@magpie-community/opencode-qoder-auth 0.2.8 → 0.2.10

package/README.md

@@ -186,12 +186,35 @@ The hosts and reply shapes come from a real VPC account's report
 
 Qoder gives credits for a daily claim (the Qoder client's campaign
 `CLAIM_BENEFIT`, 100 Credits a day as reported), on both sites. magpie can
-press it once a day for each account when its Qoder check-in switch is on
+claim it for each account when its Qoder check-in switch is on
 (Settings). It asks these pages through this plugin's fetch (since 0.2.7),
 which sends them as the account, on the device token (`Bearer`,
 `Cosy-ClientType: 10`) as usage is read; a refused device token is
 rotated once and the page asked again.
 
+International campaigns also need Qoder's native device identity:
+`Cosy-MachineToken` and `Cosy-MachineType`. Without them, the server can
+return HTTP 200 but omit the daily claim. The plugin reads them from
+Qoder's own `runtime-info` helper for the signed-in uid, sharing an
+in-flight read and caching it in memory for an hour. The same identity
+goes on the list, the claim and a device-token retry; it is not saved in
+the account's credentials.
+
+- Install Qoder desktop, or sign in to Qoder CLI once, to make its native
+  runtime available. The plugin finds the desktop's `resources/umid`
+  (`Qoder.app` on macOS, `%LOCALAPPDATA%\Programs\Qoder` on Windows,
+  `/opt/Qoder` on Linux) or the runtime the CLI caches in `~/.qoder/.bin`
+  (`runtime-info-<platform>-<arch>-*` on macOS and Linux,
+  `umid-win32-x64-*\runtime-info.exe` on Windows; `QODER_CONFIG_DIR`,
+  `QODER_CLI_HOME` and `QODER_CONFIG_DIR_NAME` move it as they move the
+  CLI's folder).
+- For another installation location, set `QODER_RUNTIME_INFO` to the
+  absolute path of Qoder's installed `runtime-info` executable
+  (`runtime-info.exe` on Windows), with its accompanying SDK files.
+- A missing helper or invalid identity is an error, rather than a false
+  "no activity" result. Qoder CN keeps its existing requests and does
+  not need this local helper.
+
 - **List:** `GET <openapi>/sash/api/v1/me/campaigns`: `campaigns[]` with
   `campaignId`, `actionType`, `claimStatus` (`CLAIMABLE`, `CLAIMED`),
   `startAt`, `endAt`, `benefit.amount`.
@@ -201,7 +224,11 @@ rotated once and the page asked again.
   (Qoder CN). Other pages on those hosts are still refused.
 
 Taken from [wallechfox/qoder-checkin](https://github.com/wallechfox/qoder-checkin),
-which a user reports works. Not yet tried here with a real Qoder account.
+which a user reports works, and Qoder desktop 0.4.3's campaign requests.
+International campaign discovery was checked with a real account on
+2026-10-08: the native identity exposed the claimable 100 credits, and
+omitting either header hid them. This verification only queried the
+activity; a live claim was not performed.
 
 ## Not here
 

package/index.mjs

@@ -35,7 +35,11 @@
 // <instance>-gateway.vpc.qoder.com.cn. The instance is kept on the account,
 // and an account with none is served as before.
 import { createCipheriv, createHash, publicEncrypt, randomBytes, randomUUID, constants } from "node:crypto"
+import { execFile } from "node:child_process"
+import { readdir, stat } from "node:fs/promises"
 import { STATUS_CODES } from "node:http"
+import { homedir } from "node:os"
+import { join, resolve } from "node:path"
 
