pi-freeflow 1.22.1 → 1.22.4

package/src/commands.ts

@@ -58,9 +58,10 @@ import {
  formatRelayPickerItem,
  formatRelayStatusLabel,
 } from "./relay-state.ts";
-import { addAccount, isClineSlotHealthy, loadPool, redactedToken, removeAccount } from "./cline-accounts.ts";
+import { addAccount, loadPool, redactedToken, removeAccount } from "./cline-accounts.ts";
 import type { ClinePoolState } from "./cline-accounts.ts";
 import { pollDeviceToken, registerClineToken, startDeviceAuth, toApiKey } from "./cline-device-auth.ts";
+import { isCertError } from "./system-ca-fetch.ts";
 import type {
  ExtensionAPI,
  ExtensionContext,
@@ -366,8 +367,9 @@ function nextClineSlot(pool: ClinePoolState): string {
 function formatClineAccountLines(pool: ClinePoolState): string[] {
  return pool.accounts.map((a, idx) => {
   const star = a.slot === pool.activeSlot ? "*" : " ";
-  const health = isClineSlotHealthy(a.slot) ? "ready" : "cooling";
-  return `${star} [${idx + 1}] [${a.slot}] key ending ${redactedToken(a.token)} — ${health}`;
+  const who = a.email || a.accountId;
+  const whoPart = who ? ` ${who}` : "";
+  return `${star} [${idx + 1}] [${a.slot}]${whoPart} key ending ${redactedToken(a.token)}`;
  });
 }
 /** User-safe one-line message for caught values (never echoes secrets). */
@@ -1452,20 +1454,25 @@ export function createCommandSpec(
      try {
       started = await startDeviceAuth();
      } catch (e) {
+      if (isCertError(e)) {
+       ctx.ui.notify("Could not reach Cline: your antivirus or network proxy intercepts TLS and Node does not trust it. The login retries with your OS certificates automatically — if this persists, restart the host with NODE_USE_SYSTEM_CA=1 set, or point NODE_EXTRA_CA_CERTS at your proxy CA file.", "error");
+       return;
+      }
       ctx.ui.notify(`Could not reach Cline to start login: ${clineErrorMessage(e)}`, "error");
       return;
      }
      const link = started.verificationUriComplete ?? started.verificationUri;
      const minutes = Math.max(1, Math.round(started.expiresIn / 60));
-     ctx.ui.notify(`Cline login [${slot}]: open ${link} and enter code ${started.userCode} (expires in ~${minutes} min)`, "info");
-     ctx.ui.notify("Waiting for approval in the browser — approve or cancel there; this finishes on its own.", "info");
+     const loginLine = `Cline login [${slot}]\nOpen this link in your browser:\n${link}\nEnter code: ${started.userCode} (expires in ~${minutes} min)\nWaiting for approval — approve or cancel in the browser; this finishes on its own.`;
+     ctx.ui.notify(loginLine, "info");
+     try { ctx.ui.setStatus("cline-login", `Cline login [${slot}] code ${started.userCode}`); } catch { }
      const progress = setInterval(() => {
-      ctx.ui.notify("Still waiting for Cline approval — approve or cancel in the browser.", "info");
+      ctx.ui.notify(loginLine, "info");
      }, 45000);
      // @ts-ignore allow unref to not block process exit in CLI
      progress.unref?.();
      try {
-      const deviceTokens = await pollDeviceToken(undefined, started.deviceCode, started.interval);
+      const deviceTokens = await pollDeviceToken(undefined, started.deviceCode, started.interval, { maxWaitMs: Math.max(60_000, started.expiresIn * 1000) });
       const creds = await registerClineToken(undefined, deviceTokens.accessToken, deviceTokens.refreshToken);
       const apiKey = toApiKey(creds.access);
       addAccount(slot, apiKey, {
@@ -1482,9 +1489,7 @@ export function createCommandSpec(
       if (e && typeof e === "object" && "errorCode" in e && typeof e.errorCode === "string") {
        code = e.errorCode;
       }
-      if (code === "authorization_pending") {
