@standardagents/builder 0.10.1-next.bbd142a → 0.11.0-next.ab7e1ea

package/LICENSE.txt

@@ -0,0 +1,48 @@
+PROPRIETARY SOFTWARE LICENSE
+
+Copyright (c) 2024-2025 FormKit Inc. All Rights Reserved.
+
+UNLICENSED - DO NOT USE
+
+This software and associated documentation files (the "Software") are the sole
+and exclusive property of FormKit Inc. ("FormKit").
+
+USE RESTRICTIONS
+
+The Software is UNLICENSED and proprietary. NO PERMISSION is granted to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, or to permit persons to whom the Software is furnished to do so,
+under any circumstances, without prior written authorization from FormKit Inc.
+
+UNAUTHORIZED USE PROHIBITED
+
+Any use of this Software without a valid, written license agreement signed by
+authorized officers of FormKit Inc. is strictly prohibited and constitutes
+unauthorized use and infringement of FormKit's intellectual property rights.
+
+LICENSING INQUIRIES
+
+Organizations interested in licensing this Software should contact:
+enterprise@formkit.com
+
+A written license agreement must be executed before any use of this Software
+is authorized.
+
+NO WARRANTY
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+FORMKIT INC. BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+GOVERNING LAW
+
+This license shall be governed by and construed in accordance with the laws
+of the jurisdiction in which FormKit Inc. is incorporated, without regard to
+its conflict of law provisions.
+
+FormKit Inc.
+https://formkit.com
+enterprise@formkit.com

package/dist/built-in-routes.js

@@ -777,6 +777,11 @@ var providers_get_default = defineController(async ({ env }) => {
 
 // src/api/threads/index.post.ts
 var index_post_default3 = defineController(async ({ req, env }) => {
+  const authResult = await requireAuth(req, env);
+  if (authResult instanceof Response) {
+    return authResult;
+  }
+  const auth = authResult;
   let body;
   try {
     body = await req.json();
@@ -786,7 +791,8 @@ var index_post_default3 = defineController(async ({ req, env }) => {
       { status: 400 }
     );
   }
-  const { agent_id, user_id, initial_messages, data, tags } = body;
+  const { agent_id, initial_messages, data, tags } = body;
+  const user_id = auth.authType === "super_admin" ? null : auth.user.id;
   if (!agent_id) {
     return Response.json(
       { error: "Missing required field: agent_id" },
@@ -828,7 +834,7 @@ var index_post_default3 = defineController(async ({ req, env }) => {
   try {
     const thread = await agentBuilder.createThread({
       agent_name: agent_id,
-      user_id,
+      user_id: user_id ?? void 0,
       tags
     });
     return Response.json({
@@ -848,16 +854,32 @@ var index_post_default3 = defineController(async ({ req, env }) => {
 });
 
 // src/api/threads/index.ts
+function resolveIconUrl(icon, origin) {
+  if (!icon) return void 0;
+  if (icon.startsWith("http://") || icon.startsWith("https://")) {
+    return icon;
+  }
+  if (icon.startsWith("/")) {
+    return `${origin}${icon}`;
+  }
+  return icon;
+}
 var threads_default = defineController(async ({ req, env }) => {
   if (req.method !== "GET") {
     return new Response("Method Not Allowed", { status: 405 });
   }
+  const authResult = await requireAuth(req, env);
+  if (authResult instanceof Response) {
+    return authResult;
+  }
+  const auth = authResult;
   try {
     const url = new URL(req.url);
+    const origin = url.origin;
     const limit = parseInt(url.searchParams.get("limit") || "50", 10);
     const offset = parseInt(url.searchParams.get("offset") || "0", 10);
     const agentName = url.searchParams.get("agent_id");
-    const userId = url.searchParams.get("user_id");
+    const userId = auth.user.role === "admin" ? void 0 : auth.user.id;
     const agentBuilderId = env.AGENT_BUILDER.idFromName("singleton");
     const agentBuilder = env.AGENT_BUILDER.get(agentBuilderId);
     const result = await agentBuilder.listThreads({
@@ -872,11 +894,14 @@ var threads_default = defineController(async ({ req, env }) => {
         try {
           const agentDef = await agentBuilder.loadAgent(thread.agent_name);
           agentDetails = {
-            title: agentDef.title,
-            type: agentDef.type || "ai_human"
+            name: thread.agent_name,
+            title: agentDef.title || thread.agent_name,
+            type: agentDef.type || "ai_human",
+            description: agentDef.description,
+            icon: resolveIconUrl(agentDef.icon, origin)
           };
         } catch {
-          agentDetails = { title: thread.agent_name, type: "unknown" };
+          agentDetails = { name: thread.agent_name, title: thread.agent_name, type: "unknown" };
         }
         return {
           id: thread.id,
@@ -1065,6 +1090,7 @@ var index_get_default2 = defineController(async ({ req, env }) => {
 });
 