 const CHAT_PATH = "/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1"
 const MODELS_PATH = "/algo/api/v2/model/list?Encode=1"
@@ -1028,6 +1032,81 @@ async function fetchUsage(site, deviceToken) {
 // credits among them (actionType CLAIM_BENEFIT) — and claims one
 // (POST …/{id}/claim), as Qoder's client does, on the device token.
 const CAMPAIGNS = "/sash/api/v1/me/campaigns"
+const CAMPAIGN_MACHINE_TTL = 60 * 60 * 1000 // Qoder's desktop client renews its native identity hourly
+
+// campaignRuntime uses Qoder's own native device identity helper, installed
+// by its desktop client or cached by its CLI. A made-up token (including the
+// chat envelope's machine id and type 5) doesn't reveal international claims.
+//
+// Where each one keeps it (Qoder desktop 0.4.3's packages, qodercli 1.1.66):
+//   - desktop: <install>/resources/umid/runtime-info(.exe): Qoder.app on
+//     macOS, %LOCALAPPDATA%\Programs\Qoder (the user installer) on Windows,
+//     /opt/Qoder (the .deb and the .rpm) on Linux;
+//   - CLI: <config>/.bin, where <config> is QODER_CONFIG_DIR, else
+//     QODER_CLI_HOME (or the home folder) joined with QODER_CONFIG_DIR_NAME
+//     (or .qoder): a file runtime-info-<platform>-<arch>-<hash> on macOS and
+//     Linux, a folder umid-win32-<arch>-<hash> holding runtime-info.exe on
+//     Windows.
+async function campaignRuntime({ home = homedir(), platform = process.platform, arch = process.arch, env = process.env, opt = "/opt" } = {}) {
+  if (env.QODER_RUNTIME_INFO) return resolve(env.QODER_RUNTIME_INFO)
+  const name = platform === "win32" ? "runtime-info.exe" : "runtime-info"
+  const isFile = async (path) => (await stat(path).catch(() => null))?.isFile() ?? false
+  const paths = []
+  if (platform === "win32") {
+    const local = env.LOCALAPPDATA || join(home, "AppData", "Local")
+    paths.push(join(local, "Programs", "Qoder", "resources", "umid", name))
+  } else if (platform === "darwin") {
+    for (const dir of ["/Applications", join(home, "Applications")]) paths.push(join(dir, "Qoder.app", "Contents", "Resources", "umid", name))
+  } else if (platform === "linux") {
+    paths.push(join(opt, "Qoder", "resources", "umid", name))
+  }
+  for (const path of paths) if (await isFile(path)) return path
+  const config = env.QODER_CONFIG_DIR || join(env.QODER_CLI_HOME || env.GEMINI_CLI_HOME || home, env.QODER_CONFIG_DIR_NAME || ".qoder")
+  const cache = join(config, ".bin")
+  const entries = await readdir(cache, { withFileTypes: true }).catch(() => [])
+  const found = []
+  for (const d of entries) {
+    let path
+    if (platform === "win32") {
+      if (d.isDirectory() && d.name.startsWith(`umid-win32-${arch}-`)) path = join(cache, d.name, name)
+    } else if (d.isFile() && d.name.startsWith(`runtime-info-${platform}-${arch}-`) && !d.name.endsWith(".tmp")) {
+      path = join(cache, d.name)
+    }
+    if (path && (await isFile(path))) found.push({ path, time: (await stat(path)).mtimeMs })
+  }
+  if (found.length) return found.sort((a, b) => b.time - a.time)[0].path
+  throw new Error("Qoder check-in: device identity runtime not found; install Qoder desktop or sign in to Qoder CLI once, or set QODER_RUNTIME_INFO to its runtime-info executable")
+}
+
+// Read the SDK identity as Qoder does: environment 3 is international; on
+// Windows and macOS the uid goes over stdin, never into the command line.
+async function campaignMachine(uid) {
+  if (!uid) throw new Error("Qoder check-in: device identity needs the account uid; sign in again")
+  const file = await campaignRuntime()
+  const args = process.platform === "linux" ? ["3"] : ["3", "--account-stdin"]
+  const text = await new Promise((resolve, reject) => {
+    const child = execFile(file, args, { timeout: 20_000, windowsHide: true, maxBuffer: 1 << 20 }, (err, out) => {
+      if (err) reject(err)
+      else resolve(out)
+    })
+    child.stdin?.on("error", () => {})
+    child.stdin?.end(process.platform === "linux" ? undefined : JSON.stringify({ account: uid }) + "\n")
+  }).catch(() => {
+    throw new Error("Qoder check-in: could not read device identity; restart or update Qoder, or check QODER_RUNTIME_INFO")
+  })
+  try {
+    const identity = JSON.parse(text.trim().split(/\r?\n/, 1)[0])
+    const headers = {}
+    for (const [key, field] of [["Cosy-MachineToken", "machineToken"], ["Cosy-MachineType", "machineType"]]) {
+      const value = identity?.[field]?.trim()
+      if (!value || value.length > 4096 || !/^[\x20-\x7e]+$/.test(value)) throw new Error("invalid identity")
+      headers[key] = value
+    }
+    return headers
+  } catch {
+    throw new Error("Qoder check-in: invalid device identity from Qoder; restart or update Qoder")
+  }
+}
 
