pi-freeflow 1.38.4 → 1.38.5

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.38.5
+
+### Patch Changes
+
+- Salvage relay rate-limit responses when direct fallback encounters network-level or abusive-IP 403 errors, preventing transient rate limits from locking up upstream models. Add the `/freeflow sticky` command to pin requests to one healthy relay until a rate limit or edge error occurs, preserving fresh pool relays. Recognize network-restricted and abusive-traffic 403 variants as free-tier gates so fresh sessions automatically fail over to healthy fallback models without interruption.
+
 ## 1.38.4
 
 ### Patch Changes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-freeflow",
   "type": "module",
-  "version": "1.38.4",
+  "version": "1.38.5",
   "description": "Thin provider for OMP/Pi — model list + dumb relay proxy + log; host pi-ai owns thinking/normalization",
   "main": "extensions/index.ts",
   "types": "src/index.ts",

package/src/commands.ts

@@ -540,10 +540,11 @@ export function createCommandSpec(
 ): Omit<RegisteredCommand, "name"> {
  return {
   description:
-   "Relay egress: auto | spread | on | off | hide | show | widget hide/show | status | kill|stop|shutdown | add <URL> [name] | list | use <URL|name|index> [name] | label <target> <name> | remove <target> | url [value] | test [target|opencode] [--chat] | export [path] [--include-secrets] | import <path> [--merge|--replace] [--dry-run] | logs [level] [n] | trace [reqId] | debug on|off|level <level> | refresh | models|reload | update [auto on|off] | autoupdate [on|off] | deploy cloudflare | deploy deno | deploy vercel | install-startup | uninstall-startup | cline login [--key] [slot] | cline accounts | cline logout [slot] | cline signout|switch",
+   "Relay egress: auto | sticky | spread | on | off | hide | show | widget hide/show | status | kill|stop|shutdown | add <URL> [name] | list | use <URL|name|index> [name] | label <target> <name> | remove <target> | url [value] | test [target|opencode] [--chat] | export [path] [--include-secrets] | import <path> [--merge|--replace] [--dry-run] | logs [level] [n] | trace [reqId] | debug on|off|level <level> | refresh | models|reload | update [auto on|off] | autoupdate [on|off] | deploy cloudflare | deploy deno | deploy vercel | install-startup | uninstall-startup | cline login [--key] [slot] | cline accounts | cline logout [slot] | cline signout|switch",
   getArgumentCompletions: (prefix: string) =>
    [
     "auto",
+    "sticky",
     "spread",
     "on",
     "off",
@@ -1134,7 +1135,7 @@ export function createCommandSpec(
     }
    };
 
-   if (sub === "auto") {
+   if (sub === "auto" || sub === "sticky") {
     applyRelayState((s) => {
      s.mode = "auto";
      s.enabled = true;
@@ -1211,10 +1212,10 @@ export function createCommandSpec(
      relayState.mode === "off"
       ? "Mode: off (always direct)"
       : relayState.mode === "on"
-       ? "Mode: on (always relay)"
+       ? "Mode: on (always relay, sticky primary)"
        : relayState.mode === "spread"
         ? "Mode: spread (rotates across healthy relays, auto-rolls on 429/5xx)"
-        : "Mode: auto (enabled on session, auto-rolls on 429/5xx)";
+        : "Mode: auto (sticky primary, auto-rolls on 429/5xx)";
     const poolLine = `${relayState.relays.length} relay(s)${relayState.relays.length > 0
      ? ` | active: ${shortRelayLabel(relayState.url, relayState.relays)}`
      : ""
@@ -1957,8 +1958,8 @@ export function createCommandSpec(
      "Deploy Cloudflare relay…",
      "Deploy Deno relay…",
      "Deploy Vercel relay (last resort)…",
-     "Mode: AUTO (auto-detect on model select)",
-     "Mode: ON (always relay)",
+     "Mode: AUTO (sticky primary, auto-detect on model select)",
+     "Mode: ON (always relay, sticky primary)",
      "Mode: OFF (always direct)",
      "Mode: SPREAD (rotate across healthy relays)",
     ]);
@@ -1986,7 +1987,7 @@ export function createCommandSpec(
      await doDeploy("cloudflare");
     } else if (choice === "Deploy Deno relay…") {
      await doDeploy("deno");
-    } else if (choice === "Mode: AUTO (auto-detect on model select)") {
+    } else if (choice === "Mode: AUTO (sticky primary, auto-detect on model select)") {
      applyRelayState((s) => {
       s.mode = "auto";
       s.enabled = true;
@@ -1998,7 +1999,7 @@ export function createCommandSpec(
      });
      persist();
      flash();
-    } else if (choice === "Mode: ON (always relay)") {
+    } else if (choice === "Mode: ON (always relay, sticky primary)") {
      applyRelayState((s) => {
       s.mode = "on";
       s.enabled = true;

