oclaw/uds-auth/skills/uds-skill-auth/SKILL.md
oliver df97c5e042
Some checks are pending
ci / test (push) Waiting to run
ci / test-postgresql (push) Waiting to run
fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions
Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 02:11:09 +08:00

2.2 KiB
Raw Blame History

name description
uds-skill-auth UDS 技能认证公共库。其它依赖 UDS 登录的 skill 必须安装本 skill,通过其 scripts/uds_skill_auth.py 取凭证或出站调用。需现场已安装 uds-auth 插件且用户已扫码登录。本 skill 随 uds-auth 插件一同分发。

uds-skill-auth(认证公共 Skill)

本 skill 不是业务能力,而是给其它 skill 用的公共库。随 uds-auth 插件一起提供,目录在插件内:

uds-auth/skills/uds-skill-auth/

现场依赖

1. 安装并启用 uds-auth 插件
2. 将本目录(插件内 skills/uds-skill-auth)加入 Harness skills 路径,
   或复制到工作区 skills/ 下与业务 skill 同级
3. 用户扫码登录
4. 再安装/使用业务 skill

给其它 Skill 用

业务 skill 的 Python 脚本里,把本 skill 的 scripts/ 加入 sys.path 后。推荐走 request()(outbound);resolve() 仅在 Host 开启 allowRawAgentToken 且任务注入了 credentials scope 的 UDS_TASK_CAPABILITY 时可用。

from uds_skill_auth import request, UdsAuthError

# 需要环境:DSH_SESSION_ID +(推荐)UDS_TASK_CAPABILITY
out = request("POST", "https://icenterapi.zte.com.cn/...", headers={...}, body={...})

定位本 skill(与业务 skill 同级,或已加入 skills 根):

from pathlib import Path
import sys

def load_uds_skill_auth():
    here = Path(__file__).resolve().parent
    for skills_root in [here.parents[1], *here.parents]:
        candidate = skills_root / "uds-skill-auth" / "scripts"
        if (candidate / "uds_skill_auth.py").is_file():
            sys.path.insert(0, str(candidate))
            import uds_skill_auth
            return uds_skill_auth
    raise RuntimeError("未找到 uds-skill-auth,请从 uds-auth 插件 skills/ 安装该 skill")

也可设置 UDS_AUTH_HELPERS 指向本 skill 的 scripts 绝对路径。

环境变量(Agent / 任务注入,勿教模型打印密钥)

  • DSH_SESSION_ID
  • DSH_WEB_URL
  • UDS_TASK_CAPABILITY(Host mintTaskCapability;scopes 按任务最小授权)

标准文档

见插件内 docs/skill-auth-standard.zh.md 与 docs/uds-skill-auth.zh.md。