@magpie-community/opencode-zcode-auth 0.1.15 → 0.1.17

package/README.md

@@ -31,7 +31,11 @@ over Anthropic's Messages API. Provider id: `zcode`.
   - Uses the account the ZCode app on this computer is signed in to. For
     every request it reads ZCode's own credentials (`~/.zcode/v2`), so it
     follows ZCode as it signs in again, renews its session or switches to a
-    team's plan.
+    team's plan, but only while ZCode is signed in to that same account.
+    Once ZCode signs out, or signs in to another account, the sign-in uses
+    what it saved when it was added; when that session has run out, it
+    asks to be signed in again. It never sends one account's requests with
+    another's credentials: to use both, add the app's sign-in once for each.
 - **GLM Coding Plan API key**
   - Paste a key (`<id>.<secret>`) and say which site it is from.
 

package/index.mjs

@@ -19,7 +19,7 @@
 import { createDecipheriv, createHash } from "node:crypto"
 import { existsSync, readFileSync, readdirSync } from "node:fs"
 import { arch, homedir, release, userInfo } from "node:os"
-import { join } from "node:path"
+import { isAbsolute, join } from "node:path"
 import PROMPT from "./prompt.mjs"
 
 const PROVIDER = "zcode"
@@ -933,8 +933,28 @@ async function authorize(site, log) {
 // team's plan. An account signed in "as ZCode" reads them for every
 // request, so it follows ZCode's own sign-in, its renewed session and its
 // switches between plans, as magpie's built-in did (zcode.go zcodeOwn).
+//
+// ZCode 3.14 can move its data (数据存储路径, "data storage path"): it copies
+// ~/.zcode/v2 to <folder>/.zcode/v2, all but setting.json, and from its next
+// start reads credentials.json and runtime/provider from there. The choice
+// stays in the home folder's setting.json as dataBaseDir, which ZCode's main
+// process reads before anything else (readBootstrapDataBaseDirFromDisk);
+// setting.json itself, and the team plan it names, stay in the home folder.
+
+// settingDir is where ZCode keeps setting.json, moved or not.
+const settingDir = () => join(homedir(), ".zcode", "v2")
+
+// dataIn is the folder ZCode keeps its .zcode data in: the home folder,
+// unless dataBaseDir moved it. A value that isn't an absolute path is
+// ignored, as magpie's built-in does (internal/appdir ZCodeDataIn).
+function dataIn() {
+  const d = readJSON(join(settingDir(), "setting.json"))?.dataBaseDir
+  const t = typeof d === "string" ? d.trim() : ""
+  return t && isAbsolute(t) ? t : homedir()
+}
 
-const zcodeDir = () => join(homedir(), ".zcode", "v2")
+// zcodeDir is where ZCode keeps credentials.json and runtime/provider.
+const zcodeDir = () => join(dataIn(), ".zcode", "v2")
 
 // secret is the key ZCode encrypts its credentials with.
 function secret() {
@@ -974,7 +994,7 @@ function readJSON(path) {
 
 // ownTeam is the team plan ZCode switched to, when it did.
 function ownTeam(store, key) {
-  const set = readJSON(join(zcodeDir(), "setting.json"))
+  const set = readJSON(join(settingDir(), "setting.json"))
   if (!set) return null
   const families = set.providerFamilyDomain === "zai" || set.providerFamilyDomain === "bigmodel" ? [set.providerFamilyDomain] : ["zai", "bigmodel"]
   for (const fam of families) {
@@ -1044,7 +1064,7 @@ function ownSignIn() {
 function asZCode() {
   return {
     url: "",
-    instructions: "Uses the account the ZCode app is signed in to, and follows it.",
+    instructions: "Uses the account the ZCode app is signed in to, and follows it while ZCode stays signed in to that account.",
     method: "auto",
     async callback() {
       const own = ownSignIn()
@@ -1064,10 +1084,13 @@ function stateOf(auth) {
       s = JSON.parse(auth.refresh)
     } catch {}
     if (s.source === "zcode") {
-      // ZCode's own, read now: what it was when this was signed in, if
-      // ZCode has since signed out
+      // ZCode's own, read now, while ZCode is signed in to this same
+      // account. Signed out, or signed in to another account since, it is
+      // what it was when this was signed in: another account's key would
+      // send this account's requests as that one, and an expired session
+      // says sign in again (EXPIRED) rather than borrowing another's.
       const own = ownSignIn()
-      if (own) {
+      if (own && own.user === String(auth.accountId ?? "")) {
         const { user, ...now } = own
         s = { source: "zcode", device: s.device, plan: s.plan, ...now }
       }
@@ -1136,7 +1159,7 @@ function modelsOf(cfg, plan) {
 // localConfig is the latest provider config an installed ZCode has.
 function localConfig() {
   const files = []
-  const rt = join(homedir(), ".zcode", "v2", "runtime", "provider")
+  const rt = join(zcodeDir(), "runtime", "provider")
   const walk = (dir, depth) => {
     let es = []
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-zcode-auth",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "OpenCode provider plugin: signs in to Z.ai's or BigModel's (智谱) GLM Coding Plan as ZCode does, including team seats and ZCode's Start Plan",
   "type": "module",
   "main": "./index.mjs",