@magpie-community/opencode-trae-auth 0.2.8 → 0.2.10

package/README.md

@@ -46,6 +46,23 @@ authorization page: `device_id` (19 digits) and `machine_id` (32 hex). Every
 request then sends that same device. The relays saw requests dropped when the
 device was new each time.
 
+### Enterprise (SaaS) accounts
+
+Since 0.2.10 the authorization page also offers Trae's enterprise (SaaS / SSO)
+sign-in; before, the plugin asked the page to hide it (`hide_saas_login`), so
+an enterprise subscription could only sign in as a personal account. A host
+the sign-in names for the account is kept when it is an https host on Trae's
+own domains (`trae.cn`, `trae.ai`, `mchost.guru`): a model host other than the
+consumer site's own (`www`, `api`, `grow…`) takes the account's model
+requests, and a token host the callback names (`authHost`) takes its
+renewals. Any other host is ignored and the consumer hosts are used, as for a
+personal account, which is unchanged. The account's tenant and login-type
+fields are kept with the sign-in; nothing sends them.
+
+**Not tried with a real enterprise account.** Which hosts and fields an
+enterprise sign-in sends back is not known yet; if yours doesn't work, open an
+issue with what the sign-in page showed.
+
 ### The international realm's region
 
 Trae Global has two deployments. The sign-in's `AIRegion` (or a US auth host

package/index.mjs

@@ -79,11 +79,19 @@ const SITES = {
     // the model host for an account: Trae CN's own hosts serve no models,
     // so only a host that is one is taken, else the one gateway
     apiOf: (a) => {
-      const h = String(a?.api ?? "").replace(/\/+$/, "")
-      return /mchost\.guru|trae-api-/i.test(h) ? h : SITES["trae-cn"].hosts.api
+      const h = traeHost(a?.api)
+      return h && SITES["trae-cn"].modelHost(h) ? h : SITES["trae-cn"].hosts.api
+    },
+    // whether a host named by a sign-in is one of the model hosts: an https
+    // host on mchost.guru or named trae-api-…, as the consumer gateway is,
+    // or another trae.cn host than the consumer site's own (www, api,
+    // grow…), which an enterprise (SaaS) sign-in may name for its tenant
+    modelHost: (h) => {
+      const t = traeHost(h)
+      if (!t) return false
+      const n = new URL(t).hostname
+      return /(^|\.)mchost\.guru$|^trae-api-/i.test(n) || (/\.trae\.cn$/i.test(n) && !/^(www|api|grow[^.]*)\./i.test(n))
     },
-    // whether a host named by a sign-in is one of the model hosts
-    modelHost: (h) => /mchost\.guru|trae-api-/i.test(String(h ?? "")),
     // ownPage: url is one of Trae CN's own JSON pages on api.trae.cn
     // (/trae/api/…: the daily check-in, credits), which the account's fetch
     // sends as the account rather than as a chat
@@ -166,15 +174,22 @@ const SITES = {
     // the model host: the account's region (or a US host the sign-in named)
     // selects the US deployment, else the SG one
     apiOf: (a) => {
-      const h = String(a?.api ?? "").replace(/\/+$/, "")
+      const h = traeHost(a?.api)
+      const n = h ? new URL(h).hostname : ""
       const region = String(a?.region ?? "").toUpperCase()
-      if (/coreva/i.test(h) || /api-us(?:[-.]|$)/i.test(h) || /^US(?:[-_ ]|$)/.test(region)) return SITES["trae-global"].hosts.us
-      if (/coresg/i.test(h)) return h
+      if (/coreva/i.test(n) || /api-us(?:[-.]|$)/i.test(n) || /^US(?:[-_ ]|$)/.test(region)) return SITES["trae-global"].hosts.us
+      if (/coresg/i.test(n)) return h
+      // another trae.ai host than the site's own (www, api-…, grow…): one an
+      // enterprise (SaaS) sign-in named for its tenant
+      if (/\.trae\.ai$/i.test(n) && !/^(www\.|api[-.]|grow)/i.test(n)) return h
       return SITES["trae-global"].hosts.api
     },
     // a sign-in names a host of Trae's, which can be an auth host
     // (api-us-east), not the chat host
-    modelHost: (h) => /trae\.ai/i.test(String(h ?? "")),
+    modelHost: (h) => {
+      const t = traeHost(h)
+      return !!t && /(^|\.)trae\.ai$/i.test(new URL(t).hostname)
+    },
     // Trae Global serves no own JSON pages through the account's fetch
     ownPage: () => false,
     // the account's region, from the sign-in's user info
@@ -213,6 +228,46 @@ const SITES = {
   },
 }
 
