@standardagents/builder 0.37.0 → 0.37.2

package/dist/runtime.d.ts

@@ -1,5 +1,5 @@
-import { e as ThreadEnv, A as Agent, r as ThreadMetadata, t as ToolResult, M as Message, k as ClientToolRequest, l as ClientToolResponse, m as ClientStreamRequest, n as ClientStreamResponse, w as FileRecord, F as FlowState, y as FileStats, G as GrepResult, x as AttachmentRef, J as MessageContent, E as Env, q as ThreadInstance } from './index-yV9JL4r3.js';
-export { f as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, o as ClientDuplex, p as ClientForwarding, B as Controller, a as ControllerContext, u as FlowResult, D as ImageContentPart, I as ImageMetadata, L as LLMResponse, H as MultimodalContent, R as RequestContext, S as StorageBackend, v as TelemetryEvent, z as TextContentPart, b as ThreadEndpointContext, T as ToolCall, g as callClient, h as callClientStream, c as createThreadEndpointHandler, j as decodeStreamChunk, d as defineController, i as encodeStreamChunk, s as supportsClientForwarding } from './index-yV9JL4r3.js';
+import { i as AuthContext, e as ThreadEnv, v as Agent, x as ThreadMetadata, y as ToolResult, M as Message, n as ClientToolRequest, o as ClientToolResponse, p as ClientStreamRequest, q as ClientStreamResponse, G as FileRecord, F as FlowState, K as FileStats, J as GrepResult, H as AttachmentRef, Q as MessageContent, E as Env, w as ThreadInstance } from './index-DceFbLG9.js';
+export { A as AuthUser, f as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, t as ClientDuplex, u as ClientForwarding, B as Controller, a as ControllerContext, z as FlowResult, O as ImageContentPart, I as ImageMetadata, L as LLMResponse, P as MultimodalContent, R as RequestContext, S as StorageBackend, D as TelemetryEvent, N as TextContentPart, b as ThreadEndpointContext, T as ToolCall, g as authenticate, j as callClient, k as callClientStream, c as createThreadEndpointHandler, m as decodeStreamChunk, d as defineController, l as encodeStreamChunk, h as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-DceFbLG9.js';
 import { CodeExecutionOptions, CodeExecutionResult, SubagentRegistryEntry, InjectMessageInput, QueueMessageInput, CredentialGrant, SkillMetadata, SkillFileInput, ModelDefinition as ModelDefinition$1, ToolArgs, PromptTextPart, PromptEnvPart, VariableDefinition, SubpromptConfig as SubpromptConfig$1, PromptToolConfig as PromptToolConfig$1, SubagentToolConfig as SubagentToolConfig$1, ReasoningConfig, SideConfig as SideConfig$1, LLMProviderInterface, ContentPart, TextPart, ImagePart, FilePart, ThreadState, NamespaceContext, DefinitionLoader } from '@standardagents/spec';
 export { AgentType, DefinitionLoader, GlobalNamespaceContext, HookSignatures, ImageContent, ModelCapabilities, ModelProvider, NamespaceContext, PackageSignature, PackedExports, PackedMeta, PackedMetadata, PackedNamespaceContext, PromptInput, PromptTextPart, ProviderAssistantMessage, ProviderError, ProviderErrorCode, ProviderFactory, ProviderFactoryConfig, ProviderFinishReason, ProviderGeneratedImage, ProviderMessage, ProviderMessageContent, ModelCapabilities as ProviderModelCapabilities, ProviderReasoningDetail, ProviderRequest, ProviderResponse, ProviderStreamChunk, ProviderSystemMessage, ProviderTool, ProviderToolCallPart, ProviderToolMessage, ProviderToolResultContent, ProviderUsage, ProviderUserMessage, ReasoningConfig, StructuredPrompt, TextContent, Tool, ToolArgs, ToolArgsNode, ToolArgsRawShape, ToolContent, belongsToPackage, defineAgent, defineHook, defineModel, definePrompt, defineTool, isPacked, isVisibleInNamespace, mapReasoningLevel } from '@standardagents/spec';
 import { DurableObject, WorkerEntrypoint } from 'cloudflare:workers';
@@ -94,46 +94,39 @@ declare global {
 }
 
 /**
- * Authentication middleware for protecting API routes
+ * Permissions utility for role-based access control
  *
- * Supports multiple authentication types:
- * - Super admin token (signed with ENCRYPTION_KEY)
- * - User session token (validated against DurableAgentBuilder)
- * - API key (validated against DurableAgentBuilder)
- */
-interface AuthUser {
-    id: string;
-    username: string;
-    /** 'admin' | 'user' | 'api' (API-only: normal API access, no UI, no logs). */
-    role: string;
-    /**
-     * Explicit permission grants (e.g. 'logs'). `null`/absent = legacy row with
-     * no explicit set — see {@link hasPermission} for the fallback rules.
