@magpie-community/opencode-workbuddy-auth 0.1.11 → 0.1.13

package/README.md

@@ -43,6 +43,14 @@ included, doesn't mark the account, as the built-in never did; magpie
 tries again later, and the old token is used meanwhile.
 OpenCode doesn't call `auth.refresh`; the check before each request stays.
 
+An enterprise (team) account is asked for as the enterprise. A browser
+sign-in keeps the enterprise id WorkBuddy names for the account (from
+`/login/account`, else its account list), and desktop's is read from the
+app's file. Every request then carries `X-Enterprise-Id` and `X-Tenant-Id`,
+as WorkBuddy's own client sends them; without them WorkBuddy answers as the
+personal account, with the personal plan's models. A browser sign-in made
+before 0.1.13 has no enterprise id kept: sign in again.
+
 Desktop's sign-in is refreshed only when the app hasn't refreshed it
 itself, and the new token is kept in memory, never written back, as magpie's
 built-in WorkBuddy does.
@@ -74,6 +82,17 @@ Each chat carries WorkBuddy's headers:
 A chat that doesn't open with a system message is given WorkBuddy's
 default one, as the app does.
 
+A chat's tools are given shapes WorkBuddy's models take. Without them
+WorkBuddy AI answers 400 "Invalid request parameters" (11133), DeepSeek's
+models to each shape below and Kimi's, GPT's, Gemini's and GLM's to some:
+- a tool's parameters with no `type`, empty, or a union (`anyOf`, `oneOf`,
+  `allOf`) at the root are an object, the union's fields merged;
+- a `pattern`'s `\0` is `\u0000`, which matches the same;
+- a tuple's `items` (a list) is one schema any of them fits;
+- a tool's name with a character other than letters, digits, `_` and `-`
+  (`.`, `:`, `/`, a space, CJK) is sent with `_` there, and the model's
+  calls come back under the tool's own name.
+
 ## Models
 
 When you are signed in, the models are the ones WorkBuddy's product config

package/index.mjs

@@ -172,6 +172,7 @@ function renew(site, a, save) {
         "X-Refresh-Token": a.refresh,
         "X-Auth-Refresh-Source": "plugin",
         "X-Domain": domainOf(site, a),
+        ...enterpriseHeaders(a),
       }, {})
       if (!got?.accessToken) throw Object.assign(new Error("WorkBuddy gave no refreshed token"), { bare: true })
       const next = merge(a, got)
@@ -259,10 +260,48 @@ function sign(site, a, headers) {
   headers.set("X-Agent-Purpose", "conversation")
   headers.set("X-IDE-Name", "WorkBuddy")
   headers.set("X-IDE-Version", UA_VERSION)
+  for (const [k, v] of Object.entries(enterpriseHeaders(a))) headers.set(k, v)
   if (!site.ai) return
   headers.set("X-Agent-Type", "main")
 }
 
