crewx 0.8.6-rc.2 → 0.8.6-rc.4

package/bin/crewx-lib.js

@@ -19,6 +19,8 @@ export function parseServeFlags(args) {
   let token = undefined;
   let tokenFile = undefined;
   let noOpen = false;
+  let https = false;
+  let trust = false;
 
   const consumed = new Set();
 
@@ -60,6 +62,12 @@ export function parseServeFlags(args) {
     } else if (arg === '--no-open') {
       noOpen = true;
       consumed.add(i);
+    } else if (arg === '--https') {
+      https = true;
+      consumed.add(i);
+    } else if (arg === '--trust') {
+      trust = true;
+      consumed.add(i);
     } else if (arg === '--help' || arg === '-h') {
       return { help: true };
     }
@@ -74,7 +82,7 @@ export function parseServeFlags(args) {
     }
   }
 
-  return { port, token, tokenFile, noOpen };
+  return { port, token, tokenFile, noOpen, https, trust };
 }
 
 /**

package/bin/crewx.js

@@ -94,6 +94,8 @@ function launchWeb(serveArgs = [], { openBrowser = false } = {}) {
       '  --port <N>           Port to listen on (default: auto)\n' +
       '  --token <T>          MCP bearer token\n' +
       '  --token-file <path>  Read token from file\n' +
+      '  --https              Enable HTTPS with auto-generated certificate\n' +
+      '  --trust              Install CA to system trust store (requires --https)\n' +
       '  --no-open            Do not open browser automatically\n' +
       '  --help, -h           Show this help\n',
     );
@@ -110,10 +112,21 @@ function launchWeb(serveArgs = [], { openBrowser = false } = {}) {
     process.exit(flagsResult.error.startsWith('Unknown option') ? 2 : 1);
   }
 
-  const { port, token, tokenFile, noOpen } = flagsResult;
+  const { port, token, tokenFile, noOpen, https, trust } = flagsResult;
 
   const env = { ...process.env, NODE_ENV: 'production' }; // Force production — prevents users from bypassing FREE limits via env
 
+  if (https) {
+    env.CREWX_HTTPS = 'true';
+  }
+  if (trust) {
+    if (!https) {
+      console.error('❌ --trust requires --https');
+      process.exit(1);
+    }
+    env.CREWX_TRUST_CA = 'true';
+  }
+
   if (port) {
     env.PORT = String(port);
   }
@@ -144,6 +157,14 @@ function launchWeb(serveArgs = [], { openBrowser = false } = {}) {
     env.NODE_EXTRA_CA_CERTS = certPath;
   }
 
+  if (https) {
+    console.log('🔒 HTTPS enabled with SowonLabs CA');
+    if (!trust) {
+      console.log('⚠️  Browser may show a certificate warning.');
+      console.log('   To remove warning: npx crewx serve --https --trust');
+    }
+  }
+
   if (openBrowser && !noOpen) {
     env.CREWX_OPEN_BROWSER = '1';
   }

