pi-freeflow 1.22.2 → 1.23.0

package/src/cline-accounts.ts

@@ -4,7 +4,8 @@
  * Cline serves its free models direct-only (never through the relay pool),
  * one bearer key per login slot. Keys live in a 0600 file beside the relay
  * state; a corrupt file reads back as an empty pool (never throws, never
- * logs secrets). Request failover walks the pool with per-slot cooldowns.
+ * logs secrets). Request failover walks the pool in order, trying every slot
+ * fresh on every request — no slot is ever locked out.
  */
 
 import fs from "node:fs";
@@ -31,14 +32,13 @@ export interface ClineAccount {
  slot: string;
  token: string;
  addedAt: string;
- lastOkAt?: number;
  /** WorkOS refresh token for device-login slots; absent on legacy key slots. */
  refreshToken?: string;
  /** Epoch-ms when `token` expires; absent means "no known expiry" (legacy slots). */
  expiresAt?: number;
- /** WorkOS account id, kept for display/diagnostics only. */
+ /** WorkOS account id, shown when choosing which login to remove. */
  accountId?: string;
- /** Login email, kept for display/diagnostics only. */
+ /** Login email, shown when choosing which login to remove. */
  email?: string;
 }
 
@@ -66,41 +66,31 @@ export interface ClineRefreshResult {
  */
 export type ClineRefresher = (refreshToken: string) => Promise<ClineRefreshResult | null>;
 
-/** Usable bearer for one slot, resolved via refresh when stale. */
-export interface ValidSlotCredentials {
- slot: string;
- token: string;
-}
-
-/** Cooldowns after failures so a bad key stops absorbing traffic. */
-const AUTH_COOLDOWN_MS = 10 * 60_000;
-const RATE_COOLDOWN_MS = 90_000;
-const SERVER_COOLDOWN_MS = 45_000;
-const DEFAULT_COOLDOWN_MS = 30_000;
-
-const slotCooldowns = new Map<string, number>();
-
-/** Test-only: clear in-memory slot cooldowns. */
-export function _resetClineCooldownsForTest(): void {
- slotCooldowns.clear();
-}
-
 /** Test-only: drop the loadPool mtime cache. */
 export function _resetClinePoolCacheForTest(): void {
  cached = null;
  cachedMtime = -1;
 }
 
-function markSlotCooldown(slot: string, ms: number): void {
- slotCooldowns.set(slot, Date.now() + ms);
-}
+/** Version this proxy reports as its Cline client build. */
+export const CLINE_CLIENT_VERSION = "3.5.54";
 
-/** True when the slot is not cooling down. */
-export function isClineSlotHealthy(slot: string): boolean {
- const until = slotCooldowns.get(slot);
- if (!until) return true;
- return Date.now() >= until;
-}
+/**
+ * Client headers the Cline API expects. Measured live (2026-09-21): the
+ * `cline-free/*` models answer 403 "only available via Cline product surfaces"
+ * with a bare bearer, and 200 with this set; every non-prefixed catalog model
+ * (e.g. z-ai/glm-5.3-flash) answers 200 either way. Header names and shape
+ * mirror reference/cline providers/request-headers.ts
+ * (DEFAULT_CLINE_REQUEST_HEADERS) — no credential is derived from them.
+ */
+export const CLINE_CLIENT_HEADERS: Record<string, string> = {
+ "HTTP-Referer": "https://cline.bot",
+ "X-Title": "Cline",
+ "X-IS-MULTIROOT": "false",
+ "X-CLIENT-TYPE": "cline-sdk",
+ "X-CLIENT-VERSION": CLINE_CLIENT_VERSION,
+ "User-Agent": `Cline/${CLINE_CLIENT_VERSION}`,
+};
 
 /** Machine-classified outcome of one Cline chat attempt. */
 export type ClineErrorKind = "ok" | "auth" | "rate-limit" | "exhausted" | "server" | "client";
@@ -161,7 +151,6 @@ function readPoolFile(): ClinePoolState {
     slot,
     token,
     addedAt: typeof rec.addedAt === "string" ? rec.addedAt : new Date().toISOString(),
-    ...(typeof rec.lastOkAt === "number" ? { lastOkAt: rec.lastOkAt } : {}),
     ...(refreshToken ? { refreshToken } : {}),
     ...(expiresAt !== undefined ? { expiresAt } : {}),
     ...(accountId ? { accountId } : {}),
@@ -226,6 +215,29 @@ export function redactedToken(token: string): string {
  return `…${tail}`;
 }
 
