theokit 0.48.14 → 0.50.1

package/dist/{start-25OV2CAK.js → start-3K3C4Z2X.js}

@@ -2,101 +2,102 @@
 import "tsx/esm";
 import {
   CONTROLLER_MANIFEST_FILE
-} from "./chunk-47CINLWF.js";
+} from "./chunk-EDWEYQRG.js";
 import {
   parseCookieHeader
 } from "./chunk-V7MTRM6Q.js";
+import {
+  initCacheEngineFromConfig
+} from "./chunk-Q5L5EGWZ.js";
 import {
   preflightNodeAndBindings
 } from "./chunk-KTMQUYED.js";
 import {
   applyNonceToInlineScripts,
+  createAgentSubjectResolver,
   extractHeadTags,
   handleAgentApproval,
   injectIntoHead,
   isApprovalPath,
+  matchAgentAuxRoute,
+  parseApprovalAgentName,
+  resolvePluginSpecifiers,
   resolveTransformer,
-  serveAgentAuxRoute,
-  writeWebResponseToServerResponse
-} from "./chunk-NTWNO24W.js";
+  serveMatchedAuxRoute,
+  serveThroughPluginLifecycle
+} from "./chunk-PLUHPNGA.js";
 import "./chunk-2CVV6CNN.js";
 import {
   findRootDiv
 } from "./chunk-3PWQQWT6.js";
-import {
-  loadConfig
-} from "./chunk-AATSV4UV.js";
-import {
-  loadEnv
-} from "./chunk-HBU2GIMZ.js";
-import "./chunk-CMYSHZFT.js";
-import "./chunk-WSXNGF7X.js";
 import {
   InMemoryStore,
-  buildSecurityHeaders,
+  createCorsHandler,
   createPluginRunnerFromConfig,
   createProductionLoader,
   executeAction,
   executeRoute,
   findSuggestion,
-  generateNonce,
-  mountAgent
-} from "./chunk-WYHYOYRH.js";
+  mountAgent,
+  readAgentPolicy,
+  writeWebResponseToServerResponse
+} from "./chunk-2COPDKIG.js";
 import {
   getApprovalRegistry,
   resolveProvider
-} from "./chunk-DQIPV7L5.js";
+} from "./chunk-5YPXXSYY.js";
 import {
+  createWebRequestSource,
   dispatchControllerRequest,
-  incomingMessageToWebRequest,
+  sendError
+} from "./chunk-FMTRNQQ7.js";
+import {
+  buildSecurityHeaders,
+  generateNonce
+} from "./chunk-RPET332G.js";
+import {
+  TRACE_HEADER,
+  createObservabilityPluginFromConfig,
+  extractTraceId,
+  generateNewTraceContext
+} from "./chunk-H53KNS6Q.js";
+import {
   logRequest,
-  sendError,
   warnOnce
-} from "./chunk-T5C46IIU.js";
+} from "./chunk-RARK7JBR.js";
+import "./chunk-7UZZHCRN.js";
 import {
   loadManifest
-} from "./chunk-ZB7D62OA.js";
+} from "./chunk-KUZVRJ7M.js";
 import {
   scanAgents
-} from "./chunk-LNVMHQ2Z.js";
+} from "./chunk-EVZKNA2W.js";
 import {
   matchRoute,
   scanServerActions,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-BMHS4WAN.js";
-import "./chunk-A7JBF5FO.js";
+} from "./chunk-XS7EX55U.js";
+import "./chunk-FD4ZDTQ6.js";
+import {
+  loadConfig
+} from "./chunk-QTHVHNJJ.js";
+import {
+  loadEnv
+} from "./chunk-3QPVEJ7D.js";
+import "./chunk-U5PWXS3J.js";
+import "./chunk-FH3SQR6P.js";
+import "./chunk-ZNZISJDZ.js";
+import "./chunk-VI7ZANB3.js";
 import "./chunk-VQIUTCK2.js";
 
 // src/cli/commands/start/index.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
 import { createServer } from "http";
 import { join as join2, resolve as resolve4 } from "path";
 
 // src/server/cron/cron-runtime-node.ts
 import { CronExpressionParser } from "cron-parser";
-
-// src/server/observability/trace-context-propagation.ts
-function generateNewTraceContext() {
-  return {
-    trace_id: randomHex(16),
-    // 16 bytes = 32 hex chars
-    span_id: randomHex(8),
-    //  8 bytes = 16 hex chars
-    flags: "01"
-  };
-}
-function randomHex(bytes) {
-  for (; ; ) {
-    const buf = new Uint8Array(bytes);
-    globalThis.crypto.getRandomValues(buf);
-    let hex = "";
-    for (const b of buf) hex += b.toString(16).padStart(2, "0");
-    if (!/^0+$/.test(hex)) return hex;
-  }
-}
-
-// src/server/cron/cron-runtime-node.ts
 function createCronScheduler(definitions) {
   const states = definitions.map((def) => ({
     def,
@@ -423,7 +424,7 @@ async function configureStorageManagerFromConfig(storageConfig) {
   if (storageConfig === void 0 || storageConfig === null) return;
   try {
     const { getStorageManager } = await import("./storage-manager-3O5PDO6O.js");
-    const { storageSchema } = await import("./schema-DNIT7JQX.js");
+    const { storageSchema } = await import("./schema-SOAD43RQ.js");
