mirror of
https://github.com/hansjone/oclaw.git
synced 2026-10-17 15:53:31 +08:00
oliver
df97c5e042
Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw "sign-in failed / add API key" on DSH Desktop because the remote.mux opens anonymously at boot and every early call was rejected terminally. - gateway: anonymous workspace/follow reaches dsh-acl's empty baseline; anonymous streams are parked until the carrier aborts instead of failing; anonymous workspace/initializeDefault answers "nothing created" - request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket or bridge (sync + async variants used by all callers) - dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup instead of 403, so the Desktop welcome read no longer fails - desktop-bootstrap: key/account projection is best-effort per reference - client: emit connection/reset after login so boot-time caches (settings describe mirror -> Settings > Models) re-read under the real principal - sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min); bridge expiry slides with its session; MemoryStore persisted to sessions.json (bearer hash only, userData AES-256-GCM sealed) - README: session lifetime/persistence and DSH compatibility notes Also includes previously uncommitted uds-auth 0.3.x work in this tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
62 lines
2.2 KiB
Markdown
62 lines
2.2 KiB
Markdown
---
|
||
name: uds-skill-auth
|
||
description: UDS 技能认证公共库。其它依赖 UDS 登录的 skill 必须安装本 skill，通过其 scripts/uds_skill_auth.py 取凭证或出站调用。需现场已安装 uds-auth 插件且用户已扫码登录。本 skill 随 uds-auth 插件一同分发。
|
||
---
|
||
|
||
# uds-skill-auth（认证公共 Skill）
|
||
|
||
本 skill **不是业务能力**，而是给其它 skill 用的公共库。**随 uds-auth 插件一起提供**，目录在插件内：
|
||
|
||
```text
|
||
uds-auth/skills/uds-skill-auth/
|
||
```
|
||
|
||
## 现场依赖
|
||
|
||
```text
|
||
1. 安装并启用 uds-auth 插件
|
||
2. 将本目录（插件内 skills/uds-skill-auth）加入 Harness skills 路径，
|
||
或复制到工作区 skills/ 下与业务 skill 同级
|
||
3. 用户扫码登录
|
||
4. 再安装/使用业务 skill
|
||
```
|
||
|
||
## 给其它 Skill 用
|
||
|
||
业务 skill 的 Python 脚本里，把本 skill 的 `scripts/` 加入 `sys.path` 后。**推荐**走 `request()`（outbound）；`resolve()` 仅在 Host 开启 `allowRawAgentToken` 且任务注入了 `credentials` scope 的 `UDS_TASK_CAPABILITY` 时可用。
|
||
|
||
```python
|
||
from uds_skill_auth import request, UdsAuthError
|
||
|
||
# 需要环境：DSH_SESSION_ID +（推荐）UDS_TASK_CAPABILITY
|
||
out = request("POST", "https://icenterapi.zte.com.cn/...", headers={...}, body={...})
|
||
```
|
||
|
||
定位本 skill（与业务 skill 同级，或已加入 skills 根）：
|
||
|
||
```python
|
||
from pathlib import Path
|
||
import sys
|
||
|
||
def load_uds_skill_auth():
|
||
here = Path(__file__).resolve().parent
|
||
for skills_root in [here.parents[1], *here.parents]:
|
||
candidate = skills_root / "uds-skill-auth" / "scripts"
|
||
if (candidate / "uds_skill_auth.py").is_file():
|
||
sys.path.insert(0, str(candidate))
|
||
import uds_skill_auth
|
||
return uds_skill_auth
|
||
raise RuntimeError("未找到 uds-skill-auth，请从 uds-auth 插件 skills/ 安装该 skill")
|
||
```
|
||
|
||
也可设置 `UDS_AUTH_HELPERS` 指向本 skill 的 `scripts` 绝对路径。
|
||
|
||
## 环境变量（Agent / 任务注入，勿教模型打印密钥）
|
||
|
||
- `DSH_SESSION_ID`
|
||
- `DSH_WEB_URL`
|
||
- `UDS_TASK_CAPABILITY`（Host `mintTaskCapability`；scopes 按任务最小授权）
|
||
|
||
## 标准文档
|
||
|
||
见插件内 `docs/skill-auth-standard.zh.md` 与 `docs/uds-skill-auth.zh.md`。
|