@standardagents/builder 0.40.0 → 0.40.2

package/dist/built-in-routes.js

@@ -11251,7 +11251,12 @@ function queueTool(flow, toolName, args = {}) {
 }
 async function injectMessage(flow, options) {
   const messageId = options.id ?? crypto.randomUUID();
-  const timestamp = Date.now() * TIMESTAMP_MULTIPLIER;
+  const wallClockTimestamp = Date.now() * TIMESTAMP_MULTIPLIER;
+  const latestLiveTimestamp = flow.messageHistory.reduce(
+    (latest, entry) => Math.max(latest, entry.created_at),
+    0
+  );
+  const timestamp = options.beforeMessageId ? wallClockTimestamp : Math.max(wallClockTimestamp, latestLiveTimestamp + 1);
   const silent = options.silent ?? false;
   const forceTopLevel = options.forceTopLevel ?? false;
   let message = {
@@ -68894,7 +68899,7 @@ var config_get_default = defineController2(async ({ config, env: env2, req }) =>
 });
 
 // src/version.ts
-var BUILDER_VERSION = "0.40.0".length > 0 ? "0.40.0" : "dev";
+var BUILDER_VERSION = "0.40.2".length > 0 ? "0.40.2" : "dev";
 
 // src/api/diagnostics.get.ts
 init_LLMRequest();
@@ -76278,6 +76283,10 @@ var stream_default3 = defineController2(async (context) => {
 
