@magpie-community/opencode-workbuddy-auth 0.1.10 → 0.1.12

package/README.md

@@ -55,11 +55,36 @@ They are streamed only; WorkBuddy refuses a chat that isn't.
 Each chat carries WorkBuddy's headers:
 - `Authorization`, `X-User-Id`, `X-Domain`, `X-Product: SaaS`, `X-IDE-Type: WorkBuddy`;
 - `User-Agent: WorkBuddy/5.5.6`. Without it, WorkBuddy answers error 10085;
-- WorkBuddy AI also takes its client and conversation headers.
+- the client's, which WorkBuddy's usage list shows as the client that asked
+  (使用端): `X-Agent-Purpose: conversation`, `X-IDE-Name: WorkBuddy`,
+  `X-IDE-Version`, `X-Agent-Intent: craft`, `X-Requested-With`. Both builds
+  send them, as WorkBuddy's own client does; a chat without them is counted
+  under no client at all;
+- the conversation's ids: `X-Conversation-ID`, `X-Conversation-Request-ID`,
+  `X-Conversation-Message-ID`, `X-Request-ID`. WorkBuddy's backend counts a
+  user send as one request by `X-Conversation-Request-ID`, so every step of
+  one send — a tool result sent back, a retry, another account answering —
+  carries the same one, and the user's next message carries another. The
+  conversation's is the session magpie (or OpenCode) names the request by,
+  else the chat's first user message; nothing is made up when neither names
+  one, a made-up conversation of the request's own being what splits one
+  conversation into many in the usage detail;
+- WorkBuddy AI also takes `X-Agent-Type: main`.
 
 A chat that doesn't open with a system message is given WorkBuddy's
 default one, as the app does.
 
+A chat's tools are given shapes WorkBuddy's models take. Without them
+WorkBuddy AI answers 400 "Invalid request parameters" (11133), DeepSeek's
+models to each shape below and Kimi's, GPT's, Gemini's and GLM's to some:
+- a tool's parameters with no `type`, empty, or a union (`anyOf`, `oneOf`,
+  `allOf`) at the root are an object, the union's fields merged;
+- a `pattern`'s `\0` is `\u0000`, which matches the same;
+- a tuple's `items` (a list) is one schema any of them fits;
+- a tool's name with a character other than letters, digits, `_` and `-`
+  (`.`, `:`, `/`, a space, CJK) is sent with `_` there, and the model's
+  calls come back under the tool's own name.
+
 ## Models
 
 When you are signed in, the models are the ones WorkBuddy's product config

package/index.mjs

@@ -8,7 +8,7 @@
 // streamed only, with WorkBuddy's headers: a request whose User-Agent isn't
 // WorkBuddy/<version> is refused (error 10085).
 
-import { randomBytes } from "node:crypto"
+import { createHash, randomBytes } from "node:crypto"
 import { readFileSync } from "node:fs"
 import { homedir } from "node:os"
 import { join } from "node:path"
@@ -235,7 +235,18 @@ async function refreshed(site, auth) {
   return Object.keys(out).length ? out : undefined
 }
 
