@magpie-community/opencode-trae-auth 0.2.9 → 0.2.11

package/README.md

@@ -46,6 +46,23 @@ authorization page: `device_id` (19 digits) and `machine_id` (32 hex). Every
 request then sends that same device. The relays saw requests dropped when the
 device was new each time.
 
+### Enterprise (SaaS) accounts
+
+Since 0.2.10 the authorization page also offers Trae's enterprise (SaaS / SSO)
+sign-in; before, the plugin asked the page to hide it (`hide_saas_login`), so
+an enterprise subscription could only sign in as a personal account. A host
+the sign-in names for the account is kept when it is an https host on Trae's
+own domains (`trae.cn`, `trae.ai`, `mchost.guru`): a model host other than the
+consumer site's own (`www`, `api`, `grow…`) takes the account's model
+requests, and a token host the callback names (`authHost`) takes its
+renewals. Any other host is ignored and the consumer hosts are used, as for a
+personal account, which is unchanged. The account's tenant and login-type
+fields are kept with the sign-in; nothing sends them.
+
+**Not tried with a real enterprise account.** Which hosts and fields an
+enterprise sign-in sends back is not known yet; if yours doesn't work, open an
+issue with what the sign-in page showed.
+
 ### The international realm's region
 
 Trae Global has two deployments. The sign-in's `AIRegion` (or a US auth host

package/index.mjs

@@ -79,11 +79,19 @@ const SITES = {
     // the model host for an account: Trae CN's own hosts serve no models,
     // so only a host that is one is taken, else the one gateway
     apiOf: (a) => {
-      const h = String(a?.api ?? "").replace(/\/+$/, "")
-      return /mchost\.guru|trae-api-/i.test(h) ? h : SITES["trae-cn"].hosts.api
+      const h = traeHost(a?.api)
+      return h && SITES["trae-cn"].modelHost(h) ? h : SITES["trae-cn"].hosts.api
+    },
+    // whether a host named by a sign-in is one of the model hosts: an https
+    // host on mchost.guru or named trae-api-…, as the consumer gateway is,
+    // or another trae.cn host than the consumer site's own (www, api,
+    // grow…), which an enterprise (SaaS) sign-in may name for its tenant
+    modelHost: (h) => {
+      const t = traeHost(h)
+      if (!t) return false
+      const n = new URL(t).hostname
+      return /(^|\.)mchost\.guru$|^trae-api-/i.test(n) || (/\.trae\.cn$/i.test(n) && !/^(www|api|grow[^.]*)\./i.test(n))
     },
-    // whether a host named by a sign-in is one of the model hosts
-    modelHost: (h) => /mchost\.guru|trae-api-/i.test(String(h ?? "")),
     // ownPage: url is one of Trae CN's own JSON pages on api.trae.cn
     // (/trae/api/…: the daily check-in, credits), which the account's fetch
     // sends as the account rather than as a chat
@@ -166,15 +174,22 @@ const SITES = {
     // the model host: the account's region (or a US host the sign-in named)
     // selects the US deployment, else the SG one
     apiOf: (a) => {
-      const h = String(a?.api ?? "").replace(/\/+$/, "")
+      const h = traeHost(a?.api)
+      const n = h ? new URL(h).hostname : ""
       const region = String(a?.region ?? "").toUpperCase()
-      if (/coreva/i.test(h) || /api-us(?:[-.]|$)/i.test(h) || /^US(?:[-_ ]|$)/.test(region)) return SITES["trae-global"].hosts.us
-      if (/coresg/i.test(h)) return h
+      if (/coreva/i.test(n) || /api-us(?:[-.]|$)/i.test(n) || /^US(?:[-_ ]|$)/.test(region)) return SITES["trae-global"].hosts.us
+      if (/coresg/i.test(n)) return h
+      // another trae.ai host than the site's own (www, api-…, grow…): one an
+      // enterprise (SaaS) sign-in named for its tenant
+      if (/\.trae\.ai$/i.test(n) && !/^(www\.|api[-.]|grow)/i.test(n)) return h
       return SITES["trae-global"].hosts.api
     },
     // a sign-in names a host of Trae's, which can be an auth host
     // (api-us-east), not the chat host
-    modelHost: (h) => /trae\.ai/i.test(String(h ?? "")),
+    modelHost: (h) => {
+      const t = traeHost(h)
+      return !!t && /(^|\.)trae\.ai$/i.test(new URL(t).hostname)
+    },
     // Trae Global serves no own JSON pages through the account's fetch
     ownPage: () => false,
     // the account's region, from the sign-in's user info
@@ -213,6 +228,46 @@ const SITES = {
   },
 }
 
