pi-freeflow 1.42.0 → 1.43.0

package/src/config.ts

@@ -2,6 +2,7 @@
  * Configuration and path resolution for pi-freeflow
  */
 
+import { spawnSync } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import path from "node:path";
@@ -25,6 +26,55 @@ export const UPSTREAM_OPENCODE = "https://opencode.ai/inference";
 export const KILO_CHAT_URL = "https://api.kilo.ai/api/gateway/chat/completions";
 export const KILO_RESPONSES_URL = "https://api.kilo.ai/api/gateway/responses";
 export const OPENCODE_API_URL = `${UPSTREAM_OPENCODE}/v1`;
+/**
+ * OpenAI-compat Zen lane — the DEFAULT lane for chat completions.
+ * Live truth (v1 1.19.4 MITM, SG): the official CLI addresses the free tier
+ * here (`POST https://opencode.ai/inference/openai/v1/chat/completions`),
+ * not on the plain /v1 chat path. Same gateway, same Bearer public
+ * credential, but the path carries the extra `/openai` segment and the body
+ * carries `stream_options: { include_usage: true }`.
+ * The plain `/inference/v1/chat/completions` path stays as the fallback when
+ * the compat lane answers 404/405. Relay probes address the compat lane via
+ * OPENCODE_OPENAI_COMPAT_PATH (the x-relay-path the workers forward as
+ * target + path).
+ */
+export const OPENCODE_OPENAI_COMPAT_URL = `${UPSTREAM_OPENCODE}/openai/v1/chat/completions`;
+export const OPENCODE_OPENAI_COMPAT_PATH = "/inference/openai/v1/chat/completions";
+
+/**
+ * Origin (scheme + host) of the OpenCode gateway. UPSTREAM_OPENCODE above is
+ * the origin plus the `/inference` base path; joining a `/inference/...`
+ * upstream path onto it would double the base (`/inference/inference/...`),
+ * so callers that already hold an upstream-rooted path join it here instead.
+ */
+export const OPENCODE_ORIGIN = "https://opencode.ai";
+
+/**
+ * Default-lane upstream path for a request path. Chat completions ride
+ * the openai-compat lane (live CLI truth); every other path (responses,
+ * messages, models) keeps its plain mapping. The plain chat path stays as
+ * the fallback when the compat lane answers 404/405.
+ *
+ * Accepts EITHER form because production `validatePath` resolves the local
+ * `/v1/...` path against the `/inference` base, so `target.pathname` already
+ * arrives upstream-rooted (`/inference/v1/chat/completions`): a leading
+ * `/inference` base is normalized off before mapping, and an already-compat
+ * or unknown path passes through untouched instead of being sliced blindly.
+ * Idempotent: feeding its own output back returns it unchanged.
+ */
+export function zenUpstreamPathFor(localOrUpstreamPathname: string): string {
+ const local = localOrUpstreamPathname.startsWith("/inference/")
+  ? localOrUpstreamPathname.slice("/inference".length)
+  : localOrUpstreamPathname;
+ if (local === "/v1/chat/completions") return OPENCODE_OPENAI_COMPAT_PATH;
+ if (local.startsWith("/v1/")) return `/inference${local}`;
+ return localOrUpstreamPathname;
+}
+
+/** Full upstream URL for a local request path on the default Zen lane. */
+export function zenUpstreamUrlFor(localPathname: string): string {
+ return `${OPENCODE_ORIGIN}${zenUpstreamPathFor(localPathname)}`;
+}
 // Cline serves chat completions only — responses-path requests are translated
 // to chat upstream and back (see tool-translation.ts). Direct-only: Cline
 // traffic never rides the relay pool and carries a per-user bearer token
@@ -83,8 +133,6 @@ export const OPENCODE_USER_AGENT_ENV = "PI_FREEFLOW_OPENCODE_USER_AGENT";
 /** Owned UA probe cache file (sibling of the update-check cache). */
 export const OPENCODE_VERSION_CACHE_ENV = "PI_FREEFLOW_OPENCODE_VERSION_CACHE";
 