+/**
+ * Persist a patch to one slot against the file as it is on disk right now.
+ * A request holds its pool snapshot across network round trips, and the host
+ * process writes the same file for login/logout, so writing the snapshot back
+ * would revert a login added or removed while the request was in flight. A
+ * slot that no longer exists is left alone rather than resurrected.
+ */
+function patchAccountOnDisk(slot: string, patch: Partial<ClineAccount>): void {
+ const live = readPoolFile();
+ const target = live.accounts.find((a) => a.slot === slot);
+ if (!target) return;
+ Object.assign(target, patch);
+ savePool(live);
+}
+
+/** Record which slot served a turn, without clobbering concurrent edits. */
+function markActiveSlotOnDisk(slot: string): void {
+ const live = readPoolFile();
+ if (!live.accounts.some((a) => a.slot === slot)) return;
+ live.activeSlot = slot;
+ savePool(live);
+}
+
 /**
  * Save (or replace) one login slot. The token must carry the `workos:` prefix.
  * Throws on bad input — the message never echoes the token.
@@ -272,7 +284,6 @@ export function addAccount(
   });
  }
  if (!pool.activeSlot) pool.activeSlot = cleanSlot;
- slotCooldowns.delete(cleanSlot);
  savePool(pool);
  return pool;
 }
@@ -296,7 +307,6 @@ export function isClineTokenStale(account: ClineAccount, skewMs = CLINE_REFRESH_
  * caller should fall back to the stale bearer (`null`).
  */
 async function refreshAccountInPlace(
- pool: ClinePoolState,
  account: ClineAccount,
  refreshImpl: ClineRefresher,
 ): Promise<boolean | null> {
@@ -323,33 +333,18 @@ async function refreshAccountInPlace(
  }
  if (fresh.accountId?.trim()) account.accountId = fresh.accountId.trim();
  if (fresh.email?.trim()) account.email = fresh.email.trim();
- savePool(pool);
+ // Persist only the refreshed fields: the snapshot this request holds may
+ // predate a login added or removed in the host process.
+ patchAccountOnDisk(account.slot, {
+  token: account.token,
+  ...(account.refreshToken ? { refreshToken: account.refreshToken } : {}),
+  expiresAt: account.expiresAt,
+  ...(account.accountId ? { accountId: account.accountId } : {}),
+  ...(account.email ? { email: account.email } : {}),
+ });
  return true;
 }
 
-/**
- * Resolve a usable bearer for one slot. Fresh slots and legacy slots without
- * a known expiry return immediately; stale slots with a refresh grant try one
- * refresh and persist it. Resolves null when the slot is unknown or its grant
- * is dead (invalid_grant) — the caller should prompt for a fresh login.
- */
-export async function getValidSlotCredentials(
- slot: string,
- opts?: { refreshImpl?: ClineRefresher; skewMs?: number },
-): Promise<ValidSlotCredentials | null> {
- const cleanSlot = (slot || "").trim();
- if (!cleanSlot) return null;
- const pool = loadPool();
- const account = pool.accounts.find((a) => a.slot === cleanSlot);
- if (!account) return null;
- if (!isClineTokenStale(account, opts?.skewMs)) return { slot: account.slot, token: account.token };
- if (!account.refreshToken || !opts?.refreshImpl) return { slot: account.slot, token: account.token };
- const outcome = await refreshAccountInPlace(pool, account, opts.refreshImpl);
- if (outcome === true) return { slot: account.slot, token: account.token };
- if (outcome === false) return null;
- return { slot: account.slot, token: account.token };
-}
-
 /** Drop one login slot. Returns false when the slot was not saved. */
 export function removeAccount(slot: string): boolean {
  const cleanSlot = (slot || "").trim();
@@ -358,7 +353,6 @@ export function removeAccount(slot: string): boolean {
  if (idx < 0) return false;
  pool.accounts.splice(idx, 1);
  if (pool.activeSlot === cleanSlot) pool.activeSlot = pool.accounts[0]?.slot;
- slotCooldowns.delete(cleanSlot);
  savePool(pool);
  return true;
 }
@@ -368,13 +362,10 @@ export interface ClineRollOpts {
  body: string;
  /** Chat completions endpoint (proxy passes its configured URL explicitly). */
  chatUrl: string;
- /** Restrict the roll to these slots; default is the whole pool. */
- slots?: string[];
  fetchImpl?: FetchImpl;
- reqId?: string;
  /**
   * Device-login refresher. When present, a stale slot refreshes once before
-  * its attempt, and a 401/403 refreshes once before the slot cools out.
+  * its attempt, and a 401/403 refreshes once before the slot is skipped.
   * Absent: every slot serves its stored bearer exactly as before.
   */
  refreshImpl?: ClineRefresher;
@@ -384,52 +375,54 @@ export interface ClineRollResult {
  res: Response;
  /** Slot that served the response; null when no account was tried. */
  slot: string | null;
- /** True when every account cooled out (or the pool is empty). */
+ /** True when every account failed (or the pool is empty). */
  exhausted: boolean;
  kind: ClineErrorKind;
 }
 
