human-auth-delegation

name: "human-auth-delegation" description: "Overview of how Human Phone authorization and delegation artifacts work. For specific capability handling, see the individual human-auth-* skills." metadata: {"openclaw":{"triggers":{"any":["human_auth","delegation","artifact","authorize"]}}}

Human Auth Delegation Overview

When a task requires real-world data or sensitive authorization, you call request_human_auth. The human on their phone approves and may return a delegation artifact — a file containing the data you need.

How It Works

1. You call request_human_auth(capability, instruction, ...).
2. The human sees an authorization page on their phone.
3. They approve/reject and optionally attach data (photo, audio, coordinates, code, credentials, etc.).
4. You receive a result with artifact_path and artifact_summary.
5. You decide what to do next based on the artifact and current screen state.

Artifact Result Format

After request_human_auth returns, the tool result contains:

• status: approved / rejected / timeout
• artifact_path: local file path to the saved artifact
• artifact_summary: structured key-value description (kind, size, fields, etc.)

What to Do With the Artifact

Each capability has its own skill with detailed handling instructions:

Use read(<skill_location>) to load the relevant skill for detailed instructions.

Key Principles

1. You decide. The runtime only saves the artifact. You choose how to apply it.
2. Redo the flow. The app's UI may have changed while waiting for human auth. After receiving the artifact, you typically need to:
   • Press Back (keyevent KEYCODE_BACK) to exit the current screen (camera preview, file picker, etc.)
   • Push/prepare the data (adb push, type_text, geo fix, etc.)
   • Re-navigate to the point where the data is needed (re-open picker, re-focus input field)
   • Complete the action (select file, tap submit, etc.)
3. Read the artifact first. For JSON artifacts (credentials, codes, coordinates), call read(<artifact_path>) to get the actual values. OTP values are not in the session log.
4. Clean up sensitive data. Delete credential/payment artifacts after use: exec("rm <path>").
5. File artifacts are auto-pushed. When you receive a file artifact (image, audio, etc.), the runtime automatically pushes it to /sdcard/Download/ on Agent Phone and runs media scan. The result includes device_path=/sdcard/Download/openpocket-human-auth-<ts>.<ext> — this is the path you use in file pickers. You do NOT need to manually adb push.