mirror of
https://github.com/hansjone/oclaw.git
synced 2026-10-12 10:30:52 +08:00
oliver
df97c5e042
Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw "sign-in failed / add API key" on DSH Desktop because the remote.mux opens anonymously at boot and every early call was rejected terminally. - gateway: anonymous workspace/follow reaches dsh-acl's empty baseline; anonymous streams are parked until the carrier aborts instead of failing; anonymous workspace/initializeDefault answers "nothing created" - request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket or bridge (sync + async variants used by all callers) - dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup instead of 403, so the Desktop welcome read no longer fails - desktop-bootstrap: key/account projection is best-effort per reference - client: emit connection/reset after login so boot-time caches (settings describe mirror -> Settings > Models) re-read under the real principal - sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min); bridge expiry slides with its session; MemoryStore persisted to sessions.json (bearer hash only, userData AES-256-GCM sealed) - README: session lifetime/persistence and DSH compatibility notes Also includes previously uncommitted uds-auth 0.3.x work in this tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
44 lines
1.6 KiB
Markdown
44 lines
1.6 KiB
Markdown
# uds-skill-auth（随插件分发）
|
||
|
||
本公共 skill **在插件仓库内**，与 uds-auth 一起提交、一起给别人：
|
||
|
||
```text
|
||
uds-auth/skills/uds-skill-auth/
|
||
SKILL.md
|
||
scripts/uds_skill_auth.py
|
||
```
|
||
|
||
## 现场怎么用
|
||
|
||
1. 安装 uds-auth 插件
|
||
2. 把 `uds-auth/skills/uds-skill-auth` 配进 Harness 的 skills 目录（或复制到工作区 `skills/uds-skill-auth`）
|
||
3. 用户扫码登录（或由 Host 为 cron 注入 `UDS_TASK_CAPABILITY`）
|
||
4. 业务 skill 通过 sibling / skills 根找到本 skill 的 `scripts/`
|
||
|
||
推荐：**优先** `request()` / outbound；原始 `resolve()` 依赖 `allowRawAgentToken`（默认关闭）。后台任务使用 `UDS_TASK_CAPABILITY`，不要依赖浏览器 Cookie。
|
||
|
||
## 业务 skill 引用
|
||
|
||
```python
|
||
from pathlib import Path
|
||
import sys
|
||
|
||
def load_uds_skill_auth():
|
||
here = Path(__file__).resolve().parent
|
||
candidate = here.parents[1] / "uds-skill-auth" / "scripts"
|
||
if not (candidate / "uds_skill_auth.py").is_file():
|
||
raise RuntimeError("请先安装插件自带的 uds-skill-auth skill")
|
||
sys.path.insert(0, str(candidate))
|
||
import uds_skill_auth
|
||
return uds_skill_auth
|
||
```
|
||
|
||
| 函数 | 用途 |
|
||
|------|------|
|
||
| `resolve()` | 原始凭证（需显式开启 raw；可带 `UDS_TASK_CAPABILITY`） |
|
||
| `request(method, url, ...)` | `POST /uds-auth/outbound`（推荐；支持 task capability） |
|
||
| `UdsAuthError` | 未登录 / 连不上 Host 等 |
|
||
|
||
环境变量：`DSH_SESSION_ID`、`UDS_TASK_CAPABILITY`（Host `mintTaskCapability` 签发）。
|
||
|
||
完整契约：[skill-auth-standard.zh.md](./skill-auth-standard.zh.md)
|