mirror of
https://github.com/deepseek-ai/deepseek-harness.git
synced 2026-08-29 04:26:38 +00:00
Yichen Jiang
732a7361f5
Some credentials cannot be configured, only obtained: getting one means a conversation — open this page, paste that code, pick an account. The new seam owns that conversation and the one-attempt-per-key lifecycle, and never the protocol, so a second authorization protocol arrives as another flow rather than as another seam. A flow is registered under the CredentialKey it writes, which is also how the seam knows which plugin answers for the format inside that record. The flow owns the write: run() resolving means the record is already committed through ctx.credentials, and the seam confirms it. That keeps a library persisting through its own store adapter the single writer instead of being copied back out and written twice. The interaction travels with the request rather than a registry, because whoever starts an authorization is the one who can talk to the human about it. A request already withdrawn never claims the key and never starts the flow — relying on each flow to check its signal before the first await would let one that does not hang holding the key.
1.1 KiB
1.1 KiB
credentials/ — credentials and authorization
English | 中文
The credential capability family separates reference resolution from its provider, and separates both from obtaining a credential that has to be asked for:
| Package | Role | ctx key |
|---|---|---|
credentials/ |
Credential-reference and credential-record seam | ctx.credentials |
credentials-local/ |
Environment and local-file provider | registers ctx.credentials |
authorization/ |
Plugin-owned flows that obtain a credential by asking a human | ctx.authorization |
Configuration carries references, not secret values. Consumers resolve those references at their operation boundary; the child READMEs own mutation, precedence, and storage semantics. An authorization flow writes a credential record and is keyed by it, so the two seams meet at the record and nowhere else.
The subsystem reference — CredentialRef, per-operation resolution, UI-safe CredentialInfo, provider layers — is docs/subsystems/credentials.md.