pi-freeflow 1.9.6 → 1.9.8

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to pi-freeflow. Public, user-visible behavior only.
 
+## 1.9.8 - 2026-09-06
+
+### Fixes
+- **Stale model list heals itself (follow-up to #6).** If your saved model list predates a newly added model, the background refresh now repairs the entry (correct endpoint and details) instead of sending requests to the wrong address — no manual `/freeflow refresh` or cache deletion needed.
+- **Paid models stay out of the picker even from old saved lists.** Every read of the saved model list now drops non-free entries, so models requiring an API key cannot linger after an upgrade.
+- **Old saved lists without a sync marker now re-sync once.** A saved list that could never trigger a network check now performs one plain revalidation (then syncs normally), so newly added free models appear without manual intervention. Missing or corrupt lists still fall back silently with no network call.
+- **Upstream errors are now visible in the proxy log.** Failed upstream responses log their status code and model, and a model routed to the wrong endpoint logs the mismatch with the fix (restart Pi/OMP after upgrade).
+
+### Validation
+- TypeScript typecheck passed cleanly (`tsc --noEmit`).
+- Full test suite passed on Windows (304 tests) and Ubuntu Linux (`acerblue`, 305/305 tests passed), including new regressions for the stale-cache shape from #6.
+- Live sweep of all 26 models through a fresh install on `acerblue`: 23/26 answered on first try (both Muse Spark models via the Responses endpoint); the 3 misses are upstream per-model daily quotas (429), zero server errors.
+
+## 1.9.7 - 2026-09-06
+
+### Fixes
+- **Model picker only shows verified free models (fixes #6).** Background catalog refresh now filters out non-free models from upstream endpoints so paid models requiring an API key no longer leak into your picker.
+- **Relay pool automatically recovers from dead deployments (fixes #5).** If a relay URL in your pool returns an infrastructure 404 (such as a missing or deleted Vercel deployment), the proxy marks it as failed and immediately rolls over to your next healthy relay or direct mode instead of getting trapped in a 404 loop.
+
+### Changes
+- **Updated model catalog (26 verified free models: 7 OpenCode Zen + 19 KiloCode Gateway).**
+  - Added `inclusionai/ling-3.0-flash-sante:free` (Ling 3.0 Flash Sante, 262K context, 32K output, reasoning supported). Clean CLI alias `ling-3.0-flash-sante` supported.
+  - Removed `laguna-s-2.1-free` (OpenCode Zen) after upstream dropped free-tier access. `poolside/laguna-s-2.1:free` on Kilo remains active.
+- **Public by default for new relay deployments.** Relays deployed via `/freeflow deploy` are now public by default with no mandatory authentication tokens. This enables seamless copy-paste migration across proxy tools (such as 9router) while maintaining safety guards for allowed AI upstreams.
+
+### Validation
+- TypeScript typecheck passed cleanly (`tsc --noEmit`).
+- Full test suite passed across Windows (299 tests) and Ubuntu Linux (`acerblue-local`, 300/300 tests passed).
+- End-to-end concurrency and failover stress testing verified (100 parallel requests, 20 subagent leases, burst failover).
+
 ## 1.9.6 - 2026-09-03
 
 ### Fixes

package/README.md

@@ -18,7 +18,7 @@ Join devs bypassing rate limits with their own relay pools. BYO, add as many as
 
