@magpie-community/opencode-zcode-auth 0.1.18 → 0.1.20

package/README.md

@@ -24,9 +24,23 @@ over Anthropic's Messages API. Provider id: `zcode`.
     ZCode's does: ZCode's headers, ZCode's system prompt ahead of the
     agent's, the day in a `<system-reminder>` turn before the agent's
     turns, and the sign-in's device id in `metadata.user_id`. GLM Coding
-    Plan and team requests go as the agent sent them.
+    Plan and team requests go as the agent sent them. One it still turns
+    away (a 405, the block page or code 3012) comes back with what to do
+    about it, as magpie's built-in said: "ZCode's Start Plan still turned
+    this request away, though magpie sends it as the ZCode app does; …
+    Use an account with a GLM Coding Plan, or add another provider to this
+    group".
   - The Start Plan's token can't be refreshed. When it runs out, sign in
     again.
+- **ZCode: a team's GLM Coding Plan**
+  - For an account with a plan of its own and a seat on a team's plan
+    (#285). The sign-ins above take the account's own plan, as ZCode does
+    by default; this one asks which site, signs in the same way, and
+    takes the team seat's `zcode-team-api-key`, as ZCode does when its
+    plan picker is switched to the team's plan.
+  - It is kept as an account of its own, named `<email> (team)`, beside
+    the account's own plan, so both can be used.
+  - With no seat on a team's plan, it says so and signs in to nothing.
 - **ZCode app's sign-in**
   - Uses the account the ZCode app on this computer is signed in to. For
     every request it reads ZCode's own credentials (`~/.zcode/v2`), so it
@@ -96,6 +110,15 @@ behind an error, so a gift hiccup must not black out a working Coding
 Plan. A gift that goes out of date while requests use it simply stops
 showing.
 
+**Resets.** A GLM Coding Plan of the account's own, and a team seat,
+show the resets the vendor's usage page lists
+(`/api/biz/customer-package-reset/list`, `targetType=PERSONAL` with the
+plan's key, `TEAM` with the team's sign-in): how many of the five hours
+and of the week are still available, and when each runs out, soonest
+first. A team's are marked a team's. They are only read; a reset is
+spent on the vendor's own page. A list that can't be read, or has none
+left, shows no count.
+
 **Gift plans ZCode holds but has not granted.** ZCode hands out one-off
 trust-build / gift plans (a day's ZCode Trust Build, say) that are not
 on the account until the ZCode app claims them. The plugin reads the

package/index.mjs

@@ -436,9 +436,12 @@ async function codingUsage(s) {
   const level = typeof d.level === "string" ? d.level : ""
   if (level) out.plan = "GLM Coding " + level[0].toUpperCase() + level.slice(1)
   out.windows = limitWindows(d)
+  const resets = personalResets(root, s.key)
   try {
     Object.assign(out, termOf(await call("GET", root + "/api/biz/subscription/list", { auth: s.key })))
   } catch {}
+  const r = await resets
+  if (r) out.resets = r
   return out
 }
 
