opencode-lobster-auth 0.1.1 → 0.1.2

package/lib/auth-login.mjs

@@ -1,131 +1,154 @@
-// 浏览器登录，走 LobsterAI 桌面端自己的通道。
-//
-// portal 的 auth 模块允许把授权码回调到任意
-// http://127.0.0.1:<port>/auth/callback（条件是 http + 127.0.0.1 +
-// /auth/callback + 有端口），因此插件可以自带登录，不依赖桌面端。
-// 参数必须追加到登录页的 hash query，不是 URL query；且必须带
-// source=electron，否则 portal 不会带上 redirect_uri。
-
-import { createServer } from "node:http"
-import { randomBytes } from "node:crypto"
-import { API, LOGIN_URL } from "./constants.mjs"
-import { jwtExp, accountOf } from "./jwt.mjs"
-
-const TIMEOUT_MS = 5 * 60 * 1000
-
-export function authorizeUrl(loginUrl, callbackUrl, state) {
-  const base = loginUrl || LOGIN_URL
-  const hashAt = base.indexOf("#")
-  const head = hashAt === -1 ? base : base.slice(0, hashAt)
-  const hash = hashAt === -1 ? "" : base.slice(hashAt + 1)
-  const [route, query = ""] = hash.split("?")
-  const q = new URLSearchParams(query)
-  q.set("source", "electron")
-  q.set("redirect_uri", callbackUrl)
-  q.set("state", state)
-  return `${head}#${route}?${q.toString()}`
-}
-
-// 起一个只监听 127.0.0.1 的临时服务；端口由系统分配（listen 0）。
-// 返回 { port, result(ms), close() }，把「等回调」和「关服务」分开，
-// 这样调用方可以先拿到端口拼 URL，再去等结果。
-function listenOnce() {
-  return new Promise((resolve, reject) => {
-    let deliver = () => {}
-    const got = new Promise((r) => { deliver = r })
-    let timer = null
-    const server = createServer((req, res) => {
-      const u = new URL(req.url, "http://127.0.0.1")
-      if (u.pathname !== "/auth/callback") { res.writeHead(404).end(); return }
-      const code = u.searchParams.get("code")
-      const state = u.searchParams.get("state")
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" })
-      res.end(code
-        ? "<h2>登录成功，可以关闭此页面。</h2>"
-        : "<h2>登录失败：没有拿到授权码。</h2>")
-      deliver({ code, state })
-    })
-    server.on("error", reject)
-    server.listen(0, "127.0.0.1", () => {
-      const { port } = server.address()
-      resolve({
-        port,
-        close() {
-          if (timer) clearTimeout(timer)
-          try { server.close() } catch {}
-        },
-        result(ms) {
-          const late = new Promise((r) => {
-            timer = setTimeout(() => r({ error: new Error("登录超时（5 分钟）") }), ms)
-          })
-          return Promise.race([got, late]).then((v) => {
-            if (v?.error) throw v.error
-            return v
-          })
-        },
-      })
-    })
-  })
-}
-
-async function exchangeCode(code) {
-  const res = await fetch(`${API}/auth/exchange`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ authCode: code, firstKeyfrom: "official", latestKeyfrom: "official" }),
-    signal: AbortSignal.timeout(30_000),
-  })
-  const text = await res.text()
-  let v
-  try { v = JSON.parse(text) } catch { throw new Error(`LobsterAI 的登录响应无法解析：${text.slice(0, 200)}`) }
-  // /api/* 用 {code, message, data} 信封，业务错误也是 HTTP 200
-  if (v?.code !== 0 || !v?.data) {
