opencode-qoder 0.1.0

package/README.md

@@ -0,0 +1,45 @@
+# opencode-qoder
+
+Qoder Global provider plugin for [opencode](https://opencode.ai/). This is a port of the global-only pieces of `pi-provider-qoder`: PAT exchange, COSY request signing, Qoder body encoding, chat SSE parsing, reasoning, image input, and tool calls.
+
+Qoder China endpoints and model aliases are intentionally not included.
+
+## Build
+
+```bash
+npm install
+npm run build
+```
+
+## Installation
+
+Add the built plugin to `opencode.json` in this repo, or adjust the relative path for your config location:
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["opencode-qoder"],
+  "model": "qoder/auto"
+}
+```
+
+The plugin registers provider `qoder` and these models: `auto`, `ultimate`, `performance`, `efficient`, `lite`, `qmodel`, `qmodel_latest`, `dmodel`, `dfmodel`, `gm51model`, `kmodel`, and `mmodel`.
+
+## Authenticate
+
+Use a Qoder Personal Access Token (`pt-...`). A PAT is exchanged for a short-lived Qoder job token automatically before requests.
+
+```bash
+export QODER_PERSONAL_ACCESS_TOKEN="pt-..."
+opencode
+```
+
+You can also run opencode's auth flow after the plugin is loaded:
+
+```text
+/connect qoder
+```
+
+Choose `Personal Access Token` and paste the PAT.
+
+After adding or changing the plugin config, quit and restart opencode. Plugins and provider config are loaded at startup.

package/dist/auth.d.ts

@@ -0,0 +1,38 @@
+export interface QoderCredentials {
+    access: string;
+    refresh: string;
+    expires: number;
+    userID: string;
+    email: string;
+    name: string;
+    machineID: string;
+}
+export interface QoderProviderOptions {
+    apiKey?: string;
+    personalAccessToken?: string;
+    qoderUserID?: string;
+    qoderEmail?: string;
+    qoderName?: string;
+    qoderMachineID?: string;
+}
+export declare const PAT_REFRESH_PREFIX = "pat";
+export declare function encodePatRefresh(pat: string, jobRefreshToken: string, userID: string, machineID: string): string;
+export declare function decodePatRefresh(refresh: string): {
+    pat: string;
+    jobRefreshToken: string;
+    userID: string;
+    machineID: string;
+};
+export declare function encodeOAuthRefresh(refreshToken: string, userID: string, machineID: string): string;
+export declare function decodeOAuthRefresh(refresh: string): {
+    refreshToken: string;
+    userID: string;
+    machineID: string;
+};
+export declare function credentialsFromPat(pat: string): Promise<QoderCredentials>;
+export declare function refreshOAuthCredential(credential: QoderCredentials): Promise<QoderCredentials>;
+export declare function resolveQoderCredentials(options?: QoderProviderOptions): Promise<QoderCredentials>;
+export declare function generatePKCE(): {
+    codeVerifier: string;
+    codeChallenge: string;
+};

