theokit 0.16.0 → 0.18.0

package/dist/{chunk-3HLO7KAK.js → chunk-DEO2VAJE.js}

@@ -6,9 +6,12 @@ import {
   broadcastToDevtools
 } from "./chunk-7BIM27LV.js";
 import {
+  buildResourceDescriptors,
+  extractAppResources,
   loadEnv,
+  readAppResource,
   resolveTransformer
-} from "./chunk-5UUOGAJH.js";
+} from "./chunk-XWS4RZCE.js";
 import {
   findSuggestion
 } from "./chunk-5QW7IQQU.js";
@@ -1039,29 +1042,30 @@ function createInProcessApprovalRegistry() {
   return {
     register(approvalId, opts) {
       return new Promise((resolve10) => {
-        const settle = (approved) => {
+        const settle = (decision) => {
           const entry = pending.get(approvalId);
           if (!entry) return;
           clearTimeout(entry.timer);
           pending.delete(approvalId);
-          resolve10(approved);
+          resolve10(decision);
         };
         const timer = setTimeout(() => {
-          settle(opts.onTimeout === "proceed");
+          settle({ approved: opts.onTimeout === "proceed" });
         }, opts.timeoutMs);
         const info = {
           approvalId,
           toolName: opts.toolName,
           question: opts.question,
-          expiresAt: Date.now() + opts.timeoutMs
+          expiresAt: Date.now() + opts.timeoutMs,
+          ...opts.payloadSchema !== void 0 ? { payloadSchema: opts.payloadSchema } : {}
         };
         pending.set(approvalId, { settle, timer, info });
       });
     },
-    resolve(approvalId, approved) {
+    resolve(approvalId, decision) {
       const entry = pending.get(approvalId);
       if (!entry) return false;
-      entry.settle(approved);
+      entry.settle(typeof decision === "boolean" ? { approved: decision } : decision);
       return true;
     },
     list() {
@@ -1087,10 +1091,22 @@ function jsonError(status, code, message) {
     headers: { "content-type": "application/json" }
   });
 }
+var MAX_PAYLOAD_BYTES = 16 * 1024;
 function parseApprovalBody(body) {
   if (typeof body !== "object" || body === null) return null;
   const b = body;
-  return typeof b.approved === "boolean" ? { approved: b.approved } : null;
+  if (typeof b.approved !== "boolean") return null;
+  const decision = { approved: b.approved };
+  if (b.reason !== void 0) {
+    if (typeof b.reason !== "string") return null;
+    decision.reason = b.reason;
+  }
+  if (b.payload !== void 0) {
+    if (typeof b.payload !== "object" || b.payload === null || Array.isArray(b.payload)) return null;
+    if (JSON.stringify(b.payload).length > MAX_PAYLOAD_BYTES) return null;
+    decision.payload = b.payload;
+  }
+  return decision;
 }
 async function handleAgentApproval(request, urlPath, registry2, csrfMode = "strict") {
   if (csrfMode !== "off") {
@@ -1112,7 +1128,7 @@ async function handleAgentApproval(request, urlPath, registry2, csrfMode = "stri
   if (parsed === null) {
     return jsonError(400, "BAD_REQUEST", "Request body must contain a boolean `approved`.");
   }
-  const resolved = registry2.resolve(approvalId, parsed.approved);
+  const resolved = registry2.resolve(approvalId, parsed);
   if (!resolved) {
     return jsonError(404, "NOT_PENDING", `No pending approval for id '${approvalId}'.`);
   }
@@ -1174,21 +1190,27 @@ function toEntry(name, mod) {
     subAgents: []
   };
 }
-function handleMcpJsonRpc(mod, name, body) {
+function handleMcpJsonRpc(mod, name, body, appResources = []) {
   if (!isJsonRpcRequest(body)) {
-    return jsonResponse({ jsonrpc: "2.0", id: null, error: { code: -32600, message: "Invalid Request" } });
+    return jsonResponse({
+      jsonrpc: "2.0",
+      id: null,
+      error: { code: -32600, message: "Invalid Request" }
+    });
   }
-  const { id, method } = body;
+  const { id, method, params } = body;
   try {
     const entry = toEntry(name, mod);
     if (method === "initialize") {
       const info = mcpServerInfo(entry);
+      const capabilities = { tools: {} };
+      if (appResources.length > 0) capabilities.resources = {};
       return jsonResponse({
         jsonrpc: "2.0",
         id,
         result: {
           protocolVersion: info.protocolVersion,
-          capabilities: { tools: {} },
+          capabilities,
           serverInfo: { name: info.name, version: info.version }
         }
       });
@@ -1196,7 +1218,37 @@ function handleMcpJsonRpc(mod, name, body) {
     if (method === "tools/list") {
       return jsonResponse({ jsonrpc: "2.0", id, result: { tools: buildMcpToolDescriptors(entry) } });
     }
-    return jsonResponse({ jsonrpc: "2.0", id, error: { code: -32601, message: `Method not found: ${method}` } });
+    if (method === "resources/list") {
+      return jsonResponse({
+        jsonrpc: "2.0",
+        id,
+        result: { resources: buildResourceDescriptors(appResources) }
+      });
+    }
+    if (method === "resources/read") {
+      const uri = params?.uri;
+      if (typeof uri !== "string") {
+        return jsonResponse({
+          jsonrpc: "2.0",
+          id,
+          error: { code: -32602, message: "resources/read requires a string `uri` param." }
+        });
+      }
+      const contents = readAppResource(appResources, uri);
+      if (contents === null) {
+        return jsonResponse({
+          jsonrpc: "2.0",
+          id,
+          error: { code: -32602, message: `Resource not found: ${uri}` }
+        });
+      }
+      return jsonResponse({ jsonrpc: "2.0", id, result: contents });
+    }
+    return jsonResponse({
+      jsonrpc: "2.0",
+      id,
+      error: { code: -32601, message: `Method not found: ${method}` }
+    });
   } catch (err) {
     return jsonResponse({
       jsonrpc: "2.0",
@@ -1270,7 +1322,9 @@ async function mountAgent(mod, request, apiKey, source = "agent module", csrfMod
       onTimeout: opts.onTimeout ?? "abort",
       // M14 — surface toolName + question in GET /approvals (the plugin forwards c.name).
