pi-freeflow 1.22.1 → 1.22.4

package/src/cline-accounts.ts

@@ -4,13 +4,16 @@
  * Cline serves its free models direct-only (never through the relay pool),
  * one bearer key per login slot. Keys live in a 0600 file beside the relay
  * state; a corrupt file reads back as an empty pool (never throws, never
- * logs secrets). Request failover walks the pool with per-slot cooldowns.
+ * logs secrets). Request failover walks the pool in order, trying every slot
+ * fresh on every request — no slot is ever locked out.
  */
 
 import fs from "node:fs";
 import path from "node:path";
 import { RELAY_STATE_FILE } from "./config.ts";
 import { logWarn } from "./logger.ts";
+import type { FetchImpl } from "./cline-device-auth.ts";
+import { isWorkosJwt } from "./cline-device-auth.ts";
 
 /** Env override for the pool file location (tests/CI sandbox). */
 export const CLINE_POOL_FILE_ENV = "PI_FREEFLOW_CLINE_POOL_FILE";
@@ -29,14 +32,13 @@ export interface ClineAccount {
  slot: string;
  token: string;
  addedAt: string;
- lastOkAt?: number;
  /** WorkOS refresh token for device-login slots; absent on legacy key slots. */
  refreshToken?: string;
  /** Epoch-ms when `token` expires; absent means "no known expiry" (legacy slots). */
  expiresAt?: number;
- /** WorkOS account id, kept for display/diagnostics only. */
+ /** WorkOS account id, shown when choosing which login to remove. */
  accountId?: string;
- /** Login email, kept for display/diagnostics only. */
+ /** Login email, shown when choosing which login to remove. */
  email?: string;
 }
 
@@ -64,41 +66,31 @@ export interface ClineRefreshResult {
  */
 export type ClineRefresher = (refreshToken: string) => Promise<ClineRefreshResult | null>;
 
-/** Usable bearer for one slot, resolved via refresh when stale. */
-export interface ValidSlotCredentials {
- slot: string;
- token: string;
-}
-
-/** Cooldowns after failures so a bad key stops absorbing traffic. */
-const AUTH_COOLDOWN_MS = 10 * 60_000;
-const RATE_COOLDOWN_MS = 90_000;
-const SERVER_COOLDOWN_MS = 45_000;
-const DEFAULT_COOLDOWN_MS = 30_000;
-
-const slotCooldowns = new Map<string, number>();
-
-/** Test-only: clear in-memory slot cooldowns. */
-export function _resetClineCooldownsForTest(): void {
- slotCooldowns.clear();
-}
-
 /** Test-only: drop the loadPool mtime cache. */
 export function _resetClinePoolCacheForTest(): void {
  cached = null;
  cachedMtime = -1;
 }
 
-function markSlotCooldown(slot: string, ms: number): void {
- slotCooldowns.set(slot, Date.now() + ms);
-}
+/** Version this proxy reports as its Cline client build. */
+export const CLINE_CLIENT_VERSION = "3.5.54";
 
-/** True when the slot is not cooling down. */
-export function isClineSlotHealthy(slot: string): boolean {
- const until = slotCooldowns.get(slot);
- if (!until) return true;
- return Date.now() >= until;
-}
+/**
+ * Client headers the Cline API expects. Measured live (2026-09-21): the
+ * `cline-free/*` models answer 403 "only available via Cline product surfaces"
+ * with a bare bearer, and 200 with this set; every non-prefixed catalog model
+ * (e.g. z-ai/glm-5.3-flash) answers 200 either way. Header names and shape
+ * mirror reference/cline providers/request-headers.ts
+ * (DEFAULT_CLINE_REQUEST_HEADERS) — no credential is derived from them.
+ */
+export const CLINE_CLIENT_HEADERS: Record<string, string> = {
+ "HTTP-Referer": "https://cline.bot",
+ "X-Title": "Cline",
+ "X-IS-MULTIROOT": "false",
+ "X-CLIENT-TYPE": "cline-sdk",
+ "X-CLIENT-VERSION": CLINE_CLIENT_VERSION,
+ "User-Agent": `Cline/${CLINE_CLIENT_VERSION}`,
+};
 