-     */
-    permissions?: string[] | null;
-    platform_user_id?: string | null;
-    email?: string | null;
-    display_name?: string | null;
-    avatar_url?: string | null;
-}
-interface AuthContext {
-    user: AuthUser;
-    authType: 'super_admin' | 'session' | 'api_key';
-}
-/**
- * Authenticate a request using various token types
+ * Current behavior:
+ * - Admin role can do everything (early return true)
+ * - Other roles only get baseline access (own threads)
+ *
+ * The `can()` function checks arbitrary permission strings.
+ * Currently, non-admin users have no explicit permissions,
+ * meaning they rely on ownership checks for access.
  */
-declare function authenticate(request: Request, env: any): Promise<AuthContext | null>;
+
 /**
- * Middleware to require authentication
- * Returns 401 if not authenticated
+ * Check if a user can access a specific thread
+ *
+ * @param auth - The authenticated user context
+ * @param thread - The thread to check access for (must have user_id)
+ * @returns true if the user can access the thread
  */
-declare function requireAuth(request: Request, env: any): Promise<AuthContext | Response>;
+declare function canAccessThread(auth: AuthContext, thread: {
+    user_id: string | null;
+}): boolean;
+
+/** Central API exposure policy shared by the generated Worker router and tests. */
+declare function isHostedInstance(env: Record<string, unknown> | undefined): boolean;
 /**
- * Middleware to require admin role
- * Returns 401 if not authenticated, 403 if not admin
+ * Local-only conveniences are enabled by the request destination, not merely
+ * by the absence of a deployment flag. This makes an incorrectly configured
+ * internet-facing Worker fail closed while preserving localhost and OrbStack.
  */
-declare function requireAdmin(request: Request, env: any): Promise<AuthContext | Response>;
+declare function isTrustedLocalDevelopmentRequest(request: Request, env: Record<string, unknown> | undefined): boolean;
+declare function isPublicApiRoute(routePath: string, request: Request, env: Record<string, unknown> | undefined): boolean;
+/** Instance-global authoring and package-management surfaces are admin-only. */
+declare function isAdminOnlyApiRoute(routePath: string, method?: string): boolean;
 
 type AlarmQueueStatus = "pending" | "processing" | "completed" | "failed" | "agent_canceled" | "user_canceled";
 type EffectCancelSource = "agent" | "user";
@@ -1938,6 +1931,12 @@ interface ThreadRegistryEntry {
      */
     last_message_at?: number | null;
 }
+/**
+ * Safe registry projection carried by system events. Thread env and arbitrary
+ * properties are intentionally excluded: the stream is an invalidation/list
+ * surface, not a second transport for thread configuration or secrets.
+ */
+type ThreadEventPayload = Pick<ThreadRegistryEntry, 'id' | 'agent_name' | 'origin_agent_name' | 'user_id' | 'tags' | 'parent' | 'terminated' | 'created_at' | 'last_activity_at' | 'executing' | 'last_message_preview' | 'last_message_at'>;
 interface PendingSubagentAttachmentRef {
     path: string;
     name?: string;
@@ -2045,6 +2044,77 @@ interface Provider$1 {
     sdk: string;
     api_key: string;
 }
+/**
+ * Lightweight agent metadata included with real-time thread events.