+// traeHost is a host a sign-in named, when it is a well-formed https one
+// on Trae's own domains (no port, no credentials), as origin plus any path;
+// "" for anything else, which is then not taken
+const TRAE_DOMAINS = ["trae.cn", "trae.ai", "mchost.guru"]
+function traeHost(h) {
+  try {
+    const u = new URL(String(h ?? "").trim())
+    if (u.protocol !== "https:" || u.username || u.password || u.port || u.search || u.hash) return ""
+    const n = u.hostname.toLowerCase()
+    if (!TRAE_DOMAINS.some((d) => n === d || n.endsWith("." + d))) return ""
+    return (u.origin + u.pathname).replace(/\/+$/, "")
+  } catch {
+    return ""
+  }
+}
+
+// authHostOf is the host a sign-in named for its tokens, when it named one
+// on the site's own domain (an enterprise's may differ from the consumer
+// one); "" when it named none, and the site's own is used
+function authHostOf(h, site) {
+  const t = traeHost(h)
+  if (!t) return ""
+  const n = new URL(t).hostname
+  return n === site.webHost || n.endsWith("." + site.webHost) ? t : ""
+}
+
+// accountOf keeps the account fields of the sign-in's user info that say
+// what kind of account it is (tenant, enterprise, login type), plain values
+// only and never anything that looks like a secret, for later use; nothing
+// sends them
+function accountOf(info) {
+  const out = {}
+  for (const [k, v] of Object.entries(info ?? {})) {
+    if (!/tenant|enterprise|saas|login|org|team|sso|^ent|usertype|accounttype/i.test(k)) continue
+    if (/token|secret|key|password|cookie|session|jwt/i.test(k)) continue
+    if (v === null || ["string", "number", "boolean"].includes(typeof v)) out[k] = v
+  }
+  return out
+}
+
 const SIGN_IN_TIMEOUT = 10 * 60 * 1000
 const EARLY_MS = 2 * 60 * 1000 // a token this close to its end is renewed before a request
 const LEAD_MS = 10 * 60 * 1000 // and this close, magpie renews it ahead of time (auth.refresh)
@@ -301,6 +356,11 @@ function toAuth(s, site) {
     // the model host the sign-in named, if it named one
     ...(site.modelHost(s.api) ? { api: s.api } : {}),
     ...(s.region ? { region: s.region } : {}),
+    // the host the sign-in named, its own token host if it named one, and
+    // what kind of account it is (an enterprise one's tenant), kept as given
+    ...(traeHost(s.host) ? { host: traeHost(s.host) } : {}),
+    ...(authHostOf(s.authHost, site) ? { authHost: authHostOf(s.authHost, site) } : {}),
+    ...(s.account && Object.keys(s.account).length ? { account: s.account } : {}),
   }
 }
 
@@ -319,6 +379,9 @@ function fromAuth(auth, site) {
     devicePrivateKey: auth.devicePrivateKey || "",
     api: auth.api || "",
     region: site.regionOf(auth),
+    host: auth.host || "",
+    authHost: authHostOf(auth.authHost, site),
+    account: auth.account && typeof auth.account === "object" ? auth.account : {},
   }
 }
 