package/dist-server/bootstrap/tls.js

@@ -17,7 +17,7 @@ const CERT_PATH = (0, path_1.join)(TLS_DIR, 'cert.pem');
 exports.CERT_PATH = CERT_PATH;
 const KEY_PATH = (0, path_1.join)(TLS_DIR, 'key.pem');
 async function resolveHttpsOptions() {
-    if (process.env.NODE_ENV !== 'production') {
+    if (process.env.CREWX_HTTPS !== 'true') {
         return null;
     }
     if (process.env.TLS_CERT && process.env.TLS_KEY) {
@@ -37,7 +37,7 @@ async function resolveHttpsOptions() {
     const server = generateServerCert(ca.cert, ca.key);
     (0, fs_1.writeFileSync)(CERT_PATH, server.certPem, { mode: 0o644 });
     (0, fs_1.writeFileSync)(KEY_PATH, server.keyPem, { mode: 0o600 });
-    if (ca.isNew) {
+    if (ca.isNew && process.env.CREWX_TRUST_CA === 'true') {
         installCA(CA_CERT_PATH);
     }
     return {
@@ -109,13 +109,9 @@ function generateServerCert(caCert, caKey) {
     };
 }
 function installCA(caCertPath) {
-    if (process.env.CREWX_TRUST_CA === '0') {
-        return;
-    }
     const platform = process.platform;
     console.log('');
-    console.log('🔐 브라우저 경고 없이 HTTPS를 사용하려면 CA 인증서를 등록해야 합니다.');
-    console.log('   등록하지 않아도 HTTPS는 동작하지만, 브라우저에서 "주의 요함" 경고가 표시됩니다.');
+    console.log('🔐 Installing CA certificate to system trust store...');
     console.log('');
     try {
         if (platform === 'win32') {
@@ -125,16 +121,16 @@ function installCA(caCertPath) {
             (0, child_process_1.execSync)(`security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db "${caCertPath}"`, { stdio: 'inherit' });
         }
         else {
-            console.log('   Linux에서는 수동 등록이 필요합니다:');
+            console.log('   Manual installation required on Linux:');
             console.log(`   sudo cp ${caCertPath} /usr/local/share/ca-certificates/crewx-ca.crt`);
             console.log('   sudo update-ca-certificates');
             return;
         }
-        console.log('✅ SowonLabs CA가 시스템에 등록되었습니다. 브라우저 경고 없이 HTTPS를 사용할 수 있습니다.');
+        console.log('✅ SowonLabs CA installed. HTTPS will work without browser warnings.');
     }
     catch {
-        console.log('⚠️  CA 등록에 실패했습니다. HTTPS는 동작하지만 브라우저에서 경고가 표시됩니다.');
-        console.log(`   수동 등록: ${caCertPath}`);
+        console.log('⚠️  CA installation failed. HTTPS still works, but browser will show a warning.');
+        console.log(`   Manual install: ${caCertPath}`);
     }
 }
 function randomSerialNumber() {

package/dist-server/domain/auth/auth.controller.js

@@ -18,10 +18,10 @@ const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const class_validator_1 = require("class-validator");
 const throttler_1 = require("@nestjs/throttler");
-const mcp_constants_js_1 = require("../mcp/mcp.constants.js");
 const auth_constants_js_1 = require("./auth.constants.js");
 const public_decorator_js_1 = require("./decorators/public.decorator.js");
 const ip_utils_js_1 = require("./utils/ip.utils.js");
+const session_store_js_1 = require("./session-store.js");
 class LoginDto {
     username;
     password;
@@ -38,11 +38,9 @@ __decorate([
 ], LoginDto.prototype, "password", void 0);
 const COOKIE_NAME = 'crewx_token';
 let AuthController = AuthController_1 = class AuthController {
-    mcpToken;
     credentials;
     logger = new common_1.Logger(AuthController_1.name);
-    constructor(mcpToken, credentials) {
-        this.mcpToken = mcpToken;
+    constructor(credentials) {
         this.credentials = credentials;
     }
     // AUTH.CHECK: Guard already passed at this point — always returns 200
@@ -66,7 +64,8 @@ let AuthController = AuthController_1 = class AuthController {
                 error: { code: 'INVALID_CREDENTIALS', message: 'Invalid username or password' },
             });
         }
-        res.cookie(COOKIE_NAME, this.mcpToken.token, {
+        const sessionId = (0, session_store_js_1.createSession)();
+        res.cookie(COOKIE_NAME, sessionId, {
             httpOnly: true,
             sameSite: 'strict',
             secure: req.secure,
@@ -76,7 +75,10 @@ let AuthController = AuthController_1 = class AuthController {
         return { success: true, data: { authenticated: true } };
     }
     // AUTH.LOGOUT: clear session cookie (BaseAuthGuard applied — not @Public)
-    logout(res) {
+    logout(req, res) {
+        const cookieSessionId = req.cookies?.[COOKIE_NAME];
+        if (cookieSessionId)
+            (0, session_store_js_1.destroySession)(cookieSessionId);
         res.cookie(COOKIE_NAME, '', { httpOnly: true, maxAge: 0, path: '/' });
         return { success: true, data: { authenticated: false } };
     }
@@ -107,15 +109,15 @@ __decorate([
     (0, swagger_1.ApiOperation)({ operationId: 'AUTH.LOGOUT', summary: 'Logout and clear session cookie' }),
     (0, common_1.Post)('logout'),
     (0, common_1.HttpCode)(200),
-    __param(0, (0, common_1.Res)({ passthrough: true })),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)({ passthrough: true })),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Object)
 ], AuthController.prototype, "logout", null);
 exports.AuthController = AuthController = AuthController_1 = __decorate([
     (0, swagger_1.ApiTags)('auth'),
     (0, common_1.Controller)('auth'),
-    __param(0, (0, common_1.Inject)(mcp_constants_js_1.MCP_TOKEN)),
-    __param(1, (0, common_1.Inject)(auth_constants_js_1.AUTH_CREDENTIALS)),
-    __metadata("design:paramtypes", [Object, Object])
+    __param(0, (0, common_1.Inject)(auth_constants_js_1.AUTH_CREDENTIALS)),
+    __metadata("design:paramtypes", [Object])
 ], AuthController);