 // src/api/auth/device/[code]/_approval.ts
 var CONFIRMATION_TTL_SECONDS = 5 * 60;
+var BUILT_IN_DEVICE_APPROVAL_BRAND = {
+  name: "Standard Agents",
+  description: "Connect a new device to your account."
+};
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
@@ -76294,18 +76303,85 @@ function page(title, body, ok) {
     }
   );
 }
-function confirmationPage(req, code, confirmationToken, handoff) {
-  const url = new URL(req.url);
+function optionalPresentationText(value, maxLength) {
+  return typeof value === "string" && value.trim() && value.trim().length <= maxLength ? value.trim() : void 0;
+}
+function safePresentationLogo(value, allowRelative) {
+  const logoUrl = optionalPresentationText(value, 2048);
+  if (!logoUrl) return void 0;
+  if (allowRelative && logoUrl.startsWith("/") && !logoUrl.startsWith("//") && !logoUrl.includes("#") && !logoUrl.includes("\\")) {
+    return logoUrl;
+  }
+  try {
+    const parsed = new URL(logoUrl);
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.hash) return void 0;
+    return parsed.toString();
+  } catch {
+    return void 0;
+  }
+}
+function normalizeRuntimeBrand(value, platformShape) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record24 = value;
+  const name15 = optionalPresentationText(record24.name, 100);
+  if (!name15) return null;
+  const description = optionalPresentationText(record24.description, 280);
+  const logoValue = platformShape ? record24.logo_url : record24.logoUrl;
+  const logoUrl = safePresentationLogo(logoValue, !platformShape);
+  return {
+    name: name15,
+    ...description ? { description } : {},
+    ...logoUrl ? { logoUrl } : {}
+  };
+}
+async function resolveDeviceApprovalBrand(env2, config) {
+  const configured = normalizeRuntimeBrand(config?.deviceApproval, false);
+  const projectId = optionalPresentationText(
+    env2.STANDARD_AGENTS_PROJECT_ID,
+    128
+  );
+  if (isPlatformHosted(env2) && projectId) {
+    try {
+      const url = new URL("/partners/auth/brand", `${platformEndpoint(env2)}/`);
+      url.searchParams.set("project_id", projectId);
+      const response = await fetch(url, {
+        headers: { Accept: "application/json" },
+        signal: AbortSignal.timeout(1e3)
+      });
+      if (response.ok) {
+        const payload = await response.json();
+        const authoritative = normalizeRuntimeBrand(payload.instance, true);
+        if (authoritative) return authoritative;
+      }
+    } catch {
+    }
+  }
+  return configured ?? BUILT_IN_DEVICE_APPROVAL_BRAND;
+}
+function approvalCsp(req, brand) {
+  let imageSource = "";
+  if (brand.logoUrl) {
+    const requestOrigin = new URL(req.url).origin;
+    const logoOrigin = new URL(brand.logoUrl, requestOrigin).origin;
+    imageSource = `; img-src ${logoOrigin === requestOrigin ? "'self'" : logoOrigin}`;
+  }
+  return `default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'${imageSource}`;
+}
+function confirmationPage(req, confirmationToken, handoff, brand, identity) {
   const handoffInput = handoff ? `<input type="hidden" name="handoff" value="${escapeHtml(handoff)}">` : "";
-  const shortCode = code.length > 12 ? `${code.slice(0, 6)}\u2026${code.slice(-6)}` : code;
-  const html = `<!doctype html><html><head><meta charset="utf-8"><meta name="referrer" content="no-referrer"><title>Approve device sign-in</title><style>body{background:#0a0c10;color:#e8ecf3;font:16px/1.6 ui-sans-serif,system-ui;display:flex;min-height:100vh;align-items:center;justify-content:center}main{max-width:440px;text-align:center;padding:40px;border:1px solid #232936;border-radius:14px;background:#11141b}h1{font-size:22px}p{color:#a5adbd}.code{font:600 18px ui-monospace,monospace;letter-spacing:.08em;color:#e8ecf3}form{display:flex;gap:12px;justify-content:center;margin-top:26px}button,a{border-radius:9px;padding:10px 18px;font:inherit;text-decoration:none}button{border:0;background:#2dd4bf;color:#07110f;font-weight:700;cursor:pointer}a{border:1px solid #394150;color:#cbd5e1}</style></head><body><main><h1>Approve device sign-in?</h1><p>A command-line client is requesting a personal instance API key for your account.</p><p class="code">${escapeHtml(shortCode)}</p><form method="post" action="${escapeHtml(url.pathname)}"><input type="hidden" name="confirmation_token" value="${escapeHtml(confirmationToken)}">${handoffInput}<button type="submit">Approve device</button><a href="/">Cancel</a></form></main></body></html>`;
+  const logo = brand.logoUrl ? `<img class="logo" src="${escapeHtml(brand.logoUrl)}" alt="">` : `<span class="logo-fallback" aria-hidden="true">${escapeHtml(brand.name.slice(0, 1).toUpperCase())}</span>`;
+  const description = brand.description ? `<p class="description">${escapeHtml(brand.description)}</p>` : "";
+  const secondaryIdentity = identity.displayEmail && identity.displayEmail !== identity.displayName ? `<span>${escapeHtml(identity.displayEmail)}</span>` : "";
+  const html = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><title>Connect device \xB7 ${escapeHtml(brand.name)}</title><style>
