pi-freeflow 1.22.1 → 1.22.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.22.2
+
+### Patch Changes
+
+- Fix Cline login flow: the browser link and code now arrive in a single copy-paste block and stay pinned until login finishes, instead of the link scrolling away behind a separate waiting notice. Saved logins also refresh on their own again before expiring, and chatting with no logins saved tells you to add one instead of showing a rate-limit hint.
+
 ## 1.22.1
 
 ### Patch Changes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-freeflow",
   "type": "module",
-  "version": "1.22.1",
+  "version": "1.22.2",
   "description": "Thin provider for OMP/Pi — model list + dumb relay proxy + log; host pi-ai owns thinking/normalization",
   "main": "extensions/index.ts",
   "types": "src/index.ts",

package/src/cline-accounts.ts

@@ -11,6 +11,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { RELAY_STATE_FILE } from "./config.ts";
 import { logWarn } from "./logger.ts";
+import type { FetchImpl } from "./cline-device-auth.ts";
+import { isWorkosJwt } from "./cline-device-auth.ts";
 
 /** Env override for the pool file location (tests/CI sandbox). */
 export const CLINE_POOL_FILE_ENV = "PI_FREEFLOW_CLINE_POOL_FILE";
@@ -144,7 +146,7 @@ function readPoolFile(): ClinePoolState {
    const rec: Record<string, unknown> = entry as Record<string, unknown>;
    const slot = typeof rec.slot === "string" ? rec.slot.trim() : "";
    const token = typeof rec.token === "string" ? rec.token : "";
-   if (!slot || !token.startsWith("workos:")) continue;
+   if (!slot || (!token.startsWith("workos:") && !isWorkosJwt(token) && !token.startsWith("clp_"))) continue;
    const refreshRaw: unknown = rec.refreshToken;
    const refreshToken = typeof refreshRaw === "string" && refreshRaw.length > 0 ? refreshRaw : undefined;
    const expiresRaw: unknown = rec.expiresAt;
@@ -238,7 +240,7 @@ export function addAccount(
  const cleanSlot = (slot || "").trim();
  if (!cleanSlot) throw new Error("Cline slot name cannot be empty");
  if (cleanSlot.length > 64) throw new Error("Cline slot name is too long (max 64 characters)");
- if (!token.startsWith("workos:")) throw new Error("Cline token must start with workos:");
+ if (!token.startsWith("workos:") && !isWorkosJwt(token) && !token.startsWith("clp_")) throw new Error("Cline token must be a workos: login grant or a clp_ API key");
  const pool = loadPool();
  const existing = pool.accounts.find((a) => a.slot === cleanSlot);
  if (existing) {
@@ -308,7 +310,7 @@ async function refreshAccountInPlace(
   void e;
   return null;
  }
- if (!fresh || typeof fresh.token !== "string" || !fresh.token.startsWith("workos:")) {
+ if (!fresh || typeof fresh.token !== "string" || (!fresh.token.startsWith("workos:") && !isWorkosJwt(fresh.token) && !fresh.token.startsWith("clp_"))) {
   logWarn("cline slot refresh rejected — grant is dead", { slot: account.slot });
   return false;
  }
@@ -368,7 +370,7 @@ export interface ClineRollOpts {
  chatUrl: string;
  /** Restrict the roll to these slots; default is the whole pool. */
  slots?: string[];
- fetchImpl?: typeof fetch;
+ fetchImpl?: FetchImpl;
  reqId?: string;
  /**
   * Device-login refresher. When present, a stale slot refreshes once before

package/src/cline-device-auth.ts

@@ -7,6 +7,8 @@
  * mocked tests only, no live calls here.
  */
 
+import { fetchWithSystemCA } from "./system-ca-fetch.ts";
+
 export interface OAuthCredentials {
  access: string;
  refresh: string;
@@ -61,9 +63,20 @@ export function resolveClineWorkosClientId(): string {
 /** Resolved client id used by start/poll. */
 export const CLINE_WORKOS_CLIENT_ID = resolveClineWorkosClientId();
 
