pi-freeflow 1.9.5 → 1.9.7

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 All notable changes to pi-freeflow. Public, user-visible behavior only.
 
+## 1.9.7 - 2026-09-06
+
+### Fixes
+- **Model picker only shows verified free models (fixes #6).** Background catalog refresh now filters out non-free models from upstream endpoints so paid models requiring an API key no longer leak into your picker.
+- **Relay pool automatically recovers from dead deployments (fixes #5).** If a relay URL in your pool returns an infrastructure 404 (such as a missing or deleted Vercel deployment), the proxy marks it as failed and immediately rolls over to your next healthy relay or direct mode instead of getting trapped in a 404 loop.
+
+### Changes
+- **Updated model catalog (26 verified free models: 7 OpenCode Zen + 19 KiloCode Gateway).**
+  - Added `inclusionai/ling-3.0-flash-sante:free` (Ling 3.0 Flash Sante, 262K context, 32K output, reasoning supported). Clean CLI alias `ling-3.0-flash-sante` supported.
+  - Removed `laguna-s-2.1-free` (OpenCode Zen) after upstream dropped free-tier access. `poolside/laguna-s-2.1:free` on Kilo remains active.
+- **Public by default for new relay deployments.** Relays deployed via `/freeflow deploy` are now public by default with no mandatory authentication tokens. This enables seamless copy-paste migration across proxy tools (such as 9router) while maintaining safety guards for allowed AI upstreams.
+
+### Validation
+- TypeScript typecheck passed cleanly (`tsc --noEmit`).
+- Full test suite passed across Windows (299 tests) and Ubuntu Linux (`acerblue-local`, 300/300 tests passed).
+- End-to-end concurrency and failover stress testing verified (100 parallel requests, 20 subagent leases, burst failover).
+
+## 1.9.6 - 2026-09-03
+
+### Fixes
+- **Hiding the status widget now sticks.** `/freeflow hide` survives restarts, new sessions, and background update notices — previously the widget could reappear on the next session.
+- **Calmer startup with many sessions.** Sessions starting at the same time now converge on a single background proxy instead of each spawning its own; a spawn that never becomes ready falls back to in-process mode instead of running untracked.
+- **Survives daemon restarts mid-session.** If the background proxy is replaced while sessions run, connected sessions re-register automatically instead of silently losing their lease (which could retire the daemon mid-use).
+- **Stale-version cleanup targets the right process.** Windows port matching is now exact, and Linux without `lsof`/`fuser` resolves the holder via `/proc` instead of giving up.
+- **`/freeflow logs --follow` no longer runs forever.** The live tail stops when the session ends and caps burst output; the update/install subprocess now has a 2-minute timeout.
+
+### Validation
+- `npx tsc --noEmit` clean, `npm test` 299 (298 pass + 1 Linux-only skip) + smoke green on Windows; stress harness 7/7 on Windows and Linux `acerblue-local`. **`macOS not tested`** this cycle.
+
 ## 1.9.5 - 2026-09-03
 
 ### Changes

package/README.md

@@ -18,7 +18,7 @@ Join devs bypassing rate limits with their own relay pools. BYO, add as many as
 
