@standardagents/builder 0.38.0 → 0.38.1

package/dist/built-in-routes.js

@@ -49,6 +49,14 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/skills/scope.ts
+var SHARED_SKILL_OWNER;
+var init_scope = __esm({
+  "src/skills/scope.ts"() {
+    SHARED_SKILL_OWNER = "__instance_shared__";
+  }
+});
+
 // src/agents/client-forwarding.ts
 function createRuntimeStreams(openClientStream) {
   return {
@@ -3123,6 +3131,104 @@ var init_sessionTools = __esm({
   }
 });
 
+// src/utils/remoteAttachment.ts
+function parseAllowedHosts(value) {
+  if (typeof value !== "string") {
+    return /* @__PURE__ */ new Set();
+  }
+  return new Set(
+    value.split(",").map((host) => host.trim().toLowerCase().replace(/\.$/, "")).filter(Boolean)
+  );
+}
+function isForbiddenHostname(hostname) {
+  const normalized = hostname.toLowerCase().replace(/\.$/, "");
+  if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(normalized)) {
+    return true;
+  }
+  if (normalized.startsWith("[") && normalized.endsWith("]")) {
+    return true;
+  }
+  if (!normalized.includes(".")) {
+    return true;
+  }
+  return FORBIDDEN_HOST_SUFFIXES.some(
+    (suffix) => normalized === suffix.slice(1) || normalized.endsWith(suffix)
+  );
+}
+function validateRemoteAttachmentUrl(value, allowedHostsValue) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.port !== "" && url.port !== "443") {
+    return null;
+  }
+  const hostname = url.hostname.toLowerCase().replace(/\.$/, "");
+  if (isForbiddenHostname(hostname)) {
+    return null;
+  }
+  const allowedHosts = parseAllowedHosts(allowedHostsValue);
+  if (!allowedHosts.has(hostname)) {
+    return null;
+  }
+  return url;
+}
+async function fetchRemoteAttachment(location, allowedHostsValue, fetchImpl = fetch) {
+  let url = validateRemoteAttachmentUrl(location, allowedHostsValue);
+  if (!url) {
+    return null;
+  }
+  for (let redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount++) {
+    let response;
+    try {
+      response = await fetchImpl(url.toString(), {
+        redirect: "manual"
+      });
+    } catch {
+      return null;
+    }
+    if (!REDIRECT_STATUSES.has(response.status)) {
+      return response.ok ? response : null;
+    }
+    await response.body?.cancel().catch(() => void 0);
+    if (redirectCount === MAX_REDIRECTS) {
+      return null;
+    }
+    const redirectLocation = response.headers.get("Location");
+    if (!redirectLocation) {
+      return null;
+    }
+    let resolvedLocation;
+    try {
+      resolvedLocation = new URL(redirectLocation, url).toString();
+    } catch {
+      return null;
+    }
+    url = validateRemoteAttachmentUrl(resolvedLocation, allowedHostsValue);
+    if (!url) {
+      return null;
+    }
+  }
+  return null;
+}
+var REDIRECT_STATUSES, MAX_REDIRECTS, FORBIDDEN_HOST_SUFFIXES;
+var init_remoteAttachment = __esm({
+  "src/utils/remoteAttachment.ts"() {
+    REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+    MAX_REDIRECTS = 3;
+    FORBIDDEN_HOST_SUFFIXES = [
+      ".internal",
+      ".lan",
+      ".local",
+      ".localhost",
+      ".home",
+      ".test"
+    ];
+  }
+});
+
 // src/durable-objects/files.ts
 var files_exports = {};
 __export(files_exports, {
@@ -3860,6 +3966,7 @@ var init_ToolExecutor = __esm({
     init_types();
     init_ThreadStateImpl();
     init_sessionTools();
+    init_remoteAttachment();
     SUBAGENT_CREATE_TOOL = "subagent_create";
     SUBAGENT_MESSAGE_TOOL = "subagent_message";
     SUBAGENTS_LIST_TOOL = "subagents";
@@ -4908,7 +5015,8 @@ Message one with subagent_message(referenceId, message).`
               stub,
               state.thread.instance,
               childResult.attachments,
-              `from-subagent-${childThreadId}`
+              `from-subagent-${childThreadId}`,
+              state.env.AGENT_BUILDER_ATTACHMENT_FETCH_HOSTS
             );
             if (resumable) {
               await this.settleResumableChildAfterRun(
@@ -4941,7 +5049,8 @@ Message one with subagent_message(referenceId, message).`
                 stub,
                 state.thread.instance,
                 childResult.attachments,
-                `from-subagent-${childThreadId}`
+                `from-subagent-${childThreadId}`,
+                state.env.AGENT_BUILDER_ATTACHMENT_FETCH_HOSTS
               );
               const messageContent = this.formatSubagentTerminalMessage(
                 childThreadId,
@@ -5355,7 +5464,8 @@ Message one with subagent_message(referenceId, message).`
           state.thread.instance,
           childThread,
           parentAttachments,
-          `from-parent-${state.threadId}`
+          `from-parent-${state.threadId}`,
+          state.env.AGENT_BUILDER_ATTACHMENT_FETCH_HOSTS
         );
         const targetRole = receivesMessages === "side_a" ? "user" : "assistant";
         const baseTimestamp = Date.now() * 1e3;
@@ -5615,7 +5725,7 @@ Reference: ${referenceId}` : `Reference: ${referenceId}`;
         const shortId = crypto.randomUUID().slice(0, 8);
         return `/attachments/${normalizedStem}-${shortId}.${finalExt}`;
       }
-      static async copyAttachmentsBetweenThreads(sourceThread, targetThread, attachments, _pathPrefix) {
+      static async copyAttachmentsBetweenThreads(sourceThread, targetThread, attachments, _pathPrefix, allowedAttachmentFetchHosts) {
         if (!attachments || attachments.length === 0) {
           return [];
         }
@@ -5643,7 +5753,8 @@ Reference: ${referenceId}` : `Reference: ${referenceId}`;
             const copiedData = await this.readAttachmentDataFromSource(
               sourceThread,
               attachment.path,
-              sourceFile
+              sourceFile,
+              allowedAttachmentFetchHosts
             );
             if (!copiedData) {
               continue;
@@ -5700,7 +5811,7 @@ Reference: ${referenceId}` : `Reference: ${referenceId}`;
         }
         return copied;
       }
-      static async readAttachmentDataFromSource(sourceThread, path10, sourceFile) {
+      static async readAttachmentDataFromSource(sourceThread, path10, sourceFile, allowedAttachmentFetchHosts) {
         const sourceData = await sourceThread.readFile(path10);
         if (sourceData.success && sourceData.data) {
           return sourceData.data;
@@ -5709,14 +5820,17 @@ Reference: ${referenceId}` : `Reference: ${referenceId}`;
           return null;
         }
         const location = sourceFile.location;
-        if (!location || !/^https?:\/\//i.test(location)) {
+        if (!location) {
+          return null;
+        }
+        const response = await fetchRemoteAttachment(
+          location,
+          allowedAttachmentFetchHosts
+        );
+        if (!response) {
           return null;
         }
         try {
-          const response = await fetch(location);
-          if (!response.ok) {
-            return null;
-          }
           const buffer = await response.arrayBuffer();
           return this.arrayBufferToBase64(buffer);
         } catch {
@@ -5970,7 +6084,8 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
           state.thread.instance,
           childStub,
           sourceAttachments,
-          `from-parent-${state.threadId}`
+          `from-parent-${state.threadId}`,
+          state.env.AGENT_BUILDER_ATTACHMENT_FETCH_HOSTS
         );
         await childStub.queueMessage(referenceId, {
           role: receivesMessages === "side_a" ? "user" : "assistant",
@@ -12570,6 +12685,32 @@ var ThreadStateImpl_exports = {};
 __export(ThreadStateImpl_exports, {
   ThreadStateImpl: () => ThreadStateImpl
 });
+function isRuntimeDurableNamespace(value) {
+  return value !== null && typeof value === "object" && "idFromName" in value && typeof value.idFromName === "function" && "get" in value && typeof value.get === "function";
+}
+function isThreadStateRuntimeEnvironment(value) {
+  return value !== null && typeof value === "object" && "AGENT_BUILDER" in value && isRuntimeDurableNamespace(value.AGENT_BUILDER) && (!("AGENT_BUILDER_USER_HUB" in value) || value.AGENT_BUILDER_USER_HUB === void 0 || isRuntimeDurableNamespace(value.AGENT_BUILDER_USER_HUB));
+}
+function confinedUserEndpointUrl(userId, endpoint) {
+  const base = new URL(
+    `https://user-hub/users/${encodeURIComponent(userId)}/endpoints/`
+  );
+  const relative4 = endpoint.replace(/^\/+/, "");
+  let decoded;
+  try {
+    decoded = decodeURIComponent(relative4);
+  } catch {
+    throw new Error("Invalid user endpoint path: malformed percent encoding.");
+  }
+  if (decoded.includes("\\") || decoded.includes("?") || decoded.includes("#") || /[\u0000-\u001f\u007f]/.test(decoded) || decoded.split("/").some((segment) => segment === "." || segment === "..")) {
+    throw new Error("Invalid user endpoint path: traversal and URL syntax are not allowed.");
+  }
+  const resolved = new URL(relative4, base);
+  if (resolved.origin !== base.origin || !resolved.pathname.startsWith(base.pathname)) {
+    throw new Error("Invalid user endpoint path: endpoint escaped the user namespace.");
+  }
+  return resolved.toString();
+}
 function hasLocalCodeExecutionRuntime(threadInstance) {
   const candidate = threadInstance;
   return Boolean(candidate.env && candidate.ctx);
@@ -12750,6 +12891,7 @@ function runCodeViaThreadRpc(threadInstance, threadId, source, options) {
 var ThreadStateImpl, ExecutionStateImpl;
 var init_ThreadStateImpl = __esm({
   "src/agents/ThreadStateImpl.ts"() {
+    init_scope();
     init_client_forwarding();
     init_types();
     init_utilities();
@@ -12983,6 +13125,14 @@ var init_ThreadStateImpl = __esm({
         }
         return value;
       }
+      async instanceEnv(propertyName) {
+        const agentBuilder = this._getAgentBuilderStub();
+        if (typeof agentBuilder.getInstanceEnv !== "function") {
+          throw new Error("instanceEnv is not supported by this runtime");
+        }
+        const values = await agentBuilder.getInstanceEnv();
+        return values[propertyName];
+      }
       async envType(propertyName) {
         const agentBuilder = this._getAgentBuilderStub();
         if (typeof agentBuilder.resolveThreadEnvType === "function") {
@@ -14013,12 +14163,11 @@ var init_ThreadStateImpl = __esm({
        * dispatcher recorded in the runtime context instead.
        */
       _getRuntimeEnv() {
-        const contextEnv = this._runtimeContext.env;
-        if (contextEnv?.AGENT_BUILDER) {
-          return contextEnv;
+        if (isThreadStateRuntimeEnvironment(this._runtimeContext.env)) {
+          return this._runtimeContext.env;
         }
         const instanceEnv = this._threadInstance.env;
-        if (!instanceEnv?.AGENT_BUILDER) {
+        if (!isThreadStateRuntimeEnvironment(instanceEnv)) {
           throw new Error(
             "No runtime environment available on this ThreadState. Stub-backed states must be constructed with runtimeContext.env."
           );
@@ -14035,9 +14184,7 @@ var init_ThreadStateImpl = __esm({
         return namespace.get(namespace.idFromName(userId));
       }
       // ─────────────────────────────────────────────────────────────────────────
-      // Skills — instance-global Agent Skills library, backed by the
-      // DurableAgentBuilder singleton (skills are never stored per-thread or on
-      // a client machine).
+      // Skills — owner-scoped library plus explicitly shared administrator skills.
       // ─────────────────────────────────────────────────────────────────────────
       /**
        * The profile of the user this thread belongs to (identity fields only —
@@ -14060,9 +14207,8 @@ var init_ThreadStateImpl = __esm({
                 "Reentrant user-scope call: this ThreadState was raised from user-scope code; state.user().call() is unavailable here."
               );
             }
-            const path10 = endpoint.replace(/^\/+/, "");
             return hub().fetch(
-              new Request(`https://user-hub/users/${encodeURIComponent(userId)}/endpoints/${path10}`, {
+              new Request(confinedUserEndpointUrl(userId, endpoint), {
                 method: "POST",
                 headers: {
                   "Content-Type": "application/json",
@@ -14122,18 +14268,42 @@ var init_ThreadStateImpl = __esm({
       }
       get skills() {
         const stub = this._getAgentBuilderStub();
+        const ownerId = this._metadata.user_id ?? SHARED_SKILL_OWNER;
+        const scope = {
+          ownerId,
+          includeShared: ownerId !== SHARED_SKILL_OWNER
+        };
+        const requireMutationAdmin = async () => {
+          const userId = this._metadata.user_id;
+          if (!userId) {
+            throw new Error("Skill mutations require an authenticated instance admin.");
+          }
+          const user = await stub.getUserById(userId);
+          if (user?.role !== "admin") {
+            throw new Error("Skill mutations require an instance admin.");
+          }
+        };
         return {
-          list: (options) => stub.listSkills(options),
+          list: (options) => stub.listSkills(scope, options),
           get: async (name15) => {
-            const metadata = await stub.getSkill(name15);
+            const metadata = await stub.getSkill(scope, name15);
             if (!metadata) return null;
-            const skillMd = await stub.getSkillFile(name15, "SKILL.md") ?? "";
+            const skillMd = await stub.getSkillFile(scope, name15, "SKILL.md") ?? "";
             return { metadata, skillMd };
           },
-          readFile: (name15, path10) => stub.getSkillFile(name15, path10),
-          install: (files) => stub.upsertSkill(files),
-          setEnabled: (name15, enabled) => stub.setSkillEnabled(name15, enabled),
-          remove: (name15) => stub.deleteSkill(name15)
+          readFile: (name15, path10) => stub.getSkillFile(scope, name15, path10),
+          install: async (files) => {
+            await requireMutationAdmin();
+            return stub.upsertSkill(scope, files);
+          },
+          setEnabled: async (name15, enabled) => {
+            await requireMutationAdmin();
+            return stub.setSkillEnabled(scope, name15, enabled);
+          },
+          remove: async (name15) => {
+            await requireMutationAdmin();
+            return stub.deleteSkill(scope, name15);
+          }
         };
       }
       // ─────────────────────────────────────────────────────────────────────────
@@ -67052,6 +67222,7 @@ function getParamRegexp(segment) {
 init_ThreadStateImpl();
 
