pi-freeflow 1.40.1 → 1.42.0

package/src/cline-accounts.ts

@@ -16,7 +16,8 @@ import { writeFileAtomic } from "./atomic-write.ts";
 import { RELAY_STATE_FILE } from "./config.ts";
 import { logWarn } from "./logger.ts";
 import type { FetchImpl } from "./cline-device-auth.ts";
-import { isWorkosJwt } from "./cline-device-auth.ts";
+import { isWorkosJwt, refreshClineToken, toApiKey } from "./cline-device-auth.ts";
+import { fetchWithSystemCA } from "./system-ca-fetch.ts";
 
 /** Env override for the pool file location (tests/CI sandbox). */
 const CLINE_POOL_FILE_ENV = "PI_FREEFLOW_CLINE_POOL_FILE";
@@ -115,37 +116,183 @@ export function _resetClinePoolCacheForTest(): void {
  cachedMtime = -1;
 }
 
-/** Version this proxy reports as its Cline client build. */
-const CLINE_CLIENT_VERSION = "3.5.54";
+/** Bundled fallback version if dynamic fetch and disk cache are absent. */
+export const BUNDLED_CLINE_VERSION = "4.1.25";
+export const CLINE_CLIENT_VERSION = BUNDLED_CLINE_VERSION;
+
+const CLINE_VERSION_TTL_MS = 24 * 60 * 60 * 1000;
+let liveClineVersion: string | null = null;
+
+function clineVersionCachePath(): string {
+ return path.join(path.dirname(CLINE_POOL_FILE), "pi-freeflow-cline-version.json");
+}
+
+export function _resetLiveClineVersionForTest(): void {
+ liveClineVersion = null;
+}
 