+ */
+interface ThreadEventAgent {
+    name: string;
+    title: string;
+    type: string;
+    description?: string;
+    icon?: string;
+}
+/**
+ * DurableAgentBuilder - The root Durable Object for AgentBuilder.
+ *
+ * This is a singleton DO that stores:
+ * - Thread registry (maps thread IDs to agent names)
+ * - User authentication data
+ * - Provider credentials (API keys for LLM providers)
+ * - Edit lock state for coordinated edits
+ *
+ * ## Usage
+ *
+ * Users must extend this class to provide virtual module access:
+ *
+ * ```typescript
+ * import { DurableAgentBuilder } from '@standardagents/builder/runtime';
+ * import { models } from 'virtual:@standardagents-models';
+ * import { prompts } from 'virtual:@standardagents-prompts';
+ * import { agents } from 'virtual:@standardagents-agents';
+ *
+ * export class AgentBuilder extends DurableAgentBuilder {
+ *   models() { return models; }
+ *   prompts() { return prompts; }
+ *   agents() { return agents; }
+ * }
+ * ```
+ */
+/**
+ * Event types that can be emitted via WebSocket
+ */
+type AgentBuilderEvent = {
+    type: 'thread_created';
+    thread: ThreadEventPayload & {
+        agent?: ThreadEventAgent;
+    };
+} | {
+    type: 'thread_updated';
+    thread: ThreadEventPayload & {
+        agent?: ThreadEventAgent;
+    };
+} | {
+    type: 'thread_deleted';
+    threadId: string;
+}
+/**
+ * Lightweight activity signal. Kept separate from `thread_updated` because it
+ * fires on every execution start/stop: re-broadcasting the whole registry
+ * entry would decrypt thread env on each transition for data that never
+ * changed.
+ */
+ | {
+    type: 'thread_activity';
+    threadId: string;
+    /** Present only when this event actually wrote the field: a message-only
+     *  recency stamp omits last_activity_at, and `executing` rides only on a
+     *  real transition — clients must leave their current value alone for
+     *  absent fields. */
+    last_activity_at?: number;
+    executing?: boolean;
+    last_message_preview?: string | null;
+    last_message_at?: number | null;
+};
 /** Sort orders supported by `listThreads`. */
 type ThreadListSort = 'activity' | 'created' | 'oldest';
 declare class DurableAgentBuilder<Env extends AgentBuilderEnv = AgentBuilderEnv> extends DurableObject<Env> {
@@ -2568,9 +2638,11 @@ declare class DurableAgentBuilder<Env extends AgentBuilderEnv = AgentBuilderEnv>
      */
     broadcastThreadUpdated(threadId: string): Promise<void>;
     /**
-     * Broadcast an event to all connected WebSocket clients
+     * Broadcast an event only to its owner or an explicitly all-scoped admin.