+// traeHost is a host a sign-in named, when it is a well-formed https one
+// on Trae's own domains (no port, no credentials), as origin plus any path;
+// "" for anything else, which is then not taken
+const TRAE_DOMAINS = ["trae.cn", "trae.ai", "mchost.guru"]
+function traeHost(h) {
+  try {
+    const u = new URL(String(h ?? "").trim())
+    if (u.protocol !== "https:" || u.username || u.password || u.port || u.search || u.hash) return ""
+    const n = u.hostname.toLowerCase()
+    if (!TRAE_DOMAINS.some((d) => n === d || n.endsWith("." + d))) return ""
+    return (u.origin + u.pathname).replace(/\/+$/, "")
+  } catch {
+    return ""
+  }
+}
+
+// authHostOf is the host a sign-in named for its tokens, when it named one
+// on the site's own domain (an enterprise's may differ from the consumer
+// one); "" when it named none, and the site's own is used
+function authHostOf(h, site) {
+  const t = traeHost(h)
+  if (!t) return ""
+  const n = new URL(t).hostname
+  return n === site.webHost || n.endsWith("." + site.webHost) ? t : ""
+}
+
+// accountOf keeps the account fields of the sign-in's user info that say
+// what kind of account it is (tenant, enterprise, login type), plain values
+// only and never anything that looks like a secret, for later use; nothing
+// sends them
+function accountOf(info) {
+  const out = {}
+  for (const [k, v] of Object.entries(info ?? {})) {
+    if (!/tenant|enterprise|saas|login|org|team|sso|^ent|usertype|accounttype/i.test(k)) continue
+    if (/token|secret|key|password|cookie|session|jwt/i.test(k)) continue
+    if (v === null || ["string", "number", "boolean"].includes(typeof v)) out[k] = v
+  }
+  return out
+}
+
 const SIGN_IN_TIMEOUT = 10 * 60 * 1000
 const EARLY_MS = 2 * 60 * 1000 // a token this close to its end is renewed before a request
 const LEAD_MS = 10 * 60 * 1000 // and this close, magpie renews it ahead of time (auth.refresh)
@@ -301,6 +356,11 @@ function toAuth(s, site) {
     // the model host the sign-in named, if it named one
     ...(site.modelHost(s.api) ? { api: s.api } : {}),
     ...(s.region ? { region: s.region } : {}),
+    // the host the sign-in named, its own token host if it named one, and
+    // what kind of account it is (an enterprise one's tenant), kept as given
+    ...(traeHost(s.host) ? { host: traeHost(s.host) } : {}),
+    ...(authHostOf(s.authHost, site) ? { authHost: authHostOf(s.authHost, site) } : {}),
+    ...(s.account && Object.keys(s.account).length ? { account: s.account } : {}),
   }
 }
 
@@ -319,6 +379,9 @@ function fromAuth(auth, site) {
     devicePrivateKey: auth.devicePrivateKey || "",
     api: auth.api || "",
     region: site.regionOf(auth),
+    host: auth.host || "",
+    authHost: authHostOf(auth.authHost, site),
+    account: auth.account && typeof auth.account === "object" ? auth.account : {},
   }
 }
 
@@ -405,6 +468,7 @@ async function exchange(refresh, clientId, site, host = site.hosts.auth) {
       name: String(info.ScreenName ?? info.screenName ?? ""),
       api: info.Host ?? "",
       region: site.regionOf(info),
+      account: accountOf(info),
     }
   }
   const e = errorOf(text)
@@ -495,12 +559,14 @@ async function boundExchange(a, site, host = site.hosts.auth) {
 // before 0.2.3 (exchange). A device key made for the account goes with
 // either, so the next renewal signs with the same one.
 async function renewal(a, site) {
-  if (!site.deviceExchange) return exchange(a.refresh, a.clientId, site)
+  // the token host the sign-in named, else the site's
+  const host = authHostOf(a.authHost, site) || site.hosts.auth
+  if (!site.deviceExchange) return exchange(a.refresh, a.clientId, site, host)
   const keys = a.devicePrivateKey && a.devicePublicKey ? {} : newDeviceKey()
   try {
-    return await boundExchange({ ...a, ...keys }, site)
+    return await boundExchange({ ...a, ...keys }, site, host)
   } catch {}
-  return { ...(await exchange(a.refresh, a.clientId, site)), ...keys }
+  return { ...(await exchange(a.refresh, a.clientId, site, host)), ...keys }
 }
 
