pi-freeflow 1.23.0 → 1.23.3

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 1.23.3
+
+### Patch Changes
+
+- Fix a test that failed intermittently on CI: it compared the whole response body of a chat request, including the timestamp each side stamps when it builds the body. When a request happened to cross a second boundary the two timestamps differed by one and the test went red even though nothing was wrong. The timestamp is no longer compared digit-for-digit, and the test now checks it is a real timestamp instead. No change to how the proxy behaves.
+
+## 1.23.2
+
+### Patch Changes
+
+- Saved Cline logins are now recoverable. The pool keeps a backup copy beside it, so a pool that is missing or unreadable restores itself from the last good set of logins instead of silently coming back empty — losing every saved login to one bad write is no longer permanent. The backup also holds the largest set of logins ever seen, so it survives a run of smaller bad writes rather than being overwritten by the first one. Removing your last login still sticks: an intentionally empty pool is left alone rather than being repopulated from the backup.
+
+## 1.23.1
+
+### Patch Changes
+
+- Cline logins no longer accept the same account twice. Two logins for one account share a single free quota, so the second one added nothing while making it look like you had more capacity — signing in with an account you already saved now says which slot has it and leaves your logins untouched. If a set of logins already contains the same account twice, `/freeflow cline accounts` marks the later one `— same account as [slot]` so you can tell them apart and remove the spare.
+
 ## 1.23.0
 
 ### Minor Changes

package/README.md

@@ -239,6 +239,8 @@ Rotating per-account promo, direct only (never through the relay pool). Sign in
 
 Add as many logins as you want — each one gets its own slot (`default`, `slot-2`, `slot-3`, …) and a request that hits a limit on one rolls straight to the next. To sign in with a different email, sign out of Cline in that browser first (`/freeflow cline signout` prints the link), or use a private window so your current session stays put.
 
+Each account can only be saved once: an extra login for an account you already have shares the same free quota, so it is refused rather than saved. If a pool already holds two logins for one account (saved before this check), `/freeflow cline accounts` marks the later one `— same account as [default]`, and `/freeflow cline logout <slot>` drops it.
+
 | Model ID | Creator / Lab | Context | Max Output | Thinking | Vision |
 | :--- | :--- | :--- | :--- | :--- | :--- |
 | `cline-free/deepseek-v4.1-flash` | DeepSeek | **1M** (1.000.000) | **384K** (384.000) | `low/high/max` | ✅ |

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-freeflow",
   "type": "module",
-  "version": "1.23.0",
+  "version": "1.23.3",
   "description": "Thin provider for OMP/Pi — model list + dumb relay proxy + log; host pi-ai owns thinking/normalization",
   "main": "extensions/index.ts",
   "types": "src/index.ts",

package/src/cline-accounts.ts

@@ -27,6 +27,15 @@ export function resolveClinePoolPath(): string {
 
 export const CLINE_POOL_FILE = resolveClinePoolPath();
 
+/**
+ * Recovery copy of the pool, read only when the main file is missing or
+ * unreadable. Mirrors the relay-state `.bak` convention, with one deliberate
+ * difference: an empty pool is a legitimate state here (`/freeflow cline
+ * logout` of the last login must stick), so a valid empty main file is never
+ * overridden from the backup.
+ */
+export const CLINE_POOL_BACKUP_FILE = `${CLINE_POOL_FILE}.bak`;
+
 /** One saved login slot. The token is only ever sent as an explicit bearer header. */
 export interface ClineAccount {
  slot: string;
@@ -108,60 +117,89 @@ function emptyPool(): ClinePoolState {
  return { accounts: [] };
 }
 