@@ -405,6 +468,7 @@ async function exchange(refresh, clientId, site, host = site.hosts.auth) {
       name: String(info.ScreenName ?? info.screenName ?? ""),
       api: info.Host ?? "",
       region: site.regionOf(info),
+      account: accountOf(info),
     }
   }
   const e = errorOf(text)
@@ -495,12 +559,14 @@ async function boundExchange(a, site, host = site.hosts.auth) {
 // before 0.2.3 (exchange). A device key made for the account goes with
 // either, so the next renewal signs with the same one.
 async function renewal(a, site) {
-  if (!site.deviceExchange) return exchange(a.refresh, a.clientId, site)
+  // the token host the sign-in named, else the site's
+  const host = authHostOf(a.authHost, site) || site.hosts.auth
+  if (!site.deviceExchange) return exchange(a.refresh, a.clientId, site, host)
   const keys = a.devicePrivateKey && a.devicePublicKey ? {} : newDeviceKey()
   try {
-    return await boundExchange({ ...a, ...keys }, site)
+    return await boundExchange({ ...a, ...keys }, site, host)
   } catch {}
-  return { ...(await exchange(a.refresh, a.clientId, site)), ...keys }
+  return { ...(await exchange(a.refresh, a.clientId, site, host)), ...keys }
 }
 
