@magpie-community/opencode-qoder-auth 0.2.30 → 0.2.32

package/README.md

@@ -98,10 +98,20 @@ itself.
   `cache_control: ephemeral` (nothing is marked when the last turn is a
   tool's result), user turns carry their blocks as `contents` too, and each
   request names its conversation in `session_id`. That id is a hash of
-  Codex's thread (`prompt_cache_key`) when magpie sends one, else of the
-  conversation's start, so every turn of one conversation names the same
-  session; the key itself never goes out. Each request has its own
-  `request_id`.
+  the session the agent names (since 0.2.31, #330: DSH's
+  `x-deepseek-harness-session-id` and the other agents' own session
+  headers, which magpie hands the plugin's `chat.headers` hook, and
+  OpenCode's session), else of Codex's thread (`prompt_cache_key`) when
+  magpie sends one, else of the conversation's start, so every turn of one
+  conversation names the same session; the key itself never goes out.
+  Each request has its own `request_id` and `chat_record_id`.
+- Every call that answers one user prompt goes out as one task, as Qoder's
+  own client sends it (since 0.2.31, #330): one `request_set_id`, which is
+  also `business.id`, and one `business.begin_at` for every call of the
+  tool loop, `business.stage` "start" until a call is answered and
+  "processing" after. A new user prompt in the session is a new task. The
+  plugin keeps at most 512 tasks, each for 2 hours after its last call.
+  Before 0.2.31 each call was a task of its own.
   - The model's own configuration from Qoder's list goes with it.
 - It picks the reasoning effort from the model's own levels:
   - The nearest level to the one asked, the higher one on a tie.
@@ -286,6 +296,13 @@ the account's credentials.
 - A helper that is there but can't be read, or gives an invalid identity,
   is `failed` and asked again later, rather than a false "no activity"
   result.
+- With the identity read and sent, a list with no daily claim is
+  `inactive`, with a message (since 0.2.32) saying Qoder offered this
+  device's identity no daily credits campaign, that Qoder decides that per
+  device, and that the credits can be claimed in Qoder desktop when it
+  shows them (#304: a Linux CLI identity was offered none while the same
+  account's desktop identity was). The plugin never sends another
+  device's identity.
 
 Qoder CN (since 0.2.30) sends its own device identity the same way when
 Qoder CN is installed: its desktop 0.4.9 and CLI (`qoderclicn`) both ask

package/index.mjs

@@ -841,12 +841,16 @@ function cacheMarked(msgs) {
 // sessionOf is the session_id a request goes out under: one for every turn
 // of a conversation and another for each conversation, as Qoder's client
 // sends its own session's (#290). Qoder can keep a conversation where its
-// prompt is cached only when its turns say they are one. It is the
-// client's prompt_cache_key (Codex's thread), else its user, else the
+// prompt is cached only when its turns say they are one. It is the session
+// the agent named (named: DSH's x-deepseek-harness-session-id, OpenCode's
+// session, as the chat.headers hook is told it, #330), else the client's
+// prompt_cache_key (Codex's thread), else its user, else the
 // conversation's opening (its system prompt and first user turn), hashed,
-// so no key of the client's goes to Qoder as it is.
-function sessionOf(chat) {
-  let seed = String(chat.prompt_cache_key ?? "").trim() ? "key\0" + chat.prompt_cache_key : String(chat.user ?? "").trim() ? "user\0" + chat.user : ""
+// so no key of the client's goes to Qoder as it is. DSH changes its system
+// prompt mid-task (yetone/magpie#3298), so its own session is the one that
+// holds for the whole task.
+function sessionOf(chat, named = "") {
+  let seed = named ? "session\0" + named : String(chat.prompt_cache_key ?? "").trim() ? "key\0" + chat.prompt_cache_key : String(chat.user ?? "").trim() ? "user\0" + chat.user : ""
   if (!seed) {
     const msgs = chat.messages ?? []
     const sys = msgs.filter((x) => x.role === "system" || x.role === "developer").map((x) => textOf(x.content))
@@ -857,9 +861,62 @@ function sessionOf(chat) {
   return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`
 }
 