-       ctx.ui.notify("Still waiting for Cline approval — approve or cancel in the browser.", "info");
-      } else if (code === "access_denied" || code === "cancelled") {
+      if (code === "access_denied") {
        ctx.ui.notify("Cline login cancelled.", "warning");
       } else if (code === "expired_token") {
        ctx.ui.notify("Cline login code expired — run /freeflow cline login again for a fresh code.", "warning");
@@ -1493,27 +1498,57 @@ export function createCommandSpec(
       }
      } finally {
       clearInterval(progress);
+      try { ctx.ui.setStatus("cline-login", undefined); } catch { }
      }
     } else if (action === "accounts" || action === "list") {
      const pool = loadPool();
      if (!pool.accounts.length) {
       ctx.ui.notify("No Cline logins saved — add one with /freeflow cline login", "info");
      } else {
-      const lines = pool.accounts.map((a, idx) => {
-       const star = a.slot === pool.activeSlot ? "*" : " ";
-       const health = isClineSlotHealthy(a.slot) ? "ready" : "cooling";
-       return `${star} [${idx + 1}] [${a.slot}] key ending ${redactedToken(a.token)} — ${health}`;
-      });
-      ctx.ui.notify(`Cline logins (${pool.accounts.length}):\n${lines.join("\n")}`, "info");
+      ctx.ui.notify(`Cline logins (${pool.accounts.length}):\n${formatClineAccountLines(pool).join("\n")}`, "info");
      }
     } else if (action === "logout" || action === "remove") {
-     const slot = arg || ((await ctx.ui.input("Cline slot to remove:", ""))?.trim() || "");
-     if (!slot) {
-      ctx.ui.notify("Cancelled — no slot provided", "warning");
-     } else if (!removeAccount(slot)) {
-      ctx.ui.notify(`Cline slot '${slot}' not found`, "warning");
+     const pool = loadPool();
+     if (!pool.accounts.length) {
+      ctx.ui.notify("No Cline logins saved — nothing to remove", "info");
      } else {
-      ctx.ui.notify(`Removed Cline login [${slot}]`, "info");
+      const resolveSlot = (raw: string): string | null => {
+       const clean = (raw || "").trim();
+       if (!clean) return null;
+       const byIndex = Number.parseInt(clean, 10);
+       if (String(byIndex) === clean && byIndex >= 1 && byIndex <= pool.accounts.length) return pool.accounts[byIndex - 1].slot;
+       const exact = pool.accounts.find((a) => a.slot === clean);
+       if (exact) return exact.slot;
+       const folded = pool.accounts.find((a) => a.slot.toLowerCase() === clean.toLowerCase());
+       return folded ? folded.slot : null;
+      };
+      let slot = resolveSlot(arg);
+      if (arg && !slot) {
+       const saved = pool.accounts.map((a, idx) => `${idx + 1}=${a.slot}`).join(", ");
+       ctx.ui.notify(`Cline slot '${arg}' not found. Saved: ${saved}`, "warning");
+      } else {
+       if (!slot) {
+        if (pool.accounts.length === 1) {
+         slot = pool.accounts[0].slot;
+        } else {
+         const opts = formatClineAccountLines(pool);
+         const choice = await ctx.ui.select("Remove Cline login", [...opts, "Cancel"]);
+         if (!choice || choice === "Cancel") {
+          ctx.ui.notify("Cancelled — no slot removed", "warning");
+          return;
+         }
+         const hit = pool.accounts.find((a, idx) => opts[idx] === choice);
+         slot = hit ? hit.slot : null;
+        }
+       }
+       if (!slot) {
+        ctx.ui.notify("Cancelled — no slot removed", "warning");
+       } else if (!removeAccount(slot)) {
+        ctx.ui.notify(`Cline slot '${slot}' not found`, "warning");
+       } else {
+        ctx.ui.notify(`Removed Cline login [${slot}]`, "info");
+       }
+      }
      }
     } else {
      ctx.ui.notify("Usage: /freeflow cline login [--key] [slot] | /freeflow cline accounts | /freeflow cline logout [slot]", "warning");