-    throw new Error(`LobsterAI 拒绝了登录：${v?.message || `code ${v?.code}`}`)
-  }
-  return v.data
-}
-
-// beginSignIn 起回调服务并拼出授权地址，然后把「等回调并换 token」交给
-// finish()。分成两半是因为由 magpie 负责打开 authorize 返回的 url ——
-// 插件自己再开一次就会开两个标签页。
-export async function beginSignIn({ timeoutMs = TIMEOUT_MS } = {}) {
-  const state = randomBytes(24).toString("base64url")
-  const listening = await listenOnce()
-  const callbackUrl = `http://127.0.0.1:${listening.port}/auth/callback`
-  const url = authorizeUrl(LOGIN_URL, callbackUrl, state)
-
-  const finish = async () => {
-    try {
-      const got = await listening.result(timeoutMs)
-      if (got.state !== state) throw new Error("登录回调的 state 不匹配，已忽略")
-      const data = await exchangeCode(got.code)
-      const access = String(data.accessToken ?? "")
-      if (!access) throw new Error("LobsterAI 没有返回 accessToken")
-      const who = accountOf(access)
-      return {
-        type: "success",
-        refresh: String(data.refreshToken ?? ""),
-        access,
-        expires: jwtExp(access) || Date.now() + 30 * 24 * 3600 * 1000,
-        accountId: who.yid ?? (who.id !== undefined ? String(who.id) : undefined),
-      }
-    } finally {
-      listening.close()
-    }
-  }
-
-  return { url, finish, close: () => listening.close() }
-}
-
-// signIn 是 beginSignIn 的「自己开浏览器」封装：给命令行与测试用。
-// open 可注入，因此测试里不必真的弹浏览器。
-export async function signIn({ open, timeoutMs = TIMEOUT_MS } = {}) {
-  const pending = await beginSignIn({ timeoutMs })
-  try {
-    await open(pending.url)
-    return await pending.finish()
-  } catch (e) {
-    pending.close()
-    throw e
-  }
-}
+// 浏览器登录，走 LobsterAI 桌面端自己的通道。
+//
+// portal 的 auth 模块允许把授权码回调到任意
+// http://127.0.0.1:<port>/auth/callback（条件是 http + 127.0.0.1 +
+// /auth/callback + 有端口），因此插件可以自带登录，不依赖桌面端。
+// 参数必须追加到登录页的 hash query，不是 URL query；且必须带
+// source=electron，否则 portal 不会带上 redirect_uri。
+
+import { createServer } from "node:http"
+import { randomBytes } from "node:crypto"
+import { API, LOGIN_URL } from "./constants.mjs"
+import { jwtExp, accountOf } from "./jwt.mjs"
+
+const TIMEOUT_MS = 5 * 60 * 1000
+
+// announce 把回调地址同时放进普通 query（hash 里那份是 portal 要的）。
+// portal 只读 hash，多这一个参数不影响登录——实测带与不带取回的页面字节
+// 完全相同。宿主 Magpie 却只从普通 query 里找 loopback 端口
+// （pluginsignin_paste.go 的 loopbackPorts），找到才为这次登录提供
+// 「回调 URL」输入框：浏览器在另一台机器上时，粘贴登录后落在地址栏的
+// 地址就能完成登录，不用别的通道。
+export function authorizeUrl(loginUrl, callbackUrl, state, { announce = false } = {}) {
+  const base = loginUrl || LOGIN_URL
+  const hashAt = base.indexOf("#")
+  const head = hashAt === -1 ? base : base.slice(0, hashAt)
+  const hash = hashAt === -1 ? "" : base.slice(hashAt + 1)
+  const [route, query = ""] = hash.split("?")
+  const q = new URLSearchParams(query)
+  q.set("source", "electron")
+  q.set("redirect_uri", callbackUrl)
+  q.set("state", state)
+  if (!announce) return `${head}#${route}?${q.toString()}`
+  const at = head.indexOf("?")
