@standardagents/builder 0.40.4 → 0.40.5

package/dist/built-in-routes.js

@@ -5047,9 +5047,7 @@ Message one with subagent_message(referenceId, message).`
             if (resumable) {
               await this.settleResumableChildAfterRun(
                 state,
-                stub,
-                childThreadId,
-                childResult
+                childThreadId
               );
             } else if (stub.terminateThread) {
               await stub.terminateThread(childThreadId);
@@ -5061,7 +5059,7 @@ Message one with subagent_message(referenceId, message).`
               attachments: copiedAttachments,
               subagent_id: childThreadId
             };
-            return resumable && !this.isTerminalSubagentResult(childResult) ? this.withReferenceInToolResult(toolResult, childThreadId) : toolResult;
+            return resumable ? this.withReferenceInToolResult(toolResult, childThreadId) : toolResult;
           }
           const backgroundRun = (async () => {
             try {
@@ -5096,9 +5094,7 @@ Message one with subagent_message(referenceId, message).`
               if (resumable) {
                 await this.settleResumableChildAfterRun(
                   state,
-                  stub,
-                  childThreadId,
-                  childResult
+                  childThreadId
                 );
               } else if (stub.terminateThread) {
                 await stub.terminateThread(childThreadId);
@@ -5493,18 +5489,8 @@ Message one with subagent_message(referenceId, message).`
           JSON.stringify(next)
         );
       }
-      static isTerminalSubagentResult(result) {
-        return result.terminal === true;
-      }
-      static async settleResumableChildAfterRun(state, childThread, reference, result) {
-        if (!this.isTerminalSubagentResult(result)) {
-          await this.updateChildStatus(state, reference, "idle");
-          return;
-        }
-        await this.updateChildStatus(state, reference, "terminated");
-        if (typeof childThread.terminateThread === "function") {
-          await childThread.terminateThread(reference);
-        }
+      static async settleResumableChildAfterRun(state, reference) {
+        await this.updateChildStatus(state, reference, "idle");
       }
       static async buildChildInvocationMessages(state, childThread, content, receivesMessages, parentAttachments, initialArguments) {
         const copiedAttachments = await this.copyAttachmentsBetweenThreads(
@@ -68027,7 +68013,14 @@ function isHostedInstance(env2) {
   }
   return Boolean(value);
 }
-function isTrustedLocalDevelopmentRequest(request, env2) {
+function compiledTrustedDevHosts() {
+  try {
+    return typeof __STANDARD_AGENTS_TRUSTED_DEV_HOSTS__ !== "undefined" && Array.isArray(__STANDARD_AGENTS_TRUSTED_DEV_HOSTS__) ? __STANDARD_AGENTS_TRUSTED_DEV_HOSTS__ : [];
+  } catch {
+    return [];
+  }
+}
+function isTrustedLocalDevelopmentRequest(request, env2, trustedDevHosts = compiledTrustedDevHosts()) {
   if (isHostedInstance(env2)) return false;
   let hostname;
   try {
@@ -68035,7 +68028,7 @@ function isTrustedLocalDevelopmentRequest(request, env2) {
   } catch {
     return false;
   }
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname.endsWith(".localhost") || hostname.endsWith(".orb.local");
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname.endsWith(".localhost") || hostname.endsWith(".orb.local") || trustedDevHosts.some((trusted) => trusted.trim().toLowerCase() === hostname);
 }
 function requestObservedOrigins(request) {
   const origins = /* @__PURE__ */ new Set();
@@ -68899,7 +68892,7 @@ var config_get_default = defineController2(async ({ config, env: env2, req }) =>
 });
 
 // src/version.ts
-var BUILDER_VERSION = "0.40.4".length > 0 ? "0.40.4" : "dev";
+var BUILDER_VERSION = "0.40.5".length > 0 ? "0.40.5" : "dev";
 
 // src/api/diagnostics.get.ts
 init_LLMRequest();
@@ -75494,11 +75487,8 @@ var tool_result_post_default = defineController2(async ({ req, params, env: env2
     if (!delivered) {
       return Response.json({ status: "ignored" }, { status: 200 });
     }
-    if (delivered.resume) {
-      await stub.continueExecution(threadId, delivered.side);
-      return Response.json({ status: "resumed", side: delivered.side }, { status: 200 });
-    }
-    return Response.json({ status: "delivered", side: delivered.side }, { status: 200 });
+    await stub.continueExecution(threadId, delivered.side);
+    return Response.json({ status: "resumed", side: delivered.side }, { status: 200 });
   } catch (error) {
     console.error(`Error delivering tool result for thread ${threadId}:`, error);
     return Response.json(
@@ -76361,16 +76351,29 @@ async function resolveDeviceApprovalBrand(env2, config) {
   }
   return configured ?? BUILT_IN_DEVICE_APPROVAL_BRAND;
 }
-function approvalCsp(req, brand) {
+function deviceOutcomeOrigin(env2) {
+  const raw = env2.STANDARD_AGENTS_DEVICE_OUTCOME_URL_BASE;
+  if (typeof raw !== "string" || !raw.trim()) return null;
+  try {
+    const target = new URL(raw.trim());
+    if (target.protocol !== "https:" || target.username || target.password) return null;
+    return target.origin;
+  } catch {
+    return null;
+  }
+}
+function approvalCsp(req, brand, env2) {
   let imageSource = "";
   if (brand.logoUrl) {
     const requestOrigin = new URL(req.url).origin;
     const logoOrigin = new URL(brand.logoUrl, requestOrigin).origin;
     imageSource = `; img-src ${logoOrigin === requestOrigin ? "'self'" : logoOrigin}`;
   }
-  return `default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'${imageSource}`;
+  const outcomeOrigin = deviceOutcomeOrigin(env2);
+  const formAction = outcomeOrigin ? `'self' ${outcomeOrigin}` : "'self'";
+  return `default-src 'none'; style-src 'unsafe-inline'; form-action ${formAction}; base-uri 'none'; frame-ancestors 'none'${imageSource}`;
 }
-function confirmationPage(req, confirmationToken, handoff, brand, identity) {
+function confirmationPage(req, confirmationToken, handoff, brand, identity, env2) {
   const handoffInput = handoff ? `<input type="hidden" name="handoff" value="${escapeHtml(handoff)}">` : "";
   const logo = brand.logoUrl ? `<img class="logo" src="${escapeHtml(brand.logoUrl)}" alt="">` : `<span class="logo-fallback" aria-hidden="true">${escapeHtml(brand.name.slice(0, 1).toUpperCase())}</span>`;
   const description = brand.description ? `<p class="description">${escapeHtml(brand.description)}</p>` : "";
@@ -76384,7 +76387,7 @@ function confirmationPage(req, confirmationToken, handoff, brand, identity) {
       "Cache-Control": "no-store",
       "Referrer-Policy": "no-referrer",
       "X-Content-Type-Options": "nosniff",
-      "Content-Security-Policy": approvalCsp(req, brand)
+      "Content-Security-Policy": approvalCsp(req, brand, env2)
     }
   });
 }
@@ -76534,7 +76537,14 @@ var approve_get_default = defineController2(async ({ req, env: env2, params, con
     });
   }
   const brand = await resolveDeviceApprovalBrand(env2, config);
-  return confirmationPage(req, confirmationToken, identity.handoff, brand, identity);
+  return confirmationPage(
+    req,
+    confirmationToken,
+    identity.handoff,
+    brand,
+    identity,
+    env2
+  );
 });
 
 // src/api/auth/device/[code]/approve.post.ts