@magpie-community/opencode-zcode-auth 0.1.25 → 0.1.27

package/README.md

@@ -25,12 +25,14 @@ over Anthropic's Messages API. Provider id: `zcode`.
     agent's system prompt at the end of the third (a fourth block is
     refused, #343), the day in a `<system-reminder>` turn before the agent's
     turns, and the sign-in's device id in `metadata.user_id`. GLM Coding
-    Plan and team requests go as the agent sent them. One it still turns
-    away (a 405, the block page or code 3012) comes back with what to do
-    about it, as magpie's built-in said: "ZCode's Start Plan still turned
-    this request away, though magpie sends it as the ZCode app does; …
-    Use an account with a GLM Coding Plan, or add another provider to this
-    group".
+    Plan and team requests go as the agent sent them. zcode.z.ai also
+    answers 405 code 3012 to every request of an account its risk control
+    blocked, ZCode's own app's included (plugins#348). That answer comes
+    back as ZCode's words, then "ZCode's risk control blocked this account
+    for unusual activity (code 3012); …", which magpie reads as the account
+    restricted: it rests, and the group's other providers are used. Only
+    ZCode support lifts such a block. A block page from ZCode's edge
+    firewall says this network's address was blocked instead.
   - The Start Plan's token can't be refreshed. When it runs out, sign in
     again.
 - **ZCode: a team's GLM Coding Plan**
@@ -57,7 +59,9 @@ over Anthropic's Messages API. Provider id: `zcode`.
     Start Plan, ZCode 1024 Dev Day) are served to ZCode's own session,
     which a key doesn't carry: for an account with only a gift plan, the
     card and each refused request (1113) say to sign in with ZCode
-    instead.
+    instead. For an account with a GLM Coding Plan, the card says the
+    gift plans' `-Trial` models need ZCode's sign-in, since a key lists
+    none of them.
 
 ## Where the sign-in is kept
 
@@ -139,12 +143,21 @@ that fails, or lists nothing, adds no line at all, and a card that is an
 error keeps its error. Claim the plan in the ZCode app (open it once);
 the next read shows it as an ordinary gift bucket.
 
+**No ZCode session.** A card read with a key, or with a sign-in whose
+ZCode session has run out (it can't be renewed), sets aside a line named
+"ZCode gift plans (-Trial models) need ZCode's sign-in", with why in its
+display: such an account reads no gift and lists no `-Trial` entries.
+Sign in again with ZCode to get them back. A gift read that fails
+otherwise is asked again a minute later, not ten.
+
 ## Models
 
 The models are the ones ZCode offers for the account's plan. They come
 from ZCode's provider config: the release zcode.z.ai names, or an
 installed ZCode's copy if that one is newer. The list is kept for 10
-minutes. When the config can't be read, the plugin falls back to this list:
+minutes. When the config can't be read, the plugin falls back to this list
+(and magpie keeps the list it was told last, unless the account's gift
+plans add `-Trial` entries, which are told as read):
 
 | Model | Context | Output | Efforts |
 |---|---|---|---|

package/index.mjs

@@ -214,8 +214,15 @@ async function plansOf(s) {
   let sure = false
   try {
     if (!(await plan(s))) start = true
-    else gift = await startPlan(s.jwt, s.device).catch(() => null)
-    sure = true
+    else {
+      // a gift read that failed is unknown, not "no gift": asked again in
+      // a minute, so its trial entries come back with the next list (an
+      // expired session is known: the card says to sign in again)
+      let failed = false
+      gift = await startPlan(s.jwt, s.device).catch(() => ((failed = !jwtExpired(s.jwt)), null))
+      sure = !failed
+    }
+    if (start) sure = true
   } catch {
     // the plan list could not be read: a key account takes the dual route
     // (start stays false, the gift is kept, a minute's ttl), so a gift
@@ -616,6 +623,21 @@ async function claimHint(s) {
   return { name: CLAIM_HINT, used: 0, aside: true, display: `${n} · ${plan}` }
 }
 
