@magpie-community/opencode-qoder-auth 0.2.2 → 0.2.4

package/README.md

@@ -26,10 +26,21 @@ What is kept: the job token, its refresh token and expiry, the uid, the
 device token and a machine id made for this sign-in. OpenCode keeps them in
 `auth.json`; magpie keeps them in `plugin-auth.json`.
 
-The job token is refreshed 5 minutes before it runs out. Qoder spends a
-refresh token once, so the new pair is saved straight away, and refreshes
-never run at the same time. When Qoder refuses a refresh (401 or 403), the
-request says to sign in again.
+Refreshing:
+- Qoder spends a refresh token once, so the plugin never sends one twice.
+- magpie renews the job token 10 minutes before it runs out, through the
+  plugin's `auth.refresh`, once for the account and before its requests,
+  models and usage need it; magpie saves the new pair. OpenCode doesn't
+  call that hook: there the job token is refreshed 5 minutes before it runs
+  out, before a request, and the new pair is saved straight away.
+- Only one refresh runs at a time. A request that reads the sign-in before
+  magpie saved a renewal uses the renewed pair, and a renewal handed a pair
+  a request already spent gives what that request got.
+- The device token, which reads usage, has no end on record: it is rotated
+  when Qoder refuses it. On a [Qoder CN](#qoder-cn) device-token account it
+  is the chat token too, and is renewed as above.
+- When Qoder refuses a refresh (401 or 403), the account needs signing in
+  again. Any other failure is tried again later.
 
 ## Requests
 

package/index.mjs

@@ -32,7 +32,9 @@ const CHAT_PATH = "/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=
 const MODELS_PATH = "/algo/api/v2/model/list?Encode=1"
 const COSY_VERSION = "1.1.49"
 const SIGN_IN_TIMEOUT = 15 * 60 * 1000
-const REFRESH_LEAD = 5 * 60 * 1000
+const REFRESH_LEAD = 5 * 60 * 1000 // a chat token this close to its end is refreshed before a request
+const RENEW_LEAD = 10 * 60 * 1000 // and this close, magpie renews it ahead of time (auth.refresh)
+const KEEP_SPENT_MS = 60 * 60 * 1000 // how long what a spent refresh token gave is remembered
 const DAY = 24 * 60 * 60 * 1000
 const CHAT = "@ai-sdk/openai-compatible"
 
@@ -724,6 +726,7 @@ async function* events(body) {
       yield { error: failure(Number(env.statusCodeValue), inner || payload) }
       return
     }
+    if (inner.trim() === "[DONE]") break
     let chunk
     try {
       chunk = JSON.parse(inner)
@@ -747,12 +750,19 @@ async function* events(body) {
         yield { tool: { index: ++index, id: tc.id || "call_" + hexID(), name: tc.function?.name ?? "", args: tc.function?.arguments ?? "" } }
       } else if (tc.function?.arguments) yield { args: { index, text: tc.function.arguments } }
     }
-    fr = chunk?.choices?.[0]?.finish_reason ?? ""
-    if (fr) {
-      const u = chunk.usage
-      if (u) usage = { prompt_tokens: u.prompt_tokens ?? 0, completion_tokens: u.completion_tokens ?? 0, total_tokens: (u.prompt_tokens ?? 0) + (u.completion_tokens ?? 0) }
-      break
-    }
+    fr = chunk?.choices?.[0]?.finish_reason || fr
+    // the usage comes in a chunk of its own after the finish, with no
+    // choices, as the built-in read it (qoder.go): every request was
+    // counted as 0 tokens when the finish ended the reading
+    const u = chunk?.usage
+    if (u)
+      usage = {
+        prompt_tokens: u.prompt_tokens ?? 0,
+        completion_tokens: u.completion_tokens ?? 0,
+        total_tokens: (u.prompt_tokens ?? 0) + (u.completion_tokens ?? 0),
+        ...(u.prompt_tokens_details?.cached_tokens ? { prompt_tokens_details: { cached_tokens: u.prompt_tokens_details.cached_tokens } } : {}),
+        ...(u.completion_tokens_details?.reasoning_tokens ? { completion_tokens_details: { reasoning_tokens: u.completion_tokens_details.reasoning_tokens } } : {}),
+      }
   }
   yield* flushed()
   yield { stop: a.sawTool ? "tool_calls" : fr === "length" ? "length" : "stop", usage }
@@ -842,6 +852,13 @@ function signed(res, renewed) {
   return new Response(res.body, { status: res.status, statusText: res.statusText, headers })
 }
 
