@standardagents/builder 0.38.0 → 0.38.2

package/dist/index.js

@@ -37,6 +37,14 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/skills/scope.ts
+var SHARED_SKILL_OWNER;
+var init_scope = __esm({
+  "src/skills/scope.ts"() {
+    SHARED_SKILL_OWNER = "__instance_shared__";
+  }
+});
+
 // src/agents/client-forwarding.ts
 function asForwarding(state) {
   return state;
@@ -3159,6 +3167,104 @@ var init_sessionTools = __esm({
   }
 });
 
+// src/utils/remoteAttachment.ts
+function parseAllowedHosts(value) {
+  if (typeof value !== "string") {
+    return /* @__PURE__ */ new Set();
+  }
+  return new Set(
+    value.split(",").map((host) => host.trim().toLowerCase().replace(/\.$/, "")).filter(Boolean)
+  );
+}
+function isForbiddenHostname(hostname) {
+  const normalized = hostname.toLowerCase().replace(/\.$/, "");
+  if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(normalized)) {
+    return true;
+  }
+  if (normalized.startsWith("[") && normalized.endsWith("]")) {
+    return true;
+  }
+  if (!normalized.includes(".")) {
+    return true;
+  }
+  return FORBIDDEN_HOST_SUFFIXES.some(
+    (suffix) => normalized === suffix.slice(1) || normalized.endsWith(suffix)
+  );
+}
+function validateRemoteAttachmentUrl(value, allowedHostsValue) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.port !== "" && url.port !== "443") {
+    return null;
+  }
+  const hostname = url.hostname.toLowerCase().replace(/\.$/, "");
+  if (isForbiddenHostname(hostname)) {
+    return null;
+  }
+  const allowedHosts = parseAllowedHosts(allowedHostsValue);
+  if (!allowedHosts.has(hostname)) {
+    return null;
+  }
+  return url;
+}
+async function fetchRemoteAttachment(location, allowedHostsValue, fetchImpl = fetch) {
+  let url = validateRemoteAttachmentUrl(location, allowedHostsValue);
+  if (!url) {
+    return null;
+  }
+  for (let redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount++) {
+    let response;
+    try {
+      response = await fetchImpl(url.toString(), {
+        redirect: "manual"
+      });
+    } catch {
+      return null;
+    }
+    if (!REDIRECT_STATUSES.has(response.status)) {
+      return response.ok ? response : null;
+    }
+    await response.body?.cancel().catch(() => void 0);
+    if (redirectCount === MAX_REDIRECTS) {
+      return null;
+    }
+    const redirectLocation = response.headers.get("Location");
+    if (!redirectLocation) {
+      return null;
+    }
+    let resolvedLocation;
+    try {
+      resolvedLocation = new URL(redirectLocation, url).toString();
+    } catch {
+      return null;
+    }
+    url = validateRemoteAttachmentUrl(resolvedLocation, allowedHostsValue);
+    if (!url) {
+      return null;
+    }
+  }
+  return null;
+}
+var REDIRECT_STATUSES, MAX_REDIRECTS, FORBIDDEN_HOST_SUFFIXES;
+var init_remoteAttachment = __esm({
+  "src/utils/remoteAttachment.ts"() {
+    REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+    MAX_REDIRECTS = 3;
+    FORBIDDEN_HOST_SUFFIXES = [
+      ".internal",
+      ".lan",
+      ".local",
+      ".localhost",
+      ".home",
+      ".test"
+    ];
+  }
+});
+
 // src/durable-objects/files.ts
 var files_exports = {};
 __export(files_exports, {
@@ -3896,6 +4002,7 @@ var init_ToolExecutor = __esm({
     init_types();
     init_ThreadStateImpl();
     init_sessionTools();
+    init_remoteAttachment();
     SUBAGENT_CREATE_TOOL = "subagent_create";
     SUBAGENT_MESSAGE_TOOL = "subagent_message";
     SUBAGENTS_LIST_TOOL = "subagents";
@@ -4944,7 +5051,8 @@ Message one with subagent_message(referenceId, message).`
               stub,
               state.thread.instance,
               childResult.attachments,
-              `from-subagent-${childThreadId}`
+              `from-subagent-${childThreadId}`,
+              state.env.AGENT_BUILDER_ATTACHMENT_FETCH_HOSTS
             );
             if (resumable) {
               await this.settleResumableChildAfterRun(
@@ -4977,7 +5085,8 @@ Message one with subagent_message(referenceId, message).`
                 stub,
                 state.thread.instance,
                 childResult.attachments,
-                `from-subagent-${childThreadId}`
+                `from-subagent-${childThreadId}`,
+                state.env.AGENT_BUILDER_ATTACHMENT_FETCH_HOSTS
               );
               const messageContent = this.formatSubagentTerminalMessage(
                 childThreadId,
@@ -5391,7 +5500,8 @@ Message one with subagent_message(referenceId, message).`
           state.thread.instance,
           childThread,
           parentAttachments,
-          `from-parent-${state.threadId}`
+          `from-parent-${state.threadId}`,
+          state.env.AGENT_BUILDER_ATTACHMENT_FETCH_HOSTS
         );
         const targetRole = receivesMessages === "side_a" ? "user" : "assistant";
         const baseTimestamp = Date.now() * 1e3;
@@ -5651,7 +5761,7 @@ Reference: ${referenceId}` : `Reference: ${referenceId}`;
         const shortId = crypto.randomUUID().slice(0, 8);
         return `/attachments/${normalizedStem}-${shortId}.${finalExt}`;
       }
-      static async copyAttachmentsBetweenThreads(sourceThread, targetThread, attachments, _pathPrefix) {
+      static async copyAttachmentsBetweenThreads(sourceThread, targetThread, attachments, _pathPrefix, allowedAttachmentFetchHosts) {
         if (!attachments || attachments.length === 0) {
           return [];
         }
@@ -5679,7 +5789,8 @@ Reference: ${referenceId}` : `Reference: ${referenceId}`;
             const copiedData = await this.readAttachmentDataFromSource(
               sourceThread,
               attachment.path,
-              sourceFile
+              sourceFile,
+              allowedAttachmentFetchHosts
             );
             if (!copiedData) {
               continue;
@@ -5736,7 +5847,7 @@ Reference: ${referenceId}` : `Reference: ${referenceId}`;
         }
         return copied;
       }
-      static async readAttachmentDataFromSource(sourceThread, path21, sourceFile) {
+      static async readAttachmentDataFromSource(sourceThread, path21, sourceFile, allowedAttachmentFetchHosts) {
         const sourceData = await sourceThread.readFile(path21);
         if (sourceData.success && sourceData.data) {
           return sourceData.data;
@@ -5745,14 +5856,17 @@ Reference: ${referenceId}` : `Reference: ${referenceId}`;
           return null;
         }
         const location = sourceFile.location;
-        if (!location || !/^https?:\/\//i.test(location)) {
+        if (!location) {
+          return null;
+        }
+        const response = await fetchRemoteAttachment(
+          location,
+          allowedAttachmentFetchHosts
+        );
+        if (!response) {
           return null;
         }
         try {
-          const response = await fetch(location);
-          if (!response.ok) {
-            return null;
-          }
           const buffer = await response.arrayBuffer();
           return this.arrayBufferToBase64(buffer);
         } catch {
@@ -6006,7 +6120,8 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
           state.thread.instance,
           childStub,
           sourceAttachments,
-          `from-parent-${state.threadId}`
+          `from-parent-${state.threadId}`,
+          state.env.AGENT_BUILDER_ATTACHMENT_FETCH_HOSTS
         );
         await childStub.queueMessage(referenceId, {
           role: receivesMessages === "side_a" ? "user" : "assistant",
@@ -12988,6 +13103,32 @@ var ThreadStateImpl_exports = {};
 __export(ThreadStateImpl_exports, {
   ThreadStateImpl: () => ThreadStateImpl
 });
+function isRuntimeDurableNamespace(value) {
+  return value !== null && typeof value === "object" && "idFromName" in value && typeof value.idFromName === "function" && "get" in value && typeof value.get === "function";
+}
+function isThreadStateRuntimeEnvironment(value) {
+  return value !== null && typeof value === "object" && "AGENT_BUILDER" in value && isRuntimeDurableNamespace(value.AGENT_BUILDER) && (!("AGENT_BUILDER_USER_HUB" in value) || value.AGENT_BUILDER_USER_HUB === void 0 || isRuntimeDurableNamespace(value.AGENT_BUILDER_USER_HUB));
+}
+function confinedUserEndpointUrl(userId, endpoint) {
+  const base = new URL(
+    `https://user-hub/users/${encodeURIComponent(userId)}/endpoints/`
+  );
+  const relative4 = endpoint.replace(/^\/+/, "");
+  let decoded;
+  try {
+    decoded = decodeURIComponent(relative4);
+  } catch {
+    throw new Error("Invalid user endpoint path: malformed percent encoding.");
+  }
+  if (decoded.includes("\\") || decoded.includes("?") || decoded.includes("#") || /[\u0000-\u001f\u007f]/.test(decoded) || decoded.split("/").some((segment) => segment === "." || segment === "..")) {
+    throw new Error("Invalid user endpoint path: traversal and URL syntax are not allowed.");
+  }
+  const resolved = new URL(relative4, base);
+  if (resolved.origin !== base.origin || !resolved.pathname.startsWith(base.pathname)) {
+    throw new Error("Invalid user endpoint path: endpoint escaped the user namespace.");
+  }
+  return resolved.toString();
+}
 function hasLocalCodeExecutionRuntime(threadInstance) {
   const candidate = threadInstance;
   return Boolean(candidate.env && candidate.ctx);
@@ -13168,6 +13309,7 @@ function runCodeViaThreadRpc(threadInstance, threadId, source, options) {
 var ThreadStateImpl, ExecutionStateImpl;
 var init_ThreadStateImpl = __esm({
   "src/agents/ThreadStateImpl.ts"() {
+    init_scope();
     init_client_forwarding();
     init_types();
     init_utilities();
@@ -13401,6 +13543,14 @@ var init_ThreadStateImpl = __esm({
         }
         return value;
       }
+      async instanceEnv(propertyName) {
+        const agentBuilder = this._getAgentBuilderStub();
+        if (typeof agentBuilder.getInstanceEnv !== "function") {
+          throw new Error("instanceEnv is not supported by this runtime");
+        }
+        const values = await agentBuilder.getInstanceEnv();
+        return values[propertyName];
+      }
       async envType(propertyName) {
         const agentBuilder = this._getAgentBuilderStub();
         if (typeof agentBuilder.resolveThreadEnvType === "function") {
@@ -14431,12 +14581,11 @@ var init_ThreadStateImpl = __esm({
        * dispatcher recorded in the runtime context instead.
        */
       _getRuntimeEnv() {
-        const contextEnv = this._runtimeContext.env;
-        if (contextEnv?.AGENT_BUILDER) {
-          return contextEnv;
+        if (isThreadStateRuntimeEnvironment(this._runtimeContext.env)) {
+          return this._runtimeContext.env;
         }
         const instanceEnv = this._threadInstance.env;
-        if (!instanceEnv?.AGENT_BUILDER) {
+        if (!isThreadStateRuntimeEnvironment(instanceEnv)) {
           throw new Error(
             "No runtime environment available on this ThreadState. Stub-backed states must be constructed with runtimeContext.env."
           );
@@ -14453,9 +14602,7 @@ var init_ThreadStateImpl = __esm({
         return namespace.get(namespace.idFromName(userId));
       }
       // ─────────────────────────────────────────────────────────────────────────
-      // Skills — instance-global Agent Skills library, backed by the
-      // DurableAgentBuilder singleton (skills are never stored per-thread or on
-      // a client machine).
+      // Skills — owner-scoped library plus explicitly shared administrator skills.
       // ─────────────────────────────────────────────────────────────────────────
       /**
        * The profile of the user this thread belongs to (identity fields only —
@@ -14478,9 +14625,8 @@ var init_ThreadStateImpl = __esm({
                 "Reentrant user-scope call: this ThreadState was raised from user-scope code; state.user().call() is unavailable here."
               );
             }
-            const path21 = endpoint.replace(/^\/+/, "");
             return hub().fetch(
-              new Request(`https://user-hub/users/${encodeURIComponent(userId)}/endpoints/${path21}`, {
+              new Request(confinedUserEndpointUrl(userId, endpoint), {
                 method: "POST",
                 headers: {
                   "Content-Type": "application/json",
@@ -14540,18 +14686,42 @@ var init_ThreadStateImpl = __esm({
       }
       get skills() {
         const stub = this._getAgentBuilderStub();
+        const ownerId = this._metadata.user_id ?? SHARED_SKILL_OWNER;
+        const scope = {
+          ownerId,
+          includeShared: ownerId !== SHARED_SKILL_OWNER
+        };
+        const requireMutationAdmin = async () => {
+          const userId = this._metadata.user_id;
+          if (!userId) {
+            throw new Error("Skill mutations require an authenticated instance admin.");
+          }
+          const user = await stub.getUserById(userId);
+          if (user?.role !== "admin") {
+            throw new Error("Skill mutations require an instance admin.");
+          }
+        };
         return {
-          list: (options) => stub.listSkills(options),
+          list: (options) => stub.listSkills(scope, options),
           get: async (name) => {
-            const metadata = await stub.getSkill(name);
+            const metadata = await stub.getSkill(scope, name);
             if (!metadata) return null;
-            const skillMd = await stub.getSkillFile(name, "SKILL.md") ?? "";
+            const skillMd = await stub.getSkillFile(scope, name, "SKILL.md") ?? "";
             return { metadata, skillMd };
           },
-          readFile: (name, path21) => stub.getSkillFile(name, path21),
-          install: (files) => stub.upsertSkill(files),
-          setEnabled: (name, enabled) => stub.setSkillEnabled(name, enabled),
-          remove: (name) => stub.deleteSkill(name)
+          readFile: (name, path21) => stub.getSkillFile(scope, name, path21),
+          install: async (files) => {
+            await requireMutationAdmin();
+            return stub.upsertSkill(scope, files);
+          },
+          setEnabled: async (name, enabled) => {
+            await requireMutationAdmin();
+            return stub.setSkillEnabled(scope, name, enabled);
+          },
+          remove: async (name) => {
+            await requireMutationAdmin();
+            return stub.deleteSkill(scope, name);
+          }
         };
       }
       // ─────────────────────────────────────────────────────────────────────────
@@ -15389,6 +15559,27 @@ declare module 'virtual:@standardagents/builder' {
     validateSession(tokenHash: string): Promise<{ user_id: string; expires_at: number } | null>;
     cleanupSessions(): Promise<number>;
     deleteSession(tokenHash: string): Promise<void>;
+    createSuperAdminSession(params: {
+      token_hash: string;
+      expires_at: number;
+    }): Promise<void>;
+    validateSuperAdminSession(tokenHash: string): Promise<boolean>;
+    deleteSuperAdminSession(tokenHash: string): Promise<void>;
+    createWebSocketTicket(params: {
+      ticket_hash: string;
+      pathname: string;
+      auth_json: string;
+      expires_at: number;
+    }): Promise<void>;
+    consumeWebSocketTicket(params: {
+      ticket_hash: string;
+      pathname: string;
+    }): Promise<string | null>;
+    consumeAuthRateLimit(params: {
+      key: string;
+      limit: number;
+      window_seconds: number;
+    }): Promise<{ allowed: boolean; retry_after: number; remaining: number }>;
 
