pi-freeflow 1.42.1 → 1.43.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.43.0
+
+### Minor Changes
+
+- Auto-detect the installed OpenCode 1.x version and auto-repair the OpenCode lane on version drift. The proxy now parses the real client version (`parseOpenCodeBinaryVersion` plus a memoized `probeInstalledOpenCodeVersion` via `opencode --version`) with precedence env override > installed 1.x > live registry > disk > `1.19.4` fallback, so fingerprint User-Agent and headers track the actual installed client instead of a pinned constant. A 2.x major never auto-switches the compat UA; it surfaces via `getLiveOpenCodeVersion` only. Outgoing requests strip stale caller `x-opencode-*` stamps and always stamp the live roster, relay shape-429s stay terminal with no health mark, and the proxy retries once through `refreshOpenCodeUserAgent` on 426/version-drift language.
+
+### Patch Changes
+
+- Harden the OpenCode fingerprint, account pools, and relay/update paths. Requests collapse to a single live OpenCode fingerprint (11-tool roster, full client User-Agent, fresh request id per prepare); silent Zen-to-Kilo failover moves behind the `PI_FREEFLOW_ZEN_KILO_FAILOVER` opt-in. The Cline pool clones on load/save with trimmed tokens and tightened stream sniffing, hedge rate-limit signals are preserved, sticky relay removal is trimmed, quota markers are narrowed, and state writes share one atomic path. Also fixes version comparison, updater probing, token mtime caching, and lease validation. The OpenCode lane is live SERVING (200 billing free).
+- fb521b1: Retire two OpenCode Zen models that upstream removed (issue #121): `longcat-2.5-preview-free` answers `410 Model has been deprecated`, and `nemotron-3-ultra-free` answers `400 Model is unavailable` — both ids are also absent from the live Zen free listing, so neither can serve traffic anymore. The catalog drops from 34 to 32 models (Zen lane 10 to 8); both ids are dead-listed so no stale disk cache or upstream merge can re-register them, and their `longcat` / `longcat-2.5-preview` short aliases are removed. The eight models that answered `429 FreeUsageLimitError` in the same run are untouched: rate-limit verdicts are an availability fault, never a catalog action. The sibling Kilo id `nvidia/nemotron-3-ultra-550b-a55b:free` is a separate serving route and is unaffected.
+- fb521b1: Record opt-in OpenCode Zen free-tier request variants for A/B testing once upstream quota recovers, with no change to the default request. A newer four-part client identifier, alternate project header values (fixed, global, or working-directory digest), and the alternate usage-marked request lane are now available as selectable variants for controlled one-variable comparisons. Default traffic is byte-identical: same User-Agent, project value, lane, tool set, and exactly-one environment block as before.
+- fb521b1: Fix OpenCode Zen free-tier requests being refused with `429 FreeUsageLimitError` ("Free usage limit reached") when the system prompt carries no environment block. The same body answers `200` with the block and `429` without it on the same machine, in the same minute, so the countdown to 00:00 UTC is a generic error body rather than a spent quota. Outgoing Zen requests now carry exactly one `<env>` block containing `Working directory:`: a complete block the host already sent is passed through untouched, a stale or incomplete one is replaced instead of duplicated, and the Kilo, Cline and OVHcloud lanes are unchanged. A conversation that already ate a refusal also keeps failing over to Kilo on its retry instead of replaying the refusal.
+
 ## 1.42.1
 
 ### Patch Changes

package/README.md

@@ -1,6 +1,6 @@
 # pi-freeflow
 
-> 34 free models with up to 1M context. No API keys to manage. Add your own relays to spread requests across more IPs.
+> 32 free models with up to 1M context. No API keys to manage. Add your own relays to spread requests across more IPs.
 
 Thin by design: a model list, a relay proxy, and a log. The host (`pi-ai`) handles thinking, normalization, and provider behavior.
 