-// sign sets on headers what WorkBuddy's desktop app sends with a chat.
+// sign sets on headers what WorkBuddy's desktop app sends with a chat: the
+// account's own, the client's, and the attribution WorkBuddy's usage list
+// shows as the client that asked (使用端). The chat's ids — the
+// conversation's, the turn's, the message's — are attend's below.
+//
+// WorkBuddy's own client sends the whole of this on both builds
+// (application-manifest.js: X-Agent-Purpose "conversation", X-IDE-Name/Type
+// "WorkBuddy", X-IDE-Version, X-Product "SaaS"); a chat without them is
+// counted under no client at all, which is the empty 使用端 a request shows
+// when only some of the group is there. The gate below used to give the China
+// build none of the client's headers, so every China-build request was
+// attribution-less.
 function sign(site, a, headers) {
   headers.set("Authorization", "Bearer " + a.access)
   headers.set("X-User-Id", a.uid ?? "")
@@ -243,18 +254,144 @@ function sign(site, a, headers) {
   headers.set("X-Product", "SaaS")
   headers.set("X-IDE-Type", "WorkBuddy")
   headers.set("User-Agent", "WorkBuddy/" + UA_VERSION)
-  if (!site.ai) return
   headers.set("X-Requested-With", "XMLHttpRequest")
   headers.set("X-Agent-Intent", "craft")
-  headers.set("X-Agent-Type", "main")
+  headers.set("X-Agent-Purpose", "conversation")
   headers.set("X-IDE-Name", "WorkBuddy")
   headers.set("X-IDE-Version", UA_VERSION)
-  const conv = hex()
-  if (!headers.has("X-Conversation-ID")) headers.set("X-Conversation-ID", conv)
-  if (!headers.has("X-Conversation-Request-ID")) headers.set("X-Conversation-Request-ID", conv)
+  if (!site.ai) return
+  headers.set("X-Agent-Type", "main")
+}
+
+// WorkBuddy's own client names each chat to its gateway four ways: the
+// conversation it belongs to, the user send (turn) it answers, the message
+// itself, and the request that carried it. Its backend counts a user send as
+// one request by X-Conversation-Request-ID: a chat carrying a new one every
+// time is counted on its own, so one send that takes several steps — a tool
+// call answered and sent again, a retry, another account answering — shows up
+// in the usage detail as many requests. The ids below are made from what
+// names the conversation and the turn, so every step of one send carries the
+// same turn id and the user's next message carries another, as WorkBuddy's
+// own client does.
+
+// SESSION carries the conversation magpie (or OpenCode) names a request by,
+// from the chat.headers hook to the loader's fetch. It goes no further.
+const SESSION = "x-magpie-workbuddy-session"
+
+// SALT is what the ids are derived with, so an id says nothing of the words
+// it was made from. New in each process, as WorkBuddy's own ids are one
+// conversation's own within a run.
+const SALT = randomBytes(16).toString("hex")
+
+// idFor is the 32 hex digits WorkBuddy's own ids are made of, made of a
+// name of the thing the id is for (a turn, a conversation) and what names it.
+function idFor(kind, key) {
+  return createHash("sha256").update(`${SALT}|${kind}|${key}`).digest("hex").slice(0, 32)
+}
+
+// signatureOf is a message content's signature: its text, and a digest of
+// every part that isn't text (an image, a file), so a turn of images alone is
+// a turn of its own too. A tool result's part — carried in a user message by
+// clients of Anthropic's shape — is left out: it is not what the user said,
+// and it changes with every step of the send.
+function signatureOf(content) {
+  if (typeof content === "string") return content
+  if (!Array.isArray(content)) return ""
+  let out = ""
+  for (const part of content) {
+    const type = part?.type ?? ""
+    if (type === "" || type === "text") out += typeof part?.text === "string" ? part.text : ""
+    else if (type !== "tool_result" && type !== "tool-result") {
+      out += `[${type}:${createHash("sha256").update(JSON.stringify(part)).digest("hex").slice(0, 8)}]`