 | Feature | Description | Value | Cost |
 | :--- | :--- | :--- | :--- |
-| **26 Curated Free Models** | 8 OpenCode Zen + 18 KiloCode Gateway models, up to 1M context & 512K output | Ceiling Unlocked | **$0** |
+| **26 Curated Free Models** | 7 OpenCode Zen + 19 KiloCode Gateway models, up to 1M context & 512K output | Ceiling Unlocked | **$0** |
 | **BYO Relay Pool** | Round-robin load balancing across your Cloudflare Workers & Vercel Edges | Zero Rate Limits | **$0** (your free tiers) |
 | **Adaptive Health & Error Detection** | Auto-cooldown on 429 rate limits, 504 timeouts, and socket drops | 0ms Wasted Latency | **$0** |
 | **Stream Truncation Resilience** | Stateful SSE terminal tracking (`response.failed` / `response.incomplete` injection) | Zero Host Crashes | **$0** |
@@ -38,7 +38,7 @@ Philosophy: **Thin by design.** We only ship model list + relay proxy + log. Hos
 /model → freeflow → pick
 ```
 
-#### OpenCode Zen (8 Models), Responses & Chat API
+#### OpenCode Zen (7 Models), Responses & Chat API
 Optimized for deep reasoning, long-horizon coding & autonomous agentic workflows.
 
 | Model ID | Creator / Lab | Context | Max Output | Thinking | Vision |
@@ -46,13 +46,11 @@ Optimized for deep reasoning, long-horizon coding & autonomous agentic workflows
 | `muse-spark-1.2-contributor-free` | Meta Superintelligence Labs | **1M** (1.048.576) | **131K** (131.072) | `minimal … xhigh` | ✅ |
 | `muse-spark-1.3-contributor-free` | Meta Superintelligence Labs | **1M** (1.048.576) | **131K** (131.072) | `minimal … xhigh` | ✅ |
 | `mimo-v2.5-free` | Xiaomi MiMo | **1M** (1.048.576) | **131K** (131.072) | `minimal … xhigh`\* | ✅ |
-| `laguna-s-2.1-free` | Poolside | **262K** (262.144) | **32K** (32.768) | `minimal … xhigh` | ❌ |
 | `nemotron-3.5-lightning-free` | NVIDIA | **1M** (1.000.000) | **262K** (262.144) | `minimal … xhigh` | ❌ |
 | `nemotron-3-ultra-free` | NVIDIA | **1M** (1.000.000) | **128K** (128.000) | `minimal … xhigh` | ❌ |
 | `big-pickle` | Big Pickle | **200K** (200.000) | **32K** (32.000) | `high / max` | ❌ |
 | `ling-3.0-flash-fin-free` | Inclusion AI | **262K** (262.144) | **131K** (131.072) | `minimal … xhigh` | ❌ |
-
-#### KiloCode Gateway (18 Models), OpenRouter Compatible
+#### KiloCode Gateway (19 Models), OpenRouter Compatible
 Keyless access with `Bearer kilo-free`. Clean slash-free and colon-free CLI aliases supported.
 
 | Model ID | Creator / Lab | Context | Max Output | Thinking | Vision |
@@ -74,6 +72,7 @@ Keyless access with `Bearer kilo-free`. Clean slash-free and colon-free CLI alia
 | `minimax-m3` (`minimax/minimax-m3:free`) | MiniMax | **1M** (1.048.576) | **512K** (524.288) | `minimal…xhigh`\* | ❌ |
 | `ling-3.0-flash-fin` (`inclusionai/ling-3.0-flash-fin:free`) | Inclusion AI | **262K** (262.144) | **32K** (32.768) | `minimal…xhigh`\* | ❌ |
 | `inkling` (`thinkingmachines/inkling:free`) | Thinking Machines | **1M** (1.048.576) | **262K** (262.144) | `minimal…xhigh`\* | ✅ |
+| `ling-3.0-flash-sante` (`inclusionai/ling-3.0-flash-sante:free`) | Inclusion AI | **262K** (262.144) | **32K** (32.768) | `minimal…xhigh`\* | ❌ |
 | `inkling-small` (`thinkingmachines/inkling-small:free`) | Thinking Machines | **1M** (1.048.576) | **262K** (262.144) | `minimal…xhigh`\* | ✅ |
 
 \* Levels are forwarded as-is through the OpenRouter-style nested `reasoning` parameter; effort mapping is decided by each model. MiMo collapses `minimal→low` and `xhigh→high` upstream, so its selector shows 5 labels but only 3 distinct effort values.
@@ -215,7 +214,7 @@ For `api/relay.js`, use the canonical worker source (see below); `vercel.json` s
 
 **Canonical worker source (all platforms)**
 
-The relay worker template is generated per deployment by `/freeflow deploy` and lives in [`src/deploy.ts`](src/deploy.ts): one hardened core plus thin Vercel / Cloudflare / Deno wrappers. Every deployment embeds its own shared secret and enforces the target allowlist (`https://opencode.ai`, `https://api.kilo.ai`), SSRF/private-host guard, relay-path validation, and a header denylist — `x-relay-auth` is checked by the worker and never forwarded upstream.
+The relay worker template is generated per deployment by `/freeflow deploy` and lives in [`src/deploy.ts`](src/deploy.ts): one hardened core plus thin Vercel / Cloudflare / Deno wrappers. Deployed relays are public by default for seamless migration across proxy tools (such as 9router), while enforcing the target allowlist (`https://opencode.ai`, `https://api.kilo.ai`), SSRF/private-host guard, relay-path validation, and a header denylist.
 
