pi-freeflow 1.9.8 → 1.9.9

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to pi-freeflow. Public, user-visible behavior only.
 
+## 1.9.9 - 2026-09-06
+
+### Fixes
+- **Removed our own request cap — sorry, that one was on us.** The proxy used to enforce a built-in request limit and could answer 429 before upstream quota was actually exhausted. That was a bug, not your quota. From this version the proxy never rejects on quota itself: a 429 only surfaces when the upstream — and every relay in your pool — genuinely is rate-limited, and that response now points you at `/freeflow deploy` to add relay egress.
+
+### Validation
+- TypeScript typecheck passed cleanly (`tsc --noEmit`) on Windows and Ubuntu Linux (`acerblue-local`).
+- Full test suite: Windows 302 tests (301 pass + 1 Linux-only skip), `acerblue-local` 302/302 pass, including new regressions locking the guidance hint onto genuine upstream 429s (direct path and exhausted relay pool).
+- Sandboxed stress harness 7/7 on `acerblue-local`; extension smoke load green on both machines.
+
 ## 1.9.8 - 2026-09-06
 
 ### Fixes

package/README.md

@@ -347,7 +347,6 @@ src/
 ├── proxy.ts          # local proxy server (127.0.0.1:28180)
 ├── relay.ts          # relay selection & round-robin
 ├── relay-state.ts    # relay pool state, health tracking
-├── rate-limiter.ts   # in-memory sliding rate limiter (200/day, 200/hour)
 ├── stream-pipe.ts    # SSE stream piping & truncation resilience
 ├── commands.ts       # /freeflow CLI subcommands
 ├── deploy.ts         # guided relay deploy (vercel/cloudflare/deno)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-freeflow",
   "type": "module",
-  "version": "1.9.8",
+  "version": "1.9.9",
   "description": "Thin provider for OMP/Pi — model list + dumb relay proxy + log; host pi-ai owns thinking/normalization",
   "main": "extensions/index.ts",
   "types": "src/index.ts",

package/src/config.ts

@@ -7,7 +7,6 @@ import { homedir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { readFileSync } from "node:fs";
-import type { Upstream } from "./types.ts";
 
 // Package version — stale-daemon detection in the shared-port reuse path.
 let PKG_VERSION = "0.0.0";
@@ -68,12 +67,6 @@ export const CATALOG_CACHE_TTL_MS = 86_400_000; // 24 hours — delegate to host
 export const LOG_MAX_BYTES = 10 * 1024 * 1024; // 10MB per file
 export const LOG_MAX_FILES = 10; // 10 archived + current ≈ 110MB max (≈100MB per your request, rotated, not single 100MB blob)
 
-// ── Rate Limit Maxima ───────────────────────────────────────────────
-export const RATE_LIMIT_MAX: Record<Upstream, number> = {
-	opencode: 200, // public free quota: requests per UTC day per IP
-	kilo: 200, // documented gateway quota: requests per 1-hour window per IP
-};
-
 // ── Whitelists & Security ───────────────────────────────────────────
 export const ALLOWED_PATH_PATTERN = /^\/v1\/[a-zA-Z0-9/_.,\-?&= %]*$/;
 export const PATH_TRAVERSAL_PATTERN = /\.\./;

package/src/index.ts

@@ -43,7 +43,6 @@ import type {
 export * from "./types.ts";
 export * from "./config.ts";
 export * from "./logger.ts";
-export * from "./rate-limiter.ts";
 export * from "./models.ts";
 export * from "./catalog.ts";
 export * from "./relay-state.ts";

package/src/proxy.ts

@@ -32,11 +32,9 @@ import {
 import { isDebugEnabled, log } from "./logger.ts";
 import { KILO_MODEL_IDS, MODEL_MAP, resolveCanonicalModelId } from "./models.ts";
 // normalize removed — host pi-ai already normalizes thinking/reasoning before proxy
-import { checkRateLimit } from "./rate-limiter.ts";
 import { relayFetch } from "./relay.ts";
 import { getActiveRelayState } from "./relay-state.ts";
 import { pipeUpstreamStream } from "./stream-pipe.ts";
-import type { Upstream } from "./types.ts";
 
 
 let shutdownShouldExit = false;
@@ -45,8 +43,9 @@ export function setShutdownShouldExit(v: boolean): void {
 }
 
 /**
- * Direct-mode 429 hint throttle: the guidance hint is emitted at most once per
- * 10 minutes per process so repeated rate-limit responses don't spam clients.
+ * Natural-429 hint throttle: the deploy guidance hint is attached to upstream
+ * 429 passthroughs at most once per 10 minutes per process so repeated
+ * rate-limit responses don't spam clients.
  */
 let last429HintAt = 0;
 function shouldShow429Hint(): boolean {
@@ -58,6 +57,26 @@ function shouldShow429Hint(): boolean {
 /** Test-only: reset 429 hint throttle */
 export function _reset429HintForTest(): void { last429HintAt = 0; }
 