-export const OPENCODE_VERSION = OPENCODE_VERSION_FALLBACK;
-export const OPENCODE_USER_AGENT = `opencode/${OPENCODE_VERSION}`;
 export const OPENCODE_CLIENT = "cli";
 
 function compareVersionParts(a: string, b: string): number {
@@ -115,6 +163,92 @@ export function toOpenCodeUserAgent(version: unknown): string | null {
  return `opencode/${bare}`;
 }
 
+/** Memo TTL for the installed-binary probe: at most one spawn per minute. */
+export const OPENCODE_BINARY_VERSION_TTL_MS = 60_000;
+/** Where an observed live OpenCode version came from. */
+export type OpenCodeVersionSource = "registry" | "binary";
+
+/**
+ * Parse `opencode --version` output into a bare semver, else null.
+ * Accepts the shapes the CLIs print (`2.2.0`, `v2.2.0`, `opencode-ai 1.19.4`)
+ * and floors through isSupportedOpenCodeVersion, so anything below 1.17.0
+ * (or unparseable) never drives the wire UA.
+ */
+export function parseOpenCodeBinaryVersion(output: unknown): string | null {
+ if (typeof output !== "string") return null;
+ const match = output.match(/(\d+\.\d+\.\d+)/);
+ if (!match) return null;
+ const version: string | undefined = match[1];
+ if (version === undefined || !isSupportedOpenCodeVersion(version)) return null;
+ return version;
+}
+
+/** Minimal spawnSync result surface the binary probe reads. */
+export interface OpenCodeSpawnResult {
+ status: number | null;
+ stdout?: unknown;
+ stderr?: unknown;
+ error?: unknown;
+}
+/** spawnSync-compatible injector for the binary probe (tests stub this). */
+export type OpenCodeSpawnSync = (
+ command: string,
+ args: readonly string[],
+ options: { encoding: "utf8"; timeout: number; windowsHide: boolean; shell?: boolean },
+) => OpenCodeSpawnResult;
+
+function defaultOpenCodeSpawn(
+ command: string,
+ args: readonly string[],
+ options: { encoding: "utf8"; timeout: number; windowsHide: boolean; shell?: boolean },
+): OpenCodeSpawnResult {
+ // Single-string form under a Windows shell: resolves *.cmd shims the same
+ // way isCommandAvailable does; direct exec elsewhere.
+ if (process.platform === "win32") {
+  return spawnSync(`${command} ${args.join(" ")}`, {
+   encoding: options.encoding,
+   timeout: options.timeout,
+   windowsHide: options.windowsHide,
+   shell: true,
+  }) as unknown as OpenCodeSpawnResult;
+ }
+ return spawnSync(command, [...args], options) as unknown as OpenCodeSpawnResult;
+}
+
+let binaryMemo: { key: string; version: string | null; probedAt: number } | null = null;
+
+/**
+ * Probe the locally installed `opencode` binary (`--version`, 10s timeout).
+ * Offline-safe by construction: no network, try/catch, null when the binary
+ * is missing, fails, times out, or prints an unsupported version. Results
+ * (including misses) are memoized ~60s so the request path never spawns
+ * more than once a minute. Pass `spawnImpl` to stub the spawn in tests —
+ * never rely on a real PATH binary there (CI has none).
+ */
+export function probeInstalledOpenCodeVersion(opts: {
+ execPath?: string;
+ timeoutMs?: number;
+ spawnImpl?: OpenCodeSpawnSync;
+} = {}): string | null {
+ const execPath = opts.execPath ?? "opencode";
+ const timeoutMs = opts.timeoutMs ?? 10_000;
+ const now = Date.now();
+ if (binaryMemo && binaryMemo.key === execPath && now - binaryMemo.probedAt < OPENCODE_BINARY_VERSION_TTL_MS) {
+  return binaryMemo.version;
+ }
+ let version: string | null = null;
+ try {
+  const spawn = opts.spawnImpl ?? defaultOpenCodeSpawn;
+  const res = spawn(execPath, ["--version"], { encoding: "utf8", timeout: timeoutMs, windowsHide: true });
+  if (res && res.error === undefined && res.status === 0) {
+   const text = [res.stdout, res.stderr].filter((part): part is string => typeof part === "string").join("\n");
+   version = parseOpenCodeBinaryVersion(text);
+  }
+ } catch { version = null; }
+ binaryMemo = { key: execPath, version, probedAt: now };
+ return version;
+}
+
 function openCodeVersionCachePath(): string {
  const override = process.env[OPENCODE_VERSION_CACHE_ENV];
  if (typeof override === "string" && override.trim() !== "") return override;
@@ -149,6 +283,7 @@ function writeOpenCodeVersionCache(version: string): void {
 }
 