@@ -16,7 +16,7 @@ Thin by design: a model list, a relay proxy, and a log. The host (`pi-ai`) handl
 
 | Feature | What it does | Cost |
 | :--- | :--- | :--- |
-| **34 free models** | 10 from OpenCode Zen, 15 from KiloCode Gateway, 1 from Cline, 8 from OVHcloud AI Endpoints, context windows up to 1M. Full list below. | **$0** |
+| **32 free models** | 8 from OpenCode Zen, 15 from KiloCode Gateway, 1 from Cline, 8 from OVHcloud AI Endpoints, context windows up to 1M. Full list below. | **$0** |
 | **Relay pool** | Route requests through your own relays: a self-hosted egress pool (many egress IPs on one small host) or Cloudflare Workers / Deno Deploy / Vercel Edge workers. Traffic spreads across the pool, or stays on one sticky relay. A relay that rate-limits, times out, or drops the connection cools down while healthy ones take its traffic. | **$0** beyond your host or platforms' free tiers |
 | **Automatic fallback** | When every relay is cooling down, requests go direct to upstream instead of failing. | **$0** |
 | **Short model names** | Most models have a slash-free, colon-free alias, plus an optional `:effort` suffix for thinking depth. You type `freeflow/<name>`; the Cline model has no alias and must be typed in full. | **$0** |
@@ -214,7 +214,7 @@ The same command set works identically in OMP and Pi:
 
 ---
 
-### 34 models, one command
+### 32 models, one command
 
 ```bash
 /model → freeflow → pick
@@ -224,7 +224,7 @@ Every model specification is reconciled against [models.dev](https://models.dev/
 
 The host catalog carries text and image inputs only. Upstream video and audio support (MiMo: audio + video; GLM 5.3 Flash: video + PDF; Nemotron Super VL and Nano Omni: video) is therefore not selectable from the picker and is not declared in `input`.
 
-#### OpenCode Zen (10 models), Chat Completions API
+#### OpenCode Zen (8 models), Chat Completions API
 
 Good defaults for long coding sessions and agentic work.
 
@@ -233,9 +233,7 @@ Good defaults for long coding sessions and agentic work.
 | `mimo-v2.6-flash-free` | Xiaomi MiMo | **1M** (1.048.576) | **128K** (131.072) | `minimal … xhigh`\* | ❌ |
 | `nemotron-3.5-lightning-free` | NVIDIA | **1M** (1.000.000) | **235K** (235.929) | `minimal … xhigh` | ❌ |
 | `nemotron-3.5-super-vl-free` | NVIDIA | **1M** (1.048.576) | **235K** (235.929) | `minimal … xhigh` | ✅ |
-| `nemotron-3-ultra-free` | NVIDIA | **1M** (1.000.000) | **182K** (182.520) | `minimal … xhigh` | ❌ |
 | `big-pickle` | Big Pickle | **200K** (200.000) | **32K** (32.000) | `high / max` | ❌ |
-| `longcat-2.5-preview-free` | Meituan LongCat | **1M** (1.048.576) | **131K** (131.072) | `minimal … xhigh` | ✅ |
 | `glm-5.3-flash-free` | Zhipu AI | **1M** (1.048.576) | **131K** (131.072) | `low / high / max` | ✅ |
 | `beam-free` | Reflection AI | **1M** (1.048.576) | **131K** (131.072) | `low … max` | ❌ |
 | `deepseek-v4.1-flash-free` | DeepSeek | **1M** (1.048.576) | **393K** (393.216) | `low / high / max` | ✅ |
@@ -394,7 +392,7 @@ pnpm smoke       # verifies extensions/index.ts loads without crashing
 #### Project structure
 
 ```
-├── models.ts                # 34-model catalog definitions
+├── models.ts                # 32-model catalog definitions
 ├── index.ts                 # extension entry, lifecycle hooks
 ├── catalog.ts               # model catalog cache (24h disk)
 ├── proxy.ts                 # local proxy server (127.0.0.1:28180)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-freeflow",
   "type": "module",
-  "version": "1.42.1",
+  "version": "1.43.0",
   "description": "Thin provider for OMP/Pi — model list + dumb relay proxy + log; host pi-ai owns thinking/normalization",
   "main": "extensions/index.ts",
   "types": "src/index.ts",