     // API key methods
     createApiKey(params: {
@@ -15990,6 +16181,92 @@ function resolveLocalBootstrapCookie(projectRoot, routePath, cookieHeader) {
   return findLocalBootstrapSession(projectRoot)?.session.session_cookie ?? null;
 }
 
+// src/utils/auth.ts
+var SUPER_ADMIN_TOKEN_TTL_SECONDS = 12 * 60 * 60;
+async function hashToken(token) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(token);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  const hashArray = new Uint8Array(hashBuffer);
+  return Array.from(hashArray, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+var SESSION_COOKIE_NAME = "agtuser_session";
+function readSessionCookie(request) {
+  const header = request.headers.get("Cookie");
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() === SESSION_COOKIE_NAME) {
+      return decodeURIComponent(part.slice(eq + 1).trim()) || null;
+    }
+  }
+  return null;
+}
+function isValidUserToken(token) {
+  return token.startsWith("agtuser_") && token.length > 10;
+}
+function isValidApiKey(key) {
+  return key.startsWith("agtbldr_") && key.length > 10 || key.startsWith("sak_live_") && key.length > 10;
+}
+async function verifySignedToken(signedToken, encryptionKey) {
+  try {
+    const parts = signedToken.split(".");
+    if (parts.length !== 2) {
+      return null;
+    }
+    const [payloadB64, signatureB64] = parts;
+    const encoder = new TextEncoder();
+    const keyData = encoder.encode(encryptionKey);
+    const cryptoKey = await crypto.subtle.importKey(
+      "raw",
+      keyData,
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["verify"]
+    );
+    const payloadData = base64ToBuffer(payloadB64);
+    const signature = base64ToBuffer(signatureB64);
+    const isValid = await crypto.subtle.verify("HMAC", cryptoKey, signature, payloadData);
+    if (!isValid) {
+      return null;
+    }
+    const decoder = new TextDecoder();
+    return decoder.decode(payloadData);
+  } catch (error) {
+    console.error("Error verifying signed token:", error);
+    return null;
+  }
+}
+async function verifySuperAdminToken(token, encryptionKey) {
+  const payload = await verifySignedToken(token, encryptionKey);
+  if (!payload) {
+    return false;
+  }
+  const parts = payload.split(":");
+  if (parts.length !== 3 || parts[0] !== "super_admin") {
+    return false;
+  }
+  const timestamp = parseInt(parts[1], 10);
+  if (!Number.isFinite(timestamp)) {
+    return false;
+  }
+  const age = Date.now() - timestamp;
+  const maxAge = SUPER_ADMIN_TOKEN_TTL_SECONDS * 1e3;
+  if (age < 0 || age > maxAge) {
+    return false;
+  }
+  return true;
+}
+function base64ToBuffer(base64) {
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
 // src/sdk/generators/generateModelFile.ts
 function generateModelFile(data, options) {
   const { providerName, providerPackage, defaultImport } = options;
@@ -16055,7 +16332,7 @@ function generateModelFile(data, options) {
   return lines.join("\n");
 }
 function escapeString(str) {
-  return str.replace(/'/g, "\\'").replace(/\\/g, "\\\\");
+  return str.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
 }
 