 | Feature | Description | Value | Cost |
 | :--- | :--- | :--- | :--- |
-| **26 Curated Free Models** | 8 OpenCode Zen + 18 KiloCode Gateway models, up to 1M context & 512K output | Ceiling Unlocked | **$0** |
+| **26 Curated Free Models** | 7 OpenCode Zen + 19 KiloCode Gateway models, up to 1M context & 512K output | Ceiling Unlocked | **$0** |
 | **BYO Relay Pool** | Round-robin load balancing across your Cloudflare Workers & Vercel Edges | Zero Rate Limits | **$0** (your free tiers) |
 | **Adaptive Health & Error Detection** | Auto-cooldown on 429 rate limits, 504 timeouts, and socket drops | 0ms Wasted Latency | **$0** |
 | **Stream Truncation Resilience** | Stateful SSE terminal tracking (`response.failed` / `response.incomplete` injection) | Zero Host Crashes | **$0** |
@@ -38,7 +38,7 @@ Philosophy: **Thin by design.** We only ship model list + relay proxy + log. Hos
 /model → freeflow → pick
 ```
 
-#### OpenCode Zen (8 Models), Responses & Chat API
+#### OpenCode Zen (7 Models), Responses & Chat API
 Optimized for deep reasoning, long-horizon coding & autonomous agentic workflows.
 
 | Model ID | Creator / Lab | Context | Max Output | Thinking | Vision |
@@ -46,13 +46,12 @@ Optimized for deep reasoning, long-horizon coding & autonomous agentic workflows
 | `muse-spark-1.2-contributor-free` | Meta Superintelligence Labs | **1M** (1.048.576) | **131K** (131.072) | `minimal … xhigh` | ✅ |
 | `muse-spark-1.3-contributor-free` | Meta Superintelligence Labs | **1M** (1.048.576) | **131K** (131.072) | `minimal … xhigh` | ✅ |
 | `mimo-v2.5-free` | Xiaomi MiMo | **1M** (1.048.576) | **131K** (131.072) | `minimal … xhigh`\* | ✅ |
-| `laguna-s-2.1-free` | Poolside | **262K** (262.144) | **32K** (32.768) | `minimal … xhigh` | ❌ |
 | `nemotron-3.5-lightning-free` | NVIDIA | **1M** (1.000.000) | **262K** (262.144) | `minimal … xhigh` | ❌ |
 | `nemotron-3-ultra-free` | NVIDIA | **1M** (1.000.000) | **128K** (128.000) | `minimal … xhigh` | ❌ |
 | `big-pickle` | Big Pickle | **200K** (200.000) | **32K** (32.000) | `high / max` | ❌ |
 | `ling-3.0-flash-fin-free` | Inclusion AI | **262K** (262.144) | **131K** (131.072) | `minimal … xhigh` | ❌ |
 
-#### KiloCode Gateway (18 Models), OpenRouter Compatible
+#### KiloCode Gateway (19 Models), OpenRouter Compatible
 Keyless access with `Bearer kilo-free`. Clean slash-free and colon-free CLI aliases supported.
 
 | Model ID | Creator / Lab | Context | Max Output | Thinking | Vision |
@@ -74,6 +73,7 @@ Keyless access with `Bearer kilo-free`. Clean slash-free and colon-free CLI alia
 | `minimax-m3` (`minimax/minimax-m3:free`) | MiniMax | **1M** (1.048.576) | **512K** (524.288) | `minimal…xhigh`\* | ❌ |
 | `ling-3.0-flash-fin` (`inclusionai/ling-3.0-flash-fin:free`) | Inclusion AI | **262K** (262.144) | **32K** (32.768) | `minimal…xhigh`\* | ❌ |
 | `inkling` (`thinkingmachines/inkling:free`) | Thinking Machines | **1M** (1.048.576) | **262K** (262.144) | `minimal…xhigh`\* | ✅ |
+| `ling-3.0-flash-sante` (`inclusionai/ling-3.0-flash-sante:free`) | Inclusion AI | **262K** (262.144) | **32K** (32.768) | `minimal…xhigh`\* | ❌ |
 | `inkling-small` (`thinkingmachines/inkling-small:free`) | Thinking Machines | **1M** (1.048.576) | **262K** (262.144) | `minimal…xhigh`\* | ✅ |
 
 \* Levels are forwarded as-is through the OpenRouter-style nested `reasoning` parameter; effort mapping is decided by each model. MiMo collapses `minimal→low` and `xhigh→high` upstream, so its selector shows 5 labels but only 3 distinct effort values.
@@ -215,7 +215,7 @@ For `api/relay.js`, use the canonical worker source (see below); `vercel.json` s
 
 **Canonical worker source (all platforms)**
 
-The relay worker template is generated per deployment by `/freeflow deploy` and lives in [`src/deploy.ts`](src/deploy.ts): one hardened core plus thin Vercel / Cloudflare / Deno wrappers. Every deployment embeds its own shared secret and enforces the target allowlist (`https://opencode.ai`, `https://api.kilo.ai`), SSRF/private-host guard, relay-path validation, and a header denylist — `x-relay-auth` is checked by the worker and never forwarded upstream.
+The relay worker template is generated per deployment by `/freeflow deploy` and lives in [`src/deploy.ts`](src/deploy.ts): one hardened core plus thin Vercel / Cloudflare / Deno wrappers. Deployed relays are public by default for seamless migration across proxy tools (such as 9router), while enforcing the target allowlist (`https://opencode.ai`, `https://api.kilo.ai`), SSRF/private-host guard, relay-path validation, and a header denylist.
 
