pi-freeflow 1.8.0 → 1.8.2

package/README.md

@@ -269,7 +269,7 @@ Current size: about 11.3k lines including tests. 230 tests pass, typecheck clean
 ### FAQ
 
 **Do I need API keys?**
-No. Kilo uses `Bearer kilo-free`, OpenCode uses `opencodeHeaders()`.
+No. Kilo uses `Bearer kilo-free`, OpenCode free models are anonymous (no header needed).
 
 **What if all relays are 429?**
 Proxy tries direct. If that is also 429, Pi shows the rate limit. That number is the global upstream cap; without relays you would hit the same wall.
@@ -277,6 +277,12 @@ Proxy tries direct. If that is also 429, Pi shows the rate limit. That number is
 **Can I use without relays?**
 Yes. `/freeflow off` → direct. Add relays later to scale.
 
+**What happens when I update to a new version?**
+The local proxy daemon is shared across sessions on port 28180. On upgrade, the new extension
+detects a stale daemon (mismatched internal version) and replaces it automatically — no manual
+kill, no restart of other sessions required. If an old daemon cannot be replaced (e.g. port held
+by an unrelated process), it falls back to reusing it with a warning.
+
 **Where's the normalizer?**
 Deleted in 1.3.0. If zai/qwen/deepseek thinking broke before, it's fixed now because host handles it.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-freeflow",
   "type": "module",
-  "version": "1.8.0",
+  "version": "1.8.2",
   "description": "Thin provider for OMP/Pi — model list + dumb relay proxy + log; host pi-ai owns thinking/normalization",
   "main": "extensions/index.ts",
   "types": "src/index.ts",

package/src/catalog.ts

@@ -191,7 +191,28 @@ export function readCatalogCache(): CatalogCacheData | null {
 /**
  * Atomically write catalog cache data to disk using temporary file + rename.
  * Persists etag alongside models for subsequent If-None-Match conditional requests.
+ * Note: fsync not needed — rename is atomic on same filesystem; crash leaves either old or new file intact.
  */
+function sleepSync(ms: number): void {
+	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function renameWithRetry(from: string, to: string): void {
+	const retryable: Record<string, true> = { EPERM: true, EACCES: true, EBUSY: true };
+	for (let attempt = 1; ; attempt++) {
+		try {
+			fs.renameSync(from, to);
+			return;
+		} catch (e) {
+			const code = (e as NodeJS.ErrnoException | null)?.code;
+			if (!code || !retryable[code] || attempt >= 3) {
+				throw e;
+			}
+			sleepSync(50);
+		}
+	}
+}
+
 export function writeCatalogCache(data: CatalogCacheData): void {
 	try {
 		const dir = path.dirname(CATALOG_CACHE_FILE);
@@ -200,7 +221,7 @@ export function writeCatalogCache(data: CatalogCacheData): void {
 		}
 		const tmpPath = `${CATALOG_CACHE_FILE}.${randomUUID()}.tmp`;
 		fs.writeFileSync(tmpPath, JSON.stringify(data, null, 2), "utf8");
-		fs.renameSync(tmpPath, CATALOG_CACHE_FILE);
+		renameWithRetry(tmpPath, CATALOG_CACHE_FILE);
 	} catch (err) {
 		logWarn("Could not persist catalog cache to disk", { error: String(err) });
 	}