package/dist/auth.js

@@ -0,0 +1,175 @@
+import crypto from "node:crypto";
+import { getMachineId } from "./cosy.js";
+import { QODER_EXCHANGE_URL, QODER_PAT_ENV, QODER_REFRESH_URL, QODER_USERINFO_URL, USER_AGENT } from "./constants.js";
+export const PAT_REFRESH_PREFIX = "pat";
+const credentialsCache = new Map();
+export function encodePatRefresh(pat, jobRefreshToken, userID, machineID) {
+    return [PAT_REFRESH_PREFIX, pat, jobRefreshToken, userID, machineID].join("|");
+}
+export function decodePatRefresh(refresh) {
+    const parts = refresh.split("|");
+    return {
+        pat: parts[1] || "",
+        jobRefreshToken: parts[2] || "",
+        userID: parts[3] || "",
+        machineID: parts[4] || "",
+    };
+}
+export function encodeOAuthRefresh(refreshToken, userID, machineID) {
+    return [refreshToken, userID, machineID].join("|");
+}
+export function decodeOAuthRefresh(refresh) {
+    const parts = refresh.split("|");
+    return {
+        refreshToken: parts[0] || "",
+        userID: parts[1] || "",
+        machineID: parts[2] || "",
+    };
+}
+function getEnvPat() {
+    for (const key of QODER_PAT_ENV) {
+        const value = process.env[key];
+        if (value)
+            return value;
+    }
+    return "";
+}
+function parseExpiresAt(expiresAt, expiresIn) {
+    if (expiresAt) {
+        const parsed = Date.parse(expiresAt);
+        if (!Number.isNaN(parsed))
+            return parsed;
+        const numeric = Number.parseInt(expiresAt, 10);
+        if (Number.isFinite(numeric) && numeric > 0)
+            return numeric;
+    }
+    if (expiresIn && expiresIn > 0) {
+        // PAT exchange returns milliseconds; browser device flow returns seconds.
+        return Date.now() + (expiresIn > 7 * 24 * 60 * 60 ? expiresIn : expiresIn * 1000);
+    }
+    return Date.now() + 24 * 60 * 60 * 1000;
+}
+async function fetchUserInfo(jobToken) {
+    try {
+        const res = await fetch(QODER_USERINFO_URL, {
+            headers: {
+                Authorization: `Bearer ${jobToken}`,
+                Accept: "application/json",
+                "User-Agent": USER_AGENT,
+                "Cosy-Version": "1.0.1",
+                "Cosy-ClientType": "5",
+            },
+        });
+        if (!res.ok)
+            return { userID: "", email: "", name: "" };
+        const info = (await res.json());
+        return {
+            userID: info.id || "",
+            email: info.email || "",
+            name: info.name || info.username || "",
+        };
+    }
+    catch {
+        return { userID: "", email: "", name: "" };
+    }
+}
+export async function credentialsFromPat(pat) {
+    const cached = credentialsCache.get(pat);
+    if (cached) {
+        const resolved = await cached;
+        if (resolved.expires > Date.now())
+            return resolved;
+        credentialsCache.delete(pat);
+    }
+    const pending = (async () => {
+        const res = await fetch(QODER_EXCHANGE_URL, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json",
+                "User-Agent": USER_AGENT,
+                "Cosy-Version": "1.0.1",
+                "Cosy-ClientType": "5",
+            },
+            body: JSON.stringify({ personal_token: pat }),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            throw new Error(`Qoder PAT exchange failed: ${res.status} ${res.statusText}. ${text.slice(0, 200)}`);
+        }
+        const data = (await res.json());
+        if (!data.token)
+            throw new Error("Qoder PAT exchange returned no job token");
+        const profile = await fetchUserInfo(data.token);
+        const machineID = getMachineId();
+        return {
+            refresh: encodePatRefresh(pat, data.refresh_token || "", profile.userID, machineID),
+            access: data.token,
+            expires: parseExpiresAt(data.expires_at, data.expires_in) - 5 * 60 * 1000,
+            userID: profile.userID || "qoder-user",
+            email: profile.email || "user@qoder.com",
+            name: profile.name || "Qoder User",
+            machineID,
+        };
+    })();
+    credentialsCache.set(pat, pending);
+    try {
+        const resolved = await pending;
+        credentialsCache.set(pat, resolved);
+        return resolved;
+    }
+    catch (error) {
+        credentialsCache.delete(pat);
+        throw error;
+    }
+}
+export async function refreshOAuthCredential(credential) {
+    const { refreshToken, userID, machineID } = decodeOAuthRefresh(credential.refresh);
+    if (!refreshToken)
+        return credential;
+    const response = await fetch(QODER_REFRESH_URL, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${credential.access}`,
+            Accept: "application/json",
+            "User-Agent": USER_AGENT,
+        },
+        body: JSON.stringify({ refreshToken }),
+    });
+    if (!response.ok)
+        return credential;
+    const data = (await response.json());
+    if (!data.token)
+        return credential;
+    return {
+        ...credential,
+        access: data.token,
+        refresh: encodeOAuthRefresh(data.refresh_token || refreshToken, userID || credential.userID, machineID || credential.machineID),
+        expires: parseExpiresAt(data.expires_at, data.expires_in) - 5 * 60 * 1000,
+        userID: userID || credential.userID,
+        machineID: machineID || credential.machineID,
+    };
+}
+export async function resolveQoderCredentials(options = {}) {
+    const token = options.personalAccessToken || options.apiKey || getEnvPat();
+    if (!token) {
+        throw new Error("Qoder credentials not set. Run `/connect qoder` in opencode or set QODER_PERSONAL_ACCESS_TOKEN.");
+    }
+    if (token.startsWith("pt-"))
+        return credentialsFromPat(token);
+    return {
+        access: token,
+        refresh: "",
+        expires: Date.now() + 60 * 60 * 1000,
+        userID: options.qoderUserID || "qoder-user",
+        email: options.qoderEmail || "user@qoder.com",
+        name: options.qoderName || "Qoder User",
+        machineID: options.qoderMachineID || getMachineId(),
+    };
+}
+export function generatePKCE() {
+    const codeVerifier = crypto.randomBytes(32).toString("base64url");
+    const codeChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
+    return { codeVerifier, codeChallenge };
+}

