fix(uds-auth): isolate trusted Host calls from browser identity

uds-auth/lib/context.js

@@ -33,6 +33,17 @@ export function runWithUserContext(userContext, fn) {
   return userContextStorage.run(userContext, fn)
 }
 
+/**
+ * Run a trusted in-process Host operation without a browser identity.
+ * Only Host plugins receive this callback API; it is not a remote endpoint.
+ * @param {Function} fn
+ * @returns {*} The operation's result, preserving synchronous and async calls.
+ */
+export function runAsHost(fn) {
+  if (typeof fn !== 'function') throw new TypeError('Host operation must be a function')
+  return userContextStorage.run(undefined, fn)
+}
+
 /**
  * Persist ALS for the rest of this async execution chain.
  * Needed for Gateway Remote stream mux: message handlers are sync but start

uds-auth/lib/index.js

@@ -21,6 +21,7 @@ import {
   LOCAL_ADMIN_BOX_ENV,
 } from './local-admin.js'
 import { SessionBridgeStore } from './session-bridge.js'
+import { runAsHost } from './context.js'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const require = createRequire(import.meta.url)
@@ -1267,6 +1268,7 @@ async function initServices(ctx, config) {
     }
 
     const udsAuth = {
+      runAsHost,
       async resolveRequestIdentity(req) {
         const identity = await resolveIdentity(req)
         if (!identity?.empNo) return null