pi-freeflow 1.44.1 → 1.45.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 1.45.0
+
+### Minor Changes
+
+- Synchronize the free model catalog with live upstreams and resolve cross-platform runtime, stream lifecycle, and process management issues across Windows and Linux (Node 22/24/26, Bun, Pi, and OMP).
+  
+  - **Catalog Sync (30 Models Total)**:
+    - Add 3 live verified OpenCode Zen models: `crouton-alpha-free` (1M context, 270K output), `iceman-free` (262K context, 131K output), and `inkling-2-small-free` (1M context, 131K output, multimodal).
+    - Add `liquid/lfm-3-1.7b:free` on KiloCode Gateway.
+    - Retire 6 discontinued KiloCode models confirmed 404 upstream (`poolside/laguna-s-2.1:free`, `poolside/laguna-xs-2.1:free`, `liquid/lfm-2.5-2.6b:free`, `reflection/beam-free`, `recursive/flint-v1.0:free`, `xingchen-agi/xing4.0-29b-a4b:free`) and dead-list them to prevent revival from stale caches.
+    - Update model aliases with clean mappings (`crouton`, `iceman`, `inkling-2-small`, `lfm-3`).
+  
+  - **Cross-Platform & Stream Lifecycle Fixes**:
+    - Add a `destroy` hook to the Zen sidecar stream and terminate orphaned child processes on stream cancellation, client disconnect, or stall timeouts.
+    - Support Windows `.cmd`/`.bat` runtime shims in child process spawns with `shell: true` and argument quoting, avoiding `EINVAL` under Node 22+.
+    - Fix `isDaemonMain()` to resolve symlinks and compare paths case-insensitively on Windows so symlinked daemon launches and lowercase drive paths start normally.
+    - Ensure client leases detach cleanly on `session_shutdown` and process exit across Node 22/24/26 and Bun.
+    - Filter `lsof` with `-sTCP:LISTEN` on Linux so active client sessions sharing port 28180 are never killed.
+    - Prioritize live registry versions and disk caches over installed 1.x binaries during User-Agent generation to fix version-drift auto-repair.
+    - Prevent tool argument corruption in `stream-cloak.ts` when function names repeat across stream deltas.
+    - Fix the hedged relay race so transient errors on one leg do not prematurely cancel healthy in-flight responses.
+    - Add single-flight deduplication and lockfile serialization to Cline token refreshes to prevent concurrent subagent requests from invalidating single-use refresh tokens.
+
 ## 1.44.1
 
 ### Patch Changes

package/README.md

@@ -19,7 +19,7 @@ Thin by design: a model list, a relay proxy, and a log. The host (`pi-ai`) handl
 | **32 free models** | 8 from OpenCode Zen, 15 from KiloCode Gateway, 1 from Cline, 8 from OVHcloud AI Endpoints, context windows up to 1M. Full list below. | **$0** |
 | **Relay pool** | Route requests through your own relays: a self-hosted egress pool (many egress IPs on one small host) or Cloudflare Workers / Deno Deploy / Vercel Edge workers. Traffic spreads across the pool, or stays on one sticky relay. A relay that rate-limits, times out, or drops the connection cools down while healthy ones take its traffic. | **$0** beyond your host or platforms' free tiers |
 | **Automatic fallback** | When every relay is cooling down, requests go direct to upstream instead of failing. | **$0** |
-| **Short model names** | Most models have a slash-free, colon-free alias, plus an optional `:effort` suffix for thinking depth. You type `freeflow/<name>`; the Cline model has no alias and must be typed in full. | **$0** |
+| **Short model names** | Most models have a slash-free, colon-free alias, plus an optional `:effort` suffix for thinking depth. You type `freeflow/<name>` (including `cline-super-vl` for Cline). | **$0** |
 | **Shared local proxy** | One daemon on `127.0.0.1:28180` serves every session on the machine, so parallel subagents reuse it instead of opening their own connections. Loopback-only and token-gated: hosts send the token automatically, external tools read `~/.pi/agent/token`. | **$0** |
 | **Logs you can read** | `~/.pi/agent/pi-freeflow.log`, rotated at 10MB. Tail it with `/freeflow logs`. | **$0** |
 | **Tool-call diagnostics** | `~/.pi/agent/toolcall-audit.jsonl`, rotated at 5MB. One line per streamed turn that declared tools (and per non-streamed Chat Completions turn) — the calls it made, argument size and validity, finish reason, classified failure — plus one line per abandoned upstream attempt. Names, sizes and reasons only. | **$0** |
@@ -134,13 +134,13 @@ For `api/relay.js`, use the canonical worker source (see below); `vercel.json` s
 