+    }
+  }
+  return out
+}
+
+// answeredBefore is whether msgs[i] answers the message before it — a tool's
+// result, or an assistant's calls — rather than carrying the user's own
+// words. A client that sends a tool result's images in a user message (pi's
+// "Attached image(s) from tool result:") puts that message right after the
+// result, and a turn keyed on it would be a turn of its own on every step.
+function answeredBefore(msgs, i) {
+  const prev = msgs[i - 1]
+  if (prev === null || typeof prev !== "object") return false
+  if (prev.role === "tool") return true
+  return prev.role === "assistant" && Array.isArray(prev.tool_calls) && prev.tool_calls.length > 0
+}
+
+// turnKey names the user send a chat answers: the body's last user message
+// that is the user's own, by its place and its signature. Every step of one
+// send repeats it; the user's next message changes it. "" for a chat whose
+// last such message has nothing signable in it (an empty message) or which
+// has none at all: the caller then makes a fresh id for that request, as
+// before these were derived at all.
+function turnKey(chat) {
+  const msgs = Array.isArray(chat?.messages) ? chat.messages : []
+  for (let i = msgs.length - 1; i >= 0; i--) {
+    if (msgs[i]?.role !== "user" || answeredBefore(msgs, i)) continue
+    const sig = signatureOf(msgs[i].content)
+    return sig ? `u${i}:${sig}` : ""
+  }
+  return ""
+}
+
+// conversationKey names the conversation a chat belongs to: the session
+// magpie or OpenCode names (its chat.headers hook), else the chat's first
+// user message, which every later turn of it repeats. "" when neither names
+// one — a body that isn't a chat, or one with no user message in it — and no
+// conversation id is sent then: a made-up one would be a conversation of the
+// request's own, which is what fragments the usage detail in the first place.
+function conversationKey(chat, session) {
+  if (session) return `session:${session}`
+  const msgs = Array.isArray(chat?.messages) ? chat.messages : []
+  for (const m of msgs) {
+    if (m?.role !== "user") continue
+    const sig = signatureOf(m.content)
+    if (sig) return `first:${sig}`
+  }
+  return ""
+}
+
+// chatOf is a chat's body as the object it is, null for one that isn't: a
+// body that isn't text (bytes), or isn't JSON at all.
+function chatOf(body) {
+  if (typeof body !== "string") return null
+  try {
+    const b = JSON.parse(body)
+    return b !== null && typeof b === "object" ? b : null
+  } catch {
+    return null
+  }
+}
+
+// sessionOf takes the session a chat.headers hook named off the headers,
+// with the header: it goes no further than here. Its length is capped as
+// magpie's own session ids are, the id below being derived from it anyway.
+function sessionOf(headers) {
+  const s = String(headers.get(SESSION) ?? "").trim()
+  headers.delete(SESSION)
+  return s.slice(0, 128)
+}
+
+// attend sets a chat's ids on the headers its request goes to WorkBuddy
+// with: the message's (each request its own, as the client makes them), the
+// turn's (one user send, whatever it takes), and the conversation's. A header
+// already there — the caller's own, or another plugin's — is kept, and the
+// message and request ids are the same one, as WorkBuddy's client has them.
+function attend(headers, body, session) {
+  const chat = chatOf(body)
+  const conv = conversationKey(chat, session)
   const msg = hex()
   headers.set("X-Conversation-Message-ID", msg)
   headers.set("X-Request-ID", msg)
+  if (!headers.has("X-Conversation-Request-ID")) {
+    const turn = turnKey(chat)
+    // a turn is a conversation's own: two conversations whose user message
+    // reads the same are still two sends, not one
+    headers.set("X-Conversation-Request-ID", turn ? idFor("turn", `${conv}|${turn}`) : hex())
+  }
+  if (conv && !headers.has("X-Conversation-ID")) headers.set("X-Conversation-ID", idFor("conversation", conv))
 }
 