       toolName,
-      question: opts.question
+      question: opts.question,
+      // M20 — carry the declared custom-payload schema into GET /approvals.
+      ...opts.payloadSchema !== void 0 ? { payloadSchema: opts.payloadSchema } : {}
     })
   } : void 0;
   return uiMessageStreamResponse(
@@ -1318,6 +1372,37 @@ function resolveProvider() {
   );
 }
 
+// src/server/agent/serve-aux-routes.ts
+async function serveAgentAuxRoute(request, urlPath, deps) {
+  const method = request.method.toUpperCase();
+  const cardName = isAgentCardPath(urlPath);
+  if (cardName !== null) {
+    if (method !== "GET") return null;
+    const agent = deps.agents.find((a) => a.name === cardName);
+    if (!agent) return null;
+    const mod = await deps.loadModule(agent.filePath);
+    return handleAgentCard(mod, agent.name, agent.agentPath, deps.baseUrl);
+  }
+  if (isListApprovalsPath(urlPath)) {
+    if (method !== "GET") return null;
+    return handleListApprovals(getApprovalRegistry());
+  }
+  const mcpName = isMcpPath(urlPath);
+  if (mcpName !== null) {
+    if (method !== "POST") return null;
+    const agent = deps.agents.find((a) => a.name === mcpName);
+    if (!agent) return null;
+    let body = null;
+    try {
+      body = await request.json();
+    } catch {
+    }
+    const mod = await deps.loadModule(agent.filePath);
+    return handleMcpJsonRpc(mod, agent.name, body, extractAppResources(mod));
+  }
+  return null;
+}
+
 // src/server/http/node-web-adapter.ts
 import { Readable } from "stream";
 function incomingMessageToWebRequest(req) {
@@ -1387,44 +1472,41 @@ var PREFIX2 = "/api/agents/";
 async function serveApprove(req, res, urlPath, csrfMode, log) {
   const method = (req.method ?? "POST").toUpperCase();
   if (method !== "POST") {
-    sendError(res, "METHOD_NOT_ALLOWED", "Approve endpoints accept POST", 405, void 0, log.requestId);
-    logRequest({ method, url: req.url ?? "", status: 405, duration: Date.now() - log.start, requestId: log.requestId });
+    sendError(
+      res,
+      "METHOD_NOT_ALLOWED",
+      "Approve endpoints accept POST",
+      405,
+      void 0,
+      log.requestId
+    );
+    logRequest({
+      method,
+      url: req.url ?? "",
+      status: 405,
+      duration: Date.now() - log.start,
+      requestId: log.requestId
+    });
     return;
   }
   try {
-    const response = await handleAgentApproval(incomingMessageToWebRequest(req), urlPath, getApprovalRegistry(), csrfMode);
+    const response = await handleAgentApproval(
+      incomingMessageToWebRequest(req),
+      urlPath,
+      getApprovalRegistry(),
+      csrfMode
+    );
     await writeWebResponseToServerResponse(response, res);
   } catch (err) {
-    sendError(res, "INTERNAL", err instanceof Error ? err.message : "Approve handler failed", 500, void 0, log.requestId);
-  }
-  logRequest({ method, url: req.url ?? "", status: res.statusCode, duration: Date.now() - log.start, requestId: log.requestId });
-}
-async function serveMcp(req, res, next, mcpAgentName, deps) {
-  const requestId = randomUUID2();
-  const start = Date.now();
-  res.setHeader("x-request-id", requestId);
-  const method = (req.method ?? "POST").toUpperCase();
-  const agent = scanAgents(deps.projectRoot).find((a) => a.name === mcpAgentName);
-  if (method !== "POST" || !agent) {
-    next();
-    return;
-  }
-  try {
-    const body = await incomingMessageToWebRequest(req).json();
-    const mod = await deps.loadModule(agent.filePath);
-    await writeWebResponseToServerResponse(handleMcpJsonRpc(mod, agent.name, body), res);
-  } catch (err) {
-    sendError(res, "INTERNAL", err instanceof Error ? err.message : "MCP handler failed", 500, void 0, requestId);
-  }
-  logRequest({ method, url: req.url ?? "", status: res.statusCode, duration: Date.now() - start, requestId });
-}
-async function serveListApprovals(req, res, next, log) {