package/dist-server/domain/auth/guards/base-auth.guard.js

@@ -18,6 +18,7 @@ const core_1 = require("@nestjs/core");
 const mcp_constants_js_1 = require("../../mcp/mcp.constants.js");
 const public_decorator_js_1 = require("../decorators/public.decorator.js");
 const ip_utils_js_1 = require("../utils/ip.utils.js");
+const session_store_js_1 = require("../session-store.js");
 let BaseAuthGuard = class BaseAuthGuard {
     reflector;
     mcpToken;
@@ -43,15 +44,15 @@ let BaseAuthGuard = class BaseAuthGuard {
         return (0, ip_utils_js_1.isLoopback)(ip);
     }
     validateToken(req) {
-        const cookieToken = req.cookies?.['crewx_token'];
+        const cookieSessionId = req.cookies?.['crewx_token'];
         const bearerToken = (0, ip_utils_js_1.extractBearerToken)(req);
-        const token = cookieToken || bearerToken;
-        if (!token)
-            throw new common_1.UnauthorizedException('Authentication required');
-        if (!(0, ip_utils_js_1.safeCompare)(token, this.mcpToken.token)) {
-            throw new common_1.UnauthorizedException('Invalid token');
+        if (cookieSessionId && (0, session_store_js_1.validateSession)(cookieSessionId)) {
+            return true;
+        }
+        if (bearerToken && (0, ip_utils_js_1.safeCompare)(bearerToken, this.mcpToken.token)) {
+            return true;
         }
-        return true;
+        throw new common_1.UnauthorizedException('Authentication required');
     }
 };
 exports.BaseAuthGuard = BaseAuthGuard;

package/dist-server/domain/auth/session-store.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSession = createSession;
+exports.validateSession = validateSession;
+exports.destroySession = destroySession;
+const crypto_1 = require("crypto");
+const sessions = new Map();
+const SESSION_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days (matches cookie maxAge)
+function createSession() {
+    const sessionId = (0, crypto_1.randomBytes)(32).toString('hex');
+    sessions.set(sessionId, { createdAt: Date.now() });
+    return sessionId;
+}
+function validateSession(sessionId) {
+    const session = sessions.get(sessionId);
+    if (!session)
+        return false;
+    if (Date.now() - session.createdAt > SESSION_MAX_AGE_MS) {
+        sessions.delete(sessionId);
+        return false;
+    }
+    return true;
+}
+function destroySession(sessionId) {
+    sessions.delete(sessionId);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewx",
-  "version": "0.8.6-rc.2",
+  "version": "0.8.6-rc.4",
   "description": "CrewX — AI agent team dashboard with Electron UI and CLI (Web + Electron + Global CLI)",
   "main": "server.js",
   "bin": {
@@ -68,17 +68,17 @@
     "wink-nlp-utils": "^2.1.0",
     "yargs": "^17.7.0",
     "zod": "^3.22.0",
-    "@crewx/cli": "0.8.6-rc.2",
-    "@crewx/cron": "0.1.8",
+    "@crewx/cli": "0.8.6-rc.4",
     "@crewx/doc": "0.1.8",
-    "@crewx/memory": "0.1.10",
+    "@crewx/cron": "0.1.8",
     "@crewx/knowledge-core": "0.1.6",
-    "@crewx/sdk": "0.8.6-rc.3",
-    "@crewx/shared": "0.0.5",
-    "@crewx/wbs": "0.1.9",
+    "@crewx/memory": "0.1.10",
+    "@crewx/sdk": "0.8.6-rc.5",
     "@crewx/search": "0.1.9",
-    "@crewx/workflow": "0.3.18",
-    "@crewx/skill": "0.1.8"
+    "@crewx/skill": "0.1.8",
+    "@crewx/wbs": "0.1.9",
+    "@crewx/shared": "0.0.5",
+    "@crewx/workflow": "0.3.18"
   },
   "devDependencies": {
     "@ccusage/codex": "^0.0.1",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewx/cli",
-  "version": "0.8.6-rc.2",
+  "version": "0.8.6-rc.4",
   "license": "UNLICENSED",
   "engines": {
     "node": ">=20.19.0"