+/**
+ * Wire form of a Cline credential. Cline OAuth access tokens are WorkOS JWTs
+ * (base64url eyJ header) and must ride as workos:<jwt>; dashboard API keys
+ * (clp_ apikey category) go verbatim — prefixing them 401s. Mirrors the
+ * 9router getClineAccessToken guard (open-sse/shared/clineAuth.js).
+ */
+export function isWorkosJwt(token: string): boolean {
+ return /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/.test(token.trim());
+}
+
 export function toApiKey(accessToken: string): string {
  const token = accessToken.trim();
- return token.toLowerCase().startsWith(WORKOS_TOKEN_PREFIX) ? token : `${WORKOS_TOKEN_PREFIX}${token}`;
+ if (token.toLowerCase().startsWith(WORKOS_TOKEN_PREFIX)) return token;
+ return isWorkosJwt(token) ? `${WORKOS_TOKEN_PREFIX}${token}` : token;
 }
 
 const DEVICE_AUTHORIZATION_PATH = "/user_management/authorize/device";
@@ -73,7 +86,7 @@ const REFRESH_PATH = "/api/v1/auth/refresh";
 
 const HTTP_TIMEOUT_MS = 30 * 1000;
 
-export type FetchImpl = typeof fetch;
+export type FetchImpl = (input: string, init?: RequestInit) => Promise<Response>;
 
 function joinUrl(base: string, path: string): string {
  return base.replace(/\/+$/, "") + path;
@@ -126,7 +139,7 @@ export function deriveExpiry(explicitMs: number | undefined, accessToken: string
 
 export async function startDeviceAuth(
  workosBase: string = DEFAULT_WORKOS_BASE,
- fetchImpl: FetchImpl = fetch,
+ fetchImpl: FetchImpl = fetchWithSystemCA,
 ): Promise<DeviceAuth> {
  const response = await fetchImpl(joinUrl(workosBase, DEVICE_AUTHORIZATION_PATH), {
   method: "POST",
@@ -173,7 +186,7 @@ export async function pollDeviceToken(
  options?: PollOptions,
 ): Promise<DevicePollTokens> {
  if (!deviceCode) throw new Error("deviceCode is required");
- const fetchFn = options?.fetchImpl ?? fetch;
+ const fetchFn = options?.fetchImpl ?? fetchWithSystemCA;
  const outerSignal = options?.signal;
  const deadline = Date.now() + (options?.maxWaitMs ?? intervalSeconds * 1000 * 60 * 10);
  let interval = Math.max(1, intervalSeconds);
@@ -295,7 +308,7 @@ export async function registerClineToken(
  apiBase: string = DEFAULT_API_BASE,
  accessToken = "",
  refreshToken = "",
- fetchImpl: FetchImpl = fetch,
+ fetchImpl: FetchImpl = fetchWithSystemCA,
 ): Promise<OAuthCredentials> {
  if (!accessToken || !refreshToken) throw new Error("accessToken and refreshToken are required");
  const response = await fetchImpl(joinUrl(apiBase, REGISTER_PATH), {
@@ -316,7 +329,7 @@ export async function registerClineToken(
 export async function refreshClineToken(
  apiBase: string = DEFAULT_API_BASE,
  refreshToken = "",
- fetchImpl: FetchImpl = fetch,
+ fetchImpl: FetchImpl = fetchWithSystemCA,
 ): Promise<OAuthCredentials> {
  if (!refreshToken) throw new Error("refreshToken is required");
  const response = await fetchImpl(joinUrl(apiBase, REFRESH_PATH), {