-function readPoolFile(): ClinePoolState {
+/**
+ * Parse a pool document. Returns null when the blob is unusable (bad JSON,
+ * wrong shape) so callers can fall back to the backup copy. A valid document
+ * with zero accounts is NOT null: that is a real empty pool.
+ */
+function parsePoolDoc(raw: string): ClinePoolState | null {
+ let parsed: unknown;
  try {
-  if (!fs.existsSync(CLINE_POOL_FILE)) return emptyPool();
-  const raw = fs.readFileSync(CLINE_POOL_FILE, "utf8");
-  let parsed: unknown;
-  try {
-   parsed = JSON.parse(raw);
-  } catch {
-   logWarn("cline pool file corrupt — starting with an empty pool", { path: CLINE_POOL_FILE });
-   return emptyPool();
-  }
-  if (typeof parsed !== "object" || parsed === null) {
-   logWarn("cline pool file unusable — starting with an empty pool", { path: CLINE_POOL_FILE });
-   return emptyPool();
-  }
-  // Boundary-narrowed once: the on-disk blob is external input, so check
-  // its shape here and read only validated fields below.
-  const doc: Record<string, unknown> = parsed as Record<string, unknown>;
-  if (!Array.isArray(doc.accounts)) {
-   logWarn("cline pool file unusable — starting with an empty pool", { path: CLINE_POOL_FILE });
-   return emptyPool();
+  parsed = JSON.parse(raw);
+ } catch {
+  logWarn("cline pool file corrupt", { path: CLINE_POOL_FILE });
+  return null;
+ }
+ if (typeof parsed !== "object" || parsed === null) {
+  logWarn("cline pool file unusable", { path: CLINE_POOL_FILE });
+  return null;
+ }
+ // Boundary-narrowed once: the on-disk blob is external input, so check
+ // its shape here and read only validated fields below.
+ const doc: Record<string, unknown> = parsed as Record<string, unknown>;
+ if (!Array.isArray(doc.accounts)) {
+  logWarn("cline pool file unusable", { path: CLINE_POOL_FILE });
+  return null;
+ }
+ const accounts: ClineAccount[] = [];
+ for (const entry of doc.accounts as unknown[]) {
+  if (typeof entry !== "object" || entry === null) continue;
+  const rec: Record<string, unknown> = entry as Record<string, unknown>;
+  const slot = typeof rec.slot === "string" ? rec.slot.trim() : "";
+  const token = typeof rec.token === "string" ? rec.token : "";
+  if (!slot || (!token.startsWith("workos:") && !isWorkosJwt(token) && !token.startsWith("clp_"))) continue;
+  const refreshRaw: unknown = rec.refreshToken;
+  const refreshToken = typeof refreshRaw === "string" && refreshRaw.length > 0 ? refreshRaw : undefined;
+  const expiresRaw: unknown = rec.expiresAt;
+  const expiresAt = typeof expiresRaw === "number" && Number.isFinite(expiresRaw) && expiresRaw > 0
+   ? expiresRaw
+   : undefined;
+  const accountIdRaw: unknown = rec.accountId;
+  const accountId = typeof accountIdRaw === "string" && accountIdRaw.trim() ? accountIdRaw.trim() : undefined;
+  const emailRaw: unknown = rec.email;
+  const email = typeof emailRaw === "string" && emailRaw.trim() ? emailRaw.trim() : undefined;
+  accounts.push({
+   slot,
+   token,
+   addedAt: typeof rec.addedAt === "string" ? rec.addedAt : new Date().toISOString(),
+   ...(refreshToken ? { refreshToken } : {}),
+   ...(expiresAt !== undefined ? { expiresAt } : {}),
+   ...(accountId ? { accountId } : {}),
+   ...(email ? { email } : {}),
+  });
+ }
+ const activeRaw: unknown = doc.activeSlot;
+ const activeSlot = typeof activeRaw === "string" && accounts.some((a) => a.slot === activeRaw.trim())
+  ? activeRaw.trim()
+  : undefined;
+ return activeSlot ? { accounts, activeSlot } : { accounts };
+}
+
+/**
+ * Recover the pool from the backup copy and heal the main file so the recovery
+ * sticks. Returns null when no usable backup exists. Only ever called for a
+ * missing or unusable main file — never to override a valid empty pool.
+ */
+function recoverPoolFromBackup(description: string): ClinePoolState | null {
+ try {
+  const parsed = parsePoolDoc(fs.readFileSync(CLINE_POOL_BACKUP_FILE, "utf8"));
+  if (parsed && parsed.accounts.length > 0) {
+   logWarn(`cline pool ${description} — recovered from backup`, { slots: parsed.accounts.length, path: CLINE_POOL_BACKUP_FILE });
+   savePool(parsed);
+   return parsed;
   }
-  const accounts: ClineAccount[] = [];
-  for (const entry of doc.accounts as unknown[]) {
-   if (typeof entry !== "object" || entry === null) continue;
-   const rec: Record<string, unknown> = entry as Record<string, unknown>;
-   const slot = typeof rec.slot === "string" ? rec.slot.trim() : "";
-   const token = typeof rec.token === "string" ? rec.token : "";
-   if (!slot || (!token.startsWith("workos:") && !isWorkosJwt(token) && !token.startsWith("clp_"))) continue;
-   const refreshRaw: unknown = rec.refreshToken;
-   const refreshToken = typeof refreshRaw === "string" && refreshRaw.length > 0 ? refreshRaw : undefined;
-   const expiresRaw: unknown = rec.expiresAt;
-   const expiresAt = typeof expiresRaw === "number" && Number.isFinite(expiresRaw) && expiresRaw > 0
-    ? expiresRaw
-    : undefined;
-   const accountIdRaw: unknown = rec.accountId;
-   const accountId = typeof accountIdRaw === "string" && accountIdRaw.trim() ? accountIdRaw.trim() : undefined;
-   const emailRaw: unknown = rec.email;
-   const email = typeof emailRaw === "string" && emailRaw.trim() ? emailRaw.trim() : undefined;
-   accounts.push({
-    slot,
-    token,
-    addedAt: typeof rec.addedAt === "string" ? rec.addedAt : new Date().toISOString(),
-    ...(refreshToken ? { refreshToken } : {}),
-    ...(expiresAt !== undefined ? { expiresAt } : {}),
-    ...(accountId ? { accountId } : {}),
-    ...(email ? { email } : {}),
-   });
+ } catch { }
+ return null;
+}
+
+function readPoolFile(): ClinePoolState {
+ try {
+  if (!fs.existsSync(CLINE_POOL_FILE)) {
+   return recoverPoolFromBackup("main file missing") ?? emptyPool();
   }
-  const activeRaw: unknown = doc.activeSlot;
-  const activeSlot = typeof activeRaw === "string" && accounts.some((a) => a.slot === activeRaw.trim())
-   ? activeRaw.trim()
-   : undefined;
-  return activeSlot ? { accounts, activeSlot } : { accounts };
+  const parsed = parsePoolDoc(fs.readFileSync(CLINE_POOL_FILE, "utf8"));
+  if (parsed) return parsed;
+  return recoverPoolFromBackup("file unusable") ?? emptyPool();
  } catch {
   return emptyPool();
  }
@@ -190,17 +228,64 @@ export function loadPool(): ClinePoolState {
  return cached;
 }
 