+// SESSION carries the session magpie (or OpenCode) names a request's
+// conversation by, from the chat.headers hook to the loader's fetch. It
+// goes no further: nothing of the request's headers is sent to Qoder.
+const SESSION = "x-magpie-qoder-session"
+
+// namedSession is the session a chat.headers hook is told, "" when it
+// names none. magpie, with no session header from the agent, makes one of
+// the conversation's first user message ("magpie-" and 24 hex digits):
+// that names no session, and sessionOf's own hash is taken instead.
+function namedSession(input) {
+  const s = String(input?.sessionID ?? "").trim()
+  if (!s || /^magpie-[0-9a-f]{24}$/.test(s)) return ""
+  return s.slice(0, 128)
+}
+
+// A task is what Qoder's client sends under one request_set_id and one
+// business record (#330): every model call that answers one user prompt,
+// the tool loop's turns included. qoder-agent-sdk (Qoder.app's
+// qoder-worker-runtime, AgentLifecycle) makes the record once per prompt
+// (business.id the prompt's requestSetId, begin_at when the prompt
+// started, stage "start"), keeps it for each call of the loop, and moves
+// stage to "processing" once a call is answered; only request_id and
+// chat_record_id are new on every call. The plugin made a new record for
+// every call, so a 265-call DSH task was 265 tasks to Qoder. A task here is
+// a session's last user turn: the tool loop repeats it, and a new prompt
+// is a new one. TASKS holds at most TASK_MAX of them, each for TASK_IDLE
+// after its last call, so a long-running magpie doesn't grow with them.
+const TASKS = new Map()
+const TASK_MAX = 512
+const TASK_IDLE = 2 * 60 * 60 * 1000
+
+// taskOf is the task chat's call belongs to, in session sid: made on its
+// first call, the same one on every call after.
+function taskOf(sid, chat, now = Date.now()) {
+  const msgs = chat.messages ?? []
+  const at = msgs.findLastIndex((x) => x?.role === "user")
+  const key = createHash("sha256").update(JSON.stringify([sid, at, at < 0 ? null : msgs[at].content ?? null])).digest("hex")
+  for (const [k, t] of TASKS) {
+    if (now - t.used <= TASK_IDLE) break
+    TASKS.delete(k)
+  }
+  let t = TASKS.get(key)
+  if (t && now - t.used > TASK_IDLE) t = undefined
+  TASKS.delete(key)
+  t ??= { id: randomUUID(), begin: now, answered: false }
+  t.used = now
+  TASKS.set(key, t)
+  while (TASKS.size > TASK_MAX) TASKS.delete(TASKS.keys().next().value)
+  return t
+}
+
 // qoderBody is the plaintext agent_chat_generation takes for a chat
-// completion request, for model m.
-function qoderBody(chat, m) {
+// completion request, for model m, in the session the agent named (named,
+// "" when none) and the task it is a call of (taskOf's, a new one when
+// none is given).
+function qoderBody(chat, m, named = "", task) {
   const system = (chat.messages ?? []).filter((x) => x.role === "system" || x.role === "developer").map((x) => textOf(x.content)).filter(Boolean).join("\n\n")
   const tools = chat.tool_choice !== "none" ? (chat.tools ?? []).filter((t) => t?.type === "function" && t.function?.name) : []
   let sysText = system ? QODER_SYS + "\n\n" + system : QODER_SYS
@@ -871,13 +928,15 @@ function qoderBody(chat, m) {
   const window = windowFor(chat, m, params.max_tokens)
   if (window > 0) params.context_length = window
   const request = randomUUID()
+  const session = sessionOf(chat, named)
+  task ??= taskOf(session, chat)
   const body = {
     request_id: request,
-    request_set_id: request,
+    request_set_id: task.id,
     chat_record_id: request,
-    session_id: sessionOf(chat),
+    session_id: session,
     parameters: params,
-    business: { product: "app", version: COSY_VERSION, type: "agent", id: hexID(), name: "magpie session", begin_at: Date.now(), stage: "start" },
+    business: { product: "app", version: COSY_VERSION, type: "agent", id: task.id, name: "magpie session", begin_at: task.begin, stage: task.answered ? "processing" : "start" },
     agent_id: "agent_common",
     task_id: "common",
     session_type: "app",
@@ -1596,6 +1655,12 @@ class RuntimeMissing extends Error {
   }
 }
 
+// noCampaign is why a check-in asked with this machine's own device
+// identity found nothing to claim: all the list says is that it offered
+// that identity no daily credits, not why.
+const noCampaign = (name) =>
+  `${name} check-in: ${name} offered this device's identity, read from this machine's own ${name} runtime-info, no daily credits campaign right now. ${name} decides per device whether to offer it; if ${name} desktop shows today's credits, claim them there`
+
 // Read the SDK identity as Qoder does: environment 3 is international, 0
 // Qoder CN; on Windows and macOS the uid goes over stdin, never into the
 // command line.
@@ -2035,7 +2100,11 @@ const makePlugin = (site) => async ({ client }) => {
         // (no Qoder CN on this machine) or ask again (it didn't answer).
         if (unread instanceof RuntimeMissing) return { outcome: "ineligible", message: unread.message }
         if (unread) return { outcome: "failed", message: unread.message }
-        return { outcome: "inactive" }
+        // Asked with this machine's own identity and still offered nothing:
+        // Qoder decides per device (plugins#304, a Linux CLI identity was
+        // offered none while the same account's desktop identity was), so
+        // say that much, and where the credits can still be claimed.
+        return { outcome: "inactive", message: noCampaign(site.name) }
       }
       const claimRes = await call(base.replace(/\/$/, "") + "/" + encodeURIComponent(campaign.campaignId) + "/claim", "POST", "{}")
       let claim = {}
@@ -2069,7 +2138,7 @@ const makePlugin = (site) => async ({ client }) => {
     })
 