 // FLAGGED are the words WorkBuddy refuses a chat for, "Illegal API
@@ -331,6 +468,250 @@ function withSystem(body) {
   }
 }
 
+// ---- tools WorkBuddy takes ----------------------------------------------------
+
+// WorkBuddy AI answers 400 code 11133 "Invalid request parameters" (the
+// model provider rejected them) to a chat whose tools it can't pass on to
+// the model (wyh on magpie's Discord: ZCode and DeepSeek Harness on
+// deepseek-v4.1-flash). Tried on the owner's account, 2026-10-08: DeepSeek
+// turns away each of the shapes below, and Kimi, GPT, Gemini and GLM some
+// of them; MiniMax none. fitTools gives each a shape every model takes.
+// A tool's name may hold letters, digits, _ and -; another character
+// (". : / space", CJK) is refused.
+const NAME_OK = /^[A-Za-z0-9_-]+$/
+
+// safeName is name with each character WorkBuddy refuses as _, kept apart
+// from the names in taken.
+function safeName(name, taken) {
+  const base = String(name).replace(/[^A-Za-z0-9_-]/g, "_") || "tool"
+  let n = base
+  for (let i = 2; taken.has(n); i++) n = `${base}_${i}`
+  taken.add(n)
+  return n
+}
+
+// NUL_ESCAPE finds a regex's \0 (the NUL character), stepping over each \\
+// (a backslash) so that a \\0 is left; \01 is an octal escape, also left.
+const NUL_ESCAPE = /\\\\|\\0(?![0-9])/g
+
+// fitSchema mends a schema in place, at every depth: a pattern's \0, which
+// DeepSeek's validator says is "not a 'regex'", is \u0000, which matches
+// the same (magpie's gateway does this for DeepSeek's own API,
+// deepseekToolPatterns); a tuple's items (a list) become one schema any of
+// them fits. It reports whether it changed anything.
+function fitSchema(s, depth = 0) {
+  if (!s || typeof s !== "object" || depth > 64) return false
+  let changed = false
+  if (Array.isArray(s)) {
+    for (const v of s) if (fitSchema(v, depth + 1)) changed = true
+    return changed
+  }
+  if (typeof s.pattern === "string" && s.pattern.includes("\\0")) {
+    const p = s.pattern.replace(NUL_ESCAPE, (m) => (m === "\\\\" ? m : "\\u0000"))
+    if (p !== s.pattern) {
+      s.pattern = p
+      changed = true
+    }
+  }
+  if (Array.isArray(s.items)) {
+    const list = s.items.filter((v) => v && typeof v === "object")
+    s.items = list.length === 0 ? {} : list.length === 1 ? list[0] : { anyOf: list }
+    delete s.additionalItems
+    changed = true
+  }
+  for (const v of Object.values(s)) if (fitSchema(v, depth + 1)) changed = true
+  return changed
+}
+
+// localRef is the schema a local $ref in root names ("#/$defs/x",
+// "#/definitions/x"), or s itself.
+function localRef(root, s) {
+  const ref = s?.$ref
+  if (typeof ref !== "string" || !ref.startsWith("#/")) return s
+  let at = root
+  for (const k of ref.slice(2).split("/")) at = at?.[k.replaceAll("~1", "/").replaceAll("~0", "~")]
+  return at && typeof at === "object" ? at : s
+}
+
+// objectRoot makes a tool's parameters an object at the root, as magpie's
+// gateway does for xAI (provider.ObjectRoot): allOf's branches are merged
+// whole; of anyOf's and oneOf's object branches the properties are merged
+// and a field each requires stays required. A root with no type, or an
+// empty one, is an object. It reports whether it changed anything.
+function objectRoot(ps, root = ps, depth = 0) {
+  const unions = ["allOf", "anyOf", "oneOf"].filter((k) => Array.isArray(ps[k]))
+  if (ps.type === "object" && !unions.length) return false
+  const props = ps.properties && typeof ps.properties === "object" ? ps.properties : {}
+  const required = Array.isArray(ps.required) ? [...ps.required] : []
+  for (const b0 of ps.allOf ?? []) {
+    let b = localRef(root, b0)
+    if (!b || typeof b !== "object") continue
+    if (depth < 8 && ["allOf", "anyOf", "oneOf"].some((k) => Array.isArray(b[k]))) objectRoot((b = structuredClone(b)), root, depth + 1)
+    for (const [k, v] of Object.entries(b.properties ?? {})) if (!(k in props)) props[k] = v
+    if (Array.isArray(b.required)) required.push(...b.required)
+  }
+  const branches = []
+  for (const key of ["anyOf", "oneOf"]) {
+    for (const b0 of ps[key] ?? []) {
+      let b = localRef(root, b0)
+      if (!b || typeof b !== "object") continue
+      if (depth < 8 && ["allOf", "anyOf", "oneOf"].some((k) => Array.isArray(b[k]))) objectRoot((b = structuredClone(b)), root, depth + 1)
+      if (b.type !== "object" && !b.properties) continue
+      branches.push(b)
+    }
+  }
+  const from = new Map()
+  for (const b of branches) {
+    for (const [k, v] of Object.entries(b.properties ?? {})) {
+      if (k in props) continue
+      const seen = from.get(k) ?? []
+      if (!seen.some((x) => JSON.stringify(x) === JSON.stringify(v))) seen.push(v)
+      from.set(k, seen)
+    }
+  }
+  for (const [k, list] of from) props[k] = list.length === 1 ? list[0] : { anyOf: list }
+  if (branches.length) {
+    for (const k of Object.keys(branches[0].properties ?? {})) {