 // src/sdk/generators/jsonSchemaToZod.ts
@@ -16586,7 +16863,7 @@ function formatSideConfig(config) {
   return parts.join("\n");
 }
 function escapeString3(str) {
-  return str.replace(/'/g, "\\'").replace(/\\/g, "\\\\");
+  return str.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
 }
 function formatSessionBinding(binding) {
   if (typeof binding === "string") {
@@ -21408,14 +21685,13 @@ var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
   "/api/auth/oauth/github",
   "/api/auth/oauth/google",
   "/api/auth/oauth/github/callback",
-  "/api/auth/oauth/google/callback",
-  "/api/hooks"
+  "/api/auth/oauth/google/callback"
 ]);
 function isProviderIconRoute(routePath) {
   return /^\/api\/providers\/[^/]+\/icon$/.test(routePath);
 }
 function isHostedInstance(env) {
-  const value = env?.STANDARD_AGENTS_HOSTED;
+  const value = env && typeof env === "object" ? Reflect.get(env, "STANDARD_AGENTS_HOSTED") : void 0;
   if (typeof value === "string") {
     const normalized = value.trim().toLowerCase();
     return normalized !== "" && normalized !== "0" && normalized !== "false";
@@ -21440,10 +21716,54 @@ function isPublicApiRoute(routePath, request, env) {
   if (isProviderIconRoute(routePath)) {
     return true;
   }
-  if (!isTrustedLocalDevelopmentRequest(request, env)) return false;
-  return routePath === "/api/threads" || routePath.startsWith("/api/threads/") || routePath === "/api/platform" || routePath.startsWith("/api/platform/") || routePath === "/api/platform-session" || routePath.startsWith("/api/platform-session/") || routePath === "/api/platform-auth" || routePath.startsWith("/api/platform-auth/");
+  return routePath === "/api/platform-auth/bootstrap" && isTrustedLocalDevelopmentRequest(request, env);
+}
+function requestObservedOrigins(request) {
+  const origins = /* @__PURE__ */ new Set();
+  let url = null;
+  try {
+    url = new URL(request.url);
+    origins.add(url.origin);
+  } catch {
+    url = null;
+  }
+  const forwardedHost = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const host = forwardedHost || request.headers.get("host")?.trim();
+  if (!host) return origins;
+  const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase();
+  const schemes = /* @__PURE__ */ new Set();
+  if (forwardedProto === "http" || forwardedProto === "https") schemes.add(forwardedProto);
+  if (url) schemes.add(url.protocol.replace(":", ""));
+  if (schemes.size === 0) {
+    schemes.add(host.endsWith(".orb.local") ? "https" : "http");
+  }
+  for (const scheme of schemes) {
+    try {
+      origins.add(new URL(`${scheme}://${host}`).origin);
+    } catch {
+    }
+  }
+  return origins;
+}
+function isSameOriginBrowserRequest(request) {
+  const fetchSite = request.headers.get("Sec-Fetch-Site")?.trim().toLowerCase();
+  if (fetchSite === "same-origin" || fetchSite === "none") {
+    return true;
+  }
+  if (fetchSite) {
+    return false;
+  }
+  const origin = request.headers.get("Origin")?.trim();
+  if (!origin) return true;
+  if (origin === "null") return false;
+  try {
+    return requestObservedOrigins(request).has(new URL(origin).origin);
+  } catch {
+    return false;
+  }
 }
 function isAdminOnlyApiRoute(routePath, method = "GET") {
+  if (routePath === "/api/hooks") return true;
   if (routePath === "/api/skills" || routePath.startsWith("/api/skills/")) return true;
   if (routePath === "/api/pack" || routePath.startsWith("/api/pack/")) return true;
   if (routePath === "/api/unpack" || routePath.startsWith("/api/unpack/")) return true;
@@ -21462,6 +21782,9 @@ function isAdminOnlyApiRoute(routePath, method = "GET") {
 }
 
 // src/plugin/dev-middleware.ts
+function isEncryptedSocket(socket) {
+  return "encrypted" in socket && socket.encrypted === true;
+}
 function readRawRequestBody(req) {
   return new Promise((resolve3, reject) => {
     const chunks = [];
@@ -21486,6 +21809,36 @@ function resolveContainedFile(baseDir, requestPath) {
     return null;
   }
 }
+function firstHeader(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+function isSameOriginDevRequest(req) {
+  const fetchSite = firstHeader(req.headers["sec-fetch-site"])?.trim().toLowerCase();
+  if (fetchSite && fetchSite !== "same-origin" && fetchSite !== "none") {
+    return false;
+  }
+  const origin = firstHeader(req.headers.origin)?.trim();
+  if (!origin) return true;
+  if (origin === "null") return false;
+  try {
+    const forwardedProtocol = firstHeader(req.headers["x-forwarded-proto"])?.split(",")[0]?.trim().toLowerCase();
+    const protocol = forwardedProtocol === "https" || forwardedProtocol === "http" ? forwardedProtocol : isEncryptedSocket(req.socket) ? "https" : "http";
+    const requestOrigin = new URL(`${protocol}://${String(req.headers.host || "").trim()}`).origin;
+    return new URL(origin).origin === requestOrigin;
+  } catch {
+    return false;
+  }
+}
+function hasDevAuthoringCredential(req) {
+  const cookie = firstHeader(req.headers.cookie) || "";
+  const hasSession = cookie.split(";").some((part) => {
+    const separator = part.indexOf("=");
+    return separator !== -1 && part.slice(0, separator).trim() === SESSION_COOKIE_NAME && part.slice(separator + 1).trim() !== "";
+  });
+  if (hasSession) return true;
+  const authorization = firstHeader(req.headers.authorization)?.trim() || "";
+  return /^Bearer\s+\S+$/.test(authorization);
+}
 function injectUiConfigIntoHtml(htmlContent) {
   const configScript = `<script>window.__AGENTBUILDER_CONFIG__ = { devMode: true };</script>`;
   return htmlContent.replace(/\/agents\//g, "/").replace("</head>", `${configScript}</head>`);
@@ -21540,11 +21893,21 @@ function createDevMiddleware(server, context) {
       );
     } catch {
     }
-    if (isAdminOnlyApiRoute(routePath, method) && !trustedLocalHost) {
-      res.statusCode = 403;
-      res.setHeader("Content-Type", "application/json");
-      res.end(JSON.stringify({ error: "Authoring APIs are available only from local development hosts" }));
-      return;
+    if (isAdminOnlyApiRoute(routePath, method)) {
+      if (!trustedLocalHost || !isSameOriginDevRequest(req)) {
+        res.statusCode = 403;
+        res.setHeader("Content-Type", "application/json");
+        res.setHeader("Cache-Control", "no-store");
+        res.end(JSON.stringify({ error: "Authoring APIs require a same-origin local request" }));
+        return;
+      }
+      if (!hasDevAuthoringCredential(req)) {
+        res.statusCode = 401;
+        res.setHeader("Content-Type", "application/json");
+        res.setHeader("Cache-Control", "no-store");
+        res.end(JSON.stringify({ error: "Authoring APIs require an authenticated local session" }));
+        return;
+      }
     }
     if (await handleConfigApiRequest({
       req,
@@ -22199,8 +22562,13 @@ import {
   canAccessThread,
   endpointCallerFromAuth,
   isHostedInstance,
+  isTrustedLocalDevelopmentRequest,
+  isSameOriginBrowserRequest,
   isPublicApiRoute,
   isAdminOnlyApiRoute,
+  applyRuntimeCors,
+  runtimeCorsHeaders,
+  runtimePreflightResponse,
 } from "@standardagents/builder/runtime";
 import { isThreadEndpoint, getEndpointAccess } from "@standardagents/spec";
 
@@ -22257,71 +22625,34 @@ function isHtmlNavigationRequest(request) {
   return (accept === '' || accept === '*/*') && isUiNavigationPath(pathname);
 }
 
-// CORS headers for API responses
-const CORS_HEADERS = {
-  "Access-Control-Allow-Origin": "*",
-  "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
-  "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Requested-With",
-  "Access-Control-Max-Age": "86400",
-};
-
 // Helper to create headers with CORS
-function corsHeaders(contentType) {
+function corsHeaders(contentType, request, env) {
   return {
     "Content-Type": contentType,
-    ...CORS_HEADERS,
+    ...runtimeCorsHeaders(request, env),
   };
 }
 
-// Helper to add CORS headers to any Response without touching the body
-function addCorsHeaders(response) {
-  // Skip WebSocket upgrade responses - they can't be wrapped
-  if (response.status === 101) {
-    return response;
-  }
-
-  // Skip if already has CORS headers
-  if (response.headers.has("Access-Control-Allow-Origin")) {
-    return response;
-  }
-
-  // Prefer mutating the original Response headers. Rebuilding a Response from
-  // response.headers can drop special headers such as Set-Cookie in Worker
-  // runtimes, even when the header is not visible through Headers.has().
-  try {
-    for (const [key, value] of Object.entries(CORS_HEADERS)) {
-      response.headers.set(key, value);
-    }
-    return response;
-  } catch {
-    // Some Responses, especially fetched upstream responses, have immutable
-    // headers. Fall back to wrapping those responses.
-  }
-
-  // Create new headers with CORS added
-  const newHeaders = new Headers(response.headers);
-  for (const [key, value] of Object.entries(CORS_HEADERS)) {
-    newHeaders.set(key, value);
-  }
-
-  // Return new Response with same body stream (not cloned, just transferred)
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: newHeaders,
-  });
-}
-
 export async function router(request, env) {
   const url = new URL(request.url);
   const pathname = url.pathname;
 
   // Handle CORS preflight requests
   if (request.method === "OPTIONS") {
-    return new Response(null, {
-      status: 204,
-      headers: CORS_HEADERS,
-    });
+    return runtimePreflightResponse(request, env);
+  }
+
+  // WebSockets do not use CORS. Reject foreign browser provenance before
+  // route dispatch so a malicious page cannot open a local stream/bridge even
+  // if a browser were to attach ambient cookies to the handshake.
+  if (
+    isTrustedLocalDevelopmentRequest(request, env) &&
+    !isSameOriginBrowserRequest(request)
+  ) {
+    return Response.json(
+      { error: "Cross-origin access is disabled for local development" },
+      { status: 403, headers: { "Cache-Control": "no-store" } }
+    );
   }
 
   const routePath = pathname || "/";
@@ -22363,19 +22694,22 @@ ${packedThreadRouteCode}
     // across requests.
     let threadAccess = null;
 
-    // Require authentication for all API routes except public ones
+    // Require authentication for all API routes except public ones.
+    // WebSocket tickets are single-use and are consumed here. Controllers
+    // must reuse context.auth (resolveRequestAuth) rather than calling
+    // requireAuth again, or a ticket-only upgrade will 401.
     if (isApiRoute && !publicRoute) {
       const authResult = await requireAuth(request, env);
 
       // If requireAuth returns a Response, it's an error (401)
       if (authResult instanceof Response) {
-        return addCorsHeaders(authResult);
+        return applyRuntimeCors(authResult, request, env);
       }
 
       authContext = authResult;
 
       if (isAdminOnlyApiRoute(routePath, request.method) && authContext.user.role !== 'admin') {
-        return addCorsHeaders(Response.json({ error: 'Forbidden: Admin access required' }, { status: 403 }));
+        return applyRuntimeCors(Response.json({ error: 'Forbidden: Admin access required' }, { status: 403 }), request, env);
       }
 
       if (routePath.startsWith('/api/threads/')) {
@@ -22389,10 +22723,10 @@ ${packedThreadRouteCode}
           const agentBuilder = env.AGENT_BUILDER.get(agentBuilderId);
           const thread = await agentBuilder.getThread(threadId);
           if (!thread) {
-            return addCorsHeaders(Response.json({ error: \`Thread not found: \${threadId}\` }, { status: 404 }));
+            return applyRuntimeCors(Response.json({ error: \`Thread not found: \${threadId}\` }, { status: 404 }), request, env);
           }
           if (!canAccessThread(authContext, thread)) {
-            return addCorsHeaders(Response.json({ error: "Forbidden: You don't have access to this thread" }, { status: 403 }));
+            return applyRuntimeCors(Response.json({ error: "Forbidden: You don't have access to this thread" }, { status: 403 }), request, env);
           }
           threadAccess = { threadId, thread };
         }
@@ -22435,16 +22769,16 @@ ${packedThreadRouteCode}
     const result = await controller(context);
 
     if (result instanceof Response) {
-      return addCorsHeaders(result);
+      return applyRuntimeCors(result, request, env);
     }
     if (typeof result === "string") {
       return new Response(result, {
-        headers: corsHeaders("text/plain"),
+        headers: corsHeaders("text/plain", request, env),
       });
     }
     // JSON responses get CORS headers
     return new Response(JSON.stringify(result), {
-      headers: corsHeaders("application/json"),
+      headers: corsHeaders("application/json", request, env),
     });
   }
 