package/src/daemon.ts

@@ -12,38 +12,37 @@
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import {
-	DAEMON_GC_MS,
-	DAEMON_GRACE_MS,
-	DAEMON_TTL_MS,
-	HOST,
-	PKG_VERSION,
-	PORT,
+ DAEMON_GC_MS,
+ DAEMON_GRACE_MS,
+ DAEMON_TTL_MS,
+ HOST,
+ PKG_VERSION,
+ PORT,
 } from "./config.ts";
 import { setShutdownShouldExit } from "./proxy.ts";
 import {
-	getAliveCatalog,
-	readCatalogCache,
-	refreshCatalog,
-	setAliveCatalog,
+ getAliveCatalog,
+ refreshCatalog,
+ setAliveCatalog,
 } from "./catalog.ts";
 import { log, logInfo, logWarn } from "./logger.ts";
 import {
-	startLeaseGC,
-	stopLeaseGC,
-	touchActivity,
+ startLeaseGC,
+ stopLeaseGC,
+ touchActivity,
 } from "./lease.ts";
 import { getActiveRequests, startProxy } from "./proxy.ts";
 import { loadRelayState, setActiveRelayState } from "./relay-state.ts";
 
 /** True when this module was run as the entry script (not imported by tests). */
 export function isDaemonMain(): boolean {
-	try {
-		const entry = process.argv[1];
-		if (!entry) return false;
-		return path.resolve(entry) === fileURLToPath(import.meta.url);
-	} catch {
-		return false;
-	}
+ try {
+  const entry = process.argv[1];
+  if (!entry) return false;
+  return path.resolve(entry) === fileURLToPath(import.meta.url);
+ } catch {
+  return false;
+ }
 }
 
 /**
@@ -51,11 +50,11 @@ export function isDaemonMain(): boolean {
  * uses the latest client edits without a daemon restart. Non-fatal on failure.
  */
 export function syncRelayStateFromDisk(): void {
-	try {
-		setActiveRelayState(loadRelayState(), false);
-	} catch (e) {
-		log("warn", "daemon failed to load relay state from disk", { error: String(e) });
-	}
+ try {
+  setActiveRelayState(loadRelayState(), false);
+ } catch (e) {
+  log("warn", "daemon failed to load relay state from disk", { error: String(e) });
+ }
 }
 
 /**
@@ -64,21 +63,17 @@ export function syncRelayStateFromDisk(): void {
  * 24h cache TTL without requiring a daemon restart.
  */
 export async function seedCatalog(): Promise<void> {
-	const cached = readCatalogCache();
-	if (cached && Array.isArray(cached.models) && cached.models.length > 0) {
-		setAliveCatalog(cached.models);
-	}
-	try {
-		const fresh = await refreshCatalog(false);
-		if (fresh.length > 0) {
-			setAliveCatalog(fresh);
-		}
-	} catch (e) {
-		logWarn("daemon catalog refresh failed; retaining cached catalog", {
-			error: String(e),
-		});
-	}
-	logInfo(`daemon catalog ready: ${getAliveCatalog().length} models`);
+ try {
+  const fresh = await refreshCatalog(false);
+  if (fresh.length > 0) {
+   setAliveCatalog(fresh);
+  }
+ } catch (e) {
+  logWarn("daemon catalog refresh failed; retaining static catalog", {
+   error: String(e),
+  });
+ }
+ logInfo(`daemon catalog ready: ${getAliveCatalog().length} models`);
 }
 
