@standardagents/builder 0.37.5 → 0.37.7

package/dist/runtime.d.ts

@@ -116,7 +116,6 @@ declare function canAccessThread(auth: AuthContext, thread: {
     user_id: string | null;
 }): boolean;
 
-/** Central API exposure policy shared by the generated Worker router and tests. */
 declare function isHostedInstance(env: Record<string, unknown> | undefined): boolean;
 /**
  * Local-only conveniences are enabled by the request destination, not merely

package/dist/runtime.js

@@ -14086,7 +14086,7 @@ var init_ThreadStateImpl = __esm({
         return bytes.buffer;
       }
       async readFileStream(path, options) {
-        const fileInfo = await this._threadInstance.statFile(path);
+        const fileInfo = this._unwrapStatRecord(await this._threadInstance.statFile(path));
         if (!fileInfo) {
           return null;
         }
@@ -14141,12 +14141,32 @@ var init_ThreadStateImpl = __esm({
           }
         };
       }
+      /**
+       * Unwrap the thread DO's `{ success, file }` stat envelope (older shapes
+       * returned the record directly). A failed or absent lookup is NULL — the
+       * old code mapped the envelope itself, producing a truthy record with
+       * every field defaulted (size 0, application/octet-stream) even for
+       * NONEXISTENT paths, which let a phantom asset pass an existence check and
+       * a real 1.2MB image read as "0 bytes" (2026-08-11).
+       */
+      _unwrapStatRecord(result) {
+        const record = result?.file ?? result;
+        if (!record || typeof record !== "object") return null;
+        if (!("path" in record) && !("name" in record)) return null;
+        return record;
+      }
       async statFile(path) {
-        const result = await this._threadInstance.statFile(path);
-        return result ? this._mapFileRecord(result) : null;
+        const record = this._unwrapStatRecord(await this._threadInstance.statFile(path));
+        return record ? this._mapFileRecord(record) : null;
       }
       async readdirFile(path) {
-        const entries = await this._threadInstance.readdirFile(path);
+        const result = await this._threadInstance.readdirFile(path);
+        const entries = Array.isArray(result) ? result : result?.files;
+        if (!Array.isArray(entries)) {
+          throw new Error(
+            result?.error || `Could not list directory: ${path}`
+          );
+        }
         return {
           entries: entries.map((e) => this._mapFileRecord(e))
         };
@@ -14943,6 +14963,10 @@ var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
 function isProviderIconRoute(routePath) {
   return /^\/api\/providers\/[^/]+\/icon$/.test(routePath);
 }
+function isPublicThreadFileRoute(routePath, method) {
+  if (method !== "GET" && method !== "HEAD") return false;
+  return /^\/api\/threads\/[^/]+\/public\/.+/.test(routePath);
+}
 function isHostedInstance(env) {
   const value = env?.STANDARD_AGENTS_HOSTED;
   if (typeof value === "string") {
@@ -14969,6 +14993,9 @@ function isPublicApiRoute(routePath, request, env) {
   if (isProviderIconRoute(routePath)) {
     return true;
   }
+  if (isPublicThreadFileRoute(routePath, request.method.toUpperCase())) {
+    return true;
+  }
   if (!isTrustedLocalDevelopmentRequest(request, env)) return false;
   return routePath === "/api/threads" || routePath.startsWith("/api/threads/") || routePath === "/api/platform" || routePath.startsWith("/api/platform/") || routePath === "/api/platform-session" || routePath.startsWith("/api/platform-session/") || routePath === "/api/platform-auth" || routePath.startsWith("/api/platform-auth/");
 }