+/**
+ * Keep the largest pool ever seen as the recovery copy.
+ *
+ * Largest-wins rather than last-write-wins, deliberately. The backup is read
+ * only when the main file is missing or unreadable, and two failure modes had
+ * to be covered at once:
+ *   - an existing richer pool being overwritten (compare the file being
+ *     replaced, before the write), and
+ *   - growth being lost because the backup always lagged one write (compare
+ *     the pool just written, after the write).
+ * Ties do not replace, so a run of equally-sized destructive writes cannot
+ * evict a good copy — which is how a real pool was lost: two good logins were
+ * replaced by fixtures, and the second fixture write replaced the backup too.
+ */
+function keepLargestBackup(raw: string): void {
+ try {
+  const count = accountCountIn(raw);
+  if (count <= 0) return;
+  let backupCount = -1;
+  try {
+   backupCount = accountCountIn(fs.readFileSync(CLINE_POOL_BACKUP_FILE, "utf8"));
+  } catch {
+   backupCount = -1;
+  }
+  if (count <= backupCount) return;
+  fs.writeFileSync(CLINE_POOL_BACKUP_FILE, raw, { encoding: "utf8", mode: 0o600 });
+  try { fs.chmodSync(CLINE_POOL_BACKUP_FILE, 0o600); } catch { }
+ } catch { }
+}
+
+/** How many accounts a raw pool blob holds; -1 when it is unreadable. */
+function accountCountIn(raw: string): number {
+ try {
+  const doc = JSON.parse(raw) as { accounts?: unknown };
+  return Array.isArray(doc.accounts) ? doc.accounts.length : -1;
+ } catch {
+  return -1;
+ }
+}
+
 /** Atomically persist the pool with owner-only permissions. Never logs secrets. */
 export function savePool(pool: ClinePoolState): void {
  try {
   const dir = path.dirname(CLINE_POOL_FILE);
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  // The pool being replaced is the only copy of itself: secure it first.
+  try {
+   if (fs.existsSync(CLINE_POOL_FILE)) keepLargestBackup(fs.readFileSync(CLINE_POOL_FILE, "utf8"));
+  } catch { }
   const tmp = `${CLINE_POOL_FILE}.${Date.now()}.tmp`;
-  fs.writeFileSync(tmp, JSON.stringify(pool, null, 2), { encoding: "utf8", mode: 0o600 });
+  const serialized = JSON.stringify(pool, null, 2);
+  fs.writeFileSync(tmp, serialized, { encoding: "utf8", mode: 0o600 });
   try {
    fs.chmodSync(tmp, 0o600);
   } catch { }
   fs.renameSync(tmp, CLINE_POOL_FILE);
+  // Compare the pool just written too, so growth is never the copy that lags.
+  keepLargestBackup(serialized);
   cached = pool;
   cachedMtime = diskMtime();
  } catch (e) {
@@ -238,11 +323,48 @@ function markActiveSlotOnDisk(slot: string): void {
  savePool(live);
 }
 