 ```js
 // Minimal Cloudflare illustration. Prefer /freeflow deploy: the generated

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-freeflow",
   "type": "module",
-  "version": "1.9.5",
+  "version": "1.9.7",
   "description": "Thin provider for OMP/Pi — model list + dumb relay proxy + log; host pi-ai owns thinking/normalization",
   "main": "extensions/index.ts",
   "types": "src/index.ts",

package/src/catalog.ts

@@ -20,6 +20,7 @@ import {
 	ALL_MODELS,
 	KILO_MODEL_IDS,
 	MODEL_MAP,
+	OPENCODE_MODELS,
 } from "./models.ts";
 import type {
 	CatalogCacheData,
@@ -37,6 +38,7 @@ export const DEAD_MODEL_IDS = new Set<string>([
 	"hy3-free",
 	"tencent/hy3:free",
 	"meituan/longcat-2.0-free",
+	"laguna-s-2.1-free",
 ]);
 /**
  * In-memory cache of currently active/available free models.
@@ -304,7 +306,15 @@ export async function refreshCatalog(force = false): Promise<RegisteredModel[]>
 					}
 				}
 				if (rawList.length > 0) {
-					const fresh = rawList.map((r) => enrichModelDef(r, "opencode"));
+					const freeRawList = rawList.filter((r) => {
+						if (!r || typeof r.id !== "string") return false;
+						if (DEAD_MODEL_IDS.has(r.id)) return false;
+						return (
+							r.id.includes("-free") ||
+							OPENCODE_MODELS.some((m) => m.id === r.id)
+						);
+					});
+					const fresh = freeRawList.map((r) => enrichModelDef(r, "opencode"));
 					const merged = mergeCatalog(aliveCatalog, fresh);
 					aliveCatalog = merged;
 					writeCatalogCache({

package/src/client.ts

@@ -63,7 +63,7 @@ function isSpawnEnabled(): boolean {
 	return process.env[DAEMON_SPAWN_ENV] !== "0";
 }
 
-type ControlResult = "ok" | "legacy" | "gone";
+type ControlResult = "ok" | "unknown" | "legacy" | "gone";
 
 async function controlCall(
 	port: number,
@@ -77,7 +77,12 @@ async function controlCall(
 			body: JSON.stringify(payload),
 			signal: AbortSignal.timeout(1500),
 		});
-		return res.ok ? "ok" : "legacy";
+		if (!res.ok) return "legacy";
+		try {
+			const data: unknown = await res.json();
+			if (data && typeof data === "object" && "ok" in data && data.ok === false) return "unknown";
+		} catch {}
+		return "ok";
 	} catch {
 		return "gone";
 	}
@@ -122,6 +127,9 @@ async function beatOnce(port: number): Promise<void> {
 	const result = await controlCall(port, "/_client/heartbeat", { id: CLIENT_ID });
 	if (result === "gone") {
 		void ensureDaemon();
+	} else if (result === "unknown") {
+		// Daemon restarted since attach: re-register our lease.
+		await attachTo(port);
 	}
 }
 
@@ -259,13 +267,22 @@ export async function ensureDaemon(): Promise<number> {
 		}
 
 		if (isSpawnEnabled()) {
+			// Cross-process race guard: a sibling session may be spawning right
+			// now (singleflight is per-process). Jitter + re-probe converts most
+			// cold-start races into attach instead of N detached spawns.
+			await new Promise<void>((r) => setTimeout(r, 100 + Math.random() * 200));
+			if (await isProxyAlive(PORT)) {
+				await attachTo(PORT);
+				return PORT;
+			}
 			spawnDaemonProcess();
 			const ready = await waitForReady(PORT, DAEMON_READY_TIMEOUT_MS);
 			if (ready) {
 				const ver = await getDaemonVersion(PORT);
 				if (ver !== null && ver !== PKG_VERSION) {
-					if (await killStaleDaemon(PORT, ver, "proxy daemon")) {
-						spawnDaemonProcess();
+				if (await killStaleDaemon(PORT, ver, "proxy daemon")) {
+					lastSpawnAt = 0; // kill-confirmed retry bypasses the spawn throttle
+					spawnDaemonProcess();
 						const retryReady = await waitForReady(PORT, DAEMON_READY_TIMEOUT_MS);
 						if (retryReady) {
 							await attachTo(PORT);
@@ -282,7 +299,8 @@ export async function ensureDaemon(): Promise<number> {
 			} else {
 				logWarn("daemon spawn did not become ready — is the port blocked?");
 			}
-			return PORT;
+			// Fall through to the in-process fallback below — never hand the caller
+			// a port we did not attach to (no lease, no heartbeat).
 		}
 