 // src/utils/auth.ts
+var SUPER_ADMIN_TOKEN_TTL_SECONDS = 12 * 60 * 60;
 function generateSecureToken(length = 32) {
   const array44 = new Uint8Array(length);
   crypto.getRandomValues(array44);
@@ -67063,6 +67234,20 @@ function generateUserToken() {
 function generateApiKey() {
   return `agtbldr_${generateSecureToken(32)}`;
 }
+async function constantTimeEqual(left, right) {
+  const encoder2 = new TextEncoder();
+  const [leftDigest, rightDigest] = await Promise.all([
+    crypto.subtle.digest("SHA-256", encoder2.encode(left)),
+    crypto.subtle.digest("SHA-256", encoder2.encode(right))
+  ]);
+  const leftBytes = new Uint8Array(leftDigest);
+  const rightBytes = new Uint8Array(rightDigest);
+  let difference = 0;
+  for (let index = 0; index < leftBytes.length; index++) {
+    difference |= leftBytes[index] ^ rightBytes[index];
+  }
+  return difference === 0;
+}
 async function hashPassword(password) {
   const encoder2 = new TextEncoder();
   const data = encoder2.encode(password);
@@ -67174,9 +67359,9 @@ function isValidUserToken(token) {
 function isValidApiKey(key) {
   return key.startsWith("agtbldr_") && key.length > 10 || key.startsWith("sak_live_") && key.length > 10;
 }
-async function signToken(payload, encryptionKey) {
+async function signToken(payload, encryptionKey2) {
   const encoder2 = new TextEncoder();
-  const keyData = encoder2.encode(encryptionKey);
+  const keyData = encoder2.encode(encryptionKey2);
   const cryptoKey = await crypto.subtle.importKey(
     "raw",
     keyData,
@@ -67190,7 +67375,7 @@ async function signToken(payload, encryptionKey) {
   const signatureB64 = bufferToBase64(new Uint8Array(signature));
   return `${payloadB64}.${signatureB64}`;
 }
-async function verifySignedToken(signedToken, encryptionKey) {
+async function verifySignedToken(signedToken, encryptionKey2) {
   try {
     const parts = signedToken.split(".");
     if (parts.length !== 2) {
@@ -67198,7 +67383,7 @@ async function verifySignedToken(signedToken, encryptionKey) {
     }
     const [payloadB64, signatureB64] = parts;
     const encoder2 = new TextEncoder();
-    const keyData = encoder2.encode(encryptionKey);
+    const keyData = encoder2.encode(encryptionKey2);
     const cryptoKey = await crypto.subtle.importKey(
       "raw",
       keyData,
@@ -67219,14 +67404,14 @@ async function verifySignedToken(signedToken, encryptionKey) {
     return null;
   }
 }
-async function generateSuperAdminToken(encryptionKey) {
+async function generateSuperAdminToken(encryptionKey2) {
   const timestamp = Date.now();
   const nonce = generateSecureToken(16);
   const payload = `super_admin:${timestamp}:${nonce}`;
-  return await signToken(payload, encryptionKey);
+  return await signToken(payload, encryptionKey2);
 }
-async function verifySuperAdminToken(token, encryptionKey) {
-  const payload = await verifySignedToken(token, encryptionKey);
+async function verifySuperAdminToken(token, encryptionKey2) {
+  const payload = await verifySignedToken(token, encryptionKey2);
   if (!payload) {
     return false;
   }
@@ -67235,9 +67420,12 @@ async function verifySuperAdminToken(token, encryptionKey) {
     return false;
   }
   const timestamp = parseInt(parts[1], 10);
+  if (!Number.isFinite(timestamp)) {
+    return false;
+  }
   const age = Date.now() - timestamp;
-  const maxAge = 30 * 24 * 60 * 60 * 1e3;
-  if (age > maxAge) {
+  const maxAge = SUPER_ADMIN_TOKEN_TTL_SECONDS * 1e3;
+  if (age < 0 || age > maxAge) {
     return false;
   }
   return true;
@@ -67258,17 +67446,99 @@ function base64ToBuffer(base64) {
   return bytes;
 }
 
-// src/middleware/auth.ts
-var CORS_HEADERS = {
+// src/routing/access-policy.ts
+function isHostedInstance(env2) {
+  const value = env2 && typeof env2 === "object" ? Reflect.get(env2, "STANDARD_AGENTS_HOSTED") : void 0;
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    return normalized !== "" && normalized !== "0" && normalized !== "false";
+  }
+  return Boolean(value);
+}
+function isTrustedLocalDevelopmentRequest(request, env2) {
+  if (isHostedInstance(env2)) return false;
+  let hostname;
+  try {
+    hostname = new URL(request.url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname.endsWith(".localhost") || hostname.endsWith(".orb.local");
+}
+function requestObservedOrigins(request) {
+  const origins = /* @__PURE__ */ new Set();
+  let url = null;
+  try {
+    url = new URL(request.url);
+    origins.add(url.origin);
+  } catch {
+    url = null;
+  }
+  const forwardedHost = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const host = forwardedHost || request.headers.get("host")?.trim();
+  if (!host) return origins;
+  const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase();
+  const schemes = /* @__PURE__ */ new Set();
+  if (forwardedProto === "http" || forwardedProto === "https") schemes.add(forwardedProto);
+  if (url) schemes.add(url.protocol.replace(":", ""));
+  if (schemes.size === 0) {
+    schemes.add(host.endsWith(".orb.local") ? "https" : "http");
+  }
+  for (const scheme of schemes) {
+    try {
+      origins.add(new URL(`${scheme}://${host}`).origin);
+    } catch {
+    }
+  }
+  return origins;
+}
+function isSameOriginBrowserRequest(request) {
+  const fetchSite = request.headers.get("Sec-Fetch-Site")?.trim().toLowerCase();
+  if (fetchSite === "same-origin" || fetchSite === "none") {
+    return true;
+  }
+  if (fetchSite) {
+    return false;
+  }
+  const origin = request.headers.get("Origin")?.trim();
+  if (!origin) return true;
+  if (origin === "null") return false;
+  try {
+    return requestObservedOrigins(request).has(new URL(origin).origin);
+  } catch {
+    return false;
+  }
+}
+
+// src/routing/cors.ts
+var RUNTIME_CORS_HEADERS = {
   "Access-Control-Allow-Origin": "*",
   "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
   "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Requested-With",
   "Access-Control-Max-Age": "86400"
 };
-function hasPermission(user, permission) {
+function exposesRuntimeCors(request, env2) {
+  return !isTrustedLocalDevelopmentRequest(request, env2);
+}
+function runtimeCorsHeaders(request, env2) {
+  return exposesRuntimeCors(request, env2) ? { ...RUNTIME_CORS_HEADERS } : {};
+}
+
+// src/middleware/auth.ts
+function isAuthenticationEnv(env2) {
+  if (!env2 || typeof env2 !== "object") return false;
+  const namespace = env2.AGENT_BUILDER;
+  return !!namespace && typeof namespace === "object" && typeof namespace.idFromName === "function" && typeof namespace.get === "function";
+}
+function hasPermission(user, permission, options = {}) {
   if (user.role === "admin") return true;
   if (Array.isArray(user.permissions)) return user.permissions.includes(permission);
-  return user.role !== "api";
+  return options.allowLegacyUserFallback !== false && user.role === "user";
+}
+function hasPermissionInEnvironment(user, permission, env2) {
+  return hasPermission(user, permission, {
+    allowLegacyUserFallback: !isHostedInstance(env2)
+  });
 }
 function parsePermissions(value) {
   if (Array.isArray(value)) return value.filter((p) => typeof p === "string");
@@ -67290,43 +67560,96 @@ function extractBearerToken(request) {
   if (cookieToken) {
     return cookieToken;
   }
-  const isWebSocket = request.headers.get("upgrade")?.toLowerCase() === "websocket";
-  if (isWebSocket) {
-    try {
-      const url = new URL(request.url);
-      const token = url.searchParams.get("token");
-      if (token) {
-        return token;
-      }
-    } catch (err) {
-    }
-  }
   return null;
 }
 function getAgentBuilder(env2) {
   const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
   return env2.AGENT_BUILDER.get(agentBuilderId);
 }
+function parseWebSocketTicketAuth(authJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(authJson);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const record24 = parsed;
+  if (!record24.user || typeof record24.user !== "object") return null;
+  const user = record24.user;
+  if (typeof user.id !== "string" || typeof user.username !== "string" || typeof user.role !== "string" || record24.authType !== "super_admin" && record24.authType !== "session" && record24.authType !== "api_key") {
+    return null;
+  }
+  const permissions = user.permissions;
+  if (permissions !== void 0 && permissions !== null && (!Array.isArray(permissions) || !permissions.every((permission) => typeof permission === "string"))) {
+    return null;
+  }
+  if (record24.credentialId !== void 0 && typeof record24.credentialId !== "string") return null;
+  return {
+    user: {
+      id: user.id,
+      username: user.username,
+      role: user.role,
+      permissions,
+      platform_user_id: typeof user.platform_user_id === "string" ? user.platform_user_id : null,
+      email: typeof user.email === "string" ? user.email : null,
+      display_name: typeof user.display_name === "string" ? user.display_name : null,
+      avatar_url: typeof user.avatar_url === "string" ? user.avatar_url : null
+    },
+    authType: record24.authType,
+    credentialId: record24.credentialId
+  };
+}
+async function consumeWebSocketTicket(request, env2) {
+  if (request.headers.get("upgrade")?.toLowerCase() !== "websocket") return null;
+  let url;
+  try {
+    url = new URL(request.url);
+  } catch {
+    return null;
+  }
+  const ticket = url.searchParams.get("ticket");
+  if (!ticket) return null;
+  const authJson = await getAgentBuilder(env2).consumeWebSocketTicket({
+    ticket_hash: await hashToken(ticket),
+    pathname: url.pathname
+  });
+  return typeof authJson === "string" ? parseWebSocketTicketAuth(authJson) : null;
+}
+function isWebSocketTicketPath(pathname) {
+  if (!pathname.startsWith("/api/") || pathname.includes("?") || pathname.includes("#")) return false;
+  try {
+    return new URL(pathname, "https://runtime.invalid").pathname === pathname;
+  } catch {
+    return false;
+  }
+}
 async function authenticate(request, env2) {
+  const ticketAuth = await consumeWebSocketTicket(request, env2);
+  if (ticketAuth) return ticketAuth;
   const token = extractBearerToken(request);
   if (!token) {
     return null;
   }
-  if (env2.SUPER_ADMIN_PASSWORD && env2.ENCRYPTION_KEY) {
+  if (typeof env2.SUPER_ADMIN_PASSWORD === "string" && typeof env2.ENCRYPTION_KEY === "string") {
     if (token.includes(".")) {
       const isValidSuperAdmin = await verifySuperAdminToken(
         token,
         env2.ENCRYPTION_KEY
       );
       if (isValidSuperAdmin) {
-        return {
-          user: {
-            id: "super_admin",
-            username: "admin",
-            role: "admin"
-          },
-          authType: "super_admin"
-        };
+        const tokenHash = await hashToken(token);
+        const agentBuilder = getAgentBuilder(env2);
+        if (await agentBuilder.validateSuperAdminSession(tokenHash)) {
+          return {
+            user: {
+              id: "super_admin",
+              username: "admin",
+              role: "admin"
+            },
+            authType: "super_admin"
+          };
+        }
       }
     }
   }
@@ -67371,7 +67694,8 @@ async function authenticate(request, env2) {
             display_name: user.display_name ?? null,
             avatar_url: user.avatar_url ?? null
           },
-          authType: "api_key"
+          authType: "api_key",
+          credentialId: apiKey.id
         };
       }
     }
@@ -67383,7 +67707,10 @@ async function requireAuth(request, env2) {
   if (!authContext) {
     return new Response(JSON.stringify({ error: "Unauthorized" }), {
       status: 401,
-      headers: { "Content-Type": "application/json", ...CORS_HEADERS }
+      headers: {
+        "Content-Type": "application/json",
+        ...runtimeCorsHeaders(request, env2)
+      }
     });
   }
   return authContext;
@@ -67393,12 +67720,15 @@ async function requirePermission(request, env2, permission) {
   if (result instanceof Response) {
     return result;
   }
-  if (!hasPermission(result.user, permission)) {
+  if (!hasPermissionInEnvironment(result.user, permission, env2)) {
     return new Response(
       JSON.stringify({ error: `Forbidden: '${permission}' access required` }),
       {
         status: 403,
-        headers: { "Content-Type": "application/json", ...CORS_HEADERS }
+        headers: {
+          "Content-Type": "application/json",
+          ...runtimeCorsHeaders(request, env2)
+        }
       }
     );
   }
@@ -67414,7 +67744,10 @@ async function requireAdmin(request, env2) {
       JSON.stringify({ error: "Forbidden: Admin access required" }),
       {
         status: 403,
-        headers: { "Content-Type": "application/json", ...CORS_HEADERS }
+        headers: {
+          "Content-Type": "application/json",
+          ...runtimeCorsHeaders(request, env2)
+        }
       }
     );
   }
@@ -67424,27 +67757,6 @@ function defineController2(controller) {
   return controller;
 }
 