+// enterpriseHeaders names the enterprise (team) an account signed in as, as
+// WorkBuddy's own client does on every request it makes for that account
+// (its auth interceptor: X-Enterprise-Id and X-Tenant-Id, both the
+// account's enterpriseId). Without them WorkBuddy answers as the personal
+// account: /v3/config lists the personal plan's models and not the
+// enterprise's (#75). A personal account has none and sends none.
+function enterpriseHeaders(a) {
+  const id = typeof a?.enterpriseId === "string" ? a.enterpriseId.trim() : ""
+  return id ? { "X-Enterprise-Id": id, "X-Tenant-Id": id } : {}
+}
+
+// enterpriseOf is the enterprise the account a sign-in gave belongs to:
+// the one /login/account names, else, for an account that isn't personal,
+// the one WorkBuddy's account list has for it — the same choice WorkBuddy's
+// own client makes (mergeCurrentAccountDetails): the uid's only entry of that
+// type, or the only one it last signed in to. None found is personal.
+async function enterpriseOf(site, a, who) {
+  const own = typeof who?.enterpriseId === "string" ? who.enterpriseId.trim() : ""
+  if (own) return own
+  const type = String(who?.type ?? "").trim().toLowerCase()
+  if (!type || type === "personal") return ""
+  let list
+  try {
+    list = await call(site, "GET", "/v2/plugin/accounts", {
+      Authorization: "Bearer " + a.access,
+      "X-Domain": domainOf(site, a),
+    })
+  } catch {
+    return ""
+  }
+  const mine = (list?.accounts ?? []).filter((x) => x?.uid === who.uid && typeof x.enterpriseId === "string" && x.enterpriseId.trim())
+  const same = mine.filter((x) => String(x.type ?? "").trim().toLowerCase() === type)
+  const last = mine.filter((x) => x.lastLogin)
+  const pick = same.length === 1 ? same[0] : last.length === 1 ? last[0] : mine.length === 1 ? mine[0] : undefined
+  return pick ? pick.enterpriseId.trim() : ""
+}
+
 // WorkBuddy's own client names each chat to its gateway four ways: the
 // conversation it belongs to, the user send (turn) it answers, the message
 // itself, and the request that carried it. Its backend counts a user send as
@@ -468,6 +507,250 @@ function withSystem(body) {
   }
 }
 
