pi-clinepass 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 fific
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,117 @@
+<div align="center">
+
+# pi-clinepass
+
+**ClinePass provider for [pi](https://pi.dev) coding agent**
+
+Dollar-based limits, live cost tracking, and plan cap reporting.
+
+<br>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/pi-clinepass"><img src="https://img.shields.io/badge/npm-pi--clinepass-CB3837?style=for-the-badge&logo=npm&logoColor=white" alt="npm package"></a>
+  <a href="https://www.typescriptlang.org"><img src="https://img.shields.io/badge/TypeScript-7.0-3178C6?style=for-the-badge&logo=typescript&logoColor=white" alt="TypeScript 7"></a>
+  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node.js-%3E%3D22.19-339933?style=for-the-badge&logo=nodedotjs&logoColor=white" alt="Node version"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-000000?style=for-the-badge" alt="MIT License"></a>
+</p>
+
+<br>
+
+<img src="https://raw.githubusercontent.com/fifidayone/pi-clinepass/main/assets/status.png" alt="pi-clinepass status meter" width="680">
+
+</div>
+
+<br>
+
+## Highlights
+
+- **16 Models**: 13 ClinePass models on a dollar-based limit system plus 3 free tier models
+- **Live Status Meter**: Per-turn and session cost directly in the pi footer
+- **Plan Utilization**: 5-hour, weekly, and monthly caps tracked via `/clinepass`
+- **Simple Auth**: One-time login via Cline CLI, browser, or API key
+
+---
+
+## Installation
+
+Requires **Node.js 22.19+** and [pi](https://pi.dev).
+
+```sh
+pi install npm:pi-clinepass
+```
+
+---
+
+## Quickstart
+
+### 1. Authenticate
+
+Run the login command inside pi:
+
+```
+/login
+```
+
+Select **ClinePass** to choose your sign-in method:
+
+<br>
+
+<div align="center">
+  <img src="https://raw.githubusercontent.com/fifidayone/pi-clinepass/main/assets/login.png" alt="ClinePass login menu" width="620">
+</div>
+
+<br>
+
+- **Use existing sign-in (Cline CLI)**: keep using your Cline CLI account
+- **Sign in with browser**: log in once in your browser
+- **Enter API key**: paste your ClinePass key
+
+### 2. Select a Model
+
+Pick any model using the interactive selector:
+
+```
+/model
+```
+
+---
+
+## Report
+
+View the live rate sheet and plan limit utilization anytime:
+
+```
+/clinepass
+```
+
+<div align="center">
+  <img src="https://raw.githubusercontent.com/fifidayone/pi-clinepass/main/assets/report.png" alt="ClinePass report with pricing and plan limits" width="620">
+</div>
+
+---
+
+## Development
+
+```sh
+git clone https://github.com/fifidayone/pi-clinepass.git
+cd pi-clinepass
+npm install
+npm test
+npm run typecheck
+```
+
+---
+
+## Support
+
+pi-clinepass is free and will stay free. If you'd like to help, consider buying me a coffee:
+
+<p align="left">
+  <a href="https://www.paypal.com/paypalme/fifidayone"><img src="https://img.shields.io/badge/PayPal-fifidayone-00457C?style=for-the-badge&logo=paypal&logoColor=white" alt="Support via PayPal"></a>
+</p>
+
+---
+
+## License
+
+[MIT](LICENSE) © 2026 fifidayone

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "pi-clinepass",
+  "version": "0.1.0",
+  "description": "ClinePass provider for pi — static measured-price catalog, server-truth billing meter, free models",
+  "keywords": [
+    "ai",
+    "cline",
+    "cline-pass",
+    "clinepass",
+    "pi",
+    "pi-coding-agent",
+    "pi-package",
+    "pi-extension"
+  ],
+  "license": "MIT",
+  "author": "fifidayone",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fifidayone/pi-clinepass.git"
+  },
+  "type": "module",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "files": [
+    "src",
+    "CHANGELOG.md",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*"
+  },
+  "devDependencies": {
+    "@types/node": "^26.3.0",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.11"
+  },
+  "pi": {
+    "extensions": [
+      "./src/index.ts"
+    ]
+  }
+}

package/src/auth.ts

@@ -0,0 +1,363 @@
+/**
+ * ClinePass authentication: credential resolution and the /login flow.
