@magpie-community/opencode-trae-auth 0.2.15 → 0.2.17

package/README.md

@@ -42,9 +42,11 @@ An account of one realm does not sign in to the other: trae.cn's accounts are
 not trae.ai's.
 
 At sign-in the plugin creates the account's device and names it to the
-authorization page: `device_id` (19 digits) and `machine_id` (32 hex). Every
+authorization page: `device_id` and `machine_id` (32 hex). Every
 request then sends that same device. The relays saw requests dropped when the
-device was new each time.
+device was new each time. A Trae CN `device_id` is 16 digits since 0.2.16, the
+shape of the ids Trae's device service gives its clients (15 or 16 digits);
+Trae Global's stays 19.
 
 ### Enterprise (SaaS) accounts
 
@@ -279,7 +281,11 @@ an empty answer.
 
 Trae CN gives credits for a daily check-in (每日签到); Trae Global has no
 such page, so this is CN only. magpie can press it
-once a day for each account (Settings, or the switch on the usage card).
+once a day for each account (Settings, or the switch on the usage card),
+through `auth.checkin`: `claimed` when Trae grants the credits, `done`
+when the status or Trae's 9095 says this device has already claimed,
+`inactive` when the page is disabled, and `failed` for a turned-away
+sign-in or Trae's 9074 busy answer.
 It asks Trae CN's own pages through
 this plugin's fetch, which sends them as the account, as Trae CN's IDE
 (3.3.104) sends them: its Cloud-IDE-JWT (renewed first when near its
@@ -314,11 +320,20 @@ answered it 9074 even with the client's headers.
   macOS `~/Library/Application Support/Trae CN/…`, Windows
   `%APPDATA%\Trae CN\…` (or `trae-cn`), Linux `~/.config/trae-cn/…`
   (or `Trae CN`; not seen on a real Linux install).
+- **Every other account's device (0.2.16):** its own device id, in the
+  client's shape. Trae CN answered a claim on the plugin's 19-digit id
+  9074, while the same account and token on a 16-digit id were taken
+  (magpie-community/plugins#194). An account signed in since 0.2.16 has a
+  16-digit id and checks in on it. One signed in before checks in on a
+  16-digit id made from its own device id and uid: the same id every day,
+  never rotated, and no other account's. Its chat requests and renewals
+  keep the 19-digit device it signed in with.
 - **What comes back:** Trae's answer as it is. A 401 or code 1001 marks
   the account for a new sign-in. Code 9095 means this device has checked
-  in today. No device id is ever made up, changed or rotated to get round
-  a 9095 or a 9074, and no account is given a device that isn't its
-  own client's.
+  in today, and that holds for the day. No device id is ever changed or
+  rotated to get round a 9095 or a 9074, and no account is given another
+  account's device or its own client's device unless the client is signed
+  in as that account.
 
 Only `api.trae.cn`'s `/trae/api/` pages are sent this way; any other URL
 that isn't a chat request is still refused (400). Needs 0.1.4 or later.

package/index.mjs

@@ -113,6 +113,10 @@ const SITES = {
     // Trae CN's account info carries no region: its one deployment is the
     // one it is asked through
     regionOf: () => "",
+    checkin: {
+      status: { path: "/trae/api/v2/ug/checkin_credits/status" },
+      claim: { path: "/trae/api/v2/ug/checkin_credits/claim" },
+    },
     // where usage is asked, and which page it is (CN: credits)
     usage: {
       kind: "credits",
@@ -296,8 +300,32 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
 
