Magolor
5249d9a4ce
* ui: show locked API key environment reference * fix(ui-settings-models): skip unused pi-ai credential reference * fix(ui-settings-models): show active provider auth source * test(llm): cover provider auth check failures * docs(ui-settings-models): clarify active provider authentication * test(web): update model key copy snapshots * fix(ui-settings-models): clarify native authentication source hint * fix: address PR 5483 review feedback * docs(llm): state empty auth lookup behavior * fix: refresh auth hints with credential snapshots * fix: require credential refresh revision * test: cover auth status projection * fix: refresh catalog and browser expectations after rebase * fix: keep auth status projection internal and explicit * fix: preserve credential source checks with signed-in account rows * test: pin Models authentication instead of inheriting host keys * fix: prioritize stored credentials across providers * fix: use one environment fallback hint * docs: refresh credential contract * docs: refresh config catalog * test: align provider hint verification * fix: use provider-native auth hints and endpoints * fix: cover oauth-capable provider auth hints * fix: show canonical endpoint defaults * fix: avoid misleading endpoint fallback * fix: label catalog endpoint defaults * fix: shorten auth hints with hover details * fix: clarify native auth resolution * test: align DeepSeek endpoint hint * fix: pair help button corner shape * fix: address credential precedence review Record the stored-credential precedence in a superseding Agent Note and an upgrade guide, and align the credentials subsystem page, package READMEs, and JSDoc with the order file > launch env > $cwd/.env > $DSH_HOME/.env. Report each pi-ai route's catalog endpoint and native-auth environment names through the provider directory, check the names against the installed pi-ai resolvers, and remove the llm/checkAuth and credential describe operations that no Models page code calls. Restore the route-derived key reference and the home expansion that reads the home directory only for a leading ~. * fix: clarify model authentication guidance * fix: explain native provider OAuth requirements * fix: keep authentication guidance method neutral * fix: show credential reference source in model editor * fix: use environment authentication in headless profile * fix: validate headless authentication and current provider metadata * test: retain authentication guidance coverage with account catalog updates * test: retain writable Models credentials with the pinned environment
2.4 KiB
2.4 KiB
description, kind
| description | kind |
|---|---|
| 凭据能力族的包映射：凭据引用 seam、环境与文件提供方、授权 flow 注册表，以及引用如何让机密值留在配置之外。 | package-group |
credentials/：凭据与授权
English | 中文
概述
credentials/ 组让配置引用机密的名字，而不嵌入机密值。使用 credentials/ 存储、查询和移除凭据；使用 credentials-local/ 将凭据私密地存储在本机，并以环境作为后备来源；当需要向人询问以获取凭据时，使用 authorization/。轮换后的存储值会作用于下一次模型请求，且存储值优先于 DEEPSEEK_API_KEY=… dsh。配置文件只包含凭据名称；本地机密值只有同一 OS 用户可读。
目录
包
三个包共同提供凭据功能：一个在运行时存储、查询与移除机密，而配置只写名字；第二个是默认的本机存储；第三个让插件获取必须向人请求的凭据。它们的 README 覆盖日常使用；全部约定以子系统参考为准。
| 包 | 角色 | ctx 键 |
|---|---|---|
credentials/ |
在运行时存储、查询与移除机密，而配置只写名字 | ctx.credentials |
credentials-local/ |
默认本机存储：一个私有 YAML 文件，优先于环境后备来源 | 注册 ctx.credentials |
authorization/ |
由插件拥有、通过询问人来取得凭据的 flow | ctx.authorization |
相关文档
先从子系统参考了解共享词汇，再看能力 seam 表与本地存储的配置面。
- 凭据子系统参考——
CredentialRef与CredentialKey、按操作解析、可安全用于 UI 的CredentialInfo、授权 flow 与生成的 Cordis 接口面。 - 能力 seam——本家族遵循的 Service Definition / Service Provider / Consumer 拆分。
- 生成配置目录——本地存储的每个受支持字段。
开发备注
维护者的工作上下文——点击展开
无。