@kukonce/dsh-loomy 0.0.0-stage → 0.3.2

package/docs/verify/live-check.mjs

@@ -0,0 +1,406 @@
+#!/usr/bin/env node
+/**
+ * Live protocol check for the Loomy plugin.
+ *
+ * Re-asserts every claim in docs/protocol.md against the real service and prints
+ * one PASS/FAIL line per assertion. Exit code is 1 if any assertion failed, so CI
+ * can gate on it.
+ *
+ *   node docs/verify/live-check.mjs              # full run
+ *   node docs/verify/live-check.mjs --offline    # skip the one paid call
+ *   node docs/verify/live-check.mjs --session <path>
+ *
+ * Auth: reads the Loomy desktop session file by default. Set LOOMY_SESSION to a
+ * session string instead.
+ *
+ * SECRETS: the session is never printed. Values are redacted to
+ * "<first2>…<last2> (len N)" wherever a message might carry one. Do not add
+ * logging that bypasses redact().
+ *
+ * Points: every call here is a free read except the single chat probe, which
+ * targets the free model (spark-x2.6) so it costs 0 points. --offline drops it.
+ */
+
+import { createHash } from 'node:crypto'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const API = 'https://loomyad.xunfei.cn'
+const GATEWAY = API + '/api/v1/chat/completions'
+const VERSION = '0.9.39'
+
+const args = process.argv.slice(2)
+const offline = args.includes('--offline')
+const sessionArgIndex = args.indexOf('--session')
+
+/**
+ * Where this user's Loomy desktop session may live.
+ *
+ * On Windows the desktop client relocates its state to
+ * `C:\\Users\\Public\\Loomy\\<sha256(username)[:12]>\\userData\`, so the directory is
+ * derived rather than hard-coded — a literal hash would only work on the machine it was
+ * copied from.
+ *
+ * Only this user's directory is probed. `C:\\Users\\Public\` is shared
+ * by every local account, so listing that root would pick up whoever ran Loomy last —
+ * exactly the behaviour the plugin was changed to stop doing.
+ */
+function windowsSessionPaths() {
+  const candidates = []
+  try {
+    const hash = createHash('sha256').update(os.userInfo().username).digest('hex').slice(0, 12)
+    candidates.push(path.join('C:\\Users\\Public\\Loomy', hash, 'userData', 'auth-session.json'))
+  } catch {
+    // userInfo can throw in a container; APPDATA below still applies
+  }
+  const roaming = process.env.APPDATA
+  if (typeof roaming === 'string' && roaming.length > 0) {
+    candidates.push(path.join(roaming, 'Loomy', 'auth-session.json'))
+  }
+  return candidates
+}
+
+const DEFAULT_SESSION_PATHS = process.platform === 'win32'
+  ? windowsSessionPaths()
+  : [
+      path.join(os.homedir(), 'Library', 'Application Support', 'Loomy', 'auth-session.json'),
+      path.join(os.homedir(), '.config', 'loomy', 'auth-session.json')
+    ]
+
+let session = ''
+let userid = ''
+let accountSource = ''
+
+/** Never let a session string reach stdout. */
+function redact(value) {
+  const text = String(value ?? '')
+  if (session.length > 4 && text.includes(session)) {
+    return text.split(session).join(`<${mask(session)}>`)
+  }
+  return text
+}
+
+function mask(value) {
+  const text = String(value ?? '')
+  if (text.length <= 4) return '*'.repeat(text.length)
+  return `${text.slice(0, 2)}…${text.slice(-2)} (len ${text.length})`
+}
+
+const results = []
+function record(ok, name, detail = '') {
+  results.push({ ok, name, detail })
+  const tag = ok ? 'PASS' : 'FAIL'
+  console.log(`${tag}  ${name}${detail ? '  — ' + redact(detail) : ''}`)
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+/** Load the session, preferring an explicit path, then env, then known locations. */