 /** Machine-classified outcome of one Cline chat attempt. */
 export type ClineErrorKind = "ok" | "auth" | "rate-limit" | "exhausted" | "server" | "client";
@@ -144,7 +136,7 @@ function readPoolFile(): ClinePoolState {
    const rec: Record<string, unknown> = entry as Record<string, unknown>;
    const slot = typeof rec.slot === "string" ? rec.slot.trim() : "";
    const token = typeof rec.token === "string" ? rec.token : "";
-   if (!slot || !token.startsWith("workos:")) continue;
+   if (!slot || (!token.startsWith("workos:") && !isWorkosJwt(token) && !token.startsWith("clp_"))) continue;
    const refreshRaw: unknown = rec.refreshToken;
    const refreshToken = typeof refreshRaw === "string" && refreshRaw.length > 0 ? refreshRaw : undefined;
    const expiresRaw: unknown = rec.expiresAt;
@@ -159,7 +151,6 @@ function readPoolFile(): ClinePoolState {
     slot,
     token,
     addedAt: typeof rec.addedAt === "string" ? rec.addedAt : new Date().toISOString(),
-    ...(typeof rec.lastOkAt === "number" ? { lastOkAt: rec.lastOkAt } : {}),
     ...(refreshToken ? { refreshToken } : {}),
     ...(expiresAt !== undefined ? { expiresAt } : {}),
     ...(accountId ? { accountId } : {}),
@@ -224,6 +215,29 @@ export function redactedToken(token: string): string {
  return `…${tail}`;
 }
 
+/**
+ * Persist a patch to one slot against the file as it is on disk right now.
+ * A request holds its pool snapshot across network round trips, and the host
+ * process writes the same file for login/logout, so writing the snapshot back
+ * would revert a login added or removed while the request was in flight. A
+ * slot that no longer exists is left alone rather than resurrected.
+ */
+function patchAccountOnDisk(slot: string, patch: Partial<ClineAccount>): void {
+ const live = readPoolFile();
+ const target = live.accounts.find((a) => a.slot === slot);
+ if (!target) return;
+ Object.assign(target, patch);
+ savePool(live);
+}
+
+/** Record which slot served a turn, without clobbering concurrent edits. */
+function markActiveSlotOnDisk(slot: string): void {
+ const live = readPoolFile();
+ if (!live.accounts.some((a) => a.slot === slot)) return;
+ live.activeSlot = slot;
+ savePool(live);
+}
+
 /**
  * Save (or replace) one login slot. The token must carry the `workos:` prefix.
  * Throws on bad input — the message never echoes the token.
@@ -238,7 +252,7 @@ export function addAccount(
  const cleanSlot = (slot || "").trim();
  if (!cleanSlot) throw new Error("Cline slot name cannot be empty");
  if (cleanSlot.length > 64) throw new Error("Cline slot name is too long (max 64 characters)");
- if (!token.startsWith("workos:")) throw new Error("Cline token must start with workos:");
+ if (!token.startsWith("workos:") && !isWorkosJwt(token) && !token.startsWith("clp_")) throw new Error("Cline token must be a workos: login grant or a clp_ API key");
  const pool = loadPool();
  const existing = pool.accounts.find((a) => a.slot === cleanSlot);
  if (existing) {
@@ -270,7 +284,6 @@ export function addAccount(
   });
  }
  if (!pool.activeSlot) pool.activeSlot = cleanSlot;
- slotCooldowns.delete(cleanSlot);
  savePool(pool);
  return pool;
 }
@@ -294,7 +307,6 @@ export function isClineTokenStale(account: ClineAccount, skewMs = CLINE_REFRESH_
  * caller should fall back to the stale bearer (`null`).
  */
 async function refreshAccountInPlace(
- pool: ClinePoolState,
  account: ClineAccount,
  refreshImpl: ClineRefresher,
 ): Promise<boolean | null> {
@@ -308,7 +320,7 @@ async function refreshAccountInPlace(
   void e;
   return null;
  }
- if (!fresh || typeof fresh.token !== "string" || !fresh.token.startsWith("workos:")) {
+ if (!fresh || typeof fresh.token !== "string" || (!fresh.token.startsWith("workos:") && !isWorkosJwt(fresh.token) && !fresh.token.startsWith("clp_"))) {
   logWarn("cline slot refresh rejected — grant is dead", { slot: account.slot });
   return false;
  }
@@ -321,33 +333,18 @@ async function refreshAccountInPlace(
  }
  if (fresh.accountId?.trim()) account.accountId = fresh.accountId.trim();
  if (fresh.email?.trim()) account.email = fresh.email.trim();
- savePool(pool);
+ // Persist only the refreshed fields: the snapshot this request holds may
+ // predate a login added or removed in the host process.
+ patchAccountOnDisk(account.slot, {
+  token: account.token,
+  ...(account.refreshToken ? { refreshToken: account.refreshToken } : {}),
+  expiresAt: account.expiresAt,
+  ...(account.accountId ? { accountId: account.accountId } : {}),
+  ...(account.email ? { email: account.email } : {}),
+ });
  return true;
 }
 