-function exhaustedResponse(reason: string): Response {
+/**
+ * Synthetic body for the two states that never reached Cline: nothing is
+ * saved to sign in with, or no saved login could reach Cline. Neither is a
+ * rate limit, so it must not answer 429 — that status makes hosts back off
+ * and hide the actionable message behind a "rate limited" notice.
+ */
+function exhaustedResponse(reason: string, status: number): Response {
  return new Response(
   JSON.stringify({ error: { message: reason, code: "cline_pool_exhausted" } }),
-  { status: 429, headers: { "content-type": "application/json" } },
+  { status, headers: { "content-type": "application/json" } },
  );
 }
 
 /**
- * POST one chat body to the Cline endpoint, rolling across saved slots with
- * per-slot cooldowns. Each attempt sends its slot bearer explicitly; raw
- * tokens never leave this module. Response bodies are never consumed here —
- * the caller owns the returned Response.
+ * POST one chat body to the Cline endpoint, rolling across every saved slot.
+ * Each attempt sends its slot bearer explicitly; raw tokens never leave this
+ * module. Superseded failure bodies are cancelled here; the response handed
+ * back to the caller is left untouched so the caller can read it.
  */
 export async function rollChat(opts: ClineRollOpts): Promise<ClineRollResult> {
  const fetchImpl = opts.fetchImpl ?? fetch;
  const pool = loadPool();
- const wanted = opts.slots?.map((s) => s.trim()).filter(Boolean);
- let candidates = wanted?.length
-  ? pool.accounts.filter((a) => wanted.includes(a.slot))
-  : [...pool.accounts];
+ let candidates = [...pool.accounts];
  if (pool.activeSlot) {
   const at = candidates.findIndex((a) => a.slot === pool.activeSlot);
   if (at > 0) candidates = [candidates[at], ...candidates.slice(0, at), ...candidates.slice(at + 1)];
  }
- candidates = candidates.filter((a) => isClineSlotHealthy(a.slot));
  if (candidates.length === 0) {
-  const reason = pool.accounts.length === 0
-   ? "No Cline accounts saved — add one with /freeflow cline login"
-   : "All Cline accounts are cooling down — try again shortly";
-  logWarn("cline pool exhausted", { slots: pool.accounts.length });
-  return { res: exhaustedResponse(reason), slot: null, exhausted: true, kind: "exhausted" };
+  const reason = "No Cline logins saved — add one with /freeflow cline login";
+  logWarn("cline pool empty", { slots: pool.accounts.length });
+  return { res: exhaustedResponse(reason, 401), slot: null, exhausted: true, kind: "exhausted" };
  }
+ let lastRes: Response | null = null;
+ let lastSlot: string | null = null;
+ let lastKind: ClineErrorKind = "exhausted";
  for (const account of candidates) {
   // Stale device-login bearer: one refresh before the attempt. A dead grant
-  // cools the slot out immediately; a transient fault keeps the stale token.
+  // skips the slot for this turn; a transient fault keeps the stale token.
   let refreshedThisSlot = false;
   if (opts.refreshImpl && account.refreshToken && isClineTokenStale(account)) {
-   const outcome = await refreshAccountInPlace(pool, account, opts.refreshImpl);
+   const outcome = await refreshAccountInPlace(account, opts.refreshImpl);
    if (outcome === false) {
-    markSlotCooldown(account.slot, AUTH_COOLDOWN_MS);
-    logWarn("cline slot refresh rejected — cooling slot", { slot: account.slot });
+    logWarn("cline slot refresh rejected — skipping slot this turn", { slot: account.slot });
     continue;
    }
    refreshedThisSlot = outcome === true;
@@ -440,67 +433,73 @@ export async function rollChat(opts: ClineRollOpts): Promise<ClineRollResult> {
      method: "POST",
      headers: {
       "content-type": "application/json",
+      ...CLINE_CLIENT_HEADERS,
       authorization: `Bearer ${token}`,
      },
      body: opts.body,
     });
    } catch (e) {
-    markSlotCooldown(account.slot, DEFAULT_COOLDOWN_MS);