package/src/commands.ts

@@ -61,6 +61,7 @@ import {
 import { addAccount, isClineSlotHealthy, loadPool, redactedToken, removeAccount } from "./cline-accounts.ts";
 import type { ClinePoolState } from "./cline-accounts.ts";
 import { pollDeviceToken, registerClineToken, startDeviceAuth, toApiKey } from "./cline-device-auth.ts";
+import { isCertError } from "./system-ca-fetch.ts";
 import type {
  ExtensionAPI,
  ExtensionContext,
@@ -1452,20 +1453,25 @@ export function createCommandSpec(
      try {
       started = await startDeviceAuth();
      } catch (e) {
+      if (isCertError(e)) {
+       ctx.ui.notify("Could not reach Cline: your antivirus or network proxy intercepts TLS and Node does not trust it. The login retries with your OS certificates automatically — if this persists, restart the host with NODE_USE_SYSTEM_CA=1 set, or point NODE_EXTRA_CA_CERTS at your proxy CA file.", "error");
+       return;
+      }
       ctx.ui.notify(`Could not reach Cline to start login: ${clineErrorMessage(e)}`, "error");
       return;
      }
      const link = started.verificationUriComplete ?? started.verificationUri;
      const minutes = Math.max(1, Math.round(started.expiresIn / 60));
-     ctx.ui.notify(`Cline login [${slot}]: open ${link} and enter code ${started.userCode} (expires in ~${minutes} min)`, "info");
-     ctx.ui.notify("Waiting for approval in the browser — approve or cancel there; this finishes on its own.", "info");
+     const loginLine = `Cline login [${slot}]\nOpen this link in your browser:\n${link}\nEnter code: ${started.userCode} (expires in ~${minutes} min)\nWaiting for approval — approve or cancel in the browser; this finishes on its own.`;
+     ctx.ui.notify(loginLine, "info");
+     try { ctx.ui.setStatus("cline-login", `Cline login [${slot}] code ${started.userCode}`); } catch { }
      const progress = setInterval(() => {
-      ctx.ui.notify("Still waiting for Cline approval — approve or cancel in the browser.", "info");
+      ctx.ui.notify(loginLine, "info");
      }, 45000);
      // @ts-ignore allow unref to not block process exit in CLI
      progress.unref?.();
      try {
-      const deviceTokens = await pollDeviceToken(undefined, started.deviceCode, started.interval);
+      const deviceTokens = await pollDeviceToken(undefined, started.deviceCode, started.interval, { maxWaitMs: Math.max(60_000, started.expiresIn * 1000) });
       const creds = await registerClineToken(undefined, deviceTokens.accessToken, deviceTokens.refreshToken);
       const apiKey = toApiKey(creds.access);
       addAccount(slot, apiKey, {
@@ -1483,7 +1489,7 @@ export function createCommandSpec(
        code = e.errorCode;
       }
       if (code === "authorization_pending") {
-       ctx.ui.notify("Still waiting for Cline approval — approve or cancel in the browser.", "info");
+       ctx.ui.notify(loginLine, "info");
       } else if (code === "access_denied" || code === "cancelled") {
        ctx.ui.notify("Cline login cancelled.", "warning");
       } else if (code === "expired_token") {
@@ -1493,6 +1499,7 @@ export function createCommandSpec(
       }
      } finally {
       clearInterval(progress);
+      try { ctx.ui.setStatus("cline-login", undefined); } catch { }
      }
     } else if (action === "accounts" || action === "list") {
      const pool = loadPool();

