@standardagents/builder 0.40.5-next.3b25e2a → 0.40.6

package/dist/plugin.d.ts

@@ -30,6 +30,13 @@ interface AgentPluginOptions {
     providers?: string[];
     /** Presentation used by the built-in device sign-in confirmation page. */
     deviceApproval?: DeviceApprovalBrand;
+    /**
+     * Exact additional hostnames trusted for local authoring APIs.
+     * Anyone who can reach the dev server through one of these names can attempt
+     * to authenticate to the authoring surface; same-origin and credential
+     * checks still apply.
+     */
+    trustedDevHosts?: string[];
 }
 declare function agentbuilder(options?: AgentPluginOptions): PluginOption[];
 declare const builder: typeof agentbuilder;

package/dist/plugin.js

@@ -1226,7 +1226,7 @@ function createHmrReloader() {
       const isConfigFile = isModelFile || isProviderFile || isPromptFile || isAgentFile || isEffectFile;
       if (!isToolFile && !isThreadApiFile && !isHookFile && !isConfigFile && !isUserEndpointFile) return;
       reloader.invalidateSourceFileModule(server, file);
-      if (isConfigFile || isToolFile) regenerateTypes();
+      if (isConfigFile || isToolFile || isHookFile) regenerateTypes();
       if (isToolFile) await reloader.reloadToolsModule(server);
       if (isModelFile) await reloader.reloadModelsModule(server);
       if (isProviderFile) await reloader.reloadProvidersModule(server);
@@ -3269,6 +3269,29 @@ async function scanPromptsDirectory(dir) {
 async function scanAgentsDirectory(dir) {
   return scanConfigDirectory(dir, /export\s+default\s+defineAgent/);
 }
+function findLegacyRootAgentFiles(agentsDir) {
+  const agentsRoot = path9__default.dirname(agentsDir);
+  if (path9__default.basename(agentsDir) !== "agents" || path9__default.basename(agentsRoot) !== "agents") {
+    return [];
+  }
+  if (!fs9__default.existsSync(agentsRoot)) return [];
+  return fs9__default.readdirSync(agentsRoot, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map((entry) => path9__default.join(agentsRoot, entry.name)).filter((filePath) => {
+    try {
+      return /export\s+default\s+defineAgent/.test(fs9__default.readFileSync(filePath, "utf8"));
+    } catch {
+      return false;
+    }
+  }).sort();
+}
+function warnLegacyRootAgentFiles(agentsDir) {
+  const expectedDir = path9__default.relative(process.cwd(), agentsDir).replace(/\\/g, "/");
+  for (const filePath of findLegacyRootAgentFiles(agentsDir)) {
+    const source = path9__default.relative(process.cwd(), filePath).replace(/\\/g, "/");
+    console.warn(
+      `[agentbuilder] Agent definition "${source}" is outside the scanned agent directory. Move it to "${expectedDir}/" so it is registered.`
+    );
+  }
+}
 async function scanEffectsDirectory(dir) {
   const effects = [];
   if (!fs9__default.existsSync(dir)) {
@@ -6960,7 +6983,32 @@ function isHostedInstance(env) {
   }
   return Boolean(value);
 }
-function isTrustedLocalDevelopmentRequest(request, env) {
+function normalizeTrustedDevHosts(hosts) {
+  const normalized = /* @__PURE__ */ new Set();
+  for (const rawHost of hosts ?? []) {
+    const candidate = rawHost.trim().toLowerCase().replace(/\.$/, "");
+    try {
+      const parsed = new URL(`http://${candidate}`);
+      if (!candidate || candidate.includes("*") || parsed.hostname.toLowerCase().replace(/\.$/, "") !== candidate || parsed.port || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+        throw new Error("invalid hostname");
+      }
+    } catch {
+      throw new Error(
+        `Invalid trusted development hostname "${rawHost}". Use an exact hostname without a scheme, port, path, or wildcard.`
+      );
+    }
+    normalized.add(candidate);
+  }
+  return [...normalized];
+}
+function compiledTrustedDevHosts() {
+  try {
+    return typeof __STANDARD_AGENTS_TRUSTED_DEV_HOSTS__ !== "undefined" && Array.isArray(__STANDARD_AGENTS_TRUSTED_DEV_HOSTS__) ? __STANDARD_AGENTS_TRUSTED_DEV_HOSTS__ : [];