-/**
- * Resolve a usable bearer for one slot. Fresh slots and legacy slots without
- * a known expiry return immediately; stale slots with a refresh grant try one
- * refresh and persist it. Resolves null when the slot is unknown or its grant
- * is dead (invalid_grant) — the caller should prompt for a fresh login.
- */
-export async function getValidSlotCredentials(
- slot: string,
- opts?: { refreshImpl?: ClineRefresher; skewMs?: number },
-): Promise<ValidSlotCredentials | null> {
- const cleanSlot = (slot || "").trim();
- if (!cleanSlot) return null;
- const pool = loadPool();
- const account = pool.accounts.find((a) => a.slot === cleanSlot);
- if (!account) return null;
- if (!isClineTokenStale(account, opts?.skewMs)) return { slot: account.slot, token: account.token };
- if (!account.refreshToken || !opts?.refreshImpl) return { slot: account.slot, token: account.token };
- const outcome = await refreshAccountInPlace(pool, account, opts.refreshImpl);
- if (outcome === true) return { slot: account.slot, token: account.token };
- if (outcome === false) return null;
- return { slot: account.slot, token: account.token };
-}
-
 /** Drop one login slot. Returns false when the slot was not saved. */
 export function removeAccount(slot: string): boolean {
  const cleanSlot = (slot || "").trim();
@@ -356,7 +353,6 @@ export function removeAccount(slot: string): boolean {
  if (idx < 0) return false;
  pool.accounts.splice(idx, 1);
  if (pool.activeSlot === cleanSlot) pool.activeSlot = pool.accounts[0]?.slot;
- slotCooldowns.delete(cleanSlot);
  savePool(pool);
  return true;
 }
@@ -366,13 +362,10 @@ export interface ClineRollOpts {
  body: string;
  /** Chat completions endpoint (proxy passes its configured URL explicitly). */
  chatUrl: string;
- /** Restrict the roll to these slots; default is the whole pool. */
- slots?: string[];
- fetchImpl?: typeof fetch;
- reqId?: string;
+ fetchImpl?: FetchImpl;
  /**
   * Device-login refresher. When present, a stale slot refreshes once before
-  * its attempt, and a 401/403 refreshes once before the slot cools out.
+  * its attempt, and a 401/403 refreshes once before the slot is skipped.
   * Absent: every slot serves its stored bearer exactly as before.
   */
  refreshImpl?: ClineRefresher;
@@ -382,52 +375,54 @@ export interface ClineRollResult {
  res: Response;
  /** Slot that served the response; null when no account was tried. */
  slot: string | null;
- /** True when every account cooled out (or the pool is empty). */
+ /** True when every account failed (or the pool is empty). */
  exhausted: boolean;
  kind: ClineErrorKind;
 }
 