-// src/api/index.post.ts
-var index_post_default = defineController2(() => {
-  const stream = new ReadableStream({
-    start(controller) {
-      const text2 = "hello world";
-      let index = 0;
-      const next = () => {
-        if (index < text2.length) {
-          controller.enqueue(new TextEncoder().encode(text2[index]));
-          index++;
-          setTimeout(next, 100);
-        } else {
-          controller.close();
-        }
-      };
-      next();
-    }
-  });
-  return new Response(stream);
-});
-
 // src/api/agents.get.ts
 var agents_get_default = defineController2(async ({ agents, agentNames, registry, auth }) => {
   const includeAuthoringDetails = auth?.user.role === "admin";
@@ -67526,29 +67838,16 @@ var agents_get_default = defineController2(async ({ agents, agentNames, registry
   return Response.json({ agents: validAgents });
 });
 
-// src/routing/access-policy.ts
-function isHostedInstance(env2) {
-  const value = env2?.STANDARD_AGENTS_HOSTED;
-  if (typeof value === "string") {
-    const normalized = value.trim().toLowerCase();
-    return normalized !== "" && normalized !== "0" && normalized !== "false";
-  }
-  return Boolean(value);
-}
-function isTrustedLocalDevelopmentRequest(request, env2) {
-  if (isHostedInstance(env2)) return false;
-  let hostname;
-  try {
-    hostname = new URL(request.url).hostname.toLowerCase();
-  } catch {
-    return false;
-  }
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname.endsWith(".localhost") || hostname.endsWith(".orb.local");
-}
-
 // src/utils/platform-auth.ts
 var FALLBACK_PLATFORM_ORIGIN = "https://platform.standardagents.ai";
 var SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
+function agentBuilderAuthStub(env2) {
+  const namespace = env2.AGENT_BUILDER;
+  if (!namespace || typeof namespace.idFromName !== "function" || typeof namespace.get !== "function") {
+    throw new Error("Server misconfigured: AGENT_BUILDER Durable Object binding is required for platform auth");
+  }
+  return namespace.get(namespace.idFromName("singleton"));
+}
 function platformApiKey(env2) {
   const value = env2.STANDARD_AGENTS_API_KEY;
   return typeof value === "string" && value.trim() ? value.trim() : null;
@@ -67707,11 +68006,7 @@ async function getPlatformIdentity(env2) {
   };
 }
 async function upsertReplicaUserForPlatformProfile(env2, profile) {
-  const namespace = env2.AGENT_BUILDER;
-  if (!namespace || typeof namespace.idFromName !== "function" || typeof namespace.get !== "function") {
-    throw new Error("Server misconfigured: AGENT_BUILDER Durable Object binding is required for platform auth");
-  }
-  const agentBuilder = namespace.get(namespace.idFromName("singleton"));
+  const agentBuilder = agentBuilderAuthStub(env2);
   return await agentBuilder.upsertPlatformReplicaUser({
     platform_user_id: profile.platform_user_id,
     username: profile.username ?? null,
@@ -67723,11 +68018,7 @@ async function upsertReplicaUserForPlatformProfile(env2, profile) {
   });
 }
 async function mintLocalSessionForPlatformUser(env2, platformUser) {
-  const namespace = env2.AGENT_BUILDER;
-  if (!namespace || typeof namespace.idFromName !== "function" || typeof namespace.get !== "function") {
-    throw new Error("Server misconfigured: AGENT_BUILDER Durable Object binding is required for platform auth");
-  }
-  const agentBuilder = namespace.get(namespace.idFromName("singleton"));
+  const agentBuilder = agentBuilderAuthStub(env2);
   const profile = typeof platformUser === "string" ? { platform_user_id: platformUser, username: `sa-${platformUser.slice(0, 12)}`, role: "admin" } : platformUser;
   const user = await upsertReplicaUserForPlatformProfile(env2, profile);
   if (user.role === "api") {
@@ -67739,6 +68030,12 @@ async function mintLocalSessionForPlatformUser(env2, platformUser) {
   await agentBuilder.createSession({ user_id: user.id, token_hash: tokenHash, expires_at: expiresAt });
   return { token, user: { id: user.id, username: user.username, role: user.role } };
 }
+async function consumePlatformHandoffJti(env2, jti, expiresAt) {
+  return agentBuilderAuthStub(env2).consumePlatformHandoffJti({
+    jti,
+    expires_at: expiresAt
+  });
+}
 async function createPlatformLocalSession(request, env2) {
   if (!isTrustedLocalDevelopmentRequest(request, env2)) {
     return null;
@@ -67752,12 +68049,7 @@ async function createPlatformLocalSession(request, env2) {
   if (!identity) {
     throw new Error("STANDARD_AGENTS_API_KEY could not be resolved to one active user-instance membership.");
   }
-  const agentBuilderNamespace = env2.AGENT_BUILDER;
-  if (!agentBuilderNamespace || typeof agentBuilderNamespace.idFromName !== "function" || typeof agentBuilderNamespace.get !== "function") {
-    throw new Error("Server misconfigured: AGENT_BUILDER Durable Object binding is required for platform auth");
-  }
-  const agentBuilderId = agentBuilderNamespace.idFromName("singleton");
-  const agentBuilder = agentBuilderNamespace.get(agentBuilderId);
+  const agentBuilder = agentBuilderAuthStub(env2);
   const user = await agentBuilder.upsertPlatformReplicaUser({
     platform_user_id: identity.user.id,
     username: identity.user.username,
@@ -67813,7 +68105,7 @@ var index_get_default = defineController2(async ({ req, env: env2 }) => {
 });
 
 // src/api/api-keys/index.post.ts
-var index_post_default2 = defineController2(async ({ req, env: env2 }) => {
+var index_post_default = defineController2(async ({ req, env: env2 }) => {
   try {
     if (isPlatformHosted(env2)) {
       return Response.json({ error: "API keys are managed in the Standard Agents platform." }, { status: 410 });
@@ -68031,7 +68323,7 @@ var config_get_default = defineController2(async ({ config, env: env2, req }) =>
 });
 
 // src/version.ts
-var BUILDER_VERSION = "0.38.0".length > 0 ? "0.38.0" : "dev";
+var BUILDER_VERSION = "0.38.1".length > 0 ? "0.38.1" : "dev";
 
 // src/api/diagnostics.get.ts
 init_LLMRequest();
@@ -68429,11 +68721,6 @@ var models_get_default = defineController2(async ({ models, modelNames }) => {
   const validModels = modelList.filter(Boolean);
   return Response.json({ models: validModels });
 });
-
-// src/api/new-test.get.ts
-var new_test_get_default = defineController2(async ({ req, params, env: env2 }) => {
-  return { message: "Modified new test API route", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
-});
 function toJSONSchema(schema) {
   if (!schema) return null;
   if (schema && typeof schema === "object" && ("~standard" in schema || "_def" in schema)) {
@@ -68540,6 +68827,7 @@ var providers_get_default = defineController2(async ({ env: env2 }) => {
 });
 
 // src/api/skills/index.get.ts
+init_scope();
 var index_get_default2 = defineController2(async ({ req, env: env2 }) => {
   const authResult = await requireAdmin(req, env2);
   if (authResult instanceof Response) return authResult;
@@ -68547,7 +68835,10 @@ var index_get_default2 = defineController2(async ({ req, env: env2 }) => {
   const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
   const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
   try {
-    const skills = await agentBuilder.listSkills({ includeDisabled });
+    const skills = await agentBuilder.listSkills(
+      { ownerId: SHARED_SKILL_OWNER },
+      { includeDisabled }
+    );
     return Response.json({ skills });
   } catch (error) {
     return Response.json(
@@ -68562,7 +68853,8 @@ var SkillValidationError = class extends Error {
 };
 
 // src/api/skills/index.post.ts
-var index_post_default3 = defineController2(async ({ req, env: env2 }) => {
+init_scope();
+var index_post_default2 = defineController2(async ({ req, env: env2 }) => {
   const authResult = await requireAdmin(req, env2);
   if (authResult instanceof Response) return authResult;
   let body;
@@ -68584,7 +68876,7 @@ var index_post_default3 = defineController2(async ({ req, env: env2 }) => {
   const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
   const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
   try {
-    const skill = await agentBuilder.upsertSkill(files);
+    const skill = await agentBuilder.upsertSkill({ ownerId: SHARED_SKILL_OWNER }, files);
     return Response.json({ skill }, { status: 201 });
   } catch (error) {
     const message = error instanceof Error ? error.message : "Failed to install skill";
@@ -68646,7 +68938,7 @@ async function hasEnabledImmediatePromptTools(agentBuilder, threadId, agentId) {
   }
   return false;
 }
-var index_post_default4 = defineController2(async ({ req, env: env2 }) => {
+var index_post_default3 = defineController2(async ({ req, env: env2 }) => {
   const authResult = await requireAuth(req, env2);
   if (authResult instanceof Response) {
     return authResult;
@@ -69243,15 +69535,138 @@ var migration17 = {
   }
 };
 
