@magpie-community/opencode-qoder-auth 0.2.14 → 0.2.16

package/README.md

@@ -78,6 +78,12 @@ itself.
   reasoning and usage.
 - Tool calls Qoder writes as XML or JSON in its text become tool calls.
   Tool calls it sends the OpenAI way keep Qoder's id.
+- A call written in the text that can't be read, or that the stream ends
+  inside, is never sent on as the answer (since 0.2.16, #132): the turn
+  ends as an error, a 502 or the stream's error frame with no finish, so
+  the agent or magpie can try again. A call whose JSON is whole when the
+  stream ends without its close is still the call; a tag in code or prose
+  stays text.
 
 **Errors**
 

package/index.mjs

@@ -311,6 +311,64 @@ async function deviceSignIn(site) {
   }
 }
 
+// exchangeExpiry is when a job token from /api/v1/jobToken/exchange runs
+// out, as Qoder's own client reads it: expire_time or expires_at (a date)
+// first, then expires_in (milliseconds), then a day.
+function exchangeExpiry(jt) {
+  for (const k of ["expire_time", "expires_at"]) {
+    const at = Date.parse(String(jt?.[k] ?? "").trim())
+    if (!isNaN(at)) return at
+  }
+  if (jt?.expires_in > 0) return Date.now() + jt.expires_in
+  return Date.now() + DAY
+}
+
+// exchangeToken is the job token from an exchange response, as Qoder's
+// client reads it: token, device_token or access_token.
+function exchangeToken(jt) {
+  return String(jt?.token ?? jt?.device_token ?? jt?.access_token ?? "").trim()
+}
+
+// patSignIn exchanges a Personal Access Token for a job token, bypassing
+// the OAuth device flow. PATs are long-lived (up to 1 year): the PAT is
+// kept on the credential, and when the job token's refresh lapses the PAT
+// is exchanged again rather than asking the user to sign in once more.
+async function patSignIn(site, pat) {
+  const machineId = randomUUID()
+  const r = await openapi(site, "/api/v1/jobToken/exchange", { method: "POST", body: { personal_token: pat } })
+  if (r.status === 400 || r.status === 401 || r.status === 403)
+    throw Object.assign(new Error(`${site.name} refused the PAT — check it is still valid`), { status: r.status })
+  if (r.status !== 200) throw new Error(`${site.name} PAT exchange: status ${r.status}`)
+  const token = exchangeToken(r.json)
+  if (!token) throw new Error(`${site.name} PAT exchange: empty token in response`)
+  const refresh = String(r.json?.refresh_token ?? r.json?.refreshToken ?? "").trim()
+  const chat = { access: token, refresh, expires: exchangeExpiry(r.json) }
+  let email = ""
+  let name = ""
+  let uid = ""
+  try {
+    const ui = await openapi(site, "/api/v1/userinfo", { token })
+    if (ui.status >= 200 && ui.status < 300) {
+      ;[email, name] = [ui.json?.email ?? "", ui.json?.name ?? ""]
+      uid = String(ui.json?.id ?? ui.json?.user_id ?? ui.json?.uid ?? "")
+    }
+  } catch {}
+  if (!uid) throw new Error(`${site.name} PAT sign-in: could not determine user id`)
+  return {
+    type: "success",
+    ...chat,
+    accountId: email || uid,
+    uid,
+    email,
+    name: name || "",
+    machineId,
+    deviceToken: "",
+    deviceRefresh: "",
+    patAuth: true,
+    pat,
+  }
+}
+
 // SignInGone is a sign-in that can't sign a request: a 401. Only Qoder
 // refusing the refresh token marks the account lapsed (expired), as the
 // built-in's qoderRefreshFailed did; no refresh token, or no account,
@@ -826,13 +884,37 @@ function parseCall(v) {
   return { name: m[1].trim(), args: JSON.stringify(args) }
 }
 