 ```js
 // Minimal Cloudflare illustration. Prefer /freeflow deploy: the generated

package/package.json

@@ -1,61 +1,61 @@
-{
-  "name": "pi-freeflow",
-  "type": "module",
-  "version": "1.9.6",
-  "description": "Thin provider for OMP/Pi — model list + dumb relay proxy + log; host pi-ai owns thinking/normalization",
-  "main": "extensions/index.ts",
-  "types": "src/index.ts",
-  "keywords": [
-    "pi-package",
-    "pi-extension",
-    "oh-my-pi",
-    "omp",
-    "free-models",
-    "opencode",
-    "kilocode",
-    "ai-models",
-    "relay"
-  ],
-  "author": "trefeon",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/trefeon/pi-freeflow.git"
-  },
-  "homepage": "https://github.com/trefeon/pi-freeflow#readme",
-  "engines": {
-    "node": ">=22.19.0"
-  },
-  "omp": {
-    "extensions": [
-      "./extensions"
-    ]
-  },
-  "pi": {
-    "extensions": [
-      "./extensions"
-    ]
-  },
-  "files": [
-    "extensions",
-    "src",
-    "README.md",
-    "CHANGELOG.md",
-    "LICENSE"
-  ],
-  "devDependencies": {
-    "@changesets/cli": "^2.27.0",
-    "@types/node": "^22.13.9",
-    "typescript": "^5.8.2",
-    "vitepress": "^1.6.4"
-  },
-  "dependencies": {},
-  "scripts": {
-    "test": "node --experimental-strip-types --import ./test/setup.mjs --test --test-concurrency=1 test/**/*.test.ts",
-    "typecheck": "tsc --noEmit",
-    "smoke": "node --experimental-strip-types -e \"import('./extensions/index.ts').then(() => console.log('✓ Smoke test passed: extensions/index.ts loaded successfully')).catch(err => { console.error(err); process.exit(1); })\"",
-    "changeset": "changeset",
-    "docs:dev": "vitepress dev docs",
-    "docs:build": "vitepress build docs"
-  }
-}
+{
+  "name": "pi-freeflow",
+  "type": "module",
+  "version": "1.9.8",
+  "description": "Thin provider for OMP/Pi — model list + dumb relay proxy + log; host pi-ai owns thinking/normalization",
+  "main": "extensions/index.ts",
+  "types": "src/index.ts",
+  "keywords": [
+    "pi-package",
+    "pi-extension",
+    "oh-my-pi",
+    "omp",
+    "free-models",
+    "opencode",
+    "kilocode",
+    "ai-models",
+    "relay"
+  ],
+  "author": "trefeon",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/trefeon/pi-freeflow.git"
+  },
+  "homepage": "https://github.com/trefeon/pi-freeflow#readme",
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "omp": {
+    "extensions": [
+      "./extensions"
+    ]
+  },
+  "pi": {
+    "extensions": [
+      "./extensions"
+    ]
+  },
+  "files": [
+    "extensions",
+    "src",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node --experimental-strip-types --import ./test/setup.mjs --test --test-concurrency=1 test/**/*.test.ts",
+    "typecheck": "tsc --noEmit",
+    "smoke": "node --experimental-strip-types -e \"import('./extensions/index.ts').then(() => console.log('✓ Smoke test passed: extensions/index.ts loaded successfully')).catch(err => { console.error(err); process.exit(1); })\"",
+    "changeset": "changeset",
+    "docs:dev": "vitepress dev docs",
+    "docs:build": "vitepress build docs"
+  },
+  "devDependencies": {
+    "@changesets/cli": "^2.27.0",
+    "@types/node": "^22.13.9",
+    "typescript": "^5.8.2",
+    "vitepress": "^1.6.4"
+  },
+  "dependencies": {}
+}