 // campaignPage: url is the site's campaigns page or a claim under it, which
 // the account's fetch sends as the account rather than as a chat.
@@ -1057,10 +1136,10 @@ function campaignTarget(base, s, url) {
 
 // campaignCall is url asked with the device token; Qoder's answer comes back
 // as it is.
-async function campaignCall(url, method, body, deviceToken, signal) {
+async function campaignCall(url, method, body, deviceToken, machine, signal) {
   return fetch(url, {
     method,
-    headers: { Accept: "application/json", "Content-Type": "application/json", Authorization: `Bearer ${deviceToken}`, "Cosy-ClientType": "10", "User-Agent": "Qoder" },
+    headers: { Accept: "application/json", "Content-Type": "application/json", Authorization: `Bearer ${deviceToken}`, "Cosy-ClientType": "10", "User-Agent": "Qoder", ...machine },
     body: method === "GET" ? undefined : body || "{}",
     signal: signal ?? AbortSignal.timeout(20_000),
   })
@@ -1175,6 +1254,23 @@ const SITES = {
 
 const makePlugin = (site) => async ({ client }) => {
   const ID = site.id
+  // The SDK identity is account-specific. Share an in-flight read, refresh
+  // after an hour, and leave a failed read available for the next attempt.
+  const campaignMachines = new Map()
+  const machineForCampaign = async (uid) => {
+    const now = Date.now()
+    let entry = campaignMachines.get(uid)
+    if (!entry || now - entry.at >= CAMPAIGN_MACHINE_TTL) {
+      entry = { at: now, promise: campaignMachine(uid) }
+      campaignMachines.set(uid, entry)
+    }
+    try {
+      return await entry.promise
+    } catch (e) {
+      if (campaignMachines.get(uid) === entry) campaignMachines.delete(uid)
+      throw e
+    }
+  }
   // serializes checking, rotating and saving tokens: a refresh token is
   // spent once, so two refreshes would spend it twice
   let lock = Promise.resolve()
@@ -1305,8 +1401,9 @@ const makePlugin = (site) => async ({ client }) => {
     if (!url) return errorResponse({ status: 404, message: "only chat completions are served" })
     const method = String(init.method ?? input?.method ?? "GET").toUpperCase()
     try {
-      let res = await campaignCall(url, method, body, cred.deviceToken, init.signal)
-      if (res.status === 401 || res.status === 403) res = await campaignCall(url, method, body, await deviceToken(getAuth, cred.deviceToken), init.signal)
+      const machine = site.id === "qoder" ? await machineForCampaign(cred.uid) : {}
+      let res = await campaignCall(url, method, body, cred.deviceToken, machine, init.signal)
+      if (res.status === 401 || res.status === 403) res = await campaignCall(url, method, body, await deviceToken(getAuth, cred.deviceToken), machine, init.signal)
       return signed(res, renewed(cred))
     } catch (e) {
       if (e?.expired) return signedInError(e)
@@ -1482,4 +1579,4 @@ export const QoderAuthPlugin = makePlugin(SITES.qoder)
 export const QoderCNAuthPlugin = makePlugin(SITES["qoder-cn"])
 
 // for tests
-export const _internal = { campaignPage, campaignTarget, vpcInstance, vpcSite, parseUsage, gfmt, when, failure, modelInfo, qoderBody, SITES, decodeBody, events }
+export const _internal = { campaignRuntime, campaignPage, campaignTarget, vpcInstance, vpcSite, parseUsage, gfmt, when, failure, modelInfo, qoderBody, SITES, decodeBody, events }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-qoder-auth",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Qoder subscriptions in OpenCode and magpie: Qoder (qoder.com) and Qoder CN (qoder.cn)",
   "type": "module",
   "main": "./index.mjs",