+  const plain = new URLSearchParams(at === -1 ? "" : head.slice(at + 1))
+  plain.set("redirect_uri", callbackUrl)
+  const path = at === -1 ? head : head.slice(0, at)
+  return `${path}?${plain.toString()}#${route}?${q.toString()}`
+}
+
+// 起一个只监听 127.0.0.1 的临时服务；端口由系统分配（listen 0）。
+// 返回 { port, result(ms), close() }，把「等回调」和「关服务」分开，
+// 这样调用方可以先拿到端口拼 URL，再去等结果。
+function listenOnce() {
+  return new Promise((resolve, reject) => {
+    let deliver = () => {}
+    const got = new Promise((r) => { deliver = r })
+    let timer = null
+    const server = createServer((req, res) => {
+      const u = new URL(req.url, "http://127.0.0.1")
+      if (u.pathname !== "/auth/callback") { res.writeHead(404).end(); return }
+      const code = u.searchParams.get("code")
+      const state = u.searchParams.get("state")
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" })
+      res.end(code
+        ? "<h2>登录成功，可以关闭此页面。</h2>"
+        : "<h2>登录失败：没有拿到授权码。</h2>")
+      deliver({ code, state })
+    })
+    server.on("error", reject)
+    server.listen(0, "127.0.0.1", () => {
+      const { port } = server.address()
+      resolve({
+        port,
+        close() {
+          if (timer) clearTimeout(timer)
+          try { server.close() } catch {}
+        },
+        result(ms) {
+          const late = new Promise((r) => {
+            timer = setTimeout(() => r({ error: new Error("登录超时（5 分钟）") }), ms)
+          })
+          return Promise.race([got, late]).then((v) => {
+            if (v?.error) throw v.error
+            return v
+          })
+        },
+      })
+    })
+  })
+}
+
+async function exchangeCode(code) {
+  const res = await fetch(`${API}/auth/exchange`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ authCode: code, firstKeyfrom: "official", latestKeyfrom: "official" }),
+    signal: AbortSignal.timeout(30_000),
+  })
+  const text = await res.text()
+  let v
+  try { v = JSON.parse(text) } catch { throw new Error(`LobsterAI 的登录响应无法解析：${text.slice(0, 200)}`) }
+  // /api/* 用 {code, message, data} 信封，业务错误也是 HTTP 200
+  if (v?.code !== 0 || !v?.data) {
+    throw new Error(`LobsterAI 拒绝了登录：${v?.message || `code ${v?.code}`}`)
+  }
+  return v.data
+}
+
+// beginSignIn 起回调服务并拼出授权地址，然后把「等回调并换 token」交给
+// finish()。分成两半是因为由 magpie 负责打开 authorize 返回的 url ——
+// 插件自己再开一次就会开两个标签页。
+//
+// announce 见 authorizeUrl：让宿主知道这次登录的回调端口，它才会提供一个
+// 粘贴回调地址的输入框（浏览器在另一台机器上时用它完成登录）。
+export async function beginSignIn({ timeoutMs = TIMEOUT_MS, announce = false } = {}) {
+  const state = randomBytes(24).toString("base64url")
+  const listening = await listenOnce()
+  const callbackUrl = `http://127.0.0.1:${listening.port}/auth/callback`
+  const url = authorizeUrl(LOGIN_URL, callbackUrl, state, { announce })
+
+  const finish = async () => {
+    try {
+      const got = await listening.result(timeoutMs)
+      if (got.state !== state) throw new Error("登录回调的 state 不匹配，已忽略")