+// GIFT_SIGN_IN is the card's line for an account whose gift plans can't
+// be read: ZCode's gift plans (the Start Plan, ZCode 1024 Dev Day, ZCode
+// Trust Build) are served by zcode.z.ai to ZCode's own session alone, so
+// a GLM Coding Plan key, or a sign-in whose ZCode session has run out
+// (that token can't be renewed), lists no <model>-Trial entries and
+// spends the coding plan alone. A fixed sentence, so magpie can
+// translate it; why goes in the display. Set aside: it stops nothing.
+const GIFT_SIGN_IN = "ZCode gift plans (-Trial models) need ZCode's sign-in"
+function giftSignIn(s, key) {
+  if (isTeam(s)) return null
+  if (!s.jwt) return { name: GIFT_SIGN_IN, used: 0, aside: true, display: key ? "not read with an API key: add the account with a ZCode sign-in" : "this sign-in has no ZCode session: sign in again" }
+  if (jwtExpired(s.jwt)) return { name: GIFT_SIGN_IN, used: 0, aside: true, display: "ZCode's sign-in has expired: sign in again" }
+  return null
+}
+
 // startUsage is a gift-only account's card: its buckets, or the words
 // for having none to show. The card's header already names the plan, so
 // the windows of one plan keep their own names; with several plans each
@@ -1416,39 +1438,51 @@ function model(m, url) {
 }
 
 // ---- the Start Plan's requests ----------------------------------------------------
-// zcode.z.ai serves the Start Plan only to what looks like ZCode's own
-// request, and turns others away with 405 "request has been blocked due to
-// unusual activity" (code 3012). A Start Plan request goes as the plugin
+// zcode.z.ai answers 405 "request has been blocked due to unusual
+// activity" (code 3012) to a request that doesn't look like ZCode's own
+// (#343: the agent's system prompt as a fourth block), and to every
+// request of an account its risk control blocked, ZCode's own app's too
+// (plugins#348). A Start Plan request goes as the plugin
 // the plan serves (ARNO's "Freeflow", provider zcode-start) sends it: its
 // headers (startHeaders) and its body (dress). The texts are prompt.mjs.
 
-// START_BLOCKED is what the Start Plan still turning a request away means,
-// word for word magpie's provider.ZCodeStartBlockedHint (#425), which
-// magpie's Routing page knows and says in the user's language. It is put
-// in place of the block page, whose words magpie would otherwise read as a
-// network firewall's (provider.BlockedHint).
-const START_BLOCKED = "ZCode's Start Plan still turned this request away, though magpie sends it as the ZCode app does; it can be a network block of this IP, or ZCode checking for something new. Use an account with a GLM Coding Plan, or add another provider to this group"
-const EDGE_BLOCKED = /request has been blocked|errors\.aliyun\.com/i
-const START_REFUSED = /unusual activity|"code"\s*:\s*"?3012\b/i
-
-// startRefused says a Start Plan answer is that refusal, as the built-in's
-// zcodeStartExplain read it: a 405, a block page or code 3012.
-const startRefused = (status, text) => status >= 400 && (status === 405 || EDGE_BLOCKED.test(text) || START_REFUSED.test(text))
-
-// startBlocked is the refusal's answer as the built-in passed it on: what
-// the vendor said (its status for a block page), then START_BLOCKED.
+// START_RESTRICTED is what ZCode's 3012, "request has been blocked due to
+// unusual activity", means: ZCode's risk control blocked the account
+// (ZCode's support says so, and ZCode's own app gets the same 405 on such
+// an account, plugins#348), not that the request was sent wrong. Word for
+// word magpie's provider.ZCodeRestrictedHint: the gateway reads it as the
+// account restricted, rests it and asks the group's next member, and the
+// Routing page says it in the user's language.
+const START_RESTRICTED = "ZCode's risk control blocked this account for unusual activity (code 3012); it rests, and the group's other providers are used. If the ZCode app fails on this account too, only ZCode support can lift the block"
+// START_EDGE is what a block page from ZCode's edge firewall (Aliyun's)
+// means: this network's address, not the account. Word for word magpie's
+// provider.BlockedHint.
+const START_EDGE = "the provider's network firewall blocked requests from this IP; wait a while, or switch to another network or proxy"
+const EDGE_PAGE = /errors\.aliyun\.com|<html/i
+const START_REFUSED = /unusual activity|request has been blocked|"code"\s*:\s*"?3012\b/i
+
+// startRefused says a Start Plan answer is a refusal: a 405, a block page
+// or code 3012.
+const startRefused = (status, text) => status >= 400 && (status === 405 || START_REFUSED.test(text))
+
+// startBlocked is the refusal's answer: what the vendor said (its status
+// for a block page), then what it means. A block page is the network's;
+// anything else, ZCode's JSON 3012 or a bare 405, the account's.
 function startBlocked(res, text) {
+  const page = EDGE_PAGE.test(text)
   let said = ""
-  if (!EDGE_BLOCKED.test(text)) {
+  if (!page) {
     try {
       const v = JSON.parse(text)
       said = first(v?.error?.message, typeof v?.error === "string" ? v.error : "", v?.message, v?.msg)
+      const code = v?.code ?? v?.error?.code
+      if (said && code != null && !String(said).includes(String(code))) said = `${said} (${res.status}, code ${code})`
     } catch {}
   }
   said ||= `${res.status} ${STATUS_TEXT[res.status] ?? res.statusText}`.trim()
   const h = new Headers(res.headers)
   h.set("content-type", "application/json")
-  const error = { type: "permission_error", message: `${said} — ${START_BLOCKED}` }
+  const error = { type: "permission_error", message: `${said} — ${page ? START_EDGE : START_RESTRICTED}` }
   return new Response(JSON.stringify({ type: "error", error }), { status: res.status, statusText: res.statusText, headers: h })
 }
 