-    logWarn("cline slot fetch error — cooling slot", { slot: account.slot });
+    logWarn("cline slot fetch error — trying next slot", { slot: account.slot });
     void e;
     return null;
    }
   };
-  const succeed = (res: Response, kind: ClineErrorKind): ClineRollResult => {
-   if (kind === "ok") {
-    account.lastOkAt = Date.now();
-    pool.activeSlot = account.slot;
-    savePool(pool);
+  const succeed = async (res: Response, kind: ClineErrorKind): Promise<ClineRollResult> => {
+   if (kind === "ok") markActiveSlotOnDisk(account.slot);
+   if (lastRes && lastRes !== res) {
+    try { await lastRes.body?.cancel(); } catch { }
    }
+   lastRes = null;
    return { res, slot: account.slot, exhausted: false, kind };
   };
-  const cool = (kind: ClineErrorKind, status: number): void => {
-   markSlotCooldown(
-    account.slot,
-    kind === "auth" ? AUTH_COOLDOWN_MS : kind === "rate-limit" ? RATE_COOLDOWN_MS : SERVER_COOLDOWN_MS,
-   );
-   logWarn("cline slot failed — rolling to next slot", { slot: account.slot, status });
+  const stashFailure = async (res: Response, kind: ClineErrorKind): Promise<void> => {
+   if (lastRes && lastRes !== res) {
+    try { await lastRes.body?.cancel(); } catch { }
+   }
+   lastRes = res;
+   lastSlot = account.slot;
+   lastKind = kind;
   };
   let res = await attempt(account.token);
   if (!res) continue;
   let kind = mapClineError(res.status);
-  if (kind === "ok" || kind === "client") return succeed(res, kind);
+  if (kind === "ok" || kind === "client") return await succeed(res, kind);
   // Auth failure on a refreshable slot that has not refreshed yet: one
   // refresh, then exactly one retry with the fresh bearer.
   if (kind === "auth" && !refreshedThisSlot && opts.refreshImpl && account.refreshToken) {
-   try {
-    await res.body?.cancel();
-   } catch { }
-   const outcome = await refreshAccountInPlace(pool, account, opts.refreshImpl);
+   const outcome = await refreshAccountInPlace(account, opts.refreshImpl);
    if (outcome === true) {
+    try {
+     await res.body?.cancel();
+    } catch { }
     refreshedThisSlot = true;
     res = await attempt(account.token);
     if (!res) continue;
     kind = mapClineError(res.status);
-    if (kind === "ok" || kind === "client") return succeed(res, kind);
+    if (kind === "ok" || kind === "client") return await succeed(res, kind);
    } else if (outcome === false) {
     try {
      await res.body?.cancel();
     } catch { }
-    cool(kind, res.status);
+    logWarn("cline slot refresh rejected — trying next slot", { slot: account.slot });
     continue;
    }
-   // Transient refresh fault: fall through and cool the slot on the
-   // original auth result below.
+   // Transient refresh fault: the original response is still intact, so it is
+   // stashed below and can be surfaced to the caller.
   }
-  cool(kind, res.status);
-  try {
-   await res.body?.cancel();
-  } catch { }
+  logWarn("cline slot failed — trying next slot", { slot: account.slot, status: res.status });
+  await stashFailure(res, kind);
+ }
+ if (lastRes) {
+  logWarn("cline pool exhausted after roll — returning last upstream failure", { slots: candidates.length });
+  return { res: lastRes, slot: lastSlot, exhausted: true, kind: lastKind };
  }
- logWarn("cline pool exhausted after roll", { slots: candidates.length });
+ // Every slot was skipped before producing a response: its saved login was
+ // rejected, or the network call threw. Nothing is rate-limited here, so say
+ // what actually happened instead of implying the user should wait.
+ logWarn("cline pool exhausted with no upstream response", { slots: candidates.length });
  return {
-  res: exhaustedResponse("All Cline accounts failed or are cooling down — try again shortly"),
+  res: exhaustedResponse("Every saved Cline login failed to reach Cline — sign in again with /freeflow cline login", 502),
   slot: null,
   exhausted: true,
   kind: "exhausted",