@@ -708,31 +711,56 @@ async function teamUsage(s, key) {
 }
 
 // teamResets is how many resets a team member may spend, of the five hours
-// and of the week: those of customer-package-reset/list still available.
-// null when it can't be told or there are none.
+// and of the week, marked a team's (team: true), as the built-in's
+// zhipuTeamResets did. null when it can't be told or there are none.
 async function teamResets(root, auth, headers) {
+  const r = await resetsOf(root + "/api/biz/customer-package-reset/list?targetType=TEAM", auth, headers)
+  if (r) r.team = true
+  return r
+}
+
+// personalResets is how many resets a GLM Coding Plan of a person's own
+// holds, as bigmodel.cn's usage page lists them, asked with the plan's
+// key (the built-in's zhipuPersonalResets). Only read: a reset is spent
+// on the vendor's own page, never from here.
+async function personalResets(root, key) {
+  return resetsOf(root + "/api/biz/customer-package-reset/list?targetType=PERSONAL", key)
+}
+
+// resetsOf reads customer-package-reset/list: the resets of the five
+// hours and of the week, of which only those still available count (one
+// run out stays listed a week, available false), each with its own end
+// (each, soonest first, one with no end last) and the soonest as until.
+// null when the list can't be read, so no count is shown rather than 0,
+// and when it holds none.
+async function resetsOf(url, auth, headers) {
   let d
   try {
-    d = (await call("GET", root + "/api/biz/customer-package-reset/list?targetType=TEAM", { auth, headers })) ?? {}
+    d = (await call("GET", url, { auth, headers })) ?? {}
   } catch {
     return null
   }
   let until = 0
-  const count = (rs) => {
+  const each = []
+  const count = (rs, window) => {
     let n = 0
     for (const x of Array.isArray(rs) ? rs : []) {
       if (x?.available !== true) continue
       n++
       const t = when(x.expireTime)
       if (t && (!until || t < until)) until = t
+      each.push(t ? { until: new Date(t).toISOString(), window } : { window })
     }
     return n
   }
-  const fiveHour = count(d.fiveHourResets)
-  const weekly = count(d.weekResets)
+  const fiveHour = count(d.fiveHourResets, "fiveHour")
+  const weekly = count(d.weekResets, "weekly")
   if (fiveHour + weekly === 0) return null
+  const end = (c) => (c.until ? Date.parse(c.until) : Infinity)
+  each.sort((a, b) => (end(a) === end(b) ? 0 : end(a) < end(b) ? -1 : 1))
   const r = { count: fiveHour + weekly, byWindow: true, fiveHour, weekly }
   if (until) r.until = new Date(until).toISOString()
+  r.each = each
   return r
 }
 
@@ -819,13 +847,29 @@ async function teamSignIn(site, root, auth, info) {
 
 // signedIn is what a sign-in gives: the account's coding plan key and plan;
 // or, with none of its own, a seat on a team's plan; or else ZCode's token
-// for its Start Plan while the account has one.
-async function signedIn(site, token, jwt, device) {
+// for its Start Plan while the account has one. Asked for the team's plan
+// (onTeam), it is the team seat alone, as ZCode's plan picker gives a team
+// plan beside the account's own (a "team-coding-plan" selection): an
+// account with both is signed in to each as an account of its own (#285).
+async function signedIn(site, token, jwt, device, onTeam = false) {
   const name = SITES[site].name
   const root = SITES[site].api
   let s = null
   let err = null
   let team = ""
+  if (onTeam) {
+    const auth = await bizAuth(site, token)
+    let info
+    try {
+      info = await call("GET", root + "/api/biz/customer/getCustomerInfo", { auth })
+    } catch (e) {
+      throw new Error(`${name} account: ${e.message}`)
+    }
+    const t = await teamSignIn(site, root, auth, info)
+    if (t.s) return { ...t.s, jwt, plan: t.plan }
+    if (t.none) throw new Error(`this ${name} account has no seat on a team's GLM Coding Plan — sign in with "ZCode: ${name} GLM Coding Plan" for its own plan`)
+    throw new Error(t.why ?? t.err)
+  }
   try {
     const auth = await bizAuth(site, token)
     let info
@@ -863,11 +907,15 @@ async function signedIn(site, token, jwt, device) {
   )
 }
 
+// TEAM marks a team seat's account name beside the account's own.
+const TEAM = "team"
 const who = (u) => first(String(u?.email ?? "").replace(/@phone\.local$/, ""), u?.name, u?.user_id, "ZCode")
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
 
 // authorize opens ZCode's sign-in flow on site; its callback polls it.
-async function authorize(site, log) {
+// onTeam signs in to the account's seat on a team's plan, named apart from
+// the account's own plan (the host keeps one entry per account name).
+async function authorize(site, log, onTeam = false) {
   const poll = "Bearer " + Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString("hex")
   const device = uuid()
   let flow
@@ -908,7 +956,7 @@ async function authorize(site, log) {
         if (got.status !== "ready" || !token) return fail("ZCode sign-in: unexpected answer " + got.status)
         let s
         try {
-          s = await signedIn(site, token, first(got.token), device)
+          s = await signedIn(site, token, first(got.token), device, onTeam)
         } catch (e) {
           return fail(e.message)
         }
@@ -919,7 +967,7 @@ async function authorize(site, log) {
           access: s.key || s.jwt || "",
           // the key doesn't run out; ZCode's token, when it is all there is, does
           expires: s.key || isTeam(s) ? 0 : jwtExpiry(s.jwt),
-          accountId: who(got.user),
+          accountId: onTeam ? `${who(got.user)} (${TEAM})` : who(got.user),
         }
       }
     },
@@ -1311,6 +1359,36 @@ function model(m, url) {
 // the plan serves (ARNO's "Freeflow", provider zcode-start) sends it: its
 // headers (startHeaders) and its body (dress). The texts are prompt.mjs.
 