 		try {

package/src/commands.ts

@@ -68,6 +68,7 @@ function spawnWithProgress(
 	cmd: string,
 	args: string[],
 	ctx: ExtensionContext,
+	timeoutMs = 120_000,
 ): Promise<number> {
 	const { promise, resolve } = Promise.withResolvers<number>();
 	try {
@@ -76,6 +77,16 @@ function spawnWithProgress(
 			stdio: "pipe",
 			windowsHide: true,
 		});
+		const timer = setTimeout(() => {
+			try { child.kill(); } catch {}
+			ctx.ui.notify(`spawn ${cmd} timed out after ${timeoutMs}ms — killed`, "warning");
+			resolve(1);
+		}, timeoutMs);
+		try { timer.unref?.(); } catch {}
+		const done = (code: number | null): void => {
+			clearTimeout(timer);
+			resolve(code ?? 0);
+		};
 		child.stdout?.on("data", (d: Buffer) => {
 			const s = String(d).trim();
 			if (s) ctx.ui.notify(s, "info");
@@ -85,10 +96,11 @@ function spawnWithProgress(
 			if (s) ctx.ui.notify(s, "info");
 		});
 		child.on("error", (err: Error) => {
+			clearTimeout(timer);
 			ctx.ui.notify(`spawn ${cmd} failed: ${err.message}`, "warning");
 			resolve(1);
 		});
-		child.on("close", (code: number | null) => resolve(code ?? 0));
+		child.on("close", done);
 	} catch (e) {
 		ctx.ui.notify(`spawn ${cmd} failed: ${(e as Error).message}`, "warning");
 		resolve(1);
@@ -100,8 +112,15 @@ function spawnWithProgress(
  * Follow-mode log poller: tracks the count of matched lines already printed
  * and notifies only lines beyond it, so repeated ticks never re-notify the
  * same tail. One poller at a time — a re-run clears the previous interval.
+ * Stop with stopLogsFollow (session shutdown / non-follow commands).
  */
 let logsFollowTimer: NodeJS.Timeout | null = null;
+export function stopLogsFollow(): void {
+	if (logsFollowTimer) {
+		clearInterval(logsFollowTimer);
+		logsFollowTimer = null;
+	}
+}
 function startLogsFollow(
 	ctx: ExtensionContext,
 	filterLevel: LogLevel | null,
@@ -110,10 +129,7 @@ function startLogsFollow(
 	filterText: string | null,
 	baselineMatched: number,
 ): void {
-	if (logsFollowTimer) {
-		clearInterval(logsFollowTimer);
-		logsFollowTimer = null;
-	}
+	stopLogsFollow();
 	let lastPrinted = baselineMatched;
 	logsFollowTimer = setInterval(() => {
 		try {
@@ -127,7 +143,7 @@ function startLogsFollow(
 			if (newCount <= 0) return;
 			const newLines = tail.lines.slice(
 				tail.lines.length - Math.min(newCount, tail.lines.length),
-			);
+			).slice(-50);
 			if (newLines.length > 0) {
 				ctx.ui.notify(newLines.join("\n"), "info");
 			}
@@ -354,7 +370,8 @@ export function createCommandSpec(
 					);
 					relayState = withRelayState((s) => {
 						const r = ensureRelay(s, url, `deployed ${name}`);
-						r.auth = auth;
+						if (auth) r.auth = auth;
+						else delete r.auth;
 						s.enabled = true;
 						s.url = url;
 						return s;

package/src/deploy.ts

@@ -160,6 +160,7 @@ export async function deployVercelRelay(
 	token: string,
 	name: string,
 	onProgress?: (msg: string) => void,
+	authSecret: string = "",
 ): Promise<{ url: string; auth: string }> {
 	name = baseRelayName(name) || "relay-worker";
 	const auth = {
@@ -169,9 +170,9 @@ export async function deployVercelRelay(
 	// 1. Create deployment (3 inline files, no git repository required)
 	onProgress?.("Uploading relay files to Vercel…");
 	log("info", `Starting Vercel deployment: ${name}`);
-	// Per-deployment shared secret: embedded in the worker, persisted on the
-	// relay-state entry by the caller, and required via x-relay-auth.
-	const relayAuth = randomBytes(24).toString("base64url");
+	// Public by default for easy migration with 9router and other proxy tools.
+	// When authSecret is provided, embeds the shared secret for private auth.
+	const relayAuth = authSecret || "";
 
 	const dep = await fetch(`${VERCEL_API}/v13/deployments`, {
 		method: "POST",
@@ -339,6 +340,7 @@ export async function deployCloudflareWorker(
 	token: string,
 	name: string,
 	onProgress?: (msg: string) => void,
+	authSecret: string = "",
 ): Promise<{ url: string; auth: string }> {
 	const auth = { Authorization: `Bearer ${token}` };
 	const scriptName = cloudflareScriptName(name);
@@ -358,9 +360,9 @@ export async function deployCloudflareWorker(
 
