@standardagents/builder 0.40.4 → 0.40.5-next.3b25e2a

package/dist/built-in-routes.js

@@ -68899,7 +68899,7 @@ var config_get_default = defineController2(async ({ config, env: env2, req }) =>
 });
 
 // src/version.ts
-var BUILDER_VERSION = "0.40.4".length > 0 ? "0.40.4" : "dev";
+var BUILDER_VERSION = "0.40.5-next.3b25e2a".length > 0 ? "0.40.5-next.3b25e2a" : "dev";
 
 // src/api/diagnostics.get.ts
 init_LLMRequest();
@@ -76361,16 +76361,29 @@ async function resolveDeviceApprovalBrand(env2, config) {
   }
   return configured ?? BUILT_IN_DEVICE_APPROVAL_BRAND;
 }
-function approvalCsp(req, brand) {
+function deviceOutcomeOrigin(env2) {
+  const raw = env2.STANDARD_AGENTS_DEVICE_OUTCOME_URL_BASE;
+  if (typeof raw !== "string" || !raw.trim()) return null;
+  try {
+    const target = new URL(raw.trim());
+    if (target.protocol !== "https:" || target.username || target.password) return null;
+    return target.origin;
+  } catch {
+    return null;
+  }
+}
+function approvalCsp(req, brand, env2) {
   let imageSource = "";
   if (brand.logoUrl) {
     const requestOrigin = new URL(req.url).origin;
     const logoOrigin = new URL(brand.logoUrl, requestOrigin).origin;
     imageSource = `; img-src ${logoOrigin === requestOrigin ? "'self'" : logoOrigin}`;
   }
-  return `default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'${imageSource}`;
+  const outcomeOrigin = deviceOutcomeOrigin(env2);
+  const formAction = outcomeOrigin ? `'self' ${outcomeOrigin}` : "'self'";
+  return `default-src 'none'; style-src 'unsafe-inline'; form-action ${formAction}; base-uri 'none'; frame-ancestors 'none'${imageSource}`;
 }
-function confirmationPage(req, confirmationToken, handoff, brand, identity) {
+function confirmationPage(req, confirmationToken, handoff, brand, identity, env2) {
   const handoffInput = handoff ? `<input type="hidden" name="handoff" value="${escapeHtml(handoff)}">` : "";
   const logo = brand.logoUrl ? `<img class="logo" src="${escapeHtml(brand.logoUrl)}" alt="">` : `<span class="logo-fallback" aria-hidden="true">${escapeHtml(brand.name.slice(0, 1).toUpperCase())}</span>`;
   const description = brand.description ? `<p class="description">${escapeHtml(brand.description)}</p>` : "";
@@ -76384,7 +76397,7 @@ function confirmationPage(req, confirmationToken, handoff, brand, identity) {
       "Cache-Control": "no-store",
       "Referrer-Policy": "no-referrer",
       "X-Content-Type-Options": "nosniff",
-      "Content-Security-Policy": approvalCsp(req, brand)
+      "Content-Security-Policy": approvalCsp(req, brand, env2)
     }
   });
 }
@@ -76534,7 +76547,14 @@ var approve_get_default = defineController2(async ({ req, env: env2, params, con
     });
   }
   const brand = await resolveDeviceApprovalBrand(env2, config);
-  return confirmationPage(req, confirmationToken, identity.handoff, brand, identity);
+  return confirmationPage(
+    req,
+    confirmationToken,
+    identity.handoff,
+    brand,
+    identity,
+    env2
+  );
 });
 
 // src/api/auth/device/[code]/approve.post.ts