+// START_BLOCKED is what the Start Plan still turning a request away means,
+// word for word magpie's provider.ZCodeStartBlockedHint (#425), which
+// magpie's Routing page knows and says in the user's language. It is put
+// in place of the block page, whose words magpie would otherwise read as a
+// network firewall's (provider.BlockedHint).
+const START_BLOCKED = "ZCode's Start Plan still turned this request away, though magpie sends it as the ZCode app does; it can be a network block of this IP, or ZCode checking for something new. Use an account with a GLM Coding Plan, or add another provider to this group"
+const EDGE_BLOCKED = /request has been blocked|errors\.aliyun\.com/i
+const START_REFUSED = /unusual activity|"code"\s*:\s*"?3012\b/i
+
+// startRefused says a Start Plan answer is that refusal, as the built-in's
+// zcodeStartExplain read it: a 405, a block page or code 3012.
+const startRefused = (status, text) => status >= 400 && (status === 405 || EDGE_BLOCKED.test(text) || START_REFUSED.test(text))
+
+// startBlocked is the refusal's answer as the built-in passed it on: what
+// the vendor said (its status for a block page), then START_BLOCKED.
+function startBlocked(res, text) {
+  let said = ""
+  if (!EDGE_BLOCKED.test(text)) {
+    try {
+      const v = JSON.parse(text)
+      said = first(v?.error?.message, typeof v?.error === "string" ? v.error : "", v?.message, v?.msg)
+    } catch {}
+  }
+  said ||= `${res.status} ${STATUS_TEXT[res.status] ?? res.statusText}`.trim()
+  const h = new Headers(res.headers)
+  h.set("content-type", "application/json")
+  const error = { type: "permission_error", message: `${said} — ${START_BLOCKED}` }
+  return new Response(JSON.stringify({ type: "error", error }), { status: res.status, statusText: res.statusText, headers: h })
+}
+
 const osVersion = () => `${process.platform} ${release()} ${arch()}`
 const osCategory = () => (process.platform === "darwin" ? "macos" : process.platform === "win32" ? "windows" : "linux")
 
@@ -1594,6 +1672,13 @@ export async function ZCodeAuthPlugin({ client }) {
               h.set("Authorization", "Bearer " + key)
             }
             let res = await fetch(url, { ...opts, headers: h })
+            // the Start Plan turning the request away says what to do about
+            // it, as the built-in's zcodeStartExplain did
+            if (start && res.status >= 400) {
+              const text = await res.text()
+              if (startRefused(res.status, text)) return kept(startBlocked(res, text))
+              res = new Response(text, { status: res.status, statusText: res.statusText, headers: res.headers })
+            }
             // a trial entry's gift answer that can't serve the request is
             // the agent's answer, not the coding plan's: the user picked the
             // gift, so a spent bucket says 429 (its quota error inside a 200
@@ -1668,6 +1753,24 @@ export async function ZCodeAuthPlugin({ client }) {
       methods: [
         oauth("zai"),
         oauth("bigmodel"),
+        // a team's plan beside the account's own (#285): the sign-ins above
+        // take the account's own plan when it has one
+        {
+          type: "oauth",
+          label: "ZCode: a team's GLM Coding Plan",
+          prompts: [
+            {
+              type: "select",
+              key: "site",
+              message: "Where is the team's plan?",
+              options: [
+                { label: "Z.ai", value: "zai", hint: "z.ai" },
+                { label: "BigModel (智谱)", value: "bigmodel", hint: "bigmodel.cn" },
+              ],
+            },
+          ],
+          authorize: (inputs) => authorize(inputs?.site === "bigmodel" ? "bigmodel" : "zai", log, true),
+        },
         { type: "oauth", label: "ZCode app's sign-in", authorize: async () => asZCode() },
         {
           type: "api",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-zcode-auth",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "OpenCode provider plugin: signs in to Z.ai's or BigModel's (智谱) GLM Coding Plan as ZCode does, including team seats and ZCode's Start Plan",
   "type": "module",
   "main": "./index.mjs",