+ *
+ * Login presents a chooser (reuse existing credentials / device flow /
+ * paste API key); the user picks explicitly every time.
+ */
+
+import type { OAuthCredentials, OAuthLoginCallbacks } from "@earendil-works/pi-ai";
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import {
+  DEFAULT_API_BASE,
+  WORKOS_REFRESH_MARGIN_MS,
+  isWorkosToken,
+  pollDeviceAuthorization,
+  refreshWorkosToken,
+  registerWorkOSTokens,
+  startDeviceAuthorization,
+  type ClineAuthCredentials,
+} from "./workos.js";
+
+export const DASHBOARD_URL = "https://app.cline.bot/dashboard/account?tab=api-keys";
+export const TEN_YEARS_MS = 10 * 365 * 24 * 60 * 60 * 1000;
+
+export interface AuthOptions {
+  homeDir?: () => string;
+  readFile?: (path: string) => string;
+  fileExists?: (path: string) => boolean;
+  writeFile?: (path: string, data: string) => void;
+  fetch?: typeof globalThis.fetch;
+  apiBase?: string;
+}
+
+function defaultHomeDir(): string {
+  return homedir();
+}
+
+function resolveOptions(
+  options: AuthOptions,
+): Required<Pick<AuthOptions, "homeDir" | "readFile" | "fileExists" | "writeFile">> {
+  return {
+    homeDir: options.homeDir ?? defaultHomeDir,
+    readFile: options.readFile ?? ((p) => readFileSync(p, "utf8")),
+    fileExists: options.fileExists ?? ((p) => existsSync(p)),
+    writeFile: options.writeFile ?? defaultWriteFile,
+  };
+}
+
+/** Atomic-ish write matching pi's auth.json conventions (JSON, 0600 on create). */
+function defaultWriteFile(path: string, data: string): void {
+  const tmp = `${path}.tmp`;
+  writeFileSync(tmp, data, { encoding: "utf8", mode: 0o600 });
+  try {
+    // rename replaces atomically on POSIX; on Windows it may fail if the
+    // target is open — fall back to a direct write in that case.
+    renameSync(tmp, path);
+  } catch {
+    writeFileSync(path, data, { encoding: "utf8", mode: 0o600 });
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function stringValue(value: unknown): string | undefined {
+  return typeof value === "string" ? value : undefined;
+}
+
+function numberValue(value: unknown): number | undefined {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  return undefined;
+}
+
+function isMissingFileError(error: unknown): boolean {
+  if (typeof error === "object" && error !== null && "code" in error) {
+    if ((error as { code?: unknown }).code === "ENOENT") return true;
+  }
+  const msg = error instanceof Error ? error.message : String(error);
+  return msg.includes("ENOENT") || msg.includes("not found");
+}
+
+function parseJson(path: string, options: AuthOptions): Record<string, unknown> | undefined {
+  const { readFile, fileExists } = resolveOptions(options);
+  try {
+    if (!fileExists(path)) return undefined;
+    const parsed: unknown = JSON.parse(readFile(path));
+    return isRecord(parsed) ? parsed : undefined;
+  } catch (error) {
+    if (!isMissingFileError(error)) {
+      console.warn(`[pi-clinepass] failed to read ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return undefined;
+  }
+}
+
+// ─── Credential extraction ────────────────────────────────────────────────
+
+function extractWorkosAuth(auth: Record<string, unknown>): ClineAuthCredentials | undefined {
+  const accessToken = stringValue(auth.accessToken);
+  const refreshToken = stringValue(auth.refreshToken);
+  if (!accessToken || !refreshToken || !isWorkosToken(accessToken)) return undefined;
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: numberValue(auth.expiresAt) ?? 0,
+  };
+}
+
+/**
+ * Read credentials a Cline CLI login left on this machine
+ * (`~/.cline/data/settings/providers.json`) — offered as the "reuse"
+ * option in /login.