 /**
@@ -87,63 +82,63 @@ export async function seedCatalog(): Promise<void> {
  * cleanly on SIGTERM/SIGINT (e.g. /freeflow kill, taskkill, Ctrl+C).
  */
 export async function runDaemon(): Promise<void> {
-	let server: { close(): void } | null = null;
-	const retire = (why: string): void => {
-		logInfo(`daemon retiring: ${why}`);
-		stopLeaseGC();
-		try {
-			server?.close();
-		} catch {}
-		process.exit(0);
-	};
-	process.on("SIGTERM", () => retire("SIGTERM"));
-	process.on("SIGINT", () => retire("SIGINT"));
-	process.on("uncaughtException", (err) => {
-		log("error", "daemon uncaughtException", { error: String(err), stack: (err as Error)?.stack, activeRequests: getActiveRequests() });
-	});
-	process.on("unhandledRejection", (reason) => {
-		log("error", "daemon unhandledRejection", { error: String(reason), activeRequests: getActiveRequests() });
-	});
-	setShutdownShouldExit(true);
-	try {
-		const r = await startProxy();
-		if (!r.server) {
-			// Port was taken by another (possibly newer) daemon — the parent
-			// attaches to the winner; this spawn exits quietly.
-			logInfo(`daemon found an existing proxy on http://${HOST}:${r.port} — exiting`);
-			process.exit(0);
-		}
-		server = r.server;
-	} catch (e) {
-		log("error", "daemon failed to bind proxy port", { error: String(e) });
-		process.exit(1);
-	}
+ let server: { close(): void } | null = null;
+ const retire = (why: string): void => {
+  logInfo(`daemon retiring: ${why}`);
+  stopLeaseGC();
+  try {
+   server?.close();
+  } catch { }
+  process.exit(0);
+ };
+ process.on("SIGTERM", () => retire("SIGTERM"));
+ process.on("SIGINT", () => retire("SIGINT"));
+ process.on("uncaughtException", (err) => {
+  log("error", "daemon uncaughtException", { error: String(err), stack: (err as Error)?.stack, activeRequests: getActiveRequests() });
+ });
+ process.on("unhandledRejection", (reason) => {
+  log("error", "daemon unhandledRejection", { error: String(reason), activeRequests: getActiveRequests() });
+ });
+ setShutdownShouldExit(true);
+ try {
+  const r = await startProxy();
+  if (!r.server) {
+   // Port was taken by another (possibly newer) daemon — the parent
+   // attaches to the winner; this spawn exits quietly.
+   logInfo(`daemon found an existing proxy on http://${HOST}:${r.port} — exiting`);
+   process.exit(0);
+  }
+  server = r.server;
+ } catch (e) {
+  log("error", "daemon failed to bind proxy port", { error: String(e) });
+  process.exit(1);
+ }
 
-	// lastActivityAt is still seeded AT BIND TIME for the /_health snapshot, but
-	// retirement no longer reads it — only the zero-lease persistence window
-	// gates the GC, so a fresh spawn always survives its re-attach window.
-	touchActivity();
-	syncRelayStateFromDisk();
-	void seedCatalog();
+ // lastActivityAt is still seeded AT BIND TIME for the /_health snapshot, but
+ // retirement no longer reads it — only the zero-lease persistence window
+ // gates the GC, so a fresh spawn always survives its re-attach window.
+ touchActivity();
+ syncRelayStateFromDisk();
+ void seedCatalog();
 
-	// Retire only when zero leases persist past the grace window with nothing
-	// in flight — never for request-idleness.
-	startLeaseGC({
-		ttlMs: DAEMON_TTL_MS,
-		gcMs: DAEMON_GC_MS,
-		graceMs: DAEMON_GRACE_MS,
-		getActiveRequests,
-		onIdle: () => retire("no clients"),
-	});
+ // Retire only when zero leases persist past the grace window with nothing
+ // in flight — never for request-idleness.
+ startLeaseGC({
+  ttlMs: DAEMON_TTL_MS,
+  gcMs: DAEMON_GC_MS,
+  graceMs: DAEMON_GRACE_MS,
+  getActiveRequests,
+  onIdle: () => retire("no clients"),
+ });
 
-	logInfo(`pi-freeflow daemon v${PKG_VERSION} listening on http://${HOST}:${PORT}`);
+ logInfo(`pi-freeflow daemon v${PKG_VERSION} listening on http://${HOST}:${PORT}`);
 }
 
