@magpie-community/opencode-qoder-auth 0.2.22 → 0.2.24

package/README.md

@@ -100,6 +100,9 @@ itself.
   - the account, AES-encrypted, with the key wrapped by Qoder's RSA key;
   - an MD5 signature;
   - the machine id and the client's headers.
+  - `Cosy-Version`: the worker runtime version that Qoder's desktop app
+    ships (1.1.69 in app 0.4.8, since 0.2.23, #281), because
+    `Cosy-ClientType` says the desktop app.
 
 **Reading the reply**
 
@@ -122,6 +125,7 @@ itself.
 | A quota (codes 110, 112–119, 122) | 429 |
 | Busy or queued for the model (code 10605) | 503, with `Retry-After` from Qoder's `retryAfterSeconds` (30s when it gives none); the sign-in is untouched |
 | A refusal of the request itself (codes 406, 416, 430, 80411, 80412, 100400–100403) | 400, with Qoder's words |
+| "Error in upstream response", the model's own vendor behind Qoder failing, which Qoder sends as a 400 (since 0.2.24) | 502, so magpie asks again or another account; the sign-in is untouched |
 | A failure before the answer starts | Qoder's status |
 | A failure after the answer has started | The stream ends with an error |
 

package/index.mjs

@@ -43,7 +43,14 @@ import { join, resolve } from "node:path"
 
 const CHAT_PATH = "/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1"
 const MODELS_PATH = "/algo/api/v2/model/list?Encode=1"
-const COSY_VERSION = "1.1.49"
+// The build the envelope claims. It has to be the one Qoder's desktop app
+// talks through — the worker runtime bundled in the app — because the
+// envelope also says Cosy-ClientType: 10 (desktop) and carries that app's
+// machine identity; the CLI's channel publishes a different, later number
+// that no desktop build runs. Taken from app 0.4.8 (build 79743374,
+// 2026-10-14), whose transport config names 1.1.69. Raise it when the app
+// moves, not when the CLI does.
+const COSY_VERSION = "1.1.69"
 const SIGN_IN_TIMEOUT = 15 * 60 * 1000
 const REFRESH_LEAD = 5 * 60 * 1000 // a chat token this close to its end is refreshed before a request
 const RENEW_LEAD = 10 * 60 * 1000 // and this close, magpie renews it ahead of time (auth.refresh)
@@ -842,6 +849,14 @@ const QUOTA_CODES = new Set(["110", "112", "113", "114", "115", "116", "117", "1
 // supported, input too long, too many media, a custom model's service
 const REQUEST_CODES = new Set(["406", "416", "430", "80411", "80412", "100400", "100401", "100403"])
 const BUSY_WAIT = 30
+// UPSTREAM_FAILED is Qoder saying the model's own vendor behind it failed:
+// "Error in upstream response", which Qoder sends as a 400 (SlouchyQuill507
+// on Discord, qoder-cn). Nothing is wrong with the request or the account,
+// so it is a 502, which magpie asks again or of another account, not a
+// 400 that ends the turn as the client's fault. A request too long for the
+// model fails the same way, and magpie tells that one apart by its size
+// (tooLongUnsaid), at 502 as at 400.
+const UPSTREAM_FAILED = /\berror in upstream response\b/i
 
 function failure(status, text) {
   if (status < 400 || status > 599) status = 502
@@ -887,6 +902,7 @@ function failure(status, text) {
   }
   if (QUOTA_CODES.has(code)) return { status: 429, message: "usage limit reached: " + msg, signIn: "" }
   if (REQUEST_CODES.has(code)) return { status: 400, message: `Qoder refused the request (${code}): ${msg}`, signIn: "" }
+  if (UPSTREAM_FAILED.test(msg)) return { status: 502, message: msg, signIn: "" }
   // a refused chat is the built-in's 401, which never marked the account
   // lapsed: only a refused refresh did (errorResponse says kept). Qoder's
   // own words go with it: a 401 right after signing in isn't a lapsed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-qoder-auth",
-  "version": "0.2.22",
+  "version": "0.2.24",
   "description": "Qoder subscriptions in OpenCode and magpie: Qoder (qoder.com) and Qoder CN (qoder.cn)",
   "type": "module",
   "main": "./index.mjs",