feat(providers): add Qoder subscription through ACP #2678

Problem

Maka cannot currently use a user's Qoder subscription and Credits as an integrated agent/provider backend. Users must run Qoder CLI separately, so Qoder authentication, model selection, streaming output, tool activity, permissions, usage, and session lifecycle are not available through Maka's normal connection and session surfaces.

This is not covered by #1088. Alibaba Coding Plan uses separate sk-sp- API keys and OpenAI-compatible endpoints, while Qoder subscriptions use Qoder account identity, Qoder CLI/PAT authentication, Qoder Credits, and Qoder-managed models.

Desired outcome

Add a Qoder subscription integration that builds on Maka's existing process-backed ACP/Pi backend rather than introducing a second agent protocol stack.

• Launch Qoder through its official ACP entrypoint (qodercli --acp) and normalize ACP updates into the existing Maka SessionEvent contract.
• Reuse the signed-in Qoder CLI session and support an explicit Qoder Personal Access Token for non-interactive setup without exposing credentials to renderer, storage, logs, or telemetry.
• Route ACP permission requests through Maka's PermissionEngine; never silently inherit bypass-permissions behavior.
• Surface Qoder readiness, login/logout guidance, supported model choices when the ACP/model contract exposes them, streaming text/tool progress, cancellation, normalized errors, and available usage data.
• Cover Qoder Global first and keep Qoder China as an independent connection/region slice so credentials, endpoints, and model aliases cannot cross regions.
• Preserve existing AI SDK and Pi/ACP backends and existing sessions without migration or behavior changes.

The MIT-licensed simonsmh/pi-provider-qoder implementation is useful reference evidence for Global/CN separation, browser/PAT login, short-lived token refresh, dynamic model catalogs, streaming transforms, thinking output, and usage reporting. Its private model gateway, WAF encoding, and COSY signing should not be copied as the default integration boundary. Prefer Qoder's documented ACP and authentication interfaces; any direct-provider fallback should require an explicit compatibility/licensing review and isolated conformance tests.

Acceptance criteria

• A user with Qoder CLI installed and signed in can select the Qoder backend in Maka and complete a text turn that consumes the same Qoder account subscription/Credits.
• PAT-based setup works through the documented QODER_PERSONAL_ACCESS_TOKEN flow, and invalid/expired credentials produce actionable, redacted readiness errors.
• Text, tool lifecycle, permission requests, cancellation, terminal completion, and usage/error events map into existing Maka contracts without raw ACP frames reaching renderer or durable storage.
• Denied permissions do not execute, stop/dispose leaves no orphaned Qoder process, and secrets are absent from child diagnostics, telemetry, exports, and snapshots.
• Global and China credentials and model catalogs remain isolated; shipping Global first does not create an implicit or partially configured China connection.
• Fake-transport contract tests cover event mapping and failures, plus a sanitized local smoke documents the tested Qoder CLI version and login mode when a subscription is available.

Alternatives or workarounds

• Run Qoder CLI or another ACP client separately: functional, but it bypasses Maka's session, permission, and UI lifecycle.
• Reuse Alibaba Coding Plan from feat(providers): add Alibaba Coding Plan (China + global) #1088: not equivalent to a Qoder account subscription or Qoder Credits.
• Port pi-provider-qoder directly: provides valuable behavior evidence, but relies on private gateway/signing details that are less stable than Qoder's documented ACP surface.

References

• Qoder ACP: https://docs.qoder.com/cli/acp
• Qoder SDK authentication: https://docs.qoder.com/cli/sdk/authentication
• Reference provider: https://pi.dev/packages/pi-provider-qoder?name=qoder
• Reference source: https://github.com/simonsmh/pi-provider-qoder

Contribution request

I am willing to implement this in small, reviewable slices, starting with the Qoder ACP launcher/auth/readiness contract and fake-transport coverage before exposing the connection in Desktop.

Maintainers: if this direction is acceptable, please assign this issue to @jischeng.