0.3.16 mapped every post-scan failure to login_finalize_failed, hiding
codes with their own message (bootstrap_required, account_disabled,
registration_closed). Pass those through again and only fall back for
unknown errors.
The bootstrap_required message now includes the scanned employee number
and how to proceed (UDS_AUTH_INITIAL_ADMIN or emergency account login).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The QR poll showed a generic "network error" for any failure, and the
server collapsed every upstream failure into an opaque 502 with no log.
- Classify upstream failures (DNS, timeout, unreachable, TLS cert, HTTP
status, bad response) and return host-specific localized messages.
- Report why the post-scan user lookup failed instead of a generic
invalid-credentials error.
- Log the real errno/message server-side for every qr-proxy failure.
- Show the server message in the QR poll UI; keep "network error" only
for failed local fetches.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.
- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
anonymous streams are parked until the carrier aborts instead of failing;
anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
bridge expiry slides with its session; MemoryStore persisted to
sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes
Also includes previously uncommitted uds-auth 0.3.x work in this tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bundle qrcode SVG into lib/qrcode-bundled.cjs and drop the runtime dependency so Desktop field installs work without registry.npmjs.org.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cookie-less Desktop needs localStorage bridge headers/WS params plus ALS enterWith and identity cache so login and history stay authenticated.
Co-authored-by: Cursor <cursoragent@cursor.com>
Shared project and channel sessions were still visible via canViewSystemSessions when the toggle was off; tighten ACL and copy so off means own only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Default priority 0 lock displaced the shipped picker; clearing it left workspaces unselectable and blocked Session create in the DSH UI. Deny open-workspace with CSS and click guards only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give admin the same permissions as super/fallback, occupy directoryFlow at priority 1 so the button renders without colliding with the native picker, and inject uiWorkspace for pickDirectory.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove directory-flow reload, only shadow the picker while anonymous, and stop clearing login attrs on AuthBadge unmount so flat↔workspace observers cannot loop.
Co-authored-by: Cursor <cursoragent@cursor.com>
Directory-flow gate was shadowing the native picker; clearing it left an empty hole so Add workspace never rendered. Reload once when permission flips on, and harden canCreateWorkspace detection from role/permissions.
Co-authored-by: Cursor <cursoragent@cursor.com>
super_admin/fallback_admin already could; admin now has canCreateWorkspace, and Host-side creates without browser ALS (IM) are no longer blocked as forbidden.
Co-authored-by: Cursor <cursoragent@cursor.com>
Super/fallback can toggle view-all (default on); admin/user stay own-only while still seeing unowned system sessions. Add restore/prune helpers so empty-shell cleanup is explicit and recoverable.
Skip startup /api/me until QR load, stop blocking me on workspace provision, and register the footer login entry before heavy ACL gates so login appears immediately.
Co-authored-by: Cursor <cursoragent@cursor.com>
Status probes often fail with the QR request, so default fallback on and always show the link on QR error/expiry.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire client locale to the DSH host, return stable API error codes with localized messages, and replace bottom refresh with an in-frame retry for expired or offline QR.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI session behavior stays unchanged; login writes a separate skill cache, with optional retain-on-logout and loopback agent-credentials/outbound APIs plus helpers/docs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Browser HTTP always enters withUserContext(null|identity); WhatsApp harness
calls session.create/prompt with no ALS frame. Treating undefined as
host-internal restores channel turns broken by the UDS session ACL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Gateway Remote stream mux starts async session.follow after the sync message
listener returns; without patching every ws copy and awaiting identity, ACL
saw an empty ALS and failed history load as gateway/internal.
Co-authored-by: Cursor <cursoragent@cursor.com>
Exclude .dsh-ct-project from the flat-sidebar hide rule and from the auto-expand clicker so admin users can see scheduled tasks again.
Co-authored-by: Cursor <cursoragent@cursor.com>
Lets plugins such as dsh-ops-cron resolve empNo/role, provisioned cwd, and stamp session owners without reading roles.json directly.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop leaving pointer-events locks on the inert workspace card, and auto-bind the provisioned personal workspace from /api/me.
Co-authored-by: Cursor <cursoragent@cursor.com>
Session RPC access checks visible workspaces (and cwd), wraps prompt and related methods with address.sessionId extraction, and gates create paths for non-admins.
Co-authored-by: Cursor <cursoragent@cursor.com>
workspace.follow no longer emits an empty baseline when ALS identity is missing, and administrator/fallback_admin always pass the workspace allow-list.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wait for WS identity before emptying workspace.follow, and hard-reload after login so the first subscribe is not stuck with an anonymous empty baseline.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop Secure cookies when not HTTPS so WS upgrades keep UDS_FALLBACK_*, and accept UDS_FALLBACK_UI for ACL identity.
Co-authored-by: Cursor <cursoragent@cursor.com>
roles.json missing the hash field (or absent) enables the emergency account; an explicit null keeps it disabled.
Co-authored-by: Cursor <cursoragent@cursor.com>
Clear Secure cookies to match login Set-Cookie attrs, and setUser(null) on logout so the UI does not keep the stale session.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wait for /api/me before clearing sessions, ignore portal cookies for login gate, and stop hiding ConversationRoot when logged out.
Co-authored-by: Cursor <cursoragent@cursor.com>