+      const data = await exchangeCode(got.code)
+      const access = String(data.accessToken ?? "")
+      if (!access) throw new Error("LobsterAI 没有返回 accessToken")
+      const who = accountOf(access)
+      return {
+        type: "success",
+        refresh: String(data.refreshToken ?? ""),
+        access,
+        expires: jwtExp(access) || Date.now() + 30 * 24 * 3600 * 1000,
+        accountId: who.yid ?? (who.id !== undefined ? String(who.id) : undefined),
+      }
+    } finally {
+      listening.close()
+    }
+  }
+
+  return { url, finish, close: () => listening.close() }
+}
+
+// beginSignInAnnounced 是给远程（NAS / Docker）用的 beginSignIn：回调服务
+// 照常起在本机 127.0.0.1 上，登录地址额外在普通 query 里写明这个端口。
+// 宿主 Magpie 看到它，就会在登录页旁给出「回调 URL」输入框——浏览器在
+// 另一台机器上时，把登录后地址栏里的完整地址粘回去，Magpie 在本机把请求
+// 送到这个端口，回调照常抵达。没有这一步，浏览器只能和插件在同一台机器上。
+export async function beginSignInAnnounced(opts = {}) {
+  return beginSignIn({ ...opts, announce: true })
+}
+
+// signIn 是 beginSignIn 的「自己开浏览器」封装：给命令行与测试用。
+// open 可注入，因此测试里不必真的弹浏览器。
+export async function signIn({ open, timeoutMs = TIMEOUT_MS } = {}) {
+  const pending = await beginSignIn({ timeoutMs })
+  try {
+    await open(pending.url)
+    return await pending.finish()
+  } catch (e) {
+    pending.close()
+    throw e
+  }
+}

package/lib/constants.mjs

@@ -1,41 +1,41 @@
-// LobsterAI（有道龙虾）的固定事实：地址、客户端标识、未登录时的兜底模型表。
-// 兜底表只在没登录时显示；登录后由 /api/models/available 的实时结果替换。
-
-export const PROVIDER = "lobster"
-export const NAME = "LobsterAI"
-export const BASE = "https://lobsterai-server.youdao.com"
-export const API = BASE + "/api"
-export const CHAT_BASE = BASE + "/api/proxy/v1"
-export const NPM = "@ai-sdk/openai-compatible"
-
-export const LOGIN_URL = "https://lobsterai.youdao.com/portal#/login"
-export const ICON = "https://lobsterai.youdao.com/portal/lobsterai-logo.png"
-
-// 桌面端 2026.9.23 发的标识头；上游不强制，但可能影响特性开关
-export const CLIENT_VERSION = "2026.9.23"
-export const CAPABILITIES = "kimi-k3-agentic-v1,thinking-level-control-v1"
-
-// 接口不提供输出上限，取一个保守值（见设计文档 §8）
-export const DEFAULT_OUTPUT = 32000
-export const DEFAULT_CONTEXT = 1000000
-
-export function configModel({ name, context, output, reasoning, image }) {
-  const input = ["text"]
-  if (image) input.push("image")
-  return {
-    name,
-    limit: { context: context || DEFAULT_CONTEXT, output: output || DEFAULT_OUTPUT },
-    reasoning: !!reasoning,
-    tool_call: true,
-    modalities: { input, output: ["text"] },
-  }
-}
-
-// 兜底：未登录时让用户看到 provider 存在。字段来自实测的模型目录。
-export const FALLBACK_MODELS = {
-  "deepseek-v4-pro": configModel({ name: "DeepSeek V4 Pro", reasoning: true }),
-  "deepseek-flash": configModel({ name: "DeepSeek Flash", reasoning: true }),
-  "glm-5.3": configModel({ name: "GLM-5.3", reasoning: true }),
-  "kimi-k3": configModel({ name: "Kimi K3", reasoning: true, image: true }),
-  "qwen3.8-max": configModel({ name: "Qwen3.8 Max", reasoning: true }),
-}
