@magpie-community/opencode-mimo-auth 0.1.4 → 0.1.6

package/README.md

@@ -29,10 +29,17 @@ Chat completions go to `https://mimo-server-<region>.xiaomimimo.com/api/route/ch
 
 `mimo-auto`, the app's default model, is requested as `mimo-pro`.
 
-The session is renewed with the passToken a day after it was issued. It is
-also renewed once when the server turns a request away: a 401, or a Xiaomi
-sign-in page where an answer was expected. If the passToken no longer works,
-sign in again.
+The session is renewed with the passToken a day after it was issued.
+magpie (0.1.684 and later) does it ahead of time through `auth.refresh`, ten
+minutes before that day is out (`refreshLead`), once for the account and
+before its requests, models and usage ask for it; a passToken Xiaomi no
+longer takes marks the account for a new sign-in. The check before each
+request stays for OpenCode, which doesn't call `auth.refresh`, and one
+sign-on at a time serves both. A model
+request the server turns away (a 401) is answered as the server answered it,
+as magpie's built-in MiMo account did; reading usage renews the session once
+when the server turns it away. If the passToken no longer works, sign in
+again.
 
 ## Where the sign-in is kept
 

package/index.mjs

@@ -18,6 +18,7 @@ const APP_VERSION = "26.929.292248"
 const SOURCE = "mimocode-cli-free"
 const UA = "miNative PC/Normal Windows_NT/10.0.26100 SDKV/1.0.0 DEVT/PC DEVS/Windows APP/miaccount_desktop APPV/0.1.0"
 const RENEW_AFTER = 24 * 60 * 60 * 1000 // the app signs on again after a day
+const LEAD_MS = 10 * 60 * 1000 // this close to it, magpie signs on again ahead of time (auth.refresh)
 const SIGN_IN_LIFE = 10 * 60 * 1000
 
 const MODEL = { release_date: "2026-07-01", attachment: true, tool_call: true, limit: { context: 1_000_000, output: 128_000 }, modalities: { input: ["text", "image"], output: ["text"] } }
@@ -117,7 +118,11 @@ async function session(creds, base) {
     const headers = appHeaders()
     const cookie = jar.header(url)
     if (cookie) headers.Cookie = cookie
-    res = await fetch(url, { headers, redirect: "manual", signal })
+    try {
+      res = await fetch(url, { headers, redirect: "manual", signal })
+    } catch (e) {
+      throw new Error("Xiaomi MiMo sign-in: " + (e?.message ?? e))
+    }
     jar.take(res, url)
     const loc = res.headers.get("location")
     if (res.status < 300 || res.status >= 400 || !loc) break
@@ -184,6 +189,15 @@ function fromAuth(auth) {
   }
 }
 
+// said is an answer with magpie's X-Magpie-Sign-In, which tells what it
+// means for the account's sign-in whatever its status: "expired" marks it
+// lapsed, "kept" leaves it be. magpie takes it off before the agent sees it.
+function said(res, v) {
+  const h = new Headers(res.headers)
+  h.set("X-Magpie-Sign-In", v)
+  return new Response(res.body, { status: res.status, statusText: res.statusText, headers: h })
+}
+
 // ---- the sign-in ------------------------------------------------------------
 
 // serviceOf is the sid and callback the MiMo server sends a browser with
@@ -325,8 +339,11 @@ function serverTime(v) {
 
 export const MimoAuthPlugin = async ({ client }) => {
   // renewals under way, one to an account: two accounts signing on at
-  // once each keep their own session
+  // once each keep their own session. renewed is the last session each
+  // account got here, so magpie's auth.refresh handed a sign-in from
+  // before it gives that one rather than signing on again.
   const renewing = new Map()
+  const renewed = new Map()
 
   const save = async (auth) => {
     try {
@@ -334,27 +351,20 @@ export const MimoAuthPlugin = async ({ client }) => {
     } catch {}
   }
 
-  // fresh is the account with a live session, signed on again when it is
-  // older than the app lets one get, or when force is set (the server
-  // turned the last one away)
-  const fresh = async (getAuth, force) => {
-    const a = fromAuth(await getAuth())
-    if (!a) throw new Error("Xiaomi MiMo: not signed in")
-    if (!force && Object.keys(a.cookies).length && Date.now() < a.expires) return a
+  // renew signs the account on again, once at a time: those who come
+  // while it runs wait for it. keep saves the new session (the request
+  // path); magpie's auth.refresh saves what it gives itself.
+  const renew = (a, keep) => {
     const who = String(a.creds.userId ?? "")
     let r = renewing.get(who)
     if (!r) {
       r = (async () => {
-        try {
-          const s = await session(a.creds, a.creds.base)
-          const issued = Date.now()
-          await save(toAuth(a.creds, s.cookies, issued))
-          return { creds: a.creds, cookies: s.cookies, expires: issued + RENEW_AFTER }
-        } catch (e) {
-          // a hiccup: the session in hand may still do
-          if (!(e instanceof Lapsed) && !force && Object.keys(a.cookies).length) return a
-          throw e
-        }
+        const s = await session(a.creds, a.creds.base)
+        const issued = Date.now()
+        const got = { creds: a.creds, cookies: s.cookies, expires: issued + RENEW_AFTER, renewed: true }
+        renewed.set(who, got)
+        if (keep) await save(toAuth(a.creds, s.cookies, issued))
+        return got
       })().finally(() => {
         renewing.delete(who)
       })
@@ -363,17 +373,61 @@ export const MimoAuthPlugin = async ({ client }) => {
     return r
   }
 