 **Canonical worker source (all platforms)**
 
-The relay worker template is generated per deployment by `/freeflow deploy`, with one shared core adapted for Vercel, Cloudflare, and Deno. Every deploy embeds a random 32-byte secret, and the generated worker answers `401` to any request without a matching `x-relay-auth` header; the client sends that secret to each relay in the pool. Only a hand-pasted legacy worker built without a secret is open to anyone. Either way, a relay forwards only to an allowlist (`https://opencode.ai`, `https://api.kilo.ai`) with private-host and path checks.
+The relay worker template is generated per deployment by `/freeflow deploy`, with one shared core adapted for Vercel, Cloudflare, and Deno. Every deploy embeds a random 32-byte secret, and the generated worker answers `401` to any request without a matching `x-relay-auth` header; the client sends that secret to each relay in the pool. Only a hand-pasted legacy worker built without a secret is open to anyone. Either way, a relay forwards only to an allowlist (`https://opencode.ai`, `https://api.kilo.ai`, `https://oai.endpoints.kepler.ai.cloud.ovh.net`) with private-host and path checks.
 
 ```js
 // Minimal Cloudflare illustration. Prefer /freeflow deploy: the generated
 // worker is the hardened source for all three platforms.
 // This example omits the private-host guard, path validation, and auth.
-const ALLOWED_TARGETS = ["https://opencode.ai", "https://api.kilo.ai"];
+const ALLOWED_TARGETS = ["https://opencode.ai", "https://api.kilo.ai", "https://oai.endpoints.kepler.ai.cloud.ovh.net"];
 export default {
   async fetch(req) {
     const target = req.headers.get("x-relay-target");
@@ -215,7 +215,7 @@ The same command set works identically in OMP and Pi:
 
 ---
 
-### 32 models, one command
+### 30 models, one command
 
 ```bash
 /model → freeflow → pick
@@ -225,7 +225,7 @@ Every model specification is reconciled against [models.dev](https://models.dev/
 
 The host catalog carries text and image inputs only. Upstream video and audio support (MiMo: audio + video; GLM 5.3 Flash: video + PDF; Nemotron Super VL and Nano Omni: video) is therefore not selectable from the picker and is not declared in `input`.
 
-#### OpenCode Zen (8 models), Chat Completions API
+#### OpenCode Zen (11 models), Chat Completions API
 
 Good defaults for long coding sessions and agentic work.
 
@@ -239,8 +239,11 @@ Good defaults for long coding sessions and agentic work.
 | `beam-free` | Reflection AI | **1M** (1.048.576) | **131K** (131.072) | `low … max` | ❌ |
 | `deepseek-v4.1-flash-free` | DeepSeek | **1M** (1.048.576) | **393K** (393.216) | `low / high / max` | ✅ |
 | `flint-40b-free` | Recursive | **262K** (262.144) | **65K** (65.536) | `low … max` | ❌ |
+| `crouton-alpha-free` | Stealth (Thinking Machines) | **1M** (1.048.576) | **270K** (270.000) | `minimal … max` | ✅ |
+| `iceman-free` | Stealth | **262K** (262.144) | **131K** (131.072) | `low / high / max` | ❌ |
+| `inkling-2-small-free` | Thinking Machines | **1M** (1.048.576) | **131K** (131.072) | `minimal … max` | ✅ |
 
-#### KiloCode Gateway (15 models), OpenRouter compatible
+#### KiloCode Gateway (10 models), OpenRouter compatible
 
 Keyless access. Most rows have a short alias (shown with the full ID in parentheses); a row that shows only the full ID has no short form.
 