 /**
- * Client headers the Cline API expects. Measured live (2026-09-21): the
- * `cline-free/*` models answer 403 "only available via Cline product surfaces"
- * with a bare bearer, and 200 with this set; every non-prefixed catalog model
- * (e.g. z-ai/glm-5.3-flash) answers 200 either way. Header names and shape
- * mirror reference/cline providers/request-headers.ts
- * (DEFAULT_CLINE_REQUEST_HEADERS) — no credential is derived from them.
- *
- * `X-CLIENT-TYPE` is the Cline desktop app's identity, and it gates the
- * `cline-free/*` id space (measured live 2026-09-22: that prefix answers 403
- * "only available via Cline product surfaces" with a bare bearer, and 200 with
- * this set; every non-prefixed id answers 200 either way). The header is kept
- * because one catalog id still depends on it — after the 2026-10-13 prune,
- * `cline-free/muse-spark-1.3-contributor` is the last prefixed model in the
- * catalog. It also decided the free-model feed at the time: five entries for
- * `cline-sdk` / `cline-cli` / the `VSCode Extension` label against six for
- * `cline-desktop`, the extra one being `cline-free/kimi-k3`. That sixth model
- * is retired upstream and no longer requested. Version and User-Agent stay
- * as-is: the feed served the desktop list with them unchanged.
+ * Resolve effective Cline client version. Precedence:
+ * env override (PI_FREEFLOW_CLINE_VERSION) > in-memory version > fresh disk cache > BUNDLED_CLINE_VERSION.
  */
-const CLINE_CLIENT_HEADERS: Record<string, string> = {
- "HTTP-Referer": "https://cline.bot",
- "X-Title": "Cline",
- "X-IS-MULTIROOT": "false",
- "X-CLIENT-TYPE": "cline-desktop",
- "X-CLIENT-VERSION": CLINE_CLIENT_VERSION,
- "User-Agent": `Cline/${CLINE_CLIENT_VERSION}`,
-};
+export function getClineVersion(): string {
+ const override = process.env.PI_FREEFLOW_CLINE_VERSION?.trim();
+ if (override) return override;
+ if (liveClineVersion) return liveClineVersion;
+ try {
+  const cachePath = clineVersionCachePath();
+  if (fs.existsSync(cachePath)) {
+   const data = JSON.parse(fs.readFileSync(cachePath, "utf8")) as { version?: string; checkedAt?: number };
+   if (typeof data.version === "string" && data.version.trim() && typeof data.checkedAt === "number" && Date.now() - data.checkedAt < CLINE_VERSION_TTL_MS) {
+    liveClineVersion = data.version.trim();
+    return liveClineVersion;
+   }
+  }
+ } catch { }
+ return BUNDLED_CLINE_VERSION;
+}
+
+/**
+ * Client headers the Cline API expects, evaluated dynamically with the current version.
+ */
+export function getClineClientHeaders(): Record<string, string> {
+ const ver = getClineVersion();
+ return {
+  "HTTP-Referer": "https://cline.bot",
+  "X-Title": "Cline",
+  "X-IS-MULTIROOT": "false",
+  "X-CLIENT-TYPE": "cline-desktop",
+  "X-CLIENT-VERSION": ver,
+  "User-Agent": `Cline/${ver}`,
+ };
+}
+
+/**
+ * Proxy object for CLINE_CLIENT_HEADERS providing full backward compatibility.
+ */
+export const CLINE_CLIENT_HEADERS: Record<string, string> = new Proxy({} as Record<string, string>, {
+ get(_target, prop) {
+  return getClineClientHeaders()[prop as string];
+ },
+ has(_target, prop) {
+  return prop in getClineClientHeaders();
+ },
+ ownKeys(_target) {
+  return Object.keys(getClineClientHeaders());
+ },
+ getOwnPropertyDescriptor(_target, prop) {
+  const val = getClineClientHeaders()[prop as string];
+  return val !== undefined ? { value: val, writable: false, enumerable: true, configurable: true } : undefined;
+ },
+});
+
+/**
+ * Refresh the live Cline version from open-vsx or GitHub releases and persist to disk.
+ */
+export async function refreshClineVersion(fetchImpl: FetchImpl = fetchWithSystemCA): Promise<string> {
+ try {
+  const res = await fetchImpl("https://open-vsx.org/api/saoudrizwan/claude-dev", {
+   headers: { "User-Agent": "pi-freeflow" },
+   signal: AbortSignal.timeout(5000),
+  });
+  if (res.ok) {
+   const data = (await res.json()) as { version?: string };
+   if (typeof data.version === "string" && /^\d+\.\d+\.\d+/.test(data.version)) {
+    liveClineVersion = data.version.trim();
+    try {
+     const cachePath = clineVersionCachePath();
+     writeFileAtomic(cachePath, JSON.stringify({ version: liveClineVersion, checkedAt: Date.now() }));
+    } catch { }
+    return liveClineVersion;
+   }
+  }
+ } catch { }
+ return getClineVersion();
+}
+async function defaultClineRefresher(refreshToken: string): Promise<ClineRefreshResult | null> {
+ try {
+  const creds = await refreshClineToken(undefined, refreshToken);
+  return { token: toApiKey(creds.access), refreshToken: creds.refresh, expiresAt: creds.expires };
+ } catch {
+  return null;
+ }
+}
+/**
+ * Background auto-probing & keep-alive for Cline account tokens.
+ * Proactively refreshes tokens nearing expiry (<30 min remaining or expired)
+ * so that saved accounts never lapse into unrecoverable dead grants.
+ * Also performs a lightweight ping to verify the account is active.
+ */
+export async function keepClineTokensAlive(
+ opts: {
+  fetchImpl?: FetchImpl;
+  refreshImpl?: ClineRefresher;
+ } = {},
+): Promise<{ refreshed: number; probed: number }> {
+ const pool = loadPool();
+ if (pool.accounts.length === 0) return { refreshed: 0, probed: 0 };
+ const fetchImpl = opts.fetchImpl ?? fetchWithSystemCA;
+ const refreshImpl = opts.refreshImpl ?? defaultClineRefresher;
+ const now = Date.now();
+ const REFRESH_THRESHOLD_MS = 30 * 60 * 1000;
+ let refreshed = 0;
+ let probed = 0;
+
+ for (const account of pool.accounts) {
+  if (!account.refreshToken) continue;
+  const isExpiringSoon = typeof account.expiresAt === "number" && (account.expiresAt - now < REFRESH_THRESHOLD_MS);
+  const isExpired = typeof account.expiresAt === "number" && account.expiresAt <= now;
+  const needsRefresh = isExpiringSoon || isExpired || isClineTokenStale(account);
+
+  if (needsRefresh) {
+   try {
+    const outcome = await refreshAccountInPlace(account, refreshImpl);
+    if (outcome === true) {
+     refreshed += 1;
+    }
+   } catch {
+    continue;
+   }
+  }
+
+  // Light probe: ping models endpoint with light timeout to keep the session warm
+  try {
+   const token = account.token;
+   const probeRes = await fetchImpl("https://api.cline.bot/api/v1/models", {
+    method: "GET",
+    headers: {
+     ...getClineClientHeaders(),
+     authorization: `Bearer ${token}`,
+    },
+    signal: AbortSignal.timeout(6000),
+   });
+   if (probeRes.ok) {
+    probed += 1;
+   }
+  } catch { }
+ }
+
+ return { refreshed, probed };
+}
+
+export const CLINE_MODEL_PREFIX = "cline/";
+
+/**
+ * Maps a catalog Cline model ID to the exact wire model ID expected by Cline API.
+ */
+export function clineUpstreamModelId(id: string): string {
+ const trimmed = id.trim();
+ if (trimmed === "cline/nemotron-3.5-super-vl") {
+  return "nvidia/nemotron-3.5-super-vl:free";
+ }
+ if (trimmed.startsWith(CLINE_MODEL_PREFIX)) {
+  return trimmed.slice(CLINE_MODEL_PREFIX.length);
+ }
+ if (trimmed.startsWith("cline-free/")) {
+  return trimmed.slice("cline-free/".length);
+ }
+ return trimmed;
+}
 