+// ---- tools WorkBuddy takes ----------------------------------------------------
+
+// WorkBuddy AI answers 400 code 11133 "Invalid request parameters" (the
+// model provider rejected them) to a chat whose tools it can't pass on to
+// the model (wyh on magpie's Discord: ZCode and DeepSeek Harness on
+// deepseek-v4.1-flash). Tried on the owner's account, 2026-10-08: DeepSeek
+// turns away each of the shapes below, and Kimi, GPT, Gemini and GLM some
+// of them; MiniMax none. fitTools gives each a shape every model takes.
+// A tool's name may hold letters, digits, _ and -; another character
+// (". : / space", CJK) is refused.
+const NAME_OK = /^[A-Za-z0-9_-]+$/
+
+// safeName is name with each character WorkBuddy refuses as _, kept apart
+// from the names in taken.
+function safeName(name, taken) {
+  const base = String(name).replace(/[^A-Za-z0-9_-]/g, "_") || "tool"
+  let n = base
+  for (let i = 2; taken.has(n); i++) n = `${base}_${i}`
+  taken.add(n)
+  return n
+}
+
+// NUL_ESCAPE finds a regex's \0 (the NUL character), stepping over each \\
+// (a backslash) so that a \\0 is left; \01 is an octal escape, also left.
+const NUL_ESCAPE = /\\\\|\\0(?![0-9])/g
+
+// fitSchema mends a schema in place, at every depth: a pattern's \0, which
+// DeepSeek's validator says is "not a 'regex'", is \u0000, which matches
+// the same (magpie's gateway does this for DeepSeek's own API,
+// deepseekToolPatterns); a tuple's items (a list) become one schema any of
+// them fits. It reports whether it changed anything.
+function fitSchema(s, depth = 0) {
+  if (!s || typeof s !== "object" || depth > 64) return false
+  let changed = false
+  if (Array.isArray(s)) {
+    for (const v of s) if (fitSchema(v, depth + 1)) changed = true
+    return changed
+  }
+  if (typeof s.pattern === "string" && s.pattern.includes("\\0")) {
+    const p = s.pattern.replace(NUL_ESCAPE, (m) => (m === "\\\\" ? m : "\\u0000"))
+    if (p !== s.pattern) {
+      s.pattern = p
+      changed = true
+    }
+  }
+  if (Array.isArray(s.items)) {
+    const list = s.items.filter((v) => v && typeof v === "object")
+    s.items = list.length === 0 ? {} : list.length === 1 ? list[0] : { anyOf: list }
+    delete s.additionalItems
+    changed = true
+  }
+  for (const v of Object.values(s)) if (fitSchema(v, depth + 1)) changed = true
+  return changed
+}
+
+// localRef is the schema a local $ref in root names ("#/$defs/x",
+// "#/definitions/x"), or s itself.
+function localRef(root, s) {
+  const ref = s?.$ref
+  if (typeof ref !== "string" || !ref.startsWith("#/")) return s
+  let at = root
+  for (const k of ref.slice(2).split("/")) at = at?.[k.replaceAll("~1", "/").replaceAll("~0", "~")]
+  return at && typeof at === "object" ? at : s
+}
+
+// objectRoot makes a tool's parameters an object at the root, as magpie's
+// gateway does for xAI (provider.ObjectRoot): allOf's branches are merged
+// whole; of anyOf's and oneOf's object branches the properties are merged
+// and a field each requires stays required. A root with no type, or an
+// empty one, is an object. It reports whether it changed anything.
+function objectRoot(ps, root = ps, depth = 0) {
+  const unions = ["allOf", "anyOf", "oneOf"].filter((k) => Array.isArray(ps[k]))
+  if (ps.type === "object" && !unions.length) return false
+  const props = ps.properties && typeof ps.properties === "object" ? ps.properties : {}
+  const required = Array.isArray(ps.required) ? [...ps.required] : []
+  for (const b0 of ps.allOf ?? []) {
+    let b = localRef(root, b0)
+    if (!b || typeof b !== "object") continue
+    if (depth < 8 && ["allOf", "anyOf", "oneOf"].some((k) => Array.isArray(b[k]))) objectRoot((b = structuredClone(b)), root, depth + 1)
+    for (const [k, v] of Object.entries(b.properties ?? {})) if (!(k in props)) props[k] = v
+    if (Array.isArray(b.required)) required.push(...b.required)
+  }
+  const branches = []
+  for (const key of ["anyOf", "oneOf"]) {
+    for (const b0 of ps[key] ?? []) {
+      let b = localRef(root, b0)
+      if (!b || typeof b !== "object") continue
+      if (depth < 8 && ["allOf", "anyOf", "oneOf"].some((k) => Array.isArray(b[k]))) objectRoot((b = structuredClone(b)), root, depth + 1)
+      if (b.type !== "object" && !b.properties) continue
+      branches.push(b)
+    }
+  }
+  const from = new Map()
+  for (const b of branches) {
+    for (const [k, v] of Object.entries(b.properties ?? {})) {
+      if (k in props) continue
+      const seen = from.get(k) ?? []
+      if (!seen.some((x) => JSON.stringify(x) === JSON.stringify(v))) seen.push(v)
+      from.set(k, seen)
+    }
+  }
+  for (const [k, list] of from) props[k] = list.length === 1 ? list[0] : { anyOf: list }
+  if (branches.length) {
+    for (const k of Object.keys(branches[0].properties ?? {})) {
+      if (branches.every((b) => Array.isArray(b.required) && b.required.includes(k))) required.push(k)