     const parsed = storageSchema.parse(storageConfig);
     getStorageManager().configure(parsed);
   } catch (err) {
@@ -501,6 +502,16 @@ function installGracefulShutdown(server) {
           message: msg
         });
       }
+      try {
+        const { getObservabilityAdapter } = await import("./observability-bootstrap-LERYDHKY.js");
+        await getObservabilityAdapter()?.shutdown();
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        warnOnce("shutdown.observability_error", {
+          event: "shutdown.observability_error",
+          message: msg
+        });
+      }
       console.log(`  [theokit] shutdown complete`);
       server.close(() => {
         process.exit(0);
@@ -551,16 +562,13 @@ function loadRoutesAndActions(distDir, serverDir, agentsDir = "agents") {
   };
 }
 
-// src/cli/commands/start/request-handler.ts
-import { randomUUID } from "crypto";
-
 // src/cli/commands/start/handlers.ts
 import { extname as extname2 } from "path";
 import { pathToFileURL } from "url";
 
 // src/server/http/static.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, statSync } from "fs";
-import { resolve as resolve3, extname } from "path";
+import { closeSync, fstatSync, openSync, readFileSync as readFileSync3, realpathSync } from "fs";
+import { resolve as resolve3, extname, sep } from "path";
 var MIME_TYPES = {
   ".html": "text/html",
   ".js": "application/javascript",
@@ -582,23 +590,40 @@ var MIME_TYPES = {
 function serveStaticFile(req, res, clientDir) {
   const urlPath = (req.url ?? "/").split("?")[0];
   const filePath = resolve3(clientDir, "." + urlPath);
-  if (!filePath.startsWith(clientDir)) {
+  if (filePath !== clientDir && !filePath.startsWith(clientDir + sep)) {
     res.writeHead(403);
     res.end("Forbidden");
     return true;
   }
-  if (!existsSync4(filePath)) return false;
-  const stat = statSync(filePath);
-  if (!stat.isFile()) return false;
-  const ext = extname(filePath);
-  const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
-  const content = readFileSync3(filePath);
-  res.writeHead(200, {
-    "Content-Type": contentType,
-    "Content-Length": content.length
-  });
-  res.end(content);
-  return true;
+  let realPath;
+  let realRoot;
+  try {
+    realPath = realpathSync(filePath);
+    realRoot = realpathSync(clientDir);
+  } catch {
+    return false;
+  }
+  if (realPath !== realRoot && !realPath.startsWith(realRoot + sep)) return false;
+  let fd;
+  try {
+    fd = openSync(realPath, "r");
+  } catch {
+    return false;
+  }
+  try {
+    if (!fstatSync(fd).isFile()) return false;
+    const ext = extname(filePath);
+    const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
+    const content = readFileSync3(fd);
+    res.writeHead(200, {
+      "Content-Type": contentType,
+      "Content-Length": content.length
+    });
+    res.end(content);
+    return true;
+  } finally {
+    closeSync(fd);
+  }
 }
 
 // src/cli/commands/start/handlers.ts
@@ -606,6 +631,15 @@ async function loadCompiledController(absPath) {
   return await import(pathToFileURL(absPath).href);
 }
 var X_REQUEST_ID = "x-request-id";
+function agentSubjectResolver(c) {
+  return createAgentSubjectResolver({
+    req: c.req,
+    res: c.res,
+    loadModule: c.loadModule,
+    serverDir: c.serverDir,
+    pluginRunner: c.pluginRunner
+  });
+}
 async function applyRateLimit(c, method) {
   if (!c.rateLimiter) return false;
   const check = await c.rateLimiter(c.req);
@@ -687,23 +721,41 @@ async function tryServeAction(c) {
 }
 async function tryServeAgentAux(c) {
   const urlPath = c.url.split("?")[0];
-  const baseUrl = `http://${c.req.headers.host ?? "localhost"}`;
-  const request = incomingMessageToWebRequest(c.req);
-  const response = await serveAgentAuxRoute(request, urlPath, {
+  const deps = {
     agents: c.cachedAgents,
     loadModule: c.loadModule,
-    baseUrl,
+    baseUrl: `http://${c.req.headers.host ?? "localhost"}`,
     // M34 (#97) — the MCP aux route drives the agent (spends tokens); enforce CSRF like the run route.