 	// 2. Upload the module worker script (multipart: main module + metadata)
 	onProgress?.("Uploading relay worker to Cloudflare…");
-	// Per-deployment shared secret: embedded in the worker, persisted on the
-	// relay-state entry by the caller, and required via x-relay-auth.
-	const relayAuth = randomBytes(24).toString("base64url");
+	// Public by default for easy migration with 9router and other proxy tools.
+	// When authSecret is provided, embeds the shared secret for private auth.
+	const relayAuth = authSecret || "";
 	const formData = new FormData();
 	formData.append(
 		"index.js",
@@ -452,12 +454,11 @@ export async function deployDenoRelay(
 	token: string,
 	name: string,
 	onProgress?: (msg: string) => void,
+	authSecret: string = "",
 ): Promise<{ url: string; auth: string }> {
+	const slug = denoProjectName(name);
 	const auth = { Authorization: `Bearer ${token}` };
 	const jsonHeaders = { ...auth, "Content-Type": "application/json" };
-	const slug = denoProjectName(name);
-
-	// 1. Create the app
 	onProgress?.("Creating Deno Deploy app…");
 	log("info", `Starting Deno Deploy deployment: ${slug}`);
 	const createRes = await fetch(`${DENO_API}/apps`, {
@@ -495,9 +496,9 @@ export async function deployDenoRelay(
 
 	// 2. Push the relay source as a single-file revision
 	onProgress?.("Uploading relay script to Deno Deploy…");
-	// Per-deployment shared secret: embedded in the worker, persisted on the
-	// relay-state entry by the caller, and required via x-relay-auth.
-	const relayAuth = randomBytes(24).toString("base64url");
+	// Public by default for easy migration with 9router and other proxy tools.
+	// When authSecret is provided, embeds the shared secret for private auth.
+	const relayAuth = authSecret || "";
 	const deployRes = await fetch(`${DENO_API}/apps/${appId}/deploy`, {
 		method: "POST",
 		headers: jsonHeaders,

package/src/index.ts

@@ -1,7 +1,7 @@
 /**
  * pi-freeflow — Modular, high-resiliency LLM extension for Pi & Oh My Pi (OMP)
  *
- * Provides access to 26 free models (8 OpenCode Zen + 18 KiloCode Gateway) with:
+ * Provides access to 26 free models (7 OpenCode Zen + 19 KiloCode Gateway) with:
  * - Single-port daemon reuse on 28180 across concurrent subagents
  * - Multi-cloud rolling egress relays (Vercel Edge, Cloudflare, Deno)
  * - 0ms instant startup with verified static catalog and background live health checks
@@ -17,7 +17,7 @@ import {
 	setAliveCatalog,
 } from "./catalog.ts";
 import { ensureDaemon as ensureClientDaemon, getClientPort, stopHeartbeat } from "./client.ts";
-import { createCommandSpec, updateStatusBar } from "./commands.ts";
+import { createCommandSpec, stopLogsFollow, updateStatusBar } from "./commands.ts";
 import { HOST, ONBOARDED_FLAG_FILE, PORT } from "./config.ts";
 import { logInfo, logWarn } from "./logger.ts";
 import { ALL_MODELS, KILO_MODEL_IDS, MODEL_MAP, resolveCanonicalModelId } from "./models.ts";
@@ -330,5 +330,6 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 	});
 	pi.on?.("session_shutdown", () => {
 		stopHeartbeat();
+		stopLogsFollow();
 	});
 }

package/src/lease.ts

@@ -32,11 +32,13 @@ export function registerClient(clientId: string): void {
 	leases.set(clientId, Date.now());
 }
 
-/** Renew an existing client lease (unknown ids are ignored). */
-export function renewClient(clientId: string): void {
+/** Renew an existing client lease. Returns false when the id is unknown (daemon restarted). */
+export function renewClient(clientId: string): boolean {
 	if (leases.has(clientId)) {
 		leases.set(clientId, Date.now());
+		return true;
 	}
+	return false;
 }
 
 /** Remove a client lease (graceful detach on session end). */

package/src/models.ts

@@ -2,8 +2,8 @@
  * Static model definitions and upstream routing catalogs for pi-freeflow
  *
  * Defines the 26 verified free models:
- * - 8 OpenCode Zen models (2 Responses API + 6 Chat Completions)
- * - 18 KiloCode Keyless Gateway models (17 OpenRouter format + 1 Standard format)
+ * - 7 OpenCode Zen models (2 Responses API + 5 Chat Completions)
+ * - 19 KiloCode Keyless Gateway models (18 OpenRouter format + 1 Standard format)
  */
 