+// src/durable-objects/agentbuilder-migrations/0018_auth_security.ts
+var migration18 = {
+  version: 18,
+  async up(sql) {
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS super_admin_sessions (
+        token_hash TEXT PRIMARY KEY,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      )
+    `);
+    sql.exec(`
+      CREATE INDEX IF NOT EXISTS idx_super_admin_sessions_expires
+      ON super_admin_sessions(expires_at)
+    `);
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS auth_rate_limits (
+        bucket_key TEXT PRIMARY KEY,
+        attempts INTEGER NOT NULL,
+        reset_at INTEGER NOT NULL
+      )
+    `);
+    sql.exec(`
+      CREATE INDEX IF NOT EXISTS idx_auth_rate_limits_reset
+      ON auth_rate_limits(reset_at)
+    `);
+    sql.exec(`
+      INSERT OR REPLACE INTO _metadata (key, value) VALUES ('schema_version', '18')
+    `);
+  }
+};
+
+// src/durable-objects/agentbuilder-migrations/0019_scope_skills.ts
+var migration19 = {
+  version: 19,
+  async up(sql) {
+    sql.exec(`
+      CREATE TABLE skills_0019 (
+        owner_id TEXT NOT NULL,
+        name TEXT NOT NULL,
+        description TEXT NOT NULL,
+        version TEXT,
+        enabled INTEGER NOT NULL DEFAULT 1,
+        shared INTEGER NOT NULL DEFAULT 0,
+        created_at INTEGER DEFAULT (strftime('%s', 'now')),
+        updated_at INTEGER DEFAULT (strftime('%s', 'now')),
+        PRIMARY KEY (owner_id, name)
+      )
+    `);
+    sql.exec(`
+      INSERT INTO skills_0019 (
+        owner_id, name, description, version, enabled, shared, created_at, updated_at
+      )
+      SELECT '__instance_shared__', name, description, version, enabled, 1, created_at, updated_at
+      FROM skills
+    `);
+    sql.exec(`
+      CREATE TABLE skill_files_0019 (
+        owner_id TEXT NOT NULL,
+        skill_name TEXT NOT NULL,
+        path TEXT NOT NULL,
+        content TEXT NOT NULL,
+        size INTEGER NOT NULL,
+        PRIMARY KEY (owner_id, skill_name, path),
+        FOREIGN KEY (owner_id, skill_name) REFERENCES skills_0019(owner_id, name) ON DELETE CASCADE
+      )
+    `);
+    sql.exec(`
+      INSERT INTO skill_files_0019 (owner_id, skill_name, path, content, size)
+      SELECT '__instance_shared__', skill_name, path, content, size FROM skill_files
+    `);
+    sql.exec(`DROP TABLE skill_files`);
+    sql.exec(`DROP TABLE skills`);
+    sql.exec(`ALTER TABLE skills_0019 RENAME TO skills`);
+    sql.exec(`ALTER TABLE skill_files_0019 RENAME TO skill_files`);
+    sql.exec(`CREATE INDEX idx_skills_owner_enabled ON skills(owner_id, enabled)`);
+    sql.exec(`CREATE INDEX idx_skills_shared_enabled ON skills(shared, enabled)`);
+    sql.exec(`CREATE INDEX idx_skill_files_skill ON skill_files(owner_id, skill_name)`);
+    sql.exec(`INSERT OR REPLACE INTO _metadata (key, value) VALUES ('schema_version', '19')`);
+  }
+};
+
+// src/durable-objects/agentbuilder-migrations/0020_websocket_tickets.ts
+var migration20 = {
+  version: 20,
+  async up(sql) {
+    sql.exec(`
+      CREATE TABLE websocket_tickets (
+        ticket_hash TEXT PRIMARY KEY,
+        pathname TEXT NOT NULL,
+        auth_json TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      )
+    `);
+    sql.exec(`
+      CREATE INDEX idx_websocket_tickets_expires
+      ON websocket_tickets(expires_at)
+    `);
+    sql.exec(`INSERT OR REPLACE INTO _metadata (key, value) VALUES ('schema_version', '20')`);
+  }
+};
+
+// src/durable-objects/agentbuilder-migrations/0021_platform_handoff_jtis.ts
+var migration21 = {
+  version: 21,
+  async up(sql) {
+    sql.exec(`
+      CREATE TABLE platform_handoff_jtis (
+        jti TEXT PRIMARY KEY,
+        consumed_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      )
+    `);
+    sql.exec(`
+      CREATE INDEX idx_platform_handoff_jtis_expires
+      ON platform_handoff_jtis(expires_at)
+    `);
+    sql.exec(`INSERT OR REPLACE INTO _metadata (key, value) VALUES ('schema_version', '21')`);
+  }
+};
+
 // src/durable-objects/agentbuilder-migrations/index.ts
-var migrations = [migration, migration2, migration3, migration4, migration5, migration6, migration7, migration8, migration9, migration10, migration11, migration12, migration13, migration14, migration15, migration16, migration17];
+var migrations = [migration, migration2, migration3, migration4, migration5, migration6, migration7, migration8, migration9, migration10, migration11, migration12, migration13, migration14, migration15, migration16, migration17, migration18, migration19, migration20, migration21];
 migrations.reduce(
-  (max, migration18) => Math.max(max, migration18.version),
+  (max, migration22) => Math.max(max, migration22.version),
   0
 );
 
 // src/durable-objects/DurableAgentBuilder.ts
 init_types();
+init_scope();
 var THREAD_PREVIEW_MAX_CHARS = 140;
 var buildThreadPreview = (content) => {
   const collapsed = content.replace(/\s+/g, " ").trim();
@@ -69607,7 +70022,7 @@ var index_get_default3 = defineController2(async ({ req, env: env2 }) => {
 
 // src/api/users/index.post.ts
 var VALID_ROLES = ["admin", "user"];
-var index_post_default5 = defineController2(async ({ req, env: env2 }) => {
+var index_post_default4 = defineController2(async ({ req, env: env2 }) => {
   try {
     if (isPlatformHosted(env2)) {
       return Response.json({ error: "Users are managed in the Standard Agents platform." }, { status: 410 });
@@ -69871,7 +70286,7 @@ var name_get_default2 = defineController2(async ({ params, models }) => {
 });
 
 // src/api/pack/[agentName]/index.post.ts
-var index_post_default6 = defineController2(async ({ req, env: env2 }) => {
+var index_post_default5 = defineController2(async ({ req, env: env2 }) => {
   const auth = await requireAdmin(req, env2);
   if (auth instanceof Response) return auth;
   const url = new URL(req.url);
@@ -70051,6 +70466,7 @@ var name_get_default3 = defineController2(async ({ params, prompts, models, mode
 });
 
 // src/api/skills/[name].delete.ts
+init_scope();
 var name_delete_default = defineController2(async ({ req, env: env2, params }) => {
   const authResult = await requireAdmin(req, env2);
   if (authResult instanceof Response) return authResult;
@@ -70059,7 +70475,7 @@ var name_delete_default = defineController2(async ({ req, env: env2, params }) =
   const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
   const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
   try {
-    const found = await agentBuilder.deleteSkill(name15);
+    const found = await agentBuilder.deleteSkill({ ownerId: SHARED_SKILL_OWNER }, name15);
     if (!found) return Response.json({ error: `Skill not found: ${name15}` }, { status: 404 });
     return Response.json({ ok: true, removed: name15 });
   } catch (error) {
@@ -70071,6 +70487,7 @@ var name_delete_default = defineController2(async ({ req, env: env2, params }) =
 });
 
 // src/api/skills/[name].get.ts
+init_scope();
 var name_get_default4 = defineController2(async ({ req, env: env2, params }) => {
   const authResult = await requireAdmin(req, env2);
   if (authResult instanceof Response) return authResult;
@@ -70079,9 +70496,10 @@ var name_get_default4 = defineController2(async ({ req, env: env2, params }) =>
   const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
   const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
   try {
-    const skill = await agentBuilder.getSkill(name15);
+    const scope = { ownerId: SHARED_SKILL_OWNER };
+    const skill = await agentBuilder.getSkill(scope, name15);
     if (!skill) return Response.json({ error: `Skill not found: ${name15}` }, { status: 404 });
-    const skillMd = await agentBuilder.getSkillFile(name15, "SKILL.md") ?? "";
+    const skillMd = await agentBuilder.getSkillFile(scope, name15, "SKILL.md") ?? "";
     return Response.json({ skill, skillMd });
   } catch (error) {
     return Response.json(
@@ -70092,6 +70510,7 @@ var name_get_default4 = defineController2(async ({ req, env: env2, params }) =>
 });
 
 // src/api/skills/[name].patch.ts
+init_scope();
 var name_patch_default = defineController2(async ({ req, env: env2, params }) => {
   const authResult = await requireAdmin(req, env2);
   if (authResult instanceof Response) return authResult;
@@ -70109,9 +70528,10 @@ var name_patch_default = defineController2(async ({ req, env: env2, params }) =>
   const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
   const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
   try {
-    const found = await agentBuilder.setSkillEnabled(name15, body.enabled);
+    const scope = { ownerId: SHARED_SKILL_OWNER };
+    const found = await agentBuilder.setSkillEnabled(scope, name15, body.enabled);
     if (!found) return Response.json({ error: `Skill not found: ${name15}` }, { status: 404 });
-    const skill = await agentBuilder.getSkill(name15);
+    const skill = await agentBuilder.getSkill(scope, name15);
     return Response.json({ skill });
   } catch (error) {
     return Response.json(
@@ -70408,7 +70828,6 @@ var id_patch_default = defineController2(async ({ req, env: env2, params }) => {
       // Map agent_name back to agent_id for API compat
       user_id: updatedThread.user_id,
       tags: updatedThread.tags || [],
-      env: updatedThread.env ?? updatedThread.tenvs ?? null,
       env_types: updatedThread.env_types ?? null,
       created_at: updatedThread.created_at
     });
@@ -70424,15 +70843,17 @@ var id_patch_default = defineController2(async ({ req, env: env2, params }) => {
 // src/middleware/request-auth.ts
 async function resolveRequestAuth(context) {
   if (context.auth) return context.auth;
+  if (!isAuthenticationEnv(context.env)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
   return requireAuth(context.req, context.env);
 }
-async function resolveOptionalRequestAuth(context) {
-  if (context.auth) return context.auth;
-  return authenticate(context.req, context.env);
-}
 async function resolveRequestPermission(context, permission) {
   if (context.auth) {
-    if (!hasPermission(context.auth.user, permission)) {
+    if (!hasPermissionInEnvironment(context.auth.user, permission, context.env)) {
       return Response.json(
         { error: `Forbidden: '${permission}' access required` },
         { status: 403 }
@@ -70578,7 +70999,7 @@ var name_get_default5 = defineController2(async ({ params, tools }) => {
 
 // src/api/unpack/[packageId]/index.post.ts
 init_package_identifier();
-var index_post_default7 = defineController2(async ({ req, env: env2 }) => {
+var index_post_default6 = defineController2(async ({ req, env: env2 }) => {
   const auth = await requireAdmin(req, env2);
   if (auth instanceof Response) return auth;
   const url = new URL(req.url);
@@ -70723,17 +71144,43 @@ var id_put_default = defineController2(async ({ req, env: env2, params }) => {
 });
 
 // src/api/auth/bootstrap.post.ts
+var SESSION_TTL_SECONDS2 = 30 * 24 * 60 * 60;
 var bootstrap_post_default = defineController2(async ({ req, env: env2 }) => {
   try {
+    if (!isTrustedLocalDevelopmentRequest(req, env2) || !isSameOriginBrowserRequest(req)) {
+      return Response.json(
+        { error: "Local bootstrap is available only to same-origin clients" },
+        { status: 403, headers: { "Cache-Control": "no-store" } }
+      );
+    }
     const platformTokenSession = await createPlatformLocalSession(req, env2);
     if (!platformTokenSession) {
-      return new Response(null, { status: 204 });
+      return new Response(null, {
+        status: 204,
+        headers: { "Cache-Control": "no-store" }
+      });
     }
-    return Response.json(platformTokenSession);
+    return Response.json({
+      user: platformTokenSession.user,
+      authType: platformTokenSession.authType,
+      platform: platformTokenSession.platform
+    }, {
+      headers: {
+        "Cache-Control": "no-store",
+        "Set-Cookie": buildSessionCookie(
+          req,
+          platformTokenSession.token,
+          SESSION_TTL_SECONDS2
+        )
+      }
+    });
   } catch (error) {
     const message = error instanceof Error ? error.message : "Failed to bootstrap platform auth";
     const status = message.includes("STANDARD_AGENTS_API_KEY") ? 401 : 502;
-    return Response.json({ error: message }, { status });
+    return Response.json(
+      { error: message },
+      { status, headers: { "Cache-Control": "no-store" } }
+    );
   }
 });
 
@@ -70862,7 +71309,51 @@ var config_get_default2 = defineController2(async ({ req, env: env2 }) => {
   };
 });
 