+    }
+  }
+  for (const k of unions) delete ps[k]
+  ps.type = "object"
+  ps.properties = props
+  const req = [...new Set(required)].filter((k) => typeof k === "string" && k in props)
+  if (req.length) ps.required = req
+  else delete ps.required
+  return true
+}
+
+// fitTools mends b's function tools in place: their parameters (fitSchema,
+// objectRoot) and names. It reports whether it changed anything, and the
+// names it gave, each to the name the client knows (ours), so that the
+// model's calls are named back. A call in the chat's history is named as
+// its tool now is.
+function fitTools(b) {
+  const names = new Map()
+  if (!Array.isArray(b?.tools) || !b.tools.length) return { changed: false, names }
+  let changed = false
+  const taken = new Set()
+  for (const t of b.tools) {
+    const n = t?.function?.name
+    if (typeof n === "string" && NAME_OK.test(n)) taken.add(n)
+  }
+  const theirs = new Map()
+  for (const t of b.tools) {
+    const fn = t?.type === "function" || t?.function ? t.function : null
+    if (!fn || typeof fn !== "object") continue
+    if (typeof fn.name === "string" && !NAME_OK.test(fn.name)) {
+      const safe = safeName(fn.name, taken)
+      names.set(safe, fn.name)
+      theirs.set(fn.name, safe)
+      fn.name = safe
+      changed = true
+    }
+    if (fn.parameters === undefined) continue
+    if (!fn.parameters || typeof fn.parameters !== "object" || Array.isArray(fn.parameters)) {
+      fn.parameters = { type: "object", properties: {} }
+      changed = true
+      continue
+    }
+    if (fitSchema(fn.parameters)) changed = true
+    if (objectRoot(fn.parameters)) changed = true
+  }
+  if (theirs.size && Array.isArray(b.messages)) {
+    for (const m of b.messages) {
+      for (const c of Array.isArray(m?.tool_calls) ? m.tool_calls : []) {
+        const safe = theirs.get(c?.function?.name)
+        if (safe) c.function.name = safe
+      }
+      if (m?.role === "tool" && theirs.has(m.name)) m.name = theirs.get(m.name)
+    }
+  }
+  const choice = b.tool_choice?.function
+  if (choice && theirs.has(choice.name)) choice.name = theirs.get(choice.name)
+  return { changed, names }
+}
+
+// fitted is a chat body with its tools mended (fitTools), and the names
+// given its tools, each to the client's own; a body that isn't a chat is
+// as it was.
+function fitted(body) {
+  if (typeof body !== "string") return { body, names: new Map() }
+  try {
+    const b = JSON.parse(body)
+    const { changed, names } = fitTools(b)
+    return { body: changed ? JSON.stringify(b) : body, names }
+  } catch {
+    return { body, names: new Map() }
+  }
+}
+
+// namedBack gives the model's calls in a chat answer (one JSON body, or an
+// SSE stream's chunks) the names the client gave its tools.
+function namedBack(v, names) {
+  let changed = false
+  for (const c of Array.isArray(v?.choices) ? v.choices : []) {
+    for (const at of [c?.message, c?.delta]) {
+      for (const tc of Array.isArray(at?.tool_calls) ? at.tool_calls : []) {
+        const ours = names.get(tc?.function?.name)
+        if (ours) {
+          tc.function.name = ours
+          changed = true
+        }
+      }
+    }
+  }
+  return changed
+}
+
+// renamed is res with namedBack on its body, read as it comes.
+function renamed(res, names) {
+  if (!names.size || !res.body) return res
+  const headers = new Headers(res.headers)
+  headers.delete("content-length")
+  headers.delete("content-encoding")
+  const json = /json/i.test(res.headers.get("content-type") ?? "")
+  if (json) {
+    const out = res.text().then((text) => {
+      try {
+        const v = JSON.parse(text)
+        return namedBack(v, names) ? JSON.stringify(v) : text
+      } catch {
+        return text
+      }
+    })
+    return out.then((text) => new Response(text, { status: res.status, statusText: res.statusText, headers }))
+  }
+  const dec = new TextDecoder()
+  const enc = new TextEncoder()
+  let rest = ""
+  const line = (l) => {
+    const m = /^data:\s?(.*)$/.exec(l)
+    if (!m || m[1] === "[DONE]") return l
+    try {
+      const v = JSON.parse(m[1])
+      return namedBack(v, names) ? `data: ${JSON.stringify(v)}` : l
+    } catch {
+      return l
+    }
+  }
+  const body = res.body.pipeThrough(
+    new TransformStream({
+      transform(chunk, ctl) {
+        rest += dec.decode(chunk, { stream: true })
+        const lines = rest.split("\n")
+        rest = lines.pop()
+        if (lines.length) ctl.enqueue(enc.encode(lines.map(line).join("\n") + "\n"))
+      },
+      flush(ctl) {
+        rest += dec.decode()
+        if (rest) ctl.enqueue(enc.encode(line(rest)))
+      },
+    }),
+  )
+  return new Response(body, { status: res.status, statusText: res.statusText, headers })
+}
+
 // ---- signing in -------------------------------------------------------------
 
