@codexhost/cli-darwin-arm64 0.17.0 → 0.17.2

package/app/plugins/qoder/plugin.mjs

@@ -28478,6 +28478,21 @@ var threadSteeringInspectParamsSchema = external_exports.object({
   /** The text about to be steered; a Harness command always stops and restarts. */
   text: external_exports.string().optional()
 }).strict();
+var threadSteeringContextSchema = external_exports.object({
+  kind: external_exports.literal("application"),
+  value: external_exports.string().transform((text, context) => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      context.addIssue({ code: "custom", message: "Invalid steering context JSON" });
+      return external_exports.NEVER;
+    }
+  }).pipe(external_exports.object({
+    expectedTurnId: hostTurnIdSchema,
+    clientUserMessageId: external_exports.string().min(1),
+    delivery: external_exports.enum(["newTurn", "activeTurn"])
+  }).strict())
+}).strict().transform((context) => context.value);
 var threadSteerDeliverySchema = external_exports.enum(["activeTurn", "newTurn"]);
 var threadSteeringInspectResultSchema = external_exports.object({
   delivery: external_exports.enum(["official", "activeTurn", "newTurn"])

package/app/plugins/qoder-cn/plugin.mjs

@@ -28075,6 +28075,21 @@ var threadSteeringInspectParamsSchema = external_exports.object({
   /** The text about to be steered; a Harness command always stops and restarts. */
   text: external_exports.string().optional()
 }).strict();
+var threadSteeringContextSchema = external_exports.object({
+  kind: external_exports.literal("application"),
+  value: external_exports.string().transform((text, context) => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      context.addIssue({ code: "custom", message: "Invalid steering context JSON" });
+      return external_exports.NEVER;
+    }
+  }).pipe(external_exports.object({
+    expectedTurnId: hostTurnIdSchema,
+    clientUserMessageId: external_exports.string().min(1),
+    delivery: external_exports.enum(["newTurn", "activeTurn"])
+  }).strict())
+}).strict().transform((context) => context.value);
 var threadSteerDeliverySchema = external_exports.enum(["activeTurn", "newTurn"]);
 var threadSteeringInspectResultSchema = external_exports.object({
   delivery: external_exports.enum(["official", "activeTurn", "newTurn"])

package/app/plugins/qwen-code/plugin.mjs

@@ -22380,6 +22380,21 @@ var threadSteeringInspectParamsSchema = external_exports.object({
   /** The text about to be steered; a Harness command always stops and restarts. */
   text: external_exports.string().optional()
 }).strict();
+var threadSteeringContextSchema = external_exports.object({
+  kind: external_exports.literal("application"),
+  value: external_exports.string().transform((text, context) => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      context.addIssue({ code: "custom", message: "Invalid steering context JSON" });
+      return external_exports.NEVER;
+    }
+  }).pipe(external_exports.object({
+    expectedTurnId: hostTurnIdSchema,
+    clientUserMessageId: external_exports.string().min(1),
+    delivery: external_exports.enum(["newTurn", "activeTurn"])
+  }).strict())
+}).strict().transform((context) => context.value);
 var threadSteerDeliverySchema = external_exports.enum(["activeTurn", "newTurn"]);
 var threadSteeringInspectResultSchema = external_exports.object({
   delivery: external_exports.enum(["official", "activeTurn", "newTurn"])

package/app/plugins/workbuddy/plugin.mjs

@@ -15492,6 +15492,21 @@ var threadSteeringInspectParamsSchema = external_exports.object({
   /** The text about to be steered; a Harness command always stops and restarts. */
   text: external_exports.string().optional()
 }).strict();
+var threadSteeringContextSchema = external_exports.object({
+  kind: external_exports.literal("application"),
+  value: external_exports.string().transform((text2, context) => {
+    try {
+      return JSON.parse(text2);
+    } catch {
+      context.addIssue({ code: "custom", message: "Invalid steering context JSON" });
+      return external_exports.NEVER;
+    }
+  }).pipe(external_exports.object({
+    expectedTurnId: hostTurnIdSchema,
+    clientUserMessageId: external_exports.string().min(1),
+    delivery: external_exports.enum(["newTurn", "activeTurn"])
+  }).strict())
+}).strict().transform((context) => context.value);
 var threadSteerDeliverySchema = external_exports.enum(["activeTurn", "newTurn"]);
 var threadSteeringInspectResultSchema = external_exports.object({
   delivery: external_exports.enum(["official", "activeTurn", "newTurn"])