-function exhaustedResponse(reason: string): Response {
+/**
+ * Synthetic body for the two states that never reached Cline: nothing is
+ * saved to sign in with, or no saved login could reach Cline. Neither is a
+ * rate limit, so it must not answer 429 — that status makes hosts back off
+ * and hide the actionable message behind a "rate limited" notice.
+ */
+function exhaustedResponse(reason: string, status: number): Response {
  return new Response(
   JSON.stringify({ error: { message: reason, code: "cline_pool_exhausted" } }),
-  { status: 429, headers: { "content-type": "application/json" } },
+  { status, headers: { "content-type": "application/json" } },
  );
 }
 
 /**
- * POST one chat body to the Cline endpoint, rolling across saved slots with
- * per-slot cooldowns. Each attempt sends its slot bearer explicitly; raw
- * tokens never leave this module. Response bodies are never consumed here —
- * the caller owns the returned Response.
+ * POST one chat body to the Cline endpoint, rolling across every saved slot.
+ * Each attempt sends its slot bearer explicitly; raw tokens never leave this
+ * module. Superseded failure bodies are cancelled here; the response handed
+ * back to the caller is left untouched so the caller can read it.
  */
 export async function rollChat(opts: ClineRollOpts): Promise<ClineRollResult> {
  const fetchImpl = opts.fetchImpl ?? fetch;
  const pool = loadPool();
- const wanted = opts.slots?.map((s) => s.trim()).filter(Boolean);
- let candidates = wanted?.length
-  ? pool.accounts.filter((a) => wanted.includes(a.slot))
-  : [...pool.accounts];
+ let candidates = [...pool.accounts];
  if (pool.activeSlot) {
   const at = candidates.findIndex((a) => a.slot === pool.activeSlot);
   if (at > 0) candidates = [candidates[at], ...candidates.slice(0, at), ...candidates.slice(at + 1)];
  }
- candidates = candidates.filter((a) => isClineSlotHealthy(a.slot));
  if (candidates.length === 0) {
-  const reason = pool.accounts.length === 0
-   ? "No Cline accounts saved — add one with /freeflow cline login"
-   : "All Cline accounts are cooling down — try again shortly";
-  logWarn("cline pool exhausted", { slots: pool.accounts.length });
-  return { res: exhaustedResponse(reason), slot: null, exhausted: true, kind: "exhausted" };
+  const reason = "No Cline logins saved — add one with /freeflow cline login";
+  logWarn("cline pool empty", { slots: pool.accounts.length });
+  return { res: exhaustedResponse(reason, 401), slot: null, exhausted: true, kind: "exhausted" };
  }
+ let lastRes: Response | null = null;
+ let lastSlot: string | null = null;
+ let lastKind: ClineErrorKind = "exhausted";
  for (const account of candidates) {
   // Stale device-login bearer: one refresh before the attempt. A dead grant
-  // cools the slot out immediately; a transient fault keeps the stale token.
+  // skips the slot for this turn; a transient fault keeps the stale token.
   let refreshedThisSlot = false;
   if (opts.refreshImpl && account.refreshToken && isClineTokenStale(account)) {
-   const outcome = await refreshAccountInPlace(pool, account, opts.refreshImpl);
+   const outcome = await refreshAccountInPlace(account, opts.refreshImpl);
    if (outcome === false) {
-    markSlotCooldown(account.slot, AUTH_COOLDOWN_MS);
-    logWarn("cline slot refresh rejected — cooling slot", { slot: account.slot });
+    logWarn("cline slot refresh rejected — skipping slot this turn", { slot: account.slot });
     continue;
    }
    refreshedThisSlot = outcome === true;
@@ -438,67 +433,73 @@ export async function rollChat(opts: ClineRollOpts): Promise<ClineRollResult> {
      method: "POST",
      headers: {
       "content-type": "application/json",
+      ...CLINE_CLIENT_HEADERS,
       authorization: `Bearer ${token}`,
      },
      body: opts.body,
     });
    } catch (e) {
-    markSlotCooldown(account.slot, DEFAULT_COOLDOWN_MS);