@@ -251,16 +254,11 @@ Keyless access. Most rows have a short alias (shown with the full ID in parenthe
 | `nemotron-3-ultra-550b` (`nvidia/...:free`) | NVIDIA | **1M** (1.000.000) | **182K** (182.520) | `minimal…xhigh`\* | ❌ |
 | `nemotron-3.5-lightning` (`nvidia/nemotron-3.5-lightning:free`) | NVIDIA | **1M** (1.000.000) | **235K** (235.929) | `minimal…xhigh`\* | ❌ |
 | `north-mini-code` (`cohere/...:free`) | Cohere | **256K** (256.000) | **64K** (64.000) | `minimal…xhigh`\* | ❌ |
-| `laguna-s-2.1:free` (`poolside/...:free`) | Poolside | **1M** (1.048.576) | **131K** (131.072) | `minimal…xhigh`\* | ❌ |
-| `laguna-xs-2.1:free` (`poolside/...:free`) | Poolside | **262K** (262.144) | **32K** (32.768) | `minimal…xhigh`\* | ❌ |
-| `lfm-2.5` (`liquid/lfm-2.5-2.6b:free`) | Liquid AI | **128K** (128.000) | **32K** (32.768) | `minimal…xhigh`\* | ❌ |
+| `lfm-3` (`liquid/lfm-3-1.7b:free`) | Liquid AI | **262K** (262.144) | **8K** (8.192) | `minimal…xhigh`\* | ❌ |
 | `kilo-auto` (`kilo-auto/free`) | Kilo Gateway Auto | **256K** (256.000) | **10K** (10.000) | `minimal…xhigh`\* | ❌ |
 | `openrouter` (`openrouter/free`) | OpenRouter Free | **200K** (200.000) | **65K** (65.536) | `minimal…xhigh`\* | ✅ |
 | `glyph-cluster` (`stealth/glyph-cluster`) | Stealth preview (lab undisclosed) | **256K** (256.000) | **256K** (256.000) | `minimal…xhigh`\* | ❌ |
-| `nvidia/nemotron-3.5-super-vl:free` | NVIDIA | **1M** (1.000.000) | **131K** (131.072) | `minimal…xhigh`\* | ✅ |
-| `beam-kilo` (`reflection/beam-free`) | Reflection AI | **1M** (1.048.576) | **131K** (131.072) | `low…max`\* | ❌ |
-| `flint-kilo` (`recursive/flint-v1.0:free`) | Recursive | **262K** (262.144) | **65K** (65.536) | `minimal…xhigh`\* | ❌ |
-| `xing4.0` (`xingchen-agi/xing4.0-29b-a4b:free`) | XingChen | **262K** (262.144) | **235K** (235.929) | `minimal…xhigh`\* | ❌ |
+| `nemotron-3.5-super-vl-kilo` (`nvidia/nemotron-3.5-super-vl:free`) | NVIDIA | **1M** (1.000.000) | **131K** (131.072) | `minimal…xhigh`\* | ✅ |
 
 \* Levels are forwarded as-is through the OpenRouter-style nested `reasoning` parameter; effort mapping is decided by each model. MiMo collapses `minimal→low` and `xhigh→high` upstream, so its selector shows 5 labels but only 3 distinct effort values.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-freeflow",
   "type": "module",
-  "version": "1.44.1",
+  "version": "1.45.0",
   "description": "Thin provider for OMP/Pi — model list + dumb relay proxy + log; host pi-ai owns thinking/normalization",
   "main": "extensions/index.ts",
   "types": "src/index.ts",