package/src/proxy.ts

@@ -42,7 +42,9 @@ import {
 } from "./opencode-fingerprint.ts";
 import { isDebugEnabled, log } from "./logger.ts";
 import { getModelUpstream, isClineModel, KILO_MODEL_IDS, MODEL_MAP, resolveCanonicalModelId } from "./models.ts";
+import { refreshClineToken, toApiKey } from "./cline-device-auth.ts";
 import { rollChat } from "./cline-accounts.ts";
+import { fetchWithSystemCA } from "./system-ca-fetch.ts";
 import {
  chatResponsesJsonFromChatCompletion,
  chatResponsesSseFromChatCompletion,
@@ -133,6 +135,9 @@ const CLINE_MODEL_HINT =
  * bodies — passes through untouched.
  */
 export function mapClineError(status: number, data: string): string {
+ // Synthetic pool-exhausted bodies already tell the user exactly what to do
+ // (add a login / wait out cooldowns) — a rate-limit hint would mislead.
+ if (data.includes("cline_pool_exhausted")) return data;
  const hint = status === 429
   ? CLINE_RATE_LIMIT_HINT
   : status === 403
@@ -151,6 +156,15 @@ export function mapClineError(status: number, data: string): string {
  } catch { }
  return data;
 }
+/**
+ * Device-login refresher for the Cline pool: one refresh per stale slot per
+ * turn. A throw keeps the stale bearer (transient); only a well-formed fresh
+ * grant replaces it — the pool module owns that decision.
+ */
+async function clineRefreshImpl(refreshToken: string): Promise<{ token: string; refreshToken?: string; expiresAt?: number } | null> {
+ const creds = await refreshClineToken(undefined, refreshToken);
+ return { token: toApiKey(creds.access), refreshToken: creds.refresh, expiresAt: creds.expires };
+}
 
 /**
  * Serve a Cline-model request direct (never relay pool, no opencode
@@ -181,7 +195,7 @@ async function handleClineRequest(opts: {
  chatBody.stream = true;
  let upstreamRes: Response;
  try {
-  const result = await rollChat({ body: JSON.stringify(chatBody), chatUrl: CLINE_CHAT_URL });
+  const result = await rollChat({ body: JSON.stringify(chatBody), chatUrl: CLINE_CHAT_URL, refreshImpl: clineRefreshImpl, fetchImpl: fetchWithSystemCA });
   upstreamRes = result.res;
   if (typeof result.slot === "string" && result.slot.length > 0) {
    log("debug", `cline served by slot ${result.slot}`, { model }, reqId);