+ */
+export function resolveClineCliCredential(options: AuthOptions = {}): ClineAuthCredentials | undefined {
+  const home = resolveOptions(options).homeDir();
+  const parsed = parseJson(join(home, ".cline", "data", "settings", "providers.json"), options);
+  if (!parsed) return undefined;
+
+  const providers = isRecord(parsed.providers) ? parsed.providers : undefined;
+  const candidates: ClineAuthCredentials[] = [];
+  for (const key of ["cline-pass", "cline"] as const) {
+    const provider = isRecord(providers?.[key]) ? providers[key] : undefined;
+    const settings = isRecord(provider?.settings) ? provider.settings : undefined;
+    const auth = isRecord(settings?.auth) ? settings.auth : undefined;
+    if (auth) {
+      const cred = extractWorkosAuth(auth);
+      if (cred) candidates.push(cred);
+    }
+  }
+  if (candidates.length > 0) {
+    return candidates.reduce((best, current) => (current.expiresAt > best.expiresAt ? current : best));
+  }
+  return undefined;
+}
+
+/**
+ * Read pi's OWN stored credential for the `clinepass` provider
+ * (`~/.pi/agent/auth.json` → `clinepass` field). This is the identity pi
+ * itself uses for chat requests after /login — the meter must match it.
+ * Handles: plain string key, `{type:"api_key", key}`, and OAuth objects.
+ */
+export function resolvePiStoredCredential(options: AuthOptions = {}): ClineAuthCredentials | undefined {
+  const home = resolveOptions(options).homeDir();
+  const parsed = parseJson(join(home, ".pi", "agent", "auth.json"), options);
+  if (!parsed) return undefined;
+
+  const cp = parsed.clinepass;
+  if (typeof cp === "string" && cp.trim()) {
+    return { accessToken: cp.trim(), refreshToken: cp.trim(), expiresAt: Number.MAX_SAFE_INTEGER };
+  }
+  if (!isRecord(cp)) return undefined;
+
+  if (cp.type === "api_key") {
+    const key = stringValue(cp.key);
+    return key ? { accessToken: key, refreshToken: key, expiresAt: Number.MAX_SAFE_INTEGER } : undefined;
+  }
+
+  const access = stringValue(cp.access);
+  const refresh = stringValue(cp.refresh);
+  if (!access) return undefined;
+  const isOAuth = isWorkosToken(access);
+  return {
+    accessToken: access,
+    refreshToken: refresh ?? access,
+    // Bare non-prefixed access from pi's store is a static key; WorkOS
+    // tokens with no expiry are treated as stale so they get refreshed.
+    expiresAt: numberValue(cp.expires) ?? (isOAuth ? 0 : Number.MAX_SAFE_INTEGER),
+  };
+}
+
+// ─── Credential persistence ─────────────────────────────────────
+
+/**
+ * Persist an OAuth credential for the `clinepass` provider back into pi's
+ * auth.json (`~/.pi/agent/auth.json`). Used after a meter-triggered refresh
+ * produced rotated tokens — if the server rotates single-use refresh
+ * tokens, discarding the new one would leave pi's stored credential dead
+ * and force a re-login. Waits for pi's lock file (`<auth.json>.lock`, held
+ * by proper-lockfile while pi writes) to clear before merging.