package/src/commands.ts

@@ -350,12 +350,13 @@ export function createCommandSpec(
 					const { url, auth } = await deployer(token, name, (m) =>
 						ctx.ui.notify(m, "info"),
 					);
-					setRelay(true, url, `deployed ${name}`);
-					// Persist the per-deployment shared secret with the relay entry
-					// (setRelay wrote without it; this save must include it).
-					const deployed = relayState.relays.find((r) => r.url === url);
-					if (deployed) deployed.auth = auth;
-					setActiveRelayState(relayState);
+					relayState = withRelayState((s) => {
+						const r = ensureRelay(s, url, `deployed ${name}`);
+						r.auth = auth;
+						s.enabled = true;
+						s.url = url;
+						return s;
+					});
 					persist();
 					let probeNote = "";
 					try {
@@ -589,12 +590,17 @@ export function createCommandSpec(
 					const tokens = rest.trim().split(/\s+/);
 					const targetUrl = tokens[0];
 					const customLabel = tokens.slice(1).join(" ").trim() || undefined;
-					applyRelayState((s) => {
-						const added = ensureRelay(s, targetUrl, customLabel);
-						s.enabled = true;
-						s.url = added.url;
-						return s;
-					});
+					try {
+						applyRelayState((s) => {
+							const added = ensureRelay(s, targetUrl, customLabel);
+							s.enabled = true;
+							s.url = added.url;
+							return s;
+						});
+					} catch (e) {
+						ctx.ui.notify((e as Error).message, "warning");
+						return;
+					}
 					persist();
 					flash();
 					ctx.ui.notify(
@@ -632,12 +638,17 @@ export function createCommandSpec(
 						} catch {}
 						const looksLikeUrl = parsedUrl && (parsedUrl.protocol === "http:" || parsedUrl.protocol === "https:");
 						if (looksLikeUrl) {
-							applyRelayState((s) => {
-								const added = ensureRelay(s, targetToken, customLabel);
-								s.enabled = true;
-								s.url = added.url;
-								return s;
-							});
+							try {
+								applyRelayState((s) => {
+									const added = ensureRelay(s, targetToken, customLabel);
+									s.enabled = true;
+									s.url = added.url;
+									return s;
+								});
+							} catch (e) {
+								ctx.ui.notify((e as Error).message, "warning");
+								return;
+							}
 							persist();
 							flash();
 						} else {

package/src/config.ts

@@ -6,8 +6,21 @@ import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { readFileSync } from "node:fs";
 import type { Upstream } from "./types.ts";
 
+// Package version — stale-daemon detection in the shared-port reuse path.
+let PKG_VERSION = "0.0.0";
+try {
+	const pkgPath = path.join(path.dirname(fileURLToPath(import.meta.url)), "../package.json");
+	const raw: unknown = JSON.parse(readFileSync(pkgPath, "utf8"));
+	if (raw && typeof raw === "object" && "version" in raw) {
+		const v = raw.version;
+		if (typeof v === "string" && v) PKG_VERSION = v;
+	}
+} catch {}
+export { PKG_VERSION };
+
 // ── Upstream endpoints ──────────────────────────────────────────────
 export const UPSTREAM_OPENCODE = "https://opencode.ai/zen";
 export const KILO_CHAT_URL = "https://api.kilo.ai/api/gateway/chat/completions";
@@ -62,7 +75,7 @@ export const RATE_LIMIT_MAX: Record<Upstream, number> = {
 };
 
 // ── Whitelists & Security ───────────────────────────────────────────
-export const ALLOWED_PATH_PATTERN = /^\/v1\/[a-zA-Z0-9/_.,\-?&=]*$/;
+export const ALLOWED_PATH_PATTERN = /^\/v1\/[a-zA-Z0-9/_.,\-?&= %]*$/;
 export const PATH_TRAVERSAL_PATTERN = /\.\./;
 export const ALLOWED_METHODS = new Set(["GET", "POST", "OPTIONS", "HEAD"]);
 