package/src/system-ca-fetch.ts

@@ -0,0 +1,235 @@
+/**
+ * Resilient fetch for Cline endpoints on MITM boxes.
+ *
+ * Node's global fetch trusts only its bundled CA list, so antivirus TLS
+ * interception (Kaspersky on Windows, corporate proxies anywhere) fails with
+ * `self-signed certificate in certificate chain` while browsers and curl keep
+ * working off the OS store. fetchWithSystemCA tries the global fetch first
+ * and, only on chain/issuer cert errors, retries the same request through
+ * node:https with the OS trust bundle appended. No verification is ever
+ * disabled; the fallback just trusts the same roots the OS trusts.
+ */
+
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const CHAIN_ERROR_CODES: Record<string, true> = {
+ "SELF_SIGNED_CERT_IN_CHAIN": true,
+ "UNABLE_TO_VERIFY_LEAF_SIGNATURE": true,
+ "DEPTH_ZERO_SELF_SIGNED_CERT": true,
+ "UNABLE_TO_GET_ISSUER_CERT": true,
+ "UNABLE_TO_GET_ISSUER_CERT_LOCALLY": true,
+};
+
+function errorCode(value: unknown): string | undefined {
+ if (value && typeof value === "object" && "code" in value) {
+  const code = value.code;
+  return typeof code === "string" ? code : undefined;
+ }
+ return undefined;
+}
+
+function errorCause(value: unknown): unknown {
+ if (value && typeof value === "object" && "cause" in value) return value.cause;
+ return undefined;
+}
+
+/** True when the failure is an OS-trust gap, not a real endpoint problem. */
+export function isCertError(e: unknown): boolean {
+ let cur: unknown = e;
+ for (let i = 0; i < 5 && cur && typeof cur === "object"; i++) {
+  const code = errorCode(cur);
+  if (code !== undefined && CHAIN_ERROR_CODES[code]) return true;
+  cur = errorCause(cur);
+ }
+ const msg = e instanceof Error ? e.message : String(e ?? "");
+ return /self[-\s]?signed certificate|unable to verify/i.test(msg);
+}
+
+const BUNDLE_CACHE = path.join(os.tmpdir(), "pi-freeflow-system-ca.pem");
+const BUNDLE_TTL_MS = 24 * 60 * 60 * 1000;
+
+function readPemFile(p: string): string[] {
+ try {
+  const raw = fs.readFileSync(p, "utf8");
+  const blocks = raw.match(/-----BEGIN CERTIFICATE-----[^-]+-----END CERTIFICATE-----/g);
+  return blocks ?? [];
+ } catch {
+  return [];
+ }
+}
+
+function nodeExtraCa(): string[] {
+ const p = (process.env.NODE_EXTRA_CA_CERTS || "").trim();
+ return p ? readPemFile(p) : [];
+}
+
+function linuxBundle(): string[] {
+ const candidates = [
+  "/etc/ssl/certs/ca-certificates.crt",
+  "/etc/pki/tls/certs/ca-bundle.crt",
+  "/etc/ssl/cert.pem",
+ ];
+ for (const p of candidates) {
+  const blocks = readPemFile(p);
+  if (blocks.length > 0) return blocks;
+ }
+ return [];
+}
+
+// Cert: drive is unavailable in some hosts; X509Store works everywhere.
+const EXPORT_PS1 = [
+ "$stores = @(",
+ " [System.Security.Cryptography.X509Certificates.X509Store]::new('Root', 'LocalMachine'),",
+ " [System.Security.Cryptography.X509Certificates.X509Store]::new('Root', 'CurrentUser')",
+ ")",
+ "$pem = foreach ($s in $stores) {",
+ " $s.Open('ReadOnly')",
+ " foreach ($c in $s.Certificates) {",
+ "  $b64 = [Convert]::ToBase64String($c.Export('Cert'))",
+ "  '-----BEGIN CERTIFICATE-----'",
+ "  for ($i = 0; $i -lt $b64.Length; $i += 64) { $b64.Substring($i, [Math]::Min(64, $b64.Length - $i)) }",
+ "  '-----END CERTIFICATE-----'",
+ " }",
+ " $s.Close()",
+ "}",
+ "$pem | Out-File -FilePath $args[0] -Encoding ascii",
+].join("\r\n");
+
+function windowsBundle(): string[] {
+ try {
+  const stat = fs.statSync(BUNDLE_CACHE);
+  if (Date.now() - stat.mtimeMs < BUNDLE_TTL_MS) {
+   const cached = readPemFile(BUNDLE_CACHE);
+   if (cached.length > 0) return cached;
+  }
+ } catch { }
+ try {
+  const script = `${BUNDLE_CACHE}.ps1`;
+  fs.writeFileSync(script, EXPORT_PS1, "utf8");
+  execFileSync("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", script, BUNDLE_CACHE], {
+   timeout: 30_000,
+   windowsHide: true,
+  });
+  return readPemFile(BUNDLE_CACHE);
+ } catch {
+  return [];
+ }
+}
+
+let systemCaCache: string[] | null = null;
+
+/** OS trust bundle: platform store plus NODE_EXTRA_CA_CERTS when set. */
+export function systemCaBundle(): string[] {