@@ -23211,95 +23545,68 @@ var builder = agentbuilder;
 // src/router/index.ts
 init_ThreadStateImpl();
 
-// src/utils/auth.ts
-async function hashToken(token) {
-  const encoder = new TextEncoder();
-  const data = encoder.encode(token);
-  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-  const hashArray = new Uint8Array(hashBuffer);
-  return Array.from(hashArray, (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-var SESSION_COOKIE_NAME = "agtuser_session";
-function readSessionCookie(request) {
-  const header = request.headers.get("Cookie");
-  if (!header) return null;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq === -1) continue;
-    if (part.slice(0, eq).trim() === SESSION_COOKIE_NAME) {
-      return decodeURIComponent(part.slice(eq + 1).trim()) || null;
+// src/routing/cors.ts
+var RUNTIME_CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Requested-With",
+  "Access-Control-Max-Age": "86400"
+};
+var CORS_RESPONSE_HEADERS = [
+  "Access-Control-Allow-Origin",
+  "Access-Control-Allow-Methods",
+  "Access-Control-Allow-Headers",
+  "Access-Control-Max-Age",
+  "Access-Control-Allow-Credentials",
+  "Access-Control-Expose-Headers"
+];
+function mutateCorsHeaders(headers, exposeCors) {
+  if (exposeCors) {
+    for (const [key, value] of Object.entries(RUNTIME_CORS_HEADERS)) {
+      if (!headers.has(key)) headers.set(key, value);
     }
+    return;
+  }
+  for (const key of CORS_RESPONSE_HEADERS) {
+    headers.delete(key);
   }
-  return null;
 }
-function isValidUserToken(token) {
-  return token.startsWith("agtuser_") && token.length > 10;
+function exposesRuntimeCors(request, env) {
+  return !isTrustedLocalDevelopmentRequest(request, env);
 }
-function isValidApiKey(key) {
-  return key.startsWith("agtbldr_") && key.length > 10 || key.startsWith("sak_live_") && key.length > 10;
+function runtimeCorsHeaders(request, env) {
+  return exposesRuntimeCors(request, env) ? { ...RUNTIME_CORS_HEADERS } : {};
 }
-async function verifySignedToken(signedToken, encryptionKey) {
+function applyRuntimeCors(response, request, env) {
+  if (response.status === 101) return response;
+  const exposeCors = exposesRuntimeCors(request, env);
   try {
-    const parts = signedToken.split(".");
-    if (parts.length !== 2) {
-      return null;
-    }
-    const [payloadB64, signatureB64] = parts;
-    const encoder = new TextEncoder();
-    const keyData = encoder.encode(encryptionKey);
-    const cryptoKey = await crypto.subtle.importKey(
-      "raw",
-      keyData,
-      { name: "HMAC", hash: "SHA-256" },
-      false,
-      ["verify"]
-    );
-    const payloadData = base64ToBuffer(payloadB64);
-    const signature = base64ToBuffer(signatureB64);
-    const isValid = await crypto.subtle.verify("HMAC", cryptoKey, signature, payloadData);
-    if (!isValid) {
-      return null;
-    }
-    const decoder = new TextDecoder();
-    return decoder.decode(payloadData);
-  } catch (error) {
-    console.error("Error verifying signed token:", error);
-    return null;
-  }
-}
-async function verifySuperAdminToken(token, encryptionKey) {
-  const payload = await verifySignedToken(token, encryptionKey);
-  if (!payload) {
-    return false;
-  }
-  const parts = payload.split(":");
-  if (parts.length !== 3 || parts[0] !== "super_admin") {
-    return false;
-  }
-  const timestamp = parseInt(parts[1], 10);
-  const age = Date.now() - timestamp;
-  const maxAge = 30 * 24 * 60 * 60 * 1e3;
-  if (age > maxAge) {
-    return false;
+    mutateCorsHeaders(response.headers, exposeCors);
+    return response;
+  } catch {
   }
-  return true;
+  const headers = new Headers(response.headers);
+  mutateCorsHeaders(headers, exposeCors);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
 }
-function base64ToBuffer(base64) {
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
+function runtimePreflightResponse(request, env) {
+  if (!exposesRuntimeCors(request, env)) {
+    return Response.json(
+      { error: "Cross-origin access is disabled for local development" },
+      { status: 403, headers: { "Cache-Control": "no-store" } }
+    );
   }
-  return bytes;
+  return new Response(null, {
+    status: 204,
+    headers: RUNTIME_CORS_HEADERS
+  });
 }
 
 // src/middleware/auth.ts
-var CORS_HEADERS = {
-  "Access-Control-Allow-Origin": "*",
-  "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
-  "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Requested-With",
-  "Access-Control-Max-Age": "86400"
-};
 function endpointCallerFromAuth(auth) {
   if (!auth) return null;
   const { id, username, role, permissions, email, display_name, avatar_url } = auth.user;
@@ -23333,43 +23640,88 @@ function extractBearerToken(request) {
   if (cookieToken) {
     return cookieToken;
   }
-  const isWebSocket = request.headers.get("upgrade")?.toLowerCase() === "websocket";
-  if (isWebSocket) {
-    try {
-      const url = new URL(request.url);
-      const token = url.searchParams.get("token");
-      if (token) {
-        return token;
-      }
-    } catch (err) {
-    }
-  }
   return null;
 }
 function getAgentBuilder(env) {
   const agentBuilderId = env.AGENT_BUILDER.idFromName("singleton");
   return env.AGENT_BUILDER.get(agentBuilderId);
 }
+function parseWebSocketTicketAuth(authJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(authJson);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const record = parsed;
+  if (!record.user || typeof record.user !== "object") return null;
+  const user = record.user;
+  if (typeof user.id !== "string" || typeof user.username !== "string" || typeof user.role !== "string" || record.authType !== "super_admin" && record.authType !== "session" && record.authType !== "api_key") {
+    return null;
+  }
+  const permissions = user.permissions;
+  if (permissions !== void 0 && permissions !== null && (!Array.isArray(permissions) || !permissions.every((permission) => typeof permission === "string"))) {
+    return null;
+  }
+  if (record.credentialId !== void 0 && typeof record.credentialId !== "string") return null;
+  return {
+    user: {
+      id: user.id,
+      username: user.username,
+      role: user.role,
+      permissions,
+      platform_user_id: typeof user.platform_user_id === "string" ? user.platform_user_id : null,
+      email: typeof user.email === "string" ? user.email : null,
+      display_name: typeof user.display_name === "string" ? user.display_name : null,
+      avatar_url: typeof user.avatar_url === "string" ? user.avatar_url : null
+    },
+    authType: record.authType,
+    credentialId: record.credentialId
+  };
+}
+async function consumeWebSocketTicket(request, env) {
+  if (request.headers.get("upgrade")?.toLowerCase() !== "websocket") return null;
+  let url;
+  try {
+    url = new URL(request.url);
+  } catch {
+    return null;
+  }
+  const ticket = url.searchParams.get("ticket");
+  if (!ticket) return null;
+  const authJson = await getAgentBuilder(env).consumeWebSocketTicket({
+    ticket_hash: await hashToken(ticket),
+    pathname: url.pathname
+  });
+  return typeof authJson === "string" ? parseWebSocketTicketAuth(authJson) : null;
+}
 async function authenticate(request, env) {
+  const ticketAuth = await consumeWebSocketTicket(request, env);
+  if (ticketAuth) return ticketAuth;
   const token = extractBearerToken(request);
   if (!token) {
     return null;
   }
-  if (env.SUPER_ADMIN_PASSWORD && env.ENCRYPTION_KEY) {
+  if (typeof env.SUPER_ADMIN_PASSWORD === "string" && typeof env.ENCRYPTION_KEY === "string") {
     if (token.includes(".")) {
       const isValidSuperAdmin = await verifySuperAdminToken(
         token,
         env.ENCRYPTION_KEY
       );
       if (isValidSuperAdmin) {
-        return {
-          user: {
-            id: "super_admin",
-            username: "admin",
-            role: "admin"
-          },
-          authType: "super_admin"
-        };
+        const tokenHash = await hashToken(token);
+        const agentBuilder = getAgentBuilder(env);
+        if (await agentBuilder.validateSuperAdminSession(tokenHash)) {
+          return {
+            user: {
+              id: "super_admin",
+              username: "admin",
+              role: "admin"
+            },
+            authType: "super_admin"
+          };
+        }
       }
     }
   }
@@ -23414,7 +23766,8 @@ async function authenticate(request, env) {
             display_name: user.display_name ?? null,
             avatar_url: user.avatar_url ?? null
           },
-          authType: "api_key"
+          authType: "api_key",
+          credentialId: apiKey.id
         };
       }
     }
@@ -23426,7 +23779,10 @@ async function requireAuth(request, env) {
   if (!authContext) {
     return new Response(JSON.stringify({ error: "Unauthorized" }), {
       status: 401,
-      headers: { "Content-Type": "application/json", ...CORS_HEADERS }
+      headers: {
+        "Content-Type": "application/json",
+        ...runtimeCorsHeaders(request, env)
+      }
     });
   }
   return authContext;
@@ -23441,7 +23797,10 @@ async function requireAdmin(request, env) {
       JSON.stringify({ error: "Forbidden: Admin access required" }),
       {
         status: 403,
-        headers: { "Content-Type": "application/json", ...CORS_HEADERS }
+        headers: {
+          "Content-Type": "application/json",
+          ...runtimeCorsHeaders(request, env)
+        }
       }
     );
   }
@@ -24426,8 +24785,37 @@ var migration35 = {
   }
 };
 