+// src/api/auth/current-key.delete.ts
+var current_key_delete_default = defineController2(async ({ req, env: env2 }) => {
+  try {
+    const auth = await authenticate(req, env2);
+    if (!auth) return Response.json({ error: "Unauthorized" }, { status: 401 });
+    if (auth.authType !== "api_key" || !auth.credentialId) {
+      return Response.json({ error: "An API key must authenticate this request." }, { status: 403 });
+    }
+    const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
+    const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
+    await agentBuilder.deleteApiKey(auth.credentialId, auth.user.id);
+    return Response.json({ revoked: true });
+  } catch (error) {
+    console.error("Current API key revocation error:", error);
+    return Response.json(
+      { error: error instanceof Error ? error.message : "Failed to revoke API key" },
+      { status: 500 }
+    );
+  }
+});
+
+// src/utils/auth-rate-limit.ts
+function authClientAddress(request) {
+  return request.headers.get("CF-Connecting-IP")?.trim() || request.headers.get("X-Real-IP")?.trim() || request.headers.get("X-Forwarded-For")?.split(",")[0]?.trim() || "unknown";
+}
+async function authRateLimitKey(scope, identifier) {
+  return `${scope}:${await hashToken(identifier.trim().toLowerCase())}`;
+}
+function authRateLimitedResponse(result) {
+  return Response.json(
+    { error: "Too many authentication attempts. Try again later." },
+    {
+      status: 429,
+      headers: {
+        "Cache-Control": "no-store",
+        "Retry-After": String(Math.max(1, Math.ceil(result.retry_after)))
+      }
+    }
+  );
+}
+
 // src/api/auth/login.post.ts
+var LOGIN_ADDRESS_LIMIT = { limit: 10, window_seconds: 5 * 60 };
+var LOGIN_IDENTITY_LIMIT = { limit: 25, window_seconds: 15 * 60 };
+var LOGIN_INSTANCE_LIMIT = { limit: 500, window_seconds: 5 * 60 };
 var login_post_default = defineController2(async ({ req, env: env2 }) => {
   try {
     if (isPlatformHosted(env2)) {
@@ -70879,7 +71370,31 @@ var login_post_default = defineController2(async ({ req, env: env2 }) => {
         { status: 400 }
       );
     }
-    if (env2.SUPER_ADMIN_PASSWORD && username === "admin" && password === env2.SUPER_ADMIN_PASSWORD) {
+    if (!env2.AGENT_BUILDER || typeof env2.AGENT_BUILDER.idFromName !== "function") {
+      return Response.json(
+        { error: "Server misconfigured: AGENT_BUILDER Durable Object binding is required for local login" },
+        { status: 500 }
+      );
+    }
+    const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
+    const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
+    const instanceLimit = await agentBuilder.consumeAuthRateLimit({
+      key: "login-instance",
+      ...LOGIN_INSTANCE_LIMIT
+    });
+    if (!instanceLimit.allowed) return authRateLimitedResponse(instanceLimit);
+    const addressLimit = await agentBuilder.consumeAuthRateLimit({
+      key: await authRateLimitKey("login-address", authClientAddress(req)),
+      ...LOGIN_ADDRESS_LIMIT
+    });
+    if (!addressLimit.allowed) return authRateLimitedResponse(addressLimit);
+    const identityLimit = await agentBuilder.consumeAuthRateLimit({
+      key: await authRateLimitKey("login-identity", username || "<missing>"),
+      ...LOGIN_IDENTITY_LIMIT
+    });
+    if (!identityLimit.allowed) return authRateLimitedResponse(identityLimit);
+    const isSuperAdminPassword = env2.SUPER_ADMIN_PASSWORD && username === "admin" ? await constantTimeEqual(password, env2.SUPER_ADMIN_PASSWORD) : false;
+    if (isSuperAdminPassword) {
       if (!env2.ENCRYPTION_KEY) {
         return Response.json(
           { error: "Server misconfigured: ENCRYPTION_KEY required for super admin" },
@@ -70887,6 +71402,12 @@ var login_post_default = defineController2(async ({ req, env: env2 }) => {
         );
       }
       const token2 = await generateSuperAdminToken(env2.ENCRYPTION_KEY);
+      const tokenHash2 = await hashToken(token2);
+      const expiresAt2 = Math.floor(Date.now() / 1e3) + SUPER_ADMIN_TOKEN_TTL_SECONDS;
+      await agentBuilder.createSuperAdminSession({
+        token_hash: tokenHash2,
+        expires_at: expiresAt2
+      });
       return Response.json({
         token: token2,
         user: {
@@ -70894,6 +71415,11 @@ var login_post_default = defineController2(async ({ req, env: env2 }) => {
           username: "admin",
           role: "admin"
         }
+      }, {
+        headers: {
+          "Cache-Control": "no-store",
+          "Set-Cookie": buildSessionCookie(req, token2, SUPER_ADMIN_TOKEN_TTL_SECONDS)
+        }
       });
     }
     if (!username) {
@@ -70902,14 +71428,6 @@ var login_post_default = defineController2(async ({ req, env: env2 }) => {
         { status: 400 }
       );
     }
-    if (!env2.AGENT_BUILDER || typeof env2.AGENT_BUILDER.idFromName !== "function") {
-      return Response.json(
-        { error: "Server misconfigured: AGENT_BUILDER Durable Object binding is required for local login" },
-        { status: 500 }
-      );
-    }
-    const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
-    const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
     const user = await agentBuilder.getUserByUsername(username);
     if (!user) {
       return Response.json(
@@ -70939,11 +71457,16 @@ var login_post_default = defineController2(async ({ req, env: env2 }) => {
         username: user.username,
         role: user.role
       }
+    }, {
+      headers: {
+        "Cache-Control": "no-store",
+        "Set-Cookie": buildSessionCookie(req, token, 30 * 24 * 60 * 60)
+      }
     });
   } catch (error) {
     console.error("Login error:", error);
     return Response.json(
-      { error: error.message || "Login failed" },
+      { error: error instanceof Error ? error.message : "Login failed" },
       { status: 500 }
     );
   }
@@ -70956,38 +71479,23 @@ async function deleteLocalSession(req, env2) {
   if (!token) {
     return;
   }
-  if (!token.includes(".") && isValidUserToken(token)) {
-    const tokenHash = await hashToken(token);
-    const agentBuilder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
+  const tokenHash = await hashToken(token);
+  const agentBuilder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
+  if (token.includes(".")) {
+    await agentBuilder.deleteSuperAdminSession(tokenHash);
+  } else if (isValidUserToken(token)) {
     await agentBuilder.deleteSession(tokenHash);
   }
 }
 function clearedSessionCookie(req) {
   return buildSessionCookie(req, "", 0);
 }
-
-// src/api/auth/logout.get.ts
-function safeReturnTo(value) {
-  if (!value || !value.startsWith("/") || value.startsWith("//")) return "/";
-  return value;
+function isSameOriginLogout(req) {
+  const origin = req.headers.get("Origin");
+  if (origin && origin !== new URL(req.url).origin) return false;
+  const fetchSite = req.headers.get("Sec-Fetch-Site");
+  return !fetchSite || fetchSite === "same-origin" || fetchSite === "none";
 }
-var logout_get_default = defineController2(async ({ req, env: env2 }) => {
-  try {
-    await deleteLocalSession(req, env2);
-  } catch (error) {
-    console.error("Logout error:", error);
-  }
-  const url = new URL(req.url);
-  const returnTo = safeReturnTo(url.searchParams.get("return_to"));
-  const location = isPlatformHosted(env2) ? platformLogoutUrl(req, env2, returnTo) : `${url.origin}/login`;
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: location,
-      "Set-Cookie": clearedSessionCookie(req)
-    }
-  });
-});
 
 // src/api/auth/logout.post.ts
 var logout_post_default = defineController2(async ({ req, env: env2 }) => {
@@ -70998,9 +71506,15 @@ var logout_post_default = defineController2(async ({ req, env: env2 }) => {
       "Set-Cookie": clearedSessionCookie(req)
     }
   });
+  if (!isSameOriginLogout(req)) {
+    return Response.json({ error: "Cross-origin logout refused" }, { status: 403 });
+  }
   try {
     await deleteLocalSession(req, env2);
-    return clearCookie({ success: true });
+    const url = new URL(req.url);
+    const returnTo = url.searchParams.get("return_to");
+    const redirect = isPlatformHosted(env2) ? platformLogoutUrl(req, env2, returnTo) : void 0;
+    return clearCookie({ success: true, ...redirect ? { redirect } : {} });
   } catch (error) {
     console.error("Logout error:", error);
     return clearCookie({ error: error.message || "Logout failed" }, 500);
@@ -71103,6 +71617,37 @@ var platform_replica_post_default = defineController2(async ({ req, env: env2 })
   return Response.json({ ok: true, ...result });
 });
 
+// src/api/auth/websocket-ticket.post.ts
+var WEBSOCKET_TICKET_TTL_SECONDS = 30;
+var websocket_ticket_post_default = defineController2(async ({ req, env: env2 }) => {
+  const auth = await authenticate(req, env2);
+  if (!auth) return Response.json({ error: "Unauthorized" }, { status: 401 });
+  let body;
+  try {
+    body = await req.json();
+  } catch {
+    return Response.json({ error: "A JSON body is required." }, { status: 400 });
+  }
+  const pathname = body && typeof body === "object" ? body.pathname : void 0;
+  if (typeof pathname !== "string" || !isWebSocketTicketPath(pathname)) {
+    return Response.json({ error: "pathname must be a normalized /api/* path." }, { status: 400 });
+  }
+  const ticket = generateSecureToken(32);
+  const now = Math.floor(Date.now() / 1e3);
+  const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
+  const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
+  await agentBuilder.createWebSocketTicket({
+    ticket_hash: await hashToken(ticket),
+    pathname,
+    auth_json: JSON.stringify(auth),
+    expires_at: now + WEBSOCKET_TICKET_TTL_SECONDS
+  });
+  return Response.json(
+    { ticket, expires_in: WEBSOCKET_TICKET_TTL_SECONDS },
+    { headers: { "Cache-Control": "no-store" } }
+  );
+});
+
 // src/api/envs/_shared.ts
 function buildScopedEnvResponse(entries) {
   const variables = [...entries].sort((a, b) => a.name.localeCompare(b.name)).map((entry) => ({
@@ -71579,6 +72124,7 @@ var path_default = defineController2(async ({ req, params, env: env2, url }) =>
 });
 
 // src/api/platform-auth/bootstrap.post.ts
+var AGENT_BUILDER_SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
 function uniqueEndpoints(preferred, candidates) {
   return Array.from(new Set([preferred, ...candidates].filter((value) => Boolean(value))));
 }
@@ -71593,10 +72139,10 @@ function buildSessionCookieHeader(req, sessionCookie) {
   return `${sessionCookie}; ${attributes.join("; ")}`;
 }
 var bootstrap_post_default2 = defineController2(async ({ req, env: env2 }) => {
-  if (!isTrustedLocalDevelopmentRequest(req, env2)) {
+  if (!isTrustedLocalDevelopmentRequest(req, env2) || !isSameOriginBrowserRequest(req)) {
     return Response.json(
-      { error: "Platform auth bridge is disabled outside local development" },
-      { status: 410 }
+      { error: "Platform auth bridge is restricted to same-origin local development" },
+      { status: 403 }
     );
   }
   const requestCookie = req.headers.get("Cookie")?.trim() || "";
@@ -71623,10 +72169,16 @@ var bootstrap_post_default2 = defineController2(async ({ req, env: env2 }) => {
         account: localSession.platform.account,
         authType: localSession.authType,
         verified: localSession.platform.verified,
-        token: localSession.token,
         localUser: localSession.user
       }, {
-        headers: { "Cache-Control": "no-store" }
+        headers: {
+          "Cache-Control": "no-store",
+          "Set-Cookie": buildSessionCookie(
+            req,
+            localSession.token,
+            AGENT_BUILDER_SESSION_TTL_SECONDS
+          )
+        }
       });
     }
   }
@@ -73281,11 +73833,9 @@ var tools_get_default2 = defineController2(async ({ params, url }) => {
 
 // src/api/threads/[id]/bridge.ts
 var bridge_default = defineController2(async ({ req, params, env: env2 }) => {
-  if (isPlatformHosted(env2)) {
-    const authResult = await requireAuth(req, env2);
-    if (authResult instanceof Response) {
-      return authResult;
-    }
+  const authResult = await requireAuth(req, env2);
+  if (authResult instanceof Response) {
+    return authResult;
   }
   const threadId = params.id;
   if (!threadId) {
@@ -73538,19 +74088,9 @@ var cost_get_default = defineController2(async ({ req, params, env: env2 }) => {
 
 // src/api/threads/[id]/diagnostics.get.ts
 var diagnostics_get_default2 = defineController2(async ({ req, params, env: env2 }) => {
-  if (isPlatformHosted(env2)) {
-    const authResult = await requirePermission(req, env2, "logs");
-    if (authResult instanceof Response) {
-      return authResult;
-    }
-  } else {
-    const authContext = await authenticate(req, env2);
-    if (authContext && !hasPermission(authContext.user, "logs")) {
-      return Response.json(
-        { error: "Forbidden: 'logs' access required" },
-        { status: 403 }
-      );
-    }
+  const authResult = await requirePermission(req, env2, "logs");
+  if (authResult instanceof Response) {
+    return authResult;
   }
   const threadId = params.id;
   if (!threadId) {
@@ -73718,6 +74258,33 @@ var fs_default = defineController2(async ({ req, params, env: env2 }) => {
   }
 });
 
