@magpie-community/opencode-qoder-auth 0.2.21 → 0.2.23

package/README.md

@@ -81,6 +81,10 @@ itself.
   - Messages become text and image blocks.
   - Tool calls and results become OpenAI tool turns. Images a tool returned
     follow in a user turn.
+  - A result whose id the client lost answers its turn's call in order
+    (since 0.2.22, #277): Qoder refuses a whole request with a result that
+    answers no call before it. A result with no call left to answer goes
+    as text in the user's turn.
   - Your tools become Qoder's native function tools.
   - The model's own configuration from Qoder's list goes with it.
 - It picks the reasoning effort from the model's own levels:
@@ -96,6 +100,9 @@ itself.
   - the account, AES-encrypted, with the key wrapped by Qoder's RSA key;
   - an MD5 signature;
   - the machine id and the client's headers.
+  - `Cosy-Version`: the worker runtime version that Qoder's desktop app
+    ships (1.1.69 in app 0.4.8, since 0.2.23, #281), because
+    `Cosy-ClientType` says the desktop app.
 
 **Reading the reply**
 

package/index.mjs

@@ -43,7 +43,14 @@ import { join, resolve } from "node:path"
 
 const CHAT_PATH = "/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1"
 const MODELS_PATH = "/algo/api/v2/model/list?Encode=1"
-const COSY_VERSION = "1.1.49"
+// The build the envelope claims. It has to be the one Qoder's desktop app
+// talks through — the worker runtime bundled in the app — because the
+// envelope also says Cosy-ClientType: 10 (desktop) and carries that app's
+// machine identity; the CLI's channel publishes a different, later number
+// that no desktop build runs. Taken from app 0.4.8 (build 79743374,
+// 2026-10-14), whose transport config names 1.1.69. Raise it when the app
+// moves, not when the CLI does.
+const COSY_VERSION = "1.1.69"
 const SIGN_IN_TIMEOUT = 15 * 60 * 1000
 const REFRESH_LEAD = 5 * 60 * 1000 // a chat token this close to its end is refreshed before a request
 const RENEW_LEAD = 10 * 60 * 1000 // and this close, magpie renews it ahead of time (auth.refresh)
@@ -687,6 +694,17 @@ const textOf = (c) => (typeof c === "string" ? c : blocksOf(c).filter((b) => b.t
 // blocks, an assistant's tool calls as tool_calls, results as tool turns by
 // tool_call_id. A tool turn holds text only, so the images a tool returned
 // follow in a user turn — the start of the user's own when one comes next.
+//
+// Qoder turns the whole request away when a tool turn answers no call of the
+// turn before it ("Messages with role 'tool' must be a response to a
+// preceding message with 'tool_calls'"), where another API takes the same
+// conversation. A client's history reaches here with such a turn because it
+// dropped the id: either the call lost it, so the result names one no call
+// has, or the result kept none. Both are filled in rather than dropped — a
+// call without an id is given one, and the results after it take the ids it
+// went out with in order, which is the pairing a dropped id means. Only a
+// result with no call of its turn left to answer becomes text in the user's
+// own turn, so the words the tool returned stay with the conversation.
 function qoderMessages(msgs) {
   const out = []
   const names = {}
@@ -695,31 +713,64 @@ function qoderMessages(msgs) {
     if (seen.length) out.push({ role: "user", content: seen })
     seen = []
   }
-  for (const m of msgs) {
+  // turn is the assistant turn being answered: the calls no result has
+  // answered yet, in the order they were made, and the ones a result after
+  // it names (kept), which a result whose id was lost must not take.
+  let turn = null
+  const asText = (txt, ims) => {
+    const said = txt.trim()
+    if (!said && !ims.length) return
+    if (seen.length) seen.push({ type: "text", text: "\n\n" })
+    if (said) seen.push({ type: "text", text: said })
+    seen.push(...ims)
+  }
+  for (const [i, m] of msgs.entries()) {
