mirror of
https://github.com/hansjone/oclaw.git
synced 2026-10-15 01:20:49 +08:00
oliver
0e6de055a9
Users were asked to sign in again every ~30 minutes, even while active. Session lifetime - Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued, so the cookie vanished 30 min after login. Re-issue it on use (throttled by slidingInterval). - Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so the idle TTL never slid. assertPrincipalLive now reports activity and slides the session and the account's bridges (throttled). - New setting sessionIdleTimeoutHours (Settings page + config). Default 0 = no automatic sign-out; only a manual sign-out ends a session, so conversations and night-time cron are never cut off. 0.5-168 enables an idle timeout with the 7-day cap. The TTL is read live. - Stores support long TTLs: the absolute cap follows the TTL, older 7-day sessions are lifted on activity, and expiry timers re-arm instead of overflowing setTimeout (~24.8 days). UAC token check - Every 2 hours (and 1 min after start) each QR session's token is checked against icenterapi. A rejected token is only flagged, never a sign-out. Network errors, 5xx and bad JSON keep the previous verdict (the old 6h check revoked all of an account's sessions on any failure, including outages). - GET /uds-auth/session-status (non-sliding) returns alive + tokenValid. The client probes it every minute and on focus: a gone session signs the UI out with a notice; a rejected token opens a refresh QR once. - Scanning in refresh mode writes the new token into every live session of the account and the skill credential cache in place: no new session, no reload. Other accounts are rejected (token_refresh_emp_mismatch). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| acceptance-batch1.test.js | ||
| acceptance-batch2.test.js | ||
| agent-auth-owner.test.js | ||
| auth-session-p0.test.js | ||
| desktop-bootstrap.test.js | ||
| emergency-workspace-follow.test.js | ||
| host-context.test.js | ||
| i18n.test.js | ||
| local-admin.test.js | ||
| net-error.test.js | ||
| phase2-acl.test.js | ||
| phase3-security.test.js | ||
| phase4-ops.test.js | ||
| remediation-0310.test.js | ||
| sealed-workspace-follow.test.js | ||
| session-access.test.js | ||
| session-persistence.test.js | ||
| session-revalidation.test.js | ||
| startup-and-session-lifetime.test.js | ||
| ws-ticket-userinfo.test.js | ||