+/**
+ * Identity of a Cline login. Two slots holding the same account share one free
+ * quota, so rotating between them buys nothing — callers use this to detect
+ * that instead of saving a duplicate.
+ *
+ * accountId (WorkOS user id) is authoritative; email is the readable fallback.
+ * When neither side carries an identity — a legacy `clp_` key slot has none —
+ * only an identical bearer proves the same account.
+ */
+function sameClineAccount(account: ClineAccount, identity: { token?: string; accountId?: string; email?: string }): boolean {
+ const idA = account.accountId?.trim();
+ const idB = identity.accountId?.trim();
+ if (idA && idB) return idA === idB;
+ const mailA = account.email?.trim().toLowerCase();
+ const mailB = identity.email?.trim().toLowerCase();
+ if (mailA && mailB) return mailA === mailB;
+ const token = identity.token;
+ return typeof token === "string" && token.length > 0 && account.token === token;
+}
+
+/**
+ * The other slot already holding this account, or null when it is new.
+ * `exceptSlot` skips the slot being written, so re-logging into an existing
+ * slot is never treated as a duplicate.
+ */
+export function findClineAccountSlot(
+ pool: ClinePoolState,
+ identity: { token?: string; accountId?: string; email?: string },
+ exceptSlot?: string,
+): string | null {
+ const hit = pool.accounts.find(
+  (a) => a.slot !== exceptSlot && sameClineAccount(a, identity),
+ );
+ return hit ? hit.slot : null;
+}
+
 /**
  * Save (or replace) one login slot. The token must carry the `workos:` prefix.
  * Throws on bad input — the message never echoes the token.
  * Extras carry the device-login grant (refresh token, expiry, identity);
  * legacy key slots keep calling with two args and load untouched.
+ * Refuses an account that another slot already holds.
  */
 export function addAccount(
  slot: string,
@@ -255,6 +377,11 @@ export function addAccount(
  if (!token.startsWith("workos:") && !isWorkosJwt(token) && !token.startsWith("clp_")) throw new Error("Cline token must be a workos: login grant or a clp_ API key");
  const pool = loadPool();
  const existing = pool.accounts.find((a) => a.slot === cleanSlot);
+ const duplicate = findClineAccountSlot(pool, { token, accountId: extras?.accountId, email: extras?.email }, cleanSlot);
+ if (duplicate) {
+  const who = extras?.email?.trim() || existing?.email?.trim() || "this account";
+  throw new Error(`That Cline account (${who}) is already saved as [${duplicate}] — log in with a different account, or use /freeflow cline logout ${duplicate} first`);
+ }
  if (existing) {
   existing.token = token;
   if (extras?.refreshToken) existing.refreshToken = extras.refreshToken;