package/app/plugins/zcode/plugin.mjs

@@ -15678,6 +15678,21 @@ var threadSteeringInspectParamsSchema = external_exports.object({
   /** The text about to be steered; a Harness command always stops and restarts. */
   text: external_exports.string().optional()
 }).strict();
+var threadSteeringContextSchema = external_exports.object({
+  kind: external_exports.literal("application"),
+  value: external_exports.string().transform((text2, context) => {
+    try {
+      return JSON.parse(text2);
+    } catch {
+      context.addIssue({ code: "custom", message: "Invalid steering context JSON" });
+      return external_exports.NEVER;
+    }
+  }).pipe(external_exports.object({
+    expectedTurnId: hostTurnIdSchema,
+    clientUserMessageId: external_exports.string().min(1),
+    delivery: external_exports.enum(["newTurn", "activeTurn"])
+  }).strict())
+}).strict().transform((context) => context.value);
 var threadSteerDeliverySchema = external_exports.enum(["activeTurn", "newTurn"]);
 var threadSteeringInspectResultSchema = external_exports.object({
   delivery: external_exports.enum(["official", "activeTurn", "newTurn"])
@@ -16879,7 +16894,7 @@ function createZcodeInstallation(environment, app) {
 }
 
 // dist/account.js
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { readFile as readFile3 } from "node:fs/promises";
 import path5 from "node:path";
 
@@ -16928,10 +16943,100 @@ async function readCredential(installation, environment, key) {
 }
 