 let liveOpenCodeVersion: string | null = null;
+let liveOpenCodeVersionSource: OpenCodeVersionSource | null = null;
 /** Memoized disk read: path -> { version, fileCheckedAt } so opencodeHeaders() stays sync and cheap. */
 let diskMemo: { path: string; version: string | null; readAt: number } | null = null;
 const DISK_MEMO_TTL_MS = 60_000;
@@ -164,22 +299,38 @@ function memoizedDiskVersion(): string | null {
 }
 
 /** Test-only: reset the in-process live version (cache file untouched). */
-export function _resetLiveOpenCodeVersionForTest(): void { liveOpenCodeVersion = null; diskMemo = null; }
+export function _resetLiveOpenCodeVersionForTest(): void {
+ liveOpenCodeVersion = null;
+ liveOpenCodeVersionSource = null;
+ diskMemo = null;
+ binaryMemo = null;
+}
 
 /**
- * Synchronous UA getter — offline-safe by construction. Precedence:
- * env override > in-process live version > fresh disk cache > pinned fallback.
- * Never throws, never touches the network (disk re-read at most once a minute).
+ * Current OpenCode version for the wire UA — the single precedence chain:
+ * env override > installed binary (1.x line) > in-process live version >
+ * fresh disk cache > pinned fallback. Never throws, never touches the
+ * network (disk re-read at most once a minute, binary probe at most once a
+ * minute). An installed 2.x binary never drives the compat-lane UA — it is
+ * skipped here and surfaces via getLiveOpenCodeVersion for logs only.
  */
-export function getOpenCodeUserAgent(): string {
+function currentOpenCodeVersion(): string {
  const override = toOpenCodeUserAgent(process.env[OPENCODE_USER_AGENT_ENV]);
- if (override) return override;
- if (liveOpenCodeVersion && isSupportedOpenCodeVersion(liveOpenCodeVersion)) {
-  return `opencode/${liveOpenCodeVersion}`;
- }
+ if (override) return override.slice("opencode/".length);
+ const installed = probeInstalledOpenCodeVersion();
+ if (installed && installed.split(".")[0] === "1") return installed;
+ if (liveOpenCodeVersion && isSupportedOpenCodeVersion(liveOpenCodeVersion)) return liveOpenCodeVersion;
  const disk = memoizedDiskVersion();
- if (disk) return `opencode/${disk}`;
- return OPENCODE_USER_AGENT;
+ if (disk) return disk;
+ return OPENCODE_VERSION_FALLBACK;
+}
+
+/**
+ * Synchronous UA getter — the single User-Agent implementation every lane
+ * sends (offline-safe by construction). Always the verbatim CLI full shape.
+ */
+export function getOpenCodeUserAgent(): string {
+ return buildOpenCodeUserAgent(currentOpenCodeVersion());
 }
 