+// src/utils/kv-key-policy.ts
+var THREAD_CLIENT_RESERVED_KEYS = /* @__PURE__ */ new Set([
+  "execution_owner",
+  "approvals",
+  "bg_processes",
+  "lines_capacity_cache"
+]);
+var THREAD_CLIENT_RESERVED_PREFIXES = [
+  "approval_"
+];
+var USER_CLIENT_RESERVED_KEYS = /* @__PURE__ */ new Set([
+  "standardcode.lines.leases",
+  "standardcode.lines.capacity_cache"
+]);
+function isThreadKvKeyClientWritable(key) {
+  return !THREAD_CLIENT_RESERVED_KEYS.has(key) && !THREAD_CLIENT_RESERVED_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
+function isUserKvKeyClientWritable(key) {
+  return !USER_CLIENT_RESERVED_KEYS.has(key);
+}
+function reservedKvKeyResponse() {
+  return Response.json(
+    { error: "Key is reserved for server-managed state" },
+    { status: 403 }
+  );
+}
+
 // src/api/threads/[id]/kv/index.ts
 async function getAuthorizedThreadStub2(context, threadId) {
   const { env: env2 } = context;
@@ -73811,11 +74378,14 @@ async function handlePost(stub, req) {
   if (body instanceof Response) return body;
   const key = readKey(body.key);
   if (key instanceof Response) return key;
+  const previousKey = typeof body.previousKey === "string" && body.previousKey !== key ? body.previousKey : null;
+  if (!isThreadKvKeyClientWritable(key) || previousKey?.trim() && !isThreadKvKeyClientWritable(previousKey)) {
+    return reservedKvKeyResponse();
+  }
   if (!Object.prototype.hasOwnProperty.call(body, "value")) {
     return Response.json({ error: "Value is required" }, { status: 400 });
   }
   await stub.setValue(key, body.value);
-  const previousKey = typeof body.previousKey === "string" && body.previousKey !== key ? body.previousKey : null;
   if (previousKey?.trim()) {
     await stub.setValue(previousKey, null);
   }
@@ -73841,6 +74411,7 @@ async function handleDelete(stub, req, url) {
   }
   const key = readKey(keyValue);
   if (key instanceof Response) return key;
+  if (!isThreadKvKeyClientWritable(key)) return reservedKvKeyResponse();
   await stub.setValue(key, null);
   return new Response(null, { status: 204 });
 }
@@ -73878,19 +74449,9 @@ var kv_default = defineController2(async (context) => {
 // src/api/threads/[id]/logs.get.ts
 var logs_get_default = defineController2(async (context) => {
   const { req, params, env: env2 } = context;
-  if (isPlatformHosted(env2)) {
-    const authResult = await resolveRequestPermission(context, "logs");
-    if (authResult instanceof Response) {
-      return authResult;
-    }
-  } else {
-    const authContext = await resolveOptionalRequestAuth(context);
-    if (authContext && !hasPermission(authContext.user, "logs")) {
-      return Response.json(
-        { error: "Forbidden: 'logs' access required" },
-        { status: 403 }
-      );
-    }
+  const authResult = await resolveRequestPermission(context, "logs");
+  if (authResult instanceof Response) {
+    return authResult;
   }
   const url = new URL(req.url);
   const threadId = params.id;
@@ -74123,19 +74684,9 @@ var pending_tool_calls_get_default = defineController2(async ({ params, env: env
 
 // src/api/threads/[id]/revive.post.ts
 var revive_post_default = defineController2(async ({ req, params, env: env2 }) => {
-  if (isPlatformHosted(env2)) {
-    const authResult = await requirePermission(req, env2, "logs");
-    if (authResult instanceof Response) {
-      return authResult;
-    }
-  } else {
-    const authContext = await authenticate(req, env2);
-    if (authContext && !hasPermission(authContext.user, "logs")) {
-      return Response.json(
-        { error: "Forbidden: 'logs' access required" },
-        { status: 403 }
-      );
-    }
+  const authResult = await requirePermission(req, env2, "logs");
+  if (authResult instanceof Response) {
+    return authResult;
   }
   const threadId = params.id;
   if (!threadId) {
@@ -74169,20 +74720,15 @@ var revive_post_default = defineController2(async ({ req, params, env: env2 }) =
 });
 
 // src/api/threads/[id]/rpc.post.ts
+function unsafeLocalRpcEnabled(env2) {
+  const value = Reflect.get(env2, "AGENT_BUILDER_ENABLE_UNSAFE_RPC");
+  if (typeof value !== "string") return value === true;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "1" || normalized === "true";
+}
 var rpc_post_default = defineController2(async ({ req, params, env: env2 }) => {
-  if (isPlatformHosted(env2)) {
-    const authResult = await requirePermission(req, env2, "logs");
-    if (authResult instanceof Response) {
-      return authResult;
-    }
-  } else {
-    const authContext = await authenticate(req, env2);
-    if (authContext && !hasPermission(authContext.user, "logs")) {
-      return Response.json(
-        { error: "Forbidden: 'logs' access required" },
-        { status: 403 }
-      );
-    }
+  if (!isTrustedLocalDevelopmentRequest(req, env2) || !unsafeLocalRpcEnabled(env2)) {
+    return Response.json({ error: "Not found" }, { status: 404 });
   }
   const threadId = params.id;
   if (!threadId) {
@@ -74196,7 +74742,11 @@ var rpc_post_default = defineController2(async ({ req, params, env: env2 }) => {
   try {
     const id = env2.AGENT_BUILDER_THREAD.idFromName(threadId);
     const thread = env2.AGENT_BUILDER_THREAD.get(id);
-    const result = await thread[method](...args);
+    const rpcMethod = Reflect.get(thread, method);
+    if (typeof rpcMethod !== "function") {
+      return Response.json({ error: "Method not found" }, { status: 404 });
+    }
+    const result = await Reflect.apply(rpcMethod, thread, args);
     if (result instanceof Response) {
       return result;
     }
@@ -74240,11 +74790,9 @@ var stop_post_default = defineController2(async ({ params, env: env2 }) => {
 
 // src/api/threads/[id]/stream.ts
 var stream_default = defineController2(async ({ req, params, env: env2 }) => {
-  if (isPlatformHosted(env2)) {
-    const authResult = await requireAuth(req, env2);
-    if (authResult instanceof Response) {
-      return authResult;
-    }
+  const authResult = await requireAuth(req, env2);
+  if (authResult instanceof Response) {
+    return authResult;
   }
   const threadId = params.id;
   if (!threadId) {
@@ -74321,6 +74869,9 @@ var tool_result_post_default = defineController2(async ({ req, params, env: env2
   if (!toolCallId || typeof toolCallId !== "string") {
     return Response.json({ error: "tool_call_id required" }, { status: 400 });
   }
+  if (!body.delivery_token || typeof body.delivery_token !== "string") {
+    return Response.json({ error: "delivery_token required" }, { status: 400 });
+  }
   try {
     const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
     const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
@@ -74336,7 +74887,8 @@ var tool_result_post_default = defineController2(async ({ req, params, env: env2
       typeof body.result === "string" ? body.result : void 0,
       typeof body.error === "string" ? body.error : void 0,
       typeof body.client_id === "string" ? body.client_id : void 0,
-      typeof body.generation === "number" ? body.generation : void 0
+      typeof body.generation === "number" ? body.generation : void 0,
+      body.delivery_token
     );
     if (!delivered) {
       return Response.json({ status: "ignored" }, { status: 200 });
@@ -74647,11 +75199,23 @@ var name_get_default8 = defineController2(async ({ params, url, prompts, agents,
 });
 
 // src/api/auth/device/start.post.ts
+var DEVICE_ADDRESS_LIMIT = { limit: 20, window_seconds: 10 * 60 };
+var DEVICE_INSTANCE_LIMIT = { limit: 300, window_seconds: 10 * 60 };
 var start_post_default = defineController2(async ({ req, env: env2 }) => {
-  const bytes = crypto.getRandomValues(new Uint8Array(24));
-  const code = [...bytes].map((b) => "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789"[b % 57]).join("");
   const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
   const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
+  const addressLimit = await agentBuilder.consumeAuthRateLimit({
+    key: await authRateLimitKey("device-start-address", authClientAddress(req)),
+    ...DEVICE_ADDRESS_LIMIT
+  });
+  if (!addressLimit.allowed) return authRateLimitedResponse(addressLimit);
+  const instanceLimit = await agentBuilder.consumeAuthRateLimit({
+    key: "device-start-instance",
+    ...DEVICE_INSTANCE_LIMIT
+  });
+  if (!instanceLimit.allowed) return authRateLimitedResponse(instanceLimit);
+  const bytes = crypto.getRandomValues(new Uint8Array(24));
+  const code = [...bytes].map((b) => "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789"[b % 57]).join("");
   await agentBuilder.startDeviceLogin(await hashToken(code));
   const origin = new URL(req.url).origin;
   const verifyBaseRaw = env2.STANDARD_AGENTS_DEVICE_VERIFY_URL_BASE;
@@ -74665,8 +75229,74 @@ var start_post_default = defineController2(async ({ req, env: env2 }) => {
   });
 });
 
+// src/api/auth/sa/_login-state.ts
+var LOGIN_STATE_COOKIE = "agtbldr_sa_login_state";
+var LOGIN_STATE_PARAM = "__sa_login_state";
+var LOGIN_STATE_TTL_SECONDS = 10 * 60;
+function safeReturnTo(value) {
+  if (!value || !value.startsWith("/") || value.startsWith("//")) return "/";
+  return value;
+}
+function stateCookie(req, value, maxAge) {
+  const attributes = ["Path=/api/auth/sa", "HttpOnly", "SameSite=Lax"];
+  if (new URL(req.url).protocol === "https:") attributes.push("Secure");
+  return `${LOGIN_STATE_COOKIE}=${encodeURIComponent(value)}; ${attributes.join("; ")}; Max-Age=${maxAge}`;
+}
+function readStateCookie(req) {
+  const raw = req.headers.get("Cookie");
+  if (!raw) return null;
+  for (const part of raw.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 0 || part.slice(0, separator).trim() !== LOGIN_STATE_COOKIE) continue;
+    try {
+      return decodeURIComponent(part.slice(separator + 1).trim()) || null;
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function statefulReturnTo(returnTo, state) {
+  const target = new URL(safeReturnTo(returnTo), "https://instance.invalid");
+  target.searchParams.set(LOGIN_STATE_PARAM, state);
+  return `${target.pathname}${target.search}${target.hash}`;
+}
+function beginPlatformLogin(req, env2, returnTo, error) {
+  const state = crypto.randomUUID();
+  const location = new URL(platformLoginUrl(req, env2, statefulReturnTo(returnTo, state)));
+  if (error) location.searchParams.set("error", error);
+  return new Response(null, {
+    status: 302,
+    headers: {
+      Location: location.toString(),
+      "Set-Cookie": stateCookie(req, state, LOGIN_STATE_TTL_SECONDS),
+      "Cache-Control": "no-store"
+    }
+  });
+}
+function consumePlatformLoginState(req, rawReturnTo) {
+  const target = new URL(safeReturnTo(rawReturnTo), "https://instance.invalid");
+  const state = target.searchParams.get(LOGIN_STATE_PARAM);
+  target.searchParams.delete(LOGIN_STATE_PARAM);
+  const returnTo = `${target.pathname}${target.search}${target.hash}`;
+  return {
+    returnTo,
+    valid: Boolean(state && state === readStateCookie(req)),
+    present: Boolean(state)
+  };
+}
+function withClearedPlatformLoginState(req, response) {
+  const headers = new Headers(response.headers);
+  headers.append("Set-Cookie", stateCookie(req, "", 0));
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
 // src/api/auth/sa/callback.get.ts
-var SESSION_TTL_SECONDS2 = 30 * 24 * 60 * 60;
+var SESSION_TTL_SECONDS3 = 30 * 24 * 60 * 60;
 function safeReturnTo2(value) {
   if (!value || !value.startsWith("/") || value.startsWith("//")) return "/";
   return value;
@@ -74674,15 +75304,12 @@ function safeReturnTo2(value) {
 function failRedirect(req, env2, reason, returnTo) {
   const origin = new URL(req.url).origin;
   if (isPlatformHosted(env2)) {
-    const target = new URL(platformLoginUrl(req, env2, returnTo ?? "/"));
-    target.searchParams.set(
-      "error",
+    return beginPlatformLogin(
+      req,
+      env2,
+      returnTo ?? "/",
       reason === "api_only_account" ? "api_only_account" : "instance_login_failed"
     );
-    return new Response(null, {
-      status: 302,
-      headers: { Location: target.toString() }
-    });
   }
   return new Response(null, {
     status: 302,
@@ -74694,7 +75321,9 @@ var callback_get_default = defineController2(async ({ req, env: env2 }) => {
     return failRedirect(req, env2, "not_hosted");
   }
   const url = new URL(req.url);
-  const failReturnTo = safeReturnTo2(url.searchParams.get("return_to"));
+  const loginState = consumePlatformLoginState(req, url.searchParams.get("return_to"));
+  const finishLoginState = (response) => loginState.present ? withClearedPlatformLoginState(req, response) : response;
+  const failReturnTo = safeReturnTo2(loginState.returnTo);
   const handoff = url.searchParams.get("handoff") || url.searchParams.get("token");
   if (!handoff) {
     return failRedirect(req, env2, "invalid_response", failReturnTo);
@@ -74708,29 +75337,37 @@ var callback_get_default = defineController2(async ({ req, env: env2 }) => {
       projectId: configuredProjectId
     }
   );
-  if (!payload || !payload.platform_user_id || !payload.role) {
+  if (!payload || !payload.platform_user_id || !payload.role || !payload.jti) {
     return failRedirect(req, env2, "invalid_handoff", failReturnTo);
   }
   if (!configuredProjectId && payload.project_id !== hostedInstanceRedirectId(req, env2)) {
     return failRedirect(req, env2, "invalid_handoff", failReturnTo);
   }
   if (payload.role === "api") {
-    const apiReturnTo = safeReturnTo2(url.searchParams.get("return_to"));
+    const apiReturnTo = failReturnTo;
     if (/^\/api\/auth\/device\/[A-Za-z0-9]{8,64}\/approve$/.test(apiReturnTo)) {
-      return new Response(null, {
+      return finishLoginState(new Response(null, {
         status: 302,
         headers: {
           Location: `${url.origin}${apiReturnTo}?handoff=${encodeURIComponent(handoff)}`
         }
-      });
+      }));
     }
     const landingRaw = env2.STANDARD_AGENTS_API_ROLE_LANDING_URL;
     const landing = typeof landingRaw === "string" ? landingRaw.trim() : "";
     if (landing && /^https:\/\//.test(landing)) {
-      return new Response(null, { status: 302, headers: { Location: landing } });
+      return finishLoginState(
+        new Response(null, { status: 302, headers: { Location: landing } })
+      );
     }
     return failRedirect(req, env2, "api_only_account");
   }
+  if (!loginState.valid) {
+    return beginPlatformLogin(req, env2, failReturnTo);
+  }
+  if (!await consumePlatformHandoffJti(env2, payload.jti, payload.exp)) {
+    return failRedirect(req, env2, "invalid_handoff", failReturnTo);
+  }
   const session = await mintLocalSessionForPlatformUser(env2, {
     platform_user_id: payload.platform_user_id,
     username: payload.username ?? null,
@@ -74740,14 +75377,15 @@ var callback_get_default = defineController2(async ({ req, env: env2 }) => {
     role: payload.role,
     permissions: payload.permissions ?? null
   });
-  const returnTo = safeReturnTo2(url.searchParams.get("return_to"));
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: `${url.origin}${returnTo}`,
-      "Set-Cookie": buildSessionCookie(req, session.token, SESSION_TTL_SECONDS2)
-    }
+  const returnTo = failReturnTo;
+  const headers = new Headers({
+    Location: `${url.origin}${returnTo}`
   });
+  headers.append("Set-Cookie", buildSessionCookie(req, session.token, SESSION_TTL_SECONDS3));
+  return withClearedPlatformLoginState(req, new Response(null, {
+    status: 302,
+    headers
+  }));
 });
 