      */
     private broadcastEvent;
+    /** Resolve a thread owner without decrypting its env or loading the row. */
+    private getThreadOwnerId;
     /**
      * WebSocket Hibernation API handler for incoming messages
      * Called when a message is received on a hibernated WebSocket
@@ -4191,4 +4263,4 @@ declare function createNamespaceContext(agentDef: {
  */
 declare function isQualifiedName(name: string): boolean;
 
-export { Agent, type AgentBuilderEnv, type AgentDefinition, AttachmentRef, type AuthContext, type AuthUser, type BroadcastOptions, ClientStreamRequest, ClientStreamResponse, ClientToolRequest, ClientToolResponse, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, Env, FileRecord, FileStats, FlowState, FlowStateSdk, type FlowStateWithSdk, GrepResult, type HubClientInfo, type ImageContextConfig, type InjectMessageOptions$1 as InjectMessageOptions, type Provider as LLMProviderInterface, Message, MessageContent, type ModelDefinition, NamespaceResolutionError, NamespacedRegistry, type PromptContent, type PromptDefinition, type PromptIncludePart, type PromptPart, type PromptToolConfig, type Provider$1 as Provider, type ProviderContentPart, type ProviderFilePart, type ProviderImagePart, ProviderRegistry, type ProviderTextPart, type SessionToolBinding, type SessionToolConfig, type SideConfig, type SubagentToolConfig, type SubpromptConfig, ThreadEnv, ThreadInstance, ThreadMetadata, type ThreadRegistryEntry, ThreadWatchdog, type ThreadWatchdogState, type ToolConfig, ToolResult, type UpdateThreadParams, type User, type WatchdogCheckin, type WatchdogProbeResult, authenticate, buildImageDescription, cat, createNamespaceContext, emitThreadEvent, enhanceFlowState, exists, find, forceTurn, generateImageDescription, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, head, injectMessage, isQualifiedName, linkFile, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, requireAdmin, requireAuth, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, stat, tail, unlink, updateThread, writeFile, writeImage };
+export { Agent, type AgentBuilderEnv, type AgentBuilderEvent, type AgentDefinition, AttachmentRef, AuthContext, type BroadcastOptions, ClientStreamRequest, ClientStreamResponse, ClientToolRequest, ClientToolResponse, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, Env, FileRecord, FileStats, FlowState, FlowStateSdk, type FlowStateWithSdk, GrepResult, type HubClientInfo, type ImageContextConfig, type InjectMessageOptions$1 as InjectMessageOptions, type Provider as LLMProviderInterface, Message, MessageContent, type ModelDefinition, NamespaceResolutionError, NamespacedRegistry, type PromptContent, type PromptDefinition, type PromptIncludePart, type PromptPart, type PromptToolConfig, type Provider$1 as Provider, type ProviderContentPart, type ProviderFilePart, type ProviderImagePart, ProviderRegistry, type ProviderTextPart, type SessionToolBinding, type SessionToolConfig, type SideConfig, type SubagentToolConfig, type SubpromptConfig, ThreadEnv, type ThreadEventPayload, ThreadInstance, ThreadMetadata, type ThreadRegistryEntry, ThreadWatchdog, type ThreadWatchdogState, type ToolConfig, ToolResult, type UpdateThreadParams, type User, type WatchdogCheckin, type WatchdogProbeResult, buildImageDescription, canAccessThread, cat, createNamespaceContext, emitThreadEvent, enhanceFlowState, exists, find, forceTurn, generateImageDescription, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, head, injectMessage, isAdminOnlyApiRoute, isHostedInstance, isPublicApiRoute, isQualifiedName, isTrustedLocalDevelopmentRequest, linkFile, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, stat, tail, unlink, updateThread, writeFile, writeImage };

package/dist/runtime.js

@@ -13710,7 +13710,7 @@ var init_ThreadStateImpl = __esm({
         const toolCallId = this._flowState?.currentToolCall?.id;
         const canPark = !!(toolCallId && this._executionState && typeof instance.dispatchClientTool === "function");
         const side = this._flowState?.currentSide === "b" ? "b" : "a";
-        const mustParkForApproval = request.requestPermission != null && await this.forwardedCallNeedsApproval(request);
+        const mustParkForApproval = await this.forwardedCallNeedsApproval(request);