+// LobsterAI（有道龙虾）的固定事实：地址、客户端标识、未登录时的兜底模型表。
+// 兜底表只在没登录时显示；登录后由 /api/models/available 的实时结果替换。
+
+export const PROVIDER = "lobster"
+export const NAME = "LobsterAI"
+export const BASE = "https://lobsterai-server.youdao.com"
+export const API = BASE + "/api"
+export const CHAT_BASE = BASE + "/api/proxy/v1"
+export const NPM = "@ai-sdk/openai-compatible"
+
+export const LOGIN_URL = "https://lobsterai.youdao.com/portal#/login"
+export const ICON = "https://lobsterai.youdao.com/portal/lobsterai-logo.png"
+
+// 桌面端 2026.9.23 发的标识头；上游不强制，但可能影响特性开关
+export const CLIENT_VERSION = "2026.9.23"
+export const CAPABILITIES = "kimi-k3-agentic-v1,thinking-level-control-v1"
+
+// 接口不提供输出上限，取一个保守值（见设计文档 §8）
+export const DEFAULT_OUTPUT = 32000
+export const DEFAULT_CONTEXT = 1000000
+
+export function configModel({ name, context, output, reasoning, image }) {
+  const input = ["text"]
+  if (image) input.push("image")
+  return {
+    name,
+    limit: { context: context || DEFAULT_CONTEXT, output: output || DEFAULT_OUTPUT },
+    reasoning: !!reasoning,
+    tool_call: true,
+    modalities: { input, output: ["text"] },
+  }
+}
+
+// 兜底：未登录时让用户看到 provider 存在。字段来自实测的模型目录。
+export const FALLBACK_MODELS = {
+  "deepseek-v4-pro": configModel({ name: "DeepSeek V4 Pro", reasoning: true }),
+  "deepseek-flash": configModel({ name: "DeepSeek Flash", reasoning: true }),
+  "glm-5.3": configModel({ name: "GLM-5.3", reasoning: true }),
+  "kimi-k3": configModel({ name: "Kimi K3", reasoning: true, image: true }),
+  "qwen3.8-max": configModel({ name: "Qwen3.8 Max", reasoning: true }),
+}

package/lib/jwt.mjs

@@ -1,34 +1,34 @@
-// LobsterAI 的 accessToken 是标准 JWT（未加密，仅签名）。
-// 插件只读它的载荷，不校验签名——校验由上游负责。
-
-function decode(part) {
-  try {
-    const s = Buffer.from(String(part).replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8")
-    const v = JSON.parse(s)
-    return v && typeof v === "object" ? v : null
-  } catch {
-    return null
-  }
-}
-
-export function jwtPayload(token) {
-  const parts = String(token ?? "").split(".")
-  if (parts.length < 2) return null
-  return decode(parts[1])
-}
-
-// exp 以秒计；返回毫秒，读不到就是 0（magpie 把 0 当作「不续期」）
-export function jwtExp(token) {
-  const p = jwtPayload(token)
-  const exp = Number(p?.exp)
-  return Number.isFinite(exp) && exp > 0 ? exp * 1000 : 0
-}
-
-export function accountOf(token) {
-  const p = jwtPayload(token)
-  if (!p) return {}
-  const out = {}
-  if (p.yid) out.yid = p.yid
-  if (p.sub !== undefined) out.id = p.sub
-  return out
-}
+// LobsterAI 的 accessToken 是标准 JWT（未加密，仅签名）。
+// 插件只读它的载荷，不校验签名——校验由上游负责。
+
+function decode(part) {
+  try {
+    const s = Buffer.from(String(part).replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8")
+    const v = JSON.parse(s)
+    return v && typeof v === "object" ? v : null
+  } catch {
+    return null
+  }
+}
+
+export function jwtPayload(token) {
+  const parts = String(token ?? "").split(".")