+ */
+export async function persistOAuthCredential(
+  credential: OAuthCredentials,
+  options: AuthOptions = {},
+): Promise<void> {
+  const { homeDir, readFile, fileExists, writeFile } = resolveOptions(options);
+  const authPath = join(homeDir(), ".pi", "agent", "auth.json");
+  const lockPath = `${authPath}.lock`;
+
+  for (let attempt = 0; attempt < 20 && fileExists(lockPath); attempt++) {
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+
+  const current = fileExists(authPath) ? readFile(authPath) : "{}";
+  const parsed: unknown = current.trim() ? JSON.parse(current) : {};
+  if (!isRecord(parsed)) {
+    throw new Error("auth.json is not a JSON object");
+  }
+  const next = {
+    ...parsed,
+    clinepass: {
+      type: "oauth",
+      access: credential.access,
+      refresh: credential.refresh,
+      expires: credential.expires,
+    },
+  };
+  writeFile(authPath, JSON.stringify(next, null, 2));
+}
+
+// ─── Login chain ──────────────────────────────────────────────────────────
+
+function credentialsFromApiKey(apiKey: string): OAuthCredentials {
+  return { refresh: apiKey, access: apiKey, expires: Date.now() + TEN_YEARS_MS };
+}
+
+async function loginWithWorkosCredentials(
+  clineAuth: ClineAuthCredentials,
+  options: AuthOptions,
+): Promise<OAuthCredentials> {
+  if (clineAuth.expiresAt <= Date.now() + WORKOS_REFRESH_MARGIN_MS) {
+    return refreshWorkosToken(
+      { access: clineAuth.accessToken, refresh: clineAuth.refreshToken, expires: clineAuth.expiresAt },
+      { fetch: options.fetch, apiBase: options.apiBase ?? DEFAULT_API_BASE },
+    );
+  }
+  return {
+    access: clineAuth.accessToken,
+    refresh: clineAuth.refreshToken,
+    expires: clineAuth.expiresAt,
+  };
+}
+
+async function loginWithDeviceFlow(
+  callbacks: OAuthLoginCallbacks,
+  options: AuthOptions,
+): Promise<OAuthCredentials> {
+  const device = await startDeviceAuthorization({ fetch: options.fetch });
+  callbacks.onDeviceCode({
+    userCode: device.userCode,
+    verificationUri: device.verificationUri,
+    intervalSeconds: device.intervalSeconds,
+    expiresInSeconds: device.expiresInSeconds,
+  });
+  callbacks.onAuth({ url: device.verificationUriComplete ?? device.verificationUri });
+  const tokens = await pollDeviceAuthorization(
+    {
+      deviceCode: device.deviceCode,
+      expiresInSeconds: device.expiresInSeconds,
+      intervalSeconds: device.intervalSeconds,
+    },
+    { fetch: options.fetch },
+  );
+  return registerWorkOSTokens(tokens, { fetch: options.fetch, apiBase: options.apiBase ?? DEFAULT_API_BASE });
+}
+
+async function loginWithManualApiKey(
+  callbacks: OAuthLoginCallbacks,
+  options: AuthOptions,
+  reason?: string,
+): Promise<OAuthCredentials> {
+  const apiKey = sanitizeApiKey(
+    await callbacks.onPrompt({
+      message:
+        (reason ? `${reason} ` : "") +
+        `Enter your ClinePass API key (get one at ${DASHBOARD_URL}):`,
+    }),
+  );
+  if (!apiKey) throw new Error("No ClinePass API key provided");
+  if (apiKey.length < 20) {
+    console.warn(
+      `[pi-clinepass] Warning: API key looks unusually short (${apiKey.length} chars). ` +
+        "Verify you copied the full key from app.cline.bot.",
+    );
+  }
+  return credentialsFromApiKey(apiKey);
+}
+
+/** Strip terminal paste wrappers and control chars from pasted key input. */
+export function sanitizeApiKey(input: string): string {
+  const esc = "\x1b";
+  return input
+    .replaceAll(`${esc}[200~`, "")
+    .replaceAll(`${esc}[201~`, "")
+    .replaceAll("[200~", "")
+    .replaceAll("[201~", "")
+    .replace(/[\u0000-\u001f\u007f]/g, "")
+    .trim();
+}
+
+/**
+ * Run the ClinePass login flow: present a chooser (reuse the Cline CLI
+ * login when one exists on this machine, device flow, or enter an API
+ * key). The user picks explicitly every time.
+ */
+export async function login(callbacks: OAuthLoginCallbacks, options: AuthOptions = {}): Promise<OAuthCredentials> {
+  // Reuse candidate comes from a Cline CLI login only — never pi's own
+  // stored credential.