         if (mustParkForApproval && canPark && toolCallId && typeof instance.hasBridge === "function" && await instance.hasBridge()) {
           await instance.dispatchClientTool(request, toolCallId, side);
           const getDelivered = instance.getDeliveredClientToolResult;
@@ -14854,6 +14854,84 @@ async function requireAdmin(request, env) {
   return result;
 }
 
+// src/utils/permissions.ts
+function canAccessThread(auth, thread) {
+  if (auth.user.role === "admin") {
+    return true;
+  }
+  if (thread.user_id === null) {
+    return false;
+  }
+  return thread.user_id === auth.user.id;
+}
+
+// src/routing/access-policy.ts
+var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
+  "/api/auth/bootstrap",
+  "/api/auth/login",
+  "/api/auth/config",
+  "/api/auth/brolly-control",
+  "/api/auth/platform-cleanup",
+  "/api/auth/platform-replica",
+  "/api/auth/sa/start",
+  "/api/auth/sa/callback",
+  "/api/config",
+  "/api/auth/oauth/github",
+  "/api/auth/oauth/google",
+  "/api/auth/oauth/github/callback",
+  "/api/auth/oauth/google/callback",
+  "/api/hooks"
+]);
+function isProviderIconRoute(routePath) {
+  return /^\/api\/providers\/[^/]+\/icon$/.test(routePath);
+}
+function isHostedInstance(env) {
+  const value = env?.STANDARD_AGENTS_HOSTED;
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    return normalized !== "" && normalized !== "0" && normalized !== "false";
+  }
+  return Boolean(value);
+}
+function isTrustedLocalDevelopmentRequest(request, env) {
+  if (isHostedInstance(env)) return false;
+  let hostname;
+  try {
+    hostname = new URL(request.url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname.endsWith(".localhost") || hostname.endsWith(".orb.local");
+}
+function isPublicApiRoute(routePath, request, env) {
+  if (PUBLIC_ROUTES.has(routePath)) return true;
+  if (routePath === "/api/auth/device/start" || routePath.startsWith("/api/auth/device/")) {
+    return true;
+  }
+  if (isProviderIconRoute(routePath)) {
+    return true;
+  }
+  if (!isTrustedLocalDevelopmentRequest(request, env)) return false;
+  return routePath === "/api/threads" || routePath.startsWith("/api/threads/") || routePath === "/api/platform" || routePath.startsWith("/api/platform/") || routePath === "/api/platform-session" || routePath.startsWith("/api/platform-session/") || routePath === "/api/platform-auth" || routePath.startsWith("/api/platform-auth/");
+}
+function isAdminOnlyApiRoute(routePath, method = "GET") {
+  if (routePath === "/api/skills" || routePath.startsWith("/api/skills/")) return true;
+  if (routePath === "/api/pack" || routePath.startsWith("/api/pack/")) return true;
+  if (routePath === "/api/unpack" || routePath.startsWith("/api/unpack/")) return true;
+  if (routePath === "/api/prompts" || routePath.startsWith("/api/prompts/")) return true;
+  if (routePath === "/api/tools" || routePath.startsWith("/api/tools/")) return true;
+  if (routePath === "/api/models" || routePath.startsWith("/api/models/")) return true;
+  if (routePath === "/api/providers") return true;
+  if (routePath.startsWith("/api/providers/")) {
+    return !isProviderIconRoute(routePath);
+  }
+  if (routePath.startsWith("/api/agents/")) {
+    return !/^\/api\/agents\/[^/]+\/tenvs$/.test(routePath);
+  }
+  if (routePath === "/api/agents" && method.toUpperCase() !== "GET") return true;
+  return false;
+}
+
 // src/runtime.ts
 init_client_forwarding();
 
@@ -16534,6 +16612,18 @@ function messageTimestampSeconds(message) {
   return Math.floor(micros / (1e3 * TIMESTAMP_MULTIPLIER));
 }
 
+// src/events/access.ts
+var EVENT_STREAM_USER_ID_HEADER = "X-Standard-Agents-Event-User-Id";
+var EVENT_STREAM_SCOPE_HEADER = "X-Standard-Agents-Event-Scope";
+function isEventSocketAttachment(value) {
+  if (!value || typeof value !== "object") return false;
+  const attachment = value;
+  return attachment.channel === "events" && (attachment.scope === "user" || attachment.scope === "all") && typeof attachment.userId === "string" && attachment.userId.length > 0;
+}
+function eventSocketCanReceive(attachment, ownerUserId) {
+  return attachment.scope === "all" || ownerUserId !== null && attachment.userId === ownerUserId;
+}
+
 // src/durable-objects/agentbuilder-migrations/0001_initial.ts
 var migration36 = {
   version: 1,
