mirror of https://git.openapi.site/https://github.com/desirecore/market.git synced 2026-09-06 02:44:45 +08:00

Files

Yige 54716ea43a fix(skill): 修正算力配置治理流程 (#100 )

## 中文

- 将算力配置流程改为 `ManageCompute` 与 `ComputeCredential set`
- 明确密钥只允许写入且工具结果保持脱敏
- 补全 GUI `mode=control` 回退、旧客户端条件化验证和升级提示
- 禁止引导 Agent 绕过 renderer Origin/token 边界

## English

- Route compute configuration through `ManageCompute` and
`ComputeCredential set`
- Keep credentials write-only and redacted from tool results
- Complete the GUI `mode=control` fallback, legacy-client validation,
and upgrade guidance
- Stop directing Agents around renderer Origin/token protections

## Validation

- Translation freshness check
- Skill i18n validation
- `git diff --check`

2026-08-29 14:26:24 -04:00

6.4 KiB

Raw Blame History

name, description, version, type, risk_level, status, disable-model-invocation, tags, metadata, market

name

description

version

type

risk_level

status

disable-model-invocation

Configure Compute

Configure DesireCore compute through governed tools. Do not call the local /api/compute/* management endpoints from Bash, HttpRequest, or scripts: those endpoints intentionally require a trusted renderer Origin and instance token.

Security contract

API keys are write-only for agents. Never read secrets.json, request ComputeCredential(action='get', raw=true), or repeat a key in tool results or chat.
Use ComputeCredential(action='set') to create or replace the key of an existing user-managed provider. If the provider has no credential reference, the tool creates and attaches one without returning the plaintext. This path is approval-gated and audited; approval cards, tool events, receipts, and session history redact the sensitive value. System-managed credentials are not writable.
Pass a value to ComputeCredential(action='set') only when the user already supplied the replacement key in the current request. If the agent must never handle the plaintext, use the GUI to focus the password field, let the user type into it directly, then continue the save flow. Never ask for the key in ordinary chat or read the masked field back into the model.
credentialMode=none means the provider needs no key. Ollama is treated as none even when an older config does not declare the field.
If the user asks for the current key, explain that the agent can replace it but cannot read it back. The human-only UI reveal flow remains separate.

Workflow for an existing provider

First confirm ManageCompute is available through the current tool catalog. If it is absent (for example on an older installed client), use the governed GUI workflow below for the whole task; do not fall back to local HTTP.

Call ManageCompute(action='list'). Record the exact provider ID, enabled state, credential mode, status, and model count.
If credential mode is required and the user supplied a new key in the current request, call ComputeCredential(action='set', providerId=..., value=...). Do not echo the value. If the agent must not handle plaintext, use the human-entry GUI flow below. For none, skip this step.
Call ManageCompute(action='set_enabled', providerId=..., enabled=true).
Call ManageCompute(action='sync_models', providerId=...). For Ollama this discovers locally installed models; for supported cloud providers it merges the built-in model list.
Call InspectModels to verify the intended model is selectable. When the user asked for a real test, run one short fixed-model conversation and verify the run receipt names the requested provider/model.

Mutating ManageCompute and ComputeCredential operations use the platform's approval policy. Do not add a second confirmation in prose unless information is missing or the user requested a destructive replacement.

Fields not yet covered by ManageCompute

Creating a new custom provider, changing base URL/API format, deleting a provider, and interactive key verification currently remain GUI operations. Use ControlDesireCoreGui, not a generic browser/CUA tool:

list_instances, then begin(instance=<id>, mode=control, reason=...) for the intended DesireCore instance. The default observe mode is read-only and cannot modify compute settings.
Use the governed CDP methods to open Resources → Compute and make the change.
Finish with end. If ManageCompute exists, call ManageCompute(action='list'); on an older client, verify the saved state in the GUI instead. Call InspectModels when available to confirm model selection.

If the installed version includes ControlDesireCoreGui but reports that GUI control is disabled, the owner must set config/security.json#desktopGuiControl.enabled=true and restart that instance. If the tool is absent from the catalog entirely, the client is too old and must be upgraded; changing the switch cannot add a missing tool. Do not bypass the renderer HTTP boundary.

Completion report

Report the provider ID, enabled state, synchronized model count, and model test result. Never include the key, its encrypted storage, or a plaintext fingerprint.

6.4 KiB Raw Blame History Unescape Escape