 /**
  * Free-limit report carried by a Cline 429 body, e.g.
@@ -165,7 +312,19 @@ interface ClineFreeLimit {
  resetAt?: number;
 }
 
-const CLINE_FREE_LIMIT_MARKER = /free limit reached on model/i;
+const CLINE_FREE_LIMIT_MARKER = /(?:free limit reached on model|Daily limit reached for)/i;
+
+/**
+ * Extract epoch reset from X-RateLimit-Reset if present in headers or metadata.
+ * Converts epoch seconds (<1e11) to ms.
+ */
+function parseXRateLimitReset(text: string): number | null {
+ const m = text.match(/X-RateLimit-Reset[\\"\s:]+([0-9.]+)/i);
+ if (!m) return null;
+ const val = Number(m[1]);
+ if (!Number.isFinite(val) || val <= 0) return null;
+ return val < 1e11 ? Math.round(val * 1000) : Math.round(val);
+}
 
 /**
  * Delay stated as `try again in <N>h <N>m`, `<N>m`, or a bare `<N>` (hours).
@@ -190,13 +349,15 @@ function parseResetDelayMs(text: string): number | null {
  */
 export function parseClineFreeLimit(raw: string, now = Date.now()): ClineFreeLimit | null {
  if (typeof raw !== "string" || !CLINE_FREE_LIMIT_MARKER.test(raw)) return null;
- const named = raw.match(/free limit reached on model\s+(\S+)/i);
+ const named = raw.match(/(?:free limit reached on model|Daily limit reached for)\s+([^\\"\s,;]+)/i);
  // The model name ends the sentence, so a trailing "." belongs to the prose.
  const modelId = named ? named[1].replace(/[.,;:]+$/, "") : "";
- const delay = parseResetDelayMs(raw);
+ const epochReset = parseXRateLimitReset(raw);
+ const delay = epochReset !== null ? null : parseResetDelayMs(raw);
+ const resetAt = epochReset !== null ? epochReset : delay !== null ? now + delay : undefined;
  return {
   ...(modelId ? { modelId } : {}),
-  ...(delay !== null ? { resetAt: now + delay } : {}),
+  ...(resetAt !== undefined ? { resetAt } : {}),
  };
 }
 
@@ -893,6 +1054,82 @@ function exhaustedResponse(reason: string, status: number): Response {
  );
 }
 