+:root{color-scheme:light dark;font-family:Inter,ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;background:#f6f7f9;color:#15171a}*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:28px;background:radial-gradient(circle at 50% 0,rgba(71,194,174,.12),transparent 38%),linear-gradient(#fbfcfd,#f2f4f6)}main{width:min(100%,480px)}.card{background:rgba(255,255,255,.92);border:1px solid #dfe3e8;border-radius:20px;padding:34px;box-shadow:0 24px 70px rgba(20,27,38,.12),0 2px 8px rgba(20,27,38,.06)}.brand{display:flex;align-items:center;gap:12px;margin-bottom:28px}.logo,.logo-fallback{width:38px;height:38px;border-radius:10px;display:grid;place-items:center;object-fit:contain}.logo-fallback{background:#171b21;color:#fff;font-weight:750}.brand strong{font-size:17px;letter-spacing:-.01em}h1{font-size:29px;line-height:1.18;letter-spacing:-.035em;margin:0 0 12px}p{margin:0;color:#5b6470;line-height:1.58}.description{margin-bottom:20px}.request{margin-top:18px}.identity{display:flex;align-items:center;gap:12px;margin-top:24px;padding:14px;border-radius:12px;background:#f2f4f6;border:1px solid #e3e6ea}.avatar{width:34px;height:34px;border-radius:50%;display:grid;place-items:center;background:#dfe4e8;color:#313841;font-weight:700}.identity-text{min-width:0;display:flex;flex-direction:column}.identity-label{font-size:11px;text-transform:uppercase;letter-spacing:.08em;color:#737d89}.identity strong,.identity span{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.identity span{font-size:13px;color:#68727e}form{display:grid;gap:10px;margin-top:26px}button{appearance:none;border-radius:11px;padding:12px 16px;font:inherit;font-weight:700;cursor:pointer}.connect{border:1px solid #15191d;background:#15191d;color:#fff}.deny{border:1px solid transparent;background:transparent;color:#68727e}.deny:hover{background:#f1f3f5;color:#252a30}.disclosure{text-align:center;font-size:12px;color:#8a939d;margin:16px 0 0}@media(prefers-color-scheme:dark){:root{background:#090b0e;color:#f2f5f7}body{background:radial-gradient(circle at 50% 0,rgba(68,198,177,.12),transparent 38%),#090b0e}.card{background:rgba(17,20,25,.94);border-color:#292e36;box-shadow:0 28px 80px rgba(0,0,0,.42)}p{color:#a9b1bc}.identity{background:#191d23;border-color:#292f38}.avatar{background:#2b323b;color:#eef2f5}.identity-label,.identity span{color:#929ca8}.connect{background:#62d4c2;border-color:#62d4c2;color:#07110f}.deny{color:#9aa4af}.deny:hover{background:#1d2229;color:#e4e8ec}.disclosure{color:#747e8a}}
+</style></head><body><main><section class="card"><div class="brand">${logo}<strong>${escapeHtml(brand.name)}</strong></div><h1>Connect ${escapeHtml(brand.name)}?</h1>${description}<p class="request">A new device wants to connect to your account. Only continue if you started this sign-in.</p><div class="identity"><div class="avatar" aria-hidden="true">${escapeHtml(identity.displayName.slice(0, 1).toUpperCase())}</div><div class="identity-text"><span class="identity-label">Signed in as</span><strong>${escapeHtml(identity.displayName)}</strong>${secondaryIdentity}</div></div><form method="post" action=""><input type="hidden" name="confirmation_token" value="${escapeHtml(confirmationToken)}">${handoffInput}<button class="connect" type="submit" name="decision" value="approve">Connect device</button><button class="deny" type="submit" name="decision" value="deny">Not me</button></form></section><p class="disclosure">Authentication secured by Standard Agents</p></main></body></html>`;
   return new Response(html, {
     headers: {
       "Content-Type": "text/html; charset=utf-8",
       "Cache-Control": "no-store",
       "Referrer-Policy": "no-referrer",
       "X-Content-Type-Options": "nosniff",
-      "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'"
+      "Content-Security-Policy": approvalCsp(req, brand)
     }
   });
 }
@@ -76332,7 +76408,7 @@ async function resolveDeviceApprovalIdentity(req, env2) {
     if (!payload || !payload.platform_user_id || !payload.role || !payload.jti || !projectOk) {
       return outcome(env2, false, "signin_failed", {
         title: "Sign in failed",
-        body: "This sign-in link is invalid or has expired. Start again from your terminal."
+        body: "This sign-in link is invalid or has expired. Start again from your device."
       });
     }
     const platformProfile = {
@@ -76347,6 +76423,8 @@ async function resolveDeviceApprovalIdentity(req, env2) {
     return {
       confirmationSubject: `platform:${payload.platform_user_id}`,
       handoff,
+      displayName: payload.display_name?.trim() || payload.username?.trim() || payload.email?.trim() || "Your account",
+      displayEmail: payload.email?.trim() || null,
       platformProfile,
       platformHandoff: {
         jti: payload.jti,
@@ -76378,6 +76456,8 @@ async function resolveDeviceApprovalIdentity(req, env2) {
   return {
     confirmationSubject: `user:${authResult.user.id}`,
     handoff: null,
+    displayName: authResult.user.display_name?.trim() || authResult.user.username?.trim() || authResult.user.email?.trim() || "Your account",
+    displayEmail: authResult.user.email?.trim() || null,
     localUserId: authResult.user.id
   };
 }
@@ -76427,16 +76507,9 @@ async function verifyDeviceConfirmationToken(env2, code, confirmationSubject, to
     return false;
   }
 }
-function isSameOriginApprovalPost(req) {
-  const url = new URL(req.url);
-  const origin = req.headers.get("Origin");
-  if (origin && origin !== url.origin) return false;
-  const fetchSite = req.headers.get("Sec-Fetch-Site");
-  return !fetchSite || fetchSite === "same-origin" || fetchSite === "none";
-}
 