 /**
@@ -190,7 +341,7 @@ export function getOpenCodeUserAgent(): string {
  */
 export async function refreshOpenCodeUserAgent(fetchImpl: typeof fetch = fetch): Promise<string> {
  const override = toOpenCodeUserAgent(process.env[OPENCODE_USER_AGENT_ENV]);
- if (override) return override;
+ if (override) return getOpenCodeUserAgent();
  try {
   const res = await fetchImpl("https://registry.npmjs.org/opencode-ai/latest", {
    signal: AbortSignal.timeout(10_000),
@@ -200,15 +351,92 @@ export async function refreshOpenCodeUserAgent(fetchImpl: typeof fetch = fetch):
   const version = (body as Record<string, unknown>)?.version;
   if (!isSupportedOpenCodeVersion(version)) return getOpenCodeUserAgent();
   liveOpenCodeVersion = version as string;
+  liveOpenCodeVersionSource = "registry";
   writeOpenCodeVersionCache(version as string);
   diskMemo = null;
-  return `opencode/${version}`;
+  return getOpenCodeUserAgent();
  } catch { return getOpenCodeUserAgent(); }
 }
-// OpenCode project ID: 40-character sha1 hex hash
-export const OPENCODE_PROJECT = createHash("sha1")
- .update("git-remote:github.com/anomalyco/opencode")
- .digest("hex");
+/**
+ * Live version already fetched in-process, else the installed binary, else
+ * the pinned fallback. The installed 2.x line surfaces here (and in logs)
+ * while the compat-lane UA keeps the 1.x line — major-2 never auto-switches
+ * the wire shape. No network; the binary probe is memoized ~60s.
+ */
+export function getLiveOpenCodeVersion(): string {
+ if (liveOpenCodeVersion) return liveOpenCodeVersion;
+ return probeInstalledOpenCodeVersion() ?? OPENCODE_VERSION_FALLBACK;
+}
+/**
+ * Where the live version came from: `registry` when refresh populated it,
+ * `binary` when it reflects the installed binary, null on the pure fallback.
+ */
+export function getOpenCodeVersionSource(): OpenCodeVersionSource | null {
+ if (liveOpenCodeVersion) return liveOpenCodeVersionSource;
+ if (probeInstalledOpenCodeVersion() !== null) return "binary";
+ return null;
+}
+
+/**
+ * Build the OpenCode User-Agent string: always the verbatim CLI full shape
+ * (`opencode/<version> ai-sdk/provider-utils/4.0.23 runtime/bun/1.4.4`).
+ * The legacy bare and channel shapes are gone with the A/B profiles.
+ */
+export function buildOpenCodeUserAgent(version: string): string {
+ return `opencode/${version} ai-sdk/provider-utils/4.0.23 runtime/bun/1.4.4`;
+}
+
+const STABLE_SESSION_RE = /^ses_[0-9a-f]{12}[0-9A-Za-z]{14}$/;
+const STABLE_SESSION_CAP = 1000;
+const stableSessionCache = new Map<string, string>();
+const TIME48_MASK = (1n << 48n) - 1n;
+
+/**
+ * Stable per-conversation session id. A valid `ses_*` key passes through
+ * verbatim; "" allocates a fresh random id; anything else maps deterministically
+ * via sha256("pi-freeflow\\0" + key): 48-bit time field from the digest with the
+ * descending counter pinned at 1, plus 14 base62 chars from later digest bytes.
+ * Results are memoized in an LRU (cap 1000, hit moves to back); `now` is accepted
+ * for signature compatibility and ignored so the same key always maps the same.
+ */
+export function stableOpenCodeSessionId(key: string, now = Date.now()): string {
+ void now;
+ if (STABLE_SESSION_RE.test(key)) return key;
+ if (key === "") return createOpenCodeSessionId();
+ const hit = stableSessionCache.get(key);
+ if (hit !== undefined) {
+  stableSessionCache.delete(key);
+  stableSessionCache.set(key, hit);
+  return hit;
+ }
+ const digest = createHash("sha256").update(`pi-freeflow\0${key}`).digest();
+ const time48 = (BigInt(digest[0]!) << 40n) | (BigInt(digest[1]!) << 32n) | (BigInt(digest[2]!) << 24n) | (BigInt(digest[3]!) << 16n) | (BigInt(digest[4]!) << 8n) | BigInt(digest[5]!);
+ const time = ((~(time48 * 0x1000n + 1n)) & TIME48_MASK).toString(16).padStart(12, "0");
+ let rand = "";
+ for (let i = 0; i < 14; i++) rand += ID_CHARS[digest[(6 + i) % digest.length]! % 62];
+ const id = `ses_${time}${rand}`;
+ stableSessionCache.set(key, id);
+ if (stableSessionCache.size > STABLE_SESSION_CAP) {
+  const oldest = stableSessionCache.keys().next();
+  if (!oldest.done) stableSessionCache.delete(oldest.value);
+ }
+ return id;
+}
+
+/** Test-only: clear the stable session memo. */
+export function _resetStableSessionCacheForTest(): void { stableSessionCache.clear(); }
+
+/** Test-only: current stable session memo size (proves the LRU cap). */
+export function _stableSessionCacheSizeForTest(): number { return stableSessionCache.size; }
+
+/** Test-only: whether a key is currently memoized (proves LRU eviction). */
+export function _stableSessionHasKeyForTest(key: string): boolean { return stableSessionCache.has(key); }
+/** The literal `global` project the CLI sends outside a repo. */
+export const OPENCODE_PROJECT_GLOBAL = "global";
+/** sha1 hex digest of a working directory (what the CLI sends as the project). */
+export function openCodeProjectForCwd(cwd: string): string {
+ return createHash("sha1").update(cwd).digest("hex");
+}
 