package/src/catalog.ts

@@ -182,6 +182,19 @@ export const DEAD_MODEL_IDS = new Set<string>([
  // model that drains account credits and answers HTTP 402 insufficient_credits.
  // Replaced with Cline's verified working free tier model.
  "z-ai/glm-5.3-flash",
+ // longcat-2.5-preview-free: deprecated upstream (2026-10-26, issue #121) —
+ // the endpoint answers HTTP 410 "Model longcat-2.5-preview-free has been
+ // deprecated", and the id is absent from the live Zen free listing (watch
+ // state 2026-10-24). Permanently dead-listed so no disk cache or upstream
+ // merge can put it back.
+ "longcat-2.5-preview-free",
+ // nemotron-3-ultra-free: retired upstream (2026-10-26, issue #121) — the
+ // endpoint answers HTTP 400 "Model is unavailable", and the id is absent
+ // from the live Zen free listing (watch state 2026-10-24 lastChecked), the
+ // same removal-plus-unavailable signature as step-5-preview-free. The
+ // sibling Kilo id nvidia/nemotron-3-ultra-550b-a55b:free is a separate
+ // serving route and is unaffected.
+ "nemotron-3-ultra-free",
 ]);
 /**
  * Free-tier allowlist for anything entering the picker via network or stale disk.
@@ -221,7 +234,7 @@ export function sanitizeCatalogModels(models: RegisteredModel[]): RegisteredMode
 }
 /**
  * In-memory cache of currently active/available free models.
- * Initialized with all 35 verified models for 0ms instant availability.
+ * Initialized with all 32 verified models for 0ms instant availability.
  */
 let aliveCatalog: RegisteredModel[] = ALL_MODELS.map((m) => ({
  ...m,
@@ -320,8 +333,12 @@ export function enrichModelDef(raw: RawModelItem, source: Upstream): RegisteredM
   idLower.includes("glm") ||
   idLower.includes("solar");
 
+ // Declared fields win over wire aliases: a listing that already names
+ // contextWindow/maxTokens/reasoning keeps its values; the snake_case
+ // upstream aliases and the id heuristics only fill gaps.
  let contextWindow =
-  typeof raw.context_length === "number" ? raw.context_length : 262_144;
+  typeof raw.contextWindow === "number" ? raw.contextWindow
+  : typeof raw.context_length === "number" ? raw.context_length : 262_144;
  if (
   idLower.includes("1m") ||
   idLower.includes("ultra") ||
@@ -333,7 +350,8 @@ export function enrichModelDef(raw: RawModelItem, source: Upstream): RegisteredM
  }
 
  let maxTokens =
-  typeof raw.max_output_tokens === "number"
+  typeof raw.maxTokens === "number" ? raw.maxTokens
+  : typeof raw.max_output_tokens === "number"
    ? raw.max_output_tokens
    : 65_536;
  if (idLower.includes("ultra") || idLower.includes("lightning")) {
@@ -351,7 +369,7 @@ export function enrichModelDef(raw: RawModelItem, source: Upstream): RegisteredM
   id: raw.id,
   name: formatCleanDisplayName(raw.id),
   source,
-  reasoning: hasReasoning,
+  reasoning: typeof raw.reasoning === "boolean" ? raw.reasoning : hasReasoning,
   contextWindow,
   maxTokens,
   api: isResponses ? "openai-responses" : undefined,

package/src/client.ts

@@ -206,8 +206,8 @@ export function resolveDaemonRuntime(opts?: {
 }
 
 function daemonScriptPath(): string {
-	const p = path.join(path.dirname(fileURLToPath(import.meta.url)), "daemon.ts");
-	return process.platform === "win32" ? p.replace(/\\/g, "/") : p;
+ const p = path.join(path.dirname(fileURLToPath(import.meta.url)), "daemon.ts");
+ return process.platform === "win32" ? p.replace(/\\/g, "/") : p;
 }
 
 function getHeartbeatMs(): number {
@@ -601,18 +601,18 @@ async function killStaleDaemon(
   remoteVer,
   expected: PKG_VERSION,
  });
-	await killPortHolder(port);
-	for (let i = 0; i < 15; i++) {
-		await new Promise<void>((r) => setTimeout(r, 100));
-		if (!(await isProxyAlive(port))) {
-			lastSpawnAt = 0;
-			return true;
-		}
-	}
-	logInfo(
-		`Reusing existing pi-freeflow proxy daemon on http://${HOST}:${port} (stale kill did not free port)`,
-	);
-	return false;
+ await killPortHolder(port);
+ for (let i = 0; i < 15; i++) {
+  await new Promise<void>((r) => setTimeout(r, 100));
+  if (!(await isProxyAlive(port))) {
+   lastSpawnAt = 0;
+   return true;
+  }
+ }
+ logInfo(
+  `Reusing existing pi-freeflow proxy daemon on http://${HOST}:${port} (stale kill did not free port)`,
+ );
+ return false;
 }
 /**
  * Open the shared log file for the detached daemon's stdout/stderr so a
@@ -1009,40 +1009,40 @@ function spawnDaemonProcess(): DaemonChild | null {
 }
 
