create-theokit 1.23.8 → 1.23.11

package/templates/default/package.json.tmpl

@@ -7,6 +7,7 @@
     "dev": "theokit dev",
     "build": "theokit build",
     "start": "theokit start",
+    "preview": "theokit preview",
     "test": "vitest run",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
@@ -15,7 +16,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "theokit": "^0.48.3",
+    "theokit": "^0.52.0",
     "@theokit/agents": "^10.1.0",
     "@theokit/sdk": "^4.52.1",
     "@theokit/ui": "^1.1.0",
@@ -40,12 +41,5 @@
     "typescript": "^5.5.0",
     "typescript-eslint": "^8.0.0",
     "vitest": "^3.0.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild",
-      "better-sqlite3",
-      "workerd"
-    ]
   }
 }

package/templates/default/pnpm-workspace.yaml

@@ -0,0 +1,21 @@
+# Build scripts this project allows its dependencies to run.
+#
+# pnpm 10 refuses to run a dependency's install script unless it is approved here,
+# and it stopped reading the `pnpm` field in package.json — where this list used to
+# live, silently doing nothing while every install printed a warning about it
+# (usetheokit/theokit#397). Without these entries, `pnpm install` ends in
+# ERR_PNPM_IGNORED_BUILDS with esbuild and node-pty unbuilt.
+#
+# Each entry is a decision, not boilerplate: an install script runs arbitrary code
+# on your machine. These are the ones this scaffold needs.
+allowBuilds:
+  # The bundler behind `theokit dev` and `theokit build`; ships a platform binary.
+  esbuild: true
+  # A native terminal, reached through @theokit/agents. Compiles or downloads a
+  # prebuild on install. A web-only app never opens one — see usetheokit/theokit#25
+  # if you would rather not pay for it.
+  node-pty: true
+  # Present only if you add them; harmless entries otherwise, and here so the
+  # decision is already made the day you do.
+  better-sqlite3: true
+  workerd: true

package/templates/default/server/routes/health.ts

@@ -1,6 +1,9 @@
 import { route } from 'theokit/server/define'
 
 export const GET = route()
+  // A liveness probe answers the same thing to everyone, so it is genuinely open.
+  // Every route declares this; `'public'` is the decision, not the absence of one.
+  .policy('public')
   .handler(() => ({
     status: 'ok',
     timestamp: Date.now(),

package/templates/surfaces/desktop/sidecar/sidecar.ts

@@ -41,10 +41,14 @@ const write = (line: string): void => {
   process.stdout.write(line)
 }
 
-await runTurnToJsonl(chatAgent, apiKey, message, write, ({ approvalId, toolName }) => {
+await runTurnToJsonl(chatAgent, apiKey, message, write, ({ approvalId }) => {
+  // Register the resolver and write NOTHING. The approval frame is already on the wire:
+  // `runTurnToJsonl` writes every chunk the in-process turn produces, and a gated tool produces a
+  // `tool-approval-request` carrying the `toolCallId` readers key a tool part by. A second,
+  // hand-written line here was a duplicate the framework's own wire schema refuses
+  // (usetheokit/theokit#403).
   return new Promise<boolean>((resolve) => {
     pending.set(approvalId, resolve)
-    write(`${JSON.stringify({ type: 'tool-approval-request', approvalId, toolName })}\n`)
   })
 })