-    logWarn("cline slot fetch error — cooling slot", { slot: account.slot });
+    logWarn("cline slot fetch error — trying next slot", { slot: account.slot });
     void e;
     return null;
    }
   };
-  const succeed = (res: Response, kind: ClineErrorKind): ClineRollResult => {
-   if (kind === "ok") {
-    account.lastOkAt = Date.now();
-    pool.activeSlot = account.slot;
-    savePool(pool);
+  const succeed = async (res: Response, kind: ClineErrorKind): Promise<ClineRollResult> => {
+   if (kind === "ok") markActiveSlotOnDisk(account.slot);
+   if (lastRes && lastRes !== res) {
+    try { await lastRes.body?.cancel(); } catch { }
    }
+   lastRes = null;
    return { res, slot: account.slot, exhausted: false, kind };
   };
-  const cool = (kind: ClineErrorKind, status: number): void => {
-   markSlotCooldown(
-    account.slot,
-    kind === "auth" ? AUTH_COOLDOWN_MS : kind === "rate-limit" ? RATE_COOLDOWN_MS : SERVER_COOLDOWN_MS,
-   );
-   logWarn("cline slot failed — rolling to next slot", { slot: account.slot, status });
+  const stashFailure = async (res: Response, kind: ClineErrorKind): Promise<void> => {
+   if (lastRes && lastRes !== res) {
+    try { await lastRes.body?.cancel(); } catch { }
+   }
+   lastRes = res;
+   lastSlot = account.slot;
+   lastKind = kind;
   };
   let res = await attempt(account.token);
   if (!res) continue;
   let kind = mapClineError(res.status);
-  if (kind === "ok" || kind === "client") return succeed(res, kind);
+  if (kind === "ok" || kind === "client") return await succeed(res, kind);
   // Auth failure on a refreshable slot that has not refreshed yet: one
   // refresh, then exactly one retry with the fresh bearer.
   if (kind === "auth" && !refreshedThisSlot && opts.refreshImpl && account.refreshToken) {
-   try {
-    await res.body?.cancel();
-   } catch { }
-   const outcome = await refreshAccountInPlace(pool, account, opts.refreshImpl);
+   const outcome = await refreshAccountInPlace(account, opts.refreshImpl);
    if (outcome === true) {
+    try {
+     await res.body?.cancel();
+    } catch { }
     refreshedThisSlot = true;
     res = await attempt(account.token);
     if (!res) continue;
     kind = mapClineError(res.status);
-    if (kind === "ok" || kind === "client") return succeed(res, kind);
+    if (kind === "ok" || kind === "client") return await succeed(res, kind);
    } else if (outcome === false) {
     try {
      await res.body?.cancel();
     } catch { }
-    cool(kind, res.status);
+    logWarn("cline slot refresh rejected — trying next slot", { slot: account.slot });
     continue;
    }
-   // Transient refresh fault: fall through and cool the slot on the
-   // original auth result below.
+   // Transient refresh fault: the original response is still intact, so it is
+   // stashed below and can be surfaced to the caller.
   }
-  cool(kind, res.status);
-  try {
-   await res.body?.cancel();
-  } catch { }
+  logWarn("cline slot failed — trying next slot", { slot: account.slot, status: res.status });
+  await stashFailure(res, kind);
+ }
+ if (lastRes) {
+  logWarn("cline pool exhausted after roll — returning last upstream failure", { slots: candidates.length });
+  return { res: lastRes, slot: lastSlot, exhausted: true, kind: lastKind };
  }
- logWarn("cline pool exhausted after roll", { slots: candidates.length });
+ // Every slot was skipped before producing a response: its saved login was
+ // rejected, or the network call threw. Nothing is rate-limited here, so say
+ // what actually happened instead of implying the user should wait.
+ logWarn("cline pool exhausted with no upstream response", { slots: candidates.length });
  return {
-  res: exhaustedResponse("All Cline accounts failed or are cooling down — try again shortly"),
+  res: exhaustedResponse("Every saved Cline login failed to reach Cline — sign in again with /freeflow cline login", 502),
   slot: null,
   exhausted: true,
   kind: "exhausted",

