@standardagents/builder 0.22.0 → 0.22.1

package/dist/index.js

@@ -6066,9 +6066,10 @@ var init_context = __esm({
 // src/agents/FlowEngine.ts
 var FlowEngine_exports = {};
 __export(FlowEngine_exports, {
-  FlowEngine: () => FlowEngine
+  FlowEngine: () => FlowEngine,
+  HookBlockedExecutionError: () => HookBlockedExecutionError
 });
-var IMMEDIATE_BOOTSTRAP_TOOL_NAME, FlowEngine;
+var IMMEDIATE_BOOTSTRAP_TOOL_NAME, HookBlockedExecutionError, FlowEngine;
 var init_FlowEngine = __esm({
   "src/agents/FlowEngine.ts"() {
     init_types();
@@ -6079,6 +6080,12 @@ var init_FlowEngine = __esm({
     init_sessionTools();
     init_ThreadStateImpl();
     IMMEDIATE_BOOTSTRAP_TOOL_NAME = "bootstrap_immediate_subagent";
+    HookBlockedExecutionError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "HookBlockedExecutionError";
+      }
+    };
     FlowEngine = class _FlowEngine {
       static IMMEDIATE_SCOPED_ENV_CONTEXT_KEY = "__immediate_scoped_env_by_call_id";
       /**
@@ -6626,7 +6633,26 @@ This usually points to something I can't fix from here \u2014 for example the wo
         state.messageHistory = await this.loadMessageHistory(state);
         const context = await this.assembleContext(state);
         state.allowedTools = context.tools;
-        context.messages = await this.runPrefilterLLMHistoryHook(state, context.messages);
+        try {
+          context.messages = await this.runPrefilterLLMHistoryHook(state, context.messages);
+        } catch (error) {
+          if (error instanceof HookBlockedExecutionError) {
+            const threadState = ThreadStateImpl.fromFlowState(state);
+            await threadState.injectMessage({ role: "assistant", content: error.message });
+            state.stopped = true;
+            state.stoppedBy = state.currentSide;
+            state.stopReason = error.message;
+            state.stopReasonCode = "hook_blocked";
+            state.emitTelemetry?.({
+              type: "stopped",
+              reason: state.stopReason,
+              side: state.currentSide,
+              timestamp: Date.now()
+            });
+            return;
+          }
+          throw error;
+        }
         const pendingMessageId = await this.createPendingMessage(state);
         state.pendingMessageId = pendingMessageId;
         let responseStatus = "completed";
@@ -8782,6 +8808,9 @@ ${lines.join("\n\n")}`
           try {
             result = await executor(threadState, result);
           } catch (error) {
+            if (error && typeof error === "object" && error.block === true) {
+              throw new HookBlockedExecutionError(error instanceof Error ? error.message : String(error));
+            }
             console.error("[Hooks] \u2717 Error running prefilter_llm_history hook:", error);
           }
         }
@@ -20849,6 +20878,14 @@ function isPublicRoute(routePath, hosted) {
     return true;
   }
 
+  // Device-code CLI login: start/poll are public by design (possession of the
+  // one-time code is the secret) and the approve page must reach its controller
+  // even when anonymous so it can redirect the browser through the platform
+  // login (the controller enforces session auth itself).
+  if (routePath === '/api/auth/device/start' || routePath.startsWith('/api/auth/device/')) {
+    return true;
+  }
+
   // Provider icon routes are public (used by <img src>)
   if (routePath.startsWith('/api/providers/') && routePath.includes('/icon')) {
     return true;