openclaw-brokerkit 0.3.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -206,3 +206,19 @@ frame and must bind each response to the supplied 128-bit nonce. `session` is
|
|
|
206
206
|
the same `brokerkit.io/delegated-web/v1` object returned by
|
|
207
207
|
`POST <basePath>/session`. The bridge is a BrokerKit interface; it contains
|
|
208
208
|
no host-product namespace or host-specific payload.
|
|
209
|
+
|
|
210
|
+
### Session rebootstrap
|
|
211
|
+
|
|
212
|
+
A direct-renewal token can expire while a browser tab is suspended. If the
|
|
213
|
+
host rejects renewal with `not_authorized`, a framed UI sends this
|
|
214
|
+
credential-free message once:
|
|
215
|
+
|
|
216
|
+
```text
|
|
217
|
+
{ type: "brokerkit.delegated-web.rebootstrap", version: 1 }
|
|
218
|
+
```
|
|
219
|
+
|
|
220
|
+
The host must accept it only from the embedded BrokerKit frame and reload only
|
|
221
|
+
that protected frame so its HTML response can inject a fresh session. Hosts
|
|
222
|
+
must rate-limit reloads and must not return a token through this message. This
|
|
223
|
+
keeps rebootstrap host-neutral while leaving session issuance at the trusted
|
|
224
|
+
HTTP boundary.
|