+  // fresh is the account with a live session, signed on again when it is
+  // older than the app lets one get, or when force is set (the server
+  // turned the last one away); renewed when it was signed on again, which
+  // took the built-in's lapse mark off
+  const fresh = async (getAuth, force) => {
+    const a = fromAuth(await getAuth())
+    if (!a) throw new Error("Xiaomi MiMo: not signed in")
+    if (!force && Object.keys(a.cookies).length && Date.now() < a.expires) return a
+    try {
+      return await renew(a, true)
+    } catch (e) {
+      // a hiccup: the session in hand may still do
+      if (!(e instanceof Lapsed) && !force && Object.keys(a.cookies).length) return a
+      throw e
+    }
+  }
+
+  // refresh is magpie's auth.refresh: the session signed on again
+  // LEAD_MS before the app would, as the fields that changed (the Xiaomi
+  // account in refresh stays as it is). A passToken Xiaomi no longer takes
+  // is signIn "expired"; any other failure throws as it is.
+  const refresh = async (auth) => {
+    const a = fromAuth(auth)
+    if (!a) return undefined
+    const last = renewed.get(String(a.creds.userId ?? ""))
+    // signed on again here already, the store not yet saying so
+    if (last && last.expires > a.expires && Date.now() < last.expires - LEAD_MS) {
+      return { access: JSON.stringify(last.cookies), expires: last.expires }
+    }
+    try {
+      const s = await renew(a, false)
+      return { access: JSON.stringify(s.cookies), expires: s.expires }
+    } catch (e) {
+      if (e instanceof Lapsed) throw Object.assign(new Error(e.message), { signIn: "expired" })
+      throw e
+    }
+  }
+
   // page asks the MiMo server for one of the account's pages, signing on
-  // again once when it is turned away, and gives its data.
-  const page = async (getAuth, path) => {
+  // again once when it is turned away, and gives its data. read.signIn is
+  // what that did to the built-in's lapse mark: signed on again took it
+  // off, a sign-in Xiaomi no longer takes (mimoLapse) put it on.
+  const page = async (getAuth, path, read) => {
     for (let t = 0; ; t++) {
       let s
       try {
         s = await fresh(getAuth, t > 0)
       } catch (e) {
-        if (e instanceof Lapsed) throw new SignInGone(`${fromAuth(await getAuth())?.creds.userId}: the Xiaomi MiMo sign-in has expired — sign in again`)
+        if (e instanceof Lapsed) {
+          read.signIn = "expired"
+          throw new SignInGone(`${fromAuth(await getAuth())?.creds.userId}: the Xiaomi MiMo sign-in has expired — sign in again`)
+        }
         throw e
       }
+      if (s.renewed) read.signIn = "renewed"
       const res = await fetch(s.creds.base.replace(/\/+$/, "") + path, {
         headers: { Cookie: cookieHeader(s.cookies), ...appHeaders() },
         signal: AbortSignal.timeout(20_000),
@@ -387,6 +441,7 @@ export const MimoAuthPlugin = async ({ client }) => {
       if (res.status === 401 || (res.status === 200 && bad)) {
         // a session gone stale, or a redirect to Xiaomi's sign-in
         if (t === 0) continue
+        read.signIn = "expired"
         throw new SignInGone(`${s.creds.userId}: the Xiaomi MiMo sign-in has expired — sign in again`)
       }
       if (res.status !== 200 || bad) throw new Error(`Xiaomi MiMo ${path}: ${vendorError(text, statusLine(res.status))}`)
@@ -395,13 +450,16 @@ export const MimoAuthPlugin = async ({ client }) => {
     }
   }
 
