@magpie-community/opencode-qoder-auth 0.2.24 → 0.2.26

package/README.md

@@ -22,6 +22,11 @@ hosts; [its section](#qoder-cn) says what differs.
 3. The device token is traded for a job token, and the account's email and
    name are read.
 
+The page is asked for no `redirect_uri`, as Qoder's CLI asks for none, so
+the sign-in ends in the browser tab even when Qoder.app is installed
+(before 0.2.25 it sent the desktop app's `qoder-app://`, which handed the
+page to Qoder.app).
+
 **Sign in with Qoder PAT** (and **Sign in with Qoder CN PAT**) skips the
 device flow: a Personal Access Token from `<site>/account/integrations` is
 posted to `/api/v1/jobToken/exchange` (`personal_token`), which answers a
@@ -86,6 +91,17 @@ itself.
     answers no call before it. A result with no call left to answer goes
     as text in the user's turn.
   - Your tools become Qoder's native function tools.
+  - A call the client sent without an id gets one made from its turn, its
+    place and its arguments, so it goes out the same on every request.
+- It marks the prompt for Qoder's cache as Qoder's own client does (since
+  0.2.26, #290): the last block of the last user turn carries
+  `cache_control: ephemeral` (nothing is marked when the last turn is a
+  tool's result), user turns carry their blocks as `contents` too, and each
+  request names its conversation in `session_id`. That id is a hash of
+  Codex's thread (`prompt_cache_key`) when magpie sends one, else of the
+  conversation's start, so every turn of one conversation names the same
+  session; the key itself never goes out. Each request has its own
+  `request_id`.
   - The model's own configuration from Qoder's list goes with it.
 - It picks the reasoning effort from the model's own levels:
   - The nearest level to the one asked, the higher one on a tie.
@@ -178,7 +194,7 @@ Qoder CN's own CLI builds in for its `cn` build (`@qodercn-ai/qoderclicn`
 | Accounts: poll, tokens, user info, usage | openapi.qoder.sh | openapi.qoder.com.cn |
 | Models and chat | api3.qoder.sh | gateway.qoder.com.cn |
 | Device-flow client id | Qoder's desktop client's | Qoder CN's CLI's (production) |
-| `redirect_uri` on the sign-in page | `qoder-app://` | none, as the CLI sends |
+| `redirect_uri` on the sign-in page | none, as Qoder's CLI sends (since 0.2.25) | none, as the CLI sends |
 
 Qoder CN's CLI chats with the device token itself and never makes a job
 token. The plugin asks qoder.cn for a job token first, as it does on
@@ -252,8 +268,8 @@ the account's credentials.
 
 - Install Qoder desktop, or sign in to Qoder CLI once, to make its native
   runtime available. The plugin finds the desktop's `resources/umid`
-  (`Qoder.app` on macOS, `%LOCALAPPDATA%\Programs\Qoder` on Windows,
-  `/opt/Qoder` on Linux) or the runtime the CLI caches in `~/.qoder/.bin`
+  (`Qoder.app` on macOS, `%LOCALAPPDATA%\Programs\Qoder` or, since
+  0.2.26, `%ProgramFiles%\Qoder` on Windows, `/opt/Qoder` on Linux) or the runtime the CLI caches in `~/.qoder/.bin`
   (`runtime-info-<platform>-<arch>-*` on macOS and Linux,
   `umid-win32-x64-*\runtime-info.exe` on Windows; `QODER_CONFIG_DIR`,
   `QODER_CLI_HOME` and `QODER_CONFIG_DIR_NAME` move it as they move the