 export async function waitForReady(
-	port: number,
-	timeoutMs: number,
-	child?: DaemonChild | null,
+ port: number,
+ timeoutMs: number,
+ child?: DaemonChild | null,
 ): Promise<boolean> {
-	const deadline = Date.now() + timeoutMs;
-	while (Date.now() < deadline) {
-		if (await isProxyAlive(port, 150)) return true;
-		if (child && (hasChildExited(child) || failedDaemonSpawns.has(child))) {
-			logWarn("daemon child exited before becoming ready", {
-				port,
-				exitCode: child.exitCode,
-				signalCode: child.signalCode,
-			});
-			return false;
-		}
-		await new Promise<void>((r) => setTimeout(r, 80));
-	}
-	return false;
+ const deadline = Date.now() + timeoutMs;
+ while (Date.now() < deadline) {
+  if (await isProxyAlive(port, 150)) return true;
+  if (child && (hasChildExited(child) || failedDaemonSpawns.has(child))) {
+   logWarn("daemon child exited before becoming ready", {
+    port,
+    exitCode: child.exitCode,
+    signalCode: child.signalCode,
+   });
+   return false;
+  }
+  await new Promise<void>((r) => setTimeout(r, 80));
+ }
+ return false;
 }
 
 async function probeAndMaybeReplace(
-	port: number,
-	label: string,
-	probeTimeoutMs = 150,
+ port: number,
+ label: string,
+ probeTimeoutMs = 150,
 ): Promise<number | null> {
-	if (!(await isProxyAlive(port, probeTimeoutMs))) return null;
-	const ver = await getDaemonVersion(port);
-	if (ver !== null && ver !== PKG_VERSION) {
-		logWarn(`detected proxy daemon version mismatch: running v${ver}, required v${PKG_VERSION} — auto-restarting`);
-		await killStaleDaemon(port, ver, label);
-		lastSpawnAt = 0;
-		return null;
-	}
-	return port;
+ if (!(await isProxyAlive(port, probeTimeoutMs))) return null;
+ const ver = await getDaemonVersion(port);
+ if (ver !== null && ver !== PKG_VERSION) {
+  logWarn(`detected proxy daemon version mismatch: running v${ver}, required v${PKG_VERSION} — auto-restarting`);
+  await killStaleDaemon(port, ver, label);
+  lastSpawnAt = 0;
+  return null;
+ }
+ return port;
 }
 
 /**
@@ -1078,8 +1078,8 @@ async function ensureDaemonAttempt(): Promise<number> {
   }
 
 
-		if (isSpawnEnabled()) {
-			const child = spawnDaemonProcess();
+  if (isSpawnEnabled()) {
+   const child = spawnDaemonProcess();
    if (child) {
     const ready = await waitForReady(PORT, DAEMON_READY_TIMEOUT_MS, child);
     if (ready) {

package/src/cline-accounts.ts

@@ -118,7 +118,6 @@ export function _resetClinePoolCacheForTest(): void {
 
 /** Bundled fallback version if dynamic fetch and disk cache are absent. */
 export const BUNDLED_CLINE_VERSION = "4.1.25";
-export const CLINE_CLIENT_VERSION = BUNDLED_CLINE_VERSION;
 
 const CLINE_VERSION_TTL_MS = 24 * 60 * 60 * 1000;
 let liveClineVersion: string | null = null;
@@ -377,6 +376,24 @@ function emptyPool(): ClinePoolState {
  return { accounts: [] };
 }
 