 // src/api/users/index.post.ts
+var VALID_ROLES = ["admin", "user"];
 var index_post_default4 = defineController(async ({ req, env }) => {
   try {
     const authResult = await requireAdmin(req, env);
@@ -1072,7 +1098,7 @@ var index_post_default4 = defineController(async ({ req, env }) => {
       return authResult;
     }
     const body = await req.json();
-    const { username, password, role = "admin" } = body;
+    const { username, password, role = "user" } = body;
     if (!username || !password) {
       return Response.json(
         { error: "Username and password are required" },
@@ -1097,6 +1123,12 @@ var index_post_default4 = defineController(async ({ req, env }) => {
         { status: 400 }
       );
     }
+    if (!VALID_ROLES.includes(role)) {
+      return Response.json(
+        { error: `Invalid role. Must be one of: ${VALID_ROLES.join(", ")}` },
+        { status: 400 }
+      );
+    }
     const agentBuilderId = env.AGENT_BUILDER.idFromName("singleton");
     const agentBuilder = env.AGENT_BUILDER.get(agentBuilderId);
     const existingUser = await agentBuilder.getUserByUsername(username);
@@ -1317,8 +1349,24 @@ var name_get_default2 = defineController(async ({ params, prompts, models, model
   }
 });
 
+// src/utils/permissions.ts
+function canAccessThread(auth, thread) {
+  if (auth.user.role === "admin") {
+    return true;
+  }
+  if (thread.user_id === null) {
+    return false;
+  }
+  return thread.user_id === auth.user.id;
+}
+
 // src/api/threads/[id].delete.ts
 var id_delete_default2 = defineController(async ({ req, env, params }) => {
+  const authResult = await requireAuth(req, env);
+  if (authResult instanceof Response) {
+    return authResult;
+  }
+  const auth = authResult;
   const threadId = params.id;
   if (!threadId) {
     return Response.json({ error: "Missing thread ID" }, { status: 400 });
@@ -1332,6 +1380,12 @@ var id_delete_default2 = defineController(async ({ req, env, params }) => {
       { status: 404 }
     );
   }
+  if (!canAccessThread(auth, thread)) {
+    return Response.json(
+      { error: "Forbidden: You don't have access to this thread" },
+      { status: 403 }
+    );
+  }
   try {
     await agentBuilder.deleteThread(threadId);
     const durableId = env.AGENT_BUILDER_THREAD.idFromName(threadId);
@@ -1359,6 +1413,11 @@ var id_patch_default = defineController(async ({ req, env, params }) => {
   if (req.method !== "PATCH") {
     return new Response("Method Not Allowed", { status: 405 });
   }
+  const authResult = await requireAuth(req, env);
+  if (authResult instanceof Response) {
+    return authResult;
+  }
+  const auth = authResult;
   const threadId = params?.id;
   if (!threadId) {
     return Response.json({ error: "Thread ID required" }, { status: 400 });
@@ -1375,6 +1434,12 @@ var id_patch_default = defineController(async ({ req, env, params }) => {
         { status: 404 }
       );
     }
+    if (!canAccessThread(auth, existingThread)) {
+      return Response.json(
+        { error: "Forbidden: You don't have access to this thread" },
+        { status: 403 }
+      );
+    }
     const updates = {};
     if (tags !== void 0) {
       if (!Array.isArray(tags)) {
@@ -1447,12 +1512,42 @@ var id_patch_default = defineController(async ({ req, env, params }) => {
 });
 
 // src/api/threads/[id].ts
+function resolveIconUrl2(icon, origin) {
+  if (!icon) return void 0;
+  if (icon.startsWith("http://") || icon.startsWith("https://")) {
+    return icon;
+  }
+  if (icon.startsWith("/")) {
+    return `${origin}${icon}`;
+  }
+  return icon;
+}
 var id_default = defineController(async ({ req, params, env }) => {
+  const authResult = await requireAuth(req, env);
+  if (authResult instanceof Response) {
+    return authResult;
+  }
+  const auth = authResult;
   const threadId = params.id;
   if (!threadId) {
     return Response.json({ error: "Thread ID required" }, { status: 400 });
   }
   try {
+    const agentBuilderId = env.AGENT_BUILDER.idFromName("singleton");
+    const agentBuilder = env.AGENT_BUILDER.get(agentBuilderId);
+    const thread = await agentBuilder.getThread(threadId);
+    if (!thread) {
+      return Response.json(
+        { error: `Thread not found: ${threadId}` },
+        { status: 404 }
+      );
+    }
+    if (!canAccessThread(auth, thread)) {
+      return Response.json(
+        { error: "Forbidden: You don't have access to this thread" },
+        { status: 403 }
+      );
+    }
     const durableId = env.AGENT_BUILDER_THREAD.idFromName(threadId);
     const stub = env.AGENT_BUILDER_THREAD.get(durableId);
     const doData = await stub.getThreadMeta(threadId);
@@ -1462,6 +1557,10 @@ var id_default = defineController(async ({ req, params, env }) => {
         { status: 404 }
       );
     }
+    if (doData.agent?.icon) {
+      const origin = new URL(req.url).origin;
+      doData.agent.icon = resolveIconUrl2(doData.agent.icon, origin);
+    }
     return Response.json(doData);
   } catch (error) {
     console.error(`Error fetching thread ${threadId}:`, error);
@@ -1624,7 +1723,7 @@ var login_post_default = defineController(async ({ req, env }) => {
         { status: 400 }
       );
     }
-    if (env.SUPER_ADMIN_PASSWORD && password === env.SUPER_ADMIN_PASSWORD) {
+    if (env.SUPER_ADMIN_PASSWORD && username === "admin" && password === env.SUPER_ADMIN_PASSWORD) {
       if (!env.ENCRYPTION_KEY) {
         return Response.json(
           { error: "Server misconfigured: ENCRYPTION_KEY required for super admin" },
@@ -2077,7 +2176,7 @@ var logs_get_default = defineController(async ({ req, params, env }) => {
   }
 });
 
