@standardagents/builder 0.22.0 → 0.23.0

package/dist/plugin.js

@@ -7296,6 +7296,14 @@ function isPublicRoute(routePath, hosted) {
     return true;
   }
 
+  // Device-code CLI login: start/poll are public by design (possession of the
+  // one-time code is the secret) and the approve page must reach its controller
+  // even when anonymous so it can redirect the browser through the platform
+  // login (the controller enforces session auth itself).
+  if (routePath === '/api/auth/device/start' || routePath.startsWith('/api/auth/device/')) {
+    return true;
+  }
+
   // Provider icon routes are public (used by <img src>)
   if (routePath.startsWith('/api/providers/') && routePath.includes('/icon')) {
     return true;