cartethyia 2.7.3 → 2.7.5

package/src/providers/integrations/qoder/qoder-oauth.ts

@@ -8,14 +8,16 @@
  * the same endpoints as the upstream client.
  *
  * The issued token is used directly at dispatch: `dt-...` tokens skip the
- * PAT→jobToken exchange. There is no working refresh grant —
- * the upstream refresh endpoint answers 403 for this flow — so no refresher
- * is registered and the token is used exactly as issued until the operator
- * re-runs login. The account's Qoder user id and machine id travel in
- * `auth_state`, because the token itself carries neither and every dispatch
- * needs both for COSY signing.
+ * PAT→jobToken exchange. Refresh uses the deviceToken refresh endpoint
+ * (`POST /api/v1/deviceToken/refresh` with `{refresh_token, machine_id,
+ * machine_token}`), verified live 2026-11-02 — it returns a fresh `dt-…`
+ * and a rotated `drt-…`. The account's Qoder user id and machine id travel
+ * in `auth_state`, because the token itself carries neither and every
+ * dispatch needs both for COSY signing.
  */
 import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { execSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { QODER_REALMS, type QoderRealm } from "./qoder-realm";
 import {
   base64UrlEncode,
@@ -28,7 +30,7 @@ import type {
   OAuthDeviceStartResult,
   OAuthExchangeResult,
 } from "../../authentication/oauth-flow-store";
-import type { OAuthTokenRefreshResult } from "../../authentication/oauth-refresh-service";
+import type { OAuthTokenRefreshResult, OAuthRefreshContext } from "../../authentication/oauth-refresh-service";
 import { OAuthDeviceFlow } from "../../authentication/oauth-device-flow";
 
 /** One Qoder account profile, as much of it as the gateway uses. */
@@ -109,9 +111,7 @@ export function readQoderUserInfo(body: Record<string, unknown>): QoderUserInfo
 }
 
 /** Global/intl endpoints. Kept as the default realm's values, unchanged. */
-export const QODER_LOGIN_URL = "https://qoder.com/device/selectAccounts" as const;
 export const QODER_DEVICE_TOKEN_URL = "https://openapi.qoder.sh/api/v1/deviceToken/poll" as const;
-export const QODER_USERINFO_URL = "https://openapi.qoder.sh/api/v1/userinfo" as const;
 
 /**
  * Per-realm device endpoints, derived from `QODER_REALMS`.
@@ -221,6 +221,82 @@ function parseDeviceState(value: string | undefined): QoderDeviceState | undefin
   return { verifier, machineId };
 }
 
