@magpie-community/opencode-workbuddy-auth 0.1.45 → 0.1.47

package/README.md

@@ -126,8 +126,8 @@ Each chat carries WorkBuddy's headers:
 - `Authorization`, `X-User-Id`, `X-Domain`, `X-Product: SaaS`, `X-IDE-Type: WorkBuddy`;
 - the desktop CLI's `User-Agent`, `WorkBuddy/<app> <appName>/<app> CLI/<cli>`:
   `WorkBuddy/5.9.3 WorkBuddy/5.9.3 CLI/2.165.0` on the China build and
-  `WorkBuddy/5.8.4 workbuddy-ai/5.8.4 CLI/2.161.0` on WorkBuddy AI, each
-  build's current app on 2026-10-28; `X-IDE-Version` is the app's version.
+  `WorkBuddy/5.9.3 workbuddy-ai/5.9.3 CLI/2.165.0` on WorkBuddy AI, each
+  build's current app on 2026-10-29; `X-IDE-Version` is the app's version.
   A User-Agent not starting `WorkBuddy/<version>` is answered error 10085;
 - the client's, which WorkBuddy's usage list shows as the client that asked
   (使用端): `X-Agent-Purpose: conversation`, `X-IDE-Name: WorkBuddy`,
@@ -137,14 +137,17 @@ Each chat carries WorkBuddy's headers:
 - the conversation's ids: `X-Conversation-ID`, `X-Conversation-Request-ID`,
   `X-Conversation-Message-ID`, `X-Request-ID`. WorkBuddy's backend counts a
   user send as one request by `X-Conversation-Request-ID`, so every step of
-  one send — a tool result sent back, a retry, another account answering —
-  carries the same one, and the user's next message carries another. The
+  one send — a tool result sent back, a retry — carries the same one, and
+  the user's next message carries another. Both ids are one account's own,
+  as WorkBuddy's client is signed in as one: a conversation sent as another
+  account (another of a group, or a sign-in saved since) carries that
+  account's ids, never the same ones under two `X-User-Id`s. The
   conversation's is the session magpie (or OpenCode) names the request by,
   else the chat's first user message; nothing is made up when neither names
   one, a made-up conversation of the request's own being what splits one
   conversation into many in the usage detail;
 - what the CLI adds to a model request alone: `X-Agent-Type: main` on both
-  builds, `X-Agent-Runtime: local-agent` on the China build (new in 5.9),
+  builds, `X-Agent-Runtime: local-agent` (new in 5.9),
   `Accept: application/json`, and the `X-Stainless-*` headers of the OpenAI
   SDK it sends through (openai 6.25.0 on Electron 37's Node v22.21.1, a
   1200s timeout, no retries).