+/**
+ * For OpenRouter-backed Cline models, Cline sometimes answers HTTP 200
+ * `text/event-stream` where the first event is an in-stream 429 error
+ * (e.g. `stream_initialization_failed` with status 429 / daily limit reached).
+ * Peek the first chunk: if it is an in-stream 429 error, convert it to a 429
+ * Response so rollChat rolls to the next slot; otherwise, reconstruct the
+ * stream with the peeked chunk re-enqueued.
+ */
+async function peekStreamForInStreamError(res: Response): Promise<{ res: Response; inStreamError: boolean; errorText: string }> {
+ const contentType = res.headers.get("content-type") || "";
+ if (!contentType.includes("text/event-stream") || !res.body) {
+  return { res, inStreamError: false, errorText: "" };
+ }
+ try {
+  const reader = res.body.getReader();
+  const { done, value } = await reader.read();
+  if (done || !value || value.byteLength === 0) {
+   return {
+    res: new Response(null, { status: res.status, statusText: res.statusText, headers: res.headers }),
+    inStreamError: false,
+    errorText: "",
+   };
+  }
+  const text = new TextDecoder().decode(value);
+  const isInStream429 = (
+   text.includes('"stream_initialization_failed"') ||
+   text.includes('"error":') ||
+   text.includes('"Rate limit exceeded"') ||
+   text.includes("Daily limit reached")
+  ) && (
+   text.includes("429") ||
+   /status["\s:]+429/i.test(text) ||
+   /Rate limit exceeded/i.test(text) ||
+   /Daily limit reached/i.test(text)
+  );
+
+  if (isInStream429) {
+   try { await reader.cancel(); } catch { }
+   const errRes = new Response(text, {
+    status: 429,
+    headers: { "content-type": "application/json" },
+   });
+   return { res: errRes, inStreamError: true, errorText: text };
+  }
+
+  const reconstructed = new ReadableStream<Uint8Array>({
+   start(controller) {
+    controller.enqueue(value);
+   },
+   async pull(controller) {
+    try {
+     const { done: nextDone, value: nextValue } = await reader.read();
+     if (nextDone) {
+      controller.close();
+     } else if (nextValue) {
+      controller.enqueue(nextValue);
+     }
+    } catch (err) {
+     controller.error(err);
+    }
+   },
+   cancel(reason) {
+    return reader.cancel(reason);
+   },
+  });
+
+  return {
+   res: new Response(reconstructed, { status: res.status, statusText: res.statusText, headers: res.headers }),
+   inStreamError: false,
+   errorText: "",
+  };
+ } catch {
+  return { res, inStreamError: false, errorText: "" };
+ }
+}
+
 /**
  * POST one chat body to the Cline endpoint, rolling across every saved slot.
  * Each attempt sends its slot bearer explicitly; raw tokens never leave this
@@ -1027,6 +1264,14 @@ export async function rollChat(opts: ClineRollOpts): Promise<ClineRollResult> {
   };
   let res = await attempt(account.token);
   if (!res) continue;
+  let inStreamLimitText: string | null = null;
+  if (res.status === 200 && res.headers.get("content-type")?.includes("text/event-stream")) {
+   const peek = await peekStreamForInStreamError(res);
+   res = peek.res;
+   if (peek.inStreamError) {
+    inStreamLimitText = peek.errorText;
+   }
+  }
   let kind = mapClineError(res.status);
   if (kind === "ok" || kind === "client") return await succeed(res, kind);
   // Auth failure on a refreshable slot that has not refreshed yet: one
@@ -1056,7 +1301,7 @@ export async function rollChat(opts: ClineRollOpts): Promise<ClineRollResult> {
   // for the requested model until the stated reset: remember it, so the next
   // turn tries the other logins first.
   if (res.status === 429) {
-   const limit = await freeLimitFrom(res, now);
+   const limit = inStreamLimitText ? parseClineFreeLimit(inStreamLimitText, now) : await freeLimitFrom(res, now);
    if (limit) {
     cappedSlots.add(account.slot);
     if (limit.modelId) limitModelId = limit.modelId;

package/src/config.ts

@@ -75,7 +75,7 @@ export const PORT = resolvePort();
 // OPENCODE_VERSION_FLOOR pins the minimum; OPENCODE_VERSION_FALLBACK is the
 // last-known-good npm version used when the live lookup is stale/offline.
 export const OPENCODE_VERSION_FLOOR = "1.17.0";
-export const OPENCODE_VERSION_FALLBACK = "1.19.0";
+export const OPENCODE_VERSION_FALLBACK = "1.19.4";
 /** Live npm lookup TTL: 6h — within one window the cached UA is reused. */
 export const OPENCODE_VERSION_TTL_MS = 6 * 60 * 60 * 1_000;
 /** Env override: exact `opencode/<version>` UA (or bare version) for tests/pins. */
@@ -239,6 +239,10 @@ export function createOpenCodeId(descending: boolean, timestamp = Date.now()): s
  return time + Array.from(bytes, (byte) => ID_CHARS[byte % 62]).join("");
 }
 
+// Upstream v1.19.4 refactored `SessionID.create` to compose the prefix itself
+// (`schema.make("ses_" + descending())` in packages/schema/src/session-id.ts).
+// The identifier generator is unchanged, so this call is still byte-for-byte
+// equivalent: `ses_` + 12 hex timestamp chars + 14 base62 random chars.
 export function createOpenCodeSessionId(): string {
  return `ses_${createOpenCodeId(true)}`;
 }
@@ -450,6 +454,19 @@ export function resolveUpstreamHealthPath(): string {
  }
 }
 