 // device is the machine an account signs in from, made once at sign-in and
 // named to trae.cn's authorization page, then sent with every request: a
-// fresh one each time is what the relays saw requests dropped for.
-const newDevice = () => ({ deviceId: digits(19), machineId: randomBytes(16).toString("hex"), ...newDeviceKey() })
+// fresh one each time is what the relays saw requests dropped for. Trae
+// CN's id has the shape its clients' have, 16 digits: the device service
+// gives the IDE a 15- or 16-digit one (iCubeAuthInfo://icube-dc:<id>, see
+// clientDevice), and Trae CN answers a check-in claim on a 19-digit id
+// 9074 where the same account and token on a 16-digit one are taken
+// (magpie-community/plugins#194). Trae's global site keeps the 19 digits
+// it was signed in with: nothing says its ids are shaped otherwise.
+const newDevice = (site) => ({ deviceId: digits(site?.id === "trae-cn" ? 16 : 19), machineId: randomBytes(16).toString("hex"), ...newDeviceKey() })
+
+// ugDevice is the device id a Trae CN account's check-in goes on when this
+// machine's client isn't signed in as it: its own when that already has a
+// client's shape (15 or 16 digits), else, for an account signed in before
+// 0.2.16 with 19 digits, a 16-digit id made from its own device id and
+// uid. That one is the same on every check-in of the account, never
+// rotated and never another account's: it is the account's own device in
+// the shape Trae CN takes (#194), not a new device to get past a refusal,
+// and a 9095 (this device is in for today) on it stays the day's answer.
+// The chat's pages and the renewal keep the device the account signed in
+// with.
+function ugDevice(a) {
+  const id = String(a.deviceId ?? "")
+  if (/^\d{15,16}$/.test(id)) return id
+  if (!id && !a.uid) return id
+  const n = BigInt("0x" + createHash("sha256").update(`trae-cn-device\0${id}\0${a.uid ?? ""}`).digest("hex").slice(0, 30))
+  return String(1_000_000_000_000_000n + (n % 9_000_000_000_000_000n))
+}
 
 // newDeviceKey is the device's key pair, an ECDSA P-256 one as the clients
 // keep (iCubeAuthInfo://icube-dc:<device>), whose public half goes with a
@@ -627,7 +655,7 @@ async function signedIn(q, device, site) {
 // browserSignIn is the IDE's sign-in: trae.cn's authorization page, back
 // to a callback on 127.0.0.1 (the page takes no other kind)
 async function browserSignIn(site) {
-  const device = newDevice()
+  const device = newDevice(site)
   const trace = randomUUID()
   let over = false
   let settle
@@ -2491,6 +2519,9 @@ const makePlugin = (site) => async ({ client }) => {
     // other account keeps its own device; none is given the client's.
     const deviceId = ug && site.id === "trae-cn" ? await clientDevice(a.uid) : undefined
     const own = deviceId ? { deviceId, ...thisMachine() } : undefined
+    // every other Trae CN account checks in on its own device, in the
+    // client's shape (ugDevice, #194)
+    if (ug && site.id === "trae-cn" && !own) a = { ...a, deviceId: ugDevice(a) }
     const res = await fetch(url, {
       method,
       headers: ug ? ugHeaders(a, site, { Accept: "application/json" }, own) : ideHeaders(a, site, { Accept: "application/json" }),
@@ -2503,6 +2534,39 @@ const makePlugin = (site) => async ({ client }) => {
     return new Response(text, { status: res.status, headers })
   }
 
