重要前提
安装AI Skills的关键前提是:必须科学上网,且开启TUN模式,这一点至关重要,直接决定安装能否顺利完成,在此郑重提醒三遍:科学上网,科学上网,科学上网。查看完整安装教程 →
spider-weave by autumnsgrove/groveengine
npx skills add https://github.com/autumnsgrove/groveengine --skill spider-weave蜘蛛从不匆忙。它一次只吐一根丝,在移动到下一根之前仔细固定每一根。网以有机的方式生长——先放射状丝线,再螺旋状丝线,每个连接点都经过强度测试。完成后,网能捕捉重要的东西,同时让风穿过。以这种方式编织的身份验证系统,结构坚固、有弹性且优美。
/spider-weave 或提及 spider/auth搭配使用: raccoon-audit 用于安全审查,beaver-build 用于身份验证测试
SPIN --> CONNECT --> SECURE --> TEST --> BIND
| | | | |
Create Link Harden Verify Lock In
Threads Strands Knots Web Security
蜘蛛吐出第一根丝,小心地将其固定在框架的角落...
创建基础的身份验证结构。在选择模式、搭建文件框架、定义模式、连接环境变量之后,再编写逻辑代码。
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
src/lib/auth/ 目录,包含 index.ts、types.ts、session.ts、middleware.ts、pkce.ts、client.ts参考: 加载 references/oauth-pkce-flow.md 以获取 PKCE 设置代码、数据库模式、环境变量列表和完整的文件结构
丝线连接到丝线,网在框架上逐渐成形...
将身份验证系统连接起来:实现 OAuth 登录重定向、回调处理程序、用户更新插入和会话创建。然后连接客户端身份验证存储。
createSession)、验证(validateSession)和失效(invalidateSession)功能auth 存储,使用 loadUser() 在 Svelte 中实现响应式身份验证状态参考: 加载 references/oauth-pkce-flow.md 以获取完整的登录和回调路由实现,加载 references/session-management.md 以获取会话函数和身份验证存储
蜘蛛测试每个结,收紧松动的部分,剪掉不属于的部分...
在将身份验证系统交付给用户之前,对其进行加固。添加路由保护、安全标头、CSRF 验证和速率限制。
hooks.server.ts 中实现验证会话的 requireAuth() 中间件requireRole(allowedRoles) —— 未经授权访问返回 403X-Frame-Options、X-Content-Type-Options、Referrer-Policy、Content-Security-Policy参考: 加载 references/route-protection.md 以获取中间件代码和 RBAC 模式,加载 references/security-headers.md 以获取标头、CSRF、速率限制和 Cloudflare 边缘规则
蜘蛛拨动丝线,验证每根丝线是否以正确的频率真实振动...
全面测试身份验证,包括正常流程、安全边界情况和故障模式。自动化测试捕获回归问题;安全测试验证结是否牢固。
参考: 加载 references/oauth-pkce-flow.md 以获取 OAuth 流程测试,加载 references/route-protection.md 以获取路由保护测试套件
网已完成,每根丝线都绑紧,整体比各部分的总和更强大...
最终确定并锁定身份验证系统。完善用户体验,配置监控,并生成完成报告。
aria-busy 和 role="alert" 属性参考: 加载 references/session-management.md 以获取完整的集成检查清单、登录 UI 片段、监控模式和完成报告模板。加载 references/heartwood-integration.md 以获取 Grove 特定的登出流程和角色分配。
| 阶段 | 参考 | 何时加载 |
|---|---|---|
| SPIN | references/oauth-pkce-flow.md | 始终 —— 基础代码在此 |
| CONNECT | references/oauth-pkce-flow.md + references/session-management.md | 实现登录/回调/会话时 |
| SECURE | references/route-protection.md + references/security-headers.md | 添加中间件、标头、速率限制时 |
| TEST | references/oauth-pkce-flow.md + references/route-protection.md | 编写身份验证和路由测试时 |
| BIND | references/session-management.md + references/heartwood-integration.md | 最终确定、日志记录、报告时 |
| Grove/Heartwood | references/heartwood-integration.md | 任何 Grove 生态系统集成时 |
一次只织一根丝。不要急于一次性连接所有东西。在添加下一根之前,每根丝线都必须是安全的。
身份验证中的小错误会带来大后果。验证每个重定向,检查每个令牌,验证每个会话。
有漏洞的网什么也抓不住。测试错误路径、边界情况、故障模式。安全性只和最薄弱的环节一样强。
使用编织隐喻:
蜘蛛不会:
redirect_uri 或 next 参数(开放重定向)用户: "添加 GitHub OAuth 登录"
蜘蛛流程:
SPIN — "在 GitHub 中创建 OAuth 应用,生成客户端凭证,设置 PKCE 工具,创建身份验证端点结构"
CONNECT — "实现 /auth/github/login 重定向,/auth/github/callback 处理程序,用户更新插入逻辑,会话创建"
SECURE — "添加 CSRF 状态验证,安全的 Cookie 设置,身份验证端点上的速率限制,为新用户分配角色"
TEST — "测试 OAuth 流程,回调处理,会话创建,受保护路由访问,错误情况(权限被拒绝)"
BIND — "向 UI 添加登录按钮,错误状态处理,加载状态,文档,监控"
| 情况 | 方法 |
|---|---|
| 简单应用,内部用户 | 基于会话的身份验证 |
| 公共应用,社交登录 | OAuth 2.0 + PKCE |
| 移动端/SPA 的 API | 带有刷新令牌的 JWT |
| 服务到服务 | 带有 IP 白名单的 API Keys |
| Grove 生态系统 | Heartwood 集成(加载 references/heartwood-integration.md) |
编织之前:
eagle-architect — 用于身份验证系统设计决策swan-design — 用于身份验证流程规范编织期间:
elephant-build — 用于多文件身份验证实现raccoon-audit — 用于安全审查编织之后:
beaver-build — 用于身份验证测试turtle-harden — 用于超越网络之外的纵深防御加固deer-sense — 用于登录 UI 的可访问性审计编织良好的网能捕捉入侵者,同时让朋友通过。
每周安装次数
53
仓库
GitHub 星标
2
首次出现
2026年2月5日
安全审计
安装于
opencode53
gemini-cli52
codex52
github-copilot51
amp51
cline51
The spider doesn't rush. It spins one thread at a time, anchoring each carefully before moving to the next. The web grows organically—radial strands first, then the spiral, each connection tested for strength. When complete, the web catches what matters while letting the wind pass through. Authentication woven this way is strong, resilient, and beautiful in its structure.