 const ID_CHARS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 let idTimestamp = 0;
@@ -251,23 +479,41 @@ export function createOpenCodeRequestId(): string {
  return `msg_${createOpenCodeId(false)}`;
 }
 
-export const OPENCODE_SESSION = createOpenCodeSessionId();
+/**
+ * Live project header: the CLI sends `global` outside a repo and the sha1 of
+ * the working directory inside one. Without a cwd to hash, `global` is the
+ * truthful value — never the fixed pin above.
+ */
+export function resolveOpenCodeProjectLive(cwd?: string): string {
+ if (typeof cwd === "string" && cwd.length > 0) return openCodeProjectForCwd(cwd);
+ return OPENCODE_PROJECT_GLOBAL;
+}
 
-export function opencodeHeaders(): Record<string, string> {
- const sessionId = OPENCODE_SESSION;
- // Real OpenCode CLI (captured 2.0.28) does NOT send x-opencode-request on
- // /inference/v1. Emitting msg_* there is treated as a non-OpenCode client and
- // returns 403 FreeTierError — keep the helper for ID-shape tests, but omit
- // the header on the wire.
+/**
+ * Live-truth OpenCode headers (v1 1.19.4 MITM, SG): full UA, Bearer public,
+ * client cli, per-conversation ses_* session, fresh msg_* request id per
+ * prepare, and the cwd-derived project. Affinity headers are NEVER sent on
+ * the opencode lane (upstream treats them as a non-OpenCode signal); they
+ * are gated to non-opencode lanes only (see sanitizeHeaders callers).
+ *
+ * @param sessionKey conversation-scoped key reused within a run
+ *   (stableOpenCodeSessionId maps it deterministically; a valid ses_* passes
+ *   through verbatim). Omitted/empty allocates a fresh id for this call.
+ * @param cwd working directory for the project header; omitted → `global`.
+ */
+export function opencodeHeaders(sessionKey?: string, cwd?: string): Record<string, string> {
+ const sessionId =
+  typeof sessionKey === "string" && sessionKey.length > 0
+   ? stableOpenCodeSessionId(sessionKey)
+   : createOpenCodeSessionId();
  return {
   Authorization: "Bearer public",
   "User-Agent": getOpenCodeUserAgent(),
   "x-opencode-client": OPENCODE_CLIENT,
-  "x-opencode-project": OPENCODE_PROJECT,
+  "x-opencode-project": resolveOpenCodeProjectLive(cwd),
   "x-opencode-session": sessionId,
   "x-opencode-session-id": sessionId,
-  "x-session-affinity": sessionId,
-  "x-session-id": sessionId,
+  "x-opencode-request": createOpenCodeRequestId(),
  };
 }
 