+ if (systemCaCache) return systemCaCache;
+ const extra = nodeExtraCa();
+ const platform = process.platform === "win32" ? windowsBundle() : linuxBundle();
+ const seen = new Set<string>();
+ systemCaCache = [...extra, ...platform].filter((b) => {
+  if (seen.has(b)) return false;
+  seen.add(b);
+  return true;
+ });
+ return systemCaCache;
+}
+
+/** Test-only: drop the cached bundle so tests re-read the platform store. */
+export function _resetSystemCaCacheForTest(): void {
+ systemCaCache = null;
+}
+
+function toNodeHeaders(headers: HeadersInit | undefined): Record<string, string> {
+ const out: Record<string, string> = {};
+ if (!headers) return out;
+ if (headers instanceof Headers) {
+  headers.forEach((v, k) => { out[k] = v; });
+ } else if (Array.isArray(headers)) {
+  for (const [k, v] of headers) out[k] = v;
+ } else {
+  for (const [k, v] of Object.entries(headers)) out[k] = v;
+ }
+ return out;
+}
+
+function toNodeBody(body: BodyInit | undefined): string | undefined {
+ if (body === undefined || body === null) return undefined;
+ if (typeof body === "string") return body;
+ if (body instanceof URLSearchParams) return body.toString();
+ if (body instanceof ArrayBuffer) return Buffer.from(body).toString("utf8");
+ if (ArrayBuffer.isView(body)) return Buffer.from(body.buffer, body.byteOffset, body.byteLength).toString("utf8");
+ throw new Error("fetchWithSystemCA fallback supports string/form bodies only");
+}
+
+/**
+ * Same request through node:https with the OS trust bundle. Only used after
+ * the global fetch already failed with a cert error, so behavior on healthy
+ * machines is byte-identical to today.
+ */
+export function requestViaNodeHttp(input: string, init?: RequestInit): Promise<Response> {
+ const { promise, resolve, reject } = Promise.withResolvers<Response>();
+ const url = new URL(input);
+ const sender = url.protocol === "https:" ? httpsRequest : httpRequest;
+ let body: string | undefined;
+ try {
+  body = toNodeBody(init?.body as BodyInit | undefined);
+ } catch (e) {
+  reject(e);
+  return promise;
+ }
+ const headers = toNodeHeaders(init?.headers as HeadersInit | undefined);
+ if (body !== undefined && !headers["content-length"] && !headers["Content-Length"]) {
+  headers["content-length"] = String(Buffer.byteLength(body));
+ }
+ // undici's AbortSignal vs node:http's: structurally identical, and the
+ // runtime accepts it — named const carries the one-line reason.
+ const nodeSignal = init?.signal as never;
+ const bundle = systemCaBundle();
+ const req = sender(url, {
+  method: init?.method ?? "GET",
+  headers,
+  ca: bundle.length > 0 ? bundle : undefined,
+  signal: nodeSignal,
+ }, (res) => {
+  const chunks: Buffer[] = [];
+  res.on("data", (c: Buffer) => chunks.push(c));
+  res.on("end", () => {
+   const outHeaders = new Headers();
+   for (const [k, v] of Object.entries(res.headers)) {
+    if (Array.isArray(v)) { for (const item of v) outHeaders.append(k, item); }
+    else if (v !== undefined) outHeaders.set(k, v);
+   }
+   resolve(new Response(Buffer.concat(chunks), { status: res.statusCode ?? 500, headers: outHeaders }));
+  });
+ });
+ req.on("error", reject);
+ if (init?.signal && typeof (init.signal as AbortSignal).addEventListener === "function") {
+  const s = init.signal as AbortSignal;
+  if (s.aborted) req.destroy(new Error("fetchWithSystemCA fallback aborted"));
+  else s.addEventListener("abort", () => req.destroy(new Error("fetchWithSystemCA fallback aborted")), { once: true });
+ }
+ if (body !== undefined) req.write(body);
+ req.end();
+ return promise;
+}
+
+/**
+ * Drop-in fetch replacement for Cline endpoints: global fetch first, OS-trust
+ * retry only on chain/issuer cert failures. Every other error passes through
+ * untouched, so healthy machines see zero behavior change.
+ */
+export async function fetchWithSystemCA(input: string, init?: RequestInit): Promise<Response> {
+ try {
+  return await fetch(input, init);
+ } catch (e) {
+  if (!isCertError(e)) throw e;
+  try {
+   return await requestViaNodeHttp(input, init);
+  } catch {
+   throw e;
+  }
+ }
+}