+/**
+ * Random PKCE verifier in the exact alphabet the desktop IDE uses.
+ *
+ * The IDE's `startDeviceFlow` draws the verifier from
+ * `ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~`. Using
+ * the same alphabet keeps the login byte-for-byte identical to the desktop
+ * client, which the approval server may use to fingerprint the requesting
+ * client. Length is fixed at 64 — RFC 7636 §4.1 requires [43,128]; a fixed
+ * length avoids a non-cryptographic length while the content comes entirely
+ * from the CSPRNG (`randomBytes`) below.
+ */
+function qoderIdeVerifier(): string {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+  // RFC 7636 §4.1: verifier length must be within [43,128]; fixed here. Content
+  // comes from the CSPRNG (randomBytes) below. `67` (alphabet length) does not
+  // divide 256, so the `%` mapping has a negligible modulo bias (~21/256 per
+  // char) — irrelevant for a 64-char secret with ~388 bits of input entropy.
+  const length = 64;
+  const bytes = randomBytes(length);
+  let out = "";
+  for (let i = 0; i < length; i += 1) {
+    out += alphabet[bytes[i]! % alphabet.length];
+  }
+  return out;
+}
+
+/**
+ * The hardware machine id the desktop IDE reports for the device flow.
+ *
+ * The IDE's `getMachineId` is platform-hardware-derived: Windows reads
+ * `MachineGuid` from `HKLM\SOFTWARE\Microsoft\Cryptography`, macOS reads the
+ * `IOPlatformUUID` from IORegistry, Linux reads `/etc/machine-id`. The device
+ * login sends it as `machine_id`, and the upstream correlates the approved
+ * device to the account. A random UUID instead registers a different device,
+ * which is the observable difference between an IDE login that chats and a
+ * gateway login that is refused with quota errors.
+ *
+ * Returns the hardware id when it can be read, else `""` so callers fall back
+ * to a random UUID exactly like the IDE does on an unreadable machine.
+ */
+export function qoderHardwareMachineId(): string {
+  try {
+    if (process.platform === "win32") {
+      const out = execSync('reg query "HKLM\\SOFTWARE\\Microsoft\\Cryptography" /v MachineGuid', {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 5000,
+      });
+      const m = /MachineGuid\s+REG_SZ\s+([0-9a-fA-F-]+)/.exec(out);
+      return m?.[1]?.trim() ?? "";
+    }
+    if (process.platform === "darwin") {
+      const out = execSync("ioreg -rd1 -c IOPlatformExpertDevice", {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 5000,
+      });
+      const m = /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out);
+      return m?.[1]?.trim() ?? "";
+    }
+    if (process.platform === "linux") {
+      for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+        try {
+          const v = readFileSync(p, "utf8").trim();
+          if (v) return v;
+        } catch {
+          // try the next candidate
+        }
+      }
+    }
+  } catch {
+    // fall through to the caller's random fallback
+  }
+  return "";
+}
+
 export class QoderOAuthClient extends OAuthDeviceFlow {
   override readonly supportsDeviceCode = true;
   override readonly supportsBrowserCode = false;
@@ -254,25 +330,35 @@ export class QoderOAuthClient extends OAuthDeviceFlow {
   override async startDeviceAuth(
     _context?: OAuthDeviceFlowContext,
   ): Promise<OAuthDeviceStartResult> {
-    const verifier = base64UrlEncode(randomBytes(32));
+    // 1:1 with the desktop IDE device flow (unpacked worker `startDeviceFlow`):
+    // the verifier is random from the IDE's own alphabet (`A-Za-z0-9-._~`,
+    // 43–128 chars), the challenge is PKCE S256, the nonce is a full UUID
+    // (dashes included), and the client id is ALWAYS sent — intl uses the
+    // same id the realm table carries, CN uses its own. Sending no client id
+    // (or stripping the UUID dashes) makes the approval screen classify the
+    // device differently and can produce an account the model server later
+    // refuses with quota/entitlement errors.
+    //
+    // The machine id defaults to the hardware id (same source the IDE reads),
+    // but an operator may pass `machine_id`/`machine_token` through
+    // `context.parameters` to reuse a device identity the IDE already holds
+    // (e.g. `aicoding.loginMachineIdentity.v1.qoder.local`) — the upstream
+    // correlates the approved device to the account, so matching the IDE's
+    // device is how a gateway login chats on the same account the IDE does.
+    const overrideMachineId = nonEmptyTrimmedString(_context?.parameters?.["machine_id"]);
+    const overrideMachineToken = nonEmptyTrimmedString(_context?.parameters?.["machine_token"]);
+    const verifier = qoderIdeVerifier();
     const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
-    // CN carries a dashed nonce and additionally states the client id and
-    // native redirect; intl stays on the 32-hex nonce and the two params it
-    // has always sent. Both shapes are upstream fact from the donor, and only
-    // the CN branch is new, so the working intl URL is untouched.
-    const nonce = this.realm === "cn" ? randomUUID() : randomUUID().replaceAll("-", "");
-    const machineId = randomUUID();
+    const nonce = randomUUID();
+    const machineId = overrideMachineId ?? (qoderHardwareMachineId() || randomUUID());
     const params = new URLSearchParams({
       challenge,
       challenge_method: "S256",
-      machine_id: machineId,
       nonce,
+      machine_id: machineId,
+      client_id: QODER_REALMS[this.realm].clientId,
     });
-    if (this.realm === "cn") {
-      const config = QODER_REALMS.cn;
-      params.set("client_id", config.clientId);
-      params.set("redirect_uri", config.redirectUri);
-    }
+    if (overrideMachineToken !== undefined) params.set("machine_token", overrideMachineToken);
     return {
       verificationUri: `${qoderOAuthUrls(this.realm).loginUrl}?${params.toString()}`,
       // This flow shows no user code: approval happens against the
@@ -395,10 +481,64 @@ export class QoderOAuthClient extends OAuthDeviceFlow {
   }
 
