Joao Moura 0185dc7a22 fix(cli): the login needs an encrypted connection, and a grade is an integer 1..5 ...

Two CodeRabbit findings on the credential-routing change.

- _origin() accepted http://, so a trusted-but-cleartext AMP would still
  have received the bearer token in a header. The credential now also
  requires an encrypted connection: HTTPS, or plain HTTP to this machine
  (localhost, its subdomains, loopback), which is the rule
  TraceGrantClient already applies to collector grants. Anything else
  reads the run anonymously and says which of the two reasons applies.
- A verdict's grades were checked with isinstance(grade, int), which
  accepts True and 6; both would have printed as real grades and let the
  command exit 0. A grade is now an exact int in 1..5, or null.

Tests: a trusted http origin gets no credential, localhost does, the
encryption rule itself over nine origins, and four more malformed verdicts
(bool, 6, 0, 4.5). 56 passed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-21 08:34:42 -07:00

..

cli

fix(cli): the login needs an encrypted connection, and a grade is an integer 1..5

2026-09-21 08:34:42 -07:00

crewai

feat(tracing): task spans say the declared output format and what came out, agent spans carry the prompt and answer, tool spans say whether the cache answered (#7597)

2026-09-19 19:38:04 -03:00

crewai-core

feat(cli): improve platform integration setup UX (#7453)

2026-09-17 11:35:32 -07:00

crewai-files

feat: bump versions to 1.15.22 (#7520)

2026-09-16 22:04:49 +00:00

crewai-tools

fix(tools): preserve directory listing paths (#7548)

2026-09-17 22:47:38 +05:30

devtools

feat: bump versions to 1.15.22 (#7520)

2026-09-16 22:04:49 +00:00