hansjone/oclaw
1
0
Fork 0
mirror of https://github.com/hansjone/oclaw.git synced 2026-10-13 03:30:46 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
oclaw/uds-auth/docs/uds-skill-auth.zh.md
oliver df97c5e042
Some checks are pending
ci / test (push) Waiting to run
Details
ci / test-postgresql (push) Waiting to run
Details
fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions 
Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 02:11:09 +08:00

1.6 KiB
Raw Blame History

uds-skill-auth（随插件分发）

本公共 skill 在插件仓库内，与 uds-auth 一起提交、一起给别人：

uds-auth/skills/uds-skill-auth/
  SKILL.md
  scripts/uds_skill_auth.py

现场怎么用

  1. 安装 uds-auth 插件
  2. 把 uds-auth/skills/uds-skill-auth 配进 Harness 的 skills 目录（或复制到工作区 skills/uds-skill-auth）
  3. 用户扫码登录（或由 Host 为 cron 注入 UDS_TASK_CAPABILITY）
  4. 业务 skill 通过 sibling / skills 根找到本 skill 的 scripts/

推荐：优先 request() / outbound；原始 resolve() 依赖 allowRawAgentToken（默认关闭）。后台任务使用 UDS_TASK_CAPABILITY，不要依赖浏览器 Cookie。

业务 skill 引用

from pathlib import Path
import sys

def load_uds_skill_auth():
    here = Path(__file__).resolve().parent
    candidate = here.parents[1] / "uds-skill-auth" / "scripts"
    if not (candidate / "uds_skill_auth.py").is_file():
        raise RuntimeError("请先安装插件自带的 uds-skill-auth skill")
    sys.path.insert(0, str(candidate))
    import uds_skill_auth
    return uds_skill_auth
函数 用途
resolve() 原始凭证（需显式开启 raw；可带 UDS_TASK_CAPABILITY）
request(method, url, ...) POST /uds-auth/outbound（推荐；支持 task capability）
UdsAuthError 未登录 / 连不上 Host 等

环境变量：DSH_SESSION_ID、UDS_TASK_CAPABILITY（Host mintTaskCapability 签发）。

完整契约：skill-auth-standard.zh.md