 // dist/personal-coding-plan.js
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { readFile as readFile2 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import path4 from "node:path";
+
+// dist/project-token.js
+import { createHash as createHash2 } from "node:crypto";
+var locationSchema = external_exports.object({
+  organizationId: external_exports.string().trim().min(1),
+  projectId: external_exports.string().trim().min(1),
+  apiKeyId: external_exports.string().trim().min(1)
+});
+function readProjectCredential(credential, family, identity, origin) {
+  const key = `project-key-location:v1:${encodeURIComponent(JSON.stringify([origin, family, identity, null, 1, "non-team"]))}`;
+  const raw = credential(key);
+  if (!raw)
+    return void 0;
+  const location = locationSchema.parse(JSON.parse(raw));
+  const login = credential(`oauth:${family}:access_token`).trim();
+  const loginToken = login.replace(/^Bearer\s+/i, "").trim();
+  if (!loginToken)
+    throw projectCredentialError();
+  const accountScope = createHash2("sha256").update(JSON.stringify([
+    family,
+    "individual-coding-plan",
+    null,
+    login,
+    credential("zcodejwttoken").trim() || null
+  ])).digest("hex");
+  return { origin, loginToken, location, accountScope };
+}
+var tokenSchema = external_exports.object({
+  success: external_exports.boolean().optional(),
+  code: external_exports.union([external_exports.literal(0), external_exports.literal(200), external_exports.literal("0"), external_exports.literal("200")]),
+  data: external_exports.object({
+    enable: external_exports.boolean().optional(),
+    accessToken: external_exports.string().trim().min(1),
+    tokenType: external_exports.literal("Bearer"),
+    expiresIn: external_exports.number().finite().positive(),
+    expiresAt: external_exports.number().finite().positive()
+  })
+});
+function projectCredentialError() {
+  return new ZcodeError("authenticationRequired", "ZCode Personal Coding Plan project credentials are unavailable. Open the personal plan in ZCode Desktop, then re-detect ZCode and reopen the Thread");
+}
+var ProjectToken = class {
+  #cached;
+  async resolve(credential, appVersion, signal, rejectedFingerprint) {
+    signal.throwIfAborted();
+    const scope = createHash2("sha256").update(JSON.stringify(credential)).digest("hex");
+    const cached2 = this.#cached;
+    if (cached2?.scope === scope && cached2.fingerprint !== rejectedFingerprint && cached2.expiresAt > Date.now() + 12e4)
+      return cached2.token;
+    this.#cached = void 0;
+    const { origin, location, loginToken } = credential;
+    const url2 = `${origin}/api/biz/v1/organization/${encodeURIComponent(location.organizationId)}/projects/${encodeURIComponent(location.projectId)}/api_keys/${encodeURIComponent(location.apiKeyId)}/access_tokens`;
+    const started = Date.now();
+    try {
+      const response = await fetch(url2, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${loginToken}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ clientType: "zcode", clientVersion: appVersion }),
+        redirect: "error",
+        signal: AbortSignal.any([signal, AbortSignal.timeout(15e3)])
+      });
+      if (!response.ok)
+        throw projectCredentialError();
+      const parsed = tokenSchema.safeParse(await response.json());
+      if (!parsed.success || parsed.data.success === false || parsed.data.data.enable === false)
+        throw projectCredentialError();
+      const data = parsed.data.data;
+      const expiresAt = Math.min(data.expiresAt * 1e3, started + data.expiresIn * 1e3);
+      signal.throwIfAborted();
+      if (expiresAt <= Date.now())
+        throw projectCredentialError();
+      this.#cached = {
+        scope,
+        token: data.accessToken,
+        expiresAt,
+        fingerprint: createHash2("sha256").update(data.accessToken).digest("hex")
+      };
+      return data.accessToken;
+    } catch (error51) {
+      signal.throwIfAborted();
+      if (error51 instanceof ZcodeError)
+        throw error51;
+      if (error51 instanceof Error && error51.name === "TimeoutError")
+        throw new ZcodeError("unavailable", "ZCode project token request timed out. Try again.", true);
+      throw projectCredentialError();
+    }
+  }
+};
+
+// dist/personal-coding-plan.js
 var familySchema = external_exports.enum(["zai", "bigmodel"]);
 var recordSchema2 = external_exports.record(external_exports.string(), external_exports.unknown());
 var CONNECT = "Connect Personal Coding Plan in ZCode Desktop, then re-detect ZCode and reopen the Thread";
@@ -16985,7 +17090,7 @@ async function queryEntitlement(family, apiKey, environment) {
   try {
     const response = await fetch(`${personalCodingPlanOrigin(family, environment)}/api/biz/subscription/list`, {