+function loadSession() {
+  if (process.env.LOOMY_SESSION) {
+    session = process.env.LOOMY_SESSION.trim()
+    accountSource = 'env LOOMY_SESSION'
+    return true
+  }
+  const explicit = sessionArgIndex !== -1 ? args[sessionArgIndex + 1] : undefined
+  const candidates = explicit ? [explicit] : DEFAULT_SESSION_PATHS
+  for (const candidate of candidates) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(candidate, 'utf8'))
+      if (typeof parsed?.session === 'string' && parsed.session.length > 0) {
+        session = parsed.session
+        userid = String(parsed.userid ?? '')
+        accountSource = candidate
+        return true
+      }
+    } catch {
+      // try the next candidate
+    }
+  }
+  return false
+}
+
+/** JSON GET against the points/business API (token header, envelope expected). */
+async function apiGet(pathname, { token } = {}) {
+  const headers = { Accept: 'application/json', 'loomy-version': VERSION }
+  if (token !== null) headers.token = token ?? session
+  const response = await fetch(API + pathname, { headers, signal: AbortSignal.timeout(30_000) })
+  const text = await response.text()
+  let json = null
+  try { json = JSON.parse(text) } catch { json = null }
+  return { status: response.status, headers: response.headers, text, json }
+}
+
+async function apiPost(pathname, body, { token } = {}) {
+  const headers = {
+    Accept: 'application/json',
+    'Content-Type': 'application/json',
+    'loomy-version': VERSION
+  }
+  if (token !== null) headers.token = token ?? session
+  const response = await fetch(API + pathname, {
+    method: 'POST', headers, body: JSON.stringify(body ?? {}),
+    signal: AbortSignal.timeout(30_000)
+  })
+  const text = await response.text()
+  let json = null
+  try { json = JSON.parse(text) } catch { json = null }
+  return { status: response.status, headers: response.headers, text, json }
+}
+
+function hex(count) {
+  let out = ''
+  while (out.length < count) out += Math.floor(Math.random() * 16).toString(16)
+  return out
+}
+
+/** The full header set the desktop client sends for one chat turn. */
+function chatHeaders() {
+  return {
+    'Content-Type': 'application/json',
+    Accept: 'text/event-stream',
+    Authorization: 'Bearer ' + session,
+    token: session,
+    'loomy-version': VERSION,
+    'X-Loomy-Request-Purpose': 'chat.message',
+    traceparent: `00-${hex(32)}-${hex(16)}-01`
+  }
+}
+
+async function chatProbe(body, { headers } = {}) {
+  const response = await fetch(GATEWAY, {
+    method: 'POST',
+    headers: headers ?? chatHeaders(),
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(60_000)
+  })
+  const text = await response.text()
+  return { status: response.status, contentType: response.headers.get('content-type') || '', text }
+}
+
+/** Split an SSE body into its `data:` payloads, preserving the [DONE] sentinel. */
+function sseEvents(text) {
+  const out = []
+  for (const line of text.split('\n')) {
+    const trimmed = line.trim()
+    if (!trimmed.startsWith('data:')) continue
+    const payload = trimmed.slice(5).trim()
+    if (payload === '[DONE]') { out.push({ done: true }); continue }
+    try { out.push({ json: JSON.parse(payload) }) } catch { out.push({ raw: payload }) }
+  }
+  return out
+}
+
+async function main() {
+  console.log('Loomy protocol live check')
+  console.log('='.repeat(60))
+
+  /* ── 0. credentials ─────────────────────────────────────────────── */
+  if (!loadSession()) {
+    console.error('FAIL  no session found. Set LOOMY_SESSION or pass --session <path>.')