+// src/durable-objects/migrations/036_add_tool_delivery_tokens.ts
+var migration36 = {
+  version: 36,
+  name: "add_tool_delivery_tokens",
+  async up(sql) {
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS pending_client_calls (
+        tool_call_id TEXT PRIMARY KEY,
+        tool TEXT NOT NULL,
+        args TEXT,
+        request_permission TEXT,
+        risk INTEGER,
+        side TEXT NOT NULL DEFAULT 'a',
+        status TEXT NOT NULL DEFAULT 'pending',
+        created_at INTEGER NOT NULL,
+        dispatched_client_id TEXT,
+        dispatched_generation INTEGER NOT NULL DEFAULT 0
+      )
+    `);
+    const columns = sql.exec(
+      `PRAGMA table_info(pending_client_calls)`
+    ).toArray();
+    if (!columns.some((column) => column.name === "delivery_token_hash")) {
+      sql.exec(`ALTER TABLE pending_client_calls ADD COLUMN delivery_token_hash TEXT`);
+    }
+    sql.exec(`UPDATE _metadata SET value = '36' WHERE key = 'schema_version'`);
+  }
+};
+
 // src/durable-objects/migrations/index.ts
-var migrations = [migration, migration2, migration3, migration4, migration5, migration6, migration7, migration8, migration9, migration10, migration11, migration12, migration13, migration14, migration15, migration16, migration17, migration18, migration19, migration20, migration21, migration22, migration23, migration24, migration25, migration26, migration27, migration28, migration29, migration30, migration31, migration32, migration33, migration34, migration35];
+var migrations = [migration, migration2, migration3, migration4, migration5, migration6, migration7, migration8, migration9, migration10, migration11, migration12, migration13, migration14, migration15, migration16, migration17, migration18, migration19, migration20, migration21, migration22, migration23, migration24, migration25, migration26, migration27, migration28, migration29, migration30, migration31, migration32, migration33, migration34, migration35, migration36];
 var LATEST_SCHEMA_VERSION = migrations.length;
 
 // src/durable-objects/subagent-reconcile.ts
@@ -25263,7 +25651,7 @@ function eventSocketCanReceive(attachment, ownerUserId) {
 }
 
 // src/durable-objects/agentbuilder-migrations/0001_initial.ts
-var migration36 = {
+var migration37 = {
   version: 1,
   async up(sql) {
     sql.exec(`
@@ -25362,7 +25750,7 @@ var migration36 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0002_add_tenvs_properties.ts
-var migration37 = {
+var migration38 = {
   version: 2,
   async up(sql) {
     sql.exec(`ALTER TABLE threads ADD COLUMN tenvs TEXT`);
@@ -25374,7 +25762,7 @@ var migration37 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0003_add_parent_and_terminated.ts
-var migration38 = {
+var migration39 = {
   version: 3,
   async up(sql) {
     sql.exec(`ALTER TABLE threads ADD COLUMN parent TEXT REFERENCES threads(id)`);
@@ -25387,7 +25775,7 @@ var migration38 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0004_add_env_tables.ts
-var migration39 = {
+var migration40 = {
   version: 4,
   async up(sql) {
     sql.exec(`ALTER TABLE threads ADD COLUMN env TEXT`);
@@ -25411,7 +25799,7 @@ var migration39 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0005_add_pending_subagent_env_requests.ts
-var migration40 = {
+var migration41 = {
   version: 5,
   async up(sql) {
     sql.exec(`
@@ -25437,7 +25825,7 @@ var migration40 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0006_add_env_value_types.ts
-var migration41 = {
+var migration42 = {
   version: 6,
   async up(sql) {
     sql.exec(
@@ -25452,7 +25840,7 @@ var migration41 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0007_platform_identity_replica.ts
-var migration42 = {
+var migration43 = {
   version: 7,
   async up(sql) {
     sql.exec(`ALTER TABLE users ADD COLUMN platform_user_id TEXT`);
@@ -25481,7 +25869,7 @@ var migration42 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0008_add_skills.ts
-var migration43 = {
+var migration44 = {
   version: 8,
   async up(sql) {
     sql.exec(`
@@ -25512,7 +25900,7 @@ var migration43 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0009_add_user_permissions.ts
-var migration44 = {
+var migration45 = {
   version: 9,
   async up(sql) {
     sql.exec(`ALTER TABLE users ADD COLUMN permissions TEXT`);
@@ -25523,7 +25911,7 @@ var migration44 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0010_add_device_logins.ts
-var migration45 = {
+var migration46 = {
   version: 10,
   async up(sql) {
     sql.exec(`
@@ -25543,7 +25931,7 @@ var migration45 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0011_add_user_values.ts
-var migration46 = {
+var migration47 = {
   version: 11,
   async up(sql) {
     sql.exec(`
@@ -25566,7 +25954,7 @@ var migration46 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0012_allow_api_instance_role.ts
-var migration47 = {
+var migration48 = {
   version: 12,
   async up(sql) {
     sql.exec(`CREATE TABLE oauth_accounts_0012_backup AS SELECT * FROM oauth_accounts`);
@@ -25676,7 +26064,7 @@ var migration47 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0013_add_thread_activity.ts
-var migration48 = {
+var migration49 = {
   version: 13,
   async up(sql) {
     sql.exec(`ALTER TABLE threads ADD COLUMN last_activity_at INTEGER`);
@@ -25692,7 +26080,7 @@ var migration48 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0014_thread_activity_scale.ts
-var migration49 = {
+var migration50 = {
   version: 14,
   async up(sql) {
     sql.exec(`ALTER TABLE threads ADD COLUMN last_message_preview TEXT`);
@@ -25710,7 +26098,7 @@ var migration49 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0015_clear_envelope_previews.ts
-var migration50 = {
+var migration51 = {
   version: 15,
   async up(sql) {
     sql.exec(
@@ -25724,7 +26112,7 @@ var migration50 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0016_add_origin_agent.ts
-var migration51 = {
+var migration52 = {
   version: 16,
   async up(sql) {
     sql.exec(`ALTER TABLE threads ADD COLUMN origin_agent_name TEXT`);
@@ -25739,7 +26127,7 @@ var migration51 = {
 };
 
 // src/durable-objects/agentbuilder-migrations/0017_add_thread_message_recency.ts
-var migration52 = {
+var migration53 = {
   version: 17,
   async up(sql) {
     sql.exec(`ALTER TABLE threads ADD COLUMN last_message_at INTEGER`);
@@ -25750,10 +26138,132 @@ var migration52 = {
   }
 };
 
+// src/durable-objects/agentbuilder-migrations/0018_auth_security.ts
+var migration54 = {
+  version: 18,
+  async up(sql) {
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS super_admin_sessions (
+        token_hash TEXT PRIMARY KEY,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      )
+    `);
+    sql.exec(`
+      CREATE INDEX IF NOT EXISTS idx_super_admin_sessions_expires
+      ON super_admin_sessions(expires_at)
+    `);
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS auth_rate_limits (
+        bucket_key TEXT PRIMARY KEY,
+        attempts INTEGER NOT NULL,
+        reset_at INTEGER NOT NULL
+      )
+    `);
+    sql.exec(`
+      CREATE INDEX IF NOT EXISTS idx_auth_rate_limits_reset
+      ON auth_rate_limits(reset_at)
+    `);
+    sql.exec(`
+      INSERT OR REPLACE INTO _metadata (key, value) VALUES ('schema_version', '18')
+    `);
+  }
+};
+
+// src/durable-objects/agentbuilder-migrations/0019_scope_skills.ts
+var migration55 = {
+  version: 19,
+  async up(sql) {
+    sql.exec(`
+      CREATE TABLE skills_0019 (
+        owner_id TEXT NOT NULL,
+        name TEXT NOT NULL,
+        description TEXT NOT NULL,
+        version TEXT,
+        enabled INTEGER NOT NULL DEFAULT 1,
+        shared INTEGER NOT NULL DEFAULT 0,
+        created_at INTEGER DEFAULT (strftime('%s', 'now')),
+        updated_at INTEGER DEFAULT (strftime('%s', 'now')),
+        PRIMARY KEY (owner_id, name)
+      )
+    `);
+    sql.exec(`
+      INSERT INTO skills_0019 (
+        owner_id, name, description, version, enabled, shared, created_at, updated_at
+      )
+      SELECT '__instance_shared__', name, description, version, enabled, 1, created_at, updated_at
+      FROM skills
+    `);
+    sql.exec(`
+      CREATE TABLE skill_files_0019 (
+        owner_id TEXT NOT NULL,
+        skill_name TEXT NOT NULL,
+        path TEXT NOT NULL,
+        content TEXT NOT NULL,
+        size INTEGER NOT NULL,
+        PRIMARY KEY (owner_id, skill_name, path),
+        FOREIGN KEY (owner_id, skill_name) REFERENCES skills_0019(owner_id, name) ON DELETE CASCADE
+      )
+    `);
+    sql.exec(`
+      INSERT INTO skill_files_0019 (owner_id, skill_name, path, content, size)
+      SELECT '__instance_shared__', skill_name, path, content, size FROM skill_files
+    `);
+    sql.exec(`DROP TABLE skill_files`);
+    sql.exec(`DROP TABLE skills`);
+    sql.exec(`ALTER TABLE skills_0019 RENAME TO skills`);
+    sql.exec(`ALTER TABLE skill_files_0019 RENAME TO skill_files`);
+    sql.exec(`CREATE INDEX idx_skills_owner_enabled ON skills(owner_id, enabled)`);
+    sql.exec(`CREATE INDEX idx_skills_shared_enabled ON skills(shared, enabled)`);
+    sql.exec(`CREATE INDEX idx_skill_files_skill ON skill_files(owner_id, skill_name)`);
+    sql.exec(`INSERT OR REPLACE INTO _metadata (key, value) VALUES ('schema_version', '19')`);
+  }
+};
+
+// src/durable-objects/agentbuilder-migrations/0020_websocket_tickets.ts
+var migration56 = {
+  version: 20,
+  async up(sql) {
+    sql.exec(`
+      CREATE TABLE websocket_tickets (
+        ticket_hash TEXT PRIMARY KEY,
+        pathname TEXT NOT NULL,
+        auth_json TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      )
+    `);
+    sql.exec(`
+      CREATE INDEX idx_websocket_tickets_expires
+      ON websocket_tickets(expires_at)
+    `);
+    sql.exec(`INSERT OR REPLACE INTO _metadata (key, value) VALUES ('schema_version', '20')`);
+  }
+};
+
+// src/durable-objects/agentbuilder-migrations/0021_platform_handoff_jtis.ts
+var migration57 = {
+  version: 21,
+  async up(sql) {
+    sql.exec(`
+      CREATE TABLE platform_handoff_jtis (
+        jti TEXT PRIMARY KEY,
+        consumed_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      )
+    `);
+    sql.exec(`
+      CREATE INDEX idx_platform_handoff_jtis_expires
+      ON platform_handoff_jtis(expires_at)
+    `);
+    sql.exec(`INSERT OR REPLACE INTO _metadata (key, value) VALUES ('schema_version', '21')`);
+  }
+};
+
 // src/durable-objects/agentbuilder-migrations/index.ts
-var migrations2 = [migration36, migration37, migration38, migration39, migration40, migration41, migration42, migration43, migration44, migration45, migration46, migration47, migration48, migration49, migration50, migration51, migration52];
+var migrations2 = [migration37, migration38, migration39, migration40, migration41, migration42, migration43, migration44, migration45, migration46, migration47, migration48, migration49, migration50, migration51, migration52, migration53, migration54, migration55, migration56, migration57];
 var LATEST_SCHEMA_VERSION2 = migrations2.reduce(
-  (max, migration53) => Math.max(max, migration53.version),
+  (max, migration58) => Math.max(max, migration58.version),
   0
 );
 