 // ---- the browser sign-in --------------------------------------------------------
@@ -527,10 +593,15 @@ async function signedIn(q, device, site) {
     name: String(info.ScreenName ?? info.screenName ?? ""),
     api: host,
     region: site.regionOf(info),
+    host,
+    // a token host the callback named, if it named one
+    authHost: authHostOf(q.get("authHost") || q.get("auth_host") || info.AuthHost || info.authHost, site),
+    account: accountOf(info),
   }
+  const authHost = s.authHost || site.hosts.auth
   if (!s.token && s.refresh) {
-    const x = await exchange(s.refresh, s.clientId, site)
-    s = { ...s, ...x, uid: x.uid || s.uid, name: x.name || s.name, api: x.api || s.api, region: x.region || s.region }
+    const x = await exchange(s.refresh, s.clientId, site, authHost)
+    s = { ...s, ...x, uid: x.uid || s.uid, name: x.name || s.name, api: x.api || s.api, region: x.region || s.region, host: s.host || x.api, account: { ...x.account, ...s.account } }
   }
   if (!s.token) throw new Error(`${site.webHost} sent back no token`)
   if (!s.refresh) throw new Error(`${site.webHost} sent back no refresh token`)
@@ -539,7 +610,7 @@ async function signedIn(q, device, site) {
   // one at once, so a check-in takes it; when Trae won't, it does as is
   if (site.deviceExchange) {
     try {
-      const x = await boundExchange(s, site)
+      const x = await boundExchange(s, site, authHost)
       s = { ...s, token: x.token, refresh: x.refresh, expires: x.expires || s.expires }
     } catch {}
   }
@@ -616,7 +687,9 @@ async function browserSignIn(site) {
     x_env: "",
     x_app_version: site.ideVersion,
     x_app_type: "stable",
-    hide_saas_login: "true",
+    // the enterprise (SaaS) sign-in is offered beside the personal one: an
+    // enterprise subscription signs in there (@shad70w0 on X)
+    hide_saas_login: "false",
   })
   return {
     url: `${site.hosts.web}/authorization?${q}`,
@@ -949,6 +1022,7 @@ class TextTools {
     this.tools = tools
     this.sent = "" // the text given out so far, to tell a block in code from a call
     this.bad = new Set() // where the waiting block's JSON was tried and not read, not tried again
+    this.mark = 0 // where in sent the text after the last call starts
   }
   push(s, end = false) {
     this.buf += s
@@ -971,6 +1045,27 @@ class TextTools {
       const i = om ? om.index : -1
       const d = this.buf.search(DSML_AT)
       const r = this.buf.search(REASON_AT)
+      const sm = this.buf.match(STRAY_AT)
+      const s = sm ? sm.index : -1
+      if (s >= 0 && [i, d, r].every((x) => x < 0 || s < x)) {
+        // a close with no call open, with what GLM left before it
+        // (}}</tool_call>, magpie#1945): not the answer, dropped; in code,
+        // shown
+        const head = this.buf.slice(0, s)
+        // only a tail: a close with nothing before it since the last call
+        // (or the start), or with GLM's braces, quotes or > right before
+        // it; a close a sentence names in passing stays
+        const tail = /^[}\]"'>]/.test(sm[0]) || !(this.sent + text + head).slice(this.mark).trim()
+        if (!tail || quoted(this.sent + text + head)) {
+          text += this.buf.slice(0, s + sm[0].length)
+          this.buf = this.buf.slice(s + sm[0].length)
+          continue
+        }
+        text += head
+        this.buf = this.buf.slice(s + sm[0].length)
+        this.after = true
+        continue
+      }
       if (r >= 0 && (i < 0 || r < i) && (d < 0 || r < d)) {
         const o = objectEnd(this.buf, r)
         if (o === -1 && !end) {
@@ -1022,6 +1117,7 @@ class TextTools {
           stop = body.length
         }
         calls.push({ name: inv[1], arguments: dsmlArgs(body.slice(0, stop)) })
+        this.mark = this.sent.length + text.length
         this.buf = body.slice(c && c.index === stop ? stop + c[0].length : stop)
         this.after = true
         continue
@@ -1063,6 +1159,7 @@ class TextTools {
         return { text, calls, reasoning, error: b.error }
       }
       calls.push(b.call)
+      this.mark = this.sent.length + text.length
       this.buf = b.rest
       this.after = true
     }
@@ -1083,6 +1180,9 @@ class TextTools {
       const at = [this.buf.search(OPEN_AT), this.buf.search(OPEN_HOLD), this.buf.search(DSML_AT), this.buf.search(REASON_AT)].filter((x) => x >= 0)
