@weiping/magpie-cf-jev 0.1.1 → 0.2.0

package/README.md

@@ -39,8 +39,9 @@ magpie 的插件可以声明自己是决策供应商：`config` 钩子里 `decid
 # 1. 装插件（npm 上发布的是 @weiping/magpie-cf-jev）
 magpie plugin add @weiping/magpie-cf-jev@latest
 
-# 2. 登录，粘贴 Cloudflare API token
-#    只做 Workers AI 的 token 可能列不出账号，那就按 "<account id>:<token>" 粘
+# 2. 登录：先问 Account ID，再粘 Cloudflare API token
+#    Account ID 是控制台里那 32 位十六进制；留空也行
+#    （token 若能列账号，插件会自己去查）
 magpie plugin login cf-jev
 
 # 3. 确认三个决策模型都在，且 decide 探针通过
@@ -55,6 +56,18 @@ magpie group set mb-classifier \
 
 > `magpie group mb-classifier` 对决策组总是显示 `not served now, skipped` / `no member ready` —— 那是 magpie CLI 的显示假象（它拿「给 agent 的模型目录」查成员，而决策模型本来就不在里面），不代表插件不能用。真要看可用性：`magpie provider test cf-jev` 或直接发一个 `/v1/systemone`。
 
+### Account ID 从哪来
+
+Worker AI 的运行地址是 `…/accounts/<account id>/ai/run`，account id 是 Cloudflare 控制台
+里那 32 位十六进制。插件登录时会**单独问一次**（magpie 的插件提问机制，答案存进该账户
+的 metadata）：
+
+- token 有列账号的权限 → Account ID 留空，插件用 token 查第一个账号；
+- token 只给 Workers AI（列不了账号）→ 必须填，否则跑不起来。
+
+也仍然支持把两者粘在一起：登录时用 `<account id>:<token>` 的写法（0.1.1 就是这么登的，
+登录信息还在就一直有效）。两种写法都以登录时回答的 Account ID 为准。
+
 ## 回滚
 
 ```sh
@@ -76,13 +89,14 @@ magpie plugin rm cf-jev          # 或 magpie plugin off cf-jev
 
 | 文件 | 作用 |
 | --- | --- |
-| `index.mjs` | 插件本体：`config` 声明决策供应商，`auth.loader` 返回自带 `fetch` 的实现，`peel()` 拆信封 |
+| `index.mjs` | 插件本体：`config` 声明决策供应商，`auth` 的登录方法带 Account ID 提问，`loader` 返回自带 `fetch` 的实现，`peel()` 拆信封，`accountFor()` 解析账号 |
 | `smoke.mjs` | 不经 magpie、直接按 host 的方式调 `fetch` 的自检（token 从 magpie 的 `providers.json` 读，不落盘） |
 | `peel.test.mjs` | `peel()` 的单元测试：两层信封、一层信封、错误体、已经扁平的答案 |
+| `account.test.mjs` | `accountFor()` 的单元测试：登录回答的 ID、key 里的 `<id>:<token>`、两者冲突、空值 |
 