@@ -26258,6 +26768,7 @@ function validateSkillFiles(files) {
 }
 
 // src/durable-objects/DurableAgentBuilder.ts
+init_scope();
 var ENV_TYPES_PROPERTY = "__agentbuilder_env_types";
 function parseStoredPermissions(value) {
   if (typeof value !== "string" || !value.trim()) return null;
@@ -26850,9 +27361,9 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
     }
   }
   async runMigrations(fromVersion) {
-    for (const migration53 of migrations2) {
-      if (migration53.version > fromVersion) {
-        await migration53.up(this.ctx.storage.sql);
+    for (const migration58 of migrations2) {
+      if (migration58.version > fromVersion) {
+        await migration58.up(this.ctx.storage.sql);
       }
     }
   }
@@ -28801,6 +29312,150 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
       tokenHash
     );
   }
+  /** Register a short-lived super-admin token so it can be revoked alone. */
+  async createSuperAdminSession(params) {
+    await this.ensureMigrated();
+    const now = Math.floor(Date.now() / 1e3);
+    await this.ctx.storage.sql.exec(
+      `DELETE FROM super_admin_sessions WHERE expires_at <= ?`,
+      now
+    );
+    await this.ctx.storage.sql.exec(
+      `INSERT INTO super_admin_sessions (token_hash, created_at, expires_at)
+       VALUES (?, ?, ?)`,
+      params.token_hash,
+      now,
+      params.expires_at
+    );
+  }
+  /** A valid signature is insufficient: the session must still be registered. */
+  async validateSuperAdminSession(tokenHash) {
+    await this.ensureMigrated();
+    const now = Math.floor(Date.now() / 1e3);
+    const cursor = await this.ctx.storage.sql.exec(
+      `SELECT 1 AS found FROM super_admin_sessions
+       WHERE token_hash = ? AND expires_at > ?`,
+      tokenHash,
+      now
+    );
+    return cursor.toArray().length > 0;
+  }
+  /** Revoke only the presented super-admin session; no key rotation required. */
+  async deleteSuperAdminSession(tokenHash) {
+    await this.ensureMigrated();
+    await this.ctx.storage.sql.exec(
+      `DELETE FROM super_admin_sessions WHERE token_hash = ?`,
+      tokenHash
+    );
+  }
+  /** Register a path-bound bearer ticket for one WebSocket handshake. */
+  async createWebSocketTicket(params) {
+    await this.ensureMigrated();
+    const now = Math.floor(Date.now() / 1e3);
+    this.ctx.storage.sql.exec(
+      `DELETE FROM websocket_tickets WHERE expires_at <= ?`,
+      now
+    );
+    this.ctx.storage.sql.exec(
+      `INSERT INTO websocket_tickets (ticket_hash, pathname, auth_json, created_at, expires_at)
+       VALUES (?, ?, ?, ?, ?)`,
+      params.ticket_hash,
+      params.pathname,
+      params.auth_json,
+      now,
+      params.expires_at
+    );
+  }
+  /**
+   * Atomically consume a WebSocket ticket. Deleting before validating its path
+   * means even a mistaken or malicious first presentation burns the bearer.
+   */
+  async consumeWebSocketTicket(params) {
+    await this.ensureMigrated();
+    const cursor = this.ctx.storage.sql.exec(
+      `DELETE FROM websocket_tickets
+       WHERE ticket_hash = ?
+       RETURNING pathname, auth_json, expires_at`,
+      params.ticket_hash
+    );
+    const ticket = cursor.toArray()[0];
+    const now = Math.floor(Date.now() / 1e3);
+    if (!ticket || ticket.expires_at <= now || ticket.pathname !== params.pathname) {
+      return null;
+    }
+    return ticket.auth_json;
+  }
+  /** Atomically accept an unexpired platform handoff identifier once. */
+  async consumePlatformHandoffJti(params) {
+    await this.ensureMigrated();
+    const jti = params.jti.trim();
+    const expiresAt = Math.floor(params.expires_at);
+    const now = Math.floor(Date.now() / 1e3);
+    if (!jti || jti.length > 200 || !Number.isSafeInteger(expiresAt) || expiresAt <= now) {
+      return false;
+    }
+    this.ctx.storage.sql.exec(
+      `DELETE FROM platform_handoff_jtis WHERE expires_at <= ?`,
+      now
+    );
+    const cursor = this.ctx.storage.sql.exec(
+      `INSERT OR IGNORE INTO platform_handoff_jtis (jti, consumed_at, expires_at)
+       VALUES (?, ?, ?)`,
+      jti,
+      now,
+      expiresAt
+    );
+    return cursor.rowsWritten > 0;
+  }
+  /**
+   * Atomically consume one attempt from a fixed-window authentication bucket.
+   * The singleton Durable Object serializes calls, preventing parallel bypass.
+   */
+  async consumeAuthRateLimit(params) {
+    await this.ensureMigrated();
+    const key = params.key.trim();
+    const limit = Math.floor(params.limit);
+    const windowSeconds = Math.floor(params.window_seconds);
+    if (!key || key.length > 160 || limit < 1 || limit > 1e4 || windowSeconds < 1 || windowSeconds > 86400) {
+      throw new Error("Invalid authentication rate-limit bucket");
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    await this.ctx.storage.sql.exec(
+      `DELETE FROM auth_rate_limits WHERE reset_at <= ?`,
+      now
+    );
+    const cursor = await this.ctx.storage.sql.exec(
+      `SELECT attempts, reset_at FROM auth_rate_limits WHERE bucket_key = ?`,
+      key
+    );
+    const current = cursor.toArray()[0];
+    if (!current || current.reset_at <= now) {
+      const resetAt = now + windowSeconds;
+      await this.ctx.storage.sql.exec(
+        `INSERT INTO auth_rate_limits (bucket_key, attempts, reset_at)
+         VALUES (?, 1, ?)
+         ON CONFLICT(bucket_key) DO UPDATE SET attempts = 1, reset_at = excluded.reset_at`,
+        key,
+        resetAt
+      );
+      return { allowed: true, retry_after: windowSeconds, remaining: limit - 1 };
+    }
+    const retryAfter = Math.max(1, current.reset_at - now);
+    if (current.attempts >= limit) {
+      return { allowed: false, retry_after: retryAfter, remaining: 0 };
+    }
+    const attempts = current.attempts + 1;
+    await this.ctx.storage.sql.exec(
+      `UPDATE auth_rate_limits SET attempts = ? WHERE bucket_key = ?`,
+      attempts,
+      key
+    );
+    return {
+      allowed: true,
+      retry_after: retryAfter,
+      remaining: Math.max(0, limit - attempts)
+    };
+  }
   // ============================================================
   // API Key Methods
   // ============================================================
@@ -29118,40 +29773,61 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
     }
   }
   // ─────────────────────────────────────────────────────────────────────────
-  // Skills — the instance-global Agent Skills library (agentskills.io format).
-  // Installed once, visible to every thread; file contents live here so
-  // nothing about a skill is stored on a client machine.
+  // Skills — owner-scoped Agent Skills plus explicitly shared admin skills.
   // ─────────────────────────────────────────────────────────────────────────
   /** Installed skills, metadata only (no file contents). */
-  async listSkills(options = {}) {
+  async listSkills(scope, options = {}) {
     await this.ensureMigrated();
-    const where = options.includeDisabled ? "" : "WHERE enabled = 1";
     const cursor = await this.ctx.storage.sql.exec(
       `SELECT s.name, s.description, s.version, s.enabled, s.updated_at,
-              (SELECT json_group_array(f.path) FROM skill_files f WHERE f.skill_name = s.name) AS files
-       FROM skills s ${where} ORDER BY s.name`
+              s.owner_id,
+              (SELECT json_group_array(f.path) FROM skill_files f
+               WHERE f.owner_id = s.owner_id AND f.skill_name = s.name) AS files
+       FROM skills s
+       WHERE (s.owner_id = ? OR (? = 1 AND s.shared = 1))
+         AND (? = 1 OR s.enabled = 1)
+       ORDER BY s.name, CASE WHEN s.owner_id = ? THEN 0 ELSE 1 END`,
+      scope.ownerId,
+      scope.includeShared ? 1 : 0,
+      options.includeDisabled ? 1 : 0,
+      scope.ownerId
     );
-    return cursor.toArray().map((row) => ({
-      name: row.name,
-      description: row.description,
-      version: row.version ?? void 0,
-      enabled: row.enabled === 1,
-      files: row.files ? JSON.parse(row.files).sort() : [],
-      updatedAt: row.updated_at
-    }));
+    const skills = /* @__PURE__ */ new Map();
+    for (const row of cursor.toArray()) {
+      if (skills.has(row.name)) continue;
+      const parsedFiles = row.files ? JSON.parse(row.files) : [];
+      const files = Array.isArray(parsedFiles) ? parsedFiles.filter((path21) => typeof path21 === "string").sort() : [];
+      skills.set(row.name, {
+        name: row.name,
+        description: row.description,
+        version: row.version ?? void 0,
+        enabled: row.enabled === 1,
+        files,
+        updatedAt: row.updated_at
+      });
+    }
+    return [...skills.values()];
   }
   /** One skill's metadata (null when not installed). */
-  async getSkill(name) {
-    const all = await this.listSkills({ includeDisabled: true });
+  async getSkill(scope, name) {
+    const all = await this.listSkills(scope, { includeDisabled: true });
     return all.find((s) => s.name === name) ?? null;
   }
   /** One bundled file's text (null when the skill or file is missing). */
-  async getSkillFile(name, path21) {
+  async getSkillFile(scope, name, path21) {
     await this.ensureMigrated();
     const cursor = await this.ctx.storage.sql.exec(
-      `SELECT content FROM skill_files WHERE skill_name = ? AND path = ?`,
+      `SELECT f.content FROM skill_files f
+       JOIN skills s ON s.owner_id = f.owner_id AND s.name = f.skill_name
+       WHERE f.skill_name = ? AND f.path = ?
+         AND (f.owner_id = ? OR (? = 1 AND s.shared = 1))
+       ORDER BY CASE WHEN f.owner_id = ? THEN 0 ELSE 1 END
+       LIMIT 1`,
       name,
-      path21.replace(/^\.\//, "")
+      path21.replace(/^\.\//, ""),
+      scope.ownerId,
+      scope.includeShared ? 1 : 0,
+      scope.ownerId
     );
     const rows = cursor.toArray();
     return rows.length ? rows[0].content : null;
@@ -29162,44 +29838,56 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
    * that frontmatter. Throws SkillValidationError with an actionable message
    * on any standard violation.
    */
-  async upsertSkill(files) {
+  async upsertSkill(scope, files) {
     await this.ensureMigrated();
     const frontmatter = validateSkillFiles(files);
     const name = frontmatter.name;
-    const existing = await this.getSkill(name);
-    await this.ctx.storage.sql.exec(`DELETE FROM skill_files WHERE skill_name = ?`, name);
+    const ownScope = { ownerId: scope.ownerId };
+    const existing = await this.getSkill(ownScope, name);
     await this.ctx.storage.sql.exec(
-      `INSERT INTO skills (name, description, version, enabled, updated_at)
-       VALUES (?, ?, ?, ?, strftime('%s', 'now'))
-       ON CONFLICT(name) DO UPDATE SET
+      `DELETE FROM skill_files WHERE owner_id = ? AND skill_name = ?`,
+      scope.ownerId,
+      name
+    );
+    await this.ctx.storage.sql.exec(
+      `INSERT INTO skills (owner_id, name, description, version, enabled, shared, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, strftime('%s', 'now'))
+       ON CONFLICT(owner_id, name) DO UPDATE SET
          description = excluded.description,
          version = excluded.version,
          updated_at = excluded.updated_at`,
+      scope.ownerId,
       name,
       frontmatter.description,
       frontmatter.version ?? null,
-      existing ? existing.enabled ? 1 : 0 : 1
+      existing ? existing.enabled ? 1 : 0 : 1,
+      scope.ownerId === SHARED_SKILL_OWNER ? 1 : 0
     );
     for (const f of files) {
       const p = f.path.replace(/^\.\//, "");
       await this.ctx.storage.sql.exec(
-        `INSERT INTO skill_files (skill_name, path, content, size) VALUES (?, ?, ?, ?)`,
+        `INSERT INTO skill_files (owner_id, skill_name, path, content, size) VALUES (?, ?, ?, ?, ?)`,
+        scope.ownerId,
         name,
         p,
         f.content,
         f.content.length
       );
     }
-    return await this.getSkill(name);
+    const installed = await this.getSkill(ownScope, name);
+    if (!installed) throw new Error(`Installed skill was not found: ${name}`);
+    return installed;
   }
   /** Enable/disable an installed skill. Returns false when not installed. */
-  async setSkillEnabled(name, enabled) {
+  async setSkillEnabled(scope, name, enabled) {
     await this.ensureMigrated();
-    const existing = await this.getSkill(name);
+    const existing = await this.getSkill({ ownerId: scope.ownerId }, name);
     if (!existing) return false;
     await this.ctx.storage.sql.exec(
-      `UPDATE skills SET enabled = ?, updated_at = strftime('%s', 'now') WHERE name = ?`,
+      `UPDATE skills SET enabled = ?, updated_at = strftime('%s', 'now')
+       WHERE owner_id = ? AND name = ?`,
       enabled ? 1 : 0,
+      scope.ownerId,
       name
     );
     return true;
@@ -29274,12 +29962,20 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
     return true;
   }
   /** Uninstall a skill and its files. Returns false when not installed. */
-  async deleteSkill(name) {
+  async deleteSkill(scope, name) {
     await this.ensureMigrated();
-    const existing = await this.getSkill(name);
+    const existing = await this.getSkill({ ownerId: scope.ownerId }, name);
     if (!existing) return false;
-    await this.ctx.storage.sql.exec(`DELETE FROM skill_files WHERE skill_name = ?`, name);
-    await this.ctx.storage.sql.exec(`DELETE FROM skills WHERE name = ?`, name);
+    await this.ctx.storage.sql.exec(
+      `DELETE FROM skill_files WHERE owner_id = ? AND skill_name = ?`,
+      scope.ownerId,
+      name
+    );
+    await this.ctx.storage.sql.exec(
+      `DELETE FROM skills WHERE owner_id = ? AND name = ?`,
+      scope.ownerId,
+      name
+    );
     return true;
   }
 };
@@ -29371,8 +30067,38 @@ function selectBridgeSocket(candidates, ownerClientId) {
 