@@ -17562,8 +17652,13 @@ var DurableAgentBuilder = class extends DurableObject {
     const sockets = ctx.getWebSockets();
     for (const ws of sockets) {
       const attachment = ws.deserializeAttachment();
-      if (attachment?.channel === "events") {
+      if (isEventSocketAttachment(attachment)) {
         this.eventSockets.add(ws);
+      } else if (attachment?.channel === "events") {
+        try {
+          ws.close(1012, "Reconnect to establish an authenticated event scope");
+        } catch {
+        }
       }
     }
   }
@@ -18192,7 +18287,10 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
       executing: false
     };
     const eventThread = await this.toThreadEventPayload(thread);
-    this.broadcastEvent({ type: "thread_created", thread: eventThread });
+    this.broadcastEvent(
+      { type: "thread_created", thread: eventThread },
+      thread.user_id
+    );
     await this.runAfterThreadCreatedHook(thread);
     return thread;
   }
@@ -18495,14 +18593,20 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
         stampedMessageAt = stampAt;
       }
     }
-    this.broadcastEvent({
-      type: "thread_activity",
-      threadId,
-      ...activityAt !== void 0 ? { last_activity_at: activityAt } : {},
-      ...executing !== void 0 ? { executing } : {},
-      ...preview != null ? { last_message_preview: preview } : {},
-      ...stampedMessageAt !== void 0 ? { last_message_at: stampedMessageAt } : {}
-    });
+    const ownerUserId = await this.getThreadOwnerId(threadId);
+    if (ownerUserId !== void 0) {
+      this.broadcastEvent(
+        {
+          type: "thread_activity",
+          threadId,
+          ...activityAt !== void 0 ? { last_activity_at: activityAt } : {},
+          ...executing !== void 0 ? { executing } : {},
+          ...preview != null ? { last_message_preview: preview } : {},
+          ...stampedMessageAt !== void 0 ? { last_message_at: stampedMessageAt } : {}
+        },
+        ownerUserId
+      );
+    }
   }
   /**
    * Fill in previews for threads that predate preview tracking. Callers read
@@ -18529,8 +18633,14 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
    */
   async deleteThread(id) {
     await this.ensureMigrated();
+    const ownerUserId = await this.getThreadOwnerId(id);
     await this.ctx.storage.sql.exec(`DELETE FROM threads WHERE id = ?`, id);
-    this.broadcastEvent({ type: "thread_deleted", threadId: id });
+    if (ownerUserId !== void 0) {
+      this.broadcastEvent(
+        { type: "thread_deleted", threadId: id },
+        ownerUserId
+      );
+    }
     return true;
   }
   /**
@@ -18592,7 +18702,10 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
       const updated = await this.getThread(id);
       if (updated) {
         const eventThread = await this.toThreadEventPayload(updated);
-        this.broadcastEvent({ type: "thread_updated", thread: eventThread });
+        this.broadcastEvent(
+          { type: "thread_updated", thread: eventThread },
+          updated.user_id
+        );
       }
     } catch {
     }
@@ -18672,7 +18785,10 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
     const updated = await this.getThread(id);
     if (updated) {
       const eventThread = await this.toThreadEventPayload(updated);
-      this.broadcastEvent({ type: "thread_updated", thread: eventThread });
+      this.broadcastEvent(
+        { type: "thread_updated", thread: eventThread },
+        updated.user_id
+      );
     }
     return updated;
   }
@@ -19377,7 +19493,18 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
   }
   async toThreadEventPayload(thread) {
     const eventThread = {
-      ...thread
+      id: thread.id,
+      agent_name: thread.agent_name,
+      origin_agent_name: thread.origin_agent_name,
+      user_id: thread.user_id,
+      tags: thread.tags,
+      parent: thread.parent,
+      terminated: thread.terminated,
+      created_at: thread.created_at,
+      last_activity_at: thread.last_activity_at,
+      executing: thread.executing,
+      last_message_preview: thread.last_message_preview,
+      last_message_at: thread.last_message_at
     };
     try {
       const agentDef = await this.loadAgent(thread.agent_name);
@@ -20244,10 +20371,21 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
