@standardagents/builder 0.17.2 → 0.17.3

package/dist/plugin.js

@@ -7205,8 +7205,9 @@ import { isThreadEndpoint } from "@standardagents/spec";
 const PUBLIC_ROUTES = [
   '/api/auth/bootstrap',
   '/api/auth/login',
-  '/api/auth/bootstrap',
   '/api/auth/config',
+  '/api/auth/sa/start',     // Login with Standard Agents (OAuth) \u2014 unauthenticated entry
+  '/api/auth/sa/callback',  // OAuth callback (sets the session cookie)
   '/api/config',
   '/api/auth/oauth/github',
   '/api/auth/oauth/google',
@@ -7219,15 +7220,31 @@ const PUBLIC_ROUTES = [
   '/api/hooks'  // Hook metadata is safe to expose publicly
 ];
 
+// True when the platform deployed this instance (injects STANDARD_AGENTS_HOSTED).
+// Hosted instances are internet-reachable and multi-tenant, so the thread data
+// API and event/stream WebSockets must NOT be anonymously public the way they
+// are in single-user local dev \u2014 they require a session (admin) or API key (SDK).
+function isHostedInstance(env) {
+  const value = env && env.STANDARD_AGENTS_HOSTED;
+  if (typeof value === 'string') {
+    const trimmed = value.trim().toLowerCase();
+    return trimmed !== '' && trimmed !== '0' && trimmed !== 'false';
+  }
+  return Boolean(value);
+}
+
 // Check if a route is public (no auth required)
-function isPublicRoute(routePath) {
+function isPublicRoute(routePath, hosted) {
   // Exact match for auth routes
   if (PUBLIC_ROUTES.includes(routePath)) {
     return true;
   }
 
-  // Thread routes are always public
-  if (routePath.startsWith('/api/threads/') || routePath === '/api/threads') {
+  // Thread routes (REST + message/log stream WebSockets) are public in local
+  // single-user dev, but on a hosted deployment they require auth \u2014 requireAuth
+  // accepts the admin's session (cookie or token) or the SDK's API key, so this
+  // only blocks anonymous access to another tenant's threads/messages/files.
+  if (!hosted && (routePath.startsWith('/api/threads/') || routePath === '/api/threads')) {
     return true;
   }
 
@@ -7329,7 +7346,7 @@ ${packedThreadRouteCode}
 
   if (routeMatch) {
     // Check if authentication is required for this route
-    const publicRoute = isPublicRoute(routePath);
+    const publicRoute = isPublicRoute(routePath, isHostedInstance(env));
     const isApiRoute = routePath.startsWith('/api/');
 
     let authContext = null;