   override async refresh(
-    _refreshToken: string,
-    _signal?: AbortSignal,
+    refreshToken: string,
+    signal?: AbortSignal,
+    context?: OAuthRefreshContext,
   ): Promise<OAuthTokenRefreshResult> {
-    throw new Error("Qoder does not support token refresh; sign in again");
+    // The deviceToken refresh endpoint is the one working refresh grant for this
+    // flow (verified live 2026-11-02: POST /api/v1/deviceToken/refresh with
+    // `{refresh_token, machine_id, machine_token}` returns 200 with a fresh
+    // `device_token` + rotated `refresh_token`). The abstract OAuth refresh
+    // endpoint answers 403 for this flow, so we post to the deviceToken one.
+    const authState = record(context?.auth_state);
+    const machineId = authState === undefined ? undefined : nonEmptyTrimmedString(authState.machineId);
+    if (machineId === undefined) {
+      throw new Error("Qoder refresh requires auth_state.machineId");
+    }
+    const response = await this.fetchFn(
+      `${qoderOAuthUrls(this.realm).deviceTokenUrl}/refresh`,
+      {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          accept: "application/json",
+          "user-agent": "Go-http-client/2.0",
+        },
+        body: JSON.stringify({
+          refresh_token: refreshToken,
+          machine_id: machineId,
+          machine_token: machineId,
+        }),
+        ...(signal === undefined ? {} : { signal }),
+      },
+    );
+    const raw = await response.text();
+    let payload: unknown;
+    try {
+      payload = JSON.parse(raw);
+    } catch {
+      throw new Error(`Qoder token refresh returned invalid JSON (${response.status})`);
+    }
+    if (!response.ok) {
+      const message = record(payload);
+      throw new Error(
+        nonEmptyTrimmedString(message?.message) ??
+          nonEmptyTrimmedString(message?.errorMessage) ??
+          `Qoder token refresh failed (${response.status})`,
+      );
+    }
+    const body = record(payload);
+    const deviceToken = body === undefined ? undefined : nonEmptyTrimmedString(body.device_token);
+    if (deviceToken === undefined) {
+      throw new Error("Qoder token refresh response omitted device_token");
+    }
+    const nextRefresh = nonEmptyTrimmedString(body?.refresh_token);
+    const expiresAt = new Date(parseQoderExpiry(body?.expires_at, body?.expires_in));
+    return {
+      access: deviceToken,
+      ...(nextRefresh === undefined ? {} : { refresh: nextRefresh }),
+      expiresAt,
+    };
   }
 }
 

package/src/providers/integrations/qoder/qoder-quota.ts

@@ -1,8 +1,10 @@
 // Qoder quota.
 //
-// `GET /api/v2/quota/usage` on the **openapi** host, with a plain bearer token
-// — no COSY signature on this surface, which is the one place the business API
-// differs from inference.
+// `GET /api/v2/quota/usage` on the **openapi** host, with a bearer token — no
+// COSY signature on this surface, which is the one place the business API
+// differs from inference. Device tokens (`dt-…`) are used directly; a PAT
+// (`pt-…`) is exchanged for a job token (`jt-…`) first, because the business
+// API rejects a raw PAT with 401 `TOKEN_EXPIRE`.
 //
 // The response carries two quota objects and they are not interchangeable:
 //
@@ -36,6 +38,7 @@ import {
 import type { QuotaCollectionContext } from "../../quota/quota-support";
 import { log } from "../../../observability/logger";
 import { QODER_REALMS, type QoderRealm } from "./qoder-realm";
+import { isQoderPat, resolveQoderAuth } from "./qoder";
 
