pi-multikey 1.7.1 → 1.8.0

package/config.ts

@@ -11,6 +11,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import type { ProviderModelConfig } from "@earendil-works/pi-coding-agent";
 import type { AuthStyle } from "./probe.ts";
+import { currentDeviceId, currentSessionId, currentTaskId, setDeviceId } from "./identity.ts";
 
 /** Safe model defaults applied when a spec doesn't say otherwise (edit in multikey.json). */
 export const DEFAULT_CONTEXT_WINDOW = 128_000;
@@ -37,6 +38,36 @@ export interface PoolKeyConfig {
 	label?: string;
 	/** Disabled keys are never selected. Default: true. */
 	enabled?: boolean;
+	/**
+	 * Credential-backed key (Cline account OAuth). When present, `key` holds the
+	 * current access token and is refreshed transparently from `credential`
+	 * before requests and again on 401 — see cline-auth.ts.
+	 */
+	credential?: KeyCredential;
+}
+
+/** OAuth-style credential for endpoints without static API keys (Cline free tier). */
+export interface KeyCredential {
+	kind: "cline-oauth";
+	/** Long-lived refresh token; access tokens are minted from it. */
+	refreshToken: string;
+	/** Last known access token (mirrors `key`). */
+	accessToken?: string;
+	/** Access token expiry (epoch ms), when known. */
+	expiresAt?: number;
+}
+
+/**
+ * Tracks which shipped preset a pool was created from / last aligned with.
+ * Lives in multikey.json as `_preset`. The fingerprint (see presetFingerprint
+ * in presets.ts) is persisted the moment an update prompt is shown — that is
+ * what guarantees each preset version is asked about at most once.
+ */
+export interface PresetMarker {
+	/** Preset id in presets.ts, e.g. "b-ai". */
+	id: string;
+	/** Fingerprint of the preset's model list at pool creation / last sync. */
+	fingerprint: string;
 }
 
 export interface PoolModelConfig {
@@ -70,12 +101,20 @@ export interface PoolConfig {
 	cooldownMs?: number;
 	/** Cooldown after a 401/403 (bad key). Default 600000ms. */
 	invalidKeyCooldownMs?: number;
+	/** Present when the pool was created from (or adopted) a shipped preset. */
+	_preset?: PresetMarker;
 	keys: PoolKeyConfig[];
 	models: PoolModelConfig[];
 }
 
 export interface KeypoolConfig {
 	pools: PoolConfig[];
+	/**
+	 * Stable per-install UUID sent as `x-opencode-request` to OpenCode Zen.
+	 * Generated once and reused forever, so every request from this machine
+	 * carries the same device identity.
+	 */
+	deviceId?: string;
 }
 
 export function configPath(): string {
@@ -260,7 +299,26 @@ export function loadConfig(): { config: KeypoolConfig; created: boolean; migrate
 		return { config, created: true };
 	}
 	const raw = JSON.parse(readFileSync(path, "utf-8")) as KeypoolConfig;
-	return { config: normalize(raw), created: false };
+	const config = normalize(raw);
+	// Adopt any stored device id into the identity module; a config predating
+	// deviceId gets one assigned by ensureDeviceId() in the caller.
+	if (config.deviceId) setDeviceId(config.deviceId);
+	return { config, created: false };
+}
+
+/**
+ * Make sure a persisted device id exists for configs that expose an OpenCode
+ * Zen pool, saving only when it actually changed anything. Pools that never
+ * talk to Zen leave the file untouched.
+ */
+export function ensureDeviceId(config: KeypoolConfig): void {
+	if (config.deviceId) {
+		setDeviceId(config.deviceId);
+		return;
+	}
+	if (!config.pools.some((pool) => isOpenCodeZenEndpoint(pool.baseUrl))) return;
+	config.deviceId = currentDeviceId();
+	saveConfig(config);
 }
 
 export function saveConfig(config: KeypoolConfig): void {
@@ -277,7 +335,19 @@ export function normalize(config: KeypoolConfig): KeypoolConfig {
 		if (!pool.baseUrl || typeof pool.baseUrl !== "string") continue;
 		normalized.push(normalizePool(pool));
 	}
-	return { pools: normalized };
+	const deviceId = typeof config.deviceId === "string" && config.deviceId.trim() ? config.deviceId.trim() : undefined;
+	return { pools: normalized, deviceId };
+}
+
+/** Structural check so a malformed credential in the JSON file can't break a pool. */
+function isValidCredential(credential: unknown): credential is KeyCredential {
+	return (
+		!!credential &&
+		typeof credential === "object" &&
+		(credential as KeyCredential).kind === "cline-oauth" &&
+		typeof (credential as KeyCredential).refreshToken === "string" &&
+		(credential as KeyCredential).refreshToken.trim().length > 0
+	);
 }
 