+  const reusable = resolveClineCliCredential(options);
+
+  const optionsList: { id: string; label: string }[] = [
+    { id: "device", label: "Sign in with browser" },
+    { id: "paste", label: "Enter API key" },
+  ];
+  if (reusable) {
+    optionsList.unshift({ id: "reuse", label: "Use existing sign-in (Cline CLI)" });
+  }
+
+  const selected = await callbacks.onSelect({
+    message: "Choose how to sign in to ClinePass",
+    options: optionsList,
+  });
+  if (!selected) throw new Error("ClinePass login cancelled");
+
+  switch (selected) {
+    case "reuse": {
+      if (!reusable) throw new Error("ClinePass login cancelled");
+      try {
+        return await loginWithWorkosCredentials(reusable, options);
+      } catch (err) {
+        console.warn(
+          `[pi-clinepass] Cline CLI sign-in failed: ${err instanceof Error ? err.message : String(err)}`,
+        );
+        return loginWithManualApiKey(callbacks, options, "Cline CLI sign-in failed (refresh token may be expired).");
+      }
+    }
+    case "paste":
+      return loginWithManualApiKey(callbacks, options);
+    case "device":
+      return loginWithDeviceFlow(callbacks, options).catch((err) => {
+        console.warn(
+          `[pi-clinepass] Device login failed: ${err instanceof Error ? err.message : String(err)}`,
+        );
+        return loginWithManualApiKey(callbacks, options, "Device login failed or was cancelled.");
+      });
+    default:
+      throw new Error("ClinePass login cancelled");
+  }
+}
+
+/**
+ * Refresh ClinePass credentials. WorkOS tokens (workos: prefix) go through
+ * Cline's server endpoint; static API keys never expire and pass through.
+ */
+export async function refreshToken(
+  credentials: OAuthCredentials,
+  _signal?: AbortSignal,
+  options: AuthOptions = {},
+): Promise<OAuthCredentials> {
+  if (isWorkosToken(credentials.access)) {
+    return refreshWorkosToken(credentials, { fetch: options.fetch, apiBase: options.apiBase ?? DEFAULT_API_BASE });
+  }
+  return credentialsFromApiKey(credentials.refresh);
+}
+
+/**
+ * Return the bearer token. OAuth flows already store the `workos:` prefix
+ * (refresh/register ensure it); static API keys are used as-is.
+ */
+export function getApiKey(credentials: OAuthCredentials): string {
+  return credentials.access;
+}

package/src/catalog.ts

@@ -0,0 +1,117 @@
+/**
+ * ClinePass static model catalog.
+ *
+ * Prices are the measured billing rates from the Cline `/usages` API
+ * (verified against real usage), not the published reference table which
+ * drifts from actual billing. `cacheWrite` is kept at 0: pi's cost model
+ * requires the field, but we do not display or track cache-write pricing.
+ */
+
+export type ThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
+
+export type ThinkingLevelMap = Readonly<Record<ThinkingLevel, string | null>>;
+
+export interface ClinePassModel {
+  id: string;
+  name: string;
+  reasoning: boolean;
+  input: readonly ["text"];
+  cost: {
+    input: number;
+    output: number;
+    cacheRead: number;
+    cacheWrite: number;
+  };
+  contextWindow: number;
+  maxTokens: number;
+  thinkingLevelMap: ThinkingLevelMap;
+  compat: {
+    supportsDeveloperRole: false;
+    cacheControlFormat: "anthropic";
+    supportsLongCacheRetention: false;
+  };
+}
+
+/** All levels supported (off → "none"), minimal unsupported. */
+const FULL_THINKING: ThinkingLevelMap = {
+  off: "none",
+  minimal: null,
+  low: "low",
+  medium: "medium",
+  high: "high",
+  xhigh: "xhigh",
+  max: "max",
+};
+
+/** ox-alpha requires reasoning upstream: off → null (unsupported). */
+const OX_ALPHA_THINKING: ThinkingLevelMap = {
+  ...FULL_THINKING,
+  off: null,
+};
+
+/**
+ * ClinePass rejects the `developer` role; the API caps at `max_tokens` /
+ * `max_completion_tokens` with reasoning excluded from the completion cap,
+ * so pi's default `max_completion_tokens` is correct and left unset.
+ * `cacheControlFormat: "anthropic"` makes pi send `{type:"ephemeral"}`
+ * (no ttl) — verified to engage real caching on ClinePass.