package/index.mjs

@@ -92,11 +92,15 @@ const SITES = {
     authID: "workbuddy-desktop-ai",
     platform: "workbuddy-ai",
     ai: true,
-    // WorkBuddy AI 5.8.4.41366630, its update feed's current build on
-    // 2026-10-28 (see the China build's)
-    app: "5.8.4",
-    cli: "2.161.0",
+    // WorkBuddy AI 5.9.3.42398134, its update feed's current build on
+    // 2026-10-29 (see the China build's): the same CLI as the China
+    // build's 5.9.3, byte for byte but for product.json, and the same
+    // Electron (37.10.3); its desktop puts agentRuntime local-agent in the
+    // prompt meta as the China build's does
+    app: "5.9.3",
+    cli: "2.165.0",
     appName: "workbuddy-ai",
+    runtime: "local-agent",
     keys: "https://www.workbuddy.ai/profile/keys",
     models: AI_MODELS,
     // models whose images WorkBuddy AI drops though its config says they
@@ -442,7 +446,7 @@ async function enterpriseOf(site, a, who) {
 // itself, and the request that carried it. Its backend counts a user send as
 // one request by X-Conversation-Request-ID: a chat carrying a new one every
 // time is counted on its own, so one send that takes several steps — a tool
-// call answered and sent again, a retry, another account answering — shows up
+// call answered and sent again, a retry — shows up
 // in the usage detail as many requests. The ids below are made from what
 // names the conversation and the turn, so every step of one send carries the
 // same turn id and the user's next message carries another, as WorkBuddy's
@@ -715,22 +719,64 @@ function sessionOf(headers) {
 // turn's (one user send, whatever it takes), and the conversation's. A header
 // already there — the caller's own, or another plugin's — is kept, and the
 // message and request ids are the same one, as WorkBuddy's client has them.
-function attend(headers, body, session) {
-  attendChat(headers, chatOf(body), session)
+//
+// who is the account the chat goes as (scopeOf). The ids are that account's
+// own: WorkBuddy's client runs as one account, so one conversation or turn
+// never shows up under two. Without it, one magpie session spread over a
+// group of accounts sent the same X-Conversation-ID and
+// X-Conversation-Request-ID under every account's X-User-Id.
+function attend(headers, body, session, who = "") {
+  return attendChat(headers, chatOf(body), session, who)
+}
+
+// attendChat is attend with the chat read already. It returns what reattend
+// needs to set the ids again for another account once the chat itself is
+// let go: the ids it set itself (not the caller's), and the digests of what
+// names the turn and the conversation, which are never sent as they are.
+function attendChat(headers, chat, session, who = "") {
+  const conv = conversationParts(chat, session)
+  const turn = turnParts(chat)
+  const ids = {
+    set: [],
+    // a turn is a conversation's own: two conversations whose user message
+    // reads the same are still two sends, not one
+    turn: turn.length ? idFor("turn", [...conv, "|", ...turn]) : "",
+    conv: conv.length ? idFor("conversation", conv) : "",
+  }
+  return setIds(headers, ids, who)
 }
 
-function attendChat(headers, chat, session) {
-  const conv = conversationParts(chat, session)
+// setIds sets the message's id, and the turn's and conversation's for the
+// account who, where the caller set none.
+function setIds(headers, ids, who) {
   const msg = hex()
   headers.set("X-Conversation-Message-ID", msg)
   headers.set("X-Request-ID", msg)
+  const set = []
+  const own = (kind, base) => (who ? idFor(kind, [`account:${who}`, "|", base]) : base)
   if (!headers.has("X-Conversation-Request-ID")) {
-    const turn = turnParts(chat)
-    // a turn is a conversation's own: two conversations whose user message
-    // reads the same are still two sends, not one
-    headers.set("X-Conversation-Request-ID", turn.length ? idFor("turn", [...conv, "|", ...turn]) : hex())
+    headers.set("X-Conversation-Request-ID", ids.turn ? own("turn", ids.turn) : hex())
+    set.push("X-Conversation-Request-ID")
+  }
+  if (ids.conv && !headers.has("X-Conversation-ID")) {
+    headers.set("X-Conversation-ID", own("conversation", ids.conv))
+    set.push("X-Conversation-ID")
   }
-  if (conv.length && !headers.has("X-Conversation-ID")) headers.set("X-Conversation-ID", idFor("conversation", conv))
+  return { ...ids, set }
+}
+
+// scopeOf names the account a chat goes as for attend: its uid, its
+// enterprise, and for a key account the key (only ever hashed).
+function scopeOf(a) {
+  return `${a?.uid ?? ""}|${a?.enterpriseId ?? ""}|${a?.source === "key" ? a.key ?? "" : ""}`
+}
+
+// reattend sets a chat's ids again for the account it is now sent as, when
+// that is another account than the one they were set for.
+function reattend(headers, ids, was, now) {
+  if (was === now) return ids
+  for (const h of ids.set) headers.delete(h)
+  return setIds(headers, ids, now)
 }
 
 // FLAGGED are the words WorkBuddy refuses a chat for, "Illegal API
@@ -1328,7 +1374,7 @@ function fitted(body) {
 