   // ask is the answer to a chat completion on the live account cred.
-  const ask = async (chat, cred, init) => {
+  const ask = async (chat, cred, init, named = "") => {
     let m
     try {
       m = (await models(cred)).find((x) => x.key === chat.model) ?? (await models(cred, true)).find((x) => x.key === chat.model)
@@ -2080,7 +2149,8 @@ const makePlugin = (site) => async ({ client }) => {
     if (!m) return errorResponse({ status: 400, message: `unknown or disabled model "${chat.model}"` })
     const api = siteOf(site, cred).api
     const CHAT_URL = api + CHAT_PATH
-    const body = qoderBody(chat, m)
+    const task = taskOf(sessionOf(chat, named), chat)
+    const body = qoderBody(chat, m, named, task)
     const wire = encodeBody(JSON.stringify(body))
     // Qoder's queue is waited out (queueWait) and the same request, its
     // request_set_id the one the queue knows, sent again
@@ -2102,6 +2172,8 @@ const makePlugin = (site) => async ({ client }) => {
         return errorResponse({ status: 502, message: e.message })
       }
       const f = !res.ok ? failure(res.status, (await res.text()).slice(0, 1 << 20)) : open.first.value?.error
+      // an answered call moves its task on, as Qoder's client moves it
+      if (!f) task.answered = true
       if (!f?.queue || waited >= QUEUE.recoveries) return f && !res.ok ? errorResponse(f) : answer(open, chat)
       try {
         if (!(await queueWait(api, cred, ask, f.queue, init.signal, deadline))) return errorResponse(f)
@@ -2112,6 +2184,16 @@ const makePlugin = (site) => async ({ client }) => {
   }
 
   return {
+    // the session the request is part of, for session_id and its task
+    // (#330): magpie names it here (DSH's x-deepseek-harness-session-id
+    // among the agents' own), as OpenCode does, and the loader's fetch
+    // reads it back. Every plugin's hook sees every provider's requests,
+    // so it is put on this site's alone.
+    async "chat.headers"(input, output) {
+      if (input?.model?.providerID !== ID && input?.provider?.info?.id !== ID) return
+      const s = namedSession(input)
+      if (s) output.headers[SESSION] = s
+    },
     auth: {
       provider: ID,
       // magpie renews the chat token RENEW_LEAD before its end, once for
@@ -2164,7 +2246,9 @@ const makePlugin = (site) => async ({ client }) => {
             } catch (e) {
               return signedInError(e)
             }
-            return signed(await ask(chat, cred, init), renewed(cred))
+            const h = new Headers(input instanceof Request ? input.headers : undefined)
+            new Headers(init.headers ?? {}).forEach((v, k) => h.set(k, v))
+            return signed(await ask(chat, cred, init, h.get(SESSION)?.trim().slice(0, 128) ?? ""), renewed(cred))
           },
         }
       },
@@ -2274,4 +2358,4 @@ export const QoderAuthPlugin = makePlugin(SITES.qoder)
 export const QoderCNAuthPlugin = makePlugin(SITES["qoder-cn"])
 
 // for tests
-export const _internal = { campaignRuntime, RUNTIMES, campaignPage, campaignTarget, vpcInstance, vpcSite, parseUsage, gfmt, when, failure, modelInfo, qoderBody, qoderMessages, cacheMarked, sessionOf, SITES, decodeBody, events, QUEUE, queueState }
+export const _internal = { campaignRuntime, RUNTIMES, campaignPage, campaignTarget, vpcInstance, vpcSite, parseUsage, gfmt, when, failure, modelInfo, qoderBody, qoderMessages, cacheMarked, sessionOf, namedSession, taskOf, TASKS, TASK_MAX, TASK_IDLE, SESSION, SITES, decodeBody, events, QUEUE, queueState }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-qoder-auth",
-  "version": "0.2.30",
+  "version": "0.2.32",
   "description": "Qoder subscriptions in OpenCode and magpie: Qoder (qoder.com) and Qoder CN (qoder.cn)",
   "type": "module",
   "main": "./index.mjs",