 // src/durable-objects/DurableThread.ts
 init_code_execution();
+init_remoteAttachment();
 var DEFAULT_CLIENT_TOOL_TIMEOUT_MS = 5 * 60 * 1e3;
 var BRIDGE_LIVENESS_TIMEOUT_MS = 20 * 1e3;
+var INTERNAL_TOOL_DELIVERY = Symbol("internal-tool-delivery");
+function generateToolDeliveryToken() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function hashToolDeliveryToken(token) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
+  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function createToolDeliveryCapability() {
+  const token = generateToolDeliveryToken();
+  return { token, tokenHash: await hashToolDeliveryToken(token) };
+}
+async function matchesToolDeliveryToken(expectedHash, token) {
+  if (!expectedHash || !token || token.length > 256) return false;
+  const actualHash = await hashToolDeliveryToken(token);
+  if (expectedHash.length !== actualHash.length) return false;
+  let difference = 0;
+  for (let index = 0; index < actualHash.length; index++) {
+    difference |= expectedHash.charCodeAt(index) ^ actualHash.charCodeAt(index);
+  }
+  return difference === 0;
+}
+function matchesToolDeliveryOwner(pending, proof) {
+  return !pending.dispatched_client_id || pending.dispatched_client_id === proof.clientId && Number(pending.dispatched_generation ?? 0) === (proof.generation ?? -1);
+}
+async function authorizesToolDelivery(pending, proof) {
+  return matchesToolDeliveryOwner(pending, proof) && await matchesToolDeliveryToken(pending.delivery_token_hash, proof.token);
+}
 var RUNTIME_STORAGE_PREFIX = "__agentbuilder_runtime_storage__:";
 function normalizeEndpointThreadPath(path21) {
   if (!path21 || /^[A-Za-z][A-Za-z\d+\-.]*:/.test(path21)) {
@@ -29523,6 +30249,30 @@ function createEndpointThreadStateBridge(state) {
     getFileThumbnail: (path21) => state.getFileThumbnail(normalizeEndpointThreadPath(path21))
   };
 }
+function routeBridgeClientFrame(socket, message, handlers) {
+  const attachment = socket.deserializeAttachment();
+  const attachedAsBridge = attachment !== null && typeof attachment === "object" && "type" in attachment && attachment.type === "bridge";
+  if (!attachedAsBridge || !handlers.isTracked(socket)) return false;
+  handlers.markSeen(socket);
+  if (typeof message !== "string") return false;
+  let parsed;
+  try {
+    const value = JSON.parse(message);
+    if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+    parsed = value;
+  } catch {
+    return false;
+  }
+  if (parsed.type === "tool_response") {
+    handlers.resolveToolResponse(socket, parsed);
+    return true;
+  }
+  if (typeof parsed.type === "string" && parsed.type.startsWith("stream_") && parsed.type !== "stream_ping" && parsed.type !== "stream_pong") {
+    handlers.handleStreamFrame(socket, parsed);
+    return true;
+  }
+  return false;
+}
 var DurableThread = class _DurableThread extends DurableObject {
   migratedToVersion = null;
   logSockets = /* @__PURE__ */ new Set();
@@ -30917,9 +31667,9 @@ var DurableThread = class _DurableThread extends DurableObject {
    * Each migration is run in order, starting from the current version + 1.
    */
   async runMigrations(fromVersion) {
-    for (const migration53 of migrations) {
-      if (migration53.version > fromVersion) {
-        await migration53.up(this.ctx.storage.sql);
+    for (const migration58 of migrations) {
+      if (migration58.version > fromVersion) {
+        await migration58.up(this.ctx.storage.sql);
       }
     }
   }
@@ -31603,14 +32353,17 @@ var DurableThread = class _DurableThread extends DurableObject {
       return null;
     }
     const location = sourceFile.location;
-    if (!location || !/^https?:\/\//i.test(location)) {
+    if (!location) {
+      return null;
+    }
+    const response = await fetchRemoteAttachment(
+      location,
+      this.env.AGENT_BUILDER_ATTACHMENT_FETCH_HOSTS
+    );
+    if (!response) {
       return null;
     }
     try {
-      const response = await fetch(location);
-      if (!response.ok) {
-        return null;
-      }
       const buffer = await response.arrayBuffer();
       return this.arrayBufferToBase64(buffer);
     } catch {
@@ -33307,7 +34060,9 @@ ${resultContent}${attachmentSummary}`;
           void 0,
           "The client executing this operation was replaced before it finished. Retry if the work is still needed.",
           previous.client_id,
-          previous.generation
+          previous.generation,
+          void 0,
+          INTERNAL_TOOL_DELIVERY
         );
         if (delivered) sides.add(delivered.side);
       }
@@ -33337,18 +34092,21 @@ ${resultContent}${attachmentSummary}`;
         data: { noClient: true }
       };
     }
+    let deliveryToken;
     if (durability) {
       try {
         await this.ensureMigrated();
         await this.ensurePendingClientTable();
+        const capability = await createToolDeliveryCapability();
+        deliveryToken = capability.token;
         const ownerId = owner?.client_id ?? null;
         const socketClientId = this.bridgeClientInfo.get(socket)?.clientId ?? null;
         const fenced = owner && socketClientId === owner.client_id;
         await this.ctx.storage.sql.exec(
           `INSERT OR REPLACE INTO pending_client_calls
              (tool_call_id, tool, args, request_permission, risk, side, status, created_at,
-              dispatched_client_id, dispatched_generation)
-           VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?)`,
+              dispatched_client_id, dispatched_generation, delivery_token_hash)
+           VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?)`,
           durability.toolCallId,
           request.tool,
           JSON.stringify(request.args ?? {}),
@@ -33357,7 +34115,8 @@ ${resultContent}${attachmentSummary}`;
           durability.side,
           Date.now(),
           fenced ? ownerId : null,
-          fenced ? owner.generation : 0
+          fenced ? owner.generation : 0,
+          capability.tokenHash
         );
       } catch (error) {
         console.error("[DurableThread] Failed to persist fast-path call (continuing):", error);
@@ -33393,7 +34152,8 @@ ${resultContent}${attachmentSummary}`;
         tool: request.tool,
         args: request.args ?? {},
         requestPermission: request.requestPermission ?? null,
-        risk: typeof request.risk === "number" ? request.risk : null
+        risk: typeof request.risk === "number" ? request.risk : null,
+        deliveryToken: deliveryToken ?? null
       });
       try {
         socket.send(frame);
@@ -33516,7 +34276,8 @@ ${resultContent}${attachmentSummary}`;
         status TEXT NOT NULL DEFAULT 'pending',
         created_at INTEGER NOT NULL,
         dispatched_client_id TEXT,
-        dispatched_generation INTEGER NOT NULL DEFAULT 0
+        dispatched_generation INTEGER NOT NULL DEFAULT 0,
+        delivery_token_hash TEXT
       )
     `);
   }
@@ -33557,13 +34318,15 @@ ${resultContent}${attachmentSummary}`;
     const socketClientId = this.bridgeClientInfo.get(socket)?.clientId ?? null;
     const fenced = owner && socketClientId === owner.client_id;
     const generation = fenced ? owner.generation : 0;
+    const capability = await createToolDeliveryCapability();
     try {
       await this.ctx.storage.sql.exec(
         `UPDATE pending_client_calls
-            SET dispatched_client_id = ?, dispatched_generation = ?
+            SET dispatched_client_id = ?, dispatched_generation = ?, delivery_token_hash = ?
           WHERE tool_call_id = ? AND status = 'pending'`,
         fenced ? owner.client_id : null,
         generation,
+        capability.tokenHash,
         toolCallId
       );
       socket.send(
@@ -33575,7 +34338,8 @@ ${resultContent}${attachmentSummary}`;
           args: request.args ?? {},
           requestPermission: request.requestPermission ?? null,
           risk: typeof request.risk === "number" ? request.risk : null,
-          generation
+          generation,
+          deliveryToken: capability.token
         })
       );
       this.bridgeLastSeen.set(socket, Date.now());
@@ -33698,12 +34462,14 @@ ${resultContent}${attachmentSummary}`;
       const pending = await this.getPendingClientCalls();
       for (const p of pending) {
         if (socket.readyState !== WebSocket.OPEN) break;
+        const capability = await createToolDeliveryCapability();
         await this.ctx.storage.sql.exec(
           `UPDATE pending_client_calls
-              SET dispatched_client_id = ?, dispatched_generation = ?
+              SET dispatched_client_id = ?, dispatched_generation = ?, delivery_token_hash = ?
             WHERE tool_call_id = ? AND status = 'pending'`,
           fenced ? owner.client_id : null,
           generation,
+          capability.tokenHash,
           p.toolCallId
         );
         socket.send(
@@ -33715,7 +34481,8 @@ ${resultContent}${attachmentSummary}`;
             args: p.args,
             requestPermission: p.requestPermission,
             risk: p.risk,
-            generation
+            generation,
+            deliveryToken: capability.token
           })
         );
       }
@@ -33728,20 +34495,25 @@ ${resultContent}${attachmentSummary}`;
    * call resolved. Returns the side to continue, or null if there is no pending
    * call (unknown id or already resolved — the delivery is idempotent).
    */
-  async deliverClientToolResult(toolCallId, ok, result, error, deliveredByClientId, deliveredGeneration) {
+  async deliverClientToolResult(toolCallId, ok, result, error, deliveredByClientId, deliveredGeneration, deliveryToken, internalAuthorization) {
     await this.ensureMigrated();
     await this.ensurePendingClientTable();
     const pendingCursor = await this.ctx.storage.sql.exec(
-      `SELECT side, status, dispatched_client_id, dispatched_generation
+      `SELECT side, status, dispatched_client_id, dispatched_generation, delivery_token_hash
          FROM pending_client_calls WHERE tool_call_id = ? LIMIT 1`,
       toolCallId
     );
     const pending = pendingCursor.toArray()[0];
     if (!pending || pending.status !== "pending") return null;
-    if (pending.dispatched_client_id) {
-      if (pending.dispatched_client_id !== deliveredByClientId || Number(pending.dispatched_generation ?? 0) !== (deliveredGeneration ?? -1)) {
-        return null;
-      }
+    const proof = {
+      token: deliveryToken,
+      clientId: deliveredByClientId,
+      generation: deliveredGeneration
+    };
+    if (internalAuthorization !== INTERNAL_TOOL_DELIVERY) {
+      if (!await authorizesToolDelivery(pending, proof)) return null;
+    } else if (!matchesToolDeliveryOwner(pending, proof)) {
+      return null;
     }
     const side = pending.side === "b" ? "b" : "a";
     const content = ok ? result ?? "" : `Error: ${error ?? "tool failed"}`;
@@ -34458,29 +35230,17 @@ ${resultContent}${attachmentSummary}`;
    */
   async webSocketMessage(ws, message) {
     try {
-      if (this.bridgeSockets.has(ws)) {
-        this.bridgeLastSeen.set(ws, Date.now());
-      }
+      const handledBridgeFrame = routeBridgeClientFrame(ws, message, {
+        isTracked: (socket) => this.bridgeSockets.has(socket),
+        markSeen: (socket) => this.bridgeLastSeen.set(socket, Date.now()),
+        resolveToolResponse: (socket, payload) => this.resolveClientCall(socket, payload),
+        handleStreamFrame: (socket, payload) => this.handleClientStreamFrame(socket, payload)
+      });
+      if (handledBridgeFrame) return;
       if (typeof message === "string" && message === "ping") {
         ws.send("pong");
         return;
       }
-      if (typeof message === "string") {
-        let parsed = null;
-        try {
-          parsed = JSON.parse(message);
-        } catch {
-          parsed = null;
-        }
-        if (parsed && parsed.type === "tool_response") {
-          this.resolveClientCall(ws, parsed);
-          return;
-        }
-        if (parsed && typeof parsed.type === "string" && parsed.type.startsWith("stream_") && parsed.type !== "stream_ping" && parsed.type !== "stream_pong") {
-          this.handleClientStreamFrame(ws, parsed);
-          return;
-        }
-      }
     } catch (error) {
       console.error("[DurableThread] Error handling WebSocket message:", error);
     }
@@ -37487,6 +38247,6 @@ init_context();
 init_ProviderRegistry();
 init_types2();
 