 // Entry guard: run only when executed as the entry script. When imported by
 // tests, isDaemonMain() is false and no port is bound.
 if (isDaemonMain()) {
-	runDaemon().catch((e) => {
-		log("error", "daemon crashed", { error: String(e) });
-		process.exit(1);
-	});
+ runDaemon().catch((e) => {
+  log("error", "daemon crashed", { error: String(e) });
+  process.exit(1);
+ });
 }

package/src/index.ts

@@ -146,17 +146,12 @@ export function buildProviderConfig(
      }
      : m.api === "openai-responses"
       ? { sessionAffinityFormat: "openai-nosession" }
-      : m.source === "kilo"
+      : m.source === "kilo" || m.source === "cline"
        ? {
         supportsDeveloperRole: false,
         supportsReasoningEffort: !!m.thinkingLevelMap,
        }
-       : m.source === "cline"
-        ? {
-         supportsDeveloperRole: false,
-         supportsReasoningEffort: !!m.thinkingLevelMap,
-        }
-        : {
+       : {
         supportsDeveloperRole: false,
         supportsReasoningEffort: true,
        },

package/src/proxy.ts

@@ -42,7 +42,9 @@ import {
 } from "./opencode-fingerprint.ts";
 import { isDebugEnabled, log } from "./logger.ts";
 import { getModelUpstream, isClineModel, KILO_MODEL_IDS, MODEL_MAP, resolveCanonicalModelId } from "./models.ts";
+import { ClineAuthError, refreshClineToken, toApiKey } from "./cline-device-auth.ts";
 import { rollChat } from "./cline-accounts.ts";
+import { fetchWithSystemCA } from "./system-ca-fetch.ts";
 import {
  chatResponsesJsonFromChatCompletion,
  chatResponsesSseFromChatCompletion,
@@ -133,6 +135,9 @@ const CLINE_MODEL_HINT =
  * bodies — passes through untouched.
  */
 export function mapClineError(status: number, data: string): string {
+ // Synthetic pool-exhausted bodies already tell the user exactly what to do
+ // (sign in again) — a rate-limit hint would mislead.
+ if (data.includes("cline_pool_exhausted")) return data;
  const hint = status === 429
   ? CLINE_RATE_LIMIT_HINT
   : status === 403
@@ -151,6 +156,29 @@ export function mapClineError(status: number, data: string): string {
  } catch { }
  return data;
 }
+/**
+ * Device-login refresher for the Cline pool: one refresh per stale slot per
+ * turn. A grant Cline rejects outright (HTTP 4xx, or a 200 without usable
+ * tokens) is dead — it resolves null so the pool stops trying that slot until
+ * the user logs in again. Anything else (network fault, upstream 5xx) throws,
+ * which keeps the stale bearer for this turn.
+ */
+async function clineRefreshImpl(refreshToken: string): Promise<{ token: string; refreshToken?: string; expiresAt?: number } | null> {
+ try {
+  const creds = await refreshClineToken(undefined, refreshToken);
+  return { token: toApiKey(creds.access), refreshToken: creds.refresh, expiresAt: creds.expires };
+ } catch (e) {
+  if (e instanceof ClineAuthError && typeof e.status === "number" && e.status >= 400 && e.status < 500) {
+   log("warn", "cline refresh grant rejected — slot needs a fresh login", { status: e.status });
+   return null;
+  }
+  if (e instanceof Error && /^Invalid token response|^Token response did not include a refresh token/.test(e.message)) {
+   log("warn", "cline refresh returned no usable tokens — slot needs a fresh login", { reason: e.message });
+   return null;
+  }
+  throw e;
+ }
+}
 