 // src/api/auth/sa/start.get.ts
@@ -74757,12 +75395,7 @@ var start_get_default = defineController2(async ({ req, env: env2 }) => {
   }
   const url = new URL(req.url);
   const returnTo = url.searchParams.get("return_to") || "/";
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: platformLoginUrl(req, env2, returnTo)
-    }
-  });
+  return beginPlatformLogin(req, env2, returnTo);
 });
 
 // src/api/users/me/[...rest].ts
@@ -74907,6 +75540,7 @@ var index_delete_default = defineController2(async ({ req, env: env2 }) => {
     if (!key) {
       return Response.json({ error: "key query parameter required" }, { status: 400 });
     }
+    if (!isUserKvKeyClientWritable(key)) return reservedKvKeyResponse();
     const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
     const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
     if (typeof agentBuilder.setUserValue !== "function") {
@@ -74977,7 +75611,7 @@ var index_get_default4 = defineController2(async ({ req, env: env2 }) => {
 });
 
 // src/api/users/me/kv/index.post.ts
-var index_post_default8 = defineController2(async ({ req, env: env2 }) => {
+var index_post_default7 = defineController2(async ({ req, env: env2 }) => {
   try {
     const authResult = await requireAuth(req, env2);
     if (authResult instanceof Response) {
@@ -75003,6 +75637,7 @@ var index_post_default8 = defineController2(async ({ req, env: env2 }) => {
     if (typeof key !== "string" || key.length === 0) {
       return Response.json({ error: "key required" }, { status: 400 });
     }
+    if (!isUserKvKeyClientWritable(key)) return reservedKvKeyResponse();
     const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
     const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
     if (typeof agentBuilder.setUserValue !== "function") {
@@ -75041,13 +75676,39 @@ var stream_default3 = defineController2(async ({ req, env: env2 }) => {
   return forwardToUserScope(req, env2, authResult.user.id, "stream");
 });
 
-// src/api/auth/device/[code]/approve.get.ts
+// src/api/auth/device/[code]/_approval.ts
+var CONFIRMATION_TTL_SECONDS = 5 * 60;
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
 function page(title, body, ok) {
   return new Response(
-    `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title><style>body{background:#0a0c10;color:#e8ecf3;font:16px/1.6 ui-sans-serif,system-ui;display:flex;min-height:100vh;align-items:center;justify-content:center}div{max-width:420px;text-align:center;padding:40px;border:1px solid #232936;border-radius:14px;background:#11141b}h1{font-size:22px;color:${ok ? "#2dd4bf" : "#f87171"}}p{color:#8b93a7;margin-top:10px}</style></head><body><div><h1>${title}</h1><p>${body}</p></div></body></html>`,
-    { headers: { "Content-Type": "text/html; charset=utf-8" } }
+    `<!doctype html><html><head><meta charset="utf-8"><meta name="referrer" content="no-referrer"><title>${escapeHtml(title)}</title><style>body{background:#0a0c10;color:#e8ecf3;font:16px/1.6 ui-sans-serif,system-ui;display:flex;min-height:100vh;align-items:center;justify-content:center}main{max-width:420px;text-align:center;padding:40px;border:1px solid #232936;border-radius:14px;background:#11141b}h1{font-size:22px;color:${ok ? "#2dd4bf" : "#f87171"}}p{color:#8b93a7;margin-top:10px}</style></head><body><main><h1>${escapeHtml(title)}</h1><p>${escapeHtml(body)}</p></main></body></html>`,
+    {
+      headers: {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store",
+        "Referrer-Policy": "no-referrer",
+        "X-Content-Type-Options": "nosniff"
+      }
+    }
   );
 }
+function confirmationPage(req, code, confirmationToken, handoff) {
+  const url = new URL(req.url);
+  const handoffInput = handoff ? `<input type="hidden" name="handoff" value="${escapeHtml(handoff)}">` : "";
+  const shortCode = code.length > 12 ? `${code.slice(0, 6)}\u2026${code.slice(-6)}` : code;
+  const html = `<!doctype html><html><head><meta charset="utf-8"><meta name="referrer" content="no-referrer"><title>Approve device sign-in</title><style>body{background:#0a0c10;color:#e8ecf3;font:16px/1.6 ui-sans-serif,system-ui;display:flex;min-height:100vh;align-items:center;justify-content:center}main{max-width:440px;text-align:center;padding:40px;border:1px solid #232936;border-radius:14px;background:#11141b}h1{font-size:22px}p{color:#a5adbd}.code{font:600 18px ui-monospace,monospace;letter-spacing:.08em;color:#e8ecf3}form{display:flex;gap:12px;justify-content:center;margin-top:26px}button,a{border-radius:9px;padding:10px 18px;font:inherit;text-decoration:none}button{border:0;background:#2dd4bf;color:#07110f;font-weight:700;cursor:pointer}a{border:1px solid #394150;color:#cbd5e1}</style></head><body><main><h1>Approve device sign-in?</h1><p>A command-line client is requesting a personal instance API key for your account.</p><p class="code">${escapeHtml(shortCode)}</p><form method="post" action="${escapeHtml(url.pathname)}"><input type="hidden" name="confirmation_token" value="${escapeHtml(confirmationToken)}">${handoffInput}<button type="submit">Approve device</button><a href="/">Cancel</a></form></main></body></html>`;
+  return new Response(html, {
+    headers: {
+      "Content-Type": "text/html; charset=utf-8",
+      "Cache-Control": "no-store",
+      "Referrer-Policy": "no-referrer",
+      "X-Content-Type-Options": "nosniff",
+      "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'"
+    }
+  });
+}
 function outcome(env2, ok, reason, fallback) {
   const baseRaw = env2.STANDARD_AGENTS_DEVICE_OUTCOME_URL_BASE;
   const base = typeof baseRaw === "string" ? baseRaw.trim().replace(/\/+$/, "") : "";
@@ -75057,12 +75718,9 @@ function outcome(env2, ok, reason, fallback) {
   }
   return page(fallback.title, fallback.body, ok);
 }
-var approve_get_default = defineController2(async ({ req, env: env2, params }) => {
-  const code = params.code;
-  if (!code) return outcome(env2, false, "invalid_link", { title: "Missing code", body: "This device link is malformed." });
+async function resolveDeviceApprovalIdentity(req, env2) {
   const url = new URL(req.url);
-  let approvingUserId = null;
-  const handoff = url.searchParams.get("handoff");
+  const handoff = url.searchParams.get("handoff") ?? (req.method === "POST" ? (await req.clone().formData().catch(() => null))?.get("handoff")?.toString() ?? null : null);
   if (handoff && isPlatformHosted(env2)) {
     const configuredProjectId = typeof env2.STANDARD_AGENTS_PROJECT_ID === "string" ? env2.STANDARD_AGENTS_PROJECT_ID : void 0;
     const payload = await verifyPlatformSignedPayload(
@@ -75071,10 +75729,13 @@ var approve_get_default = defineController2(async ({ req, env: env2, params }) =
       { kind: "instance_handoff", projectId: configuredProjectId }
     );
     const projectOk = payload && (configuredProjectId || payload.project_id === hostedInstanceRedirectId(req, env2));
-    if (!payload || !payload.platform_user_id || !payload.role || !projectOk) {
-      return outcome(env2, false, "signin_failed", { title: "Sign in failed", body: "This sign-in link is invalid or has expired. Start again from your terminal." });
+    if (!payload || !payload.platform_user_id || !payload.role || !payload.jti || !projectOk) {
+      return outcome(env2, false, "signin_failed", {
+        title: "Sign in failed",
+        body: "This sign-in link is invalid or has expired. Start again from your terminal."
+      });
     }
-    const user = await upsertReplicaUserForPlatformProfile(env2, {
+    const platformProfile = {
       platform_user_id: payload.platform_user_id,
       username: payload.username ?? null,
       display_name: payload.display_name ?? null,
@@ -75082,27 +75743,163 @@ var approve_get_default = defineController2(async ({ req, env: env2, params }) =
       avatar_url: payload.avatar_url ?? null,
       role: payload.role,
       permissions: payload.permissions ?? null
-    });
-    approvingUserId = user.id;
-  } else {
-    const authResult = await requireAuth(req, env2);
-    if (authResult instanceof Response) {
-      const returnTo = encodeURIComponent(url.pathname);
-      const hosted = Boolean(env2.STANDARD_AGENTS_HOSTED && String(env2.STANDARD_AGENTS_HOSTED) !== "0" && String(env2.STANDARD_AGENTS_HOSTED).toLowerCase() !== "false");
-      const target = hosted ? `/api/auth/sa/start?return_to=${returnTo}` : `/login?return_to=${returnTo}`;
-      return new Response(null, { status: 302, headers: { Location: `${url.origin}${target}` } });
-    }
-    if (authResult.authType === "api_key") {
-      return outcome(env2, false, "session_required", { title: "Sign in required", body: "Device logins must be approved from a signed-in browser session." });
+    };
+    return {
+      confirmationSubject: `platform:${payload.platform_user_id}`,
+      handoff,
+      platformProfile,
+      platformHandoff: {
+        jti: payload.jti,
+        expires_at: payload.exp
+      }
+    };
+  }
+  const authResult = await requireAuth(req, env2);
+  if (authResult instanceof Response) {
+    if (req.method !== "GET") {
+      return outcome(env2, false, "session_required", {
+        title: "Sign in required",
+        body: "Return to the device link and sign in again before approving."
+      });
     }
-    approvingUserId = authResult.user.id;
+    const returnTo = encodeURIComponent(url.pathname);
+    const hosted = Boolean(
+      env2.STANDARD_AGENTS_HOSTED && String(env2.STANDARD_AGENTS_HOSTED) !== "0" && String(env2.STANDARD_AGENTS_HOSTED).toLowerCase() !== "false"
+    );
+    const target = hosted ? `/api/auth/sa/start?return_to=${returnTo}` : `/login?return_to=${returnTo}`;
+    return new Response(null, { status: 302, headers: { Location: `${url.origin}${target}` } });
+  }
+  if (authResult.authType === "api_key") {
+    return outcome(env2, false, "session_required", {
+      title: "Sign in required",
+      body: "Device logins must be approved from a signed-in browser session."
+    });
+  }
+  return {
+    confirmationSubject: `user:${authResult.user.id}`,
+    handoff: null,
+    localUserId: authResult.user.id
+  };
+}
+async function consumeDeviceApprovalHandoff(env2, identity) {
+  if (!identity.platformHandoff) return true;
+  return consumePlatformHandoffJti(
+    env2,
+    identity.platformHandoff.jti,
+    identity.platformHandoff.expires_at
+  );
+}
+async function materializeDeviceApprovalUser(env2, identity) {
+  if (identity.localUserId) return identity.localUserId;
+  if (!identity.platformProfile) {
+    throw new Error("Device approval identity is missing a local user and platform profile");
+  }
+  const user = await upsertReplicaUserForPlatformProfile(
+    env2,
+    identity.platformProfile
+  );
+  return user.id;
+}
+function encryptionKey(env2) {
+  const value = env2.ENCRYPTION_KEY;
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+async function createDeviceConfirmationToken(env2, code, confirmationSubject) {
+  const key = encryptionKey(env2);
+  if (!key) return null;
+  return signToken(JSON.stringify({
+    kind: "device_approval_confirmation",
+    code_hash: await hashToken(code),
+    subject: confirmationSubject,
+    exp: Math.floor(Date.now() / 1e3) + CONFIRMATION_TTL_SECONDS,
+    nonce: crypto.randomUUID()
+  }), key);
+}
+async function verifyDeviceConfirmationToken(env2, code, confirmationSubject, token) {
+  const key = encryptionKey(env2);
+  if (!key) return false;
+  const raw = await verifySignedToken(token, key);
+  if (!raw) return false;
+  try {
+    const payload = JSON.parse(raw);
+    return payload.kind === "device_approval_confirmation" && payload.code_hash === await hashToken(code) && payload.subject === confirmationSubject && typeof payload.exp === "number" && payload.exp >= Math.floor(Date.now() / 1e3);
+  } catch {
+    return false;
+  }
+}
+function isSameOriginApprovalPost(req) {
+  const url = new URL(req.url);
+  const origin = req.headers.get("Origin");
+  if (origin && origin !== url.origin) return false;
+  const fetchSite = req.headers.get("Sec-Fetch-Site");
+  return !fetchSite || fetchSite === "same-origin" || fetchSite === "none";
+}
+
+// src/api/auth/device/[code]/approve.get.ts
+var approve_get_default = defineController2(async ({ req, env: env2, params }) => {
+  const code = params.code;
+  if (!code) {
+    return outcome(env2, false, "invalid_link", {
+      title: "Missing code",
+      body: "This device link is malformed."
+    });
+  }
+  const identity = await resolveDeviceApprovalIdentity(req, env2);
+  if (identity instanceof Response) return identity;
+  const confirmationToken = await createDeviceConfirmationToken(
+    env2,
+    code,
+    identity.confirmationSubject
+  );
+  if (!confirmationToken) {
+    return outcome(env2, false, "signin_failed", {
+      title: "Sign in failed",
+      body: "This instance cannot create a secure device confirmation. Contact its administrator."
+    });
   }
+  return confirmationPage(req, code, confirmationToken, identity.handoff);
+});
+
+// src/api/auth/device/[code]/approve.post.ts
+var approve_post_default = defineController2(async ({ req, env: env2, params }) => {
+  const code = params.code;
+  if (!code) {
+    return outcome(env2, false, "invalid_link", {
+      title: "Missing code",
+      body: "This device link is malformed."
+    });
+  }
+  if (!isSameOriginApprovalPost(req)) {
+    return Response.json({ error: "Cross-origin device approval refused" }, { status: 403 });
+  }
+  const form = await req.clone().formData().catch(() => null);
+  const confirmationToken = form?.get("confirmation_token")?.toString() ?? "";
+  if (!confirmationToken) {
+    return Response.json({ error: "Device confirmation token required" }, { status: 403 });
+  }
+  const identity = await resolveDeviceApprovalIdentity(req, env2);
+  if (identity instanceof Response) return identity;
+  if (!await verifyDeviceConfirmationToken(
+    env2,
+    code,
+    identity.confirmationSubject,
+    confirmationToken
+  )) {
+    return Response.json({ error: "Invalid or expired device confirmation" }, { status: 403 });
+  }
+  if (!await consumeDeviceApprovalHandoff(env2, identity)) {
+    return outcome(env2, false, "signin_failed", {
+      title: "Sign in failed",
+      body: "This sign-in link was already used or has expired. Start again from your terminal."
+    });
+  }
+  const userId = await materializeDeviceApprovalUser(env2, identity);
   const token = generateApiKey();
   const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
   const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
   const ok = await agentBuilder.approveDeviceLogin({
     code_hash: await hashToken(code),
-    user_id: approvingUserId,
+    user_id: userId,
     token,
     token_hash: await hashToken(token),
     key_prefix: token.slice(0, 12),
@@ -75110,12 +75907,19 @@ var approve_get_default = defineController2(async ({ req, env: env2, params }) =
     key_name: "CLI device login"
   });
   if (!ok) {
-    return outcome(env2, false, "expired", { title: "Link expired", body: "This device login has expired or was already used. Start again from your terminal." });
+    return outcome(env2, false, "expired", {
+      title: "Link expired",
+      body: "This device login has expired or was already used. Start again from your terminal."
+    });
   }
-  return outcome(env2, true, "done", { title: "You're connected", body: "Standard Code is now signed in. Return to your terminal \u2014 it will pick up automatically." });
+  return outcome(env2, true, "done", {
+    title: "You're connected",
+    body: "Standard Code is now signed in. Return to your terminal \u2014 it will pick up automatically."
+  });
 });
 