    * Uses Hibernation API to reduce costs during inactivity
    */
   async handleEventsWebSocketUpgrade(request) {
+    const attachment = {
+      channel: "events",
+      scope: request.headers.get(EVENT_STREAM_SCOPE_HEADER) === "all" ? "all" : "user",
+      userId: request.headers.get(EVENT_STREAM_USER_ID_HEADER) ?? ""
+    };
+    if (!isEventSocketAttachment(attachment)) {
+      return Response.json(
+        { error: "Missing authenticated event subscription" },
+        { status: 401 }
+      );
+    }
     const pair = new WebSocketPair();
     const [client, server] = Object.values(pair);
     this.ctx.acceptWebSocket(server);
-    server.serializeAttachment({ channel: "events" });
+    server.serializeAttachment(attachment);
     this.eventSockets.add(server);
     return new Response(null, {
       status: 101,
@@ -20268,17 +20406,23 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
     const thread = await this.getThread(threadId);
     if (!thread) return;
     const eventThread = await this.toThreadEventPayload(thread);
-    this.broadcastEvent({ type: "thread_updated", thread: eventThread });
+    this.broadcastEvent(
+      { type: "thread_updated", thread: eventThread },
+      thread.user_id
+    );
   }
   /**
-   * Broadcast an event to all connected WebSocket clients
+   * Broadcast an event only to its owner or an explicitly all-scoped admin.
    */
-  broadcastEvent(event) {
+  broadcastEvent(event, ownerUserId) {
     const payload = JSON.stringify(event);
     for (const ws of Array.from(this.eventSockets)) {
       try {
         if (ws.readyState === WebSocket.OPEN) {
-          ws.send(payload);
+          const attachment = ws.deserializeAttachment();
+          if (isEventSocketAttachment(attachment) && eventSocketCanReceive(attachment, ownerUserId)) {
+            ws.send(payload);
+          }
         } else {
           this.eventSockets.delete(ws);
         }
@@ -20287,6 +20431,15 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
       }
     }
   }
+  /** Resolve a thread owner without decrypting its env or loading the row. */
+  async getThreadOwnerId(threadId) {
+    const cursor = await this.ctx.storage.sql.exec(
+      `SELECT user_id FROM threads WHERE id = ? LIMIT 1`,
+      threadId
+    );
+    const rows = cursor.toArray();
+    return rows[0]?.user_id;
+  }
   /**
    * WebSocket Hibernation API handler for incoming messages
    * Called when a message is received on a hibernated WebSocket
@@ -28541,6 +28694,6 @@ init_context();
 init_ProviderRegistry();
 init_types2();
 
-export { CLIENT_STREAM_CHUNK_BYTES, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, FlowStateSdk, NamespaceResolutionError, ProviderRegistry, ThreadWatchdog, authenticate, buildImageDescription, callClient, callClientStream, cat, createNamespaceContext, createThreadEndpointHandler, decodeStreamChunk, defineController2 as defineController, emitThreadEvent, encodeStreamChunk, enhanceFlowState, exists, find, forceTurn, generateImageDescription, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, head, injectMessage, isQualifiedName, linkFile, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, requireAdmin, requireAuth, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, stat, supportsClientForwarding, tail, unlink, updateThread, writeFile, writeImage };
+export { CLIENT_STREAM_CHUNK_BYTES, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, FlowStateSdk, NamespaceResolutionError, ProviderRegistry, ThreadWatchdog, authenticate, buildImageDescription, callClient, callClientStream, canAccessThread, cat, createNamespaceContext, createThreadEndpointHandler, decodeStreamChunk, defineController2 as defineController, emitThreadEvent, encodeStreamChunk, enhanceFlowState, exists, find, forceTurn, generateImageDescription, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, head, injectMessage, isAdminOnlyApiRoute, isHostedInstance, isPublicApiRoute, isQualifiedName, isTrustedLocalDevelopmentRequest, linkFile, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, requireAdmin, requireAuth, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, stat, supportsClientForwarding, tail, unlink, updateThread, writeFile, writeImage };
 //# sourceMappingURL=runtime.js.map
 //# sourceMappingURL=runtime.js.map