-export { CLIENT_STREAM_CHUNK_BYTES, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, FlowStateSdk, NamespaceResolutionError, PackageDiscoveryService, ProviderRegistry, ThreadWatchdog, agentbuilder, assistantMessageText, authenticate, buildImageDescription, builder, callClient, callClientStream, canAccessThread, cat, createNamespaceContext, createThreadEndpointHandler, decodeStreamChunk, defineController2 as defineController, discoverPackages, emitThreadEvent, encodeStreamChunk, endpointCallerFromAuth, enhanceFlowState, exists, find, forceTurn, generateAgentFile, generateImageDescription, generateModelFile, generatePromptFile, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, hasJsonArrayEntries, head, injectMessage, isAdminOnlyApiRoute, isHostedInstance, isPublicApiRoute, isQualifiedName, isTrustedLocalDevelopmentRequest, isVisibleTerminalAssistantMessage, linkFile, messageTimestampSeconds, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, requireAdmin, requireAuth, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, stat, supportsClientForwarding, tail, unlink, updateThread, writeFile, writeImage };
+export { CLIENT_STREAM_CHUNK_BYTES, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, FlowStateSdk, NamespaceResolutionError, PackageDiscoveryService, ProviderRegistry, ThreadWatchdog, agentbuilder, applyRuntimeCors, assistantMessageText, authenticate, buildImageDescription, builder, callClient, callClientStream, canAccessThread, cat, createNamespaceContext, createThreadEndpointHandler, decodeStreamChunk, defineController2 as defineController, discoverPackages, emitThreadEvent, encodeStreamChunk, endpointCallerFromAuth, enhanceFlowState, exists, find, forceTurn, generateAgentFile, generateImageDescription, generateModelFile, generatePromptFile, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, hasJsonArrayEntries, head, injectMessage, isAdminOnlyApiRoute, isHostedInstance, isPublicApiRoute, isQualifiedName, isSameOriginBrowserRequest, isTrustedLocalDevelopmentRequest, isVisibleTerminalAssistantMessage, linkFile, messageTimestampSeconds, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, requireAdmin, requireAuth, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, runtimeCorsHeaders, runtimePreflightResponse, stat, supportsClientForwarding, tail, unlink, updateThread, writeFile, writeImage };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map