@standardagents/builder 0.37.5 → 0.37.7

package/dist/client/index.html

@@ -26,7 +26,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <link rel="icon" type="image/svg+xml" href="/agents/assets/img/favicon-9uH1rb2F.svg">
     <title>AgentBuilder Admin</title>
-    <script type="module" crossorigin src="/agents/index-BMqXblce.js"></script>
+    <script type="module" crossorigin src="/agents/index-AUGwDdSH.js"></script>
     <link rel="modulepreload" crossorigin href="/agents/formkit-CE26dtFp.js">
     <link rel="modulepreload" crossorigin href="/agents/vendor-TPZjEwCU.js">
     <link rel="modulepreload" crossorigin href="/agents/syntax-D-ZcovVx.js">

package/dist/index.js

@@ -14095,7 +14095,7 @@ var init_ThreadStateImpl = __esm({
         return bytes.buffer;
       }
       async readFileStream(path21, options) {
-        const fileInfo = await this._threadInstance.statFile(path21);
+        const fileInfo = this._unwrapStatRecord(await this._threadInstance.statFile(path21));
         if (!fileInfo) {
           return null;
         }
@@ -14150,12 +14150,32 @@ var init_ThreadStateImpl = __esm({
           }
         };
       }
+      /**
+       * Unwrap the thread DO's `{ success, file }` stat envelope (older shapes
+       * returned the record directly). A failed or absent lookup is NULL — the
+       * old code mapped the envelope itself, producing a truthy record with
+       * every field defaulted (size 0, application/octet-stream) even for
+       * NONEXISTENT paths, which let a phantom asset pass an existence check and
+       * a real 1.2MB image read as "0 bytes" (2026-08-11).
+       */
+      _unwrapStatRecord(result) {
+        const record = result?.file ?? result;
+        if (!record || typeof record !== "object") return null;
+        if (!("path" in record) && !("name" in record)) return null;
+        return record;
+      }
       async statFile(path21) {
-        const result = await this._threadInstance.statFile(path21);
-        return result ? this._mapFileRecord(result) : null;
+        const record = this._unwrapStatRecord(await this._threadInstance.statFile(path21));
+        return record ? this._mapFileRecord(record) : null;
       }
       async readdirFile(path21) {
-        const entries = await this._threadInstance.readdirFile(path21);
+        const result = await this._threadInstance.readdirFile(path21);
+        const entries = Array.isArray(result) ? result : result?.files;
+        if (!Array.isArray(entries)) {
+          throw new Error(
+            result?.error || `Could not list directory: ${path21}`
+          );
+        }
         return {
           entries: entries.map((e) => this._mapFileRecord(e))
         };
@@ -21350,6 +21370,10 @@ var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
 function isProviderIconRoute(routePath) {
   return /^\/api\/providers\/[^/]+\/icon$/.test(routePath);
 }
+function isPublicThreadFileRoute(routePath, method) {
+  if (method !== "GET" && method !== "HEAD") return false;
+  return /^\/api\/threads\/[^/]+\/public\/.+/.test(routePath);
+}
 function isHostedInstance(env) {
   const value = env?.STANDARD_AGENTS_HOSTED;
   if (typeof value === "string") {
@@ -21376,6 +21400,9 @@ function isPublicApiRoute(routePath, request, env) {
   if (isProviderIconRoute(routePath)) {
     return true;
   }
+  if (isPublicThreadFileRoute(routePath, request.method.toUpperCase())) {
+    return true;
+  }
   if (!isTrustedLocalDevelopmentRequest(request, env)) return false;
   return routePath === "/api/threads" || routePath.startsWith("/api/threads/") || routePath === "/api/platform" || routePath.startsWith("/api/platform/") || routePath === "/api/platform-session" || routePath.startsWith("/api/platform-session/") || routePath === "/api/platform-auth" || routePath.startsWith("/api/platform-auth/");
 }