+// changed is the fields of b that differ from a's: what auth.refresh gives.
+function changed(a, b) {
+  const out = {}
+  for (const k of ["access", "refresh", "expires", "deviceToken", "deviceRefresh"]) if (b[k] !== a[k]) out[k] = b[k]
+  return out
+}
+
 // ---- usage --------------------------------------------------------------------
 //
 // The account's allowance as magpie's built-in Qoder account shows it
@@ -995,6 +1012,38 @@ const makePlugin = (site) => async ({ client }) => {
     lock = run.catch(() => {})
     return run
   }
+  // spent is what each refresh token this process spent gave, by that
+  // token: the chat pair it renewed. magpie saves what auth.refresh gives
+  // only once the hook has returned, and a request may read the account in
+  // between, or the hook be handed the account as it was before a request
+  // renewed it: either follows spent rather than spending the token again.
+  const spent = new Map()
+  const latest = (a) => {
+    for (let i = 0; i < 16 && a?.refresh; i++) {
+      const s = spent.get(a.refresh)
+      if (!s) break
+      a = { ...a, ...s.got }
+    }
+    return a
+  }
+  const spend = (refresh, got) => {
+    const now = Date.now()
+    for (const [k, v] of spent) if (now - v.at > KEEP_SPENT_MS) spent.delete(k)
+    spent.set(refresh, { got, at: now })
+    return got
+  }
+  // renew spends a's chat refresh token, under the lock: the fields it
+  // changes, recorded in spent.
+  const renew = async (a) => {
+    if (a.deviceChat) {
+      // the device token is the chat token: renewed as a device token,
+      // both pairs being the one pair
+      const dt = await refreshDevice(site, a.refresh, true)
+      return spend(a.refresh, { access: dt.token, refresh: dt.refresh, expires: dt.expires, deviceToken: dt.token, deviceRefresh: dt.refresh })
+    }
+    const jt = await refreshJob(site, a.refresh, a.accountId || a.email || a.uid)
+    return spend(a.refresh, { access: jt.token, refresh: jt.refresh_token, expires: expiresAt(jt) })
+  }
   // each account's listing, the model configs a request carries
   const listings = new Map()
   // the accounts fresh renewed: the built-in took the lapse mark off on a
@@ -1013,19 +1062,12 @@ const makePlugin = (site) => async ({ client }) => {
   // its end.
   const fresh = (getAuth) =>
     locked(async () => {
-      const a = await getAuth()
-      if (a?.type !== "oauth" || !a.access || !a.uid) throw new SignInGone(`${site.name}: not signed in`)
+      const stored = await getAuth()
+      if (stored?.type !== "oauth" || !stored.access || !stored.uid) throw new SignInGone(`${site.name}: not signed in`)
+      // renewed already (by magpie's auth.refresh), the store not yet saying so
+      const a = latest(stored)
       if (a.expires - Date.now() > REFRESH_LEAD) return a
-      let next
-      if (a.deviceChat) {
-        // the device token is the chat token: renewed as a device token,
-        // both pairs being the one pair
-        const dt = await refreshDevice(site, a.refresh, true)
-        next = { ...a, access: dt.token, refresh: dt.refresh, expires: dt.expires, deviceToken: dt.token, deviceRefresh: dt.refresh }
-      } else {
-        const jt = await refreshJob(site, a.refresh, a.accountId || a.email || a.uid)
-        next = { ...a, access: jt.token, refresh: jt.refresh_token, expires: expiresAt(jt) }
-      }
+      const next = { ...a, ...(await renew(a)) }
       await client.auth.set({ path: { id: ID }, body: next })
       renewals.add(next)
       return next
@@ -1044,12 +1086,12 @@ const makePlugin = (site) => async ({ client }) => {
   // the one saved since, else a rotated one, saved.
   const deviceToken = (getAuth, attempted) =>
     locked(async () => {
-      const a = await getAuth()
+      const a = latest(await getAuth())
       if (a?.deviceToken !== attempted) return a?.deviceToken
       const dt = await refreshDevice(site, a.deviceRefresh, !!a.deviceChat)
       const next = { ...a, deviceToken: dt.token, deviceRefresh: dt.refresh }
       // the pair it spent was the chat pair too
-      if (a.deviceChat) Object.assign(next, { access: dt.token, refresh: dt.refresh, expires: dt.expires })
+      if (a.deviceChat) Object.assign(next, spend(a.refresh, { access: dt.token, refresh: dt.refresh, expires: dt.expires, deviceToken: dt.token, deviceRefresh: dt.refresh }))
       await client.auth.set({ path: { id: ID }, body: next })
       return dt.token
     })
@@ -1115,6 +1157,28 @@ const makePlugin = (site) => async ({ client }) => {
   return {
     auth: {
       provider: ID,
+      // magpie renews the chat token RENEW_LEAD before its end, once for
+      // the account, before its requests, models and usage ask for it; the
+      // check before each request (REFRESH_LEAD) stays for OpenCode, which
+      // doesn't call this. The device token of a job-token account has no
+      // end on record: usage rotates it once Qoder refuses it, as before.
+      refreshLead: RENEW_LEAD,
+      async refresh(auth) {
+        if (auth?.type !== "oauth" || !auth.access || !auth.uid || !String(auth.refresh ?? "").trim()) return undefined
+        return locked(async () => {
+          // a request renewed it meanwhile (or magpie hasn't saved this
+          // hook's last answer): what that gave, not a second refresh
+          const a = latest(auth)
+          if (a.access !== auth.access && a.expires - Date.now() > RENEW_LEAD) return changed(auth, a)
+          try {
+            // magpie saves what this gives
+            return changed(auth, { ...a, ...(await renew(a)) })
+          } catch (e) {
+            if (e?.expired) throw Object.assign(new Error(e.message), { signIn: "expired" })
+            throw e
+          }
+        })
+      },
       async loader(getAuth) {
         const a = await getAuth()
         if (a?.type !== "oauth") return {}
@@ -1189,4 +1253,4 @@ export const QoderAuthPlugin = makePlugin(SITES.qoder)
 export const QoderCNAuthPlugin = makePlugin(SITES["qoder-cn"])
 
 // for tests
-export const _internal = { parseUsage, gfmt, when, failure, modelInfo, SITES, decodeBody }
+export const _internal = { parseUsage, gfmt, when, failure, modelInfo, SITES, decodeBody, events }

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@magpie-community/opencode-qoder-auth",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Qoder subscriptions in OpenCode and magpie: Qoder (qoder.com) and Qoder CN (qoder.cn)",
   "type": "module",
   "main": "./index.mjs",
   "exports": "./index.mjs",
   "files": ["index.mjs", "README.md", "LICENSE-CLIProxyAPI"],
   "keywords": ["opencode", "opencode-plugin", "magpie", "qoder", "qoder-cn"],
-  "license": "MIT"
+  "license": "MIT",
+  "repository": { "type": "git", "url": "git+https://github.com/magpie-community/plugins.git", "directory": "packages/qoder" }
 }