+ * `supportsLongCacheRetention: false` keeps ttl from ever being sent
+ * (ttl causes HTTP 500).
+ */
+const COMPAT = {
+  supportsDeveloperRole: false as const,
+  cacheControlFormat: "anthropic" as const,
+  supportsLongCacheRetention: false as const,
+};
+
+function model(
+  id: string,
+  name: string,
+  cost: [input: number, output: number, cacheRead: number],
+  contextWindow: number,
+  maxTokens: number,
+  thinkingLevelMap: ThinkingLevelMap = FULL_THINKING,
+): ClinePassModel {
+  return {
+    id,
+    name,
+    reasoning: true,
+    input: ["text"],
+    cost: { input: cost[0], output: cost[1], cacheRead: cost[2], cacheWrite: 0 },
+    contextWindow,
+    maxTokens,
+    thinkingLevelMap,
+    compat: COMPAT,
+  };
+}
+
+/** Measured prices ($/1M tokens: input/output/cacheRead). */
+export const MODELS: readonly ClinePassModel[] = [
+  // ── Free models (Cline free tier, cost 0) ──────────────────────────────
+  model("deepseek/deepseek-v4-flash", "DeepSeek V4 Flash (Cline Free)", [0, 0, 0], 1_024_000, 384_000),
+  model("stealth/ox-alpha", "Ox Alpha (Cline Free)", [0, 0, 0], 1_048_576, 131_072, OX_ALPHA_THINKING),
+  model("poolside/laguna-s-2.1:free", "Poolside Laguna S-2.1 (Cline Free)", [0, 0, 0], 262_144, 32_768),
+  // ── ClinePass models (measured billing prices) ─────────────────────────
+  model("cline-pass/glm-5.3", "GLM-5.3 (ClinePass)", [1.4, 4.4, 0.26], 1_048_576, 131_072),
+  model("cline-pass/glm-5.2", "GLM-5.2 (ClinePass)", [1.4, 4.4, 0.26], 1_048_576, 262_144),
+  model("cline-pass/kimi-k2.7-code", "Kimi K2.7 Code (ClinePass)", [1.58, 6.67, 0.317], 262_144, 262_144),
+  model("cline-pass/kimi-k2.6", "Kimi K2.6 (ClinePass)", [1.58, 6.67, 0.267], 262_144, 262_144),
+  model("cline-pass/kimi-k3", "Kimi K3 (ClinePass)", [6.0, 30.0, 0.6], 1_048_576, 1_048_576),
+  model("cline-pass/deepseek-v4-pro", "DeepSeek V4 Pro (ClinePass)", [1.65, 4.95, 0.06], 1_024_000, 384_000),
+  model("cline-pass/deepseek-v4-flash", "DeepSeek V4 Flash (ClinePass)", [0.44, 1.32, 0.014], 1_024_000, 384_000),
+  model("cline-pass/mimo-v2.5", "MiMo-V2.5 (ClinePass)", [0.14, 0.28, 0.0028], 1_048_576, 131_072),
+  model("cline-pass/mimo-v2.5-pro", "MiMo-V2.5-Pro (ClinePass)", [0.435, 0.87, 0.0036], 1_048_576, 131_072),
+  model("cline-pass/minimax-m3", "MiniMax M3 (ClinePass)", [0.5, 2.0, 0.1], 524_288, 512_000),
+  model("cline-pass/qwen3.7-plus", "Qwen3.7 Plus (ClinePass)", [0.67, 2.68, 0.067], 1_000_000, 131_072),
+  model("cline-pass/qwen3.7-max", "Qwen3.7 Max (ClinePass)", [4.17, 12.51, 0.83], 1_000_000, 131_072),
+  model("cline-pass/qwen3.8-max", "Qwen3.8 Max (ClinePass)", [2.75, 8.25, 0.344], 1_000_000, 131_072),
+];
+
+export function modelIds(): string[] {
+  return MODELS.map((m) => m.id);
+}
+
+/** True for the Cline free-tier models (cost 0). */
+export function isFreeModel(id: string): boolean {
+  return id.includes(":free") || id.includes("ox-alpha") || id === "deepseek/deepseek-v4-flash";
+}