 /** Paths on the realm's openapi host. */
 const QUOTA_PATH = "/api/v2/quota/usage";
@@ -75,7 +78,29 @@ function creditWindow(
 ): ProviderQuotaWindow | null {
   if (remaining === null && limit === null) return null;
   const used = remaining !== null && limit !== null ? limit - remaining : null;
-  return percentWindow(kind, label, null, resetsAt, used, limit, "pooled");
+  // Give pooled windows a percentage so the console can render a real bar and
+  // tone instead of an uncolored "quota-only" row (which is what a null
+  // percent produced: every Qoder account was grey, and "enable available
+  // accounts" could never match a window). A ceiling of 0 with nothing left is
+  // a spent balance — report 0% remaining rather than a null percent.
+  let usedPercent: number | null = null;
+  if (remaining !== null && limit !== null) {
+    if (limit > 0) usedPercent = ((limit - remaining) / limit) * 100;
+    else if (remaining <= 0) usedPercent = 100;
+  }
+  return percentWindow(kind, label, usedPercent, resetsAt, used, limit, "pooled");
+}
+
+/**
+ * The business API answers "never resets" with a far-future sentinel
+ * (`9999-12-31T00:00:00.000Z`). Keeping it on the wire makes the console show
+ * a 7978-year countdown. Any date at or beyond year 9999 means no reset.
+ */
+function normalizeQoderReset(resetsAt: string | null): string | null {
+  if (resetsAt === null) return null;
+  const date = new Date(resetsAt);
+  if (!Number.isFinite(date.getTime())) return null;
+  return date.getUTCFullYear() >= 9999 ? null : resetsAt;
 }
 
 /**
@@ -103,11 +128,28 @@ export async function fetchQoderQuota(
 
   let payload: unknown;
   try {
+    // A PAT (`pt-…`) is not an active bearer on the business API: it is a
+    // minted credential that must be exchanged for a short-lived job token
+    // (`jt-…`) first. Verified live 2026-11-02: a raw `pt-…` bearer answers
+    // 401 `TOKEN_EXPIRE` while the exchanged `jt-…` answers 200. Device
+    // tokens (`dt-…`) are used directly. A failed exchange — expired/revoked
+    // PAT — is an unreadable balance, not an error that cools the account.
+    let bearer = credential;
+    if (isQoderPat(credential)) {
+      const auth = await resolveQoderAuth({
+        secret: credential,
+        authState: raw,
+        signal: AbortSignal.timeout(15_000),
+        fetcher,
+        realm,
+      });
+      bearer = auth.securityOauthToken;
+    }
     const response = await fetcher(url, {
       method: "GET",
       headers: {
         accept: "application/json",
-        authorization: `Bearer ${credential}`,
+        authorization: `Bearer ${bearer}`,
         "user-agent": config.userAgent,
       },
     });
@@ -148,7 +190,7 @@ export async function fetchQoderQuota(
     return { source: "qoder", plan: null, windows: [], error: null };
   }
 
-  const resetsAt = isoDate(root["expiresAt"] ?? root["expireAt"] ?? root["expires_at"]);
+  const resetsAt = normalizeQoderReset(isoDate(root["expiresAt"] ?? root["expireAt"] ?? root["expires_at"]));
   const windows: ProviderQuotaWindow[] = [];
   const plan = creditWindow("qoder:plan", "Plan credits", number(userQuota?.["remaining"]), number(userQuota?.["total"]), resetsAt);
   if (plan) windows.push(plan);

package/src/providers/integrations/qoder/qoder-realm.ts

@@ -39,6 +39,25 @@ export const QODER_CHAT_PATH =
   "/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1";
 export const QODER_MODELS_PATH = "/algo/api/v2/model/list?Encode=1";
 