+  } catch {
+    return [];
+  }
+}
+function isTrustedLocalDevelopmentRequest(request, env, trustedDevHosts = compiledTrustedDevHosts()) {
   if (isHostedInstance(env)) return false;
   let hostname;
   try {
@@ -6968,7 +7016,7 @@ function isTrustedLocalDevelopmentRequest(request, env) {
   } catch {
     return false;
   }
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname.endsWith(".localhost") || hostname.endsWith(".orb.local");
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname.endsWith(".localhost") || hostname.endsWith(".orb.local") || trustedDevHosts.some((trusted) => trusted.trim().toLowerCase() === hostname);
 }
 function isAdminOnlyApiRoute(routePath, method = "GET") {
   if (routePath === "/api/hooks") return true;
@@ -7063,7 +7111,8 @@ function createDevMiddleware(server, context) {
     installedProviderPackageMap,
     hmr,
     sourceDirs,
-    regenerateTypes
+    regenerateTypes,
+    trustedDevHosts
   } = context;
   server.watcher.on("add", async (file) => {
     await hmr.handleFileChange(file, server, sourceDirs, regenerateTypes);
@@ -7097,7 +7146,8 @@ function createDevMiddleware(server, context) {
     try {
       trustedLocalHost = isTrustedLocalDevelopmentRequest(
         new Request(`http://${req.headers.host || "invalid.remote"}${routePath}`),
-        {}
+        {},
+        trustedDevHosts
       );
     } catch {
     }
@@ -8331,7 +8381,7 @@ var firstPartyProviderPackages = [
   "@standardagents/openrouter",
   "@standardagents/xai"
 ];
-var depsToInclude = [
+var baseDepsToInclude = [
   "zod",
   "zod/v3",
   "zod/v4",
@@ -8342,17 +8392,24 @@ var depsToInclude = [
   // a root dep). The `parent > child` form pre-bundles it at startup so Vite
   // doesn't discover it mid-request and reload the worker (which would destroy
   // an in-flight Durable Object execution and drop the client bridge).
-  "@standardagents/openrouter > @openrouter/sdk",
   "magic-string",
   "@standardagents/spec",
   // Incremental JSON reader used by the runtime to surface a tool's progress
   // argument from partial streamed tool-call arguments (tool_call_started).
-  "@formkit/jsonreader",
-  // Pre-bundle the provider packages themselves so their whole subtree (SDKs,
-  // pricing tables) lands in the initial optimized bundle and nothing is
-  // discovered lazily by workerd.
-  ...firstPartyProviderPackages
+  "@formkit/jsonreader"
 ];
+function depsToInclude(options = {}) {
+  const installedProviders = options.isPackageInstalled ? firstPartyProviderPackages.filter(options.isPackageInstalled) : firstPartyProviderPackages;
+  const openRouterTransitive = installedProviders.includes("@standardagents/openrouter") ? ["@standardagents/openrouter > @openrouter/sdk"] : [];
+  return [...baseDepsToInclude, ...openRouterTransitive, ...installedProviders];
+}
+function trustedDevHostDefines(options) {
+  return {
+    __STANDARD_AGENTS_TRUSTED_DEV_HOSTS__: JSON.stringify(
+      normalizeTrustedDevHosts(options.trustedDevHosts)
+    )
+  };
+}
 var packingDeps = [
   "rollup",
   "@rollup/plugin-commonjs",
@@ -8361,7 +8418,7 @@ var packingDeps = [
   "fsevents",
   "typescript"
 ];
-function createPluginViteConfig(pluginModuleUrl) {
+function createPluginViteConfig(pluginModuleUrl, options = {}) {
   const currentDir = path9__default.dirname(fileURLToPath(pluginModuleUrl));
   const isInDist = currentDir.endsWith("dist");
   const builderClientDir = path9__default.resolve(
@@ -8369,6 +8426,7 @@ function createPluginViteConfig(pluginModuleUrl) {
     isInDist ? "./client" : "../dist/client"
   );
   return {
+    define: trustedDevHostDefines(options),
     publicDir: fs9__default.existsSync(builderClientDir) ? builderClientDir : void 0,
     build: {
       rollupOptions: {
@@ -8384,7 +8442,7 @@ function createPluginViteConfig(pluginModuleUrl) {
       // `npm run dev` ("There is a new version of the pre-bundle for X").