 ```sh
-node --test peel.test.mjs     # 单元测试
-node smoke.mjs                # 打真实 Cloudflare
+node --test peel.test.mjs account.test.mjs   # 单元测试
+node smoke.mjs                              # 打真实 Cloudflare
 ```
 
 ## 发布

package/account.test.mjs

@@ -0,0 +1,40 @@
+// account.test.mjs: the account a key works in. Run: node --test account.test.mjs
+import assert from "node:assert/strict";
+import test from "node:test";
+import { accountFor } from "./index.mjs";
+
+test("the account id the sign-in answered names the account", () => {
+  const a = accountFor({ key: "tok", metadata: { accountId: "f14d88531a144167d91b1be6fb789b3f" } });
+  assert.equal(a.token, "tok");
+  assert.equal(a.named, "f14d88531a144167d91b1be6fb789b3f");
+});
+
+test("a key pasted as '<account id>:<token>' names it too", () => {
+  const a = accountFor({ key: "f14d88531a144167d91b1be6fb789b3f:tok" });
+  assert.equal(a.token, "tok");
+  assert.equal(a.named, "f14d88531a144167d91b1be6fb789b3f");
+});
+
+test("the answer wins over the key's own account id", () => {
+  const a = accountFor({ key: "old:tok", metadata: { accountId: "new" } });
+  assert.equal(a.token, "tok");
+  assert.equal(a.named, "new");
+});
+
+test("a token alone names no account: the token is asked for it", () => {
+  const a = accountFor({ key: "tok" });
+  assert.equal(a.token, "tok");
+  assert.equal(a.named, "");
+});
+
+test("an empty answer leaves the token's own account id", () => {
+  const a = accountFor({ key: "old:tok", metadata: { accountId: "" } });
+  assert.equal(a.named, "old");
+  assert.equal(a.token, "tok");
+});
+
+test("no sign-in at all is no token and no account", () => {
+  const a = accountFor(undefined);
+  assert.equal(a.token, "");
+  assert.equal(a.named, "");
+});

package/index.mjs

@@ -110,6 +110,18 @@ export async function ask({ token, named, model, question, signal }) {
   return { status: 200, body: JSON.stringify(peel(parsed)) };
 }
 
+// accountFor is the account a key works in, and the key itself: the
+// account named in the sign-in's own answer (the prompt magpie asks and
+// keeps), else the one a key pasted as "<account id>:<token>" names, else
+// none — which asks the token for the account it can list.
+export function accountFor(auth) {
+  const raw = String(auth?.key ?? auth?.apiKey ?? "").trim();
+  const named = String(auth?.metadata?.accountId ?? "").trim();
+  const cut = raw.indexOf(":");
+  if (named) return { token: cut > 0 ? raw.slice(cut + 1).trim() : raw, named };
+  return { token: cut > 0 ? raw.slice(cut + 1).trim() : raw, named: cut > 0 ? raw.slice(0, cut).trim() : "" };
+}
+
 export async function CfJevPlugin() {
   return {
     config: async (cfg) => {
@@ -133,17 +145,27 @@ export async function CfJevPlugin() {
         {
           type: "api",
           label: "Cloudflare API token (Workers AI)",
-          placeholder: "token, or <account id>:<token>",
+          placeholder: "token",
+          // the account the token works in, asked on its own: a token made
+          // for Workers AI alone cannot list the accounts, and the run
+          // needs the account's id. Left empty, the token is asked for it.
+          prompts: [
+            {
+              type: "text",
+              key: "accountId",
+              message: "Your Cloudflare account ID (the 32 hex digits in the dashboard; empty if the token can list accounts)",
+              placeholder: "f14d88531a144167d91b1be6fb789b3f",
+              validate: (v) => {
+                const s = String(v ?? "").trim();
+                if (!s || /^[0-9a-f]{32}$/i.test(s)) return undefined;
+                return "An account ID is 32 hexadecimal digits (or empty)";
+              },
+            },
+          ],
         },
       ],
       async loader(getAuth) {
-        const auth = (await getAuth()) ?? {};
-        const raw = String(auth.key ?? auth.apiKey ?? "").trim();
-        // a key pasted as "<account id>:<token>" names the account itself,
-        // which a token made for Workers AI alone can't be asked for
-        const cut = raw.indexOf(":");
-        const named = cut > 0 ? raw.slice(0, cut).trim() : "";
-        const token = cut > 0 ? raw.slice(cut + 1).trim() : raw;
+        const { token, named } = accountFor((await getAuth()) ?? {});
         return {
           apiKey: token,
           // where magpie thinks the provider's requests go: this fetch is

package/package.json

@@ -1,13 +1,15 @@
 {
   "name": "@weiping/magpie-cf-jev",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Cloudflare Workers AI (Jev and Clef) as a magpie decision provider, with the answers read out of Cloudflare's envelope",
   "type": "module",
   "main": "./index.mjs",
   "exports": "./index.mjs",
   "files": [
     "index.mjs",
-    "README.md"
+    "README.md",
+    "peel.test.mjs",
+    "account.test.mjs"
   ],
   "keywords": [
     "magpie",
@@ -30,6 +32,6 @@
     "access": "public"
   },
   "scripts": {
-    "test": "node --test peel.test.mjs"
+    "test": "node --test peel.test.mjs account.test.mjs"
   }
 }

package/peel.test.mjs

@@ -0,0 +1,65 @@
+// peel.test.mjs: what the answers are read out of, and what is left alone.
+// Run: node --test peel.test.mjs
+import assert from "node:assert/strict";
+import test from "node:test";
+import { peel } from "./index.mjs";
+
+// the two envelopes Workers AI puts a Jev's answer in
+const jev = {
+  result: {
+    state: "Completed",
+    result: {
+      model: "jev-1.13.0",
+      answers: { tier: { type: "choice", choice: "fast", confidence: 0.98 } },
+      usage: { input_tokens: 330, output_tokens: 38 },
+    },
+  },
+  success: true,
+  errors: [],
+  messages: [],
+};
+
+// a Clef answers as it is asked: one envelope, and its answers inside
+const clef = {
+  result: {
+    model: "clef",
+    answers: { tier: { type: "choice", choice: "balanced", confidence: 0.4 } },
+    usage: { input_tokens: 143, output_tokens: 0 },
+  },
+  success: true,
+  errors: [],
+  messages: [],
+};
+
+test("a Jev's answer comes out of Cloudflare's and the Jev's own envelope", () => {
+  const out = peel(jev);
+  assert.equal(out.model, "jev-1.13.0");
+  assert.equal(out.answers.tier.choice, "fast");
+});
+
+test("a Clef's answer comes out of Cloudflare's envelope", () => {
+  const out = peel(clef);
+  assert.equal(out.model, "clef");
+  assert.equal(out.answers.tier.choice, "balanced");
+});
+
+test("an answer with no envelope is left as it came", () => {
+  const flat = { model: "jev-1.13.0", answers: { tier: { choice: "fast" } } };
+  assert.deepEqual(peel(flat), flat);
+});
+
+test("a failure is left as it came: its errors are not peeled away", () => {
+  const bad = { success: false, errors: [{ code: 7003, message: "Bad input" }], messages: [] };
+  assert.deepEqual(peel(bad), bad);
+});
+
+test("an answer that keeps an envelope past the fourth stops at four: never peeled forever", () => {
+  let deep = { answers: { tier: { choice: "fast" } } };
+  for (let i = 0; i < 6; i++) deep = { result: deep };
+  const out = peel(deep);
+  // four envelopes taken off, two left: the loop is bounded, not a hunt
+  let depth = 0;
+  for (let cur = out; cur && typeof cur === "object" && cur.result; cur = cur.result) depth++;
+  assert.equal(depth, 2);
+  assert.ok(out.result && out.result.result, "the fifth and sixth envelopes are still there");
+});