       method: "GET",
-      // The subscription endpoint accepts the model API Key, not the OAuth token or Start JWT.
+      // Legacy Desktop uses a personal API Key; project-token Desktop uses its OAuth login.
       headers: { Authorization: apiKey.trim() },
       redirect: "error",
       signal: AbortSignal.timeout(15e3)
@@ -17019,6 +17124,8 @@ var PersonalCodingPlanAccount = class {
   installation;
   environment;
   #authorized = /* @__PURE__ */ new Map();
+  #projectToken = new ProjectToken();
+  issue;
   constructor(installation, environment) {
     this.installation = installation;
     this.environment = environment;
@@ -17038,12 +17145,16 @@ var PersonalCodingPlanAccount = class {
     const identity = normalized ? normalized.id.trim() : family === "zai" && typeof profile.user_id === "string" ? profile.user_id.trim() : "";
     if (!identity || identity === "unknown")
       return void 0;
+    const project2 = readProjectCredential(credential, family, identity, personalCodingPlanOrigin(family, this.environment));
+    if (project2)
+      return { identity, current, apiKey: project2.loginToken, project: project2 };
     const key = `account-provider:coding-plan:${providerId}:account:${encodeURIComponent(identity)}:api-key`;
     return { identity, current, apiKey: credential(key).trim() };
   }
   async inspect(providerId, accountType) {
     const family = familySchema.parse(accountType);
     this.#authorized.delete(providerId);
+    this.issue = void 0;
     let current = false;
     try {
       const context = await this.#context(providerId, family);
@@ -17055,24 +17166,29 @@ var PersonalCodingPlanAccount = class {
           unavailableReason: "not-connected"
         };
       current = context.current;
-      const connectionKey = createHash2("sha256").update(JSON.stringify([family, context.identity, "individual-coding-plan"])).digest("hex");
+      const connectionKey = createHash3("sha256").update(JSON.stringify([family, context.identity, "individual-coding-plan"])).digest("hex");
       const base = { current, connectionKey };
-      if (!context.apiKey)
+      if (!context.apiKey) {
+        if (current)
+          this.issue = "ZCode is signed in, but its Personal Coding Plan credentials are not initialized. Open the personal plan in ZCode Desktop, then re-detect ZCode. This does not mean the subscription is inactive.";
         return {
           ...base,
           availability: "unavailable",
           entitled: false,
           unavailableReason: "credential-failed"
         };
+      }
       const entitlement = await queryEntitlement(family, context.apiKey, this.environment);
       const after = await this.#context(providerId, family);
-      if (!after || after.identity !== context.identity || after.current !== current || after.apiKey !== context.apiKey)
+      if (!after || after.identity !== context.identity || after.current !== current || after.apiKey !== context.apiKey || JSON.stringify(after.project) !== JSON.stringify(context.project))
         return { availability: "unknown", entitled: false, current: false };
       if (entitlement === "available") {
         if (current)
           this.#authorized.set(providerId, { family, identity: context.identity });
         return { ...base, availability: "available", entitled: true };
       }
+      if (current)
+        this.issue = entitlement === "unavailable" ? "ZCode Personal Coding Plan subscription check found no active subscription. Check the selected account in ZCode Desktop, then re-detect ZCode." : "ZCode Personal Coding Plan credentials or subscription could not be verified. Open the personal plan in ZCode Desktop, then re-detect ZCode; subscription status is unknown.";
       return {
         ...base,
         availability: entitlement === "unknown" ? "unknown" : "unavailable",
@@ -17082,6 +17198,9 @@ var PersonalCodingPlanAccount = class {
         }
       };
     } catch {
+      current = await readSelection(this.environment, family).catch(() => false);
+      if (current)
+        this.issue = "ZCode Personal Coding Plan credentials could not be read or verified. Open the personal plan in ZCode Desktop, then re-detect ZCode; subscription status is unknown.";
       return { availability: "unknown", entitled: false, current };
     }
   }
@@ -17093,7 +17212,9 @@ var PersonalCodingPlanAccount = class {
         type: external_exports.literal("zhipu-account"),
         mode: external_exports.literal("individual-coding-plan"),
         accountType: familySchema
-      })
+      }),
+      expectedAccountScope: external_exports.string().optional(),
+      rejectedProjectTokenFingerprint: external_exports.string().optional()
     }).safeParse(request);
     if (!parsed.success)
       throw new ZcodeError("authenticationRequired", CONNECT);
