@standardagents/builder 0.27.5 → 0.27.7

package/dist/runtime.d.ts

@@ -1003,7 +1003,9 @@ declare class DurableThread<Env extends ThreadEnv = ThreadEnv> extends DurableOb
     private currentExecutionOwnerId;
     /** Persist + cache the execution-owner record (null releases ownership). */
     private setExecutionOwner;
-    /** Whether the given client id has a live bridge socket (excluding `except`). */
+    /** Whether the given client id has an open bridge socket (excluding `except`).
+     * Idle bridge heartbeats are handled by Cloudflare without waking this object,
+     * so timestamp liveness is intentionally enforced only for an in-flight call. */
     private hasLiveBridgeSocketForClient;
     /** Tell every other bridge socket that execution ownership moved. */
     private broadcastOwnerChanged;
@@ -1031,11 +1033,10 @@ declare class DurableThread<Env extends ThreadEnv = ThreadEnv> extends DurableOb
     private markBridgeDead;
     /**
      * Return the bridge socket a forwarded call should be dispatched to, pruning
-     * dead ones. A half-open client (idle NAT/proxy drop) keeps a
-     * `readyState === OPEN` socket that never fires close/error, so we also treat
-     * a socket we haven't heard from within {@link BRIDGE_LIVENESS_TIMEOUT_MS} as
-     * dead. The CLI heartbeats every few seconds, so this only trips on a truly
-     * gone client — and it means we won't dispatch a forwarded call into the void.
+     * closed ones. Idle clients use Cloudflare's hibernation auto-response, so
+     * their frames deliberately do not update `bridgeLastSeen`. Once a call is
+     * dispatched, the client switches to application-visible pings and the
+     * in-flight liveness timer above detects a half-open connection.
      *
      * With an execution owner recorded, only the owner's socket (or, as a
      * back-compat fallback, an unidentified legacy socket) is eligible; with no
@@ -3604,6 +3605,28 @@ declare class ProviderRegistryImpl {
     private providerOverrideFn;
     private providerOverrideRevision;
     setProviderOverride(fn: ProviderOverrideFn | null): void;
+    /**
+     * The env a provider resolves against for a given execution, scoped to the
+     * THREAD rather than just the instance: thread env overrides win, then the
+     * thread OWNER's user env, then instance/Worker env. This is what makes
+     * per-user BYOK providers work — a credential a user installs in their own
+     * account env (e.g. an OAuth token a companion service rotates) is honored
+     * for that user's threads no matter which authorized actor plays the turn.
+     *
+     * Best-effort by design: a missing user id (super-admin/local threads) or
+     * an older AgentBuilder DO without user-env storage simply contributes
+     * nothing, leaving instance-env behavior untouched.
+     */
+    buildThreadScopedEnv(state: {
+        env: Env;
+        thread: {
+            metadata?: {
+                user_id?: string | null;
+                env?: Record<string, unknown> | null;
+                tenvs?: Record<string, unknown> | null;
+            };
+        };
+    }): Promise<Env>;
     /**
      * Get provider for a model.
      *