package/src/catalog.ts

@@ -195,6 +195,25 @@ export const DEAD_MODEL_IDS = new Set<string>([
  // sibling Kilo id nvidia/nemotron-3-ultra-550b-a55b:free is a separate
  // serving route and is unaffected.
  "nemotron-3-ultra-free",
+ // poolside/laguna-s-2.1:free and poolside/laguna-xs-2.1:free: discontinued
+ // upstream on KiloCode (2026-11-09) — removed from live /api/gateway/models,
+ // answers HTTP 404 "The requested model does not exist" across all egresses.
+ "poolside/laguna-s-2.1:free",
+ "poolside/laguna-xs-2.1:free",
+ // liquid/lfm-2.5-2.6b:free: replaced upstream on KiloCode by liquid/lfm-3-1.7b:free
+ // (2026-11-09) — answers HTTP 404 "The requested model is currently unavailable".
+ "liquid/lfm-2.5-2.6b:free",
+ // reflection/beam-free: discontinued upstream on KiloCode (2026-11-09) —
+ // answers HTTP 404 "The requested model does not exist". The Zen beam-free
+ // twin is a separate serving route and remains active.
+ "reflection/beam-free",
+ // recursive/flint-v1.0:free: discontinued upstream on KiloCode (2026-11-09) —
+ // answers HTTP 404 "The requested model is currently unavailable". The Zen
+ // flint-40b-free twin is a separate serving route and remains active.
+ "recursive/flint-v1.0:free",
+ // xingchen-agi/xing4.0-29b-a4b:free: discontinued upstream on KiloCode (2026-11-09) —
+ // answers HTTP 404 "The requested model is currently unavailable".
+ "xingchen-agi/xing4.0-29b-a4b:free",
 ]);
 /**
  * Free-tier allowlist for anything entering the picker via network or stale disk.
@@ -336,25 +355,30 @@ export function enrichModelDef(raw: RawModelItem, source: Upstream): RegisteredM
  // Declared fields win over wire aliases: a listing that already names
  // contextWindow/maxTokens/reasoning keeps its values; the snake_case
  // upstream aliases and the id heuristics only fill gaps.
- let contextWindow =
-  typeof raw.contextWindow === "number" ? raw.contextWindow
-  : typeof raw.context_length === "number" ? raw.context_length : 262_144;
+ const validPosNum = (n: unknown): n is number =>
+  typeof n === "number" && Number.isFinite(n) && n > 0;
+ const declaredContext =
+  validPosNum(raw.contextWindow) ? raw.contextWindow
+  : validPosNum(raw.context_length) ? raw.context_length : undefined;
+ let contextWindow = declaredContext ?? 262_144;
  if (
-  idLower.includes("1m") ||
-  idLower.includes("ultra") ||
-  idLower.includes("lightning") ||
-  idLower.includes("mimo-v2.5") ||
-  idLower.includes("muse-spark")
+  declaredContext === undefined && (
+   idLower.includes("1m") ||
+   idLower.includes("ultra") ||
+   idLower.includes("lightning") ||
+   idLower.includes("mimo-v2.5") ||
+   idLower.includes("muse-spark")
+  )
  ) {
   contextWindow = 1_048_576;
  }
 
- let maxTokens =
-  typeof raw.maxTokens === "number" ? raw.maxTokens
-  : typeof raw.max_output_tokens === "number"
-   ? raw.max_output_tokens
-   : 65_536;
- if (idLower.includes("ultra") || idLower.includes("lightning")) {
+ const declaredMaxTokens =
+  validPosNum(raw.maxTokens) ? raw.maxTokens
+  : validPosNum(raw.max_output_tokens) ? raw.max_output_tokens
+  : validPosNum(raw.max_tokens) ? raw.max_tokens : undefined;
+ let maxTokens = declaredMaxTokens ?? 65_536;
+ if (declaredMaxTokens === undefined && (idLower.includes("ultra") || idLower.includes("lightning"))) {
   maxTokens = 131_072;
  }
 

