix = specifier.slice(0, -1);
+    return (v) => typeof v === "string" && v.startsWith(prefix);
+  }
+  return (v) => v === specifier;
+}
+function hostOf(value) {
+  try {
+    return new URL(value).hostname.toLowerCase();
+  } catch {
+    return void 0;
+  }
+}
+function translateGlobChar(glob, i) {
+  const c = glob[i] ?? "";
+  if (c === "?") return { pattern: "[^/]", consumed: 0 };
+  if (c !== "*") return { pattern: c.replace(/[.+^${}()|[\]\\]/g, "\\$&"), consumed: 0 };
+  if (glob[i + 1] !== "*") return { pattern: "[^/]*", consumed: 0 };
+  return { pattern: ".*", consumed: glob[i + 2] === "/" ? 2 : 1 };
+}
+function globToRegExp(glob) {
+  let out = "";
+  for (let i = 0; i < glob.length; i += 1) {
+    const piece = translateGlobChar(glob, i);
+    out += piece.pattern;
+    i += piece.consumed;
+  }
+  return new RegExp(`^${out}$`);
+}
+
 // src/project-env.ts
 var SOVEREIGN_ENV_KEYS = [
   /** Locates the SDK home — sessions, and the credential store beneath it. */
@@ -1792,7 +2016,7 @@ function isBuiltAgent(m) {
   return typeof m.send === "function";
 }
 async function materialize(def, index) {
-  const { Agent: Agent2 } = await import('./agent-G3T7Q3SQ.js');
+  const { Agent: Agent2 } = await import('./agent-EQ5HKTWV.js');
   return Agent2.create({
     // `AgentDefinition.model` admits the sentinel `'inherit'`, which is not a model id. Inheriting
     // here means "declare nothing and let the default apply" — forwarding the literal would create
@@ -2326,6 +2550,6 @@ function recordWiring(input) {
   return record;
 }
 
-export { AgentFactory, Budget, EventBus, JobQueue, LayerOrderError, LiveSessionError, Memory, NoopMemoryProvider, PermissionEngine, PermissionPlugin, Plugin, Provider, RetentionPolicyError, SOVEREIGN_ENV_KEYS, Security, Skill, SkillReadTool, Squad, Task, Theokit, TokenLimiter, UngatedCapabilityError, UnicodeNormalizer, applyMode, applySecurityFloor, auditEnvReachability, chargeAndCheckThresholds, createCounterBudgetTracker, decideApproval, describeAction, describeCredential, effectiveToolNames, evaluateBlastRadius, extractRawId, foldLayers, guardSessionDestruction, inferApiMode, loadProjectEnv, migrateSqliteToLance2 as migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, planReaping, preflightCheck, readSessionMessages2 as readSessionMessages, recordWiring, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, toShareGptTrajectory, verifyLayerOrdering, withBlastRadius };
+export { AgentFactory, Budget, EventBus, JobQueue, LayerOrderError, LiveSessionError, Memory, NoopMemoryProvider, PermissionEngine, PermissionPlugin, Plugin, Provider, RetentionPolicyError, SOVEREIGN_ENV_KEYS, Security, Skill, SkillReadTool, Squad, Task, Theokit, TokenLimiter, UngatedCapabilityError, UnicodeNormalizer, applyMode, applySecurityFloor, auditEnvReachability, chargeAndCheckThresholds, createCounterBudgetTracker, decideApproval, describeAction, describeCredential, effectiveToolNames, evaluateBlastRadius, extractRawId, foldLayers, guardSessionDestruction, inferApiMode, isInside, loadProjectEnv, migrateSqliteToLance2 as migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, parsePermissionRules, permissionFloorReason, planReaping, preflightCheck, readSessionMessages2 as readSessionMessages, recordWiring, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, toShareGptTrajectory, verifyLayerOrdering, withBlastRadius };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map