 function normalizePool(pool: PoolConfig): PoolConfig {
@@ -287,8 +357,14 @@ function normalizePool(pool: PoolConfig): PoolConfig {
 			key: k.key.trim(),
 			label: typeof k.label === "string" && k.label.trim() ? k.label.trim() : undefined,
 			enabled: k.enabled !== false,
+			// OAuth-backed keys keep their credential; only well-formed ones survive.
+			...(isValidCredential(k.credential) ? { credential: k.credential } : {}),
 		}));
 	const models = (Array.isArray(pool.models) ? pool.models : []).filter((m) => m && typeof m.id === "string" && m.id.trim());
+	const preset =
+		pool._preset && typeof pool._preset.id === "string" && typeof pool._preset.fingerprint === "string"
+			? { id: pool._preset.id, fingerprint: pool._preset.fingerprint }
+			: undefined;
 	return {
 		id: pool.id.trim(),
 		name: pool.name ?? pool.id,
@@ -302,6 +378,7 @@ function normalizePool(pool: PoolConfig): PoolConfig {
 			typeof pool.invalidKeyCooldownMs === "number" && pool.invalidKeyCooldownMs >= 0
 				? pool.invalidKeyCooldownMs
 				: DEFAULT_INVALID_KEY_COOLDOWN_MS,
+		_preset: preset,
 		keys,
 		models,
 	};
@@ -342,21 +419,73 @@ export function maskKey(key: string): string {
 
 // ── Endpoint-required headers ────────────────────────────────────────────────
 
-/** OpenCode Zen free tier endpoint that requires a specific User-Agent header. */
+/** OpenCode Zen free tier endpoint that mimics the official OpenCode client. */
 const OPENCODE_ZEN_BASE_URL = "https://opencode.ai/zen/v1";
-const OPENCODE_ZEN_USER_AGENT =
-	"opencode/1.15.0 ai-sdk/provider-utils/4.0.23 runtime/bun/1.3.13";
+const OPENCODE_ZEN_USER_AGENT = "opencode/0.1.50 ai-sdk/openai-compatible/3.0.41";
+const OPENCODE_ZEN_CLIENT = "tui";
+
+/** True when a baseUrl points at OpenCode Zen (case-insensitive, trailing slash ok). */
+export function isOpenCodeZenEndpoint(baseUrl: string | undefined): boolean {
+	if (!baseUrl) return false;
+	return baseUrl.replace(/\/+$/, "").toLowerCase() === OPENCODE_ZEN_BASE_URL;
+}
 
 /**
- * Headers that must be sent to known endpoints.
- *
- * Currently: OpenCode Zen's free tier endpoint requires this exact User-Agent;
- * anything else returns an empty object.
+ * Constant headers a known endpoint expects on every request.
  *
- * The comparison is case-insensitive and tolerates a trailing slash.
+ * OpenCode Zen's free tier wants the full OpenCode client header set; the
+ * per-conversation / per-device halves live in {@link endpointIdentityHeaders}.
+ * Cline's API gates on its official client's header set (versioned client
+ * identity + platform metadata), so we send the same shape the Cline CLI
+ * sends (mirroring sdk request-headers.ts). Anything else returns an empty object.
  */
 export function endpointHeaders(baseUrl: string): Record<string, string> {
-	const normalized = baseUrl.replace(/\/+$/, "").toLowerCase();
-	if (normalized === OPENCODE_ZEN_BASE_URL) return { "User-Agent": OPENCODE_ZEN_USER_AGENT };
-	return {};
+	if (isClineEndpoint(baseUrl)) return clineClientHeaders();
+	if (!isOpenCodeZenEndpoint(baseUrl)) return {};
+	return { "x-opencode-client": OPENCODE_ZEN_CLIENT, "User-Agent": OPENCODE_ZEN_USER_AGENT };
+}
+
+/**
+ * Per-request identity headers a known endpoint expects.
+ *
+ * OpenCode Zen reads `x-opencode-session` for per-conversation routing and
+ * `x-opencode-request` as the caller's device id, so these must be generated
+ * at request time rather than baked into the provider registration.
+ * Cline reads `X-Task-ID` as a per-conversation correlation id.
+ */
+export function endpointIdentityHeaders(baseUrl: string | undefined): Record<string, string> {
+	if (isClineEndpoint(baseUrl ?? "")) return { "X-Task-ID": currentTaskId() };
+	if (!isOpenCodeZenEndpoint(baseUrl ?? "")) return {};
+	return { "x-opencode-session": currentSessionId(), "x-opencode-request": currentDeviceId() };
+}
+
+// ── Cline (api.cline.bot) ────────────────────────────────────────────────────
+
+const CLINE_API_BASE_URL = "https://api.cline.bot";
+
+/**
+ * Header set the official Cline CLI sends to api.cline.bot (mirrors
+ * cline sdk request-headers.ts buildClineRequestHeaders with source "cli").
+ * The values track the cline repo versions: CLI 3.0.61, SDK core 0.0.82.
+ */
+const CLINE_CLIENT_HEADERS: Record<string, string> = {
+	"HTTP-Referer": "https://cline.bot",
+	"X-Title": "Cline",
+	"X-IS-MULTIROOT": "false",
+	"X-CLIENT-TYPE": "cline-cli",
+	"User-Agent": "Cline/3.0.61",
+	"X-CLIENT-VERSION": "3.0.61",
+	"X-PLATFORM": "cli",
+	"X-PLATFORM-VERSION": "3.0.61",
+	"X-CORE-VERSION": "0.0.82",
+};
+
+function clineClientHeaders(): Record<string, string> {
+	return { ...CLINE_CLIENT_HEADERS };
+}
+
+/** True when a baseUrl points at Cline's API (any path depth, trailing slash ok). */
+export function isClineEndpoint(baseUrl: string | undefined): boolean {
+	if (!baseUrl) return false;
+	return baseUrl.replace(/\/+$/, "").toLowerCase().startsWith(CLINE_API_BASE_URL);
 }