     csrfMode: c.csrfMode,
     // M39 — the thread follow-up route drives the agent; resolve the key on demand.
     // theokit#328 — the thread route drives an agent, so its key follows the model too.
-    resolveApiKey: (model) => resolveProvider(model).apiKey
-  });
-  if (response === null) return false;
+    resolveApiKey: (model) => resolveProvider(model).apiKey,
+    // usetheokit/theokit#365 — who is asking. Memoized and LAZY: built here, invoked only inside
+    // `serveMatchedAuxRoute` and only when the matched agent declares a policy, so the application's
+    // `createContext` never runs for a url this branch declines.
+    resolveSubject: agentSubjectResolver(c)
+  };
+  const method = (c.req.method ?? "GET").toUpperCase();
+  const route = await matchAgentAuxRoute(method, urlPath, deps);
+  if (route === null) return false;
   c.res.setHeader(X_REQUEST_ID, c.requestId);
-  await writeWebResponseToServerResponse(response, c.res);
+  await serveThroughPluginLifecycle(
+    {
+      source: createWebRequestSource(c.req),
+      res: c.res,
+      requestId: c.requestId,
+      pluginRunner: c.pluginRunner,
+      failureMessage: "Agent aux handler failed"
+    },
+    async (request) => {
+      await writeWebResponseToServerResponse(
+        await serveMatchedAuxRoute(route, request, deps),
+        c.res
+      );
+    }
+  );
   logRequest({
-    method: (c.req.method ?? "GET").toUpperCase(),
+    method,
     url: c.url,
     status: c.res.statusCode,
     duration: Date.now() - c.startTime,
@@ -736,25 +788,27 @@ async function tryServeAgent(c) {
       });
       return true;
     }
-    try {
-      const request = incomingMessageToWebRequest(c.req);
-      const response = await handleAgentApproval(
-        request,
-        urlPath,
-        getApprovalRegistry(),
-        c.csrfMode
-      );
-      await writeWebResponseToServerResponse(response, c.res);
-    } catch (err) {
-      sendError(
-        c.res,
-        "INTERNAL",
-        err instanceof Error ? err.message : "Approve handler failed",
-        500,
-        void 0,
-        c.requestId
-      );
-    }
+    await serveThroughPluginLifecycle(
+      {
+        source: createWebRequestSource(c.req),
+        res: c.res,
+        requestId: c.requestId,
+        pluginRunner: c.pluginRunner,
+        failureMessage: "Approve handler failed"
+      },
+      async (request) => {
+        const approveAgent = c.cachedAgents.find((a) => a.name === parseApprovalAgentName(urlPath));
+        const policy = approveAgent === void 0 ? void 0 : readAgentPolicy(await c.loadModule(approveAgent.filePath), approveAgent.filePath);
+        const response = await handleAgentApproval(
+          request,
+          urlPath,
+          getApprovalRegistry(),
+          c.csrfMode,
+          { policy, resolveSubject: agentSubjectResolver(c) }
+        );
+        await writeWebResponseToServerResponse(response, c.res);
+      }
+    );
     logRequest({
       method: method2,
       url: c.url,
@@ -791,64 +845,31 @@ async function tryServeAgent(c) {
   return true;
 }
 async function serveAgentTurn(c, agent, method) {
-  let pluginCtx;
-  let request;
-  try {
-    request = incomingMessageToWebRequest(c.req);
-    pluginCtx = { request, response: c.res, ctx: {}, requestId: c.requestId };
-  } catch (err) {
-    sendError(
-      c.res,
-      "INTERNAL",
-      err instanceof Error ? err.message : "Agent handler failed",
-      500,
-      void 0,
-      c.requestId
-    );
-    logRequest({
-      method,
-      url: c.url,
-      status: c.res.statusCode,
-      duration: Date.now() - c.startTime,
-      requestId: c.requestId
-    });
-    return;
-  }
-  if (c.pluginRunner) {
-    c.pluginRunner.applyDecorations(pluginCtx.ctx);
-    const onRequest = await c.pluginRunner.runOnRequest(pluginCtx);
-    if (onRequest.shortCircuited) {
-      logRequest({
-        method,
-        url: c.url,
-        status: c.res.statusCode,
-        duration: Date.now() - c.startTime,
-        requestId: c.requestId
+  const resolveSubject = agentSubjectResolver(c);
+  await serveThroughPluginLifecycle(
+    {
+      source: createWebRequestSource(c.req),
+      res: c.res,
+      requestId: c.requestId,
+      pluginRunner: c.pluginRunner,
+      failureMessage: "Agent handler failed"
+    },
+    async (request) => {
+      const mod = await c.loadModule(agent.filePath);
+      const apiKey = (model) => resolveProvider(model).apiKey;
+      const response = await mountAgent(mod, request, apiKey, {
+        source: agent.filePath,
+        csrfMode: c.csrfMode,
+        projectRoot: c.projectRoot,
+        // usetheokit/theokit#365 — the policy is read off `mod` inside `mountAgent`; what this
+        // caller owes is the identity to judge it against. usetheokit/theokit#406 — and it is the
+        // same value the run's spans are labelled with, so `source` above never reaches telemetry.