package/dist/runtime.js

@@ -890,6 +890,42 @@ var init_ProviderRegistry = __esm({
         this.providerOverrideFn = fn;
         this.providerOverrideRevision += 1;
       }
+      /**
+       * The env a provider resolves against for a given execution, scoped to the
+       * THREAD rather than just the instance: thread env overrides win, then the
+       * thread OWNER's user env, then instance/Worker env. This is what makes
+       * per-user BYOK providers work — a credential a user installs in their own
+       * account env (e.g. an OAuth token a companion service rotates) is honored
+       * for that user's threads no matter which authorized actor plays the turn.
+       *
+       * Best-effort by design: a missing user id (super-admin/local threads) or
+       * an older AgentBuilder DO without user-env storage simply contributes
+       * nothing, leaving instance-env behavior untouched.
+       */
+      async buildThreadScopedEnv(state) {
+        const threadEnv = state.thread.metadata?.env ?? state.thread.metadata?.tenvs ?? null;
+        const userId = state.thread.metadata?.user_id ?? null;
+        let userEnv = null;
+        if (userId) {
+          try {
+            const agentBuilderId = state.env.AGENT_BUILDER.idFromName("singleton");
+            const agentBuilder = state.env.AGENT_BUILDER.get(agentBuilderId);
+            if (typeof agentBuilder.getUserEnvEntries === "function") {
+              const entries = await agentBuilder.getUserEnvEntries(userId);
+              if (Array.isArray(entries) && entries.length > 0) {
+                userEnv = {};
+                for (const entry of entries) {
+                  if (entry?.name) userEnv[entry.name] = entry.value;
+                }
+              }
+            }
+          } catch (error) {
+            console.warn("buildThreadScopedEnv: user env unavailable:", error instanceof Error ? error.message : String(error));
+          }
+        }
+        if (!userEnv && !threadEnv) return state.env;
+        return { ...state.env, ...userEnv ?? {}, ...threadEnv ?? {} };
+      }
       /**
        * Get provider for a model.
        *
@@ -1801,7 +1837,8 @@ var init_LLMRequest = __esm({
        */
       static async callModel(modelId, context, state, logId) {
         const { ProviderRegistry: ProviderRegistry2 } = await Promise.resolve().then(() => (init_providers(), providers_exports));
-        const { provider, modelName, modelDef, viaPlatform, platformProxyOrigin } = await ProviderRegistry2.getProvider(modelId, state.env, state.thread.instance);
+        const providerEnv = await ProviderRegistry2.buildThreadScopedEnv(state);
+        const { provider, modelName, modelDef, viaPlatform, platformProxyOrigin } = await ProviderRegistry2.getProvider(modelId, providerEnv, state.thread.instance);
         const streamAbort = new AbortController();
         const parentSignal = state.abortController?.signal;
         let onParentAbort;
@@ -16093,9 +16130,11 @@ var DurableThread = class _DurableThread extends DurableObject {
   codeExecutionBridges = /* @__PURE__ */ new Map();
   constructor(ctx, env) {
     super(ctx, env);
-    ctx.setWebSocketAutoResponse(
-      new WebSocketRequestResponsePair("stream_ping", "stream_pong")
-    );
+    if (typeof WebSocketRequestResponsePair !== "undefined") {
+      ctx.setWebSocketAutoResponse(
+        new WebSocketRequestResponsePair("stream_ping", "stream_pong")
+      );
+    }
     this.alarmQueue = new AlarmQueue(ctx);
     this.alarmQueue.setExecutor(
       async (method, args, itemId) => {
@@ -19460,14 +19499,13 @@ ${resultContent}${attachmentSummary}`;
   async setExecutionOwner(owner) {
     await this.setValue(EXECUTION_OWNER_KEY, owner);
   }
-  /** Whether the given client id has a live bridge socket (excluding `except`). */
+  /** Whether the given client id has an open bridge socket (excluding `except`).
+   * Idle bridge heartbeats are handled by Cloudflare without waking this object,
+   * so timestamp liveness is intentionally enforced only for an in-flight call. */
   hasLiveBridgeSocketForClient(clientId, except) {
-    const now = Date.now();
     for (const ws of this.bridgeSockets) {
       if (ws === except) continue;
       if (ws.readyState !== WebSocket.OPEN) continue;
-      const lastSeen = this.bridgeLastSeen.get(ws) ?? 0;
-      if (now - lastSeen > BRIDGE_LIVENESS_TIMEOUT_MS) continue;
       if ((this.bridgeClientInfo.get(ws)?.clientId ?? null) === clientId) return true;
     }
     return false;
@@ -19628,22 +19666,19 @@ ${resultContent}${attachmentSummary}`;
   }
   /**
    * Return the bridge socket a forwarded call should be dispatched to, pruning
-   * dead ones. A half-open client (idle NAT/proxy drop) keeps a
-   * `readyState === OPEN` socket that never fires close/error, so we also treat
-   * a socket we haven't heard from within {@link BRIDGE_LIVENESS_TIMEOUT_MS} as
-   * dead. The CLI heartbeats every few seconds, so this only trips on a truly
-   * gone client — and it means we won't dispatch a forwarded call into the void.
+   * closed ones. Idle clients use Cloudflare's hibernation auto-response, so
+   * their frames deliberately do not update `bridgeLastSeen`. Once a call is
+   * dispatched, the client switches to application-visible pings and the
+   * in-flight liveness timer above detects a half-open connection.
    *
    * With an execution owner recorded, only the owner's socket (or, as a
    * back-compat fallback, an unidentified legacy socket) is eligible; with no
    * owner, the first live socket wins as it always has.
    */
   getOpenBridgeSocket(ownerClientId) {
-    const now = Date.now();
     const live = [];
     for (const ws of Array.from(this.bridgeSockets)) {
-      const lastSeen = this.bridgeLastSeen.get(ws) ?? 0;
-      if (ws.readyState === WebSocket.OPEN && now - lastSeen <= BRIDGE_LIVENESS_TIMEOUT_MS) {
+      if (ws.readyState === WebSocket.OPEN) {
         live.push({ socket: ws, clientId: this.bridgeClientInfo.get(ws)?.clientId ?? null });
         continue;
       }
@@ -22317,9 +22352,11 @@ var DurableAgentBuilder = class extends DurableObject {
   eventSockets = /* @__PURE__ */ new Set();
   constructor(ctx, env) {
     super(ctx, env);
-    ctx.setWebSocketAutoResponse(
-      new WebSocketRequestResponsePair("stream_ping", "stream_pong")
-    );
+    if (typeof WebSocketRequestResponsePair !== "undefined") {
+      ctx.setWebSocketAutoResponse(
+        new WebSocketRequestResponsePair("stream_ping", "stream_pong")
+      );
+    }
     const sockets = ctx.getWebSockets();
     for (const ws of sockets) {
       const attachment = ws.deserializeAttachment();