package/identity.ts

@@ -0,0 +1,101 @@
+/**
+ * Client identity for endpoints that expect an OpenCode-style client.
+ *
+ * OpenCode Zen keys its per-conversation routing/telemetry off two headers we
+ * have to synthesize: `x-opencode-session` (one id per conversation, reused for
+ * its whole lifetime) and `x-opencode-request` (one UUID per device, persisted
+ * in multikey.json). Both are generated here; persistence stays in config.ts.
+ */
+
+import { randomBytes, randomUUID } from "node:crypto";
+
+/** OpenCode's identifier alphabet: 12 hex chars of time, then 14 base62 chars. */
+const BASE62 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+const ID_LENGTH = 26;
+const TIME_HEX_LENGTH = 12;
+
+// Monotonic counter within a millisecond, reset when the clock ticks — same
+// rule OpenCode uses so ids sort correctly by creation time.
+let lastTimestamp = 0;
+let counter = 0;
+
+/**
+ * Reproduce OpenCode's `Identifier.create()`:
+ * `timestamp_ms * 0x1000 + counter`, bitwise-NOTed for descending order, as
+ * 6 big-endian bytes of hex, followed by 14 random base62 characters.
+ *
+ * The 48-bit window truncates today's millisecond timestamps, which is exactly
+ * what OpenCode ships — the low bits still order ids newest-first.
+ */
+export function createIdentifier(descending = true, timestamp = Date.now()): string {
+	if (timestamp !== lastTimestamp) {
+		lastTimestamp = timestamp;
+		counter = 0;
+	}
+	counter++;
+
+	const current = BigInt(timestamp) * 0x1000n + BigInt(counter);
+	const value = descending ? ~current : current;
+	let time = "";
+	for (let index = 0; index < 6; index++) {
+		const byte = Number((value >> BigInt(40 - 8 * index)) & 0xffn);
+		time += byte.toString(16).padStart(2, "0");
+	}
+
+	const bytes = randomBytes(ID_LENGTH - TIME_HEX_LENGTH);
+	let rest = "";
+	for (const byte of bytes) rest += BASE62[byte % 62];
+	return `${time}${rest}`;
+}
+
+/** A session id in OpenCode's format: `ses_` + 26 descending-sortable chars. */
+export function createSessionId(): string {
+	return `ses_${createIdentifier(true)}`;
+}
+
+/** A fresh device identifier (plain v4 UUID, like OpenCode's client). */
+export function createDeviceId(): string {
+	return randomUUID();
+}
+
+/** A per-conversation task id (plain v4 UUID, like Cline's X-Task-ID). */
+export function createTaskId(): string {
+	return randomUUID();
+}
+
+let sessionId: string | undefined;
+let deviceId: string | undefined;
+let taskId: string | undefined;
+
+/** Current conversation's session id, created on first use. */
+export function currentSessionId(): string {
+	if (!sessionId) sessionId = createSessionId();
+	return sessionId;
+}
+
+/** Drop the cached session id so the next request starts a new conversation. */
+export function resetSessionId(): void {
+	sessionId = undefined;
+}
+
+/** Seed the device id from config (call once at startup). */
+export function setDeviceId(id: string): void {
+	if (id) deviceId = id;
+}
+
+/** Current device id, generated on first use if config had none. */
+export function currentDeviceId(): string {
+	if (!deviceId) deviceId = createDeviceId();
+	return deviceId;
+}
+
+/** Current conversation's task id (Cline X-Task-ID), created on first use. */
+export function currentTaskId(): string {
+	if (!taskId) taskId = createTaskId();
+	return taskId;
+}
+
+/** Drop the cached task id so the next request starts a new conversation. */
+export function resetTaskId(): void {
+	taskId = undefined;
+}