package/src/health.ts

@@ -5,6 +5,7 @@
  */
 
 import type * as http from "node:http";
+import { Buffer } from "node:buffer";
 import { ALL_MODELS } from "./models.ts";
 import { getActiveRelayState, getRelayHealth, isRelayHealthy } from "./relay-state.ts";
 import { getLastActivityAt, getLeaseCount, getLeaseSnapshot } from "./lease.ts";
@@ -12,45 +13,45 @@ import { PKG_VERSION, PORT } from "./config.ts";
 import { getLastForwardedByteAt, getMidStreamFaultStats, getSseStats } from "./stream-pipe.ts";
 
 interface HealthRelayInfo {
-	url: string;
-	label?: string;
-	healthy: boolean;
-	cooldownUntil: number;
-	consecutiveFailures: number;
+ url: string;
+ label?: string;
+ healthy: boolean;
+ cooldownUntil: number;
+ consecutiveFailures: number;
 }
 
 interface HealthData {
-	port: number;
-	active: string;
-	mode: string;
-	enabled: boolean;
-	relays: HealthRelayInfo[];
-	catalog: number;
-	version: string;
-	/** In-flight proxied requests right now (stale-daemon replacement guard). */
-	activeRequests: number;
-	/** Clients holding a live lease (detached-daemon GC). */
-	clients: number;
-	/** clientId -> lastSeenAt for every live lease. */
-	leases: Record<string, number>;
-	/** Last time any request was proxied (request-touch for legacy clients). */
-	lastActivityAt: number;
-	/** Failed-SSE rolling window: failures in the last 20 streams. */
-	sseFailed: number;
-	/** Streams recorded in the current rolling window (max 20). */
-	sseTotal: number;
-	/** Failure rate over the window (0 when empty). */
-	sseRate: number;
-	/** True when the window holds enough samples and the rate exceeds 50%. */
-	sseDegraded: boolean;
-	/** Last time any stream byte was forwarded (busy-bypass quiet check), 0 when no stream yet. */
-	lastBytesAt: number;
-	/** Mid-stream turns the upstream model itself failed (model fault, never a relay fault). */
-	midStreamModelFaults: number;
-	/** Mid-stream turns held on a retriable rate-limit frame (whether or not the rescue served). */
-	midStreamRateLimitFaults: number;
-	/** Mid-stream turns cut by the relay/transport (relay fault, rotated away from). */
-	midStreamRelayTruncations: number;
+ port: number;
+ active: string;
+ mode: string;
+ enabled: boolean;
+ relays: HealthRelayInfo[];
+ catalog: number;
+ version: string;
+ /** In-flight proxied requests right now (stale-daemon replacement guard). */
+ activeRequests: number;
+ /** Clients holding a live lease (detached-daemon GC). */
+ clients: number;
+ /** clientId -> lastSeenAt for every live lease. */
+ leases: Record<string, number>;
+ /** Last time any request was proxied (request-touch for legacy clients). */
+ lastActivityAt: number;
+ /** Failed-SSE rolling window: failures in the last 20 streams. */
+ sseFailed: number;
+ /** Streams recorded in the current rolling window (max 20). */
+ sseTotal: number;
+ /** Failure rate over the window (0 when empty). */
+ sseRate: number;
+ /** True when the window holds enough samples and the rate exceeds 50%. */
+ sseDegraded: boolean;
+ /** Last time any stream byte was forwarded (busy-bypass quiet check), 0 when no stream yet. */
+ lastBytesAt: number;
+ /** Mid-stream turns the upstream model itself failed (model fault, never a relay fault). */
+ midStreamModelFaults: number;
+ /** Mid-stream turns held on a retriable rate-limit frame (whether or not the rescue served). */
+ midStreamRateLimitFaults: number;
+ /** Mid-stream turns cut by the relay/transport (relay fault, rotated away from). */
+ midStreamRelayTruncations: number;
 }
 