-  // usage is the plan and the week's allowance, magpie's own hook
+  // usage is the plan and the week's allowance, magpie's own hook; signIn
+  // is the lapse mark as the built-in's reads left it, a clean read with
+  // no signing on again leaving it be
   const usage = async (getAuth) => {
+    const read = { signIn: "kept" }
     let self
     try {
-      self = await page(getAuth, "/user/xiaomi/subscription/self")
+      self = await page(getAuth, "/user/xiaomi/subscription/self", read)
     } catch (e) {
-      return { error: e?.message ?? String(e) }
+      return { error: e?.message ?? String(e), signIn: read.signIn }
     }
     const c = self?.current
     const out = { plan: "Free" }
@@ -415,12 +473,13 @@ export const MimoAuthPlugin = async ({ client }) => {
     }
     let use
     try {
-      use = await page(getAuth, "/user/usage")
+      use = await page(getAuth, "/user/usage", read)
     } catch (e) {
       if (e instanceof SignInGone) out.error = e.message
       // the plan alone, when the week's allowance can't be read
-      return out
+      return { ...out, signIn: read.signIn }
     }
+    out.signIn = read.signIn
     const percent = use?.percent
     const reset = use?.resetDate
     // no plan: the free offer shows no allowance
@@ -447,6 +506,11 @@ export const MimoAuthPlugin = async ({ client }) => {
     auth: {
       provider: ID,
       usage,
+      // magpie signs the account on again LEAD_MS before the day is out,
+      // once, before its requests, models and usage ask; fresh's check
+      // before each request stays for OpenCode, which doesn't call this
+      refreshLead: LEAD_MS,
+      refresh,
       loader: async (getAuth) => {
         const a = fromAuth(await getAuth())
         if (!a) return {}
@@ -467,31 +531,29 @@ export const MimoAuthPlugin = async ({ client }) => {
                 if (j?.model === "mimo-auto") body = JSON.stringify({ ...j, model: "mimo-pro" })
               } catch {}
             }
-            const send = async (force) => {
-              const s = await fresh(getAuth, force)
-              const headers = new Headers(init.headers ?? req?.headers)
-              headers.delete("authorization")
-              headers.set("Cookie", cookieHeader(s.cookies))
-              headers.set("X-Mimo-Source", SOURCE)
-              headers.set("User-Agent", UA)
-              headers.set("X-Client-Version", APP_VERSION)
-              return fetch(url, { ...init, method: init.method ?? req?.method ?? "POST", headers, body })
-            }
+            let s
             try {
-              const res = await send(false)
-              // a session gone stale, or a redirect to Xiaomi's sign-in page
-              const stale = res.status === 401 || (res.status === 200 && /text\/html/i.test(res.headers.get("content-type") ?? ""))
-              if (!stale || (body != null && typeof body !== "string")) return res
-              await res.arrayBuffer().catch(() => {})
-              return await send(true)
+              s = await fresh(getAuth, false)
             } catch (e) {
-              // the passToken no longer signs the account on: the account's
-              // own 401, in the built-in's words (mimoLapse)
+              // the passToken no longer signs the account on: the built-in
+              // failed the request (magpie's 502) in mimoLapse's words and
+              // marked the account lapsed
               if (!(e instanceof Lapsed)) throw e
               const who = fromAuth(await getAuth())?.creds.userId ?? a.creds.userId
               const message = `${who}: the Xiaomi MiMo sign-in has expired — sign in again`
-              return new Response(JSON.stringify({ error: { message, type: "authentication_error", code: null } }), { status: 401, headers: { "content-type": "application/json" } })
+              return said(new Response(JSON.stringify({ error: { message, type: "api_error", code: null } }), { status: 502, headers: { "content-type": "application/json" } }), "expired")
             }
+            const headers = new Headers(init.headers ?? req?.headers)
+            headers.delete("authorization")
+            headers.set("Cookie", cookieHeader(s.cookies))
+            headers.set("X-Mimo-Source", SOURCE)
+            headers.set("User-Agent", UA)
+            headers.set("X-Client-Version", APP_VERSION)
+            // the server's answer goes through as it is, a 401 too, as the
+            // built-in's did: it took the lapse off only when it signed on
+            // again, whatever the server then answered
+            const res = await fetch(url, { ...init, method: init.method ?? req?.method ?? "POST", headers, body })
+            return said(res, s.renewed ? "renewed" : "kept")
           },
         }
       },

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@magpie-community/opencode-mimo-auth",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "OpenCode provider plugin for Xiaomi MiMo: the MiMo app's Xiaomi-account sign-in, MiMo Pro and MiMo Flash",
   "type": "module",
   "main": "./index.mjs",
   "exports": "./index.mjs",
   "files": ["index.mjs", "README.md"],
   "keywords": ["opencode", "opencode-plugin", "xiaomi", "mimo"],
-  "license": "MIT"
+  "license": "MIT",
+  "repository": { "type": "git", "url": "git+https://github.com/magpie-community/plugins.git", "directory": "packages/mimo" }
 }