 // ---- the browser sign-in --------------------------------------------------------
@@ -527,10 +593,15 @@ async function signedIn(q, device, site) {
     name: String(info.ScreenName ?? info.screenName ?? ""),
     api: host,
     region: site.regionOf(info),
+    host,
+    // a token host the callback named, if it named one
+    authHost: authHostOf(q.get("authHost") || q.get("auth_host") || info.AuthHost || info.authHost, site),
+    account: accountOf(info),
   }
+  const authHost = s.authHost || site.hosts.auth
   if (!s.token && s.refresh) {
-    const x = await exchange(s.refresh, s.clientId, site)
-    s = { ...s, ...x, uid: x.uid || s.uid, name: x.name || s.name, api: x.api || s.api, region: x.region || s.region }
+    const x = await exchange(s.refresh, s.clientId, site, authHost)
+    s = { ...s, ...x, uid: x.uid || s.uid, name: x.name || s.name, api: x.api || s.api, region: x.region || s.region, host: s.host || x.api, account: { ...x.account, ...s.account } }
   }
   if (!s.token) throw new Error(`${site.webHost} sent back no token`)
   if (!s.refresh) throw new Error(`${site.webHost} sent back no refresh token`)
@@ -539,7 +610,7 @@ async function signedIn(q, device, site) {
   // one at once, so a check-in takes it; when Trae won't, it does as is
   if (site.deviceExchange) {
     try {
-      const x = await boundExchange(s, site)
+      const x = await boundExchange(s, site, authHost)
       s = { ...s, token: x.token, refresh: x.refresh, expires: x.expires || s.expires }
     } catch {}
   }
@@ -616,7 +687,9 @@ async function browserSignIn(site) {
     x_env: "",
     x_app_version: site.ideVersion,
     x_app_type: "stable",
-    hide_saas_login: "true",
+    // the enterprise (SaaS) sign-in is offered beside the personal one: an
+    // enterprise subscription signs in there (@shad70w0 on X)
+    hide_saas_login: "false",
   })
   return {
     url: `${site.hosts.web}/authorization?${q}`,
@@ -1067,6 +1140,15 @@ class TextTools {
       this.after = true
     }
     if (end) {
+      // an opener the stream ended inside (<tool_call name): a call cut
+      // short, not the answer (plugins#38)
+      const h = this.buf.search(OPEN_HOLD)
+      if (h >= 0 && !quoted(this.sent + text + this.buf.slice(0, h))) {
+        text += this.buf.slice(0, h)
+        this.buf = ""
+        this.sent += text
+        return { text, calls, reasoning, error: CUT_SHORT }
+      }
       text += this.buf
       this.buf = ""
     } else {
@@ -1088,11 +1170,11 @@ class TextTools {
   // gave as <tool_call name="…">.
   block(body, named, end) {
     if (!end && !body.trim()) return { wait: true }
-    const close = body.indexOf(CLOSE)
+    const [close, closeLen] = closeAt(body)
     if (named) {
       if (close < 0 && !end) return { wait: true }
       const region = close >= 0 ? body.slice(0, close) : body
-      const rest = close >= 0 ? body.slice(close + CLOSE.length) : ""
+      const rest = close >= 0 ? body.slice(close + closeLen) : ""
       if (region.trimStart().startsWith("{")) {
         const v = repairedJSON(region.trim())
         if (!v) return { error: close >= 0 ? UNREADABLE : CUT_SHORT }
@@ -1116,7 +1198,7 @@ class TextTools {
         const region = body.slice(ph[0].length, close >= 0 ? close : body.length)
         const p = paramArgs(region, ph[1], this.tools)
         if (close < 0 && !p.closed) return { error: CUT_SHORT }
-        return { call: { name: ph[1], arguments: JSON.stringify(p.args) }, rest: close >= 0 ? body.slice(close + CLOSE.length) : "" }
+        return { call: { name: ph[1], arguments: JSON.stringify(p.args) }, rest: close >= 0 ? body.slice(close + closeLen) : "" }
       }
       const o = objectEnd(body, 0)
       if (o > 0 && !this.bad.has(":" + o)) {
@@ -1128,10 +1210,10 @@ class TextTools {
       }
       // not whole, or not JSON as it stands: read up to a close (a file's
       // content may hold one), or at the end all of it
-      for (let j = close; j >= 0; j = body.indexOf(CLOSE, j + 1)) {
+      for (let [j, n] = [close, closeLen]; j >= 0; [j, n] = closeAt(body, j + 1)) {
         if (this.bad.has("<" + j)) continue
         const v = callJSON(body.slice(0, j))
-        if (v) return { call: { name: String(v.name), arguments: callArgs(v) }, rest: body.slice(j + CLOSE.length) }
+        if (v) return { call: { name: String(v.name), arguments: callArgs(v) }, rest: body.slice(j + n) }
         this.bad.add("<" + j)
       }
       if (!end) return { wait: true }
@@ -1145,7 +1227,7 @@ class TextTools {
     const region = close >= 0 ? body.slice(0, close) : body
     const w = glmCall(region, this.tools)
     // GLM's call, cut short at the end, is still the call
-    if (w) return { call: { name: w.name, arguments: callArgs(w) }, rest: close >= 0 ? body.slice(close + CLOSE.length) : "" }
+    if (w) return { call: { name: w.name, arguments: callArgs(w) }, rest: close >= 0 ? body.slice(close + closeLen) : "" }
     if (/^\s*[\w.:-]{1,128}\s*<arg_key>/.test(body)) return { error: close >= 0 ? UNREADABLE : CUT_SHORT }
     return { text: true }
   }
@@ -1155,9 +1237,18 @@ const CUT_SHORT = "the model's tool call, written as text, was cut short; it is
 const UNREADABLE = "the model's tool call, written as text, can't be read; it is not sent on as the answer"
 