+/** Deploy guidance attached to a natural upstream 429 once the throttle allows. */
+const RATE_LIMIT_HINT =
+	"Shared free-tier IP quota reached. Add your own relay egress: /freeflow deploy (Vercel 1M/mo recommended)";
+
+/**
+ * Attach the deploy hint to a natural upstream 429 JSON body. Anything else —
+ * non-429 statuses, non-JSON bodies — passes through untouched without
+ * consuming the throttle slot.
+ */
+function withRateLimitHint(status: number, data: string): string {
+	if (status !== 429) return data;
+	try {
+		const parsed: unknown = JSON.parse(data);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed) && shouldShow429Hint()) {
+			return JSON.stringify({ ...(parsed as Record<string, unknown>), hint: RATE_LIMIT_HINT });
+		}
+	} catch {}
+	return data;
+}
+
 /**
  * Extract client IP address from incoming HTTP request.
  */
@@ -504,26 +523,8 @@ export function startProxy(
 				}
 			} catch {}
 
-			const upstream: Upstream = isKilo ? "kilo" : "opencode";
 			const isStream = parsedBody?.stream === true;
 
-			// Seamless sub-agent rate-limit: when relay pool is active, bypass
-			// local per-IP quota (127.0.0.1 shared by all subagents) — upstream
-			// quota is per-egress-IP and relayFetch already rolls on 429 across
-			// 7 candidates until a response succeeds. Without this, parallel
-			// subagents sharing the daemon would hit local 429 before relay failover.
-			const relayPreview = getActiveRelayState();
-			const willUseRelay = relayPreview.enabled && Boolean(relayPreview.url || relayPreview.relays.length > 0);
-			if (!willUseRelay && !checkRateLimit(clientIP, upstream)) {
-				const body: Record<string, unknown> = { error: "rate limit exceeded" };
-				if (shouldShow429Hint()) {
-					body.hint = "Shared free-tier IP quota reached. Add your own relay egress: /freeflow deploy (Vercel 1M/mo recommended)";
-				}
-				res.writeHead(429, { "content-type": "application/json" });
-				res.end(JSON.stringify(body));
-				return;
-			}
-
 			// Stale-registration guard: responses-only models (muse-spark-*) must
 			// reach upstream via /v1/responses. A chat/completions request for one
 			// means the host still holds a pre-fix provider registration (stale
@@ -593,7 +594,7 @@ export function startProxy(
 							undefined,
 						);
 					} else {
-						const data = await response.text();
+						const data = withRateLimitHint(response.status, await response.text());
 						const ct =
 							response.headers.get("content-type") || "application/json";
 						res.writeHead(response.status, { "content-type": ct });
@@ -672,7 +673,7 @@ export function startProxy(
 									if (!response.ok) {
 										log("warn", `upstream ${response.status} for model ${String((parsedBody as Record<string, unknown> | null)?.model ?? "?")} via relay`, { status: response.status, model: (parsedBody as Record<string, unknown> | null)?.model, path: req.url }, reqId);
 									}
-									const data = await response.text();
+									const data = withRateLimitHint(response.status, await response.text());
 									const ct =
 										response.headers.get("content-type") ||
 										"application/json";
@@ -733,6 +734,17 @@ export function startProxy(
 							log("warn", `direct upstream ${upstreamRes.status} for model ${String(parsedBody?.model ?? "?")} ${target.pathname}`, { status: upstreamRes.status, model: parsedBody?.model, path: target.pathname }, reqId);
 						}
 
+						// Natural 429: every relay plus direct is rate-limited — buffer the
+						// JSON error and attach the deploy hint instead of piping it
+						// through as a stream body.
+						if (upstreamRes.status === 429) {
+							const data = withRateLimitHint(429, await upstreamRes.text());
+							const ct429 = upstreamRes.headers.get("content-type") || "application/json";
+							res.writeHead(429, { "content-type": ct429 });
+							res.end(data);
+							return;
+						}
+
 						const outHeaders: Record<string, string> = {};
 						for (const h of ["content-type", "cache-control", "x-request-id"] as const) {
 							const v = upstreamRes.headers.get(h);

package/src/types.ts

@@ -76,19 +76,6 @@ export interface CatalogCacheData {
 	etag?: string;
 }
 
-export interface RateLimitEntry {
-	count: number;
-	resetAt: number;
-}
-
-export interface RateLimitStatus {
-	allowed: boolean;
-	remaining: number;
-	resetAt: number;
-	limit: number;
-	count: number;
-}
-
 // ── Extension API & UI Types (compatible with @earendil-works/pi-coding-agent) ──
 