+  if (parts.length < 2) return null
+  return decode(parts[1])
+}
+
+// exp 以秒计；返回毫秒，读不到就是 0（magpie 把 0 当作「不续期」）
+export function jwtExp(token) {
+  const p = jwtPayload(token)
+  const exp = Number(p?.exp)
+  return Number.isFinite(exp) && exp > 0 ? exp * 1000 : 0
+}
+
+export function accountOf(token) {
+  const p = jwtPayload(token)
+  if (!p) return {}
+  const out = {}
+  if (p.yid) out.yid = p.yid
+  if (p.sub !== undefined) out.id = p.sub
+  return out
+}

package/lib/sse.mjs

@@ -1,67 +1,67 @@
-// LobsterAI 的推理端点永远以 SSE 作答，即使请求写了 stream:false。
-// 这里把字节流切成 {event, data} 记录，两种情形都由上层决定怎么用。
-
-const decoder = new TextDecoder()
-
-export async function* sse(body) {
-  let buf = ""
-  let event = ""
-  let data = []
-
-  // 一条空行结束一个事件；没有 data 的事件（只有注释）不产出
-  const flush = () => {
-    if (data.length === 0) { event = ""; return null }
-    const rec = { event, data: data.join("\n") }
-    event = ""
-    data = []
-    return rec
-  }
-
-  const feed = (raw) => {
-    const line = raw.endsWith("\r") ? raw.slice(0, -1) : raw
-    if (line === "") return flush()
-    if (line.startsWith(":")) return null // 注释 / keep-alive
-    const i = line.indexOf(":")
-    const field = i === -1 ? line : line.slice(0, i)
-    let value = i === -1 ? "" : line.slice(i + 1)
-    if (value.startsWith(" ")) value = value.slice(1)
-    if (field === "event") event = value
-    else if (field === "data") data.push(value)
-    return null
-  }
-
-  for await (const chunk of body) {
-    buf += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true })
-    let nl
-    while ((nl = buf.indexOf("\n")) !== -1) {
-      const rec = feed(buf.slice(0, nl))
-      buf = buf.slice(nl + 1)
-      if (rec) yield rec
-    }
-  }
-  buf += decoder.decode()
-  if (buf !== "") {
-    const rec = feed(buf)
-    if (rec) yield rec
-  }
-  const last = flush()
-  if (last) yield last
-}
-
-async function* empty() {}
-
-// first 读一条但把它放回去：上游把错误藏在流里，必须先看一眼首条
-export async function first(it) {
-  const n = await it.next()
-  if (n.done) return { head: null, rest: empty() }
-  return { head: n.value, rest: chain([n.value], it) }
-}
-
-export async function* chain(held, it) {
-  yield* held
-  for (;;) {
-    const n = await it.next()
-    if (n.done) return
-    yield n.value
-  }
-}
+// LobsterAI 的推理端点永远以 SSE 作答，即使请求写了 stream:false。
+// 这里把字节流切成 {event, data} 记录，两种情形都由上层决定怎么用。
+
+const decoder = new TextDecoder()
+
+export async function* sse(body) {
+  let buf = ""
+  let event = ""
+  let data = []
+
+  // 一条空行结束一个事件；没有 data 的事件（只有注释）不产出
+  const flush = () => {
+    if (data.length === 0) { event = ""; return null }
+    const rec = { event, data: data.join("\n") }
+    event = ""
+    data = []
+    return rec
+  }
+
+  const feed = (raw) => {
+    const line = raw.endsWith("\r") ? raw.slice(0, -1) : raw
+    if (line === "") return flush()
+    if (line.startsWith(":")) return null // 注释 / keep-alive
+    const i = line.indexOf(":")
+    const field = i === -1 ? line : line.slice(0, i)
+    let value = i === -1 ? "" : line.slice(i + 1)
+    if (value.startsWith(" ")) value = value.slice(1)
+    if (field === "event") event = value
+    else if (field === "data") data.push(value)
+    return null
+  }
+
+  for await (const chunk of body) {
+    buf += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true })
+    let nl
+    while ((nl = buf.indexOf("\n")) !== -1) {
+      const rec = feed(buf.slice(0, nl))
+      buf = buf.slice(nl + 1)
+      if (rec) yield rec
+    }
+  }
+  buf += decoder.decode()
+  if (buf !== "") {
+    const rec = feed(buf)
+    if (rec) yield rec
+  }
+  const last = flush()
+  if (last) yield last
+}
+
+async function* empty() {}
+
+// first 读一条但把它放回去：上游把错误藏在流里，必须先看一眼首条
+export async function first(it) {
+  const n = await it.next()
+  if (n.done) return { head: null, rest: empty() }
+  return { head: n.value, rest: chain([n.value], it) }
+}
+
+export async function* chain(held, it) {
+  yield* held
+  for (;;) {
+    const n = await it.next()
+    if (n.done) return
+    yield n.value
+  }
+}