     if (m.role === "system" || m.role === "developer") continue
+    if (m.role === "user") turn = null
     if (m.role !== "user" && m.role !== "tool") showSeen()
     if (m.role === "tool") {
       let txt = textOf(m.content)
       const ims = Array.isArray(m.content) ? m.content.filter((p) => p?.type === "image_url").map(imageBlock).filter(Boolean) : []
+      const named = String(m.tool_call_id ?? "").trim()
+      // A result naming a call of this turn answers it; one whose id the
+      // client lost — none, or one no call here has — answers the earliest
+      // call still open that no other result names, which is the order the
+      // calls were made in.
+      const at = named ? turn?.open.findIndex((id) => id === named) ?? -1 : -1
+      const pick = at >= 0 ? at : turn ? turn.open.findIndex((id) => !turn.kept.has(id)) : -1
+      if (pick < 0) {
+        asText(txt, ims)
+        continue
+      }
+      const answered = turn.open.splice(pick, 1)[0]
       if (ims.length) {
-        let of = "tool call " + m.tool_call_id
-        const name = names[m.tool_call_id] || m.name
+        let of = "tool call " + answered
+        const name = names[answered] || m.name
         if (name) of = `${name} (${of})`
         seen.push({ type: "text", text: `[From the result of ${of}:]` }, ...ims)
         const note = ims.length === 1 ? "[The tool returned an image; it follows in the next message.]" : `[The tool returned ${ims.length} images; they follow in the next message.]`
         txt = txt.trim() ? txt + "\n\n" + note : txt + note
       }
-      out.push({ role: "tool", tool_call_id: m.tool_call_id, content: txt })
+      out.push({ role: "tool", tool_call_id: answered, content: txt })
       continue
     }
     if (m.role === "assistant" && m.tool_calls?.length) {
+      // a call the client sent without an id gets one, so its result can
+      // answer it instead of being turned into text
       const calls = m.tool_calls.map((c) => {
-        const id = c.id || "call_" + hexID()
+        const id = String(c.id ?? "").trim() || "call_" + hexID()
         names[id] = c.function?.name
         const args = c.function?.arguments
         return { id, type: "function", function: { name: c.function?.name, arguments: typeof args === "string" ? args : JSON.stringify(args ?? {}) } }
       })
       out.push({ role: "assistant", content: textOf(m.content), tool_calls: calls })
+      const open = calls.map((c) => c.id)
+      const kept = new Set()
+      for (let j = i + 1; j < msgs.length && msgs[j].role === "tool"; j++) {
+        const id = String(msgs[j].tool_call_id ?? "").trim()
+        if (open.includes(id)) kept.add(id)
+      }
+      turn = { open, kept }
       continue
     }
     let blocks = blocksOf(m.content)
@@ -727,6 +778,8 @@ function qoderMessages(msgs) {
     if (!blocks.length) continue
     if (m.role === "user" && seen.length) [blocks, seen] = [[...seen, ...blocks], []]
     out.push({ role: m.role, content: blocks })
+    // a result after the assistant's own words answers no call before it
+    turn = null
   }
   showSeen()
   return out
@@ -1928,4 +1981,4 @@ export const QoderAuthPlugin = makePlugin(SITES.qoder)
 export const QoderCNAuthPlugin = makePlugin(SITES["qoder-cn"])
 
 // for tests
-export const _internal = { campaignRuntime, campaignPage, campaignTarget, vpcInstance, vpcSite, parseUsage, gfmt, when, failure, modelInfo, qoderBody, SITES, decodeBody, events }
+export const _internal = { campaignRuntime, campaignPage, campaignTarget, vpcInstance, vpcSite, parseUsage, gfmt, when, failure, modelInfo, qoderBody, qoderMessages, SITES, decodeBody, events }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-qoder-auth",
-  "version": "0.2.21",
+  "version": "0.2.23",
   "description": "Qoder subscriptions in OpenCode and magpie: Qoder (qoder.com) and Qoder CN (qoder.cn)",
   "type": "module",
   "main": "./index.mjs",