 // an opener: <tool_call>, one with attributes (<tool_call name="bash">),
-// or <tool_call right before its JSON; and one still being written
-const OPEN_AT = /<tool_call(?:(\s[^<>{}]*)?>|(?=\s*\{))/
-const OPEN_HOLD = /<tool_call(?:\s[^<>{}\n]{0,200})?$/
+// or <tool_call right before its JSON; and one still being written. GLM
+// also writes it without the underscore, <toolcall> (plugins#38)
+const OPEN_AT = /<tool_?call(?:(\s[^<>{}]*)?>|(?=\s*\{))/
+const OPEN_HOLD = /<tool_?call(?:\s[^<>{}\n]{0,200})?$/
+// closeAt is where the next close is from i, </tool_call> or </toolcall>,
+// and its length: [-1, 0] when there is none
+function closeAt(s, i = 0) {
+  const re = /<\/tool_?call>/g
+  re.lastIndex = i
+  const m = re.exec(s)
+  return m ? [m.index, m[0].length] : [-1, 0]
+}
 // DeepSeek's half-and-half call: {"name":"x"} (or its brace or > left
 // out), then <parameter name="k">v</parameter> or Qwen's <parameter=k>
 const PARAM_HEAD = /^\s*\{\s*"name"\s*:\s*"([^"]+)"\s*\}?\s*>?\s*(?=<parameter\b)/
@@ -1303,7 +1394,7 @@ const GLM_ARG = /<arg_key>\s*([\s\S]*?)\s*<\/arg_key>\s*<arg_value>([\s\S]*?)<\/
 // a value that isn't a string. A name alone is a call only to a tool the
 // request has.
 function glmCall(s, tools = []) {
-  s = String(s ?? "").replace(/<\/tool_call>\s*$/, "")
+  s = String(s ?? "").replace(/<\/tool_?call>\s*$/, "")
   const k = s.indexOf("<arg_key>")
   const name = (k < 0 ? s : s.slice(0, k)).trim()
   if (!/^[\w.:-]{1,128}$/.test(name)) return null
@@ -1373,9 +1464,9 @@ const DSML_CLOSE = new RegExp(String.raw`<\s*\/\s*[|｜][\s|｜]*DSML[\s|｜]*in
 const DSML_PARAM = new RegExp(String.raw`<\s*[|｜][\s|｜]*DSML[\s|｜]*parameter\s+name\s*=\s*"([^"]+)"((?:\s+\w+\s*=\s*"[^"]*")*)\s*>([\s\S]*?)` + DSML + String.raw`parameter\s*>`, "g")
 // what is left after a call: blanks, our close, DeepSeek's tags but the
 // next call's
-const LEFTOVER = new RegExp(String.raw`^(?:\s+|<\/tool_calls?>|<tool_calls>|` + DSML + String.raw`(?![\s|｜]*invoke\b)[^<>]*>)+`)
+const LEFTOVER = new RegExp(String.raw`^(?:\s+|<\/tool_?calls?>|<tool_?calls>|` + DSML + String.raw`(?![\s|｜]*invoke\b)[^<>]*>)+`)
 // what text may be the start of, so held back
-const MARKS = [OPEN, CLOSE, "<｜DSML｜", "<|DSML|", "</｜DSML｜", "</|DSML|", '{"reasoning_content"']
+const MARKS = [OPEN, CLOSE, "<toolcall>", "</toolcall>", "<｜DSML｜", "<|DSML|", "</｜DSML｜", "</|DSML|", '{"reasoning_content"']
 // reasoning a model wrote into its text as JSON
 const REASON_AT = /\{\s*"reasoning_content"\s*:/
 const MARK_MAX = Math.max(...MARKS.map((m) => m.length))
@@ -2329,4 +2420,4 @@ const makePlugin = (site) => async ({ client }) => {
 export const TraeCNAuthPlugin = makePlugin(SITES["trae-cn"])
 export const TraeGlobalAuthPlugin = makePlugin(SITES["trae-global"])
 
-export const _internal = { HOSTS: SITES["trae-cn"].hosts, MODELS: SITES["trae-cn"].models, TextTools, NativeCalls, looseJSON, glmCall, toolNamed, unwrapped, traeMessages, chatBody, credits, dollarUsageOf, whenOf, newDevice, proofOf, SITES, SESSION, conversationID }
+export const _internal = { traeHost, accountOf, HOSTS: SITES["trae-cn"].hosts, MODELS: SITES["trae-cn"].models, TextTools, NativeCalls, looseJSON, glmCall, toolNamed, unwrapped, traeMessages, chatBody, credits, dollarUsageOf, whenOf, newDevice, proofOf, SITES, SESSION, conversationID }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-trae-auth",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "OpenCode provider plugins for Trae: Trae CN (trae.cn) and Trae Global (trae.ai), free tier included, with Trae's own browser sign-in",
   "type": "module",
   "main": "./index.mjs",