@magpie-community/opencode-workbuddy-auth 0.2.12 → 0.2.14

package/README.md

@@ -399,6 +399,14 @@ What is measured, and what is easy to read wrongly:
   429 whose named reset is still ahead makes the window full — `used: 100`,
   `resetsAt` the reset the vendor named — whatever the rows add up to. The
   sum carries the window only until the first refusal.
+- **The sum is shown, not routed on.** Until the vendor refuses, the card is
+  set aside (`aside: true`): magpie draws it beside the account and never
+  counts it as the account's allowance, so an estimate near its cap does not
+  stop the model. The refusal's card does (`refused: true`), and magpie's
+  gateway rests this model alone on this account until the reset the
+  refusal names. Before 0.2.14 the sum stopped the model too, and a paid
+  China account read 99% of a cap it had never been refused at, with 2,457
+  credits left (plugins#641).
 - **The card names both ids**, `deepseek-v4.1-flash` and
   `deepseek-v4.1-flash-sg`: magpie matches a window's models by exact id
   (only an `@size` suffix folds into the bare id), so one alone would leave
@@ -435,10 +443,10 @@ exhausted, and the next request opens a fresh one. The China build
 (`copilot.tencent.com`) carries the same window: two Free-plan accounts
 refused on 2026-11-02 at 200,389,043 and 200,485,923 tokens, so its cap is
 measured at about 2e8 — and its refusals name the reset in Chinese
-(`将在 … UTC+8 重置`), which reads as an edge the same way. Its card stops
-at a **soft cap of 1.9e8**, 5% short of the measured one, so routing rests
-the model before the vendor refuses it; the headroom absorbs the account's
-spending on other machines, which this ledger cannot see.
+(`将在 … UTC+8 重置`), which reads as an edge the same way. Its card reads
+against 2e8. In 0.2.12 and 0.2.13 it read against a soft cap of 1.9e8, so
+that routing rested the model before the vendor refused it; with the sum set
+aside that headroom only stopped the model early, so it is gone.
 
 ## When free models work but a credit model does not
 

package/index.mjs

@@ -2276,6 +2276,17 @@ const compact = (n) => (Number.isInteger(n) ? String(n) : n.toFixed(2).replace(/
 //     full whatever the sum says. That is the one exact signal there is,
 //     and routing must not pass over it either.
 //
+// So the sum is an estimate, and it is shown, not routed on: its card is set
+// aside (aside: true), which magpie draws beside the account and never counts
+// as its allowance. Only a refusal's card stops the model. The estimate used
+// to stop it as well, and it read a paid China account at 99% of a cap it had
+// never been refused at, with 2,457 credits left (XiaoFeiyu9, plugins#641):
+// the cap is two accounts' measurement, the ledger is one machine's, and
+// neither is the vendor's word for this account. Nothing is lost by waiting
+// for that word: magpie's gateway reads the refusal's reset ("将在 … 重置",
+// "reset at …") and its "switch to the other models", and rests this model
+// alone, on this account alone, until the time the vendor named.
+//
 // The ledger is magpie's own, in magpie's config folder (appdir.Config()):
 // the folder the plugin host runs in, which is the portable data folder
 // when magpie runs portable, $XDG_CONFIG_HOME/magpie when that is set, and
@@ -2287,12 +2298,12 @@ const compact = (n) => (Number.isInteger(n) ? String(n) : n.toFixed(2).replace(/
 // caps: the same phone number can be signed in to both, and their ledgers
 // stay apart — one build's spending must not fill the other's window.
 //
-// The China cap is a soft one. Measured at about 2e8 (two accounts refusing
-// at 200.39M and 200.49M), the card stops the model at 1.9e8: 5% of headroom
-// for the account's spending on other machines (which this ledger cannot
-// see), so routing rests the model before the vendor's refusal does. A
-// refusal in force still reads the window full whatever the sum says.
-const FREE_WINDOW_CN = { provider: "workbuddy", cap: 1.9e8, short: "190M" }
+// The China cap is the measured one, 2e8 (two accounts refused at 200.39M
+// and 200.49M). It was a soft 1.9e8 in 0.2.12 and 0.2.13, so that routing
+// rested the model before the vendor refused it; since the sum is set aside
+// (freeWindowOf's card), the cap only scales what the card says, and the
+// headroom bought nothing but a model stopped 10M tokens early (plugins#641).
+const FREE_WINDOW_CN = { provider: "workbuddy", cap: 2e8, short: "200M" }
 const FREE_WINDOW_AI = { provider: "workbuddy-ai", cap: 1e8, short: "100M" }
 const FREE_WINDOW_SPAN = 24 * 3600 * 1000
 // The lead: how far back of an edge the read goes on. A chain read from a row
@@ -2438,7 +2449,9 @@ function freeWindowOf(rows, account, now = Date.now(), win = FREE_WINDOW_AI) {
     resetsAt: new Date(resetsAt).toISOString(),
     span: FREE_WINDOW_SPAN / 1000,
     models: FREE_WINDOW_MODELS.slice(),
-    ...(refused ? { refused: true } : {}),
+    // the ledger's sum is an estimate, shown and set aside; the vendor's
+    // refusal is the one that stops the model (see the window above)
+    ...(refused ? { refused: true } : { aside: true }),
   })
 