+/**
+ * Deep clone a pool snapshot so callers can never alias the cache: mutating a
+ * loaded pool must not corrupt the next load, and mutating the argument after
+ * savePool must not rewrite what was cached.
+ */
+function clonePool(pool: ClinePoolState): ClinePoolState {
+ return {
+  accounts: pool.accounts.map((a) => ({ ...a })),
+  ...(pool.activeSlot !== undefined ? { activeSlot: pool.activeSlot } : {}),
+  ...(pool.limits
+   ? { limits: Object.fromEntries(Object.entries(pool.limits).map(([slot, models]) => [slot, { ...models }])) }
+   : {}),
+  ...(pool.usage
+   ? { usage: Object.fromEntries(Object.entries(pool.usage).map(([slot, row]) => [slot, { ...row }])) }
+   : {}),
+ };
+}
+
 /**
  * Read the optional `limits` map out of a pool document, dropping anything
  * malformed and every entry whose reset has already passed. Returns undefined
@@ -455,8 +472,11 @@ function parsePoolDoc(raw: string): ClinePoolState | null {
   if (typeof entry !== "object" || entry === null) continue;
   const rec: Record<string, unknown> = entry as Record<string, unknown>;
   const slot = typeof rec.slot === "string" ? rec.slot.trim() : "";
-  const token = typeof rec.token === "string" ? rec.token : "";
-  if (!slot || (!token.startsWith("workos:") && !isWorkosJwt(token) && !token.startsWith("clp_"))) continue;
+  const token = typeof rec.token === "string" ? rec.token.trim() : "";
+  if (!slot || (!token.startsWith("workos:") && !isWorkosJwt(token) && !token.startsWith("clp_"))) {
+   logWarn("cline pool entry rejected", { slot: slot || "(unnamed)" });
+   continue;
+  }
   const refreshRaw: unknown = rec.refreshToken;
   const refreshToken = typeof refreshRaw === "string" && refreshRaw.length > 0 ? refreshRaw : undefined;
   const expiresRaw: unknown = rec.expiresAt;
@@ -542,7 +562,7 @@ function diskMtime(): number {
  */
 export function loadPool(): ClinePoolState {
  const before = diskMtime();
- if (cached && before === cachedMtime) return cached;
+ if (cached && before === cachedMtime) return clonePool(cached);
  let loaded = readPoolFile();
  let stamp = diskMtime();
  // The read is only trustworthy when the file did not move across it. Reading
@@ -553,9 +573,9 @@ export function loadPool(): ClinePoolState {
   loaded = readPoolFile();
   stamp = diskMtime();
  }
- cached = loaded;
+ cached = clonePool(loaded);
  cachedMtime = stamp;
- return cached;
+ return clonePool(cached);
 }
 
 /**
@@ -653,7 +673,7 @@ export function savePool(pool: ClinePoolState): boolean {
   }
   // Compare the pool just written too, so growth is never the copy that lags.
   keepLargestBackup(serialized);
-  cached = pool;
+  cached = clonePool(pool);
   cachedMtime = diskMtime();
   return true;
  } catch (e) {
@@ -811,16 +831,17 @@ export function addAccount(
  const cleanSlot = (slot || "").trim();
  if (!cleanSlot) throw new Error("Cline slot name cannot be empty");
  if (cleanSlot.length > 64) throw new Error("Cline slot name is too long (max 64 characters)");
- if (!token.startsWith("workos:") && !isWorkosJwt(token) && !token.startsWith("clp_")) throw new Error("Cline token must be a workos: login grant or a clp_ API key");
+ const cleanToken = (token || "").trim();
+ if (!cleanToken.startsWith("workos:") && !isWorkosJwt(cleanToken) && !cleanToken.startsWith("clp_")) throw new Error("Cline token must be a workos: login grant or a clp_ API key");
  const pool = loadPool();
  const existing = pool.accounts.find((a) => a.slot === cleanSlot);
- const duplicate = findClineAccountSlot(pool, { token, accountId: extras?.accountId, email: extras?.email }, cleanSlot);
+ const duplicate = findClineAccountSlot(pool, { token: cleanToken, accountId: extras?.accountId, email: extras?.email }, cleanSlot);
  if (duplicate) {
   const who = extras?.email?.trim() || existing?.email?.trim() || "this account";
   throw new Error(`That Cline account (${who}) is already saved as [${duplicate}] — log in with a different account, or use /freeflow cline logout ${duplicate} first`);
  }
  if (existing) {
-  existing.token = token;
+  existing.token = cleanToken;
   // A fresh login is proof the grant works again: a quarantine recorded
   // against the credential it replaces must never outlive it.
   delete existing.deadUntil;
@@ -840,7 +861,7 @@ export function addAccount(
  } else {
   pool.accounts.push({
    slot: cleanSlot,
-   token,
+   token: cleanToken,
    addedAt: new Date().toISOString(),
    ...(extras?.refreshToken ? { refreshToken: extras.refreshToken } : {}),
    ...(extras?.expiresAt !== undefined && Number.isFinite(extras.expiresAt) && extras.expiresAt > 0
@@ -858,7 +879,7 @@ export function addAccount(
   // Re-read the way the relay deploy path does before blaming the write.
   let landed = false;
   try {
-   landed = loadPool().accounts.some((a) => a.slot === cleanSlot && a.token === token);
+   landed = loadPool().accounts.some((a) => a.slot === cleanSlot && a.token === cleanToken);
   } catch {
    landed = false;
   }
@@ -868,7 +889,7 @@ export function addAccount(
    );
   }
  }
- return pool;
+ return clonePool(pool);
 }
 