package/dist/constants.d.ts

@@ -0,0 +1,30 @@
+export declare const PROVIDER_ID = "qoder";
+export declare const PROVIDER_NAME = "Qoder";
+export declare const QODER_BASE_URL = "https://api3.qoder.sh/";
+export declare const QODER_OPENAPI_URL = "https://openapi.qoder.sh";
+export declare const QODER_CENTER_URL = "https://center.qoder.sh";
+export declare const QODER_MANAGE_URL = "https://qoder.com";
+export declare const QODER_MODEL_LIST_URL = "https://api3.qoder.sh/algo/api/v2/model/list";
+export declare const QODER_CHAT_URL = "https://api3.qoder.sh/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1";
+export declare const QODER_EXCHANGE_URL = "https://openapi.qoder.sh/api/v1/jobToken/exchange";
+export declare const QODER_USERINFO_URL = "https://openapi.qoder.sh/api/v1/userinfo";
+export declare const QODER_REFRESH_URL = "https://center.qoder.sh/algo/api/v3/user/refresh_token";
+export declare const QODER_PAT_ENV: readonly ["QODER_PERSONAL_ACCESS_TOKEN", "QODER_PAT"];
+export declare const USER_AGENT = "opencode-qoder";
+export declare const ZERO_COST: Readonly<{
+    input: 0;
+    output: 0;
+    cache_read: 0;
+    cache_write: 0;
+}>;
+export type QoderModelDefinition = {
+    id: string;
+    name: string;
+    reasoning: boolean;
+    supportsEffort: boolean;
+    input: Array<"text" | "image">;
+    contextWindow: number;
+    maxTokens: number;
+};
+export declare const QODER_MODELS: QoderModelDefinition[];
+export declare function getModelDefinition(modelID: string): QoderModelDefinition;

package/dist/constants.js

@@ -0,0 +1,127 @@
+export const PROVIDER_ID = "qoder";
+export const PROVIDER_NAME = "Qoder";
+export const QODER_BASE_URL = "https://api3.qoder.sh/";
+export const QODER_OPENAPI_URL = "https://openapi.qoder.sh";
+export const QODER_CENTER_URL = "https://center.qoder.sh";
+export const QODER_MANAGE_URL = "https://qoder.com";
+export const QODER_MODEL_LIST_URL = `${QODER_BASE_URL}algo/api/v2/model/list`;
+export const QODER_CHAT_URL = `${QODER_BASE_URL}algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1`;
+export const QODER_EXCHANGE_URL = `${QODER_OPENAPI_URL}/api/v1/jobToken/exchange`;
+export const QODER_USERINFO_URL = `${QODER_OPENAPI_URL}/api/v1/userinfo`;
+export const QODER_REFRESH_URL = `${QODER_CENTER_URL}/algo/api/v3/user/refresh_token`;
+export const QODER_PAT_ENV = ["QODER_PERSONAL_ACCESS_TOKEN", "QODER_PAT"];
+export const USER_AGENT = "opencode-qoder";
+export const ZERO_COST = Object.freeze({ input: 0, output: 0, cache_read: 0, cache_write: 0 });
+export const QODER_MODELS = [
+    {
+        id: "auto",
+        name: "Qoder Auto",
+        reasoning: true,
+        supportsEffort: false,
+        input: ["text", "image"],
+        contextWindow: 180000,
+        maxTokens: 32768,
+    },
+    {
+        id: "ultimate",
+        name: "Qoder Ultimate",
+        reasoning: true,
+        supportsEffort: true,
+        input: ["text", "image"],
+        contextWindow: 1000000,
+        maxTokens: 32768,
+    },
+    {
+        id: "performance",
+        name: "Qoder Performance",
+        reasoning: true,
+        supportsEffort: true,
+        input: ["text", "image"],
+        contextWindow: 1000000,
+        maxTokens: 32768,
+    },
+    {
+        id: "efficient",
+        name: "Qoder Efficient",
+        reasoning: false,
+        supportsEffort: false,
+        input: ["text", "image"],
+        contextWindow: 180000,
+        maxTokens: 32768,
+    },
+    {
+        id: "lite",
+        name: "Qoder Lite",
+        reasoning: false,
+        supportsEffort: false,
+        input: ["text"],
+        contextWindow: 180000,
+        maxTokens: 32768,
+    },
+    {
+        id: "qmodel",
+        name: "Qwen3.7 Plus (Qoder)",
+        reasoning: false,
+        supportsEffort: false,
+        input: ["text", "image"],
+        contextWindow: 1000000,
+        maxTokens: 32768,
+    },
+    {
+        id: "qmodel_latest",
+        name: "Qwen3.7 Max (Qoder)",
+        reasoning: false,
+        supportsEffort: false,
+        input: ["text", "image"],
+        contextWindow: 1000000,
+        maxTokens: 32768,
+    },
+    {
+        id: "dmodel",
+        name: "DeepSeek V4 Pro (Qoder)",
+        reasoning: true,
+        supportsEffort: true,
+        input: ["text", "image"],
+        contextWindow: 1000000,
+        maxTokens: 32768,
+    },
+    {
+        id: "dfmodel",
+        name: "DeepSeek V4 Flash (Qoder)",
+        reasoning: true,
+        supportsEffort: true,
+        input: ["text", "image"],
+        contextWindow: 1000000,
+        maxTokens: 32768,
+    },
+    {
+        id: "gm51model",
+        name: "GLM 5.1 (Qoder)",
+        reasoning: true,
+        supportsEffort: true,
+        input: ["text", "image"],
+        contextWindow: 180000,
+        maxTokens: 32768,
+    },
+    {
+        id: "kmodel",
+        name: "Kimi K2.6 (Qoder)",
+        reasoning: false,
+        supportsEffort: false,
+        input: ["text", "image"],
+        contextWindow: 256000,
+        maxTokens: 32768,
+    },
+    {
+        id: "mmodel",
+        name: "MiniMax M3 (Qoder)",
+        reasoning: false,
+        supportsEffort: false,
+        input: ["text", "image"],
+        contextWindow: 1000000,
+        maxTokens: 32768,
+    },
+];
+export function getModelDefinition(modelID) {
+    return QODER_MODELS.find((model) => model.id === modelID) ?? QODER_MODELS[0];
+}