package/src/catalog.ts

@@ -37,7 +37,41 @@ export const DEAD_MODEL_IDS = new Set<string>([
 	"hy3-free",
 	"tencent/hy3:free",
 	"meituan/longcat-2.0-free",
+	"laguna-s-2.1-free",
 ]);
+/**
+ * Free-tier allowlist for anything entering the picker via network or stale disk.
+ * Upstream lists paid models alongside free ones (e.g. claude-fable-5-1,
+ * claude-opus-4-*, gemini-3-*) so a bare upstream merge leaks paid entries that
+ * fail with 401 Missing API key. Known static IDs without a free suffix
+ * (e.g. big-pickle) stay allowed via MODEL_MAP.
+ */
+export function isFreeCatalogId(id: string): boolean {
+	if (typeof id !== "string" || id.length === 0) return false;
+	if (DEAD_MODEL_IDS.has(id)) return false;
+	return id.includes("-free") || id.includes(":free") || id.includes("/free") || MODEL_MAP.has(id);
+}
+/**
+ * Purge paid/dead entries from a catalog list and repair known models against
+ * the static definitions. Stale disk caches predate the paid filter and the
+ * muse-spark-1.3 responses-api entry, so loading them verbatim replays a wrong
+ * api (chat/completions for a responses-only model -> upstream 500) until the
+ * 24h TTL expires. Repairing here self-heals on the next refresh without a
+ * reinstall.
+ */
+export function sanitizeCatalogModels(models: RegisteredModel[]): RegisteredModel[] {
+	const out: RegisteredModel[] = [];
+	for (const m of models) {
+		if (!m || typeof m.id !== "string" || !isFreeCatalogId(m.id)) continue;
+		const known = MODEL_MAP.get(m.id);
+		if (known) {
+			out.push({ ...known, source: m.source ?? (KILO_MODEL_IDS.has(m.id) ? "kilo" : "opencode") });
+		} else {
+			out.push(m);
+		}
+	}
+	return out;
+}
 /**
  * In-memory cache of currently active/available free models.
  * Initialized with all 26 verified models for 0ms instant availability.
@@ -71,11 +105,12 @@ export function mergeCatalog(
 	base: RegisteredModel[],
 	fresh: RegisteredModel[],
 ): RegisteredModel[] {
-	const filteredFresh = fresh.filter((m) => !DEAD_MODEL_IDS.has(m.id));
+	const filteredFresh = fresh.filter((m) => m && typeof m.id === "string" && isFreeCatalogId(m.id));
 	const byId = new Map(base.map((m) => [m.id, m]));
 	for (const m of filteredFresh) byId.set(m.id, m);
-	// Ensure no dead IDs survive even if base was stale
-	return [...byId.values()].filter((m) => !DEAD_MODEL_IDS.has(m.id));
+	// Sanitize the merged result so stale paid entries in a pre-fix base and
+	// stale api fields on known models never survive the merge.
+	return sanitizeCatalogModels([...byId.values()]);
 }
 
 /**
@@ -186,7 +221,7 @@ export function readCatalogCache(): CatalogCacheData | null {
 		if (!Array.isArray(data.models)) {
 			return null;
 		}
-		data.models = data.models.filter((m) => !DEAD_MODEL_IDS.has(m.id));
+		data.models = sanitizeCatalogModels(data.models);
 		if (Date.now() - data.timestamp < CATALOG_CACHE_TTL_MS) {
 			return data;
 		}
@@ -248,7 +283,7 @@ export async function refreshCatalog(force = false): Promise<RegisteredModel[]>
 	if (disk && Array.isArray(disk.models) && disk.models.length > 0) {
 		const age = Date.now() - (disk.timestamp ?? 0);
 		if (!force && age < CATALOG_CACHE_TTL_MS) {
-			aliveCatalog = disk.models.filter((m) => !DEAD_MODEL_IDS.has(m.id));
+			aliveCatalog = sanitizeCatalogModels(disk.models);
 			return aliveCatalog;
 		}
 	}
@@ -269,8 +304,12 @@ export async function refreshCatalog(force = false): Promise<RegisteredModel[]>
 		}
 	}
 
-	// Attempt conditional fetch with If-None-Match when we have an etag
-	if (cachedEtag || force) {
+	// Attempt a fetch whenever there is cache material to revalidate: conditional
+	// with If-None-Match when we have an etag, plain otherwise. A pre-fix cache
+	// file with no etag must still go live (acquiring an etag and discovering
+	// new free models) instead of serving stale indefinitely. Corrupt/missing
+	// caches (staleForEtag null) skip the network and fall through to static.
+	if (cachedEtag || force || staleForEtag) {
 		try {
 			const headers: Record<string, string> = { ...opencodeHeaders() };
 			if (cachedEtag) {
@@ -304,7 +343,8 @@ export async function refreshCatalog(force = false): Promise<RegisteredModel[]>
 					}
 				}
 				if (rawList.length > 0) {
-					const fresh = rawList.map((r) => enrichModelDef(r, "opencode"));
+					const freeRawList = rawList.filter((r) => r && typeof r.id === "string" && isFreeCatalogId(r.id));
+					const fresh = freeRawList.map((r) => enrichModelDef(r, "opencode"));
 					const merged = mergeCatalog(aliveCatalog, fresh);
 					aliveCatalog = merged;
 					writeCatalogCache({
@@ -335,7 +375,7 @@ export async function refreshCatalog(force = false): Promise<RegisteredModel[]>
 