package/src/deploy.ts

@@ -75,6 +75,8 @@ const timingSafeEqualStr = function(a, b) {
 // (never forwarded upstream) instead of living in the denylist.
 const DENY_HEADERS = ["host", "connection", "content-length", "keep-alive", "proxy-connection", "proxy-authenticate", "proxy-authorization", "transfer-encoding", "te", "trailer", "upgrade", "x-relay-target", "x-relay-path"];
 async function relayHandler(req) {
+  if (!["GET", "POST", "HEAD", "OPTIONS"].includes(req.method)) return new Response("Method Not Allowed", { status: 405 });
+  if (Number(req.headers.get("content-length") || 0) > 32 * 1024 * 1024) return new Response("Payload Too Large", { status: 413 });
   const target = req.headers.get("x-relay-target");
   if (!target) return new Response(JSON.stringify({ error: "Missing x-relay-target header" }), { status: 400, headers: { "content-type": "application/json" } });
   if (RELAY_AUTH && !timingSafeEqualStr(req.headers.get("x-relay-auth") || "", RELAY_AUTH)) {
@@ -159,11 +161,11 @@ export async function deployVercelRelay(
 	name: string,
 	onProgress?: (msg: string) => void,
 ): Promise<{ url: string; auth: string }> {
+	name = baseRelayName(name) || "relay-worker";
 	const auth = {
 		Authorization: `Bearer ${token}`,
 		"Content-Type": "application/json",
 	};
-
 	// 1. Create deployment (3 inline files, no git repository required)
 	onProgress?.("Uploading relay files to Vercel…");
 	log("info", `Starting Vercel deployment: ${name}`);

package/src/health.ts

@@ -6,8 +6,7 @@
 import type * as http from "node:http";
 import { ALL_MODELS } from "./models.ts";
 import { getActiveRelayState, getRelayHealth, isRelayHealthy } from "./relay-state.ts";
-import { PORT } from "./config.ts";
-import { getClientIP } from "./proxy.ts";
+import { PKG_VERSION, PORT } from "./config.ts";
 
 export interface HealthRelayInfo {
 	url: string;
@@ -24,8 +23,8 @@ export interface HealthData {
 	enabled: boolean;
 	relays: HealthRelayInfo[];
 	catalog: number;
+	version: string;
 }
-
 /**
  * Collect current health snapshot.
  * @param portOverride - actual listening port (defaults to config PORT)
@@ -50,12 +49,14 @@ export function getHealthData(portOverride?: number): HealthData {
 		enabled: Boolean(state.enabled),
 		relays,
 		catalog: ALL_MODELS.length,
+		version: PKG_VERSION,
 	};
 }
 
 function isLoopbackIP(ip: string): boolean {
 	if (!ip) return false;
-	const clean = ip.startsWith("::ffff:") ? ip.slice(7) : ip;
+	const withoutZone = ip.split("%")[0];
+	const clean = withoutZone.startsWith("::ffff:") ? withoutZone.slice(7) : withoutZone;
 	return clean === "127.0.0.1" || clean === "::1" || clean === "localhost";
 }
 
@@ -76,13 +77,18 @@ export function handleHealthRequest(
 		return false;
 	}
 
-	const isHealthPath =
-		pathname === "/_health" || pathname === "/health" || pathname.endsWith("/health");
+	const isHealthPath = pathname === "/_health" || pathname === "/health";
 	if (req.method !== "GET" || !isHealthPath) {
 		return false;
 	}
 
-	const clientIP = getClientIP(req);
+	const sock: unknown = req.socket;
+	let rawIp = "";
+	if (sock && typeof sock === "object" && "remoteAddress" in sock) {
+		const v = sock.remoteAddress;
+		if (typeof v === "string") rawIp = v;
+	}
+	const clientIP = rawIp.startsWith("::ffff:") ? rawIp.slice(7) : rawIp;
 	if (!isLoopbackIP(clientIP)) {
 		const body = JSON.stringify({ error: "forbidden" });
 		res.writeHead(403, { "content-type": "application/json", "content-length": Buffer.byteLength(body) });