package/src/cline-device-auth.ts

@@ -7,6 +7,8 @@
  * mocked tests only, no live calls here.
  */
 
+import { fetchWithSystemCA } from "./system-ca-fetch.ts";
+
 export interface OAuthCredentials {
  access: string;
  refresh: string;
@@ -58,12 +60,20 @@ export function resolveClineWorkosClientId(): string {
  return BUNDLED_CLINE_WORKOS_CLIENT_ID;
 }
 
-/** Resolved client id used by start/poll. */
-export const CLINE_WORKOS_CLIENT_ID = resolveClineWorkosClientId();
+/**
+ * Wire form of a Cline credential. Cline OAuth access tokens are WorkOS JWTs
+ * (base64url eyJ header) and must ride as workos:<jwt>; dashboard API keys
+ * (clp_ apikey category) go verbatim — prefixing them 401s. Mirrors the
+ * 9router getClineAccessToken guard (open-sse/shared/clineAuth.js).
+ */
+export function isWorkosJwt(token: string): boolean {
+ return /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/.test(token.trim());
+}
 
 export function toApiKey(accessToken: string): string {
  const token = accessToken.trim();
- return token.toLowerCase().startsWith(WORKOS_TOKEN_PREFIX) ? token : `${WORKOS_TOKEN_PREFIX}${token}`;
+ if (token.toLowerCase().startsWith(WORKOS_TOKEN_PREFIX)) return token;
+ return isWorkosJwt(token) ? `${WORKOS_TOKEN_PREFIX}${token}` : token;
 }
 
 const DEVICE_AUTHORIZATION_PATH = "/user_management/authorize/device";
@@ -73,7 +83,7 @@ const REFRESH_PATH = "/api/v1/auth/refresh";
 
 const HTTP_TIMEOUT_MS = 30 * 1000;
 
-export type FetchImpl = typeof fetch;
+export type FetchImpl = (input: string, init?: RequestInit) => Promise<Response>;
 
 function joinUrl(base: string, path: string): string {
  return base.replace(/\/+$/, "") + path;
@@ -126,7 +136,7 @@ export function deriveExpiry(explicitMs: number | undefined, accessToken: string
 