       let keep = at.length ? this.buf.length - Math.min(...at) : 0
       if (!keep) for (let k = Math.min(MARK_MAX - 1, this.buf.length); k > 0; k--) if (MARKS.some((m) => m.startsWith(this.buf.slice(-k)))) { keep = k; break }
+      // and braces, brackets, quotes or a > a close may still come after
+      const sh = this.buf.slice(0, this.buf.length - keep).match(STRAY_HOLD)
+      if (sh) keep = this.buf.length - sh.index
       text += this.buf.slice(0, this.buf.length - keep)
       this.buf = this.buf.slice(this.buf.length - keep)
     }
@@ -1132,8 +1232,27 @@ class TextTools {
         const v = callJSON(body.slice(0, o))
         // a name alone may have its parameters still to come
         if (v && !end && Object.keys(v).length === 1 && "<parameter".startsWith(body.slice(o).replace(/^\s*>?\s*/, ""))) return { wait: true }
-        if (v) return { call: { name: String(v.name), arguments: callArgs(v) }, rest: body.slice(o) }
-        this.bad.add(":" + o)
+        if (v) {
+          // what follows the object up to the close: GLM leaves braces,
+          // brackets, quotes or a > of its own there (}}</tool_call>,
+          // "></tool_call>, magpie#1945), dropped with the close; held
+          // while only those have come
+          const tail = body.slice(o)
+          const junk = tail.match(TAIL_JUNK)[0]
+          const next = tail.slice(junk.length)
+          const call = { name: String(v.name), arguments: callArgs(v) }
+          if (!end && (!next || ["</tool_call>", "</toolcall>"].some((k) => k.startsWith(next)))) return { wait: true }
+          const [c, n] = closeAt(next)
+          if (c === 0) return { call, rest: next.slice(n) }
+          // after blanks alone, or with no close to come: the call, and
+          // what follows read on as before. Other text before the close
+          // right after the object means the object ended early, at a
+          // quote inside a string left unescaped: that cut is wrong (a
+          // heredoc's command cut short, magpie#1945), so it is read up to
+          // the close below, or not at all
+          if (!/\S/.test(junk) && !/^[^\s<]/.test(next)) return { call, rest: tail }
+          if (close < 0 && end) return { call, rest: tail }
+        } else this.bad.add(":" + o)
       }
       // not whole, or not JSON as it stands: read up to a close (a file's
       // content may hold one), or at the end all of it
@@ -1168,6 +1287,14 @@ const UNREADABLE = "the model's tool call, written as text, can't be read; it is
 // also writes it without the underscore, <toolcall> (plugins#38)
 const OPEN_AT = /<tool_?call(?:(\s[^<>{}]*)?>|(?=\s*\{))/
 const OPEN_HOLD = /<tool_?call(?:\s[^<>{}\n]{0,200})?$/
+// what GLM leaves between a call's JSON and its close: blanks, closing
+// braces and brackets, quotes, a > (magpie#1945)
+const TAIL_JUNK = /^[\s}\]"'>]*/
+// a close with no call open, and that leftover before it: the tail of a
+// call Trae's service read itself, or of one already read (magpie#1945)
+const STRAY_AT = /[}\]"'>]*\s*<\/tool_?calls?>/
+// the end of text that may be such a tail still being written
+const STRAY_HOLD = /[}\]"'>][\s}\]"'>]*$/
 // closeAt is where the next close is from i, </tool_call> or </toolcall>,
 // and its length: [-1, 0] when there is none
 function closeAt(s, i = 0) {
@@ -2347,4 +2474,4 @@ const makePlugin = (site) => async ({ client }) => {
 export const TraeCNAuthPlugin = makePlugin(SITES["trae-cn"])
 export const TraeGlobalAuthPlugin = makePlugin(SITES["trae-global"])
 
-export const _internal = { HOSTS: SITES["trae-cn"].hosts, MODELS: SITES["trae-cn"].models, TextTools, NativeCalls, looseJSON, glmCall, toolNamed, unwrapped, traeMessages, chatBody, credits, dollarUsageOf, whenOf, newDevice, proofOf, SITES, SESSION, conversationID }
+export const _internal = { traeHost, accountOf, HOSTS: SITES["trae-cn"].hosts, MODELS: SITES["trae-cn"].models, TextTools, NativeCalls, looseJSON, glmCall, toolNamed, unwrapped, traeMessages, chatBody, credits, dollarUsageOf, whenOf, newDevice, proofOf, SITES, SESSION, conversationID }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-trae-auth",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "OpenCode provider plugins for Trae: Trae CN (trae.cn) and Trae Global (trae.ai), free tier included, with Trae's own browser sign-in",
   "type": "module",
   "main": "./index.mjs",