package/src/relay.ts

@@ -621,6 +621,25 @@ export async function relayFetch(
 		directHeaders.set("x-request-id", rid);
 
 		const directRes = await fetch(url, { ...opts, headers: directHeaders } as unknown as RequestInit);
+		if (
+			directRes.status === 403 &&
+			lastResponse &&
+			(lastResponse.status === 429 || lastResponse.status === 502 || lastResponse.status === 503)
+		) {
+			log(
+				"warn",
+				`direct fallback returned HTTP 403 FreeTierError (direct IP untrusted) — salvaging last relay HTTP ${lastResponse.status}`,
+				{
+					upstream: url,
+					directStatus: 403,
+					relayStatus: lastResponse.status,
+				},
+				rid,
+			);
+			directRes.body?.cancel().catch(() => {});
+			affinity.onServed?.(lastResponseRelay);
+			return lastResponse;
+		}
 		// lastResponse holds an unread body that would otherwise leak its socket
 		// until GC; the salvage path below still needs it, so only cancel here.
 		lastResponse?.body?.cancel().catch(() => {});

package/src/upstream-health.ts

@@ -31,10 +31,11 @@ export const FALLBACK_KILO_MODEL = "nvidia/nemotron-3.5-lightning:free";
 
 export type ZenRoute = "passthrough" | "failover" | "canary";
 
-/** Free-tier gate marker: the free tier only works from inside OpenCode. */
+/** Free-tier gate marker: the free tier only works from inside OpenCode or is blocked by network/VPN abuse detection. */
 const GATE_CODE_MARKER = "FreeTierError";
 const GATE_MESSAGE_MARKER = "only be used from within OpenCode";
-
+const GATE_ABUSIVE_MARKER = "abusive traffic";
+const GATE_NETWORK_MARKER = "aren't available from your current network";
 /** User-visible hint attached to fast-failed 403 gate bodies. */
 const FREE_TIER_HINT =
  "OpenCode's free tier is only available inside OpenCode right now, " +
@@ -266,12 +267,14 @@ export function notifyGateTransition(upstream: UpstreamName, gated?: boolean): v
 
 /** True when a status/body pair is the free-tier gate (fresh sessions refused). */
 export function isFreeTierGate(status: number, bodyText: unknown): boolean {
- if (status !== 403 || typeof bodyText !== "string") return false;
- return (
-  bodyText.includes(GATE_CODE_MARKER) && bodyText.includes(GATE_MESSAGE_MARKER)
- );
+	if (status !== 403 || typeof bodyText !== "string") return false;
+	if (!bodyText.includes(GATE_CODE_MARKER)) return false;
+	return (
+		bodyText.includes(GATE_MESSAGE_MARKER) ||
+		bodyText.includes(GATE_ABUSIVE_MARKER) ||
+		bodyText.includes(GATE_NETWORK_MARKER)
+	);
 }
-
 /** Stable conversation key carried by request bodies, if the caller sent one. */
 export function sessionKeyOf(parsedBody: unknown): string | null {
  if (typeof parsedBody !== "object" || parsedBody === null) return null;