mirror of
https://github.com/deepseek-ai/deepseek-harness.git
synced 2026-09-11 04:00:38 +00:00
Yichen Jiang
732a7361f5
Some credentials cannot be configured, only obtained: getting one means a conversation — open this page, paste that code, pick an account. The new seam owns that conversation and the one-attempt-per-key lifecycle, and never the protocol, so a second authorization protocol arrives as another flow rather than as another seam. A flow is registered under the CredentialKey it writes, which is also how the seam knows which plugin answers for the format inside that record. The flow owns the write: run() resolving means the record is already committed through ctx.credentials, and the seam confirms it. That keeps a library persisting through its own store adapter the single writer instead of being copied back out and written twice. The interaction travels with the request rather than a registry, because whoever starts an authorization is the one who can talk to the human about it. A request already withdrawn never claims the key and never starts the flow — relying on each flow to check its signal before the first await would let one that does not hang holding the key.
1.0 KiB
1.0 KiB
credentials/：凭据与授权
English | 中文
凭据能力家族将引用解析与提供方分离，并把二者与"必须开口去要才能拿到的凭据"再分开：
| 包 | 角色 | ctx 键 |
|---|---|---|
credentials/ |
凭据引用与凭据记录 seam | ctx.credentials |
credentials-local/ |
环境与本地文件提供方 | 注册 ctx.credentials |
authorization/ |
由插件拥有、通过询问人来取得凭据的 flow | ctx.authorization |
配置携带引用而非机密值。消费方在其操作边界解析这些引用；变更、优先级与存储语义由子级 README 负责。授权 flow 写入一条凭据记录并以它为键，因此两个 seam 只在记录处相交，别无其他接触面。
子系统参考——CredentialRef、按操作解析、对 UI 安全的 CredentialInfo、提供方层——见 docs/subsystems/credentials.md。