 import type { ModelDef, ThinkingLevelMap, Upstream } from "./types.ts";
@@ -111,22 +111,6 @@ export const OPENCODE_MODELS: ModelDef[] = [
 			xhigh: null,
 			max: "max",},
 	},
-	{
-		id: "laguna-s-2.1-free",
-		name: "Laguna S 2.1 (256K)",
-		reasoning: true,
-		contextWindow: 262_144,
-		maxTokens: 32_768,
-		input: ["text"],
-		thinkingLevelMap: {
-			off: null,
-			minimal: "minimal",
-			low: "low",
-			medium: "medium",
-			high: "high",
-			xhigh: "xhigh",
-			max: null,},
-	},
 	{
 		id: "ling-3.0-flash-fin-free",
 		name: "Ling 3.0 Flash Fin (256K)",
@@ -345,6 +329,16 @@ export const KILO_MODELS: ModelDef[] = [
 	thinkingFormat: "openrouter",
 	thinkingLevelMap: KILO_REASONING_MAP,
 },
+	{
+		id: "inclusionai/ling-3.0-flash-sante:free",
+		name: "Ling 3.0 Flash Sante",
+		reasoning: true,
+		contextWindow: 262_144,
+		maxTokens: 32_768,
+		input: ["text"],
+		thinkingFormat: "openrouter",
+		thinkingLevelMap: KILO_REASONING_MAP,
+	},
 ];
 
 /**
@@ -368,6 +362,7 @@ export const MODEL_ALIASES: Record<string, string> = {
 	"minimax-m2.7": "minimax/minimax-m2.7:free",
 	"minimax-m3": "minimax/minimax-m3:free",
 	"ling-3.0-flash-fin": "inclusionai/ling-3.0-flash-fin:free",
+	"ling-3.0-flash-sante": "inclusionai/ling-3.0-flash-sante:free",
 	"inkling": "thinkingmachines/inkling:free",
 	"inkling-small": "thinkingmachines/inkling-small:free",
 	// provider-prefixed short aliases (slash-normalized)

package/src/proxy.ts

@@ -6,6 +6,7 @@
  */
 
 import { randomUUID } from "node:crypto";
+import fs from "node:fs";
 import { execSync } from "node:child_process";
 import * as http from "node:http";
 import * as https from "node:https";
@@ -177,6 +178,63 @@ export async function getDaemonVersion(port: number): Promise<string | null> {
 	return h ? h.version : null;
 }
 
+/**
+ * Linux fallback when neither lsof nor fuser exists: resolve the LISTEN
+ * socket inode for `port` via /proc/net/tcp{,6}, then find the owning pid by
+ * scanning /proc fds. Dependency-free, same-user only, never self-kills.
+ */
+function killViaProcNet(port: number): boolean {
+	if (process.platform !== "linux") return false;
+	try {
+		const hexPort = port.toString(16).toUpperCase().padStart(4, "0");
+		const inodes = new Set<string>();
+		for (const table of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+			let text = "";
+			try {
+				text = fs.readFileSync(table, "utf8");
+			} catch {
+				continue;
+			}
+			for (const line of text.split("\n").slice(1)) {
+				const cols = line.trim().split(/\s+/);
+				if (cols.length < 10) continue;
+				const addr = cols[1].split(":");
+				if (addr.length !== 2 || addr[1].toUpperCase() !== hexPort) continue;
+				if (cols[3] !== "0A") continue; // LISTEN only
+				inodes.add(cols[9]);
+			}
+		}
+		if (inodes.size === 0) return false;
+		for (const pid of fs.readdirSync("/proc")) {
+			if (!/^\d+$/.test(pid) || Number(pid) === process.pid) continue;
+			let fds: string[];
+			try {
+				fds = fs.readdirSync(`/proc/${pid}/fd`);
+			} catch {
+				continue;
+			}
+			for (const fd of fds) {
+				let link = "";
+				try {
+					link = fs.readlinkSync(`/proc/${pid}/fd/${fd}`);
+				} catch {
+					continue;
+				}
+				const sock = link.match(/^socket:\[(\d+)\]$/);
+				if (sock && inodes.has(sock[1])) {
+					try {
+						process.kill(Number(pid), "SIGKILL");
+						return true;
+					} catch {
+						return false;
+					}
+				}
+			}
+		}
+	} catch {}
+	return false;
+}
+
 export async function killPortHolder(port: number): Promise<boolean> {
 	if (!Number.isInteger(port) || port < 1 || port > 65535) return false;
 	try {
@@ -189,8 +247,10 @@ export async function killPortHolder(port: number): Promise<boolean> {
 				}) as string;
 				for (const line of out.split("\n")) {
 					if (!line.includes("LISTENING")) continue;
-					if (!line.includes(`:${port}`)) continue;
 					const parts = line.trim().split(/\s+/);
+					// Match the port on the Local Address column only — a raw
+					// substring match can hit longer ports (:2818 vs :28180).
+					if (!parts[1] || !parts[1].endsWith(`:${port}`)) continue;
 					const pid = parts[parts.length - 1];
 					if (!pid || !/^\d+$/.test(pid)) continue;
 					// Windows netstat report: 127.0.0.1:38180 ... LISTENING/PID
@@ -206,13 +266,14 @@ export async function killPortHolder(port: number): Promise<boolean> {
 				encoding: "utf8",
 				timeout: 3000,
 			}) as string;
-			const pid = out.trim().split(/\s+/)[0];
-			if (!pid || !/^\d+$/.test(pid)) return false;
-			if (Number(pid) === process.pid) return false; // never self-kill (Unix) — matches Windows guard at 161
-			execSync(`kill -9 ${pid}`, { timeout: 3000, stdio: "ignore" });
+			const pids = out.trim().split(/\s+/).filter((p) => /^\d+$/.test(p) && Number(p) !== process.pid);
+			// lsof matches both ends of a connection: our own recent probe socket
+			// (TIME_WAIT) can sort first, so skip self instead of taking [0].
+			if (pids.length === 0) return killViaProcNet(port);
+			execSync(`kill -9 ${pids[0]}`, { timeout: 3000, stdio: "ignore" });
 			return true;
 		} catch {
-			return false;
+			return killViaProcNet(port);
 		}
 	} catch {
 		return false;
@@ -271,8 +332,15 @@ export function handleControlRequest(
 			return;
 		}
 		if (reqPathname === "/_client/attach") registerClient(clientId);
-		else if (reqPathname === "/_client/heartbeat") renewClient(clientId);
-		else if (reqPathname === "/_client/detach") unregisterClient(clientId);
+		else if (reqPathname === "/_client/heartbeat") {
+			// Unknown id = daemon restarted since attach. Report ok:false so the
+			// client re-attaches instead of heartbeating lease-less.
+			if (!renewClient(clientId)) {
+				res.writeHead(200, { "content-type": "application/json" });
+				res.end(JSON.stringify({ ok: false }));
+				return;
+			}
+		} else if (reqPathname === "/_client/detach") unregisterClient(clientId);
 		else {
 			res.writeHead(404, { "content-type": "application/json" });
 			res.end(JSON.stringify({ error: "not found" }));
@@ -345,7 +413,6 @@ export function startProxy(
 			if (handleHealthRequest(req, res, realPort, getActiveRequests())) return;
 		}
 		if (req.method === "GET" && (reqPathname === "/v1/models" || reqPathname === "/v1/models/")) {
-			touchActivity();
 			const alive = getAliveCatalog();
 			const body = JSON.stringify({
 				object: "list",