package/src/index.ts

@@ -18,10 +18,10 @@ import {
 	setAliveCatalog,
 } from "./catalog.ts";
 import { createCommandSpec, updateStatusBar } from "./commands.ts";
-import { HOST, LEGACY_PORT, ONBOARDED_FLAG_FILE, PORT } from "./config.ts";
+import { HOST, LEGACY_PORT, ONBOARDED_FLAG_FILE, PKG_VERSION, PORT } from "./config.ts";
 import { log, logInfo, logWarn } from "./logger.ts";
 import { ALL_MODELS, KILO_MODEL_IDS, MODEL_MAP, resolveCanonicalModelId } from "./models.ts";
-import { isProxyAlive, startProxy } from "./proxy.ts";
+import { getDaemonVersion, isProxyAlive, killPortHolder, startProxy } from "./proxy.ts";
 import { resetRateLimits } from "./rate-limiter.ts";
 import { checkForUpdateInBackground } from "./update-checker.ts";
 import {
@@ -150,7 +150,7 @@ export function buildProviderConfig(
 						: m.source === "kilo"
 							? {
 									supportsDeveloperRole: false,
-									supportsReasoningEffort: false,
+									supportsReasoningEffort: !!m.thinkingLevelMap,
 								}
 							: {
 									supportsDeveloperRole: false,
@@ -174,18 +174,81 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 	// 2. Single-Port Shared Pattern: Check if daemon is already running (e.g. parent session)
 	// Dual-probe: probe current PORT first; if missing, check LEGACY_PORT so existing v1.4.9
 	// sessions on 18080 are seamlessly reused without split-brain or duplicate daemons.
+	// Stale-daemon heal: if the alive daemon reports a different version (e.g. 1.7.1 vs 1.8.0
+	// after an upgrade), the auth fix never loads for the new session. Detect via /_health
+	// and best-effort replace the stale holder so old users are auto-healed.
 	let alreadyRunning = await isProxyAlive(PORT);
 	if (alreadyRunning) {
-		logInfo(
-			`Reusing existing pi-freeflow proxy daemon on http://${HOST}:${PORT}`,
-		);
-		actualPort = PORT;
+		const remoteVer = await getDaemonVersion(PORT);
+		if (remoteVer !== null && remoteVer !== PKG_VERSION) {
+			logWarn(`stale proxy daemon v${remoteVer} on :${PORT} (need v${PKG_VERSION}) — replacing`, {
+				remoteVer,
+				expected: PKG_VERSION,
+			});
+			const killed = await killPortHolder(PORT);
+			if (killed) {
+				for (let i = 0; i < 10; i++) {
+					await new Promise<void>((r) => setTimeout(r, 200));
+					if (!(await isProxyAlive(PORT))) break;
+				}
+			}
+			if (!(await isProxyAlive(PORT))) {
+				try {
+					const r = await startProxy();
+					server = r.server;
+					actualPort = r.port;
+					alreadyRunning = false;
+				} catch (e) {
+					log("error", "stale daemon replaced but fresh bind failed — reusing stale as fallback", {
+						error: String(e),
+					});
+					actualPort = PORT;
+				}
+			} else {
+				logInfo(`Reusing existing pi-freeflow proxy daemon on http://${HOST}:${PORT} (stale kill did not free port)`);
+				actualPort = PORT;
+			}
+		} else {
+			logInfo(`Reusing existing pi-freeflow proxy daemon on http://${HOST}:${PORT}`);
+			actualPort = PORT;
+		}
 	} else if (PORT !== LEGACY_PORT && (await isProxyAlive(LEGACY_PORT))) {
-		logInfo(
-			`Reusing existing legacy pi-freeflow proxy daemon on http://${HOST}:${LEGACY_PORT}`,
-		);
-		alreadyRunning = true;
-		actualPort = LEGACY_PORT;
+		const remoteVer = await getDaemonVersion(LEGACY_PORT);
+		if (remoteVer !== null && remoteVer !== PKG_VERSION) {
+			logWarn(`stale legacy daemon v${remoteVer} on :${LEGACY_PORT} (need v${PKG_VERSION}) — replacing`, {
+				remoteVer,
+				expected: PKG_VERSION,
+			});
+			const killed = await killPortHolder(LEGACY_PORT);
+			if (killed) {
+				for (let i = 0; i < 10; i++) {
+					await new Promise<void>((r) => setTimeout(r, 200));
+					if (!(await isProxyAlive(LEGACY_PORT))) break;
+				}
+			}
+			if (!(await isProxyAlive(LEGACY_PORT)) && !(await isProxyAlive(PORT))) {
+				try {
+					const r = await startProxy();
+					server = r.server;
+					actualPort = r.port;
+					alreadyRunning = false;
+				} catch (e) {
+					log("error", "stale legacy daemon replaced but fresh bind failed — reusing as fallback", {
+						error: String(e),
+					});
+					alreadyRunning = true;
+					actualPort = LEGACY_PORT;
+				}
+			} else {
+				logInfo(`Reusing existing legacy pi-freeflow proxy daemon on http://${HOST}:${LEGACY_PORT}`);
