@magpie-community/opencode-workbuddy-auth 0.1.16 → 0.1.18

package/README.md

@@ -24,7 +24,8 @@ The package exports `WorkBuddyAuthPlugin` (`workbuddy`) and
   - Windows: `~/AppData/Local/CodeBuddyExtension/…`
   - Linux: `~/.local/share/CodeBuddyExtension/…`
 
-  A sign-in the app keeps encrypted can't be read, and this way fails.
+  WorkBuddy 5.6 and later keep the sign-in encrypted, which only the app
+  opens, so this way fails there and says so: use the browser sign-in.
 
 A browser sign-in is kept as an OpenCode `oauth` auth: the access and
 refresh tokens, their expiry, the user id and the domain; desktop's as a

package/index.mjs

@@ -931,6 +931,19 @@ function readDesktop(site) {
   }
 }
 
+// notDesktop says why there is no desktop sign-in to use: WorkBuddy 5.6
+// and later seal its tokens at rest ({$wbEncrypted: 1, envelope}), which
+// only the app itself opens (plugins#18), so the browser sign-in is the way;
+// else the app isn't signed in.
+function notDesktop(site) {
+  try {
+    const t = JSON.parse(readFileSync(desktopFile(site), "utf8"))?.auth ?? {}
+    if (t.accessToken?.$wbEncrypted || t.refreshToken?.$wbEncrypted)
+      return `${site.name} desktop keeps its sign-in encrypted (WorkBuddy 5.6 and later), which magpie can't read; sign in with "${site.name} account (browser)" instead`
+  } catch {}
+  return `${site.name} desktop isn't signed in`
+}
+
 // desktopSignIn uses the account WorkBuddy desktop is signed in to: nothing
 // is copied (a copied refresh token would be the app's and the plugin's
 // both, and the first to use it would sign the other out); its file is
@@ -942,7 +955,7 @@ function desktopSignIn(site) {
     method: "auto",
     async callback() {
       const d = readDesktop(site)
-      if (!d) return { type: "failed", error: `${site.name} desktop isn't signed in` }
+      if (!d) return { type: "failed", error: notDesktop(site) }
       return { type: "success", refresh: "", access: "", expires: 0, source: "desktop", accountId: d.name || site.name, uid: d.uid }
     },
   }
@@ -957,7 +970,7 @@ const desktopHeld = new Map()
 async function current(site, client, auth) {
   if (auth?.source !== "desktop") return fresh(site, client, auth)
   const d = readDesktop(site)
-  if (!d) throw new Error(`${site.name} desktop isn't signed in`)
+  if (!d) throw new Error(notDesktop(site))
   const k = site.id + "|" + d.uid
   const h = desktopHeld.get(k)
   const a = await fresh(site, null, h && h.expires >= d.expires ? h : d)
@@ -1350,6 +1363,18 @@ const REFUSED_HINT =
   "WorkBuddy refuses chats from Codex and Claude Code (their system prompt); use it from Hermes, OpenCode or Pi, or add another provider to this group"
 const REFUSED = /unapproved channel|illegal api invocation/i
 
+// RESTRICTED_HINT is what the user can do about WorkBuddy's 403 code 11140
+// "request illegal", whose displayMsg says "Your account has been restricted
+// due to unusual activity" (magpie #1849): the account is out until WorkBuddy
+// lifts the restriction, which an appeal asks for. It ends the error's
+// message as magpie's built-in puts it (provider.WBRestrictedHint), word for
+// word, so magpie rests the account for hours rather than minutes.
+const RESTRICTED_HINT =
+  "WorkBuddy restricted this account for unusual activity; it stays out until WorkBuddy lifts that, which an appeal (Submit feedback in WorkBuddy) asks for"
+const RESTRICTED_CODE = 11140
+// The code is matched whole, as with 14018: 111400 is another error.
+const RESTRICTED_TEXT = /account has been restricted due to unusual activity|账号存在异常行为|帳號存在異常行為|["']code["']\s*:\s*["']?11140(?![\d.])/i
+
 // EXHAUSTED_HINT explains WorkBuddy's requirement of an active package
 // even for 0-rate / free models. When an account has no packages or 0 credits,
 // WorkBuddy returns code 14018 ("Credits exhausted...").
@@ -1367,7 +1392,7 @@ function kept(res) {
   return new Response(res.body, { status: res.status, statusText: res.statusText, headers })
 }
 