package/src/relay-state.ts

@@ -117,6 +117,7 @@ function parseRelayState(raw: string): RelayState | null {
 						: s?.enabled !== false && relays.length > 0,
 			url: typeof s?.url === "string" ? s.url.trim() : (relays[0]?.url || ""),
 			relays,
+			hideWidget: s?.hideWidget === true,
 		};
 	} catch {
 		return null;
@@ -182,9 +183,10 @@ export function loadRelayState(): RelayState {
 			if (healed) {
 				return healed;
 			}
-			return { mode: "auto", enabled: true, url: "", relays: [] };
+			return { mode: "auto", enabled: true, url: "", relays: [], hideWidget: false };
 		}
-		const main = parseRelayState(fs.readFileSync(RELAY_STATE_FILE, "utf8"));
+		const raw = fs.readFileSync(RELAY_STATE_FILE, "utf8");
+		const main = parseRelayState(raw);
 		if (main) {
 			return main;
 		}
@@ -196,9 +198,15 @@ export function loadRelayState(): RelayState {
 		logWarn("relay state file unusable and no valid backup — starting fresh", {
 			path: RELAY_STATE_FILE,
 		});
-		return { mode: "auto", enabled: true, url: "", relays: [] };
+		// parse returns null on an empty pool by design (wipe-protection above);
+		// preserve an explicit hide so hide-with-zero-relays survives reload.
+		let hide = false;
+		try {
+			hide = (JSON.parse(raw) as RelayState)?.hideWidget === true;
+		} catch {}
+		return { mode: "auto", enabled: true, url: "", relays: [], hideWidget: hide };
 	} catch {
-		return { mode: "auto", enabled: true, url: "", relays: [] };
+		return { mode: "auto", enabled: true, url: "", relays: [], hideWidget: false };
 	}
 }
 
@@ -537,9 +545,6 @@ export function setActiveRelayState(s: RelayState, persist = true): void {
 // concurrent sessions cannot silently clobber each other's edits.
 
 const RELAY_STATE_LOCK_FILE = `${RELAY_STATE_FILE}.lock`;
-const LOCK_WAIT_MAX_MS = 2_000;
-const LOCK_RETRY_START_MS = 25;
-const LOCK_RETRY_MAX_MS = 200;
 /** A lock older than this is presumed abandoned (crashed holder) and taken over. */
 const LOCK_STALE_MS = 30_000;
 
