@standardagents/builder 0.37.4 → 0.37.6

package/dist/plugin.js

@@ -7617,6 +7617,10 @@ ${packedThreadRouteCode}
     const isApiRoute = routePath.startsWith('/api/');
 
     let authContext = null;
+    // The router's thread-authorization result, bound to the exact matched
+    // thread id, for same-request reuse by controllers (AB-05). Never cached
+    // across requests.
+    let threadAccess = null;
 
     // Require authentication for all API routes except public ones
     if (isApiRoute && !publicRoute) {
@@ -7649,6 +7653,7 @@ ${packedThreadRouteCode}
           if (!canAccessThread(authContext, thread)) {
             return addCorsHeaders(Response.json({ error: "Forbidden: You don't have access to this thread" }, { status: 403 }));
           }
+          threadAccess = { threadId, thread };
         }
       }
     }
@@ -7669,6 +7674,7 @@ ${packedThreadRouteCode}
       config,
       tools,
       auth: authContext, // Add auth context to controller context
+      threadAccess, // Router's thread authorization, bound to the exact id
     };
     const result = await controller(context);