package/src/commands.ts

@@ -58,7 +58,7 @@ import {
  formatRelayPickerItem,
  formatRelayStatusLabel,
 } from "./relay-state.ts";
-import { addAccount, loadPool, redactedToken, removeAccount } from "./cline-accounts.ts";
+import { addAccount, findClineAccountSlot, loadPool, redactedToken, removeAccount } from "./cline-accounts.ts";
 import type { ClinePoolState } from "./cline-accounts.ts";
 import { CLINE_BROWSER_SIGNOUT_URL, pollDeviceToken, registerClineToken, startDeviceAuth, toApiKey } from "./cline-device-auth.ts";
 import { isCertError } from "./system-ca-fetch.ts";
@@ -369,7 +369,12 @@ function formatClineAccountLines(pool: ClinePoolState): string[] {
   const star = a.slot === pool.activeSlot ? "*" : " ";
   const who = a.email || a.accountId;
   const whoPart = who ? ` ${who}` : "";
-  return `${star} [${idx + 1}] [${a.slot}]${whoPart} key ending ${redactedToken(a.token)}`;
+  // Two slots on one account share one quota, so rotation between them buys
+  // nothing. Mark the later one against the earlier slot it duplicates.
+  const earlier = { accounts: pool.accounts.slice(0, idx) };
+  const dup = findClineAccountSlot(earlier, a);
+  const dupPart = dup ? ` — same account as [${dup}]` : "";
+  return `${star} [${idx + 1}] [${a.slot}]${whoPart} key ending ${redactedToken(a.token)}${dupPart}`;
  });
 }
 /** User-safe one-line message for caught values (never echoes secrets). */
@@ -1475,6 +1480,15 @@ export function createCommandSpec(
       const deviceTokens = await pollDeviceToken(undefined, started.deviceCode, started.interval, { maxWaitMs: Math.max(60_000, started.expiresIn * 1000) });
       const creds = await registerClineToken(undefined, deviceTokens.accessToken, deviceTokens.refreshToken);
       const apiKey = toApiKey(creds.access);
+      const dup = findClineAccountSlot(loadPool(), { token: apiKey, accountId: creds.accountId, email: creds.email }, slot);
+      if (dup) {
+       // Same account twice shares one free quota, so it would never add capacity.
+       ctx.ui.notify(
+        `That Cline account${creds.email ? ` (${creds.email})` : ""} is already saved as [${dup}] — nothing added.\nUse a different account: /freeflow cline signout shows the sign-out link. Or drop the existing one first: /freeflow cline logout ${dup}`,
+        "warning",
+       );
+       return;
+      }
       addAccount(slot, apiKey, {
        refreshToken: creds.refresh,
        expiresAt: creds.expires,