package/index.ts

@@ -11,10 +11,11 @@
 
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { getApiProvider, type Api } from "@earendil-works/pi-ai";
-import { configPath, endpointHeaders, loadConfig, saveConfig, toProviderModels, type KeypoolConfig, type PoolConfig } from "./config.ts";
+import { configPath, endpointHeaders, ensureDeviceId, loadConfig, saveConfig, toProviderModels, type KeypoolConfig, type PoolConfig } from "./config.ts";
+import { resetSessionId, resetTaskId } from "./identity.ts";
 import { KeyPool } from "./pool.ts";
 import { createRotatingStreamSimple } from "./stream.ts";
-import { runManager, type ManagerHooks } from "./manage.ts";
+import { runManager, maybeOfferPresetUpdates, type ManagerHooks } from "./manage.ts";
 
 type CommandContext = Parameters<Parameters<ExtensionAPI["registerCommand"]>[1]["handler"]>[1];
 
@@ -35,6 +36,8 @@ export default function multikey(pi: ExtensionAPI) {
 
 	const pools = new Map<string, KeyPool>();
 	for (const pool of config.pools) pools.set(pool.id, new KeyPool(pool));
+	// OpenCode Zen needs a stable per-device id; persist one when a Zen pool exists.
+	ensureDeviceId(config);
 
 	let ui: ExtensionContext["ui"] | undefined;
 	const notify = (message: string) => {
@@ -62,6 +65,9 @@ export default function multikey(pi: ExtensionAPI) {
 		const keyPool = pools.get(pool.id) ?? new KeyPool(pool);
 		keyPool.updateConfig(pool);
 		pools.set(pool.id, keyPool);
+		// A Zen pool needs a durable device identity; adopt one before the first
+		// request goes out (no-op once multikey.json has a deviceId).
+		ensureDeviceId(config);
 
 		pi.registerProvider(pool.id, {
 			name: pool.name ?? pool.id,
@@ -71,7 +77,7 @@ export default function multikey(pi: ExtensionAPI) {
 			api,
 			headers: { ...pool.headers, ...endpointHeaders(pool.baseUrl) },
 			models: toProviderModels(pool),
-			streamSimple: createRotatingStreamSimple(keyPool, api, notify),
+			streamSimple: createRotatingStreamSimple(keyPool, api, notify, () => saveConfig(config)),
 		});
 		return undefined;
 	}
@@ -131,8 +137,15 @@ export default function multikey(pi: ExtensionAPI) {
 		}
 	}
 
-	pi.on("session_start", async (_event, ctx) => {
+	pi.on("session_start", async (event, ctx) => {
 		ui = ctx.ui;
+	// One OpenCode session id / Cline task id per conversation: /new, resume and
+	// fork switch to a different conversation, so drop the cached ids for those.
+	if (event.reason === "new" || event.reason === "resume" || event.reason === "fork") {
+		resetSessionId();
+		resetTaskId();
+	}
+		ensureDeviceId(config);
 		for (const { id, reason } of skipped) {
 			notify(`multikey: provider "${id}" not available — ${reason}. Fix it via /multikey → Manage pools.`);
 		}
@@ -149,6 +162,22 @@ export default function multikey(pi: ExtensionAPI) {
 				notify(`multikey: no multi-key providers found in models.json — run /multikey → Add pool to create one at ${path}.`);
 			}
 		}
+		if (ctx.hasUI) {
+			const hooks: ManagerHooks = {
+				get config() {
+					return config;
+				},
+				pools,
+				saveAndReregister,
+				removePool,
+				reloadFromDisk,
+				saveConfig: () => saveConfig(config),
+				notify,
+			};
+			// Ask (at most once per preset version) whether to align preset-created
+			// pools with updated built-in presets. Never blocks or breaks startup.
+			await maybeOfferPresetUpdates(hooks, ctx as CommandContext);
+		}
 	});
 
 	const managerHandler = async (_args: unknown, ctx: CommandContext) => {
@@ -164,6 +193,7 @@ export default function multikey(pi: ExtensionAPI) {
 			saveAndReregister,
 			removePool,
 			reloadFromDisk,
+			saveConfig: () => saveConfig(config),
 			notify,
 		};
 		await runManager(pi, ctx, hooks);