   // A refusal still in force is exact: the account is spending this window
@@ -2674,7 +2687,7 @@ function readLedgerTail(path, st, now, chunks, account, win = FREE_WINDOW_AI) {
     let carry = ""
     let firstPass = true
     let stop = false
-    let chain = [] // this account's own rows read, latest first
+    const edge = pinning() // where this account's own rows read so far say the chain is read from
     let reach = 0 // the row below which nothing is kept: 0 until an edge is found
     let answered = false // whether an answered free-model row of it is read
 
@@ -2717,9 +2730,8 @@ function readLedgerTail(path, st, now, chunks, account, win = FREE_WINDOW_AI) {
         }
         if (!ofAccount(row, account, win)) continue
         rev.push(row)
-        chain.push(row)
         if (Number(row.status) === 200) answered = true
-        if (!reach && Number(row.status) !== 429) reach = pinned(chain, account)
+        if (!reach) reach = edge(row)
       }
       firstPass = false
     }
@@ -2787,6 +2799,51 @@ function pinned(rows, account) {
   return 0
 }
 
+// pinning is pinned read a row at a time: it is handed the account's own
+// rows latest first, as readLedgerTail reads them, and answers each with what
+// pinned would answer for every row handed so far — in constant time.
+//
+// readLedgerTail used to call pinned on its whole chain after each row, and
+// pinned walks the chain, so a chain with no edge in it cost the square of
+// its rows: 10.5 s for 16,000 rows on mote, a minute and more for an account
+// a server spends on all day (a call a minute is 43,000 rows in a month).
+// That ran on the plugin host's one thread at every usage read, and the
+// ledger changes with every call, so nothing held it over: the host sat at
+// 99% CPU and every session through it stalled (xmoon76 on Discord, the
+// China build's window being read since 0.2.12).
+//
+// It holds because the rows only ever grow at their oldest end, and pinned
+// was asked only while it answered 0 — no readable refusal and no day's gap
+// among the rows so far — so the one new thing a row can bring is:
+//
+//   - a refusal with a readable reset: the newest such is the first read,
+//     and pinned answers it whatever else the rows hold, once a row that is
+//     not a refusal follows (readLedgerTail asked pinned for those alone);
+//   - a day's gap between it and the oldest answered row before it, the only
+//     pair of answered rows not already looked at. pinned answers that with
+//     the older row of the pair, this one.
+function pinning() {
+  let denied = null // the newest readable refusal's reset
+  let oldest = null // the oldest answered row's time so far
+  return (row) => {
+    const status = Number(row?.status)
+    if (status === 429) {
+      if (denied === null) {
+        const reset = windowReset(row.err)
+        if (Number.isFinite(reset)) denied = reset
+      }
+      return 0
+    }
+    if (denied !== null) return denied - FREE_WINDOW_LEAD
+    if (status !== 200) return 0
+    const t = Date.parse(row?.t)
+    if (!Number.isFinite(t)) return 0
+    if (oldest !== null && oldest - t >= FREE_WINDOW_GAP) return t - FREE_WINDOW_LEAD
+    oldest = t
+    return 0
+  }
+}
+
 // _internal is where these are handed to a test: magpie's host calls every
 // exported function of a plugin as one of its own factories (host.js,
 // servers()), so freeWindowRows et al. must not be exports of the plugin.
@@ -3744,9 +3801,8 @@ function makePlugin(site) {
           // the free model's own window, which the credit meter above does
           // not show: what actually refuses a chat long before 160 credits
           // are spent. Both builds: WorkBuddy AI at 1e8 (ten days of
-          // refusals), the China build's refusals measured at about 2e8 on
-          // 2026-11-02, its card stopping at the 1.9e8 soft cap (see the
-          // window definitions above)
+          // refusals), the China build's at about 2e8 (2026-11-02). Set
+          // aside until the vendor refuses (see the window definitions above)
           {
             const account = a.accountId || a.user || a.uid || ""
             const win = site.ai ? FREE_WINDOW_AI : FREE_WINDOW_CN
@@ -3896,4 +3952,4 @@ export const WorkBuddyAuthPlugin = makePlugin(SITES.workbuddy)
 export const WorkBuddyAIAuthPlugin = makePlugin(SITES["workbuddy-ai"])
 