-// src/api/threads/[id]/message.post.ts
+// src/api/threads/[id]/messages.post.ts
 function needsProcessing(base64Data, mimeType) {
   const binarySize = Math.ceil(base64Data.length * 3 / 4);
   const MAX_SIZE = 2 * 1024 * 1024;
@@ -2089,7 +2188,7 @@ function needsProcessing(base64Data, mimeType) {
   }
   return false;
 }
-var message_post_default = defineController(async ({ req, params, env }) => {
+var messages_post_default = defineController(async ({ req, params, env }) => {
   const threadId = params.id;
   if (!threadId) {
     return Response.json({ error: "Thread ID required" }, { status: 400 });
@@ -2148,9 +2247,6 @@ var message_post_default = defineController(async ({ req, params, env }) => {
         }
         const ext = mimeType === "image/png" ? "png" : mimeType === "image/jpeg" ? "jpg" : attachment.name.split(".").pop() || "bin";
         const path = `/attachments/${timestamp}-${attachmentId}.${ext}`;
-        const metadata = {};
-        if (width) metadata.width = width;
-        if (height) metadata.height = height;
         const base64Size = fileData.length;
         const binarySize = Math.ceil(base64Size * 3 / 4);
         console.log(`[writeFile] Storing ${attachment.name}: ${(binarySize / 1024 / 1024).toFixed(2)}MB binary (${(base64Size / 1024 / 1024).toFixed(2)}MB base64) to ${path}`);
@@ -2159,8 +2255,9 @@ var message_post_default = defineController(async ({ req, params, env }) => {
           fileData,
           mimeType,
           {
-            metadata: Object.keys(metadata).length > 0 ? metadata : void 0,
-            thumbnail: attachment.thumbnail
+            thumbnail: attachment.thumbnail,
+            width,
+            height
           }
         );
         console.log(`[writeFile] Result:`, result.success ? "success" : result.error);
@@ -2323,6 +2420,22 @@ var stream_default = defineController(async ({ req, params, env }) => {
 });
 
 // src/api/threads/[id]/fs/[...path].ts
+function toAttachmentRef(file) {
+  const metadata = file.metadata;
+  const width = file.width ?? metadata?.width;
+  const height = file.height ?? metadata?.height;
+  return {
+    id: file.path,
+    // Use path as unique ID
+    type: "file",
+    path: file.path,
+    name: file.name,
+    mimeType: file.mimeType,
+    size: file.size,
+    ...width && { width },
+    ...height && { height }
+  };
+}
 var path_default = defineController(async ({ req, params, env }) => {
   console.log("[fs] params received:", JSON.stringify(params));
   const threadId = params.id;
@@ -2444,7 +2557,7 @@ async function handlePut(stub, path, req) {
       if (!result2.success) {
         return Response.json({ error: result2.error }, { status: 400 });
       }
-      return Response.json({ file: result2.file }, { status: 201 });
+      return Response.json(toAttachmentRef(result2.file), { status: 201 });
     }
     if (body.data) {
       const result2 = await stub.writeFile(path, body.data, body.mimeType || "application/octet-stream", {
@@ -2454,7 +2567,7 @@ async function handlePut(stub, path, req) {
       if (!result2.success) {
         return Response.json({ error: result2.error }, { status: 400 });
       }
-      return Response.json({ file: result2.file }, { status: 201 });
+      return Response.json(toAttachmentRef(result2.file), { status: 201 });
     }
     return Response.json({ error: "Invalid request body" }, { status: 400 });
   }
@@ -2470,7 +2583,7 @@ async function handlePut(stub, path, req) {
   if (!result.success) {
     return Response.json({ error: result.error }, { status: 400 });
   }
-  return Response.json({ file: result.file }, { status: 201 });
+  return Response.json(toAttachmentRef(result.file), { status: 201 });
 }
 async function handleDelete(stub, path) {
   const statResult = await stub.statFile(path);
@@ -2654,7 +2767,7 @@ var routeHandlers = {
   "GET:/threads/:id/cost": cost_get_default,
   "GET:/threads/:id/fs": fs_default,
   "GET:/threads/:id/logs": logs_get_default,
-  "POST:/threads/:id/message": message_post_default,
+  "POST:/threads/:id/messages": messages_post_default,
   "GET:/threads/:id/messages": messages_get_default,
   "POST:/threads/:id/rpc": rpc_post_default,
   "POST:/threads/:id/stop": stop_post_default,