package/src/cline-device-auth.ts

@@ -45,6 +45,16 @@ export const DEFAULT_WORKOS_BASE = "https://api.workos.com";
 export const DEFAULT_API_BASE = "https://api.cline.bot";
 export const WORKOS_TOKEN_PREFIX = "workos:";
 
+/**
+ * Cline's own sign-out route, for switching accounts in the browser. Verified
+ * live: it answers 302 -> https://app.cline.bot/dashboard. Cline ships no
+ * hosted sign-out page on its auth host (every /logout, /sign-out, /signout,
+ * /account path there is 404), so this app route is the one to point at.
+ * The device flow reuses whatever account the browser is signed in with, and
+ * a private window clears that without ending the current session.
+ */
+export const CLINE_BROWSER_SIGNOUT_URL = "https://api.cline.bot/api/v1/auth/logout";
+
 /** Env override for the WorkOS client id (wins over the bundled default). */
 export const CLINE_WORKOS_CLIENT_ID_ENV = "PI_FREEFLOW_CLINE_WORKOS_CLIENT_ID";
 
@@ -60,9 +70,6 @@ export function resolveClineWorkosClientId(): string {
  return BUNDLED_CLINE_WORKOS_CLIENT_ID;
 }
 
-/** Resolved client id used by start/poll. */
-export const CLINE_WORKOS_CLIENT_ID = resolveClineWorkosClientId();
-
 /**
  * Wire form of a Cline credential. Cline OAuth access tokens are WorkOS JWTs
  * (base64url eyJ header) and must ride as workos:<jwt>; dashboard API keys
@@ -212,7 +219,7 @@ export async function pollDeviceToken(
    }
    if (error instanceof ClineAuthError) throw error;
    if (Date.now() > deadline) throw new Error("WorkOS device authorization timed out");
-   await sleepMs(interval * 1000, outerSignal);
+   await sleepMs(remainingMs(deadline, interval), outerSignal);
    continue;
   }
   const payload = (await response.json().catch(() => ({}))) as Record<string, unknown>;
@@ -232,6 +239,9 @@ export async function pollDeviceToken(
    payload.error === "invalid_grant"
   ) {
    throwDenied(payload, response.status, `Device login refused (${String(payload.error)})`);
+  } else if (response.status >= 500 || response.status === 429) {
+   // Transient WorkOS blip: keep polling until the code's own deadline rather
+   // than failing a login that would have succeeded seconds later.
   } else {
    throw new ClineAuthError(
     typeof payload.error_description === "string"
@@ -241,10 +251,19 @@ export async function pollDeviceToken(
    );
   }
   if (Date.now() > deadline) throw new Error("WorkOS device authorization timed out");
-  await sleepMs(interval * 1000, outerSignal);
+  await sleepMs(remainingMs(deadline, interval), outerSignal);
  }
 }
 