/spider-weave or mentions spider/authPair with: raccoon-audit for security review, beaver-build for auth testing
SPIN --> CONNECT --> SECURE --> TEST --> BIND
| | | | |
Create Link Harden Verify Lock In
Threads Strands Knots Web Security
The spider spins the first thread, anchoring it carefully in the corner of the frame...
Create the foundational auth structure. Choose a pattern, scaffold the files, define the schema, and wire environment variables before writing a line of logic.
src/lib/auth/ with index.ts, types.ts, session.ts, middleware.ts, pkce.ts, client.tsReference: Load references/oauth-pkce-flow.md for PKCE setup code, database schema, env var list, and the full file structure
Thread connects to thread, the web taking shape across the frame...
Link the auth system together: implement the OAuth login redirect, the callback handler, user upsert, and session creation. Then wire up the client-side auth store.
createSession), validation (validateSession), and invalidation (invalidateSession)auth store with loadUser() for reactive auth state in SvelteReference: Load references/oauth-pkce-flow.md for the complete login and callback route implementations, and references/session-management.md for session functions and the auth store
The spider tests each knot, tightening what holds loose, cutting what doesn't belong...
Harden the authentication system before trusting it with users. Add route protection, security headers, CSRF validation, and rate limiting.
requireAuth() middleware that validates sessions in hooks.server.tsrequireRole(allowedRoles) for RBAC — 403 on unauthorized accessX-Frame-Options, X-Content-Type-Options, Referrer-Policy, Content-Security-PolicyReference: Load references/route-protection.md for middleware code and RBAC patterns, and references/security-headers.md for headers, CSRF, rate limiting, and Cloudflare edge rules
The spider plucks the strands, verifying each vibrates true at the right frequency...
Test authentication thoroughly across the happy path, security edge cases, and failure modes. Automated tests catch regressions; security tests verify the knots hold.
Reference: Load references/oauth-pkce-flow.md for OAuth flow tests and references/route-protection.md for route protection test suite
The web is complete, every strand bound tight, the whole stronger than the sum of its threads...
Finalize and lock in the authentication. Polish the user experience, configure monitoring, and produce the completion report.
aria-busy and role="alert" attributesReference: Load references/session-management.md for the full integration checklist, login UI snippet, monitoring patterns, and completion report template. Load references/heartwood-integration.md for Grove-specific logout flow and role assignment.
| Phase | Reference | Load When |
|---|---|---|
| SPIN | references/oauth-pkce-flow.md | Always — foundation code lives here |
| CONNECT | references/oauth-pkce-flow.md + references/session-management.md | Implementing login/callback/session |
| SECURE | references/route-protection.md + references/security-headers.md | Adding middleware, headers, rate limiting |
| TEST | references/oauth-pkce-flow.md + |
Weave one thread at a time. Don't rush to connect everything at once. Each strand must be secure before adding the next.
Small mistakes in auth have big consequences. Verify every redirect, check every token, validate every session.
A web with holes catches nothing. Test the error paths, the edge cases, the failure modes. Security is only as strong as the weakest strand.
Use weaving metaphors:
The spider does NOT:
redirect_uri or next parameters without validation (open redirect)User: "Add GitHub OAuth login"
Spider flow:
SPIN — "Create OAuth app in GitHub, generate client credentials, set up PKCE utilities, create auth endpoints structure"
CONNECT — "Implement /auth/github/login redirect, /auth/github/callback handler, user upsert logic, session creation"
SECURE — "Add CSRF state validation, secure cookie settings, rate limiting on auth endpoints, role assignment for new users"
TEST — "Test OAuth flow, callback handling, session creation, protected route access, error cases (denied permissions)"
BIND — "Add login button to UI, error state handling, loading states, documentation, monitoring"
| Situation | Approach |
|---|---|
| Simple app, internal users | Session-based auth |
| Public app, social login | OAuth 2.0 + PKCE |
| API for mobile/SPA | JWT with refresh tokens |
| Service-to-service | API keys with IP allowlist |
| Grove ecosystem | Heartwood integration (load references/heartwood-integration.md) |
Before Weaving:
eagle-architect — For auth system design decisionsswan-design — For auth flow specificationsDuring Weaving:
elephant-build — For multi-file auth implementationraccoon-audit — For security reviewAfter Weaving:
beaver-build — For auth testingturtle-harden — For defense-in-depth hardening beyond the webdeer-sense — For accessibility audit of login UIA well-woven web catches intruders while letting friends pass through.
Weekly Installs
53
Repository
GitHub Stars
2
First Seen
Feb 5, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
opencode53
gemini-cli52
codex52
github-copilot51
amp51
cline51
Lark Mail CLI 使用指南:邮件管理、安全规则与自动化工作流
40,400 周安装
references/route-protection.md| Writing auth and route tests |
| BIND | references/session-management.md + references/heartwood-integration.md | Finalizing, logging, reporting |
| Grove/Heartwood | references/heartwood-integration.md | Any Grove ecosystem integration |