package/src/client-recovery.ts

@@ -168,7 +168,10 @@ export async function triggerRecovery(port: number, why: string, deps: RecoveryD
   logWarn(`watchdog recovery (${why}) — backing off ${Math.round(delay)}ms before respawn`);
   deps.stopHeartbeatInternal();
   deps.resetHeartbeatPort();
-  await new Promise<void>((r) => setTimeout(r, delay));
+  const { promise: backoffDone, resolve: resolveBackoff } = Promise.withResolvers<void>();
+  const backoffTimer = setTimeout(resolveBackoff, delay);
+  try { backoffTimer.unref(); } catch { }
+  await backoffDone;
   try {
    const health = deps.getDaemonHealth ? await deps.getDaemonHealth(port) : null;
    if (health && (health.activeRequests ?? 0) > 0) {

package/src/client-staging.ts

@@ -5,11 +5,13 @@
  * required for Node's --experimental-strip-types execution.
  */
 
+import { spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { DAEMON_RUNTIME_ENV, resolveDaemonSrcCacheDir } from "./config.ts";
+import { renameWithRetry } from "./atomic-write.ts";
 import { logInfo, logWarn } from "./logger.ts";
 
 export interface DaemonRuntime {
@@ -25,7 +27,7 @@ export interface DaemonRuntime {
 export function isJsRuntimeExecutable(execPath: string): "bun" | "node" | null {
  if (!execPath || typeof execPath !== "string") return null;
  const checkName = (target: string): "bun" | "node" | null => {
-  const base = path.basename(target.replace(/\\/g, "/")).toLowerCase().replace(/\.exe$/i, "");
+  const base = path.basename(target.replace(/\\/g, "/")).toLowerCase().replace(/\.(?:exe|cmd|bat)$/i, "");
   if (base === "bun" || base === "bunx") return "bun";
   if (base === "node" || base === "nodejs") return "node";
   return null;
@@ -75,6 +77,54 @@ export function findExecutableOnPath(
  }
  return null;
 }
+/**
+ * Search directories in PATH for a Node.js binary meeting the >= 22.6 requirement
+ * for native type stripping (--experimental-strip-types).
+ */
+export function findSupportedNodeOnPath(
+ envPath: string = process.env.PATH || process.env.Path || "",
+): string | null {
+ if (!envPath || typeof envPath !== "string") return null;
+ const dirs = envPath.split(path.delimiter).filter(Boolean);
+ const extensions = process.platform === "win32"
+  ? (process.env.PATHEXT ? process.env.PATHEXT.split(";").filter(Boolean) : [".exe", ".cmd", ".bat"])
+  : [""];
+
+ for (const dir of dirs) {
+  for (const ext of extensions) {
+   const candidate = ext ? path.join(dir, `node${ext}`) : path.join(dir, "node");
+   try {
+    const stat = fs.statSync(candidate);
+    if (!stat.isFile()) continue;
+    if (process.platform !== "win32") {
+     fs.accessSync(candidate, fs.constants.X_OK);
+    }
+    if (stat.size === 0) {
+     return candidate;
+    }
+    const res = spawnSync(candidate, ["--version"], {
+     encoding: "utf8",
+     timeout: 1500,
+     windowsHide: true,
+     shell: process.platform === "win32" && /\.(?:cmd|bat)$/i.test(candidate),
+    });
+    if (res.status === 0) {
+     const match = (res.stdout || "").match(/^v?(\d+)\.(\d+)\./);
+     if (match) {
+      const major = Number(match[1]);
+      const minor = Number(match[2]);
+      if (major < 22 || (major === 22 && minor < 6)) {
+       continue;
+      }
+     }
+    }
+    return candidate;
+   } catch { }
+  }
+ }
+ return null;
+}
+
 
 /**
  * Resolve the executable and arguments needed to run src/daemon.ts.
@@ -122,7 +172,7 @@ export function resolveDaemonRuntime(opts?: {
   return { execPath: bunOnPath, args: [script], runtimeType: "bun" };
  }
 