 /** Skew so a token expiring mid-flight counts as stale before it breaks a call. */
@@ -911,7 +932,8 @@ async function refreshAccountInPlace(
   void e;
   return null;
  }
- if (!fresh || typeof fresh.token !== "string" || (!fresh.token.startsWith("workos:") && !isWorkosJwt(fresh.token) && !fresh.token.startsWith("clp_"))) {
+ const freshToken = fresh !== null && typeof fresh.token === "string" ? fresh.token.trim() : "";
+ if (fresh === null || !freshToken || (!freshToken.startsWith("workos:") && !isWorkosJwt(freshToken) && !freshToken.startsWith("clp_"))) {
   // Cline rejected the grant outright: park the slot on disk so the next
   // turns skip it instead of re-paying a refresh that cannot succeed. The
   // credential stays in the pool — a fresh login into the slot clears this —
@@ -924,7 +946,7 @@ async function refreshAccountInPlace(
   patchAccountOnDisk(account.slot, { deadUntil: account.deadUntil });
   return false;
  }
- account.token = fresh.token;
+ account.token = freshToken;
  if (fresh.refreshToken) account.refreshToken = fresh.refreshToken;
  if (typeof fresh.expiresAt === "number" && Number.isFinite(fresh.expiresAt) && fresh.expiresAt > 0) {
   account.expiresAt = fresh.expiresAt;
@@ -1078,17 +1100,19 @@ async function peekStreamForInStreamError(res: Response): Promise<{ res: Respons
    };
   }
   const text = new TextDecoder().decode(value);
-  const isInStream429 = (
-   text.includes('"stream_initialization_failed"') ||
-   text.includes('"error":') ||
-   text.includes('"Rate limit exceeded"') ||
-   text.includes("Daily limit reached")
-  ) && (
-   text.includes("429") ||
-   /status["\s:]+429/i.test(text) ||
+  // Strict: only an in-stream initialization failure carrying a 429 signal
+  // converts. A 200 whose first chunk merely mentions "error" or "429" (model
+  // content, tool output) must pass through untouched.
+  const hasInitFailed = text.includes("stream_initialization_failed");
+  const has429Signal = (
+   /status[^0-9]{0,12}429/i.test(text) ||
+   /"code"\s*:\s*429/.test(text) ||
    /Rate limit exceeded/i.test(text) ||
-   /Daily limit reached/i.test(text)
+   /Daily limit reached/i.test(text) ||
+   /free limit reached/i.test(text) ||
+   /Daily free limit/i.test(text)
   );
+  const isInStream429 = hasInitFailed && has429Signal;
 
   if (isInStream429) {
    try { await reader.cancel(); } catch { }

package/src/cline-device-auth.ts

@@ -1,9 +1,8 @@
 /**
  * Cline WorkOS device-flow auth (extension login, no paste).
- * Mirrors C:/tmp/cline-login-proto/src/cline-auth.ts + reference/cline
- * sdk/packages/core/src/auth/cline.ts (device authorize / poll /
- * register / refresh) and provider-auth-registry.ts (expiry derive,
- * workos: prefix). All network goes through injectable fetchImpl;
+ * Mirrors the Cline device authorize / poll / register / refresh flow
+ * (sdk device-auth plus provider-auth-registry expiry derive, workos:
+ * prefix). All network goes through injectable fetchImpl;
  * mocked tests only, no live calls here.
  */
 

package/src/commands.ts

@@ -1228,7 +1228,7 @@ export function createCommandSpec(
      if (cached && typeof cached.latest === "string") {
       latest = cached.latest;
      }
-     if (latest && compareVersions(latest, local) > 0) {
+     if (latest && local && compareVersions(latest, local) > 0) {
       ctx.ui.notify(
        `Update available: ${local} -> ${latest} - run /freeflow update`,
        "info",
@@ -1325,11 +1325,12 @@ export function createCommandSpec(
        ctx.ui.notify("Could not check latest version (offline?)", "warning");
       } else {
        const local = getLocalVersion();
-       const cmp = compareVersions(latest, local);
+       // Null local (unreadable package.json) can never prove up-to-date: run.
+       const cmp = local === null ? 1 : compareVersions(latest, local);
        if (cmp <= 0) {
         ctx.ui.notify(`Already on latest (v${local})`, "info");
        } else {
-        ctx.ui.notify(`Update available: v${local} → v${latest} — updating…`, "info");
+        ctx.ui.notify(`Update available: v${local ?? "unknown"} → v${latest} — updating…`, "info");
         // Host plugin managers first (neither host has an `update` action for
         // registry plugins: omp updates by reinstall, pi updates the named
         // package). Global npm/bun is the last resort, not the default.