 // gzipped is a chat's body compressed, as WorkBuddy's own client sends its
 // model requests: its CLI's GzipRequestProcessor (WorkBuddy 5.9.3, CLI
-// 2.165.0; WorkBuddy AI 5.8.4 the same) gzips each POST's body and sets
+// 2.165.0, on both builds) gzips each POST's body and sets
 // Content-Encoding: gzip when the product's RequestBodyGzip feature is on,
 // which both builds' product.json turn on and /v3/config (merged over it)
 // doesn't turn off. Sent as plain JSON, a long agent conversation went up
@@ -2506,7 +2552,8 @@ function makePlugin(site) {
             const completion = !native && isCompletion(req ? req.url : input, chat)
             if (completion && chat && !namesEffort(chat) && withDefaultEffort(chat, await effortList(a))) changed = true
             chatHeaders(site, headers)
-            attendChat(headers, chat, session)
+            let who = scopeOf(a)
+            let ids = attendChat(headers, chat, session, who)
             const post = (b) => {
               // a chat goes gzipped, as WorkBuddy's client sends it
               // (gzipped); its size on the wire is what unanswered weighs
@@ -2553,6 +2600,7 @@ function makePlugin(site) {
               renewed = true
               a = r.a
               sign(site, a, headers)
+              ids = reattend(headers, ids, who, (who = scopeOf(a)))
               const again = await post(b)
               if (again.status !== 401) return again
               return out("it refused the token renewed for it too", invalidToken(again), again)
@@ -2801,4 +2849,4 @@ export const WorkBuddyAuthPlugin = makePlugin(SITES.workbuddy)
 export const WorkBuddyAIAuthPlugin = makePlugin(SITES["workbuddy-ai"])
 
 // for tests
-export const _internal = { idFor, replyAfterToolsOn, withDefaultEffort, defaultEffortOf, gzipped, FREE_ONLY, PRICE_TTL, keyAccount, remoteConfig, cycleOf, typeUnions, systemAsUser, systemKey, DEFAULT_SYSTEM, EDGE_READS, fitShape, replyAfterTools, AFTER_TOOLS_REFUSED, enterpriseUsageOf, notDesktop, textOnly, runsOutOf, packagesOf, endOf, enterpriseHeaders, enterpriseOf, liveModels, browserSignIn, withSystem, asReasoning, normalizeToolChoice, fitTools, fitted, renamed, unflagged, usageOf, desktopHeld, explained, REFUSED_HINT, RESTRICTED_HINT, EXHAUSTED_HINT, freeCredits, creditsOf, priceOf, fresh, SITES, renewing, renewed, SESSION, attend, turnKey, conversationKey, signatureOf, isMessages, withoutUnsigned, withoutSignedThinking, prepared, answeredBefore, nativeOf, modelOf, configModels, API_MESSAGES: NPM_MESSAGES, API_CHAT: NPM }
+export const _internal = { idFor, replyAfterToolsOn, withDefaultEffort, defaultEffortOf, gzipped, FREE_ONLY, PRICE_TTL, keyAccount, remoteConfig, cycleOf, typeUnions, systemAsUser, systemKey, DEFAULT_SYSTEM, EDGE_READS, fitShape, replyAfterTools, AFTER_TOOLS_REFUSED, enterpriseUsageOf, notDesktop, textOnly, runsOutOf, packagesOf, endOf, enterpriseHeaders, enterpriseOf, liveModels, browserSignIn, withSystem, asReasoning, normalizeToolChoice, fitTools, fitted, renamed, unflagged, usageOf, desktopHeld, explained, REFUSED_HINT, RESTRICTED_HINT, EXHAUSTED_HINT, freeCredits, creditsOf, priceOf, fresh, SITES, renewing, renewed, SESSION, attend, scopeOf, turnKey, conversationKey, signatureOf, isMessages, withoutUnsigned, withoutSignedThinking, prepared, answeredBefore, nativeOf, modelOf, configModels, API_MESSAGES: NPM_MESSAGES, API_CHAT: NPM }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-workbuddy-auth",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "description": "OpenCode provider plugins for WorkBuddy's plans: WorkBuddy (CodeBuddy, copilot.tencent.com) and WorkBuddy AI (www.workbuddy.ai)",
   "type": "module",
   "main": "./index.mjs",