crewx 0.8.8-rc.13 → 0.8.8-rc.15

package/dist-server/domain/auth/guards/base-auth.guard.js

@@ -47,14 +47,17 @@ let BaseAuthGuard = class BaseAuthGuard {
         // CSRF not required for loopback — cross-origin CSRF to localhost is blocked by the browser.
         if (this.isLocalRequest(req))
             return true;
-        // External requests: CSRF Double Submit Cookie check
-        const csrfHeader = req.headers['x-csrf-token'];
-        const csrfCookie = req.cookies?.['crewx_csrf'];
-        if (!csrfHeader || csrfHeader !== csrfCookie) {
-            throw new common_1.ForbiddenException('CSRF token mismatch');
+        // External access → session first (throws 401 if missing/invalid)
+        this.validateWebSession(req);
+        // CSRF Double Submit only on unsafe methods (state-changing)
+        if (this.requiresCsrf(req)) {
+            const csrfHeader = req.headers['x-csrf-token'];
+            const csrfCookie = req.cookies?.['crewx_csrf'];
+            if (!csrfHeader || csrfHeader !== csrfCookie) {
+                throw new common_1.ForbiddenException('CSRF token mismatch');
+            }
         }
-        // External access → session validation
-        return this.validateWebSession(req);
+        return true;
     }
     isLocalRequest(req) {
         const ip = req.socket?.remoteAddress;
@@ -63,6 +66,10 @@ let BaseAuthGuard = class BaseAuthGuard {
         const host = (req.headers['host'] ?? '').split(':')[0];
         return host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
     }
+    requiresCsrf(req) {
+        const method = (req.method ?? 'GET').toUpperCase();
+        return !['GET', 'HEAD', 'OPTIONS'].includes(method);
+    }
     validateWebSession(req) {
         const cookieSessionId = req.cookies?.['crewx_token'];
         if (cookieSessionId && (0, session_store_js_1.validateSession)(cookieSessionId)) {

package/dist-server/domain/market/default-marketplace.json

@@ -0,0 +1,24 @@
+{
+  "version": "1.0",
+  "registries": [
+    {
+      "id": "crewx-official",
+      "name": "crewx-templates",
+      "url": "https://github.com/sowonlabs/crewx-templates",
+      "trust": "verified",
+      "type": "crewx",
+      "default": true
+    },
+    {
+      "id": "anthropic-skills",
+      "name": "anthropic-skills",
+      "url": "https://github.com/anthropics/skills",
+      "trust": "verified",
+      "type": "claude",
+      "default": false
+    }
+  ],
+  "deny": [],
+  "forceDisabled": [],
+  "forceEnabled": []
+}

package/dist-server/main.js

@@ -75,7 +75,7 @@ async function bootstrap() {
                 httpOnly: false,
                 sameSite: 'strict',
                 path: '/',
-                secure: process.env.NODE_ENV === 'production',
+                secure: req.secure || req.headers['x-forwarded-proto'] === 'https',
             });
         }
         next();

package/dist-server/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewx",
-  "version": "0.8.8-rc.13",
+  "version": "0.8.8-rc.15",
   "description": "CrewX — AI agent team dashboard with Electron UI and CLI (Web + Electron + Global CLI)",
   "main": "server.js",
   "bin": {
@@ -76,17 +76,17 @@
     "wink-nlp-utils": "2.1.0",
     "yargs": "17.7.0",
     "zod": "3.25.76",
-    "@crewx/cron": "0.1.10-rc.11",
+    "@crewx/cli": "0.8.8-rc.15",
+    "@crewx/cron": "0.1.10-rc.13",
     "@crewx/knowledge-core": "0.1.17",
-    "@crewx/cli": "0.8.8-rc.13",
-    "@crewx/memory": "0.1.22-rc.8",
-    "@crewx/sdk": "0.8.8-rc.13",
     "@crewx/doc": "0.1.8",
-    "@crewx/skill": "0.1.20",
-    "@crewx/wbs": "0.1.10-rc.6",
+    "@crewx/memory": "0.1.22-rc.10",
+    "@crewx/sdk": "0.8.8-rc.15",
     "@crewx/search": "0.1.9",
+    "@crewx/wbs": "0.1.10-rc.8",
+    "@crewx/skill": "0.1.20",
     "@crewx/shared": "0.0.5",
-    "@crewx/workflow": "0.3.21-rc.8"
+    "@crewx/workflow": "0.3.21-rc.10"
   },
   "devDependencies": {
     "@ccusage/codex": "0.0.1",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewx/cli",
-  "version": "0.8.8-rc.13",
+  "version": "0.8.8-rc.15",
   "license": "UNLICENSED",
   "engines": {
     "node": ">=20.19.0"