 	// Stale cache still better than empty — return it without network (filtered)
 	if (disk && Array.isArray(disk.models) && disk.models.length > 0) {
-		const filtered = disk.models.filter((m) => !DEAD_MODEL_IDS.has(m.id));
+		const filtered = sanitizeCatalogModels(disk.models);
 		if (filtered.length >= ALL_MODELS.length) {
 			aliveCatalog = filtered;
 			return aliveCatalog;
@@ -347,7 +387,7 @@ export async function refreshCatalog(force = false): Promise<RegisteredModel[]>
 			const raw = fs.readFileSync(CATALOG_CACHE_FILE, "utf8");
 			const stale = JSON.parse(raw) as CatalogCacheData;
 			if (Array.isArray(stale.models) && stale.models.length > 0) {
-				const filtered = stale.models.filter((m) => !DEAD_MODEL_IDS.has(m.id));
+				const filtered = sanitizeCatalogModels(stale.models);
 				if (filtered.length >= ALL_MODELS.length) {
 					aliveCatalog = filtered;
 					return aliveCatalog;

package/src/commands.ts

@@ -370,7 +370,8 @@ export function createCommandSpec(
 					);
 					relayState = withRelayState((s) => {
 						const r = ensureRelay(s, url, `deployed ${name}`);
-						r.auth = auth;
+						if (auth) r.auth = auth;
+						else delete r.auth;
 						s.enabled = true;
 						s.url = url;
 						return s;

package/src/deploy.ts

@@ -160,6 +160,7 @@ export async function deployVercelRelay(
 	token: string,
 	name: string,
 	onProgress?: (msg: string) => void,
+	authSecret: string = "",
 ): Promise<{ url: string; auth: string }> {
 	name = baseRelayName(name) || "relay-worker";
 	const auth = {
@@ -169,9 +170,9 @@ export async function deployVercelRelay(
 	// 1. Create deployment (3 inline files, no git repository required)
 	onProgress?.("Uploading relay files to Vercel…");
 	log("info", `Starting Vercel deployment: ${name}`);
-	// Per-deployment shared secret: embedded in the worker, persisted on the
-	// relay-state entry by the caller, and required via x-relay-auth.
-	const relayAuth = randomBytes(24).toString("base64url");
+	// Public by default for easy migration with 9router and other proxy tools.
+	// When authSecret is provided, embeds the shared secret for private auth.
+	const relayAuth = authSecret || "";
 
 	const dep = await fetch(`${VERCEL_API}/v13/deployments`, {
 		method: "POST",
@@ -339,6 +340,7 @@ export async function deployCloudflareWorker(
 	token: string,
 	name: string,
 	onProgress?: (msg: string) => void,
+	authSecret: string = "",
 ): Promise<{ url: string; auth: string }> {
 	const auth = { Authorization: `Bearer ${token}` };
 	const scriptName = cloudflareScriptName(name);
@@ -358,9 +360,9 @@ export async function deployCloudflareWorker(
 
 	// 2. Upload the module worker script (multipart: main module + metadata)
 	onProgress?.("Uploading relay worker to Cloudflare…");
-	// Per-deployment shared secret: embedded in the worker, persisted on the
-	// relay-state entry by the caller, and required via x-relay-auth.
-	const relayAuth = randomBytes(24).toString("base64url");
+	// Public by default for easy migration with 9router and other proxy tools.
+	// When authSecret is provided, embeds the shared secret for private auth.
+	const relayAuth = authSecret || "";
 	const formData = new FormData();
 	formData.append(
 		"index.js",
@@ -452,12 +454,11 @@ export async function deployDenoRelay(
 	token: string,
 	name: string,
 	onProgress?: (msg: string) => void,
+	authSecret: string = "",
 ): Promise<{ url: string; auth: string }> {
+	const slug = denoProjectName(name);
 	const auth = { Authorization: `Bearer ${token}` };
 	const jsonHeaders = { ...auth, "Content-Type": "application/json" };
-	const slug = denoProjectName(name);
-
-	// 1. Create the app
 	onProgress?.("Creating Deno Deploy app…");
 	log("info", `Starting Deno Deploy deployment: ${slug}`);
 	const createRes = await fetch(`${DENO_API}/apps`, {
@@ -495,9 +496,9 @@ export async function deployDenoRelay(
 