+        agentName: agent.name,
+        resolveSubject
       });
-      return;
+      await writeWebResponseToServerResponse(response, c.res);
     }
-  }
-  try {
-    const mod = await c.loadModule(agent.filePath);
-    const apiKey = (model) => resolveProvider(model).apiKey;
-    const response = await mountAgent(mod, request, apiKey, {
-      source: agent.filePath,
-      csrfMode: c.csrfMode,
-      projectRoot: c.projectRoot
-    });
-    await writeWebResponseToServerResponse(response, c.res);
-  } catch (err) {
-    if (c.pluginRunner) await c.pluginRunner.runOnError(pluginCtx, err);
-    sendError(
-      c.res,
-      "INTERNAL",
-      err instanceof Error ? err.message : "Agent handler failed",
-      500,
-      void 0,
-      c.requestId
-    );
-  }
-  if (c.pluginRunner) await c.pluginRunner.runOnResponse(pluginCtx);
+  );
   logRequest({
     method,
     url: c.url,
@@ -1021,7 +1042,16 @@ async function handleSsrStreaming(ctx, req, res, url, nonce) {
   try {
     const result = await ctx.ssrRenderStreaming(url, res, {
       signal: controller.signal,
-      nonce
+      nonce,
+      // #343 — the streamed response carried neither of these, so `ssrStreaming: true`
+      // served a bare React tree: no `<head>`, no client entry, no hydration data.
+      //
+      // `applyNonceToInlineScripts` and not `withHoistedHead`: hoisting reads the
+      // RENDERED body for head elements, and nothing is rendered yet when the head
+      // has to flush. Metadata hoisting under streaming is the same defect on a
+      // different surface, and it is M9's, not this one's.
+      htmlHead: applyNonceToInlineScripts(ctx.htmlHead, nonce),
+      htmlTail: ctx.htmlTail
     });
     if (isRedirectResult(result)) sendRedirect(res, result);
     return true;
@@ -1063,8 +1093,12 @@ function createRequestHandler(ctx) {
   return (req, res) => {
     void (async () => {
       const url = req.url ?? "/";
-      const requestId = randomUUID();
+      const requestId = extractTraceId(req);
       const start = Date.now();
+      res.setHeader("x-request-id", requestId);
+      res.setHeader(TRACE_HEADER, requestId);
+      if (ctx.corsHandler?.handlePreflight(req, res) === true) return;
+      ctx.corsHandler?.applyHeaders(req, res);
       const nonce = generateNonce();
       const securityHeaders = buildSecurityHeaders(
         ctx.securityHeadersConfig,
@@ -1094,6 +1128,24 @@ function createRequestHandler(ctx) {
   };
 }
 
+// src/cli/commands/start/resolve-listen-host.ts
+function resolveListenTarget(host, env = process.env.HOST) {
+  if (host === true) return { host: "0.0.0.0", source: "config" };
+  if (typeof host === "string" && host !== "") return { host, source: "config" };
+  if (host !== false && env !== void 0 && env !== "") return { host: env, source: "env" };
+  return { host: "localhost", source: "default" };
+}
+function describeListenTarget(target, port) {
+  const url = target.host === "0.0.0.0" || target.host === "::" ? "localhost" : target.host;
+  const bound = target.host === "0.0.0.0" || target.host === "::" ? `bound to ${target.host} (every interface)` : `bound to ${target.host} only`;
+  return `  \u2192 http://${url}:${String(port)}  [${bound}${provenance(target.source)}]`;
+}
+function provenance(source) {
+  if (source === "env") return " from HOST";
+  if (source === "config") return "";
+  return " \u2014 set `host: true` in theo.config.ts or HOST=0.0.0.0 to reach it from outside this machine";
+}
+
 // src/cli/commands/start/websocket-handler.ts
 async function attachWebSocketHandler(server, wsRoutes, loadModule) {
   if (wsRoutes.length === 0) return;