- const nodeOnPath = findExecutableOnPath("node", pathVal);
+ const nodeOnPath = findSupportedNodeOnPath(pathVal);
  if (nodeOnPath) {
   return {
    execPath: nodeOnPath,
@@ -241,7 +291,7 @@ export function materializeDaemonSources(scriptPath: string, cacheDir?: string):
   fs.copyFileSync(path.join(pkgRoot, "package.json"), path.join(tmpDir, "package.json"));
   stageRuntimeDependencies(pkgRoot, pkgJson, tmpDir);
   try {
-   fs.renameSync(tmpDir, finalDir);
+   renameWithRetry(tmpDir, finalDir);
    logInfo(`staged proxy daemon sources outside node_modules at ${finalDir}`);
   } catch (e) {
    // A concurrent starter won the rename (or the dir appeared meanwhile):

package/src/client.ts

@@ -49,6 +49,7 @@ import { tokenAuthHeaders } from "./token.ts";
 import {
  daemonScriptPath,
  findExecutableOnPath,
+ findSupportedNodeOnPath,
  isJsRuntimeExecutable,
  isUnderNodeModules,
  materializeDaemonSources,
@@ -81,6 +82,7 @@ import {
 export {
  daemonScriptPath,
  findExecutableOnPath,
+ findSupportedNodeOnPath,
  isJsRuntimeExecutable,
  isUnderNodeModules,
  materializeDaemonSources,
@@ -245,19 +247,24 @@ function stopHeartbeatInternal(): void {
  }
 }
 
-export function stopHeartbeat(): void {
+export async function stopHeartbeat(): Promise<void> {
  const port = heartbeatPort;
+ const hadFallback = fallbackServer !== null;
  stopHeartbeatInternal();
  heartbeatPort = 0;
- if (port) {
-  void controlCall(port, "/_client/detach", { id: CLIENT_ID });
- }
  if (fallbackServer) {
   try {
+   fallbackServer.closeIdleConnections?.();
+   fallbackServer.closeAllConnections?.();
    fallbackServer.close();
   } catch { }
   fallbackServer = null;
  }
+ if (port && !hadFallback) {
+  try {
+   await controlCall(port, "/_client/detach", { id: CLIENT_ID });
+  } catch { }
+ }
 }
 
 async function beatOnce(port: number): Promise<void> {
@@ -272,14 +279,15 @@ async function beatOnce(port: number): Promise<void> {
  }
 }
 
-async function attachTo(port: number): Promise<void> {
+async function attachTo(port: number): Promise<boolean> {
  attachedPort = port;
  const result = await controlCall(port, "/_client/attach", { id: CLIENT_ID });
  if (result === "gone") {
-  return;
+  return false;
  }
  startHeartbeat(port);
  maybeRefreshOpenCodeUserAgent();
+ return true;
 }
 
 async function ensureInProcessFallback(): Promise<number> {
@@ -304,7 +312,7 @@ const recoveryDeps: RecoveryDeps = {
  resetHeartbeatPort: () => {
   heartbeatPort = 0;
  },
- attachTo,
+ attachTo: async (p: number) => { await attachTo(p); },
  killStaleDaemon: (p, v, w) => killStaleDaemon(p, v, w),
  ensureDaemon: () => ensureDaemon(),
  getDaemonHealth: (p: number) => getDaemonHealth(p),
@@ -606,20 +614,31 @@ function spawnDaemonProcess(): DaemonChild | null {
  lastSpawnAt = now;
  const logFd = openDaemonLogFd();
  try {
-  const child = daemonSpawner(runtime.execPath, args, {
-   detached: true,
-   stdio: logFd === null ? "ignore" : ["ignore", logFd, logFd],
-   windowsHide: true,
-   env: {
-    ...process.env,
-    [DAEMON_SPAWN_ENV]: "0",
-   },
-  });
+  const child = process.platform === "win32" && /\.(?:cmd|bat)$/i.test(runtime.execPath) && daemonSpawner === spawn
+   ? daemonSpawner(`"${runtime.execPath}" ${args.map((a) => `"${a}"`).join(" ")}`, [], {
+    detached: true,
+    stdio: logFd === null ? "ignore" : ["ignore", logFd, logFd],
+    windowsHide: true,
+    shell: true,
+    env: {
+     ...process.env,
+     [DAEMON_SPAWN_ENV]: "0",
+    },
+   })
+   : daemonSpawner(runtime.execPath, args, {
+    detached: true,
+    stdio: logFd === null ? "ignore" : ["ignore", logFd, logFd],
+    windowsHide: true,
+    env: {
+     ...process.env,
+     [DAEMON_SPAWN_ENV]: "0",
+    },
+   });
   child.unref();
   logInfo(
    `spawned proxy daemon process (pid ${child.pid ?? "unknown"}) using ${runtime.runtimeType} (${runtime.execPath}) for :${PORT}${stagedScript === scriptArg ? "" : " [staged sources]"}`,
   );
-  child.on("error", (err) => {
+  child.on("error", (err: Error) => {
    failedDaemonSpawns.add(child);
    logWarn("daemon spawn failed", { error: String(err), execPath: runtime.execPath });
   });
@@ -731,8 +750,7 @@ export async function ensureDaemon(): Promise<number> {
 async function ensureDaemonAttempt(): Promise<number> {
   const primary = await probeAndMaybeReplace(PORT, "proxy daemon");
   if (primary !== null) {
-   await attachTo(primary);
-   return primary;
+   if (await attachTo(primary)) return primary;
   }
 