 // src/api/auth/device/[code]/approve.get.ts
-var approve_get_default = defineController2(async ({ req, env: env2, params }) => {
+var approve_get_default = defineController2(async ({ req, env: env2, params, config }) => {
   const code = params.code;
   if (!code) {
     return outcome(env2, false, "invalid_link", {
@@ -76457,7 +76530,8 @@ var approve_get_default = defineController2(async ({ req, env: env2, params }) =
       body: "This instance cannot create a secure device confirmation. Contact its administrator."
     });
   }
-  return confirmationPage(req, code, confirmationToken, identity.handoff);
+  const brand = await resolveDeviceApprovalBrand(env2, config);
+  return confirmationPage(req, confirmationToken, identity.handoff, brand, identity);
 });
 
 // src/api/auth/device/[code]/approve.post.ts
@@ -76469,11 +76543,15 @@ var approve_post_default = defineController2(async ({ req, env: env2, params })
       body: "This device link is malformed."
     });
   }
-  if (!isSameOriginApprovalPost(req)) {
+  if (!isSameOriginBrowserRequest(req)) {
     return Response.json({ error: "Cross-origin device approval refused" }, { status: 403 });
   }
   const form = await req.clone().formData().catch(() => null);
   const confirmationToken = form?.get("confirmation_token")?.toString() ?? "";
+  const decision = form?.get("decision")?.toString() || "approve";
+  if (decision !== "approve" && decision !== "deny") {
+    return Response.json({ error: "Invalid device confirmation decision" }, { status: 400 });
+  }
   if (!confirmationToken) {
     return Response.json({ error: "Device confirmation token required" }, { status: 403 });
   }
@@ -76490,31 +76568,45 @@ var approve_post_default = defineController2(async ({ req, env: env2, params })
   if (!await consumeDeviceApprovalHandoff(env2, identity)) {
     return outcome(env2, false, "signin_failed", {
       title: "Sign in failed",
-      body: "This sign-in link was already used or has expired. Start again from your terminal."
+      body: "This sign-in link was already used or has expired. Start again from your device."
     });
   }
-  const userId = await materializeDeviceApprovalUser(env2, identity);
-  const token = generateApiKey();
   const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
   const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
+  const codeHash = await hashToken(code);
+  if (decision === "deny") {
+    const denied = await agentBuilder.denyDeviceLogin(codeHash);
+    if (!denied) {
+      return outcome(env2, false, "expired", {
+        title: "Link expired",
+        body: "This device sign-in has expired or was already decided. Start again from your device."
+      });
+    }
+    return outcome(env2, false, "denied", {
+      title: "Connection denied",
+      body: "The device was not connected. You can close this window."
+    });
+  }
+  const userId = await materializeDeviceApprovalUser(env2, identity);
+  const token = generateApiKey();
   const ok = await agentBuilder.approveDeviceLogin({
-    code_hash: await hashToken(code),
+    code_hash: codeHash,
     user_id: userId,
     token,
     token_hash: await hashToken(token),
     key_prefix: token.slice(0, 12),
     last_five: token.slice(-5),
-    key_name: "CLI device login"
+    key_name: "Device login"
   });
   if (!ok) {
     return outcome(env2, false, "expired", {
       title: "Link expired",
-      body: "This device login has expired or was already used. Start again from your terminal."
+      body: "This device sign-in has expired or was already decided. Start again from your device."
     });
   }
   return outcome(env2, true, "done", {
     title: "You're connected",
-    body: "Standard Code is now signed in. Return to your terminal \u2014 it will pick up automatically."
+    body: "The device is now connected. Return to the app that started this sign-in."
   });
 });