dsh-connect-qoder 0.1.1 → 0.2.0

package/lib/credentials.js

@@ -21,7 +21,7 @@
 import { execFileSync } from 'node:child_process'
 import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { join, basename } from 'node:path'
 import { createDecipheriv } from 'node:crypto'
 import { DatabaseSync } from 'node:sqlite'
 
@@ -49,6 +49,11 @@ export const REGIONS = [
     mode: 'cn',
     displayName: 'Qoder CN',
     appNames: ['QoderCN', 'Qoder CN', 'QoderWork CN'],
+    // Qoder 0.3.x moved its user data to a `com.<vendor>.app.<channel>` Electron
+    // directory and replaced the VS Code `state.vscdb` store with `auth.v1.dat`.
+    // Both layouts are listed so a user who upgrades keeps working; the newer
+    // one is tried first because that is where a freshly installed app writes.
+    newAppNames: ['com.qodercn.app.stable'],
     baseUrl: 'https://gateway.qoder.com.cn/',
     openApiUrl: 'https://openapi.qoder.com.cn',
     centerUrl: 'https://gateway.qoder.com.cn',
@@ -60,6 +65,7 @@ export const REGIONS = [
     mode: 'global',
     displayName: 'Qoder',
     appNames: ['Qoder', 'QoderWork'],
+    newAppNames: ['com.qoder.app.stable'],
     baseUrl: 'https://api3.qoder.sh/',
     openApiUrl: 'https://openapi.qoder.sh',
     centerUrl: 'https://center.qoder.sh',
@@ -218,11 +224,14 @@ function stateDbCandidates(appDir) {
 /**
  * The machine id Qoder binds its session to.
  *
- * `machineid` sits beside `Local State`; when it is missing a stable value is
- * derived from the app directory so repeated runs still agree with each other.
+ * The legacy layout keeps it in `machineid`; 0.3.x renamed the file to
+ * `auth.machine-id`. Both are checked because the id is sent to the gateway
+ * alongside the token, and a wrong one is indistinguishable from a hijacked
+ * session. When neither exists a stable value is derived from the app directory
+ * so repeated runs still agree with each other.
  */
 function machineIdFor(appDir, fallback) {
-  for (const name of ['machineid', 'machineId']) {
+  for (const name of ['auth.machine-id', 'machineid', 'machineId']) {
     const p = join(appDir, name)
     if (!existsSync(p)) continue
     const value = readFileSync(p, 'utf8').trim()
@@ -231,16 +240,91 @@ function machineIdFor(appDir, fallback) {
   return fallback
 }
 
+/**
+ * Read the 0.3.x credential file.
+ *
+ * From 0.3.x the apps keep their sign-in in
+ * `<userData>/auth.v1.dat` — a Chromium OSCrypt blob whose plaintext is the
+ * session JSON directly, rather than a row inside a VS Code `state.vscdb`:
+ *
+ * ```json
+ * { "schemaVersion": 1, "token": "dt-…", "refreshToken": "drt-…",
+ *   "expiresAt": "2026-10-19T07:44:22Z", "refreshTokenExpiresAt": "…",
+ *   "user": { "id": "…", "name": "…", "email": "…" } }
+ * ```
+ *
+ * The envelope is unchanged (`v10` + AES-256-GCM under the DPAPI-wrapped key),
+ * so {@link oscryptKeyFor} and {@link decryptOscrypt} are reused as they are.
+ *
+ * @returns a credential record, or `undefined` when the file is absent or
+ *   cannot be decoded.
+ */
+function loadNewCredential(region, appDir, oscryptKey) {
+  const file = join(appDir, 'auth.v1.dat')
+  if (!existsSync(file)) return undefined
+  const plain = decryptOscrypt(readFileSync(file), oscryptKey)
+  if (plain === undefined) return undefined
+  let session
+  try {
+    session = JSON.parse(plain)
+  } catch {
+    return undefined
+  }
+  if (session === null || typeof session !== 'object') return undefined
+  if (typeof session.token !== 'string' || session.token.length === 0) return undefined
+  const user = session.user !== null && typeof session.user === 'object' ? session.user : {}
+  const userID = typeof user.id === 'string' ? user.id : ''
+  if (userID.length === 0) return undefined
+  // The new file carries ISO timestamps rather than epoch millis.
+  const expiresAt = Date.parse(session.expiresAt)
+  const refreshExpiresAt = Date.parse(session.refreshTokenExpiresAt)
+  return {
+    region: region.id,
+    appName: basename(appDir),
+    userID,
+    name: typeof user.name === 'string' ? user.name : '',
+    email: typeof user.email === 'string' ? user.email : '',
+    token: session.token,
+    refreshToken: typeof session.refreshToken === 'string' ? session.refreshToken : '',
+    refreshTokenExpiresAt: Number.isFinite(refreshExpiresAt) ? refreshExpiresAt : 0,
+    expiresAt: Number.isFinite(expiresAt) ? expiresAt : 0,
+    expired: Number.isFinite(expiresAt) && expiresAt > 0 ? expiresAt <= Date.now() : false,
+    // The new layout does not publish these; they were only ever used for
+    // display, and the catalog call supplies what routing actually needs.
+    userType: '',
+    userTag: '',
+    machineID: machineIdFor(appDir, `dsh-connect-qoder-${region.id}`),
+    source: 'app',
+    plan: undefined,
+    usage: undefined,
+  }
+}
+
 /**
  * Load one region's credential from the local Qoder apps.
  *
+ * The 0.3.x layout is tried before the legacy one, because that is where a
+ * freshly installed app writes; a user who upgrades therefore keeps working
+ * without a reinstall, and a user who has not upgraded is unaffected.
+ *
  * Every candidate app is tried in order; the first that yields a decryptable
- * `userInfo` row wins. A credential whose access token has expired is still
+ * credential wins. A credential whose access token has expired is still
  * returned — the caller decides whether to refresh it — but `expired` says so.
  *
  * @returns a credential record, or `undefined` when no app holds a usable one.
  */
 export function loadCredential(region, appDataRoot) {
+  // 0.3.x: `com.<vendor>.app.stable/auth.v1.dat`.
+  for (const appName of region.newAppNames ?? []) {
+    const appDir = join(appDataRoot, appName)
+    if (!existsSync(appDir)) continue
+    const oscryptKey = oscryptKeyFor(appDir)
+    if (oscryptKey === undefined) continue
+    const credential = safeRead(() => loadNewCredential(region, appDir, oscryptKey))
+    if (credential !== undefined) return credential
+  }
+
+  // Legacy: `<AppName>/User/globalStorage/state.vscdb`.
   for (const appName of region.appNames) {
     const appDir = join(appDataRoot, appName)
     if (!existsSync(appDir)) continue

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-qoder",
   "displayName": "DSH Connect Qoder",
   "description": "将本机已登录的 Qoder（国内版 Qoder CN / 国际版 Qoder）模型接入 DeepSeek Harness —— bring locally signed-in Qoder models into DeepSeek Harness with zero configuration.",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "author": "hdhgsysh",
   "homepage": "https://github.com/hdhgsysh/dsh-connect-qoder",
   "repository": {