+// quoted says text ends inside a code fence or an inline code span: a
+// <tool_call> there is prose about one, not a call
+function quoted(text) {
+  if ((text.match(/```/g)?.length ?? 0) % 2) return true
+  const line = text.slice(text.lastIndexOf("\n") + 1).replace(/```/g, "")
+  return (line.match(/`/g)?.length ?? 0) % 2 === 1
+}
+
+// callish says a block was on its way to being a call: its JSON began, or
+// the XML function form
+const callish = (v) => v.trimStart().startsWith("{") || v.includes("\x3cfunction=")
+
+const CUT_SHORT = "the model's tool call, written as text, was cut short; it is not sent on as the answer"
+const UNREADABLE = "the model's tool call, written as text, can't be read; it is not sent on as the answer"
+
 // Splitter holds text until a whole tool-call block has come, then gives
-// it as a call.
+// it as a call. A block on its way to being a call that can't be read, or
+// that the stream ended inside, is an error, never the answer (plugins#132,
+// as trae's since plugins#38): the turn fails so it can be tried again. A
+// block whose JSON is whole when the stream ends without its close is still
+// the call; one that is no call at all, or one in code, stays text.
 class Splitter {
   textBuf = ""
   callBuf = ""
   inCall = false
   sawTool = false
+  sent = "" // the text given out so far, to tell a block in code from a call
+  text(out, t) {
+    this.sent += t
+    out.push({ text: t })
+  }
   feed(input) {
     const out = []
     while (input) {
@@ -847,11 +929,11 @@ class Splitter {
               keep = n
               break
             }
-          if (keep < comb.length) out.push({ text: comb.slice(0, comb.length - keep) })
+          if (keep < comb.length) this.text(out, comb.slice(0, comb.length - keep))
           this.textBuf = comb.slice(comb.length - keep)
           break
         }
-        if (i > 0) out.push({ text: comb.slice(0, i) })
+        if (i > 0) this.text(out, comb.slice(0, i))
         input = comb.slice(i + CALL_OPEN.length)
         this.inCall = true
         continue
@@ -863,11 +945,16 @@ class Splitter {
         this.callBuf = comb
         break
       }
-      const c = parseCall(comb.slice(0, j))
+      const body = comb.slice(0, j)
+      const c = parseCall(body)
       if (c) {
         this.sawTool = true
         out.push({ call: c })
-      } else out.push({ text: CALL_OPEN + comb.slice(0, j) + CALL_CLOSE })
+      } else if (callish(body) && !quoted(this.sent)) {
+        this.inCall = false
+        out.push({ error: UNREADABLE })
+        return out
+      } else this.text(out, CALL_OPEN + body + CALL_CLOSE)
       input = comb.slice(j + CALL_CLOSE.length)
       this.inCall = false
     }
@@ -875,14 +962,23 @@ class Splitter {
   }
   flush() {
     if (this.inCall) {
-      const t = CALL_OPEN + this.callBuf
+      const body = this.callBuf
       this.inCall = false
       this.callBuf = ""
+      if (callish(body) && !quoted(this.sent)) {
+        const c = parseCall(body)
+        if (!c) return [{ error: CUT_SHORT }]
+        this.sawTool = true
+        return [{ call: c }]
+      }
+      const t = CALL_OPEN + body
+      this.sent += t
       return [{ text: t }]
     }
     if (this.textBuf) {
       const t = this.textBuf
       this.textBuf = ""
+      this.sent += t
       return [{ text: t }]
     }
     return []
@@ -910,9 +1006,10 @@ async function* events(body) {
   const a = new Splitter()
   let index = -1 // the tool call being given
   let native = -1 // the native tool call being assembled
-  const flushed = function* () {
-    for (const f of a.flush()) if (f.text) yield { text: f.text }
-  }
+  // one piece of the split text as an event: a call, text, or a call that
+  // can't be read, which ends the turn as a 502
+  const piece = (f) =>
+    f.call ? { tool: { index: ++index, id: "call_" + hexID(), name: f.call.name, args: f.call.args } } : f.error ? { error: { status: 502, message: f.error } } : { text: f.text }
   let usage
   let fr = ""
   for await (const line of sseLines(body)) {
@@ -940,15 +1037,21 @@ async function* events(body) {
     if (delta.reasoning_content) yield { reasoning: delta.reasoning_content }
     if (typeof delta.content === "string")
       for (const f of a.feed(delta.content)) {
-        if (f.call) yield { tool: { index: ++index, id: "call_" + hexID(), name: f.call.name, args: f.call.args } }
-        else if (f.text) yield { text: f.text }
+        if (!f.call && !f.error && !f.text) continue
+        const e = piece(f)
+        yield e
+        if (e.error) return
       }
     // tool calls served the OpenAI way keep Qoder's id: a result answers it
     for (const tc of delta.tool_calls ?? []) {
       const i = Number(tc.index ?? 0)
       if (i !== native) {
         native = i
-        yield* flushed()
+        for (const f of a.flush()) {
+          const e = piece(f)
+          yield e
+          if (e.error) return
+        }
         a.sawTool = true
         yield { tool: { index: ++index, id: tc.id || "call_" + hexID(), name: tc.function?.name ?? "", args: tc.function?.arguments ?? "" } }
       } else if (tc.function?.arguments) yield { args: { index, text: tc.function.arguments } }
@@ -967,7 +1070,11 @@ async function* events(body) {
         ...(u.completion_tokens_details?.reasoning_tokens ? { completion_tokens_details: { reasoning_tokens: u.completion_tokens_details.reasoning_tokens } } : {}),
       }
   }
-  yield* flushed()
+  for (const f of a.flush()) {
+    const e = piece(f)
+    yield e
+    if (e.error) return
+  }
   yield { stop: a.sawTool ? "tool_calls" : fr === "length" ? "length" : "stop", usage }
 }
 