@@ -1149,22 +1201,28 @@ async function startCommand(options) {
   assertSdkCompatible();
   await configureAgentRegistryFromConfig(config.agents?.registry);
   await configureStorageManagerFromConfig(config.storage);
+  await initCacheEngineFromConfig(config.cache);
   const distDir = resolve4(cwd, ".theokit");
   const clientDir = resolve4(distDir, "client");
-  const controllersDistDir = existsSync5(resolve4(distDir, CONTROLLER_MANIFEST_FILE)) ? resolve4(distDir, "controllers") : void 0;
+  const controllersDistDir = existsSync4(resolve4(distDir, CONTROLLER_MANIFEST_FILE)) ? resolve4(distDir, "controllers") : void 0;
   const serverDir = resolve4(cwd, config.serverDir);
-  if (!existsSync5(clientDir)) {
+  if (!existsSync4(clientDir)) {
     throw new Error("No build found. Run `theo build` first.");
   }
   const indexHtml = readFileSync4(join2(clientDir, "index.html"), "utf-8");
   const loadModule = createProductionLoader();
-  const port = options.port ?? config.port;
-  const pluginRunner = await createPluginRunnerFromConfig(config.plugins);
+  const envPort = Number.parseInt(process.env.PORT ?? "", 10);
+  const port = options.port ?? (Number.isInteger(envPort) ? envPort : void 0) ?? config.port;
+  const observabilityPlugin = createObservabilityPluginFromConfig(config.observability, process.env);
+  const declaredPlugins = await resolvePluginSpecifiers(config.plugins ?? [], cwd);
+  const pluginRunner = await createPluginRunnerFromConfig(
+    observabilityPlugin === void 0 ? declaredPlugins : [observabilityPlugin, ...declaredPlugins]
+  );
   const transformer = resolveTransformer(config.serialization);
   const custom404Path = join2(clientDir, "404.html");
   const custom500Path = join2(clientDir, "500.html");
-  const custom404Html = existsSync5(custom404Path) ? readFileSync4(custom404Path, "utf-8") : null;
-  const custom500Html = existsSync5(custom500Path) ? readFileSync4(custom500Path, "utf-8") : null;
+  const custom404Html = existsSync4(custom404Path) ? readFileSync4(custom404Path, "utf-8") : null;
+  const custom500Html = existsSync4(custom500Path) ? readFileSync4(custom500Path, "utf-8") : null;
   const {
     routes: cachedRoutes,
     actions: cachedActions,
@@ -1202,6 +1260,10 @@ async function startCommand(options) {
         rateLimiter
       }),
       securityHeadersConfig: config.security?.headers ?? {},
+      // #409 — built once at startup, like the security headers beside it. Declaring `cors` and
+      // being served by this command used to mean no CORS at all, which reads in a browser as a
+      // blocked fetch and in the config as a setting that is present and validated.
+      corsHandler: config.security?.cors ? createCorsHandler(config.security.cors) : null,
       ssrRender: ssr.render,
       ssrRenderStreaming: ssr.renderStreaming,
       ssrStreamingEnabled: ssr.streamingEnabled,
@@ -1220,10 +1282,11 @@ async function startCommand(options) {
   if (cronDefinitions.length > 0) {
     createCronScheduler(cronDefinitions).start();
   }
-  server.listen(port, () => {
+  const listenTarget = resolveListenTarget(config.host);
+  server.listen(port, listenTarget.host, () => {
     console.log(`
   Theo production server`);
-    console.log(`  \u2192 http://localhost:${String(port)}
+    console.log(`${describeListenTarget(listenTarget, port)}
 `);
     if (cronDefinitions.length > 0) {
       console.log(`  Crons: ${String(cronDefinitions.length)} scheduled in-process
@@ -1236,4 +1299,4 @@ export {
   resolveSsrEntry,
   startCommand
 };
-//# sourceMappingURL=start-25OV2CAK.js.map
+//# sourceMappingURL=start-3K3C4Z2X.js.map