+    process.exit(1)
+  }
+  record(true, 'session loaded', `${accountSource}; userid=${userid ? mask(userid) : '(absent)'}; session=${mask(session)}`)
+
+  /* ── 1. model catalog ───────────────────────────────────────────── */
+  const models = await apiGet('/api/v1/models')
+  record(models.status === 200, 'GET /api/v1/models -> 200', `status ${models.status}`)
+  const isBareList = models.json !== null && Array.isArray(models.json?.data) && models.json?.code === undefined
+  record(isBareList, 'model list is a BARE list (no envelope, no code field)',
+    isBareList ? `keys: ${Object.keys(models.json).join(',')}` : `body: ${models.text.slice(0, 160)}`)
+  const catalog = Array.isArray(models.json?.data) ? models.json.data : []
+  record(catalog.length > 0, 'catalog is non-empty', `${catalog.length} models`)
+  record(typeof models.json?.reasoning_catalog_version === 'string',
+    'reasoning_catalog_version present', String(models.json?.reasoning_catalog_version))
+  const defaultModel = catalog.find((entry) => entry?.is_default_model === true)
+  record(defaultModel !== undefined, 'exactly one is_default_model',
+    defaultModel ? defaultModel.id : 'none flagged')
+  record(catalog.every((entry) => typeof entry?.id === 'string' && entry.id.length > 0),
+    'every catalog entry has a string id')
+  for (const entry of catalog.slice(0, 3)) {
+    record(typeof entry.protocol === 'string' && entry.protocol === 'openai_chat',
+      `${entry.id}: protocol openai_chat`, String(entry.protocol))
+  }
+
+  /* ── 2. auth header matrix ──────────────────────────────────────── */
+  const tokenOnly = await apiGet('/api/v1/models')
+  const authOnly = await apiGet('/api/v1/models', { token: null })
+  record(Array.isArray(tokenOnly.json?.data), 'models accepts token header only')
+  record(authOnly.json?.code === '100002', 'models REJECTS Authorization-only with code 100002',
+    `code=${authOnly.json?.code} desc=${authOnly.json?.desc}`)
+
+  const chatTokenOnly = await chatProbe(
+    { model: defaultModel?.id ?? 'spark-x2.6', messages: [{ role: 'user', content: 'hi' }], stream: true },
+    { headers: { 'Content-Type': 'application/json', Accept: 'text/event-stream', token: session, 'loomy-version': VERSION } }
+  )
+  record(chatTokenOnly.contentType.includes('application/json') && chatTokenOnly.text.includes('100002'),
+    'chat REJECTS token-only with code 100002 (misleading "缺少 token")',
+    chatTokenOnly.text.slice(0, 120))
+
+  /* ── 3. points / daily grant ────────────────────────────────────── */
+  const first = await apiPost('/api/v1/points/first-login', {})
+  record(first.json?.code === '000000', 'POST points/first-login -> code 000000',
+    `code=${first.json?.code} desc=${first.json?.desc}`)
+  const balance = first.json?.data ?? {}
+  record(typeof balance.dailyQuota === 'number' && balance.dailyQuota > 0,
+    'dailyQuota reported', String(balance.dailyQuota))
+  record(typeof balance.dailyCycleDate === 'string', 'dailyCycleDate is a date string',
+    String(balance.dailyCycleDate))
+  const identityHolds = balance.currentBalance === (balance.permanentBalance ?? 0) + (balance.dailyBalance ?? 0)
+  record(identityHolds, 'currentBalance === permanentBalance + dailyBalance',
+    `${balance.currentBalance} === ${balance.permanentBalance} + ${balance.dailyBalance}`)
+
+  // Idempotency: a second call in the same dailyCycleDate must not change the balance.
+  const second = await apiPost('/api/v1/points/first-login', {})
+  const secondBalance = second.json?.data ?? {}
+  record(second.json?.code === '000000' && secondBalance.currentBalance === balance.currentBalance,
+    'first-login is idempotent within the same dailyCycleDate',
+    `alreadyProcessed=${secondBalance.alreadyProcessed} balance ${balance.currentBalance} -> ${secondBalance.currentBalance}`)
+  record(secondBalance.dailyCycleDate === balance.dailyCycleDate,
+    'dailyCycleDate stable across repeated calls', String(secondBalance.dailyCycleDate))
+
+  /* ── 4. records (v1 vs v2 shape) ────────────────────────────────── */
+  const recordsV1 = await apiGet('/api/v1/points/records?pageNo=1&pageSize=5&recordType=all')
+  record(recordsV1.json?.code === '000000', 'GET v1 points/records -> 000000')
+  const v1List = recordsV1.json?.data?.list
+  record(Array.isArray(v1List), 'v1 records expose a list array')
+  if (Array.isArray(v1List) && v1List.length > 0) {
+    record('pointsActual' in v1List[0], 'v1 record carries pointsActual (not points)',