@@ -1372,7 +1479,8 @@ const makePlugin = (site) => async ({ client }) => {
     return got
   }
   // renew spends a's chat refresh token, under the lock: the fields it
-  // changes, recorded in spent.
+  // changes, recorded in spent. A PAT account whose job refresh has lapsed
+  // exchanges the PAT again: the PAT lasts a year, the refresh two days.
   const renew = async (a) => {
     const s = siteOf(site, a)
     if (a.deviceChat) {
@@ -1381,7 +1489,22 @@ const makePlugin = (site) => async ({ client }) => {
       const dt = await refreshDevice(s, a.refresh, true)
       return spend(a.refresh, { access: dt.token, refresh: dt.refresh, expires: dt.expires, deviceToken: dt.token, deviceRefresh: dt.refresh })
     }
-    const jt = await refreshJob(s, a.refresh, a.accountId || a.email || a.uid)
+    let jt
+    try {
+      jt = await refreshJob(s, a.refresh, a.accountId || a.email || a.uid)
+    } catch (e) {
+      if (!(e instanceof SignInGone) || !a.patAuth || !a.pat) throw e
+      let ex
+      try {
+        ex = await patSignIn(s, a.pat)
+      } catch (p) {
+        // a PAT lapses too — out of date, or revoked: Qoder's refusal ends
+        // the sign-in as a lapsed device one does, not as a server fault
+        if (!p?.status) throw p
+        throw new SignInGone(`${site.name} refused the PAT — sign in again with a new one`, true)
+      }
+      return spend(a.refresh, { access: ex.access, refresh: ex.refresh, expires: ex.expires })
+    }
     return spend(a.refresh, { access: jt.token, refresh: jt.refresh_token, expires: expiresAt(jt) })
   }
   // each account's listing, the model configs a request carries
@@ -1450,6 +1573,14 @@ const makePlugin = (site) => async ({ client }) => {
     try {
       const cred = await fresh(getAuth)
       if (renewed(cred)) signIn = "renewed"
+      // A PAT account has no device token: the usage endpoint takes the job
+      // token the exchange gave — a live PAT account answered 200 with a
+      // qoder envelope. Its errors surface as the device path's do; there is
+      // no second token here to rotate and retry with.
+      if (cred.patAuth && !cred.deviceToken) {
+        const env = await fetchUsage(siteOf(site, cred), cred.access)
+        return { ...parseUsage(env), signIn }
+      }
       let env
       try {
         env = await fetchUsage(siteOf(site, cred), cred.deviceToken)
@@ -1583,6 +1714,40 @@ const makePlugin = (site) => async ({ client }) => {
       },
       methods: [
         { type: "oauth", label: `Sign in with ${site.name}`, authorize: () => deviceSignIn(site) },
+        // PAT sign-in: exchange a Personal Access Token for a job token,
+        // bypassing the OAuth device flow. PATs last up to 1 year.
+        // Not offered on Qoder CN: its CLI uses device chat directly and
+        // never makes a job token, so a PAT exchange may not produce one
+        // the chat endpoint accepts.
+        ...(site.id !== "qoder-cn"
+          ? [
+              {
+                type: "oauth",
+                label: `Sign in with ${site.name} PAT`,
+                prompts: [
+                  {
+                    type: "password",
+                    key: "pat",
+                    message: "Your Qoder Personal Access Token (from qoder.com/account/integrations)",
+                    placeholder: "pt-...",
+                    validate: (v) => (String(v ?? "").trim().startsWith("pt-") ? undefined : "PAT must start with pt-"),
+                  },
+                ],
+                authorize: (inputs) => {
+                  const pat = String(inputs?.pat ?? "").trim()
+                  if (!pat) throw new Error("enter your Personal Access Token")
+                  return {
+                    url: `${site.web}/account/integrations`,
+                    instructions: `Create a PAT at ${site.web}/account/integrations if you don't have one`,
+                    method: "auto",
+                    async callback() {
+                      return patSignIn(site, pat)
+                    },
+                  }
+                },
+              },
+            ]
+          : []),
         // an enterprise VPC instance (Qoder CN), a method of its own so
         // that the sign-in above asks nothing new
         ...(site.vpcDomain

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-qoder-auth",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "description": "Qoder subscriptions in OpenCode and magpie: Qoder (qoder.com) and Qoder CN (qoder.cn)",
   "type": "module",
   "main": "./index.mjs",