-  const method = (req.method ?? "GET").toUpperCase();
-  if (method !== "GET") {
-    next();
-    return;
+    sendError(
+      res,
+      "INTERNAL",
+      err instanceof Error ? err.message : "Approve handler failed",
+      500,
+      void 0,
+      log.requestId
+    );
   }
-  await writeWebResponseToServerResponse(handleListApprovals(getApprovalRegistry()), res);
   logRequest({
     method,
     url: req.url ?? "",
@@ -1433,33 +1515,48 @@ async function serveListApprovals(req, res, next, log) {
     requestId: log.requestId
   });
 }
-async function serveAgentCard(req, res, next, cardAgentName, deps) {
+async function serveAux(req, res, next, urlPath, deps) {
   const requestId = randomUUID2();
   const start = Date.now();
-  res.setHeader("x-request-id", requestId);
-  const method = (req.method ?? "GET").toUpperCase();
-  const agent = scanAgents(deps.projectRoot).find((a) => a.name === cardAgentName);
-  if (method !== "GET" || !agent) {
-    next();
-    return;
-  }
   try {
-    const mod = await deps.loadModule(agent.filePath);
-    const baseUrl = `http://${req.headers.host ?? "localhost"}`;
-    await writeWebResponseToServerResponse(handleAgentCard(mod, agent.name, agent.agentPath, baseUrl), res);
+    const request = incomingMessageToWebRequest(req);
+    const response = await serveAgentAuxRoute(request, urlPath, {
+      agents: scanAgents(deps.projectRoot),
+      loadModule: deps.loadModule,
+      baseUrl: `http://${req.headers.host ?? "localhost"}`
+    });
+    if (response === null) {
+      next();
+      return;
+    }
+    res.setHeader("x-request-id", requestId);
+    await writeWebResponseToServerResponse(response, res);
   } catch (err) {
-    sendError(res, "INTERNAL", err instanceof Error ? err.message : "Agent card failed", 500, void 0, requestId);
+    res.setHeader("x-request-id", requestId);
+    sendError(
+      res,
+      "INTERNAL",
+      err instanceof Error ? err.message : "Agent aux handler failed",
+      500,
+      void 0,
+      requestId
+    );
   }
-  logRequest({ method, url: req.url ?? "", status: res.statusCode, duration: Date.now() - start, requestId });
+  logRequest({
+    method: (req.method ?? "GET").toUpperCase(),
+    url: req.url ?? "",
+    status: res.statusCode,
+    duration: Date.now() - start,
+    requestId
+  });
 }
 function createAgentMiddleware(vite, projectRoot, csrfMode = "strict") {
   const loadModule = createViteLoader(vite);
   return (req, res, next) => {
     void (async () => {
       const url = req.url ?? "";
-      const cardAgentName = isAgentCardPath(url.split("?")[0]);
-      if (cardAgentName) {
-        await serveAgentCard(req, res, next, cardAgentName, { projectRoot, loadModule });
+      if (isAgentCardPath(url.split("?")[0]) !== null) {
+        await serveAux(req, res, next, url.split("?")[0], { projectRoot, loadModule });
         return;
       }
       if (!url.startsWith(PREFIX2)) {
@@ -1474,13 +1571,8 @@ function createAgentMiddleware(vite, projectRoot, csrfMode = "strict") {
         await serveApprove(req, res, urlPath, csrfMode, { requestId, start });
         return;
       }
-      if (isListApprovalsPath(urlPath)) {
-        await serveListApprovals(req, res, next, { requestId, start });
-        return;
-      }
-      const mcpAgentName = isMcpPath(urlPath);
-      if (mcpAgentName) {
-        await serveMcp(req, res, next, mcpAgentName, { projectRoot, loadModule });
+      if (isListApprovalsPath(urlPath) !== null || isMcpPath(urlPath) !== null) {
+        await serveAux(req, res, next, urlPath, { projectRoot, loadModule });
         return;
       }
       const agent = scanAgents(projectRoot).find((a) => a.agentPath === urlPath);
@@ -3073,4 +3165,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-3HLO7KAK.js.map
+//# sourceMappingURL=chunk-DEO2VAJE.js.map