 /**
@@ -63,9 +64,9 @@ interface HealthData {
  * for unversioned responses. The key list must match what getDaemonHealth parses.
  */
 export type DaemonHealthSnapshot = {
-	[K in "activeRequests" | "sseRate" | "sseDegraded" | "lastBytesAt"]?: HealthData[K] | undefined;
+ [K in "activeRequests" | "sseRate" | "sseDegraded" | "lastBytesAt"]?: HealthData[K] | undefined;
 } & {
-	version: string | null;
+ version: string | null;
 } | null;
 
 /**
@@ -74,41 +75,41 @@ export type DaemonHealthSnapshot = {
  * @param activeRequests - in-flight proxied requests (defaults to 0 for callers that do not track)
  */
 export function getHealthData(portOverride?: number, activeRequests = 0): HealthData {
-	const state = getActiveRelayState();
-	const relays: HealthRelayInfo[] = (state.relays || []).map((r) => {
-		const h = getRelayHealth(r.url);
-		const healthy = isRelayHealthy(r.url);
-		return {
-			url: r.url,
-			label: r.label,
-			healthy,
-			cooldownUntil: h?.cooldownUntil ?? 0,
-			consecutiveFailures: h?.consecutiveFailures ?? 0,
-		};
-	});
-	const sse = getSseStats();
-	const midStreamFaults = getMidStreamFaultStats();
-	return {
-		port: portOverride ?? PORT,
-		active: state.url || "",
-		mode: (state.mode as string) ?? "auto",
-		enabled: Boolean(state.enabled),
-		relays,
-		catalog: ALL_MODELS.length,
-		version: PKG_VERSION,
-		activeRequests,
-		clients: getLeaseCount(),
-		leases: getLeaseSnapshot(),
-		lastActivityAt: getLastActivityAt(),
-		sseFailed: sse.failures,
-		sseTotal: sse.total,
-		sseRate: sse.rate,
-		sseDegraded: sse.degraded,
-		lastBytesAt: getLastForwardedByteAt(),
-		midStreamModelFaults: midStreamFaults.modelFaults,
-		midStreamRateLimitFaults: midStreamFaults.rateLimitFaults,
-		midStreamRelayTruncations: midStreamFaults.relayTruncations,
-	};
+ const state = getActiveRelayState();
+ const relays: HealthRelayInfo[] = (state.relays || []).map((r) => {
+  const h = getRelayHealth(r.url);
+  const healthy = isRelayHealthy(r.url);
+  return {
+   url: r.url,
+   label: r.label,
+   healthy,
+   cooldownUntil: h?.cooldownUntil ?? 0,
+   consecutiveFailures: h?.consecutiveFailures ?? 0,
+  };
+ });
+ const sse = getSseStats();
+ const midStreamFaults = getMidStreamFaultStats();
+ return {
+  port: portOverride ?? PORT,
+  active: state.url || "",
+  mode: (state.mode as string) ?? "auto",
+  enabled: Boolean(state.enabled),
+  relays,
+  catalog: ALL_MODELS.length,
+  version: PKG_VERSION,
+  activeRequests,
+  clients: getLeaseCount(),
+  leases: getLeaseSnapshot(),
+  lastActivityAt: getLastActivityAt(),
+  sseFailed: sse.failures,
+  sseTotal: sse.total,
+  sseRate: sse.rate,
+  sseDegraded: sse.degraded,
+  lastBytesAt: getLastForwardedByteAt(),
+  midStreamModelFaults: midStreamFaults.modelFaults,
+  midStreamRateLimitFaults: midStreamFaults.rateLimitFaults,
+  midStreamRelayTruncations: midStreamFaults.relayTruncations,
+ };
 }
 
