Users were asked to sign in again every ~30 minutes, even while active.
Session lifetime
- Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued,
so the cookie vanished 30 min after login. Re-issue it on use (throttled
by slidingInterval).
- Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so
the idle TTL never slid. assertPrincipalLive now reports activity and
slides the session and the account's bridges (throttled).
- New setting sessionIdleTimeoutHours (Settings page + config). Default 0 =
no automatic sign-out; only a manual sign-out ends a session, so
conversations and night-time cron are never cut off. 0.5-168 enables an
idle timeout with the 7-day cap. The TTL is read live.
- Stores support long TTLs: the absolute cap follows the TTL, older 7-day
sessions are lifted on activity, and expiry timers re-arm instead of
overflowing setTimeout (~24.8 days).
UAC token check
- Every 2 hours (and 1 min after start) each QR session's token is checked
against icenterapi. A rejected token is only flagged, never a sign-out.
Network errors, 5xx and bad JSON keep the previous verdict (the old 6h
check revoked all of an account's sessions on any failure, including
outages).
- GET /uds-auth/session-status (non-sliding) returns alive + tokenValid.
The client probes it every minute and on focus: a gone session signs the
UI out with a notice; a rejected token opens a refresh QR once.
- Scanning in refresh mode writes the new token into every live session of
the account and the skill credential cache in place: no new session, no
reload. Other accounts are rejected (token_refresh_emp_mismatch).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.
- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
anonymous streams are parked until the carrier aborts instead of failing;
anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
bridge expiry slides with its session; MemoryStore persisted to
sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes
Also includes previously uncommitted uds-auth 0.3.x work in this tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cookie-less Desktop needs localStorage bridge headers/WS params plus ALS enterWith and identity cache so login and history stay authenticated.
Co-authored-by: Cursor <cursoragent@cursor.com>
Shared project and channel sessions were still visible via canViewSystemSessions when the toggle was off; tighten ACL and copy so off means own only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give admin the same permissions as super/fallback, occupy directoryFlow at priority 1 so the button renders without colliding with the native picker, and inject uiWorkspace for pickDirectory.
Co-authored-by: Cursor <cursoragent@cursor.com>
super_admin/fallback_admin already could; admin now has canCreateWorkspace, and Host-side creates without browser ALS (IM) are no longer blocked as forbidden.
Co-authored-by: Cursor <cursoragent@cursor.com>
Super/fallback can toggle view-all (default on); admin/user stay own-only while still seeing unowned system sessions. Add restore/prune helpers so empty-shell cleanup is explicit and recoverable.
Wire client locale to the DSH host, return stable API error codes with localized messages, and replace bottom refresh with an in-frame retry for expired or offline QR.
Co-authored-by: Cursor <cursoragent@cursor.com>
Browser HTTP always enters withUserContext(null|identity); WhatsApp harness
calls session.create/prompt with no ALS frame. Treating undefined as
host-internal restores channel turns broken by the UDS session ACL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Gateway Remote stream mux starts async session.follow after the sync message
listener returns; without patching every ws copy and awaiting identity, ACL
saw an empty ALS and failed history load as gateway/internal.
Co-authored-by: Cursor <cursoragent@cursor.com>
Session RPC access checks visible workspaces (and cwd), wraps prompt and related methods with address.sessionId extraction, and gates create paths for non-admins.
Co-authored-by: Cursor <cursoragent@cursor.com>
workspace.follow no longer emits an empty baseline when ALS identity is missing, and administrator/fallback_admin always pass the workspace allow-list.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wait for WS identity before emptying workspace.follow, and hard-reload after login so the first subscribe is not stuck with an anonymous empty baseline.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop Secure cookies when not HTTPS so WS upgrades keep UDS_FALLBACK_*, and accept UDS_FALLBACK_UI for ACL identity.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop Cordis throws on ctx.workspaceRegistry, inject the registry handle for provisioning, and bind login identity onto remote.mux WebSocket listeners so super_admin keeps all workspaces.
Co-authored-by: Cursor <cursoragent@cursor.com>
Capture identity when workspace.follow starts and passthrough for canViewAllSessions so historical pre-plugin workspaces stay visible.
Co-authored-by: Cursor <cursoragent@cursor.com>
Anonymous and normal users no longer open the OS folder dialog from the empty chat hero; only super_admin can pick/create directories. Host gates directoryPicker.pick/list/createDirectory and the client cancels directoryFlow when canCreateWorkspace is false.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject anonymous /dsh-ops-cron requests after session validation, hide the 定时任务 chrome when logged out, and block client fetch to the cron HTTP API.
Co-authored-by: Cursor <cursoragent@cursor.com>
Filter session.list/search on the client when cookies are absent, ignore broadcast session-added events, and deepen host listState wrapping so ungrouped rows no longer leak while logged out.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bridge UDS identity into DSH RPC via ALS, stamp/filter sessions, auto-provision per-empNo workspaces, and hide Settings/Add-workspace for roles that lack those permissions.
Co-authored-by: Cursor <cursoragent@cursor.com>
