[LittlefishStudent]

The single PR the ruling on #313/#314 asked for: QwenWork (千问办公) serves from the qoder package itself, as more provider ids beside qoder and qoder-cn, rebased on main (0.2.28's queue fix keeps its behaviour), at 0.2.29.

What

Provider id	Service	Sign-in
qwenwork	the public cloud (gateway.qwenwork.cn)	the desktop client's own device flow, with redirect_uri=qwenwork-cn://; usage reads its account-context
qwenwork-enterprise	the enterprise flagship (企业旗舰版, VPC)	asks for the enterprise's own domain (the host its admin console lives on), then the same device flow against that domain, with no redirect_uri — the flagship's /device/selectAccounts refuses one, as the desktop client's enterprise mode behaves

QWENWORK_ENT_DOMAIN presets the domain so the sign-in asks nothing.

Both reviews' items, addressed

From #313:

• chat is signed for the site: cosyHeaders(CHAT_URL, cred, wire, siteOf(site, cred)), as are the model list and the queue paths — verified by a test that asserts the outgoing headers (ClientType 6, scene qwork, version 1.1.59, product qoder_work) and goes red when the site argument is dropped;
• the hooks go red when removed: dropping the chat signing, the model scene, the 503 fallback or the enterpriseHost routing each fails tests — checked by hand for every hook;
• package.json keeps its diff to the version, description and keywords lines;
• the account field is enterpriseHost, not vpcDomain (that names a site's CN VPC suffix);
• the README documents the protocol export and its not-a-stable-API caveat, and the QwenWork section.

From #314:

• no cross-package import: one package, one version bump;
• usage renews an expired account rather than marking it lapsed — a 401 from the account-context rotates the device token once, as qoder's own usage does; tested;
• the public plugin offers no PAT and no check-in (pat: false, checkin: false): both are Qoder's, and Qoder's desktop device identity is never sent to QwenWork;
• the public account is named email-first;
• no bun.lock change, no separate package, no registry entry of its own: the qoder entry lists the two new provider ids.

Verified

• end to end against a real deployment: sign-in by email OTP, flash and qwen3.8-max-preview chats, usage showing the Enterprise plan's credits;
• HOME=$(mktemp -d) bun test: 2130 pass (Qoder and Qoder CN's 185 untouched); bun scripts/check.mjs: all ok.

Unofficial for QwenWork: not affiliated with Alibaba. @harwinvoid FYI — the qwenwork provider id your plugin served moves here.

[yetone]

Thanks, @LittlefishStudent. This is the shape the ruling asked for, and the behaviour checks out. Only the tests stand between it and a merge.

What I ran at c228168

• Whole repo, TMPDIR=$T HOME=$T/home bun test: 2127 pass, 0 fail. (HOME has to sit under tmpdir(), or the isolation guards in zcode and others throw.) packages/qoder alone: 195 pass. bun scripts/check.mjs: all ok.
• scripts/try.sh qoder (magpie 0.1.1296, sandbox HOME): it lists qoder (17 models), qoder-cn (4), qwenwork (3) and qwenwork-enterprise (3).
• A recording probe with fetch mocked. It records every request the plugin makes for a model list, a chat (the body decoded), and a usage read that gets 401 and then succeeds on a rotated token. Random fields are normalized.
  • Qoder and Qoder CN: base 4d73d22 and this PR give byte-identical recordings. Their behaviour doesn't change.
  • QwenWork: the list and the chat both go out with ClientType 6, scene qwork, version 1.1.59 and product qoder_work. The chat body has session_type: qoder_work, business.product: qoder_work and the QwenWork system prompt. Usage gets 401, refreshes with target: "c", reads again, and returns signIn: "kept". Only when the refresh is refused too does it return expired. There is no PAT method and no checkin. Machine ids are randomUUID(), and machineForCampaign runs only for qoder, so Qoder desktop's identity doesn't reach QwenWork.
• qwenwork.cn is Alibaba's own service (whois, see #314), not a relay.

Blocking: hooks that no test catches. The ruling asked that "the signing and body hooks need tests that go red without them". I broke each hook by hand and ran packages/qoder:

Broken by hand	Red
chat signed without site (index.mjs:2204)	1
model list signed without site (:619)	1
enterpriseHost routing (:256)	4
503 fallback (:625)	1
PAT / check-in off, normalizeUser	1 each
qoderBody(chat, m) without site (:2196)	0
systemPrompt (:897), sessionType (:916)	0
queue status signed without site (:1118)	0
the usage 401 rotation removed (:2045)	0
deviceRefreshTarget (:1687)	0

1. The body hooks are the same gap as #313's item 3, still 0 red. _internal.decodeBody is already exported. Decode the recorded agent_chat_generation body in the chat test and assert session_type, business.product/version and the system text.
2. The PR body says the usage 401 rotation is tested, but qwenwork.test.mjs:172-188 uses an expired access token, so fresh() renews it before account-context is ever asked. Please add the case the ruling named: a live access token, account-context answers 401 to it and 200 to the rotated token, and the test asserts signIn !== "expired" and that a refresh was made. Add a second case where the refresh is refused and the result is expired.
3. Please also add tests for the queue status headers (a chat whose first answer is a queue refusal) and for the refresh body's target: "c".

