@flame0510/project-aether 1.1.9 → 1.1.10

package/app/api/auth/login/route.ts

@@ -70,11 +70,17 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
       .setExpirationTime('7d')
       .sign(secretKey);
 
+    // Use secure cookies only when running behind HTTPS.
+    // On plain HTTP the Secure flag prevents the browser from sending
+    // the cookie, causing an immediate redirect loop after login.
+    const isProduction = process.env.NODE_ENV === 'production';
+    const forceInsecure = process.env.REV4A_FORCE_INSECURE_COOKIE === '1';
+
     const response = NextResponse.json({ ok: true });
     response.cookies.set('rev4a_token', token, {
       httpOnly: true,
-      secure: true,
-      sameSite: 'strict',
+      secure: isProduction && !forceInsecure,
+      sameSite: isProduction && !forceInsecure ? 'strict' : 'lax',
       maxAge: 60 * 60 * 24 * 7,
       path: '/',
     });

package/app/api/wizard/complete/route.ts

@@ -21,10 +21,13 @@ export function POST(): NextResponse {
 
   const response = NextResponse.json({ done: true });
   // Also set cookie for backwards compat / existing clients
+  const isProduction = process.env.NODE_ENV === 'production';
+  const forceInsecure = process.env.REV4A_FORCE_INSECURE_COOKIE === '1';
+
   response.cookies.set('wizard_done', '1', {
     httpOnly: true,
-    sameSite: 'lax',
-    secure: process.env.NODE_ENV === 'production',
+    sameSite: isProduction && !forceInsecure ? 'strict' : 'lax',
+    secure: isProduction && !forceInsecure,
     maxAge: 60 * 60 * 24 * 365,
     path: '/',
   });

package/app/api/wizard/reset/route.ts

@@ -17,10 +17,13 @@ export function POST(): NextResponse {
   try { fs.unlinkSync(WIZARD_FILE); } catch { /* ignore */ }
 
   const response = NextResponse.json({ done: false });
+  const isProduction = process.env.NODE_ENV === 'production';
+  const forceInsecure = process.env.REV4A_FORCE_INSECURE_COOKIE === '1';
+
   response.cookies.set('wizard_done', '', {
     httpOnly: true,
-    secure: process.env.NODE_ENV === 'production',
-    sameSite: 'lax',
+    secure: isProduction && !forceInsecure,
+    sameSite: isProduction && !forceInsecure ? 'strict' : 'lax',
     maxAge: 0,
     path: '/',
   });

package/bin/rev4a.js

@@ -413,7 +413,7 @@ function serve(port) {
     ...process.env,
     ...envVars,
     PORT: String(port),
-    NODE_ENV: 'production',
+    NODE_ENV: process.env.NODE_ENV || 'production',
   };
 
   const children = [];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@flame0510/project-aether",
-  "version": "1.1.9",
-  "description": "Rev4a \u2014 Revolution for Agents. OpenClaw agent fleet orchestrator.",
+  "version": "1.1.10",
+  "description": "Rev4a — Revolution for Agents. OpenClaw agent fleet orchestrator.",
   "keywords": [
     "openclaw",
     "rev4a",