@@ -1781,7 +1815,11 @@ export async function ZCodeAuthPlugin({ client }) {
           if (out[id]) continue
           out[id] = model({ ...about(raw), id }, url)
         }
-        if (fell) out[Symbol.for("magpie.fellBack")] = true
+        // a fallback tells magpie to keep the list it was told last, which
+        // predates the gift read just made: an account whose gift lists
+        // trial entries is told this list, so ZCode's config out of reach
+        // (a remote box that can't get its CDN) never hides them
+        if (fell && !giftNames(gift).length) out[Symbol.for("magpie.fellBack")] = true
         return out
       },
     },
@@ -1874,7 +1912,7 @@ export async function ZCodeAuthPlugin({ client }) {
             }
             let res = await fetch(url, { ...opts, headers: h })
             // the Start Plan turning the request away says what to do about
-            // it, as the built-in's zcodeStartExplain did
+            // it: the account blocked, or the network
             if (start && res.status >= 400) {
               const text = await res.text()
               if (startRefused(res.status, text)) return kept(startBlocked(res, text))
@@ -1953,6 +1991,10 @@ export async function ZCodeAuthPlugin({ client }) {
           if (!card.error) {
             const hint = await claimHint(s)
             if (hint) card.windows = [...(card.windows ?? []), hint]
+            // a key, or a ZCode session that ran out: no gift read, so no
+            // -Trial models, said on the card rather than left out unsaid
+            const need = start ? null : giftSignIn(s, auth?.type === "api")
+            if (need) card.windows = [...(card.windows ?? []), need]
           }
           return card
         } catch (e) {
@@ -2002,4 +2044,7 @@ export async function ZCodeAuthPlugin({ client }) {
 }
 
 // for tests
-export const _internal = { entry, limitWindows, termOf, startUsage, routes, blocked, plansOf, giftOf, dualUsage, claimHint, spentUp, giftServes, modelOf, teamKeys, ownSignIn, stateOf, dress, PROMPT }
+// config sets what zcodeConfig has read, for tests: null is ZCode's config
+// out of reach, undefined forgets it
+const config = (cfg) => (cfgCache = cfg === undefined ? null : { cfg, at: Date.now() })
+export const _internal = { config, entry, limitWindows, termOf, startUsage, routes, blocked, plansOf, giftOf, dualUsage, claimHint, spentUp, giftServes, modelOf, teamKeys, ownSignIn, stateOf, dress, PROMPT }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-zcode-auth",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "OpenCode provider plugin: signs in to Z.ai's or BigModel's (智谱) GLM Coding Plan as ZCode does, including team seats and ZCode's Start Plan",
   "type": "module",
   "main": "./index.mjs",