+/**
+ * Wait before the next poll, never past the device code's own expiry: a
+ * `slow_down` reply grows the interval, and sleeping the full interval after
+ * the deadline check would keep a dead login alive for minutes.
+ */
+function remainingMs(deadline: number, intervalSeconds: number): number {
+ return Math.max(0, Math.min(intervalSeconds * 1000, deadline - Date.now()));
+}
+
 async function sleepMs(ms: number, signal?: AbortSignal): Promise<void> {
  if (signal?.aborted) throw new ClineAuthError("Device login cancelled", { errorCode: "cancelled" });
  if (!signal) {
@@ -271,7 +290,7 @@ interface ClineTokenData {
  refreshToken?: string;
  tokenType: string;
  expiresAt: string;
- userInfo: { email: string; clineUserId: string | null };
+ userInfo?: { email?: string; clineUserId?: string | null };
 }
 
 function toCredentials(data: ClineTokenData, fallbackRefresh?: string): OAuthCredentials {
@@ -287,8 +306,8 @@ function toCredentials(data: ClineTokenData, fallbackRefresh?: string): OAuthCre
   access: data.accessToken,
   refresh,
   expires: deriveExpiry(explicit, data.accessToken),
-  accountId: data.userInfo.clineUserId ?? undefined,
-  email: data.userInfo.email || undefined,
+  accountId: data.userInfo?.clineUserId ?? undefined,
+  email: data.userInfo?.email || undefined,
   metadata: { tokenType: data.tokenType },
  };
 }