 /**
  * Serve a Cline-model request direct (never relay pool, no opencode
@@ -181,7 +209,7 @@ async function handleClineRequest(opts: {
  chatBody.stream = true;
  let upstreamRes: Response;
  try {
-  const result = await rollChat({ body: JSON.stringify(chatBody), chatUrl: CLINE_CHAT_URL });
+  const result = await rollChat({ body: JSON.stringify(chatBody), chatUrl: CLINE_CHAT_URL, refreshImpl: clineRefreshImpl, fetchImpl: fetchWithSystemCA });
   upstreamRes = result.res;
   if (typeof result.slot === "string" && result.slot.length > 0) {
    log("debug", `cline served by slot ${result.slot}`, { model }, reqId);
@@ -200,10 +228,23 @@ async function handleClineRequest(opts: {
  }
  if (!upstreamRes.ok) {
   log("warn", `cline upstream ${upstreamRes.status} for model ${model}`, { status: upstreamRes.status, model }, reqId);
-  const data = mapClineError(upstreamRes.status, await upstreamRes.text());
+  const raw = await upstreamRes.text().catch(() => null);
+  if (raw === null) {
+   log("error", "cline upstream body unreadable", { status: upstreamRes.status, model }, reqId);
+   if (!res.headersSent) {
+    res.writeHead(502, { "content-type": "application/json" });
+    res.end(JSON.stringify({ error: "upstream error" }));
+   } else if (!res.writableEnded) {
+    res.end();
+   }
+   return;
+  }
+  const data = mapClineError(upstreamRes.status, raw);
   if (!res.headersSent) {
    res.writeHead(upstreamRes.status, { "content-type": upstreamRes.headers.get("content-type") || "application/json" });
    res.end(data);
+  } else if (!res.writableEnded) {
+   res.end();
   }
   return;
  }
@@ -223,12 +264,24 @@ async function handleClineRequest(opts: {
   );
   return;
  }
- const sseText = await upstreamRes.text();
+ const sseText = await upstreamRes.text().catch(() => null);
+ if (sseText === null) {
+  log("error", "cline upstream stream unreadable", { status: upstreamRes.status, model }, reqId);
+  if (!res.headersSent) {
+   res.writeHead(502, { "content-type": "application/json" });
+   res.end(JSON.stringify({ error: "upstream error" }));
+  } else if (!res.writableEnded) {
+   res.end();
+  }
+  return;
+ }
  if (!responsesRequest) {
   const data = convertSseToJson(sseText, pathname);
   if (!res.headersSent) {
    res.writeHead(upstreamRes.status, { "content-type": "application/json" });
    res.end(data);
+  } else if (!res.writableEnded) {
+   res.end();
   }
   return;
  }
@@ -243,12 +296,16 @@ async function handleClineRequest(opts: {
     "x-accel-buffering": "no",
    });
    res.end(chatResponsesSseFromChatCompletion(resp));
+  } else if (!res.writableEnded) {
+   res.end();
   }
   return;
  }
  if (!res.headersSent) {
   res.writeHead(200, { "content-type": "application/json" });
   res.end(JSON.stringify(resp));
+ } else if (!res.writableEnded) {
+  res.end();
  }
 }
 
@@ -257,13 +314,15 @@ async function handleClineRequest(opts: {
  * when the model is a non-empty string present in MODEL_MAP or KILO_MODEL_IDS
  * (Kilo traffic leaves via its own branch regardless), and when the model is
  * missing/empty (e.g. GET /v1/models carries no body — preserve routing).
- * Anything else (unknown/paid model ids, non-strings) goes direct upstream.
+ * Cline models are direct-only and never relay-eligible. Anything else
+ * (unknown/paid model ids, non-strings) goes direct upstream.
  */
 export function isRelayEligibleModel(model: unknown): boolean {
  if (model === undefined || model === null) return true;
  if (typeof model !== "string") return false;
  if (model.trim() === "") return true;
  const canonical = resolveCanonicalModelId(model.trim());
+ if (isClineModel(canonical)) return false;
  return MODEL_MAP.has(canonical) || KILO_MODEL_IDS.has(canonical);
 }
 
@@ -752,7 +811,7 @@ export function startProxy(
      id: m.id,
      object: "model",
      created: 0,
-     owned_by: m.source === "kilo" ? "kilocode" : "opencode",
+     owned_by: m.source === "kilo" ? "kilocode" : m.source === "cline" ? "clinecode" : "opencode",
     })),
    });
    res.writeHead(200, {