-// explained is res with REFUSED_HINT or EXHAUSTED_HINT added to that refusal's message.
+// explained is res with REFUSED_HINT, RESTRICTED_HINT or EXHAUSTED_HINT added to that refusal's message.
 // Each refusal says the sign-in is kept: the built-in passed WorkBuddy's
 // 401 on and never marked a WorkBuddy account lapsed.
 async function explained(res) {
@@ -1386,8 +1411,9 @@ async function explained(res) {
   const at = v?.error && typeof v.error === "object" ? v.error : v && typeof v === "object" ? v : null
   const code = at?.data?.code ?? at?.code ?? v?.code ?? v?.data?.code
   const isRefused = REFUSED.test(text)
-  const isExhausted = code === 14018 || Number(code) === 14018 || EXHAUSTED_TEXT.test(text)
-  if (!isRefused && !isExhausted) return again(text)
+  const isRestricted = !isRefused && (Number(code) === RESTRICTED_CODE || RESTRICTED_TEXT.test(text))
+  const isExhausted = !isRestricted && (code === 14018 || Number(code) === 14018 || EXHAUSTED_TEXT.test(text))
+  if (!isRefused && !isRestricted && !isExhausted) return again(text)
 
   let msg = text.trim()
   if (at && typeof at.message === "string") msg = at.message
@@ -1396,9 +1422,9 @@ async function explained(res) {
   else if (typeof v?.msg === "string" && v.msg) msg = v.msg // WorkBuddy's own {"code", "msg"}
   else if (typeof v?.data?.msg === "string") msg = v.data.msg
 
-  const hint = isRefused ? REFUSED_HINT : EXHAUSTED_HINT
-  const type = isRefused ? "permission_error" : "insufficient_quota"
-  const errCode = isRefused ? null : 14018
+  const hint = isRefused ? REFUSED_HINT : isRestricted ? RESTRICTED_HINT : EXHAUSTED_HINT
+  const type = isRefused || isRestricted ? "permission_error" : "insufficient_quota"
+  const errCode = isRefused ? null : isRestricted ? RESTRICTED_CODE : 14018
   msg = `${msg} — ${hint}`
   const headers = new Headers(res.headers)
   headers.set("content-type", "application/json")
@@ -1412,4 +1438,4 @@ export const WorkBuddyAuthPlugin = makePlugin(SITES.workbuddy)
 export const WorkBuddyAIAuthPlugin = makePlugin(SITES["workbuddy-ai"])
 
 // for tests
-export const _internal = { textOnly, runsOutOf, packagesOf, endOf, enterpriseHeaders, enterpriseOf, liveModels, browserSignIn, withSystem, normalizeToolChoice, fitTools, fitted, renamed, unflagged, usageOf, desktopHeld, explained, REFUSED_HINT, EXHAUSTED_HINT, freeCredits, creditsOf, fresh, SITES, renewing, renewed, SESSION, attend, turnKey, conversationKey, signatureOf }
+export const _internal = { notDesktop, textOnly, runsOutOf, packagesOf, endOf, enterpriseHeaders, enterpriseOf, liveModels, browserSignIn, withSystem, normalizeToolChoice, fitTools, fitted, renamed, unflagged, usageOf, desktopHeld, explained, REFUSED_HINT, RESTRICTED_HINT, EXHAUSTED_HINT, freeCredits, creditsOf, fresh, SITES, renewing, renewed, SESSION, attend, turnKey, conversationKey, signatureOf }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-workbuddy-auth",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "OpenCode provider plugins for WorkBuddy's plans: WorkBuddy (CodeBuddy, copilot.tencent.com) and WorkBuddy AI (www.workbuddy.ai)",
   "type": "module",
   "main": "./index.mjs",