       holdUntilCrawlEnd: true,
       exclude: depsToExclude,
-      include: depsToInclude.filter((dep) => dep !== "zod/v3" && dep !== "zod/v4" && dep !== "zod/v4/core")
+      include: depsToInclude(options).filter((dep) => dep !== "zod/v3" && dep !== "zod/v4" && dep !== "zod/v4/core")
     },
     ssr: {
       noExternal: [
@@ -8489,7 +8547,11 @@ function createAgentBuilderCloudflarePlugins(options) {
     }
   });
 }
-function applyPluginEnvironmentConfig(config) {
+function applyPluginEnvironmentConfig(config, options = {}) {
+  config.define = {
+    ...config.define || {},
+    ...trustedDevHostDefines(options)
+  };
   config.optimizeDeps = config.optimizeDeps || {};
   config.optimizeDeps.holdUntilCrawlEnd = true;
   config.optimizeDeps.exclude = [
@@ -8498,7 +8560,7 @@ function applyPluginEnvironmentConfig(config) {
   ];
   config.optimizeDeps.include = [
     ...config.optimizeDeps.include || [],
-    ...depsToInclude.filter((dep) => !config.optimizeDeps?.include?.includes(dep))
+    ...depsToInclude(options).filter((dep) => !config.optimizeDeps?.include?.includes(dep))
   ];
   config.build = config.build || {};
   config.build.rollupOptions = config.build.rollupOptions || {};
@@ -8558,6 +8620,7 @@ function normalizeDeviceApprovalBrand(value) {
 // src/plugin.ts
 function agentbuilder(options = {}) {
   const deviceApproval = normalizeDeviceApprovalBrand(options.deviceApproval);
+  const trustedDevHosts = normalizeTrustedDevHosts(options.trustedDevHosts);
   const toolsDir = options.toolsDir ? path9__default.resolve(process.cwd(), options.toolsDir) : path9__default.resolve(process.cwd(), "agents/tools");
   const hooksDir = options.hooksDir ? path9__default.resolve(process.cwd(), options.hooksDir) : path9__default.resolve(process.cwd(), "agents/hooks");
   const threadApiDir = options.apiDir ? path9__default.resolve(process.cwd(), options.apiDir) : path9__default.resolve(process.cwd(), "agents/api");
@@ -8662,7 +8725,8 @@ export { CodeExecutionBridge, DurableAgentBuilder, DurableThread, ThreadWatchdog
     installedProviderPackageMap,
     hmr,
     sourceDirs,
-    regenerateTypes
+    regenerateTypes,
+    trustedDevHosts
   };
   const workerEntry = path9__default.relative(process.cwd(), generatedWorkerEntry).split(path9__default.sep).join("/");
   const corePlugin = {
@@ -8670,12 +8734,18 @@ export { CodeExecutionBridge, DurableAgentBuilder, DurableThread, ThreadWatchdog
     enforce: "pre",
     config() {
       writeGeneratedWorkerEntry();
-      const viteConfig = createPluginViteConfig(import.meta.url);
+      const viteConfig = createPluginViteConfig(import.meta.url, {
+        isPackageInstalled: isProviderPackageInstalled,
+        trustedDevHosts
+      });
       return viteConfig;
     },
     // Apply exclusions and inclusions to ALL environments including Cloudflare worker
     configEnvironment(_name, config) {
-      applyPluginEnvironmentConfig(config);
+      applyPluginEnvironmentConfig(config, {
+        isPackageInstalled: isProviderPackageInstalled,
+        trustedDevHosts
+      });
     },
     resolveId(id) {
       if (id === VIRTUAL_TOOLS_ID) {
@@ -8720,6 +8790,7 @@ export { CodeExecutionBridge, DurableAgentBuilder, DurableThread, ThreadWatchdog
     },
     buildStart() {
       writeGeneratedWorkerEntry();
+      warnLegacyRootAgentFiles(agentsDir);
       regenerateTypes();
       this.addWatchFile(toolsDir);
       this.addWatchFile(threadApiDir);