+      if (branches.every((b) => Array.isArray(b.required) && b.required.includes(k))) required.push(k)
+    }
+  }
+  for (const k of unions) delete ps[k]
+  ps.type = "object"
+  ps.properties = props
+  const req = [...new Set(required)].filter((k) => typeof k === "string" && k in props)
+  if (req.length) ps.required = req
+  else delete ps.required
+  return true
+}
+
+// fitTools mends b's function tools in place: their parameters (fitSchema,
+// objectRoot) and names. It reports whether it changed anything, and the
+// names it gave, each to the name the client knows (ours), so that the
+// model's calls are named back. A call in the chat's history is named as
+// its tool now is.
+function fitTools(b) {
+  const names = new Map()
+  if (!Array.isArray(b?.tools) || !b.tools.length) return { changed: false, names }
+  let changed = false
+  const taken = new Set()
+  for (const t of b.tools) {
+    const n = t?.function?.name
+    if (typeof n === "string" && NAME_OK.test(n)) taken.add(n)
+  }
+  const theirs = new Map()
+  for (const t of b.tools) {
+    const fn = t?.type === "function" || t?.function ? t.function : null
+    if (!fn || typeof fn !== "object") continue
+    if (typeof fn.name === "string" && !NAME_OK.test(fn.name)) {
+      const safe = safeName(fn.name, taken)
+      names.set(safe, fn.name)
+      theirs.set(fn.name, safe)
+      fn.name = safe
+      changed = true
+    }
+    if (fn.parameters === undefined) continue
+    if (!fn.parameters || typeof fn.parameters !== "object" || Array.isArray(fn.parameters)) {
+      fn.parameters = { type: "object", properties: {} }
+      changed = true
+      continue
+    }
+    if (fitSchema(fn.parameters)) changed = true
+    if (objectRoot(fn.parameters)) changed = true
+  }
+  if (theirs.size && Array.isArray(b.messages)) {
+    for (const m of b.messages) {
+      for (const c of Array.isArray(m?.tool_calls) ? m.tool_calls : []) {
+        const safe = theirs.get(c?.function?.name)
+        if (safe) c.function.name = safe
+      }
+      if (m?.role === "tool" && theirs.has(m.name)) m.name = theirs.get(m.name)
+    }
+  }
+  const choice = b.tool_choice?.function
+  if (choice && theirs.has(choice.name)) choice.name = theirs.get(choice.name)
+  return { changed, names }
+}
+
+// fitted is a chat body with its tools mended (fitTools), and the names
+// given its tools, each to the client's own; a body that isn't a chat is
+// as it was.
+function fitted(body) {
+  if (typeof body !== "string") return { body, names: new Map() }
+  try {
+    const b = JSON.parse(body)
+    const { changed, names } = fitTools(b)
+    return { body: changed ? JSON.stringify(b) : body, names }
+  } catch {
+    return { body, names: new Map() }
+  }
+}
+
+// namedBack gives the model's calls in a chat answer (one JSON body, or an
+// SSE stream's chunks) the names the client gave its tools.
+function namedBack(v, names) {
+  let changed = false
+  for (const c of Array.isArray(v?.choices) ? v.choices : []) {
+    for (const at of [c?.message, c?.delta]) {
+      for (const tc of Array.isArray(at?.tool_calls) ? at.tool_calls : []) {
+        const ours = names.get(tc?.function?.name)
+        if (ours) {
+          tc.function.name = ours
+          changed = true
+        }
+      }
+    }
+  }
+  return changed
+}
+
+// renamed is res with namedBack on its body, read as it comes.
+function renamed(res, names) {
+  if (!names.size || !res.body) return res
+  const headers = new Headers(res.headers)
+  headers.delete("content-length")
+  headers.delete("content-encoding")
+  const json = /json/i.test(res.headers.get("content-type") ?? "")
+  if (json) {
+    const out = res.text().then((text) => {
+      try {
+        const v = JSON.parse(text)
+        return namedBack(v, names) ? JSON.stringify(v) : text
+      } catch {
+        return text
+      }
+    })
+    return out.then((text) => new Response(text, { status: res.status, statusText: res.statusText, headers }))
+  }
+  const dec = new TextDecoder()
+  const enc = new TextEncoder()
+  let rest = ""
+  const line = (l) => {
+    const m = /^data:\s?(.*)$/.exec(l)
+    if (!m || m[1] === "[DONE]") return l
+    try {
+      const v = JSON.parse(m[1])
+      return namedBack(v, names) ? `data: ${JSON.stringify(v)}` : l
+    } catch {
+      return l
+    }
+  }
+  const body = res.body.pipeThrough(
+    new TransformStream({
+      transform(chunk, ctl) {
+        rest += dec.decode(chunk, { stream: true })
+        const lines = rest.split("\n")
+        rest = lines.pop()
+        if (lines.length) ctl.enqueue(enc.encode(lines.map(line).join("\n") + "\n"))
+      },
+      flush(ctl) {
+        rest += dec.decode()
+        if (rest) ctl.enqueue(enc.encode(line(rest)))
+      },
+    }),
+  )
+  return new Response(body, { status: res.status, statusText: res.statusText, headers })
+}
+
 // ---- signing in -------------------------------------------------------------
 