 export interface ExtensionUIContext {

package/src/rate-limiter.ts

@@ -1,148 +0,0 @@
-/**
- * Memory-safe sliding rate limiter for pi-freeflow
- * Enforces:
- *  - OpenCode Zen: 200 requests per UTC day per IP
- *  - KiloCode Gateway: 200 requests per 1-hour window per IP
- */
-
-import { RATE_LIMIT_MAX } from "./config.ts";
-import type { RateLimitEntry, RateLimitStatus, Upstream } from "./types.ts";
-
-const rateLimitMap = new Map<string, RateLimitEntry>();
-let lastCleanupAt = 0;
-const CLEANUP_INTERVAL_MS = 60_000; // 1 minute
-const MAX_MAP_SIZE_BEFORE_CLEANUP = 500;
-
-/**
- * Calculate the next reset timestamp in epoch milliseconds.
- */
-export function rateLimitResetAt(upstream: Upstream, now: number): number {
-	if (upstream === "kilo") {
-		return now + 60 * 60_000; // 1 hour sliding window
-	}
-	// OpenCode resets at 00:00:00.000 UTC of next day
-	const nextUtcDay = new Date(now);
-	nextUtcDay.setUTCHours(24, 0, 0, 0);
-	return nextUtcDay.getTime();
-}
-
-/**
- * Construct a cache key for an upstream + client IP.
- */
-export function rateLimitKey(
-	upstream: Upstream,
-	ip: string,
-	now: number = Date.now(),
-): string {
-	const safeIp = ip.trim() || "127.0.0.1";
-	if (upstream === "kilo") {
-		return `kilo:${safeIp}`;
-	}
-	const utcDate = new Date(now).toISOString().slice(0, 10);
-	return `opencode:${utcDate}:${safeIp}`;
-}
-
-/**
- * Purge expired rate limit buckets to guarantee bounded memory usage.
- * Returns the number of evicted entries.
- */
-export function cleanupRateLimits(now: number = Date.now()): number {
-	let evicted = 0;
-	for (const [key, entry] of rateLimitMap.entries()) {
-		if (entry.resetAt <= now) {
-			rateLimitMap.delete(key);
-			evicted++;
-		}
-	}
-	lastCleanupAt = now;
-	return evicted;
-}
-
-/**
- * Trigger cleanup if interval elapsed or map has grown past the high watermark.
- */
-function maybeCleanup(now: number): void {
-	if (
-		now - lastCleanupAt > CLEANUP_INTERVAL_MS ||
-		rateLimitMap.size > MAX_MAP_SIZE_BEFORE_CLEANUP
-	) {
-		cleanupRateLimits(now);
-	}
-}
-
-/**
- * Check and consume a quota token for the given IP and upstream.
- * Returns true if request is permitted, false if rate limit exceeded.
- */
-export function checkRateLimit(
-	ip: string,
-	upstream: Upstream,
-	now: number = Date.now(),
-): boolean {
-	maybeCleanup(now);
-
-	const key = rateLimitKey(upstream, ip, now);
-	const entry = rateLimitMap.get(key);
-	const maxLimit = RATE_LIMIT_MAX[upstream] ?? 200;
-
-	if (!entry || entry.resetAt <= now) {
-		rateLimitMap.set(key, {
-			count: 1,
-			resetAt: rateLimitResetAt(upstream, now),
-		});
-		return true;
-	}
-
-	if (entry.count >= maxLimit) {
-		return false;
-	}
-
-	entry.count++;
-	return true;
-}
-
-/**
- * Query current rate limit quota and remaining requests without mutating count.
- */
-export function getRateLimitStatus(
-	ip: string,
-	upstream: Upstream,
-	now: number = Date.now(),
-): RateLimitStatus {
-	const key = rateLimitKey(upstream, ip, now);
-	const entry = rateLimitMap.get(key);
-	const limit = RATE_LIMIT_MAX[upstream] ?? 200;
-
-	if (!entry || entry.resetAt <= now) {
-		return {
-			allowed: true,
-			remaining: limit,
-			resetAt: rateLimitResetAt(upstream, now),
-			limit,
-			count: 0,
-		};
-	}
-
-	const remaining = Math.max(0, limit - entry.count);
-	return {
-		allowed: remaining > 0,
-		remaining,
-		resetAt: entry.resetAt,
-		limit,
-		count: entry.count,
-	};
-}
-/**
- * Clear all rate limit records (primarily for testing and reset commands).
- */
-export function resetRateLimits(): void {
-	rateLimitMap.clear();
-	lastCleanupAt = Date.now();
-}
-
-/**
- * Get active count of entries in the rate limit table.
- */
-export function getRateLimitMapSize(): number {
-	return rateLimitMap.size;
-}