@@ -17106,6 +17227,23 @@ var PersonalCodingPlanAccount = class {
     signal.throwIfAborted();
     if (!context?.current || context.identity !== authorized.identity || !context.apiKey)
       throw new ZcodeError("authenticationRequired", CONNECT);
+    if (context.project) {
+      const { expectedAccountScope, rejectedProjectTokenFingerprint } = parsed.data;
+      if (expectedAccountScope !== void 0 && expectedAccountScope !== context.project.accountScope || rejectedProjectTokenFingerprint && !expectedAccountScope)
+        throw new ZcodeError("authenticationRequired", CONNECT);
+      const apiKey = await this.#projectToken.resolve(context.project, this.installation.version, signal, rejectedProjectTokenFingerprint);
+      const after = await this.#context(providerId, authorized.family);
+      signal.throwIfAborted();
+      if (!after?.current || after.identity !== context.identity || JSON.stringify(after.project) !== JSON.stringify(context.project))
+        throw new ZcodeError("authenticationRequired", CONNECT);
+      return {
+        apiKey,
+        apiKeyId: context.project.location.apiKeyId,
+        accountScope: context.project.accountScope
+      };
+    }
+    if (parsed.data.expectedAccountScope !== void 0 || parsed.data.rejectedProjectTokenFingerprint)
+      throw new ZcodeError("authenticationRequired", CONNECT);
     return { apiKey: context.apiKey };
   }
 };
@@ -17231,7 +17369,7 @@ async function queryStartPlanBalance(origin, appVersion, jwt2, deviceMid) {
 async function accountConfig(installation, environment) {
   const file2 = installation.builtinProviderConfig;
   const builtin = builtinSchema.parse(JSON.parse(await readFile3(file2, "utf8")));
-  const basedOnZCodeBuiltinRevision = `zcode-builtin:${builtin.revision}:${createHash3("sha256").update(path5.resolve(file2)).digest("hex")}`;
+  const basedOnZCodeBuiltinRevision = `zcode-builtin:${builtin.revision}:${createHash4("sha256").update(path5.resolve(file2)).digest("hex")}`;
   const family = await readCredential(installation, environment, "oauth:active_provider");
   let balanceData;
   if (family) {
@@ -17283,7 +17421,7 @@ async function accountConfig(installation, environment) {
       };
     }
   }
-  const overlayDigest = createHash3("sha256").update(JSON.stringify([providers, states])).digest("hex").slice(0, 16);
+  const overlayDigest = createHash4("sha256").update(JSON.stringify([providers, states])).digest("hex").slice(0, 16);
   return {
     params: {
       revision: `codexhost:${family || "signed-out"}:${builtin.revision}:${overlayDigest}`,
@@ -17300,6 +17438,7 @@ async function accountConfig(installation, environment) {
 async function providerRuntimeHeaders(request, signal, installation, environment, verifier, codingPlan) {
   const mode = external_exports.object({ mode: external_exports.string() }).safeParse(request.accountAccess).data?.mode;
   try {
+    signal.throwIfAborted();
     if (mode === "individual-coding-plan")
       return { headersApplied: true, requestAuth: await codingPlan.requestAuth(request, signal) };
     if (mode !== "start-plan")
@@ -17313,6 +17452,8 @@ async function providerRuntimeHeaders(request, signal, installation, environment
     const headers = await verifier().verify(signal);
     return { headersApplied: true, requestAuth: { apiKey, headers } };
   } catch (error51) {
+    if (signal.aborted)
+      return { headersApplied: false };
     return {
       headersApplied: false,
       errorMessage: error51 instanceof ZcodeError ? error51.message : "ZCode account authentication failed"
@@ -17421,6 +17562,9 @@ var CliTransport = class {
   get startPlanChecked() {
     return this.#startPlanChecked;
   }
+  get codingPlanIssue() {
+    return this.#codingPlan?.issue;
+  }
   constructor(options) {
     this.options = options;
     this.#context = {
@@ -20144,6 +20288,10 @@ var ZcodeAdapter = class {
             code: "authenticationRequired",
             message: "ZCode has no available models. Sign in to ZCode Desktop with a Start Plan or Personal Coding Plan account, or add a personal provider, then re-detect ZCode. Team Coding Plan is not supported.",
             retryable: true
+          } : transport.codingPlanIssue ? {
+            code: "configurationRequired",
+            message: transport.codingPlanIssue,
+            retryable: true
           } : transport.startPlanChecked ? {
             code: "configurationRequired",
             message: "ZCode is signed in, but the account has no available models: no active Start Plan or event quota, no Personal Coding Plan, and no personal provider. Free trial and event quotas expire; subscribe to GLM Coding Plan or add a personal provider (API Key) in ZCode Desktop, then re-detect ZCode. Team Coding Plan is not supported.",