 // for tests
-export const _internal = { planCodes, idFor, OFF_TAKEN, replyAfterToolsOn, withDefaultEffort, defaultEffortOf, gzipped, FREE_ONLY, PRICE_TTL, keyAccount, remoteConfig, cycleOf, typeUnions, systemAsUser, systemKey, DEFAULT_SYSTEM, EDGE_READS, fitShape, replyAfterTools, AFTER_TOOLS_REFUSED, enterpriseUsageOf, accountName, notDesktop, textOnly, runsOutOf, packagesOf, endOf, enterpriseHeaders, enterpriseOf, liveModels, browserSignIn, withSystem, asReasoning, normalizeToolChoice, fitTools, fitted, renamed, unsaid, FILTER_SAYS, unflagged, usageOf, desktopHeld, explained, REFUSED_HINT, RESTRICTED_HINT, EXHAUSTED_HINT, REFUSED_DOC, commaPaused, commaPausedOn, opened, freeCredits, creditsOf, priceOf, fresh, SITES, renewing, renewed, SESSION, attend, scopeOf, turnKey, conversationKey, signatureOf, isMessages, withoutUnsigned, withoutSignedThinking, prepared, answeredBefore, nativeOf, modelOf, configModels, freeWindowOf, tokensShort, freeWindowRows, freeWindowLedger, readLedgerTail, pinned, rowTime, rowAccount, ofAccount, windowOffset, windowReset, FREE_WINDOW_MODELS, FREE_WINDOW_CN, FREE_WINDOW_AI, FREE_WINDOW_SPAN, FREE_WINDOW_GAP, FREE_WINDOW_LEAD, checkinOf, API_MESSAGES: NPM_MESSAGES, API_CHAT: NPM }
+export const _internal = { planCodes, idFor, OFF_TAKEN, replyAfterToolsOn, withDefaultEffort, defaultEffortOf, gzipped, FREE_ONLY, PRICE_TTL, keyAccount, remoteConfig, cycleOf, typeUnions, systemAsUser, systemKey, DEFAULT_SYSTEM, EDGE_READS, fitShape, replyAfterTools, AFTER_TOOLS_REFUSED, enterpriseUsageOf, accountName, notDesktop, textOnly, runsOutOf, packagesOf, endOf, enterpriseHeaders, enterpriseOf, liveModels, browserSignIn, withSystem, asReasoning, normalizeToolChoice, fitTools, fitted, renamed, unsaid, FILTER_SAYS, unflagged, usageOf, desktopHeld, explained, REFUSED_HINT, RESTRICTED_HINT, EXHAUSTED_HINT, REFUSED_DOC, commaPaused, commaPausedOn, opened, freeCredits, creditsOf, priceOf, fresh, SITES, renewing, renewed, SESSION, attend, scopeOf, turnKey, conversationKey, signatureOf, isMessages, withoutUnsigned, withoutSignedThinking, prepared, answeredBefore, nativeOf, modelOf, configModels, freeWindowOf, tokensShort, freeWindowRows, freeWindowLedger, readLedgerTail, pinned, pinning, rowTime, rowAccount, ofAccount, windowOffset, windowReset, FREE_WINDOW_MODELS, FREE_WINDOW_CN, FREE_WINDOW_AI, FREE_WINDOW_SPAN, FREE_WINDOW_GAP, FREE_WINDOW_LEAD, checkinOf, API_MESSAGES: NPM_MESSAGES, API_CHAT: NPM }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-workbuddy-auth",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "OpenCode provider plugins for WorkBuddy's plans: WorkBuddy (CodeBuddy, copilot.tencent.com) and WorkBuddy AI (www.workbuddy.ai)",
   "type": "module",
   "main": "./index.mjs",