+/**
+ * The modern model-server surface used by the IDE / QoderWake (OpenAI-shaped
+ * chunks, plain bearer auth). This surface streams immediately and echoes the
+ * real model key — the legacy `/algo` chat endpoint answers
+ * `10605 isQueued` (parking requests in a server-side queue) and echoes a
+ * fixed `"auto"` model. Dispatch tries this surface first, and falls back to
+ * legacy COSY only when it refuses the account on entitlement grounds (HTTP
+ * 402 / `{"code":116}`) AND the dispatched model is a free-tier row — for a
+ * billed model the same code is genuine quota exhaustion and must surface.
+ */
+export const QODER_IDE_CHAT_PATH = "/model/v1/chat/completions";
+
+/** The model-server host for one realm (intl: `api2-v2`, cn: gateway). */
+export function qoderIdeChatUrl(realm: QoderRealm): string {
+  return realm === "cn"
+    ? `https://gateway.qoder.com.cn${QODER_IDE_CHAT_PATH}`
+    : `https://api2-v2.qoder.sh${QODER_IDE_CHAT_PATH}`;
+}
+
 /**
  * Realm → deployment.
  *
@@ -61,7 +80,9 @@ export const QODER_REALMS: Readonly<Record<QoderRealm, QoderRealmConfig>> = {
     gatewayFallbacks: [],
     openapi: "https://openapi.qoder.com.cn",
     website: "https://qoder.com.cn",
-    clientId: "1c5e33e1-364d-4ce6-b02c-acaa81274a5c",
+    // 1:1 with the desktop IDE's device flow (`Hfl` in the unpacked worker):
+    // the client id the IDE registers for the CN deployment.
+    clientId: "e93fe488-5778-4c35-a6fc-0f54ed7b3139",
     redirectUri: "qoder-work-cn://",
     userAgent: "QoderWork/1.1.64",
   },
@@ -97,30 +118,3 @@ export function qoderInferenceCandidates(
   }
   return [config.gateway, ...config.gatewayFallbacks];
 }
-
-/**
- * Model keys that exist in exactly one realm.
- *
- * From the donor's `INTL_EXCLUSIVE` / `CN_EXCLUSIVE` tables. A request for one
- * of these on the wrong realm does not degrade — it is refused — so the roster
- * each realm publishes is the authority, not a union.
- */
-export const QODER_INTL_EXCLUSIVE: ReadonlySet<string> = new Set([
-  "fast",
-  "efficient",
-  "cmodel",
-  "smodel",
-  "ultimate",
-  "performance",
-]);
-
-export const QODER_CN_EXCLUSIVE: ReadonlySet<string> = new Set([
-  "q37fmodel",
-  "gm51model",
-]);
-
-/** True when this model key is served only by the other realm. */
-export function isForeignQoderModel(realm: QoderRealm, modelId: string): boolean {
-  const foreign = realm === "cn" ? QODER_INTL_EXCLUSIVE : QODER_CN_EXCLUSIVE;
-  return foreign.has(modelId.trim().toLowerCase());
-}