@@ -571,24 +576,19 @@ function tryAcquireRelayLock(): boolean {
 
 /**
  * Apply a mutation to relay state with a compare-and-swap discipline.
- * Locks the state file (bounded retry, ~2s), loads the freshest on-disk state,
+ * Makes a single lock acquisition attempt, loads the freshest on-disk state,
  * runs the updater against it, persists atomically, and releases the lock.
- * On lock timeout the write proceeds unlocked — the atomic tmp+rename save
- * already prevents torn files; the lock only serializes write intent.
+ * When the lock is held the write proceeds unlocked — the atomic tmp+rename
+ * save already prevents torn files; the lock only serializes write intent.
+ * (Never spin here: this runs on the proxy request path and blocking the
+ * event loop stalls all in-flight streams.)
  * Returns the state that was actually persisted (also becomes the in-memory
  * active state).
  */
 export function withRelayState(updater: (s: RelayState) => RelayState): RelayState {
-	const deadline = Date.now() + LOCK_WAIT_MAX_MS;
-	let locked = tryAcquireRelayLock();
-	let delay = LOCK_RETRY_START_MS;
-	while (!locked && Date.now() < deadline) {
-		sleepSync(delay);
-		locked = tryAcquireRelayLock();
-		delay = Math.min(delay * 2, LOCK_RETRY_MAX_MS);
-	}
+	const locked = tryAcquireRelayLock();
 	if (!locked) {
-		logWarn("relay state lock held — proceeding without lock after timeout", {
+		logWarn("relay state lock held — proceeding without lock", {
 			lock: RELAY_STATE_LOCK_FILE,
 		});
 	}

package/src/relay.ts

@@ -156,6 +156,36 @@ export async function relayFetch(
 				break;
 			}
 
+			// Relay host infrastructure 404 (e.g. Vercel DEPLOYMENT_NOT_FOUND or non-JSON 404):
+			// When a relay URL is deleted, misconfigured, or has no deployment, Vercel/Cloudflare
+			// returns edge 404. This is a relay failure, not an upstream API response.
+			const isRelayEdge404 =
+				res.status === 404 &&
+				(Boolean(res.headers.get("x-vercel-error")) ||
+					Boolean(res.headers.get("x-vercel-id")) ||
+					res.headers.get("server")?.toLowerCase().includes("vercel") ||
+					!res.headers.get("content-type")?.includes("json"));
+
+			if (isRelayEdge404) {
+				markRelayFailure(targetUrl, 404, "Deployment or route not found on relay host");
+				lastResponse?.body?.cancel().catch(() => {});
+				lastResponse = res;
+				log(
+					"warn",
+					`relay ${targetUrl} returned edge 404 (deployment missing or route not found) — rolling to next relay`,
+					{ upstream: url },
+					rid,
+				);
+				const now = Date.now();
+				if (now - lastRollNotify > ROLL_NOTIFY_MS) {
+					lastRollNotify = now;
+					const ui = getStatusUi();
+					if (ui?.notify) {
+						ui.notify(`relay ${shortRelayLabel(targetUrl)} failed (HTTP 404) — rolled to next relay`, "warning");
+					}
+				}
+				continue;
+			}
 			if (isRetriableStatus(res.status)) {
 				markRelayFailure(targetUrl, res.status);
 				lastResponse?.body?.cancel().catch(() => {});

package/src/update-checker.ts

@@ -4,7 +4,7 @@ import { fileURLToPath } from "node:url";
 import { UPDATE_CACHE_FILE, UPDATE_CHECK_TTL_MS } from "./config.ts";
 import { logInfo } from "./logger.ts";
 import { logWarn } from "./logger.ts";
-import { getStatusUi } from "./relay-state.ts";
+import { getActiveRelayState, getStatusUi } from "./relay-state.ts";
 import type { ExtensionUIContext } from "./types.ts";
 const REGISTRY_URL = "https://registry.npmjs.org/pi-freeflow/latest";
 /** Strict semver shape: major.minor.patch with optional -prerelease or +build suffix. */
@@ -143,6 +143,10 @@ export function checkForUpdateInBackground(ui?: ExtensionUIContext | null): void
 					const local = getLocalVersion();
 					if (local && compareVersions(latest, local) > 0) {
 						logInfo(`pi-freeflow update available: ${local} -> ${latest} (run /freeflow update)`);
+						// Respect hide: log only, never re-show the widget.
+						try {
+							if (getActiveRelayState().hideWidget) return;
+						} catch {}
 						const targetUi = ui ?? null;
 						if (targetUi?.setStatus) {
 							try { targetUi.setStatus("freeflow", `update: ${local} → ${latest}`); } catch {}