 

package/src/cline-accounts.ts

@@ -6,7 +6,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { writeFileAtomic } from "./atomic-write.ts";
 import type { FetchImpl } from "./cline-device-auth.ts";
-import { refreshClineToken, toApiKey } from "./cline-device-auth.ts";
+import { ClineAuthError, refreshClineToken, toApiKey } from "./cline-device-auth.ts";
 import { fetchWithSystemCA } from "./system-ca-fetch.ts";
 import {
  CLINE_POOL_FILE,
@@ -114,12 +114,15 @@ export async function refreshClineVersion(fetchImpl: FetchImpl = fetchWithSystem
  return getClineVersion();
 }
 
-async function defaultClineRefresher(refreshToken: string): Promise<ClineRefreshResult | null> {
+export async function defaultClineRefresher(refreshToken: string): Promise<ClineRefreshResult | null> {
  try {
   const creds = await refreshClineToken(undefined, refreshToken);
   return { token: toApiKey(creds.access), refreshToken: creds.refresh, expiresAt: creds.expires };
- } catch {
-  return null;
+ } catch (e) {
+  if (e instanceof ClineAuthError && e.status !== undefined && e.status >= 400 && e.status < 500) {
+   return null;
+  }
+  throw e;
  }
 }
 

package/src/cline-device-auth.ts

@@ -250,14 +250,16 @@ export async function pollDeviceToken(
      device_code: deviceCode,
      client_id: resolveClineWorkosClientId(),
     }),
-    signal: AbortSignal.timeout(options?.timeoutMs ?? HTTP_TIMEOUT_MS),
+    signal: options?.signal
+     ? AbortSignal.any([options.signal, AbortSignal.timeout(options?.timeoutMs ?? HTTP_TIMEOUT_MS)])
+     : AbortSignal.timeout(options?.timeoutMs ?? HTTP_TIMEOUT_MS),
    });
   } catch (error) {
    if (outerSignal?.aborted) {
     throw new ClineAuthError("Device login cancelled", { errorCode: "cancelled" });
    }
    if (error instanceof ClineAuthError) throw error;
-   if (Date.now() > deadline) throw new Error("WorkOS device authorization timed out");
+   if (Date.now() >= deadline) throw new Error("WorkOS device authorization timed out");
    await sleepMs(remainingMs(deadline, interval), outerSignal);
    continue;
   }
@@ -289,7 +291,7 @@ export async function pollDeviceToken(
     { status: response.status, errorCode: typeof payload.error === "string" ? payload.error : undefined },
    );
   }
-  if (Date.now() > deadline) throw new Error("WorkOS device authorization timed out");
+  if (Date.now() >= deadline) throw new Error("WorkOS device authorization timed out");
   await sleepMs(remainingMs(deadline, interval), outerSignal);
  }
 }