 	// 2. Push the relay source as a single-file revision
 	onProgress?.("Uploading relay script to Deno Deploy…");
-	// Per-deployment shared secret: embedded in the worker, persisted on the
-	// relay-state entry by the caller, and required via x-relay-auth.
-	const relayAuth = randomBytes(24).toString("base64url");
+	// Public by default for easy migration with 9router and other proxy tools.
+	// When authSecret is provided, embeds the shared secret for private auth.
+	const relayAuth = authSecret || "";
 	const deployRes = await fetch(`${DENO_API}/apps/${appId}/deploy`, {
 		method: "POST",
 		headers: jsonHeaders,

package/src/index.ts

@@ -1,7 +1,7 @@
 /**
  * pi-freeflow — Modular, high-resiliency LLM extension for Pi & Oh My Pi (OMP)
  *
- * Provides access to 26 free models (8 OpenCode Zen + 18 KiloCode Gateway) with:
+ * Provides access to 26 free models (7 OpenCode Zen + 19 KiloCode Gateway) with:
  * - Single-port daemon reuse on 28180 across concurrent subagents
  * - Multi-cloud rolling egress relays (Vercel Edge, Cloudflare, Deno)
  * - 0ms instant startup with verified static catalog and background live health checks

package/src/models.ts

@@ -2,8 +2,8 @@
  * Static model definitions and upstream routing catalogs for pi-freeflow
  *
  * Defines the 26 verified free models:
- * - 8 OpenCode Zen models (2 Responses API + 6 Chat Completions)
- * - 18 KiloCode Keyless Gateway models (17 OpenRouter format + 1 Standard format)
+ * - 7 OpenCode Zen models (2 Responses API + 5 Chat Completions)
+ * - 19 KiloCode Keyless Gateway models (18 OpenRouter format + 1 Standard format)
  */
 
 import type { ModelDef, ThinkingLevelMap, Upstream } from "./types.ts";
@@ -111,22 +111,6 @@ export const OPENCODE_MODELS: ModelDef[] = [
 			xhigh: null,
 			max: "max",},
 	},
-	{
-		id: "laguna-s-2.1-free",
-		name: "Laguna S 2.1 (256K)",
-		reasoning: true,
-		contextWindow: 262_144,
-		maxTokens: 32_768,
-		input: ["text"],
-		thinkingLevelMap: {
-			off: null,
-			minimal: "minimal",
-			low: "low",
-			medium: "medium",
-			high: "high",
-			xhigh: "xhigh",
-			max: null,},
-	},
 	{
 		id: "ling-3.0-flash-fin-free",
 		name: "Ling 3.0 Flash Fin (256K)",
@@ -345,6 +329,16 @@ export const KILO_MODELS: ModelDef[] = [
 	thinkingFormat: "openrouter",
 	thinkingLevelMap: KILO_REASONING_MAP,
 },
+	{
+		id: "inclusionai/ling-3.0-flash-sante:free",
+		name: "Ling 3.0 Flash Sante",
+		reasoning: true,
+		contextWindow: 262_144,
+		maxTokens: 32_768,
+		input: ["text"],
+		thinkingFormat: "openrouter",
+		thinkingLevelMap: KILO_REASONING_MAP,
+	},
 ];
 
