@hybridaione/hybridclaw 0.25.0 → 0.25.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/CHANGELOG.md +9 -0
  2. package/README.md +1 -1
  3. package/console/package.json +1 -1
  4. package/container/npm-shrinkwrap.json +2 -2
  5. package/container/package-lock.json +2 -2
  6. package/container/package.json +1 -1
  7. package/dist/gateway/gateway-http-server.d.ts.map +1 -1
  8. package/dist/gateway/gateway-http-server.js +1 -8
  9. package/dist/gateway/gateway-http-server.js.map +1 -1
  10. package/dist/security/admin-rbac.d.ts.map +1 -1
  11. package/dist/security/admin-rbac.js +9 -2
  12. package/dist/security/admin-rbac.js.map +1 -1
  13. package/docs/content/developer-guide/admin-access-control.md +4 -2
  14. package/npm-shrinkwrap.json +5 -5
  15. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -2,6 +2,15 @@
2
2
 
3
3
  ## Unreleased
4
4
 
5
+ ## [0.25.1](https://github.com/HybridAIOne/hybridclaw/tree/v0.25.1) - 2026-06-20
6
+
7
+ ### Fixed
8
+
9
+ - **HybridAI cloud admin sessions**: HybridAI-launched sessions without scoped
10
+ RBAC claims are treated as full admin sessions for compatibility, explicit
11
+ scoped sessions remain restricted, and cookie-authenticated admin mutations
12
+ respect forwarded public origins behind the cloud proxy.
13
+
5
14
  ## [0.25.0](https://github.com/HybridAIOne/hybridclaw/tree/v0.25.0) - 2026-06-20
6
15
 
7
16
  ### Added
package/README.md CHANGED
@@ -220,7 +220,7 @@ Core pieces:
220
220
  | Build desktop releases | [Desktop Release Builds](https://hybridaione.github.io/hybridclaw/docs/developer-guide/desktop-release) |
221
221
  | Contribute | [CONTRIBUTING.md](./CONTRIBUTING.md), [docs/content/README.md](./docs/content/README.md) |
222
222
 
223
- Latest release: [v0.25.0](https://github.com/HybridAIOne/hybridclaw/releases/tag/v0.25.0).
223
+ Latest release: [v0.25.1](https://github.com/HybridAIOne/hybridclaw/releases/tag/v0.25.1).
224
224
  Release notes: [CHANGELOG.md](./CHANGELOG.md)
225
225
 
226
226
  ## Development
package/console/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@hybridaione/hybridclaw-console",
3
3
  "private": true,
4
- "version": "0.25.0",
4
+ "version": "0.25.1",
5
5
  "type": "module",
6
6
  "scripts": {
7
7
  "build": "tsc --noEmit && vite build",
package/container/npm-shrinkwrap.json CHANGED
@@ -1,12 +1,12 @@
1
1
  {
2
2
  "name": "hybridclaw-agent",
3
- "version": "0.25.0",
3
+ "version": "0.25.1",
4
4
  "lockfileVersion": 3,
5
5
  "requires": true,
6
6
  "packages": {
7
7
  "": {
8
8
  "name": "hybridclaw-agent",
9
- "version": "0.25.0",
9
+ "version": "0.25.1",
10
10
  "dependencies": {
11
11
  "@modelcontextprotocol/sdk": "1.29.0",
12
12
  "@mozilla/readability": "0.6.0",
package/container/package-lock.json CHANGED
@@ -1,12 +1,12 @@
1
1
  {
2
2
  "name": "hybridclaw-agent",
3
- "version": "0.25.0",
3
+ "version": "0.25.1",
4
4
  "lockfileVersion": 3,
5
5
  "requires": true,
6
6
  "packages": {
7
7
  "": {
8
8
  "name": "hybridclaw-agent",
9
- "version": "0.25.0",
9
+ "version": "0.25.1",
10
10
  "dependencies": {
11
11
  "@modelcontextprotocol/sdk": "1.29.0",
12
12
  "@mozilla/readability": "0.6.0",
package/container/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "hybridclaw-agent",
3
- "version": "0.25.0",
3
+ "version": "0.25.1",
4
4
  "type": "module",
5
5
  "main": "dist/index.js",
6
6
  "packageManager": "npm@11.10.0",
package/dist/gateway/gateway-http-server.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"gateway-http-server.d.ts","sourceRoot":"","sources":["../../src/gateway/gateway-http-server.ts"],"names":[],"mappings":"AA4zNA,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,wBAAgB,sBAAsB,IAAI,iBAAiB,CAk3B1D"}
1
+ {"version":3,"file":"gateway-http-server.d.ts","sourceRoot":"","sources":["../../src/gateway/gateway-http-server.ts"],"names":[],"mappings":"AAqzNA,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,wBAAgB,sBAAsB,IAAI,iBAAiB,CAk3B1D"}
package/dist/gateway/gateway-http-server.js CHANGED
@@ -1381,18 +1381,11 @@ function requestUsesHttps(req) {
1381
1381
  return forwardedProto === 'https';
1382
1382
  return req.socket.encrypted === true;
1383
1383
  }
1384
- function resolveRequestOriginForAuth(req) {
1385
- const host = String(req.headers.host || '').trim();
1386
- if (!host)
1387
- return null;
1388
- const protocol = requestUsesHttps(req) ? 'https' : 'http';
1389
- return `${protocol}://${host}`;
1390
- }
1391
1384
  function hasSameGatewayOrigin(req) {
1392
1385
  const origin = String(req.headers.origin || '').trim();
1393
1386
  if (!origin)
1394
1387
  return false;
1395
- return origin === resolveRequestOriginForAuth(req);
1388
+ return origin === resolveRequestOrigin(req);
1396
1389
  }
1397
1390
  function hasApiAuth(req, url, opts) {
1398
1391
  const authHeader = req.headers.authorization || '';