@magpie-community/opencode-qoder-auth 0.2.20 → 0.2.22

package/README.md

@@ -22,6 +22,31 @@ hosts; [its section](#qoder-cn) says what differs.
 3. The device token is traded for a job token, and the account's email and
    name are read.
 
+**Sign in with Qoder PAT** (and **Sign in with Qoder CN PAT**) skips the
+device flow: a Personal Access Token from `<site>/account/integrations` is
+posted to `/api/v1/jobToken/exchange` (`personal_token`), which answers a
+job token, its refresh token and its expiry. The PAT is kept on the
+credential, so a lapsed job refresh is exchanged again instead of asking
+for the sign-in; PATs last up to a year. The job token signs the model list
+and chat calls with the same COSY envelope either sign-in's does.
+
+On Qoder CN this is the plugin's own reading of the protocol rather than
+the CLI's path: qoder.cn's CLI signs requests with its device token and
+never asks for a job token. Verified against a live qoder.cn account — the
+exchange answers 200 with a `jt-` token, the signed model list answers 200
+with that account's own models, and a chat completion returns its text.
+
+A PAT account keeps the name its browser sign-in takes (`email || uid`): magpie
+replaces an account on a new sign-in when both the accountId and the uid
+match, so a renewed PAT sign-in names the same account rather than adding a
+row beside the lapsed one.
+
+A PAT account has no device token, so its usage read, campaigns pages and
+daily check-in go out on the job token instead. The check-in works on it: a
+live PAT account answered 200 to the campaigns list and `CLAIMED` to a claim,
+so it earns the daily credits the browser sign-in does. That path has no
+second token to rotate, so a refused call is the answer rather than a retry.
+
 What is kept: the job token, its refresh token and expiry, the uid, the
 device token and a machine id made for this sign-in. OpenCode keeps them in
 `auth.json`; magpie keeps them in `plugin-auth.json`.
@@ -56,6 +81,10 @@ itself.
   - Messages become text and image blocks.
   - Tool calls and results become OpenAI tool turns. Images a tool returned
     follow in a user turn.
+  - A result whose id the client lost answers its turn's call in order
+    (since 0.2.22, #277): Qoder refuses a whole request with a result that
+    answers no call before it. A result with no call left to answer goes
+    as text in the user's turn.
   - Your tools become Qoder's native function tools.
   - The model's own configuration from Qoder's list goes with it.
 - It picks the reasoning effort from the model's own levels:

package/index.mjs

@@ -357,6 +357,10 @@ async function patSignIn(site, pat) {
   return {
     type: "success",
     ...chat,
+    // The same name its browser sign-in takes: magpie's plugin host replaces
+    // an account on a new sign-in when both the accountId and the uid match,
+    // so a renewed PAT sign-in must keep naming the same account. A suffix
+    // here would add a second row beside the lapsed one instead.
     accountId: email || uid,
     uid,
     email,
@@ -683,6 +687,17 @@ const textOf = (c) => (typeof c === "string" ? c : blocksOf(c).filter((b) => b.t
 // blocks, an assistant's tool calls as tool_calls, results as tool turns by
 // tool_call_id. A tool turn holds text only, so the images a tool returned
 // follow in a user turn — the start of the user's own when one comes next.
+//
+// Qoder turns the whole request away when a tool turn answers no call of the
+// turn before it ("Messages with role 'tool' must be a response to a
+// preceding message with 'tool_calls'"), where another API takes the same
+// conversation. A client's history reaches here with such a turn because it
+// dropped the id: either the call lost it, so the result names one no call
+// has, or the result kept none. Both are filled in rather than dropped — a
+// call without an id is given one, and the results after it take the ids it
+// went out with in order, which is the pairing a dropped id means. Only a
+// result with no call of its turn left to answer becomes text in the user's
+// own turn, so the words the tool returned stay with the conversation.
 function qoderMessages(msgs) {
   const out = []
   const names = {}
@@ -691,31 +706,64 @@ function qoderMessages(msgs) {
     if (seen.length) out.push({ role: "user", content: seen })
     seen = []
   }
-  for (const m of msgs) {
+  // turn is the assistant turn being answered: the calls no result has
+  // answered yet, in the order they were made, and the ones a result after
+  // it names (kept), which a result whose id was lost must not take.
+  let turn = null
+  const asText = (txt, ims) => {
+    const said = txt.trim()
+    if (!said && !ims.length) return
+    if (seen.length) seen.push({ type: "text", text: "\n\n" })
+    if (said) seen.push({ type: "text", text: said })
+    seen.push(...ims)
+  }
+  for (const [i, m] of msgs.entries()) {
     if (m.role === "system" || m.role === "developer") continue
+    if (m.role === "user") turn = null
     if (m.role !== "user" && m.role !== "tool") showSeen()
     if (m.role === "tool") {
       let txt = textOf(m.content)
       const ims = Array.isArray(m.content) ? m.content.filter((p) => p?.type === "image_url").map(imageBlock).filter(Boolean) : []
+      const named = String(m.tool_call_id ?? "").trim()
+      // A result naming a call of this turn answers it; one whose id the
+      // client lost — none, or one no call here has — answers the earliest
+      // call still open that no other result names, which is the order the
+      // calls were made in.
+      const at = named ? turn?.open.findIndex((id) => id === named) ?? -1 : -1
+      const pick = at >= 0 ? at : turn ? turn.open.findIndex((id) => !turn.kept.has(id)) : -1
+      if (pick < 0) {
+        asText(txt, ims)
+        continue
+      }
+      const answered = turn.open.splice(pick, 1)[0]
       if (ims.length) {
-        let of = "tool call " + m.tool_call_id
-        const name = names[m.tool_call_id] || m.name
+        let of = "tool call " + answered
+        const name = names[answered] || m.name
         if (name) of = `${name} (${of})`
         seen.push({ type: "text", text: `[From the result of ${of}:]` }, ...ims)
         const note = ims.length === 1 ? "[The tool returned an image; it follows in the next message.]" : `[The tool returned ${ims.length} images; they follow in the next message.]`
         txt = txt.trim() ? txt + "\n\n" + note : txt + note
       }
-      out.push({ role: "tool", tool_call_id: m.tool_call_id, content: txt })
+      out.push({ role: "tool", tool_call_id: answered, content: txt })
       continue
     }
     if (m.role === "assistant" && m.tool_calls?.length) {
+      // a call the client sent without an id gets one, so its result can
+      // answer it instead of being turned into text
       const calls = m.tool_calls.map((c) => {
-        const id = c.id || "call_" + hexID()
+        const id = String(c.id ?? "").trim() || "call_" + hexID()
         names[id] = c.function?.name
         const args = c.function?.arguments
         return { id, type: "function", function: { name: c.function?.name, arguments: typeof args === "string" ? args : JSON.stringify(args ?? {}) } }
       })
       out.push({ role: "assistant", content: textOf(m.content), tool_calls: calls })
+      const open = calls.map((c) => c.id)
+      const kept = new Set()
+      for (let j = i + 1; j < msgs.length && msgs[j].role === "tool"; j++) {
+        const id = String(msgs[j].tool_call_id ?? "").trim()
+        if (open.includes(id)) kept.add(id)
+      }
+      turn = { open, kept }
       continue
     }
     let blocks = blocksOf(m.content)
@@ -723,6 +771,8 @@ function qoderMessages(msgs) {
     if (!blocks.length) continue
     if (m.role === "user" && seen.length) [blocks, seen] = [[...seen, ...blocks], []]
     out.push({ role: m.role, content: blocks })
+    // a result after the assistant's own words answers no call before it
+    turn = null
   }
   showSeen()
   return out
@@ -1636,8 +1686,14 @@ const makePlugin = (site) => async ({ client }) => {
     const method = String(init.method ?? input?.method ?? "GET").toUpperCase()
     try {
       const machine = site.id === "qoder" ? await machineForCampaign(cred.uid) : {}
-      let res = await campaignCall(url, method, body, cred.deviceToken, machine, init.signal)
-      if (res.status === 401 || res.status === 403) res = await campaignCall(url, method, body, await deviceToken(getAuth, cred.deviceToken), machine, init.signal)
