@magpie-community/opencode-workbuddy-auth 0.1.17 → 0.1.19

package/README.md

@@ -24,7 +24,8 @@ The package exports `WorkBuddyAuthPlugin` (`workbuddy`) and
   - Windows: `~/AppData/Local/CodeBuddyExtension/…`
   - Linux: `~/.local/share/CodeBuddyExtension/…`
 
-  A sign-in the app keeps encrypted can't be read, and this way fails.
+  WorkBuddy 5.6 and later keep the sign-in encrypted, which only the app
+  opens, so this way fails there and says so: use the browser sign-in.
 
 A browser sign-in is kept as an OpenCode `oauth` auth: the access and
 refresh tokens, their expiry, the user id and the domain; desktop's as a
@@ -133,6 +134,12 @@ client reads. The daily Free Plan slice isn't counted: it ends at the same
 midnight on every account. magpie's smart routing spends the account whose
 credits run out first.
 
+An enterprise (team) account's resource summary lists no packages. Its
+credits are read from the enterprise meter
+(`/billing/meter/get-enterprise-user-usage`), the one WorkBuddy's own usage
+page reads: the cycle's credits used of its limit, and when the cycle
+resets (magpie #1904).
+
 ## Not here
 
 magpie's built-in WorkBuddy does more than this package:

package/index.mjs

@@ -931,6 +931,19 @@ function readDesktop(site) {
   }
 }
 
+// notDesktop says why there is no desktop sign-in to use: WorkBuddy 5.6
+// and later seal its tokens at rest ({$wbEncrypted: 1, envelope}), which
+// only the app itself opens (plugins#18), so the browser sign-in is the way;
+// else the app isn't signed in.
+function notDesktop(site) {
+  try {
+    const t = JSON.parse(readFileSync(desktopFile(site), "utf8"))?.auth ?? {}
+    if (t.accessToken?.$wbEncrypted || t.refreshToken?.$wbEncrypted)
+      return `${site.name} desktop keeps its sign-in encrypted (WorkBuddy 5.6 and later), which magpie can't read; sign in with "${site.name} account (browser)" instead`
+  } catch {}
+  return `${site.name} desktop isn't signed in`
+}
+
 // desktopSignIn uses the account WorkBuddy desktop is signed in to: nothing
 // is copied (a copied refresh token would be the app's and the plugin's
 // both, and the first to use it would sign the other out); its file is
@@ -942,7 +955,7 @@ function desktopSignIn(site) {
     method: "auto",
     async callback() {
       const d = readDesktop(site)
-      if (!d) return { type: "failed", error: `${site.name} desktop isn't signed in` }
+      if (!d) return { type: "failed", error: notDesktop(site) }
       return { type: "success", refresh: "", access: "", expires: 0, source: "desktop", accountId: d.name || site.name, uid: d.uid }
     },
   }
@@ -957,7 +970,7 @@ const desktopHeld = new Map()
 async function current(site, client, auth) {
   if (auth?.source !== "desktop") return fresh(site, client, auth)
   const d = readDesktop(site)
-  if (!d) throw new Error(`${site.name} desktop isn't signed in`)
+  if (!d) throw new Error(notDesktop(site))
   const k = site.id + "|" + d.uid
   const h = desktopHeld.get(k)
   const a = await fresh(site, null, h && h.expires >= d.expires ? h : d)
@@ -1043,6 +1056,25 @@ function usageOf(sum, plan) {
   return out
 }
 
+// enterpriseUsageOf is an enterprise (team) account's credits, from
+// /billing/meter/get-enterprise-user-usage, the meter WorkBuddy's own usage
+// page (www.workbuddy.cn/profile/usage) reads for one (magpie #1904,
+// CnsMaple): the resource summary answers such an account with no
+// packages at all. It counts the cycle's credits flat — credit used of
+// limitNum — and when the cycle began and resets (UTC+8). null when it
+// grants none.
+function enterpriseUsageOf(u) {
+  const limit = capacity(u?.limitNum)
+  if (!(limit > 0)) return null
+  const used = capacity(u?.credit)
+  const w = { name: "Credits", used: (100 * used) / limit, display: `${compact(used)} / ${compact(limit)}`, amount: used, limit, unit: "credits" }
+  const at = (v) => (typeof v === "string" && /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(v.trim()) ? Date.parse(v.trim().replace(" ", "T") + "+08:00") : 0)
+  const reset = at(u?.cycleResetTime), start = at(u?.cycleStartTime)
+  if (reset > 0) w.resetsAt = new Date(reset).toISOString()
+  if (reset > start && start > 0) w.span = (reset - start) / 1000
+  return w
+}
+
 // The packages' codes, as WorkBuddy's own client lists them when it asks
 // for each package's credits (its COMMODITY_CODES): the API refuses a
 // detail list without them (10001 "PackageCodes required").
@@ -1312,6 +1344,17 @@ function makePlugin(site) {
           // the meter has no /v2 prefix, on either site
           const sum = await meter(site, a, "/billing/meter/get-user-resource-summary")
           const out = usageOf(sum, auth.plan)
+          // an enterprise account's summary has no packages: its credits
+          // are the enterprise meter's (#1904). A personal account's
+          // refusal of it (10001 "uid or enterpriseID is empty") leaves
+          // the card as the summary said.
+          if (!out.windows.length) {
+            let ent = null
+            try {
+              ent = enterpriseUsageOf(await meter(site, a, "/billing/meter/get-enterprise-user-usage"))
+            } catch {}
+            if (ent) return { plan: auth.plan || "Enterprise", windows: [ent], signIn: "kept" }
+          }
           // when the credits left run out, for routing to spend them first;
           // a list that can't be read leaves it unknown, the card stands
           const credits = out.windows.find((w) => w.name === "Credits")
@@ -1425,4 +1468,4 @@ export const WorkBuddyAuthPlugin = makePlugin(SITES.workbuddy)
 export const WorkBuddyAIAuthPlugin = makePlugin(SITES["workbuddy-ai"])
 
 // for tests
-export const _internal = { textOnly, runsOutOf, packagesOf, endOf, enterpriseHeaders, enterpriseOf, liveModels, browserSignIn, withSystem, normalizeToolChoice, fitTools, fitted, renamed, unflagged, usageOf, desktopHeld, explained, REFUSED_HINT, RESTRICTED_HINT, EXHAUSTED_HINT, freeCredits, creditsOf, fresh, SITES, renewing, renewed, SESSION, attend, turnKey, conversationKey, signatureOf }
+export const _internal = { enterpriseUsageOf, notDesktop, textOnly, runsOutOf, packagesOf, endOf, enterpriseHeaders, enterpriseOf, liveModels, browserSignIn, withSystem, normalizeToolChoice, fitTools, fitted, renamed, unflagged, usageOf, desktopHeld, explained, REFUSED_HINT, RESTRICTED_HINT, EXHAUSTED_HINT, freeCredits, creditsOf, fresh, SITES, renewing, renewed, SESSION, attend, turnKey, conversationKey, signatureOf }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-workbuddy-auth",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "OpenCode provider plugins for WorkBuddy's plans: WorkBuddy (CodeBuddy, copilot.tencent.com) and WorkBuddy AI (www.workbuddy.ai)",
   "type": "module",
   "main": "./index.mjs",