 // poll asks path until WorkBuddy answers with data, retrying the codes
@@ -515,6 +798,7 @@ async function browserSignIn(site) {
           "X-No-Enterprise-Id": "true",
         }, [12151], deadline)
         a.uid = who.uid ?? ""
+        a.enterpriseId = await enterpriseOf(site, a, who)
         return success(site, a, who.nickname || who.phoneNumber || who.uid)
       } catch (e) {
         return { type: "failed", error: e.message }
@@ -532,6 +816,7 @@ function success(site, a, name) {
     accountId: name || site.name,
     uid: a.uid ?? "",
     domain: a.domain ?? "",
+    ...(a.enterpriseId ? { enterpriseId: a.enterpriseId } : {}),
     ...(a.refreshExpiresAt ? { refreshExpiresAt: a.refreshExpiresAt } : {}),
     ...(a.tokenType ? { tokenType: a.tokenType } : {}),
   }
@@ -564,6 +849,7 @@ function readDesktop(site) {
       domain: typeof t.domain === "string" ? t.domain : "",
       tokenType: typeof t.tokenType === "string" ? t.tokenType : "",
       uid: acct.uid,
+      ...(typeof acct.enterpriseId === "string" && acct.enterpriseId.trim() ? { enterpriseId: acct.enterpriseId.trim() } : {}),
       name: acct.nickname || acct.phoneNumber || acct.uid,
     }
   } catch {
@@ -636,7 +922,7 @@ async function meter(site, a, path) {
     method: "POST",
     headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": "WorkBuddy/" + UA_VERSION,
       Authorization: "Bearer " + a.access, "X-User-Id": a.uid ?? "", "X-Domain": domainOf(site, a), "X-Product": "SaaS",
-      "X-IDE-Type": "WorkBuddy" },
+      "X-IDE-Type": "WorkBuddy", ...enterpriseHeaders(a) },
     body: "{}",
     signal: AbortSignal.timeout(20000),
   })
@@ -863,9 +1149,11 @@ function makePlugin(site) {
             let body = init?.body
             if (body === undefined && req) body = await req.clone().text()
             body = withSystem(body)
+            const fit = fitted(body)
+            body = fit.body
             attend(headers, body, session)
             const res = await fetch(req ? req.url : input, { ...init, method: init?.method ?? req?.method, headers, body })
-            return res.status >= 400 ? explained(res) : kept(res)
+            return res.status >= 400 ? explained(res) : kept(await renamed(res, fit.names))
           },
         }
       },
@@ -970,4 +1258,4 @@ export const WorkBuddyAuthPlugin = makePlugin(SITES.workbuddy)
 export const WorkBuddyAIAuthPlugin = makePlugin(SITES["workbuddy-ai"])
 
 // for tests
-export const _internal = { withSystem, unflagged, usageOf, desktopHeld, explained, REFUSED_HINT, EXHAUSTED_HINT, freeCredits, creditsOf, fresh, SITES, renewing, renewed, SESSION, attend, turnKey, conversationKey, signatureOf }
+export const _internal = { enterpriseHeaders, enterpriseOf, liveModels, browserSignIn, withSystem, fitTools, fitted, renamed, unflagged, usageOf, desktopHeld, explained, REFUSED_HINT, EXHAUSTED_HINT, freeCredits, creditsOf, fresh, SITES, renewing, renewed, SESSION, attend, turnKey, conversationKey, signatureOf }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-workbuddy-auth",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "OpenCode provider plugins for WorkBuddy's plans: WorkBuddy (CodeBuddy, copilot.tencent.com) and WorkBuddy AI (www.workbuddy.ai)",
   "type": "module",
   "main": "./index.mjs",