Smaller

4. qwenwork.test.mjs:118: the title says "to the enterprise's own host", but the test drives the public plugin and asserts no host. :128 (pub.loader?.()) is dead code, and qoderKeys at :100-105 is never used.
5. index.mjs:1859-1860: "Overridable with QWENWORK_* env vars and defaults.json". Nothing reads either; QWENWORK_ENT_DOMAIN is the only variable. Please drop the line or make it true.
6. index.mjs:328: a device-only account still stores email: "", even though the sign-in read it and accountId is now email-first. Unless QwenWork needs the field empty, keep the email, as Qoder does.

Once 1 to 3 are in, I'll merge.

[LittlefishStudent]

All in at eeda75c — every hook that broke 0-red now has a test that goes red without it, and I broke each one again to check:

Broken by hand	Red
qoderBody(chat, m) without site	1
systemPrompt	1
sessionType	1
queue status without site	1
the usage 401 rotation	1
deviceRefreshTarget	1

1. The chat test decodes the recorded agent_chat_generation body (through _internal.decodeBody) and asserts session_type: "qoder_work", business.product: "qoder_work", business.version: "1.1.59" and the QwenWork system prompt — not Qoder's.
2. The usage test now drives the named case: a live access token, account-context answering 401 to it and 200 to the rotated token, asserting signIn !== "expired" and that a refresh was made (counted); a second case where the refresh is refused gives signIn: "expired".
3. The queue test makes a chat whose first answer is a code-10605 queue refusal and asserts the queue status request's Cosy headers for the site; the refresh test asserts the body's target: "c".

Smaller: the chat test's dead qoderKeys block and pub.loader?.() are gone (its title no longer claims a host it didn't check — the second, decoding test carries the body), the unread QWENWORK_* env vars line is dropped, and a device-only account keeps the email the sign-in read instead of blanking it.

Whole repo, your isolation style (TMPDIR and HOME under one temp dir): 2131 pass, 0 fail; check.mjs all ok; Qoder and Qoder CN's own tests untouched.

[yetone]

main now holds qoder 0.2.30 (929a8b3, Qoder CN check-in device identity, touches packages/qoder/index.mjs, README.md, package.json and two tests). This PR needs a rebase and 0.2.31.

[LittlefishStudent]

Rebased on main at 929a8b3 (qoder 0.2.30) and bumped to 0.2.31 — head is now 8f16bc1.

The 0.2.30 change (Qoder CN's check-in device identity) touches the campaigns path only; QwenWork's sites set checkin: false, so its behaviour is untouched, and the rebase's only conflict was the version line in package.json.

Verified after the rebase, your isolation style: whole repo 2264 pass / 0 fail, check.mjs all ok, packages/qoder 209 pass (QwenWork's 14 among them, all hooks still red when broken by hand as reported above).

[LittlefishStudent]

Rebased again on main at 421117e (qoder 0.2.31) and bumped to 0.2.32 — head is now 935c5e9.

The 0.2.31 change (one task per prompt's tool loop, #330) reshaped qoderBody to (chat, m, named, task); the site hook moved to a fifth parameter, and its business line keeps the task's request_set_id/begin_at/stage semantics with the site's businessProduct/cosyVersion overriding the defaults. Conflicts were that call, its signature, and the version line.

Verified after the rebase: whole repo 2331 pass / 0 fail, check.mjs all ok, packages/qoder 215 pass; the hooks still go red when broken by hand (spot-checked qoderBody without its site under the new signature: 1 red).

[LittlefishStudent]

Rebased again on main (qoder 0.2.32 and 0.2.33 landed since) and bumped to 0.2.34 — head is now c543f1b.

0.2.33's change (a task's business name is the prompt's first ten characters) is kept: the business line now carries task.name alongside the site's businessProduct/cosyVersion overrides. The only other conflict was the version line.

Verified after the rebase: whole repo 2461 pass / 0 fail, check.mjs all ok (the cloudflare package needs the network, as on main), packages/qoder 223 pass; the hooks still go red when broken by hand.