 export async function startDeviceAuth(
  workosBase: string = DEFAULT_WORKOS_BASE,
- fetchImpl: FetchImpl = fetch,
+ fetchImpl: FetchImpl = fetchWithSystemCA,
 ): Promise<DeviceAuth> {
  const response = await fetchImpl(joinUrl(workosBase, DEVICE_AUTHORIZATION_PATH), {
   method: "POST",
@@ -173,7 +183,7 @@ export async function pollDeviceToken(
  options?: PollOptions,
 ): Promise<DevicePollTokens> {
  if (!deviceCode) throw new Error("deviceCode is required");
- const fetchFn = options?.fetchImpl ?? fetch;
+ const fetchFn = options?.fetchImpl ?? fetchWithSystemCA;
  const outerSignal = options?.signal;
  const deadline = Date.now() + (options?.maxWaitMs ?? intervalSeconds * 1000 * 60 * 10);
  let interval = Math.max(1, intervalSeconds);
@@ -199,7 +209,7 @@ export async function pollDeviceToken(
    }
    if (error instanceof ClineAuthError) throw error;
    if (Date.now() > deadline) throw new Error("WorkOS device authorization timed out");
-   await sleepMs(interval * 1000, outerSignal);
+   await sleepMs(remainingMs(deadline, interval), outerSignal);
    continue;
   }
   const payload = (await response.json().catch(() => ({}))) as Record<string, unknown>;
@@ -219,6 +229,9 @@ export async function pollDeviceToken(
    payload.error === "invalid_grant"
   ) {
    throwDenied(payload, response.status, `Device login refused (${String(payload.error)})`);
+  } else if (response.status >= 500 || response.status === 429) {
+   // Transient WorkOS blip: keep polling until the code's own deadline rather
+   // than failing a login that would have succeeded seconds later.
   } else {
    throw new ClineAuthError(
     typeof payload.error_description === "string"
@@ -228,10 +241,19 @@ export async function pollDeviceToken(
    );
   }
   if (Date.now() > deadline) throw new Error("WorkOS device authorization timed out");
-  await sleepMs(interval * 1000, outerSignal);
+  await sleepMs(remainingMs(deadline, interval), outerSignal);
  }
 }
 
+/**
+ * Wait before the next poll, never past the device code's own expiry: a
+ * `slow_down` reply grows the interval, and sleeping the full interval after
+ * the deadline check would keep a dead login alive for minutes.
+ */
+function remainingMs(deadline: number, intervalSeconds: number): number {
+ return Math.max(0, Math.min(intervalSeconds * 1000, deadline - Date.now()));
+}
+
 async function sleepMs(ms: number, signal?: AbortSignal): Promise<void> {
  if (signal?.aborted) throw new ClineAuthError("Device login cancelled", { errorCode: "cancelled" });
  if (!signal) {
@@ -258,7 +280,7 @@ interface ClineTokenData {
  refreshToken?: string;
  tokenType: string;
  expiresAt: string;
- userInfo: { email: string; clineUserId: string | null };
+ userInfo?: { email?: string; clineUserId?: string | null };
 }
 
 function toCredentials(data: ClineTokenData, fallbackRefresh?: string): OAuthCredentials {
@@ -274,8 +296,8 @@ function toCredentials(data: ClineTokenData, fallbackRefresh?: string): OAuthCre
   access: data.accessToken,
   refresh,
   expires: deriveExpiry(explicit, data.accessToken),
-  accountId: data.userInfo.clineUserId ?? undefined,
-  email: data.userInfo.email || undefined,
+  accountId: data.userInfo?.clineUserId ?? undefined,
+  email: data.userInfo?.email || undefined,
   metadata: { tokenType: data.tokenType },
  };
 }
@@ -295,7 +317,7 @@ export async function registerClineToken(
  apiBase: string = DEFAULT_API_BASE,
  accessToken = "",
  refreshToken = "",
- fetchImpl: FetchImpl = fetch,
+ fetchImpl: FetchImpl = fetchWithSystemCA,
 ): Promise<OAuthCredentials> {
  if (!accessToken || !refreshToken) throw new Error("accessToken and refreshToken are required");
  const response = await fetchImpl(joinUrl(apiBase, REGISTER_PATH), {
@@ -316,7 +338,7 @@ export async function registerClineToken(
 export async function refreshClineToken(
  apiBase: string = DEFAULT_API_BASE,
  refreshToken = "",
- fetchImpl: FetchImpl = fetch,
+ fetchImpl: FetchImpl = fetchWithSystemCA,
 ): Promise<OAuthCredentials> {
  if (!refreshToken) throw new Error("refreshToken is required");
  const response = await fetchImpl(joinUrl(apiBase, REFRESH_PATH), {