package/dist/cosy.d.ts

@@ -0,0 +1,9 @@
+export interface CosyCredentials {
+    userID: string;
+    authToken: string;
+    name: string;
+    email: string;
+    machineID?: string;
+}
+export declare function getMachineId(): string;
+export declare function buildAuthHeaders(body: Buffer | string | null, requestURL: string, creds: CosyCredentials): Record<string, string>;

package/dist/cosy.js

@@ -0,0 +1,114 @@
+import crypto from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+const qoderRSAPublicKey = `-----BEGIN PUBLIC KEY-----
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA8iMH5c02LilrsERw9t6Pv5Nc
+4k6Pz1EaDicBMpdpxKduSZu5OANqUq8er4GM95omAGIOPOh+Nx0spthYA2BqGz+l
+6HRkPJ7S236FZz73In/KVuLnwI8JJ2CbuJap8kvheCCZpmAWpb/cPx/3Vr/J6I17
+XcW+ML9FoCI6AOvOzwIDAQAB
+-----END PUBLIC KEY-----`;
+const QoderIDEVersion = "1.0.0";
+const QoderClientType = "5";
+const QoderDataPolicy = "disagree";
+const QoderLoginVersion = "v2";
+const QoderMachineOS = "x86_64_windows";
+const QoderMachineTypeMagic = "5";
+function rsaEncryptBase64(data) {
+    const encrypted = crypto.publicEncrypt({
+        key: qoderRSAPublicKey,
+        padding: crypto.constants.RSA_PKCS1_PADDING,
+    }, typeof data === "string" ? Buffer.from(data) : data);
+    return encrypted.toString("base64");
+}
+function aesEncryptCBCBase64(plaintext, keyStr) {
+    const cipher = crypto.createCipheriv("aes-128-cbc", Buffer.from(keyStr), Buffer.from(keyStr));
+    let encrypted = cipher.update(plaintext, "utf8", "base64");
+    encrypted += cipher.final("base64");
+    return encrypted;
+}
+function computeSigPath(urlStr) {
+    const parsed = new URL(urlStr);
+    let sigPath = parsed.pathname;
+    if (sigPath.startsWith("/algo"))
+        sigPath = sigPath.substring("/algo".length);
+    return sigPath;
+}
+export function getMachineId() {
+    const paths = [
+        join(homedir(), ".qoder", ".auth", "machine_id"),
+        join(homedir(), ".local", "share", "opencode", "qoder-machine-id"),
+    ];
+    for (const path of paths) {
+        if (!existsSync(path))
+            continue;
+        try {
+            const val = readFileSync(path, "utf8").trim();
+            if (val)
+                return val;
+        }
+        catch { }
+    }
+    const newId = crypto.randomUUID();
+    try {
+        const savePath = paths[1];
+        mkdirSync(dirname(savePath), { recursive: true });
+        writeFileSync(savePath, newId, "utf8");
+    }
+    catch { }
+    return newId;
+}
+export function buildAuthHeaders(body, requestURL, creds) {
+    if (!creds.userID)
+        throw new Error("qoder: user id is empty");
+    if (!creds.authToken)
+        throw new Error("qoder: auth token is empty");
+    const aesKey = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
+    const userInfo = {
+        uid: creds.userID,
+        security_oauth_token: creds.authToken,
+        name: creds.name || "",
+        aid: "",
+        email: creds.email || "",
+    };
+    const infoB64 = aesEncryptCBCBase64(JSON.stringify(userInfo), aesKey);
+    const cosyKey = rsaEncryptBase64(aesKey);
+    const timestamp = Math.floor(Date.now() / 1000).toString();