+				alreadyRunning = true;
+				actualPort = LEGACY_PORT;
+			}
+		} else {
+			logInfo(`Reusing existing legacy pi-freeflow proxy daemon on http://${HOST}:${LEGACY_PORT}`);
+			alreadyRunning = true;
+			actualPort = LEGACY_PORT;
+		}
 	} else {
 		try {
 			const r = await startProxy();
@@ -200,8 +263,6 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 			return;
 		}
 	}
-
-	// 3. Instant 0ms Static Catalog Registration
 	// Register static models immediately on boot so Pi/OMP picker is populated with zero latency!
 	const registeredCatalog: RegisteredModel[] = ALL_MODELS.map((m) => ({
 		...m,
@@ -215,27 +276,80 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 			buildProviderConfig(models, actualPort),
 		);
 	};
-	registerCatalog(registeredCatalog);
-	// Self-heal: if this session attached to an external daemon that later died,
-	// re-bind on the next lifecycle event so model calls recover without a restart.
 	let ensuringDaemon = false;
 	const ensureDaemon = async (): Promise<void> => {
 		if (ensuringDaemon) return;
 		ensuringDaemon = true;
 		try {
-			if (await isProxyAlive(actualPort)) return;
-			// If actualPort died, check if another daemon is alive on PORT or LEGACY_PORT before binding
+			if (await isProxyAlive(actualPort)) {
+				const v = await getDaemonVersion(actualPort);
+				if (v === null || v === PKG_VERSION) return;
+				logWarn(`proxy on :${actualPort} is stale v${v} (need v${PKG_VERSION}) — replacing`, {
+					remoteVer: v,
+					expected: PKG_VERSION,
+				});
+				const killed = await killPortHolder(actualPort);
+				if (killed) {
+					for (let i = 0; i < 10; i++) {
+						await new Promise<void>((r) => setTimeout(r, 200));
+						if (!(await isProxyAlive(actualPort))) break;
+					}
+				}
+				if (await isProxyAlive(actualPort)) return;
+			}
 			if (await isProxyAlive(PORT)) {
-				actualPort = PORT;
-				registerCatalog(getAliveCatalog());
-				logInfo(`Re-attached to proxy daemon on http://${HOST}:${PORT}`);
-				return;
+				const v = await getDaemonVersion(PORT);
+				if (v !== null && v !== PKG_VERSION) {
+					logWarn(`proxy on :${PORT} is stale v${v} (need v${PKG_VERSION}) — replacing`, {
+						remoteVer: v,
+						expected: PKG_VERSION,
+					});
+					const killed = await killPortHolder(PORT);
+					if (killed) {
+						for (let i = 0; i < 10; i++) {
+							await new Promise<void>((r) => setTimeout(r, 200));
+							if (!(await isProxyAlive(PORT))) break;
+						}
+					}
+					if (await isProxyAlive(PORT)) {
+						actualPort = PORT;
+						registerCatalog(getAliveCatalog());
+						logInfo(`Re-attached to proxy daemon on http://${HOST}:${PORT} (stale kill did not free port)`);
+						return;
+					}
+				} else {
+					actualPort = PORT;
+					registerCatalog(getAliveCatalog());
+					logInfo(`Re-attached to proxy daemon on http://${HOST}:${PORT}`);
+					return;
+				}
 			}
 			if (PORT !== LEGACY_PORT && (await isProxyAlive(LEGACY_PORT))) {
-				actualPort = LEGACY_PORT;
-				registerCatalog(getAliveCatalog());
-				logInfo(`Re-attached to legacy proxy daemon on http://${HOST}:${LEGACY_PORT}`);
-				return;
+				const v = await getDaemonVersion(LEGACY_PORT);
+				if (v !== null && v !== PKG_VERSION) {
+					logWarn(`legacy proxy on :${LEGACY_PORT} is stale v${v} (need v${PKG_VERSION}) — replacing`, {
+						remoteVer: v,
+						expected: PKG_VERSION,
+					});
+					const killed = await killPortHolder(LEGACY_PORT);
+					if (killed) {
+						for (let i = 0; i < 10; i++) {
+							await new Promise<void>((r) => setTimeout(r, 200));
+							if (!(await isProxyAlive(LEGACY_PORT))) break;
+						}
+					}
+					if (await isProxyAlive(LEGACY_PORT)) {
+						actualPort = LEGACY_PORT;
+						registerCatalog(getAliveCatalog());
+						logInfo(`Re-attached to legacy proxy daemon on http://${HOST}:${LEGACY_PORT} (stale kill did not free port)`);
+						return;
+					}
+				} else {
+					actualPort = LEGACY_PORT;
+					registerCatalog(getAliveCatalog());
+					logInfo(`Re-attached to legacy proxy daemon on http://${HOST}:${LEGACY_PORT}`);
+					return;
+				}
 			}
 			const r = await startProxy();
 			if (r.server) server = r.server;