+      Object.keys(v1List[0]).join(','))
+    record('dailyCycleDate' in v1List[0], 'v1 record carries dailyCycleDate')
+  }
+  const recordsV2 = await apiGet('/api/v2/points/records?pageNo=1&pageSize=5&direction=credit')
+  record(recordsV2.json?.code === '000000', 'GET v2 points/records -> 000000')
+  const v2List = recordsV2.json?.data?.list
+  if (Array.isArray(v2List) && v2List.length > 0) {
+    record('points' in v2List[0] && !('pointsActual' in v2List[0]),
+      'v2 record carries points (not pointsActual)', Object.keys(v2List[0]).join(','))
+  }
+
+  /* ── 5. read-only business endpoints ────────────────────────────── */
+  for (const [label, pathname] of [
+    ['user/identity', '/api/v1/user/identity'],
+    ['onboarding/tasks', '/api/v1/onboarding/tasks'],
+    ['pet-work', '/api/v1/pet-work']
+  ]) {
+    const res = await apiGet(pathname)
+    record(res.json?.code === '000000', `GET ${label} -> 000000`, String(res.json?.desc ?? ''))
+  }
+  const tasks = await apiGet('/api/v1/onboarding/tasks')
+  record(tasks.json?.data?.total === 10000, 'onboarding total pool is 10000',
+    String(tasks.json?.data?.total))
+
+  /* ── 6. error shapes ────────────────────────────────────────────── */
+  const badToken = await apiGet('/api/v1/models', { token: '0'.repeat(32) })
+  record(badToken.status === 200 && badToken.json?.code === '100002',
+    'bad token -> HTTP 200 with code 100002 (status is not the failure signal)',
+    `status=${badToken.status} code=${badToken.json?.code}`)
+  record(typeof badToken.json?.desc === 'string', 'error envelope carries a human desc',
+    String(badToken.json?.desc))
+
+  const emptyMessages = await chatProbe({ model: defaultModel?.id ?? 'spark-x2.6', messages: [], stream: true })
+  record(emptyMessages.status === 400 && emptyMessages.text.includes('messages 不能为空'),
+    'empty messages -> 400 "messages 不能为空" (no free probe via empty array)',
+    `status=${emptyMessages.status}`)
+
+  /* ── 7. rate-limit headers ──────────────────────────────────────── */
+  const headerNames = [...models.headers.keys()]
+  const rateLimits = headerNames.filter((name) => /ratelimit|retry-after|x-rate/i.test(name))
+  record(rateLimits.length === 0, 'no rate-limit headers on responses',
+    rateLimits.length ? rateLimits.join(',') : `headers: ${headerNames.join(',')}`)
+
+  /* ── 8. the one chat probe (free model, costs 0 points) ─────────── */
+  if (offline) {
+    console.log('SKIP  chat/SSE probe (--offline)')
+  } else {
+    const freeModel = catalog.find((entry) => /x0\.0/.test(String(entry.name ?? '')))?.id ?? 'spark-x2.6'
+    const stream = await chatProbe({
+      model: freeModel,
+      messages: [{ role: 'user', content: 'Reply with the single word: ok' }],
+      stream: true,
+      tools: [{
+        type: 'function',
+        function: {
+          name: 'noop_tool',
+          description: 'Does nothing',
+          parameters: { type: 'object', properties: { value: { type: 'string' } }, required: ['value'] }
+        }
+      }]
+    })
+    record(stream.contentType.includes('text/event-stream'),
+      'chat with Authorization -> text/event-stream', stream.contentType)
+
+    const events = sseEvents(stream.text)
+    record(events.length > 0, 'SSE stream carries data: events', `${events.length} events`)
+    record(events.some((event) => event.done === true), 'SSE stream ends with data: [DONE]')
+    const firstChunk = events.find((event) => event.json)?.json
+    record(firstChunk?.object === 'chat.completion.chunk', 'first event is a chat.completion.chunk',
+      String(firstChunk?.object))
+    record(typeof firstChunk?.model === 'string' && firstChunk.model === freeModel,
+      'stream reports the model actually used', String(firstChunk?.model))
+
+    const usageEvent = events.find((event) => event.json?.usage !== undefined)
+    record(usageEvent !== undefined, 'stream carries a usage block',
+      usageEvent ? JSON.stringify(usageEvent.json.usage) : 'absent')
+    if (usageEvent) {
+      const usage = usageEvent.json.usage
+      record(typeof usage.points_consumed === 'number', 'usage.points_consumed is present and numeric',
+        `points_consumed=${usage.points_consumed}`)
+      record(Array.isArray(usageEvent.json.choices) && usageEvent.json.choices.length === 0,
+        'usage chunk has an EMPTY choices array (adapter must guard choices[0])')
+    }
+
+    // Reasoning and/or content must arrive as deltas.