+  // checkin asks Trae CN's own pages as magpie's check-in host does, with
+  // the same account, device and renewal as any own page. Trae Global has
+  // no such page.
+  const checkin = async (getAuth) => {
+    if (!site.checkin) return { outcome: "inactive", message: `${site.realm} has no daily check-in` }
+    const a0 = fromAuth(await getAuth(), site)
+    if (!a0) return { outcome: "failed", message: "not signed in" }
+    const base = site.hosts.auth + site.checkin.status.path
+    const status = await ownRequest(getAuth, a0, base, "POST", "{}")
+    const statusText = await status.text()
+    let body
+    try { body = JSON.parse(statusText) } catch {}
+    if (!body || typeof body !== "object" || Array.isArray(body)) return { outcome: "failed", message: `check-in status: unreadable reply ${statusText.trim().slice(0, 120) || "(empty)"}` }
+    const e = errorOf(body)
+    if (status.status === 401 || lapsedCode(e.code, site)) return { outcome: "failed", message: e.message || `${a0.name || a0.uid}: Trae's sign-in has expired` }
+    if (status.status !== 200 || (e.code && String(e.code) !== "0")) return { outcome: "failed", message: e.message || statusLine(status.status) }
+    if (body?.checked_in) return { outcome: "done", ...(Number(body.credits) > 0 ? { credit: Number(body.credits) } : {}) }
+    if (!body?.enable) return { outcome: "inactive" }
+    const claim = await ownRequest(getAuth, a0, site.hosts.auth + site.checkin.claim.path, "POST", "{}")
+    const claimText = await claim.text()
+    let answer
+    try { answer = JSON.parse(claimText) } catch {}
+    const ce = errorOf(answer)
+    if (claim.status === 401 || lapsedCode(ce.code, site)) return { outcome: "failed", message: ce.message || `${a0.name || a0.uid}: Trae's sign-in has expired` }
+    if (String(ce.code) === "9095") return { outcome: "ineligible", message: ce.message || "this device has checked in today" }
+    if (String(ce.code) === "9074") return { outcome: "ineligible", message: `${ce.message} — check in in the Trae CN app` }
+    if (claim.status !== 200 || (ce.code && String(ce.code) !== "0")) return { outcome: "failed", message: ce.message || statusLine(claim.status) }
+    if (!answer || typeof answer !== "object" || Array.isArray(answer)) return { outcome: "failed", message: `check-in claim: unreadable reply ${claimText.trim().slice(0, 120) || "(empty)"}` }
+    const credit = Number(answer.credits) + Number(answer.extra_credits || 0)
+    const fallback = Number(body.credits) + Number(body.extra_credits || 0)
+    return { outcome: "claimed", ...(credit > 0 ? { credit } : fallback > 0 ? { credit: fallback } : {}) }
+  }
+
   const usage = async (getAuth) => {
     let a
     try {
@@ -2746,6 +2810,7 @@ const makePlugin = (site) => async ({ client }) => {
     auth: {
       provider: site.id,
       usage,
+      checkin,
       // magpie renews the token LEAD_MS before its end, once, before its
       // requests, models and usage ask; the check before each request
       // stays for OpenCode, which doesn't call this
@@ -2861,4 +2926,4 @@ const makePlugin = (site) => async ({ client }) => {
 export const TraeCNAuthPlugin = makePlugin(SITES["trae-cn"])
 export const TraeGlobalAuthPlugin = makePlugin(SITES["trae-global"])
 
-export const _internal = { ownClient, clientStoragePaths, clientDevice, clientDecode, thisMachine, traeHost, accountOf, HOSTS: SITES["trae-cn"].hosts, MODELS: SITES["trae-cn"].models, TextTools, NativeCalls, looseJSON, glmCall, nameCall, toolNamed, unwrapped, traeMessages, chatBody, credits, dollarUsageOf, whenOf, newDevice, proofOf, SITES, SESSION, conversationID }
+export const _internal = { ownClient, clientStoragePaths, clientDevice, clientDecode, thisMachine, traeHost, accountOf, HOSTS: SITES["trae-cn"].hosts, MODELS: SITES["trae-cn"].models, TextTools, NativeCalls, looseJSON, glmCall, nameCall, toolNamed, unwrapped, traeMessages, chatBody, credits, dollarUsageOf, whenOf, newDevice, ugDevice, proofOf, SITES, SESSION, conversationID }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-trae-auth",
-  "version": "0.2.15",
+  "version": "0.2.17",
   "description": "OpenCode provider plugins for Trae: Trae CN (trae.cn) and Trae Global (trae.ai), free tier included, with Trae's own browser sign-in",
   "type": "module",
   "main": "./index.mjs",