package/src/logger.ts

@@ -197,6 +197,10 @@ export function formatLogMeta(
 	if (meta && Object.keys(meta).length > 0) {
 		const safe: Record<string, unknown> = {};
 		for (const [k, v] of Object.entries(meta)) {
+			if (/(auth|token|secret|password|bearer|api.?key|cookie|x-relay-auth)/i.test(k)) {
+				safe[k] = "[REDACTED]";
+				continue;
+			}
 			if (typeof v === "string" && v.length > 800) {
 				safe[k] = `${v.slice(0, 800)}…(${v.length})`;
 			} else if (v instanceof Error) {

package/src/proxy.ts

@@ -6,6 +6,7 @@
  */
 
 import { randomUUID } from "node:crypto";
+import { execSync } from "node:child_process";
 import * as http from "node:http";
 import * as https from "node:https";
 import { handleHealthRequest } from "./health.ts";
@@ -65,6 +66,7 @@ export function validatePath(rawUrl: string): URL | null {
 	if (PATH_TRAVERSAL_PATTERN.test(cleaned)) return null;
 	try {
 		const decoded = decodeURIComponent(cleaned);
+		if (PATH_TRAVERSAL_PATTERN.test(decoded)) return null;
 		if (decoded !== cleaned && !ALLOWED_PATH_PATTERN.test(`/${decoded}`)) {
 			return null;
 		}
@@ -112,6 +114,7 @@ export function sanitizeHeaders(
 	return sanitized;
 }
 export async function isProxyAlive(port: number): Promise<boolean> {
+	if (!Number.isInteger(port) || port < 1 || port > 65535) return false;
 	try {
 		const res = await fetch(`http://${HOST}:${port}/v1/models`, {
 			signal: AbortSignal.timeout(500),
@@ -123,6 +126,63 @@ export async function isProxyAlive(port: number): Promise<boolean> {
 	}
 }
 