package/index.mjs

@@ -705,6 +705,16 @@ const textOf = (c) => (typeof c === "string" ? c : blocksOf(c).filter((b) => b.t
 // went out with in order, which is the pairing a dropped id means. Only a
 // result with no call of its turn left to answer becomes text in the user's
 // own turn, so the words the tool returned stay with the conversation.
+// callID is the id a call the client sent without one goes out with: the
+// same on every turn of the conversation (#290), made from where the call
+// is and what it says, so the history Qoder sees doesn't change under a
+// prompt cache from one request to the next.
+function callID(at, k, c) {
+  const args = c.function?.arguments
+  const said = typeof args === "string" ? args : JSON.stringify(args ?? {})
+  return "call_" + createHash("sha256").update(`${at}\0${k}\0${c.function?.name ?? ""}\0${said}`).digest("hex").slice(0, 32)
+}
+
 function qoderMessages(msgs) {
   const out = []
   const names = {}
@@ -757,8 +767,8 @@ function qoderMessages(msgs) {
     if (m.role === "assistant" && m.tool_calls?.length) {
       // a call the client sent without an id gets one, so its result can
       // answer it instead of being turned into text
-      const calls = m.tool_calls.map((c) => {
-        const id = String(c.id ?? "").trim() || "call_" + hexID()
+      const calls = m.tool_calls.map((c, k) => {
+        const id = String(c.id ?? "").trim() || callID(i, k, c)
         names[id] = c.function?.name
         const args = c.function?.arguments
         return { id, type: "function", function: { name: c.function?.name, arguments: typeof args === "string" ? args : JSON.stringify(args ?? {}) } }
@@ -804,6 +814,49 @@ function windowFor(chat, m, reply = 0) {
   return m.windows.find((w) => w >= need) ?? m.windows[m.windows.length - 1]
 }
 