package/src/commands.ts

@@ -58,9 +58,9 @@ import {
  formatRelayPickerItem,
  formatRelayStatusLabel,
 } from "./relay-state.ts";
-import { addAccount, isClineSlotHealthy, loadPool, redactedToken, removeAccount } from "./cline-accounts.ts";
+import { addAccount, loadPool, redactedToken, removeAccount } from "./cline-accounts.ts";
 import type { ClinePoolState } from "./cline-accounts.ts";
-import { pollDeviceToken, registerClineToken, startDeviceAuth, toApiKey } from "./cline-device-auth.ts";
+import { CLINE_BROWSER_SIGNOUT_URL, pollDeviceToken, registerClineToken, startDeviceAuth, toApiKey } from "./cline-device-auth.ts";
 import { isCertError } from "./system-ca-fetch.ts";
 import type {
  ExtensionAPI,
@@ -367,8 +367,9 @@ function nextClineSlot(pool: ClinePoolState): string {
 function formatClineAccountLines(pool: ClinePoolState): string[] {
  return pool.accounts.map((a, idx) => {
   const star = a.slot === pool.activeSlot ? "*" : " ";
-  const health = isClineSlotHealthy(a.slot) ? "ready" : "cooling";
-  return `${star} [${idx + 1}] [${a.slot}] key ending ${redactedToken(a.token)} — ${health}`;
+  const who = a.email || a.accountId;
+  const whoPart = who ? ` ${who}` : "";
+  return `${star} [${idx + 1}] [${a.slot}]${whoPart} key ending ${redactedToken(a.token)}`;
  });
 }
 /** User-safe one-line message for caught values (never echoes secrets). */
@@ -1462,7 +1463,7 @@ export function createCommandSpec(
      }
      const link = started.verificationUriComplete ?? started.verificationUri;
      const minutes = Math.max(1, Math.round(started.expiresIn / 60));
-     const loginLine = `Cline login [${slot}]\nOpen this link in your browser:\n${link}\nEnter code: ${started.userCode} (expires in ~${minutes} min)\nWaiting for approval — approve or cancel in the browser; this finishes on its own.`;
+     const loginLine = `Cline login [${slot}]\nOpen this link in your browser:\n${link}\nEnter code: ${started.userCode} (expires in ~${minutes} min)\nWaiting for approval — approve or cancel in the browser; this finishes on its own.\nDifferent account? Sign out first: ${CLINE_BROWSER_SIGNOUT_URL} (or use a private window)`;
      ctx.ui.notify(loginLine, "info");
      try { ctx.ui.setStatus("cline-login", `Cline login [${slot}] code ${started.userCode}`); } catch { }
      const progress = setInterval(() => {
@@ -1488,9 +1489,7 @@ export function createCommandSpec(
       if (e && typeof e === "object" && "errorCode" in e && typeof e.errorCode === "string") {
        code = e.errorCode;
       }
-      if (code === "authorization_pending") {
-       ctx.ui.notify(loginLine, "info");
-      } else if (code === "access_denied" || code === "cancelled") {
+      if (code === "access_denied") {
        ctx.ui.notify("Cline login cancelled.", "warning");
       } else if (code === "expired_token") {
        ctx.ui.notify("Cline login code expired — run /freeflow cline login again for a fresh code.", "warning");
@@ -1506,24 +1505,60 @@ export function createCommandSpec(
      if (!pool.accounts.length) {
       ctx.ui.notify("No Cline logins saved — add one with /freeflow cline login", "info");
      } else {
-      const lines = pool.accounts.map((a, idx) => {
-       const star = a.slot === pool.activeSlot ? "*" : " ";
-       const health = isClineSlotHealthy(a.slot) ? "ready" : "cooling";
-       return `${star} [${idx + 1}] [${a.slot}] key ending ${redactedToken(a.token)} — ${health}`;
-      });
-      ctx.ui.notify(`Cline logins (${pool.accounts.length}):\n${lines.join("\n")}`, "info");
+      ctx.ui.notify(`Cline logins (${pool.accounts.length}):\n${formatClineAccountLines(pool).join("\n")}`, "info");
      }
     } else if (action === "logout" || action === "remove") {
-     const slot = arg || ((await ctx.ui.input("Cline slot to remove:", ""))?.trim() || "");
-     if (!slot) {
-      ctx.ui.notify("Cancelled — no slot provided", "warning");
-     } else if (!removeAccount(slot)) {
-      ctx.ui.notify(`Cline slot '${slot}' not found`, "warning");
+     const pool = loadPool();
+     if (!pool.accounts.length) {
+      ctx.ui.notify("No Cline logins saved — nothing to remove", "info");
      } else {
-      ctx.ui.notify(`Removed Cline login [${slot}]`, "info");
+      const resolveSlot = (raw: string): string | null => {
+       const clean = (raw || "").trim();
+       if (!clean) return null;
+       const byIndex = Number.parseInt(clean, 10);
+       if (String(byIndex) === clean && byIndex >= 1 && byIndex <= pool.accounts.length) return pool.accounts[byIndex - 1].slot;
+       const exact = pool.accounts.find((a) => a.slot === clean);
+       if (exact) return exact.slot;
+       const folded = pool.accounts.find((a) => a.slot.toLowerCase() === clean.toLowerCase());
+       return folded ? folded.slot : null;
+      };
+      let slot = resolveSlot(arg);
+      if (arg && !slot) {
+       const saved = pool.accounts.map((a, idx) => `${idx + 1}=${a.slot}`).join(", ");
+       ctx.ui.notify(`Cline slot '${arg}' not found. Saved: ${saved}`, "warning");
+      } else {
+       if (!slot) {
+        if (pool.accounts.length === 1) {
+         slot = pool.accounts[0].slot;
+        } else {
+         const opts = formatClineAccountLines(pool);
+         const choice = await ctx.ui.select("Remove Cline login", [...opts, "Cancel"]);
+         if (!choice || choice === "Cancel") {
+          ctx.ui.notify("Cancelled — no slot removed", "warning");
+          return;
+         }
+         const hit = pool.accounts.find((a, idx) => opts[idx] === choice);
+         slot = hit ? hit.slot : null;
+        }
+       }
+       if (!slot) {
+        ctx.ui.notify("Cancelled — no slot removed", "warning");
+       } else if (!removeAccount(slot)) {
+        ctx.ui.notify(`Cline slot '${slot}' not found`, "warning");
+       } else {
+        ctx.ui.notify(`Removed Cline login [${slot}]`, "info");
+       }
+      }
      }
+    } else if (action === "signout" || action === "sign-out" || action === "switch") {
+     // Signing out is a browser action; it never touches saved logins here.
+     const saved = loadPool().accounts.length;
+     ctx.ui.notify(
+      `Sign out of Cline in your browser to use a different account:\n${CLINE_BROWSER_SIGNOUT_URL}\nA private window works too, and keeps your current session.\nThen run /freeflow cline login again — each login gets its own slot (${saved ? `you have ${saved}; next is ` : "next is "}${nextClineSlot(loadPool())}).`,
+      "info",
+     );
     } else {
-     ctx.ui.notify("Usage: /freeflow cline login [--key] [slot] | /freeflow cline accounts | /freeflow cline logout [slot]", "warning");
+     ctx.ui.notify("Usage: /freeflow cline login [--key] [slot] | /freeflow cline accounts | /freeflow cline logout [slot] | /freeflow cline signout", "warning");
     }
    } else if (sub === "export") {
     const tokens = rest.trim() ? rest.trim().split(/\s+/) : [];