+export async function getDaemonVersion(port: number): Promise<string | null> {
+	if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+	try {
+		const res = await fetch(`http://${HOST}:${port}/_health`, {
+			signal: AbortSignal.timeout(800),
+		});
+		if (!res.ok) return null;
+		const data: unknown = await res.json();
+		if (data && typeof data === "object" && "version" in data) {
+			const v = data.version;
+			if (typeof v === "string" && v) return v;
+		}
+		// Alive but no version field = pre-1.8.0 daemon (never embedded it) — stale.
+		return "";
+	} catch {
+		return null;
+	}
+}
+
+export async function killPortHolder(port: number): Promise<boolean> {
+	if (!Number.isInteger(port) || port < 1 || port > 65535) return false;
+	try {
+		if (process.platform === "win32") {
+			try {
+				const out = execSync(`netstat -ano | findstr :${port}`, { encoding: "utf8", timeout: 3000 }) as string;
+				for (const line of out.split("\n")) {
+					if (!line.includes("LISTENING")) continue;
+					if (!line.includes(`:${port}`)) continue;
+					const parts = line.trim().split(/\s+/);
+					const pid = parts[parts.length - 1];
+					if (!pid || !/^\d+$/.test(pid)) continue;
+					// Windows netstat report: 127.0.0.1:38180 ... LISTENING/PID
+					if (Number(pid) === process.pid) continue; // never self-kill
+					execSync(`taskkill /F /PID ${pid}`, { timeout: 3000, stdio: "ignore" });
+					return true;
+				}
+			} catch {}
+			return false;
+		}
+		try {
+			const out = execSync(`lsof -ti tcp:${port} 2>/dev/null || fuser -n tcp ${port} 2>/dev/null`, {
+				encoding: "utf8",
+				timeout: 3000,
+			}) as string;
+			const pid = out.trim().split(/\s+/)[0];
+			if (!pid || !/^\d+$/.test(pid)) return false;
+			if (Number(pid) === process.pid) return false; // never self-kill (Unix) — matches Windows guard at 161
+			execSync(`kill -9 ${pid}`, { timeout: 3000, stdio: "ignore" });
+			return true;
+		} catch {
+			return false;
+		}
+	} catch {
+		return false;
+	}
+}
+
 /**
  * Tagged abort reason for the proxy-internal header-wait timeout.
  * relayFetch rethrows AbortErrors untouched, and stream-pipe recognizes
@@ -179,7 +239,7 @@ export function startProxy(
 			reqPathname = new URL(req.url ?? "/", `http://${HOST}`).pathname;
 		} catch {}
 		// Loopback-only health endpoint — always accessible even when widget hidden
-		if (req.method === "GET" && reqPathname !== null && (reqPathname === "/_health" || reqPathname === "/health" || reqPathname.endsWith("/health"))) {
+		if (req.method === "GET" && reqPathname !== null && (reqPathname === "/_health" || reqPathname === "/health")) {
 			const addr = server.address();
 			const realPort = addr && typeof addr === "object" ? (addr as { port: number }).port : basePort;
 			if (handleHealthRequest(req, res, realPort)) return;
@@ -464,7 +524,7 @@ export function startProxy(
 					fwd["connection"] = "keep-alive";
 
 					const controller = new AbortController();
-					const timeoutId = setTimeout(() => controller.abort(), 300_000);
+					const timeoutId = setTimeout(() => controller.abort(upstreamTimeoutError()), UPSTREAM_HEADER_TIMEOUT_MS);
 					const onClientClose = () => {
 						if (!res.writableEnded) controller.abort();
 					};
@@ -542,6 +602,7 @@ export function startProxy(
 			let settled = false;
 
 			const tryListen = async (port: number) => {
+				server.removeAllListeners("error");
 				server.once("error", async (err: NodeJS.ErrnoException) => {
 					if (settled) return;
 					if (err.code === "EADDRINUSE") {

package/src/relay-state.ts

@@ -512,7 +512,7 @@ lastKnownStateMtimeMs = currentDiskStateMtimeMs();
  */
 export function getActiveRelayState(): RelayState {
 	const currentMtime = currentDiskStateMtimeMs();
-	if (currentMtime > 0 && currentMtime > lastKnownStateMtimeMs) {
+	if (currentMtime !== lastKnownStateMtimeMs) {
 		activeRelayState = resolveRelayState();
 		lastKnownStateMtimeMs = currentMtime;
 	}