@magpie-community/opencode-zcode-auth 0.1.21 → 0.1.22

package/index.mjs

@@ -29,7 +29,7 @@ const BIGMODEL_API = "https://bigmodel.cn" // BigModel's business API, where ZCo
 const ZAI_BASE = "https://api.z.ai/api/anthropic"
 const BIGMODEL_BASE = "https://open.bigmodel.cn/api/anthropic"
 const START_BASE = ZCODE + "/api/v1/zcode-plan/anthropic"
-const APP_VERSION = "3.14.3" // the ZCode whose sign-in this makes
+const APP_VERSION = "3.16.3" // the ZCode whose sign-in this makes
 const UA = "ZCode/" + APP_VERSION
 
 // ZCode's models before its config is read; the Start Plan has all but GLM-5.3.
@@ -1400,28 +1400,48 @@ function intl() {
   }
 }
 
-// startHeaders puts ZCode's headers on a Start Plan request, jwt its key.
+// startHeaders is a Start Plan request's headers, jwt its key: ZCode's
+// own (3.16.3's Frn and Vdt in glm/zcode.cjs) and the body's content-type,
+// and nothing else. The agent's headers never go on: Claude Code's
+// anthropic-beta, x-app, x-stainless-*, anthropic-dangerous-direct-browser-
+// access and x-claude-code-session-id reach the plugin through magpie's
+// gateway, and ZCode sends none of them (no anthropic-beta at all on the
+// Start Plan: its tool search beta is for coding plans only). Accept and
+// accept-encoding are left to the HTTP client, as ZCode leaves them to
+// Node's.
 function startHeaders(h, jwt) {
-  h.delete("x-api-key")
-  h.delete("authorization")
-  h.delete("X-Device-Mid")
-  h.set("Authorization", "Bearer " + jwt)
-  h.set("anthropic-version", "2023-06-01")
-  h.set("HTTP-Referer", ZCODE)
-  h.set("User-Agent", UA + " ai-sdk/anthropic/3.0.81")
-  h.set("X-ZCode-App-Version", APP_VERSION)
-  h.set("X-Title", "Z Code@cli")
-  h.set("X-Release-Channel", "production")
+  const out = new Headers()
+  out.set("content-type", h.get("content-type") || "application/json")
+  out.set("Authorization", "Bearer " + jwt)
+  out.set("anthropic-version", "2023-06-01")
+  out.set("HTTP-Referer", ZCODE)
+  out.set("User-Agent", UA + " ai-sdk/anthropic/3.0.81")
+  out.set("X-ZCode-App-Version", APP_VERSION)
+  out.set("X-Title", "Z Code@cli")
+  out.set("X-Release-Channel", "production")
   const o = intl()
-  h.set("X-Client-Language", o.locale || "unknown")
-  if (o.timeZone) h.set("X-Client-Timezone", o.timeZone)
-  h.set("X-ZCode-Agent", "glm")
-  h.set("X-Platform", platform())
-  h.set("X-Os-Category", osCategory())
-  h.set("X-Os-Version", osVersion())
-  h.set("x-request-id", uuid())
-  h.set("x-zcode-session-type", "main")
-  h.set("x-zcode-trace-id", uuid())
+  out.set("X-Client-Language", o.locale || "unknown")
+  out.set("X-Client-Timezone", o.timeZone || "unknown")
+  out.set("X-ZCode-Agent", "glm")
+  out.set("X-Platform", platform())
+  out.set("X-Os-Category", osCategory())
+  // os.release() alone, as ZCode's buildZCodeSourceHeadersFromContext
+  // has it; the prompt's OS line is osVersion()
+  out.set("X-Os-Version", release())
+  out.set("x-request-id", uuid())
+  out.set("x-zcode-session-type", "main")
+  out.set("x-zcode-trace-id", uuid())
+  // 3.16's createModelRequestAttributionHeaders: what asked the model
+  out.set("x-zcode-query-source", "main_turn")
+  return out
+}
+
+// startURL is a Start Plan request's URL without the query the agent put
+// on it: Claude Code asks /v1/messages?beta=true, which magpie passes on,
+// and ZCode asks /v1/messages alone.
+function startURL(url) {
+  const i = url.indexOf("?")
+  return i < 0 ? url : url.slice(0, i)
 }
 
 // WORK_DIR and WORK_GIT are where magpie tells a plugin's fetch the agent
@@ -1660,7 +1680,8 @@ export async function ZCodeAuthPlugin({ client }) {
               if (!s.jwt) throw new Error("ZCode's sign-in has no key; sign in again")
               swap(START_BASE)
               // the Start Plan is served only to what looks like ZCode's own request
-              startHeaders(h, s.jwt)
+              url = startURL(url)
+              h = startHeaders(h, s.jwt)
               if (opts.body != null) {
                 const text = orig ?? (typeof opts.body === "string" ? opts.body : await new Response(opts.body).text())
                 opts.body = dress(text, s.site, s.device, place)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-zcode-auth",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "OpenCode provider plugin: signs in to Z.ai's or BigModel's (智谱) GLM Coding Plan as ZCode does, including team seats and ZCode's Start Plan",
   "type": "module",
   "main": "./index.mjs",