+// UNCACHED are the blocks Qoder's client never marks for the prompt cache.
+const UNCACHED = new Set(["thinking", "redacted_thinking", "tool_use", "tool_result"])
+
+// cacheMarked is the turns as Qoder's own client sends them for the prompt
+// cache (#290): every user turn's blocks also as contents, and the last
+// block of the last turn that isn't thinking or a tool's marked
+// cache_control ephemeral. That is qoder-agent-sdk's (Qoder.app and
+// qodercli 1.1.75 alike): the last message's last such block, and nothing
+// when the last turn is a tool's. A model behind Qoder that caches only
+// what is marked (Anthropic's) read none of a conversation without it,
+// while one that caches on its own (Fast) did. The caller's turns are left
+// as they were.
+function cacheMarked(msgs) {
+  const out = msgs.map((m) => (m.role === "user" && Array.isArray(m.content) ? { ...m, contents: m.content } : m))
+  const last = out.at(-1)
+  if (last?.role !== "user" || !Array.isArray(last.content)) return out
+  const at = last.content.findLastIndex((b) => b?.type && !UNCACHED.has(b.type))
+  if (at < 0) return out
+  const blocks = last.content.slice()
+  blocks[at] = { ...blocks[at], cache_control: { type: "ephemeral" } }
+  out[out.length - 1] = { ...last, content: blocks, contents: blocks }
+  return out
+}
+
+// sessionOf is the session_id a request goes out under: one for every turn
+// of a conversation and another for each conversation, as Qoder's client
+// sends its own session's (#290). Qoder can keep a conversation where its
+// prompt is cached only when its turns say they are one. It is the
+// client's prompt_cache_key (Codex's thread), else its user, else the
+// conversation's opening (its system prompt and first user turn), hashed,
+// so no key of the client's goes to Qoder as it is.
+function sessionOf(chat) {
+  let seed = String(chat.prompt_cache_key ?? "").trim() ? "key\0" + chat.prompt_cache_key : String(chat.user ?? "").trim() ? "user\0" + chat.user : ""
+  if (!seed) {
+    const msgs = chat.messages ?? []
+    const sys = msgs.filter((x) => x.role === "system" || x.role === "developer").map((x) => textOf(x.content))
+    const first = msgs.find((x) => x.role === "user")
+    seed = "chat\0" + JSON.stringify([sys, first?.content ?? ""])
+  }
+  const h = createHash("sha256").update(seed).digest("hex")
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`
+}
+
 // qoderBody is the plaintext agent_chat_generation takes for a chat
 // completion request, for model m.
 function qoderBody(chat, m) {
@@ -817,7 +870,12 @@ function qoderBody(chat, m) {
   if (effort) params.reasoning_effort = effort
   const window = windowFor(chat, m, params.max_tokens)
   if (window > 0) params.context_length = window
+  const request = randomUUID()
   const body = {
+    request_id: request,
+    request_set_id: request,
+    chat_record_id: request,
+    session_id: sessionOf(chat),
     parameters: params,
     business: { product: "app", version: COSY_VERSION, type: "agent", id: hexID(), name: "magpie session", begin_at: Date.now(), stage: "start" },
     agent_id: "agent_common",
@@ -825,7 +883,7 @@ function qoderBody(chat, m) {
     session_type: "app",
     model_config: m.config,
     system: [sys],
-    messages: [{ role: "system", content: [sys] }, ...qoderMessages(chat.messages ?? [])],
+    messages: [{ role: "system", content: [sys] }, ...cacheMarked(qoderMessages(chat.messages ?? []))],
   }
   if (tools.length)
     body.tools = tools.map((t) => ({
@@ -1312,7 +1370,8 @@ const CAMPAIGN_MACHINE_TTL = 60 * 60 * 1000 // Qoder's desktop client renews its
 //
 // Where each one keeps it (Qoder desktop 0.4.3's packages, qodercli 1.1.66):
 //   - desktop: <install>/resources/umid/runtime-info(.exe): Qoder.app on
-//     macOS, %LOCALAPPDATA%\Programs\Qoder (the user installer) on Windows,
+//     macOS, %LOCALAPPDATA%\Programs\Qoder (the user installer) or
+//     %ProgramFiles%\Qoder (a machine-wide install) on Windows,
 //     /opt/Qoder (the .deb and the .rpm) on Linux;
 //   - CLI: <config>/.bin, where <config> is QODER_CONFIG_DIR, else
 //     QODER_CLI_HOME (or the home folder) joined with QODER_CONFIG_DIR_NAME
@@ -1327,6 +1386,8 @@ async function campaignRuntime({ home = homedir(), platform = process.platform,
   if (platform === "win32") {
     const local = env.LOCALAPPDATA || join(home, "AppData", "Local")
     paths.push(join(local, "Programs", "Qoder", "resources", "umid", name))
+    // the machine-wide installer, as VS Code's system setup places it
+    for (const dir of [env.ProgramFiles || env.PROGRAMFILES, env.ProgramW6432]) if (dir) paths.push(join(dir, "Qoder", "resources", "umid", name))
   } else if (platform === "darwin") {
     for (const dir of ["/Applications", join(home, "Applications")]) paths.push(join(dir, "Qoder.app", "Contents", "Resources", "umid", name))
   } else if (platform === "linux") {
@@ -1504,7 +1565,10 @@ const SITES = {
     web: "https://qoder.com",
     openapi: "https://openapi.qoder.sh",
     api: "https://api3.qoder.sh",
-    redirect: "qoder-app://",
+    // none, as Qoder's CLI (@qoder-ai/qodercli 1.1.75) sends: the desktop
+    // app's qoder-app:// hands the finished page to Qoder.app, when it is
+    // installed, instead of leaving it in the tab while this polls (#276)
+    redirect: "",
     models: MODELS,
   },
   "qoder-cn": {
@@ -1990,4 +2054,4 @@ export const QoderAuthPlugin = makePlugin(SITES.qoder)
 export const QoderCNAuthPlugin = makePlugin(SITES["qoder-cn"])
 
 // for tests
-export const _internal = { campaignRuntime, campaignPage, campaignTarget, vpcInstance, vpcSite, parseUsage, gfmt, when, failure, modelInfo, qoderBody, qoderMessages, SITES, decodeBody, events }
+export const _internal = { campaignRuntime, campaignPage, campaignTarget, vpcInstance, vpcSite, parseUsage, gfmt, when, failure, modelInfo, qoderBody, qoderMessages, cacheMarked, sessionOf, SITES, decodeBody, events }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-qoder-auth",
-  "version": "0.2.24",
+  "version": "0.2.26",
   "description": "Qoder subscriptions in OpenCode and magpie: Qoder (qoder.com) and Qoder CN (qoder.cn)",
   "type": "module",
   "main": "./index.mjs",