 /**
@@ -124,20 +125,20 @@ export function getHealthData(portOverride?: number, activeRequests = 0): Health
  * still fails.
  */
 export function isDaemonIdentityBody(port: number, body: unknown): boolean {
-	if (!body || typeof body !== "object" || Array.isArray(body)) return false;
-	if (!("port" in body) || typeof body.port !== "number" || body.port !== port) return false;
-	if ("service" in body) return body.service === "pi-freeflow" && "ok" in body && body.ok === true;
-	return "version" in body && typeof body.version === "string" && body.version !== "";
+ if (!body || typeof body !== "object" || Array.isArray(body)) return false;
+ if (!("port" in body) || typeof body.port !== "number" || body.port !== port) return false;
+ if ("service" in body) return body.service === "pi-freeflow" && "ok" in body && body.ok === true;
+ return "version" in body && typeof body.version === "string" && body.version !== "";
 }
 
 /**
  * Check whether an IP address is a loopback address (127.0.0.1, ::1, localhost).
  */
 export function isLoopbackIP(ip: string): boolean {
-	if (!ip) return false;
-	const withoutZone = ip.split("%")[0];
-	const clean = withoutZone.startsWith("::ffff:") ? withoutZone.slice(7) : withoutZone;
-	return clean === "127.0.0.1" || clean === "::1" || clean === "localhost";
+ if (!ip) return false;
+ const withoutZone = ip.split("%")[0];
+ const clean = withoutZone.startsWith("::ffff:") ? withoutZone.slice(7) : withoutZone;
+ return clean === "127.0.0.1" || clean === "::1" || clean === "localhost";
 }
 
 /**
@@ -154,43 +155,43 @@ export function isLoopbackIP(ip: string): boolean {
  *   here, so this handler does not repeat the auth check.
  */
 export function handleHealthRequest(
-	req: http.IncomingMessage,
-	res: http.ServerResponse,
-	portOverride?: number,
-	activeRequests = 0,
+ req: http.IncomingMessage,
+ res: http.ServerResponse,
+ portOverride?: number,
+ activeRequests = 0,
 ): boolean {
-	if (req.method !== "GET") return false;
+ if (req.method !== "GET") return false;
 
-	let reqPathname: string | null = null;
-	try {
-		reqPathname = new URL(req.url ?? "/", `http://127.0.0.1`).pathname;
-	} catch {
-		return false;
-	}
-	if (reqPathname === null) return false;
-	if (reqPathname !== "/_health" && reqPathname !== "/health") return false;
+ let reqPathname: string | null = null;
+ try {
+  reqPathname = new URL(req.url ?? "/", `http://127.0.0.1`).pathname;
+ } catch {
+  return false;
+ }
+ if (reqPathname === null) return false;
+ if (reqPathname !== "/_health" && reqPathname !== "/health") return false;
 
-	const clientIP = req.socket.remoteAddress ?? "";
-	if (!isLoopbackIP(clientIP)) {
-		res.writeHead(403, { "content-type": "application/json" });
-		res.end(JSON.stringify({ error: "loopback only" }));
-		return true;
-	}
+ const clientIP = req.socket.remoteAddress ?? "";
+ if (!isLoopbackIP(clientIP)) {
+  res.writeHead(403, { "content-type": "application/json" });
+  res.end(JSON.stringify({ error: "loopback only" }));
+  return true;
+ }
 
-	const body =
-		reqPathname === "/health"
-			? JSON.stringify({
-				ok: true,
-				service: "pi-freeflow",
-				port: portOverride ?? PORT,
-				version: PKG_VERSION,
-			})
-			: JSON.stringify(getHealthData(portOverride, activeRequests), null, 2);
-	res.writeHead(200, {
-		"content-type": "application/json",
-		"content-length": Buffer.byteLength(body),
-		"cache-control": "no-store",
-	});
-	res.end(body);
-	return true;
+ const body =
+  reqPathname === "/health"
+   ? JSON.stringify({
+    ok: true,
+    service: "pi-freeflow",
+    port: portOverride ?? PORT,
+    version: PKG_VERSION,
+   })
+   : JSON.stringify(getHealthData(portOverride, activeRequests), null, 2);
+ res.writeHead(200, {
+  "content-type": "application/json",
+  "content-length": Buffer.byteLength(body),
+  "cache-control": "no-store",
+ });
+ res.end(body);
+ return true;
 }