+/** JSONL audit of tool-call turns that failed or needed repair (src/toolcall-audit.ts). */
+export function resolveToolcallAuditPath(): string {
+ try {
+  return dataFilePath("toolcall-audit.jsonl");
+ } catch {
+  return path.join(
+   path.dirname(fileURLToPath(import.meta.url)),
+   "..",
+   ".toolcall-audit.jsonl",
+  );
+ }
+}
+
 export function resolveSessionPinPath(): string {
  try {
   return dataFilePath("pi-freeflow-session-pins.json");

package/src/daemon.ts

@@ -31,7 +31,7 @@ import {
  stopLeaseGC,
  touchActivity,
 } from "./lease.ts";
-import { getActiveRequests, startProxy } from "./proxy.ts";
+import { getActiveRequests, startClineKeepAlive, startProxy } from "./proxy.ts";
 import { loadRelayState, setActiveRelayState } from "./relay-state.ts";
 
 /** True when this module was run as the entry script (not imported by tests). */
@@ -122,6 +122,7 @@ async function runDaemon(): Promise<void> {
  touchActivity();
  syncRelayStateFromDisk();
  void seedCatalog();
+ startClineKeepAlive();
 
  // Retire only when zero leases persist past the grace window with nothing
  // in flight — never for request-idleness.

package/src/deploy.ts

@@ -23,8 +23,8 @@ import { randomBytes } from "node:crypto";
  *   auth gate (legacy/manual deploys); built-in deploys always embed one.
  */
 function buildRelayWorkerCore(relayAuth: string): string {
- return String.raw`// Only the 2 upstreams pi-freeflow talks to. Anything else = open proxy abuse.
-const ALLOWED_TARGETS = ["https://opencode.ai", "https://api.kilo.ai"];
+ return String.raw`// Upstreams pi-freeflow talks to. Anything else = open proxy abuse.
+const ALLOWED_TARGETS = ["https://opencode.ai", "https://api.kilo.ai", "https://oai.endpoints.kepler.ai.cloud.ovh.net"];
 const RELAY_AUTH = ${JSON.stringify(relayAuth)};
 const resolveRelayTarget = function(target, relayPath) {
   let targetUrl;

package/src/index.ts

@@ -145,22 +145,44 @@ export function buildProviderConfig(
     contextWindow: m.contextWindow,
     maxTokens: m.maxTokens,
     cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-    compat: m.thinkingFormat
+    compat: {
+     ...(m.thinkingFormat
      ? {
       supportsDeveloperRole: false,
       thinkingFormat: m.thinkingFormat,
      }
      : m.api === "openai-responses"
       ? { sessionAffinityFormat: "openai-nosession" }
-      : m.source === "kilo" || m.source === "cline" || m.source === "ovh"
+      : m.source === "kilo" || m.source === "cline"
        ? {
         supportsDeveloperRole: false,
         supportsReasoningEffort: !!m.thinkingLevelMap,
        }
-       : {
-        supportsDeveloperRole: false,
-        supportsReasoningEffort: true,
-       },
+       // OVH is a plain OpenAI chat endpoint. Without an explicit format the
+       // host sees the loopback proxy URL, classifies the lane as a local
+       // backend and treats `Qwen3.x` ids as template-dialect Qwen, emitting
+       // `chat_template_kwargs` that OVH rejects with
+       // `400 feature 'extra arguments: ...' is not currently supported`.
+       // Pin the format so the host sends `reasoning_effort` instead.
+       : m.source === "ovh"
+        ? {
+         supportsDeveloperRole: false,
+         supportsReasoningEffort: !!m.thinkingLevelMap,
+         thinkingFormat: "openai",
+         // The host derives these two from the loopback base URL before the
+         // spec override lands: `thinkingFormat` is overridden above, but
+         // `qwenPreserveThinking` was already latched on and still emits
+         // `chat_template_kwargs.preserve_thinking`. Clear it explicitly.
+         qwenPreserveThinking: false,
+        }
+        : {
+         supportsDeveloperRole: false,
+         supportsReasoningEffort: true,
+        }),
+     ...(m.requiresReasoningContentOnAssistantMessages !== undefined
+      ? { requiresReasoningContentOnAssistantMessages: m.requiresReasoningContentOnAssistantMessages }
+      : {}),
+    },
    };
   }),
  };