package/src/providers/integrations/qoder/qoder-sse.ts

@@ -0,0 +1,159 @@
+/**
+ * Qoder-specific SSE decoding.
+ *
+ * The generic `decodeSseEvents` splits on newlines and treats a bare line
+ * (no `data:` prefix) with no open event as malformed. Qoder's IDE surface
+ * embeds literal newline bytes inside JSON string values (e.g. `raw_usage`
+ * keys like `"data_policy_preferre\n\nnd_count"`), which fragments one logical
+ * `data:` event into many physical lines — including blank lines that are not
+ * event boundaries. The generic decoder can throw `Malformed SSE line` on the
+ * trailing fragments of those giant events.
+ *
+ * This decoder is tolerant by construction: it accumulates one event's payload
+ * across `data:` lines, bare continuations, and blank lines until the payload
+ * is a complete JSON value or the `[DONE]` sentinel. It never throws on a
+ * bare fragment — payload completeness is the only way an event ends.
+ */
+
+export interface QoderSseEvent {
+  readonly event: string | null;
+  readonly data: string;
+}
+
+const DEFAULT_MAX_EVENT_BYTES = 8 * 1024 * 1024;
+
+/** True when the accumulated text is a complete JSON value (or non-JSON text). */
+function isCompleteJsonValue(data: string): boolean {
+  if (data.length === 0) return true;
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < data.length; i += 1) {
+    const ch = data[i]!;
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (ch === "\\") {
+        escaped = true;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+    } else if (ch === "{" || ch === "[") {
+      depth += 1;
+    } else if (ch === "}" || ch === "]") {
+      depth -= 1;
+      if (depth < 0) return true;
+    }
+  }
+  return depth <= 0;
+}
+
+/**
+ * Decodes Qoder SSE into complete events.
+ */
+export async function* decodeQoderSseEvents(
+  body: ReadableStream<Uint8Array> | null,
+  signal?: AbortSignal,
+  maxEventBytes = DEFAULT_MAX_EVENT_BYTES,
+): AsyncIterable<QoderSseEvent> {
+  if (body === null) return;
+
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let lineBuffer = "";
+  let current: string | null = null; // accumulated payload of the open event
+  let eventBytes = 0;
+
+  /** Returns the open payload when complete, else null (clearing it). */
+  const takeComplete = (): string | null => {
+    if (current === null) return null;
+    const trimmed = current.trim();
+    if (trimmed.length === 0) {
+      current = null;
+      eventBytes = 0;
+      return null;
+    }
+    if (trimmed === "[DONE]" || isCompleteJsonValue(trimmed)) {
+      const data = current;
+      current = null;
+      eventBytes = 0;
+      return data;
+    }
+    return null;
+  };
+
+  const appendPayload = (text: string): void => {
+    if (current === null) return;
+    current += text;
+    eventBytes += text.length;
+    if (eventBytes > maxEventBytes) throw new Error("SSE event exceeds size bound");
+  };
+
+  /** Emit a complete open payload, if any. Returns `true` when the stream ends. */
+  function* emitComplete(): Generator<QoderSseEvent, boolean, void> {
+    const data = takeComplete();
+    if (data === null) return false;
+    if (data.trim() === "[DONE]") return true;
+    yield { event: null, data };
+    return false;
+  }
+
+  try {
+    for (;;) {
+      if (signal?.aborted) return;
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value || value.byteLength === 0) continue;
+      lineBuffer += decoder.decode(value, { stream: true });
+
+      for (;;) {
+        const nl = lineBuffer.indexOf("\n");
+        if (nl < 0) break;
+        const line = lineBuffer.slice(0, nl);
+        lineBuffer = lineBuffer.slice(nl + 1);
+        const trimmed = line.trim();
+
+        // Comments, event names, and other fields carry no payload.
+        if (trimmed.startsWith(":") || trimmed.startsWith("event:")) continue;
+
+        if (trimmed.startsWith("data:")) {
+          // A fresh `data:` — flush a complete open event first, then start a
+          // new payload with the slice after the prefix.
+          if (yield* emitComplete()) return;
+          current = line.slice(5).trimStart();
+          eventBytes = current.length;
+          if (eventBytes > maxEventBytes) throw new Error("SSE event exceeds size bound");
+          continue;
+        }
+
+        // Other known fields (id:, retry:, vendor extensions) carry no payload.
+        if (/^[a-zA-Z0-9_-]+:/.test(trimmed)) continue;
+
+        if (trimmed.length === 0) {
+          // Blank line: an event boundary only when the open payload is
+          // complete; otherwise it is a literal newline inside the JSON string.
+          if (yield* emitComplete()) return;
+          if (current !== null) appendPayload("\n");
+          continue;
+        }
+
+        // Bare line: continuation of the open payload (Qoder fragments JSON
+        // across physical lines with literal newlines inside strings).
+        if (current !== null) {
+          appendPayload("\n" + line);
+          if (yield* emitComplete()) return;
+          continue;
+        }
+        // Bare line with no open payload: ignore (tolerant by design).
+      }
+    }
+
+    yield* emitComplete();
+  } finally {
+    reader.releaseLock();
+  }
+}