+    const requestId = crypto.randomUUID();
+    const cosyPayload = {
+        version: "v1",
+        requestId,
+        info: infoB64,
+        cosyVersion: QoderIDEVersion,
+        ideVersion: "",
+    };
+    const payloadB64 = Buffer.from(JSON.stringify(cosyPayload)).toString("base64");
+    const sigPath = computeSigPath(requestURL);
+    const bodyStr = body ? (Buffer.isBuffer(body) ? body.toString("utf8") : body) : "";
+    const sigInput = `${payloadB64}\n${cosyKey}\n${timestamp}\n${bodyStr}\n${sigPath}`;
+    const sig = crypto.createHash("md5").update(sigInput).digest("hex");
+    const bodyHash = crypto.createHash("md5").update(body || "").digest("hex");
+    const bodyLen = body ? (Buffer.isBuffer(body) ? body.length : Buffer.from(body).length).toString() : "0";
+    const machineID = creds.machineID || getMachineId();
+    return {
+        Authorization: `Bearer COSY.${payloadB64}.${sig}`,
+        "Cosy-Key": cosyKey,
+        "Cosy-User": creds.userID,
+        "Cosy-Date": timestamp,
+        "Cosy-Version": QoderIDEVersion,
+        "Cosy-Machineid": machineID,
+        "Cosy-Machinetoken": machineID,
+        "Cosy-Machinetype": QoderMachineTypeMagic,
+        "Cosy-Machineos": QoderMachineOS,
+        "Cosy-Clienttype": QoderClientType,
+        "Cosy-Clientip": "127.0.0.1",
+        "Cosy-Bodyhash": bodyHash,
+        "Cosy-Bodylength": bodyLen,
+        "Cosy-Sigpath": sigPath,
+        "Cosy-Data-Policy": QoderDataPolicy,
+        "Cosy-Organization-Id": "",
+        "Cosy-Organization-Tags": "",
+        "Login-Version": QoderLoginVersion,
+        "X-Request-Id": crypto.randomUUID(),
+    };
+}

package/dist/encoding.d.ts

@@ -0,0 +1 @@
+export declare function qoderEncodeBody(plaintext: string | Buffer): string;

package/dist/encoding.js

@@ -0,0 +1,19 @@
+const qoderCustomAlphabet = "_doRTgHZBKcGVjlvpC,@aFSx#DPuNJme&i*MzLOEn)sUrthbf%Y^w.(kIQyXqWA!";
+const qoderStdAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+export function qoderEncodeBody(plaintext) {
+    const std = Buffer.isBuffer(plaintext) ? plaintext.toString("base64") : Buffer.from(plaintext).toString("base64");
+    const n = std.length;
+    const a = Math.floor(n / 3);
+    const rearranged = std.slice(n - a) + std.slice(a, n - a) + std.slice(0, a);
+    let out = "";
+    for (let i = 0; i < n; i++) {
+        const c = rearranged[i];
+        if (c === "=") {
+            out += "$";
+            continue;
+        }
+        const idx = qoderStdAlphabet.indexOf(c);
+        out += idx >= 0 ? qoderCustomAlphabet[idx] : c;
+    }
+    return out;
+}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+import type { Hooks, PluginInput, PluginOptions } from "@opencode-ai/plugin";
+import type { PluginContext } from "@opencode-ai/plugin/v2/promise";
+import { createQoder, QoderLanguageModel } from "./language-model.js";
+export { createQoder, QoderLanguageModel };
+declare function setupV2(ctx: PluginContext): Promise<void>;
+declare const plugin: {
+    id: string;
+    setup: typeof setupV2;
+    server: (_input: PluginInput, options?: PluginOptions) => Promise<Hooks>;
+};
+export default plugin;