+      // A PAT account has no device token: its job token signs the campaigns
+      // pages too, as it does the usage read. Nothing is rotated on that
+      // path — the refusal is the answer.
+      const patToken = cred.patAuth && !cred.deviceToken
+      const token = patToken ? cred.access : cred.deviceToken
+      let res = await campaignCall(url, method, body, token, machine, init.signal)
+      if (!patToken && (res.status === 401 || res.status === 403))
+        res = await campaignCall(url, method, body, await deviceToken(getAuth, cred.deviceToken), machine, init.signal)
       return signed(res, renewed(cred))
     } catch (e) {
       if (e?.expired) return signedInError(e)
@@ -1659,8 +1715,15 @@ const makePlugin = (site) => async ({ client }) => {
     if (!base) return { outcome: "inactive", message: "no campaigns page for this account" }
     try {
       const machine = site.id === "qoder" ? await machineForCampaign(cred.uid) : {}
+      // A PAT account has no device token: the campaigns pages take the job
+      // token the exchange gave, as the usage endpoint does. A live Qoder CN
+      // PAT account answered 200 to the list and CLAIMED to a claim, so the
+      // check-in works there as it does on a device-token account. That path
+      // has no second token to rotate, so a refusal is the answer.
+      const patToken = cred.patAuth && !cred.deviceToken ? cred.access : ""
       const call = async (url, method, body) => {
-        let res = await campaignCall(url, method, body, cred.deviceToken, machine)
+        let res = await campaignCall(url, method, body, patToken || cred.deviceToken, machine)
+        if (patToken) return res
         if (res.status === 401 || res.status === 403) {
           const token = await deviceToken(getAuth, cred.deviceToken)
           const current = latest(await getAuth())
@@ -1809,38 +1872,35 @@ const makePlugin = (site) => async ({ client }) => {
         { type: "oauth", label: `Sign in with ${site.name}`, authorize: () => deviceSignIn(site) },
         // PAT sign-in: exchange a Personal Access Token for a job token,
         // bypassing the OAuth device flow. PATs last up to 1 year.
-        // Not offered on Qoder CN: its CLI uses device chat directly and
-        // never makes a job token, so a PAT exchange may not produce one
-        // the chat endpoint accepts.
-        ...(site.id !== "qoder-cn"
-          ? [
-              {
-                type: "oauth",
-                label: `Sign in with ${site.name} PAT`,
-                prompts: [
-                  {
-                    type: "password",
-                    key: "pat",
-                    message: "Your Qoder Personal Access Token (from qoder.com/account/integrations)",
-                    placeholder: "pt-...",
-                    validate: (v) => (String(v ?? "").trim().startsWith("pt-") ? undefined : "PAT must start with pt-"),
-                  },
-                ],
-                authorize: (inputs) => {
-                  const pat = String(inputs?.pat ?? "").trim()
-                  if (!pat) throw new Error("enter your Personal Access Token")
-                  return {
-                    url: `${site.web}/account/integrations`,
-                    instructions: `Create a PAT at ${site.web}/account/integrations if you don't have one`,
-                    method: "auto",
-                    async callback() {
-                      return patSignIn(site, pat)
-                    },
-                  }
-                },
+        // Offered on both sites: Qoder CN's /api/v1/jobToken/exchange takes
+        // a PAT too (verified: HTTP 200 and a jt- token), and that job token
+        // signs the model list and chat calls with the COSY envelope as on
+        // qoder.com, so the exchange gives a token the chat endpoint accepts.
+        {
+          type: "oauth",
+          label: `Sign in with ${site.name} PAT`,
+          prompts: [
+            {
+              type: "password",
+              key: "pat",
+              message: `Your ${site.name} Personal Access Token (from ${site.web}/account/integrations)`,
+              placeholder: "pt-...",
+              validate: (v) => (String(v ?? "").trim().startsWith("pt-") ? undefined : "PAT must start with pt-"),
+            },
+          ],
+          authorize: (inputs) => {
+            const pat = String(inputs?.pat ?? "").trim()
+            if (!pat) throw new Error("enter your Personal Access Token")
+            return {
+              url: `${site.web}/account/integrations`,
+              instructions: `Create a PAT at ${site.web}/account/integrations if you don't have one`,
+              method: "auto",
+              async callback() {
+                return patSignIn(site, pat)
               },
-            ]
-          : []),
+            }
+          },
+        },
         // an enterprise VPC instance (Qoder CN), a method of its own so
         // that the sign-in above asks nothing new
         ...(site.vpcDomain
@@ -1914,4 +1974,4 @@ export const QoderAuthPlugin = makePlugin(SITES.qoder)
 export const QoderCNAuthPlugin = makePlugin(SITES["qoder-cn"])
 
 // for tests
-export const _internal = { campaignRuntime, campaignPage, campaignTarget, vpcInstance, vpcSite, parseUsage, gfmt, when, failure, modelInfo, qoderBody, SITES, decodeBody, events }
+export const _internal = { campaignRuntime, campaignPage, campaignTarget, vpcInstance, vpcSite, parseUsage, gfmt, when, failure, modelInfo, qoderBody, qoderMessages, SITES, decodeBody, events }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-qoder-auth",
-  "version": "0.2.20",
+  "version": "0.2.22",
   "description": "Qoder subscriptions in OpenCode and magpie: Qoder (qoder.com) and Qoder CN (qoder.cn)",
   "type": "module",
   "main": "./index.mjs",