 // poll asks path until WorkBuddy answers with data, retrying the codes
@@ -674,6 +1055,13 @@ function makePlugin(site) {
       p.api ??= api(site)
       p.models = { ...configModels(site), ...(p.models ?? {}) }
     },
+    // the conversation's id, which the chats below carry to WorkBuddy:
+    // magpie's (or OpenCode's) session for this request, when it names one
+    "chat.headers": async (input, output) => {
+      const id = input?.model?.providerID ?? input?.provider?.info?.id
+      if (id !== site.id || !input?.sessionID) return
+      output.headers[SESSION] = String(input.sessionID).slice(0, 128)
+    },
     provider: {
       id: site.id,
       // the account's own list, when it's signed in and WorkBuddy answers;
@@ -714,11 +1102,16 @@ function makePlugin(site) {
             headers.delete("authorization")
             headers.delete("x-api-key")
             headers.delete("content-length")
+            const session = sessionOf(headers)
             sign(site, a, headers)
             let body = init?.body
             if (body === undefined && req) body = await req.clone().text()
-            const res = await fetch(req ? req.url : input, { ...init, method: init?.method ?? req?.method, headers, body: withSystem(body) })
-            return res.status >= 400 ? explained(res) : kept(res)
+            body = withSystem(body)
+            const fit = fitted(body)
+            body = fit.body
+            attend(headers, body, session)
+            const res = await fetch(req ? req.url : input, { ...init, method: init?.method ?? req?.method, headers, body })
+            return res.status >= 400 ? explained(res) : kept(await renamed(res, fit.names))
           },
         }
       },
@@ -823,4 +1216,4 @@ export const WorkBuddyAuthPlugin = makePlugin(SITES.workbuddy)
 export const WorkBuddyAIAuthPlugin = makePlugin(SITES["workbuddy-ai"])
 
 // for tests
-export const _internal = { withSystem, unflagged, usageOf, desktopHeld, explained, REFUSED_HINT, EXHAUSTED_HINT, freeCredits, creditsOf, fresh, SITES, renewing, renewed }
+export const _internal = { withSystem, fitTools, fitted, renamed, unflagged, usageOf, desktopHeld, explained, REFUSED_HINT, EXHAUSTED_HINT, freeCredits, creditsOf, fresh, SITES, renewing, renewed, SESSION, attend, turnKey, conversationKey, signatureOf }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-workbuddy-auth",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "OpenCode provider plugins for WorkBuddy's plans: WorkBuddy (CodeBuddy, copilot.tencent.com) and WorkBuddy AI (www.workbuddy.ai)",
   "type": "module",
   "main": "./index.mjs",