 /**
@@ -368,6 +362,7 @@ export const MODEL_ALIASES: Record<string, string> = {
 	"minimax-m2.7": "minimax/minimax-m2.7:free",
 	"minimax-m3": "minimax/minimax-m3:free",
 	"ling-3.0-flash-fin": "inclusionai/ling-3.0-flash-fin:free",
+	"ling-3.0-flash-sante": "inclusionai/ling-3.0-flash-sante:free",
 	"inkling": "thinkingmachines/inkling:free",
 	"inkling-small": "thinkingmachines/inkling-small:free",
 	// provider-prefixed short aliases (slash-normalized)

package/src/proxy.ts

@@ -30,7 +30,7 @@ import {
 } from "./config.ts";
 
 import { isDebugEnabled, log } from "./logger.ts";
-import { KILO_MODEL_IDS, resolveCanonicalModelId } from "./models.ts";
+import { KILO_MODEL_IDS, MODEL_MAP, resolveCanonicalModelId } from "./models.ts";
 // normalize removed — host pi-ai already normalizes thinking/reasoning before proxy
 import { checkRateLimit } from "./rate-limiter.ts";
 import { relayFetch } from "./relay.ts";
@@ -524,6 +524,16 @@ export function startProxy(
 				return;
 			}
 
+			// Stale-registration guard: responses-only models (muse-spark-*) must
+			// reach upstream via /v1/responses. A chat/completions request for one
+			// means the host still holds a pre-fix provider registration (stale
+			// disk cache or no restart after upgrade) and upstream answers 500.
+			if (!isKilo && typeof parsedBody?.model === "string" && target.pathname.endsWith("/chat/completions")) {
+				const knownDef = MODEL_MAP.get(String(parsedBody.model));
+				if (knownDef?.api === "openai-responses") {
+					log("warn", `model ${String(parsedBody.model)} expects openai-responses but got ${target.pathname} — stale provider registration (restart Pi/OMP after upgrade)`, { model: String(parsedBody.model), path: target.pathname }, reqId);
+				}
+			}
 			try {
 				if (isKilo && parsedBody) {
 					// Header-wait timeout + client-disconnect abort: once headers
@@ -659,6 +669,9 @@ export function startProxy(
 										relayState.url,
 									);
 								} else {
+									if (!response.ok) {
+										log("warn", `upstream ${response.status} for model ${String((parsedBody as Record<string, unknown> | null)?.model ?? "?")} via relay`, { status: response.status, model: (parsedBody as Record<string, unknown> | null)?.model, path: req.url }, reqId);
+									}
 									const data = await response.text();
 									const ct =
 										response.headers.get("content-type") ||
@@ -716,6 +729,9 @@ export function startProxy(
 						clearTimeout(timeoutId);
 						res.off("close", onClientClose);
 						req.off("error", onReqError);
+						if (upstreamRes.status >= 400) {
+							log("warn", `direct upstream ${upstreamRes.status} for model ${String(parsedBody?.model ?? "?")} ${target.pathname}`, { status: upstreamRes.status, model: parsedBody?.model, path: target.pathname }, reqId);
+						}
 
 						const outHeaders: Record<string, string> = {};
 						for (const h of ["content-type", "cache-control", "x-request-id"] as const) {

package/src/relay.ts

@@ -156,6 +156,36 @@ export async function relayFetch(
 				break;
 			}
 
+			// Relay host infrastructure 404 (e.g. Vercel DEPLOYMENT_NOT_FOUND or non-JSON 404):
+			// When a relay URL is deleted, misconfigured, or has no deployment, Vercel/Cloudflare
+			// returns edge 404. This is a relay failure, not an upstream API response.
+			const isRelayEdge404 =
+				res.status === 404 &&
+				(Boolean(res.headers.get("x-vercel-error")) ||
+					Boolean(res.headers.get("x-vercel-id")) ||
+					res.headers.get("server")?.toLowerCase().includes("vercel") ||
+					!res.headers.get("content-type")?.includes("json"));
+
+			if (isRelayEdge404) {
+				markRelayFailure(targetUrl, 404, "Deployment or route not found on relay host");
+				lastResponse?.body?.cancel().catch(() => {});
+				lastResponse = res;
+				log(
+					"warn",
+					`relay ${targetUrl} returned edge 404 (deployment missing or route not found) — rolling to next relay`,
+					{ upstream: url },
+					rid,
+				);
+				const now = Date.now();
+				if (now - lastRollNotify > ROLL_NOTIFY_MS) {
+					lastRollNotify = now;
+					const ui = getStatusUi();
+					if (ui?.notify) {
+						ui.notify(`relay ${shortRelayLabel(targetUrl)} failed (HTTP 404) — rolled to next relay`, "warning");
+					}
+				}
+				continue;
+			}
 			if (isRetriableStatus(res.status)) {
 				markRelayFailure(targetUrl, res.status);
 				lastResponse?.body?.cancel().catch(() => {});