 // src/api/skills/[name]/files/[...path].get.ts
+init_scope();
 var path_get_default = defineController2(async ({ req, env: env2, params }) => {
   const authResult = await requireAdmin(req, env2);
   if (authResult instanceof Response) return authResult;
@@ -75128,7 +75932,11 @@ var path_get_default = defineController2(async ({ req, env: env2, params }) => {
   const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
   const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
   try {
-    const content = await agentBuilder.getSkillFile(name15, filePath);
+    const content = await agentBuilder.getSkillFile(
+      { ownerId: SHARED_SKILL_OWNER },
+      name15,
+      filePath
+    );
     if (content === null) {
       return Response.json({ error: `File not found: ${filePath} in skill ${name15}` }, { status: 404 });
     }
@@ -75143,6 +75951,24 @@ var path_get_default = defineController2(async ({ req, env: env2, params }) => {
 
 // src/api/threads/[id]/fs/[...path].ts
 var CHUNK_SIZE2 = 1.75 * 1024 * 1024;
+var EXECUTABLE_DOCUMENT_MIME_TYPES = /* @__PURE__ */ new Set([
+  "text/html",
+  "image/svg+xml",
+  "application/xhtml+xml"
+]);
+function safeDownloadName(name15) {
+  return name15.replace(/["\\\r\n]/g, "_");
+}
+function fileResponseHeaders(file) {
+  const mimeType = file.mimeType.split(";", 1)[0]?.trim().toLowerCase();
+  const disposition = mimeType && EXECUTABLE_DOCUMENT_MIME_TYPES.has(mimeType) ? "attachment" : "inline";
+  return {
+    "Content-Type": file.mimeType,
+    "Content-Length": String(file.size),
+    "Content-Disposition": `${disposition}; filename="${safeDownloadName(file.name)}"`,
+    "X-Content-Type-Options": "nosniff"
+  };
+}
 function toAttachmentRef(file) {
   const metadata = file.metadata;
   const width = file.width ?? metadata?.width;
@@ -75233,8 +76059,9 @@ async function handleGet2(stub, path10, url) {
       headers: {
         "Content-Type": "image/jpeg",
         // Thumbnails are typically JPEG
-        "Cache-Control": "public, max-age=31536000"
+        "Cache-Control": "public, max-age=31536000",
         // Cache for 1 year
+        "X-Content-Type-Options": "nosniff"
       }
     });
   }
@@ -75274,11 +76101,7 @@ async function handleGet2(stub, path10, url) {
     bytes[i] = binary.charCodeAt(i);
   }
   return new Response(bytes, {
-    headers: {
-      "Content-Type": file.mimeType,
-      "Content-Length": String(file.size),
-      "Content-Disposition": `inline; filename="${file.name}"`
-    }
+    headers: fileResponseHeaders(file)
   });
 }
 function streamChunkedFile(stub, path10, file) {
@@ -75306,12 +76129,8 @@ function streamChunkedFile(stub, path10, file) {
     }
   })();
   return new Response(readable, {
-    headers: {
-      "Content-Type": file.mimeType,
-      "Content-Length": String(file.size),
-      "Content-Disposition": `inline; filename="${file.name}"`
-      // Note: We set Content-Length, but also use chunked transfer internally
-    }
+    // Note: We set Content-Length, but also use chunked transfer internally.
+    headers: fileResponseHeaders(file)
   });
 }
 async function handlePost2(stub, path10, req) {
@@ -75508,19 +76327,9 @@ async function handleChunkedUploadComplete(stub, filePath, req) {
 
 // src/api/threads/[id]/logs/[logId].get.ts
 var logId_get_default = defineController2(async ({ req, params, env: env2 }) => {
-  if (isPlatformHosted(env2)) {
-    const authResult = await requirePermission(req, env2, "logs");
-    if (authResult instanceof Response) {
-      return authResult;
-    }
-  } else {
-    const authContext = await authenticate(req, env2);
-    if (authContext && !hasPermission(authContext.user, "logs")) {
-      return Response.json(
-        { error: "Forbidden: 'logs' access required" },
-        { status: 403 }
-      );
-    }
+  const authResult = await requirePermission(req, env2, "logs");
+  if (authResult instanceof Response) {
+    return authResult;
   }
   const threadId = params.id;
   const logId = params.logId;
@@ -75932,19 +76741,9 @@ function createInspectProviderConfig(providerName, factory, env2) {
   };
 }
 var provider_get_default = defineController2(async ({ req, params, env: env2 }) => {
-  if (isPlatformHosted(env2)) {
-    const authResult = await requirePermission(req, env2, "logs");
-    if (authResult instanceof Response) {
-      return authResult;
-    }
-  } else {
-    const authContext = await authenticate(req, env2);
-    if (authContext && !hasPermission(authContext.user, "logs")) {
-      return Response.json(
-        { error: "Forbidden: 'logs' access required" },
-        { status: 403 }
-      );
-    }
+  const authResult = await requirePermission(req, env2, "logs");
+  if (authResult instanceof Response) {
+    return authResult;
   }
   const threadId = params.id;
   const logId = params.logId;
@@ -76164,30 +76963,28 @@ var provider_get_default = defineController2(async ({ req, params, env: env2 })
 
 // src/built-in-routes.ts
 var routeHandlers = {
-  "POST:/": index_post_default,
   "GET:/agents": agents_get_default,
   "GET:/api-keys": index_get_default,
-  "POST:/api-keys": index_post_default2,
+  "POST:/api-keys": index_post_default,
   "GET:/config": config_get_default,
   "GET:/diagnostics": diagnostics_get_default,
   "GET:/events": events_get_default,
   "GET:/hooks": hooks_get_default,
   "GET:/models": models_get_default,
-  "GET:/new-test": new_test_get_default,
   "GET:/platform-endpoint": platform_endpoint_default,
   "GET:/prompts": prompts_get_default,
   "GET:/providers": providers_get_default,
   "GET:/skills": index_get_default2,
-  "POST:/skills": index_post_default3,
-  "POST:/threads": index_post_default4,
+  "POST:/skills": index_post_default2,
+  "POST:/threads": index_post_default3,
   "GET:/threads": threads_default,
   "GET:/tools": tools_get_default,
   "GET:/users": index_get_default3,
-  "POST:/users": index_post_default5,
+  "POST:/users": index_post_default4,
   "GET:/agents/:name": name_get_default,
   "DELETE:/api-keys/:id": id_delete_default,
   "GET:/models/:name": name_get_default2,
-  "POST:/pack/:agentName": index_post_default6,
+  "POST:/pack/:agentName": index_post_default5,
   "GET:/prompts/:name": name_get_default3,
   "DELETE:/skills/:name": name_delete_default,
   "GET:/skills/:name": name_get_default4,
@@ -76196,18 +76993,19 @@ var routeHandlers = {
   "PATCH:/threads/:id": id_patch_default,
   "GET:/threads/:id": id_default,
   "GET:/tools/:name": name_get_default5,
-  "POST:/unpack/:packageId": index_post_default7,
+  "POST:/unpack/:packageId": index_post_default6,
   "DELETE:/users/:id": id_delete_default3,
   "PUT:/users/:id": id_put_default,
   "POST:/auth/bootstrap": bootstrap_post_default,
   "POST:/auth/brolly-control": brolly_control_post_default,
   "GET:/auth/config": config_get_default2,
+  "DELETE:/auth/current-key": current_key_delete_default,
   "POST:/auth/login": login_post_default,
-  "GET:/auth/logout": logout_get_default,
   "POST:/auth/logout": logout_post_default,
   "GET:/auth/me": me_get_default,
   "POST:/auth/platform-cleanup": platform_cleanup_post_default,
   "POST:/auth/platform-replica": platform_replica_post_default,
+  "POST:/auth/websocket-ticket": websocket_ticket_post_default,
   "GET:/envs/instance": instance_get_default,
   "PATCH:/envs/instance": instance_patch_default,
   "POST:/models/available": available_post_default,
@@ -76283,9 +77081,10 @@ var routeHandlers = {
   "GET:/users/me/hub": hub_default,
   "DELETE:/users/me/kv": index_delete_default,
   "GET:/users/me/kv": index_get_default4,
-  "POST:/users/me/kv": index_post_default8,
+  "POST:/users/me/kv": index_post_default7,
   "GET:/users/me/stream": stream_default3,
   "GET:/auth/device/:code/approve": approve_get_default,
+  "POST:/auth/device/:code/approve": approve_post_default,
   "GET:/skills/:name/files/**": path_get_default,
   "DELETE:/threads/:id/fs/**": path_default3,
   "POST:/threads/:id/fs/**": path_default3,