+    const hasDelta = events.some((event) => {
+      const delta = event.json?.choices?.[0]?.delta
+      return delta && (typeof delta.content === 'string' || typeof delta.reasoning_content === 'string')
+    })
+    record(hasDelta, 'stream carries delta.content and/or delta.reasoning_content')
+
+    const finish = events.find((event) => typeof event.json?.choices?.[0]?.finish_reason === 'string' && event.json.choices[0].finish_reason !== null)
+    record(finish !== undefined, 'stream carries a finish_reason',
+      finish ? String(finish.json.choices[0].finish_reason) : 'absent')
+
+    // Non-streaming must be accepted.
+    const plain = await chatProbe({ model: freeModel, messages: [{ role: 'user', content: 'Reply with: ok' }], stream: false })
+    let plainJson = null
+    try { plainJson = JSON.parse(plain.text) } catch { plainJson = null }
+    record(plain.contentType.includes('application/json') && plainJson?.object === 'chat.completion',
+      'stream:false is accepted and answers a chat.completion object', plain.contentType)
+    record(Array.isArray(plainJson?.choices) && typeof plainJson?.choices?.[0]?.message?.content === 'string',
+      'non-streaming answer carries choices[0].message.content')
+
+    // An unknown model must NOT error — it silently falls back. Documented trap.
+    const unknown = await chatProbe({ model: 'definitely-not-a-real-model-xyz', messages: [{ role: 'user', content: 'hi' }], stream: true })
+    const unknownFirst = sseEvents(unknown.text).find((event) => event.json)?.json
+    record(unknown.status === 200 && unknownFirst?.model !== 'definitely-not-a-real-model-xyz',
+      'unknown model id silently falls back instead of erroring (trap)',
+      `requested=definitely-not-a-real-model-xyz served=${unknownFirst?.model}`)
+  }
+
+  /* ── 9. balance did not move ────────────────────────────────────── */
+  await sleep(400)
+  const after = await apiPost('/api/v1/points/first-login', {})
+  const afterBalance = after.json?.data ?? {}
+  record(afterBalance.currentBalance === balance.currentBalance,
+    'checks spent no points (balance unchanged)',
+    `${balance.currentBalance} -> ${afterBalance.currentBalance}`)
+
+  /* ── summary ────────────────────────────────────────────────────── */
+  const failed = results.filter((entry) => !entry.ok)
+  console.log('='.repeat(60))
+  console.log(`${results.length - failed.length}/${results.length} PASS, ${failed.length} FAIL`)
+  if (failed.length > 0) {
+    console.log('\nFailed assertions:')
+    for (const entry of failed) console.log(`  - ${entry.name}${entry.detail ? ': ' + redact(entry.detail) : ''}`)
+  }
+  process.exit(failed.length === 0 ? 0 : 1)
+}
+
+main().catch((error) => {
+  console.error('FAIL  uncaught: ' + redact(error instanceof Error ? error.message : String(error)))
+  process.exit(1)
+})

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Loomy Models",
+    "description": "Connects iFlytek's Loomy desktop model service: sign in with an SMS code or adopt the desktop app's session, metered in points with the 5,000 daily quota claimed automatically."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Loomy 模型",
+    "description": "接入讯飞 Loomy 桌面端的模型服务：用手机号短信或本机桌面端登录态接入账号，按积分计费，每天自动领取 5000 每日赠送积分。"
+  }
+}

package/package.json

@@ -1,6 +1,60 @@
 {
   "name": "@kukonce/dsh-loomy",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.3.2",
+  "description": "Loomy (讯飞 Loomy) model provider for DeepSeek Harness — session login, live model catalog, daily 5000-credit renewal",
+  "type": "module",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./client": "./client/index.js",
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.png"
+  },
+  "files": [
+    "src",
+    "client",
+    "docs",
+    "locale/*.json",
+    "cordis.patch.yml",
+    "icon.png",
+    "icon-mask.png",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "llm-provider",
+    "loomy",
+    "xfyun"
+  ],
+  "engines": {
+    "node": ">=20.11"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": []
+    }
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kukonce/dsh-loomy.git"
+  },
+  "homepage": "https://github.com/kukonce/dsh-loomy#readme",
+  "bugs": {
+    "url": "https://github.com/kukonce/dsh-loomy/issues"
+  },
+  "author": "kukonce",
+  "scripts": {
+    "verify": "node docs/verify/live-check.mjs",
+    "verify:offline": "node docs/verify/live-check.mjs --offline"
+  }
 }