pi-multikey 1.7.1 → 1.8.1

package/pool.ts

@@ -6,20 +6,23 @@
  * concurrent subagents across different keys automatically.
  */
 
-import type { PoolConfig } from "./config.ts";
+import type { KeyCredential, PoolConfig } from "./config.ts";
 import { maskKey } from "./config.ts";
 
-export type KeyOutcome = "ok" | "rate_limited" | "invalid" | "error";
+export type KeyOutcome = "ok" | "rate_limited" | "quota_exhausted" | "invalid" | "error";
 
 export interface Lease {
 	key: string;
 	label: string;
 	acquiredAt: number;
+	/** OAuth credential behind this key, when it has one (Cline accounts). */
+	credential?: KeyCredential;
 }
 
 interface KeyStat {
 	ok: number;
 	rateLimited: number;
+	quotaLimited: number;
 	invalid: number;
 	errors: number;
 	inflight: number;
@@ -29,7 +32,7 @@ interface KeyStat {
 }
 
 function newStat(): KeyStat {
-	return { ok: 0, rateLimited: 0, invalid: 0, errors: 0, inflight: 0, cooldownUntil: 0, lastUsed: 0 };
+	return { ok: 0, rateLimited: 0, quotaLimited: 0, invalid: 0, errors: 0, inflight: 0, cooldownUntil: 0, lastUsed: 0 };
 }
 
 export class KeyPool {
@@ -49,10 +52,10 @@ export class KeyPool {
 		return s;
 	}
 
-	private enabledKeys(): { key: string; label: string }[] {
+	private enabledKeys(): { key: string; label: string; credential?: KeyCredential }[] {
 		return this.config.keys
 			.filter((k) => k.enabled !== false)
-			.map((k) => ({ key: k.key, label: k.label ?? maskKey(k.key) }));
+			.map((k) => ({ key: k.key, label: k.label ?? maskKey(k.key), credential: k.credential }));
 	}
 
 	get size(): number {
@@ -85,7 +88,7 @@ export class KeyPool {
 				const chosen = candidates[0]!;
 				chosen.stat.inflight++;
 				chosen.stat.lastUsed = now;
-				return { key: chosen.key, label: chosen.label, acquiredAt: now };
+				return { key: chosen.key, label: chosen.label, acquiredAt: now, credential: chosen.credential };
 			}
 
 			// All keys cooling: wait for the earliest recovery (bounded to 60s).
@@ -115,6 +118,14 @@ export class KeyPool {
 				s.cooldownUntil = Math.max(s.cooldownUntil, now + (cooldownMs ?? this.config.cooldownMs ?? 20_000));
 				s.cooldownReason = "429";
 				break;
+			case "quota_exhausted":
+				// Daily per-account quota (Cline free models): the server tells us when
+				// it resets ("Try again in 23h 59m"), so the cooldown is hours, not the
+				// 20s rate-limit rotation. A sane fallback if the parse ever fails.
+				s.quotaLimited++;
+				s.cooldownUntil = Math.max(s.cooldownUntil, now + (cooldownMs ?? 30 * 60_000));
+				s.cooldownReason = "daily limit";
+				break;
 			case "invalid":
 				s.invalid++;
 				s.cooldownUntil = Math.max(s.cooldownUntil, now + (this.config.invalidKeyCooldownMs ?? 600_000));
@@ -147,6 +158,34 @@ export class KeyPool {
 		});
 	}
 
+	/**
+	 * Persist a refreshed OAuth credential onto the key's config entry (the
+	 * access token also becomes the key value so every consumer sees the same
+	 * token). Live stats move with the rotation — they are keyed by the key
+	 * string, so the entry's counters (including its in-flight count) must be
+	 * re-keyed to the new token. The caller saves the config to disk.
+	 */
+	applyClineCredential(lease: Lease, update: { accessToken: string; refreshToken: string; expiresAt?: number }): void {
+		const entry = this.config.keys.find(
+			(k) => k.credential === lease.credential || (k.credential && lease.credential && k.credential.refreshToken === lease.credential.refreshToken),
+		);
+		if (!entry?.credential) return;
+		const oldKey = entry.key;
+		entry.credential.refreshToken = update.refreshToken;
+		entry.credential.accessToken = update.accessToken;
+		entry.credential.expiresAt = update.expiresAt;
+		entry.key = update.accessToken;
+		if (oldKey !== update.accessToken) {
+			const stat = this.stats.get(oldKey);
+			if (stat) {
+				this.stats.delete(oldKey);
+				this.stats.set(update.accessToken, stat);
+			}
+		}
+		lease.key = update.accessToken;
+		lease.credential = entry.credential;
+	}
+
 	/** One row per configured key, for TUI status display. */
 	statusRows(): {
 		label: string;
@@ -155,10 +194,12 @@ export class KeyPool {
 		inflight: number;
 		ok: number;
 		rateLimited: number;
+		quotaLimited: number;
 		invalid: number;
 		errors: number;
 		cooldownRemainingMs: number;
 		cooldownReason?: string;
+		credential?: KeyCredential;
 	}[] {
 		const now = Date.now();
 		return this.config.keys.map((k) => {
@@ -170,10 +211,12 @@ export class KeyPool {
 				inflight: s.inflight,
 				ok: s.ok,
 				rateLimited: s.rateLimited,
+				quotaLimited: s.quotaLimited,
 				invalid: s.invalid,
 				errors: s.errors,
 				cooldownRemainingMs: Math.max(0, s.cooldownUntil - now),
 				cooldownReason: s.cooldownReason,
+				credential: k.credential,
 			};
 		});
 	}

package/presets.ts

@@ -6,6 +6,8 @@
  * live probes — see README "Presets" for the evidence trail.
  */
 
+import { createHash } from "node:crypto";
+
 import type { PoolConfig, PoolModelConfig } from "./config.ts";
 
 export interface Preset {
@@ -55,34 +57,13 @@ export const PRESETS: Preset[] = [
 	{
 		id: "b-ai",
 		name: "B.AI",
-		description: "api.b.ai — DeepSeek V4 Flash (+vision), Hunyuan Hy3, MiMo V2.5, Qwen3.8, GLM 5.3 (6 models)",
+		description: "api.b.ai — Hunyuan Hy3, MiMo V2.5, Qwen3.8, GLM 5.3 (4 models)",
 		defaultPoolId: "bai",
 		baseUrl: "https://api.b.ai/v1",
 		api: "openai-completions",
 		compat: BAI_COMPAT,
 		keyHint: "https://www.b.ai/ → API Keys (one entry per key; multiple keys share the load)",
 		models: [
-			{
-				// docs.b.ai/llmservice/models/deepseek-v4-flash + api-docs.deepseek.com/guides/thinking_mode
-				// Native effort tiers: low/high/max (medium & xhigh alias to high server-side).
-				id: "deepseek-v4-flash",
-				name: "DeepSeek V4 Flash",
-				reasoning: true,
-				input: ["text"],
-				contextWindow: 1_000_000,
-				maxTokens: 384_000,
-				thinkingLevelMap: levels({ off: "none", low: "low", high: "high", max: "max" }),
-			},
-			{
-				// No public card; experimental vision build on the same V4 Flash backbone.
-				id: "deepseek-v4-flash-vision-exp",
-				name: "DeepSeek V4 Flash Vision (exp)",
-				reasoning: true,
-				input: ["text", "image"],
-				contextWindow: 1_000_000,
-				maxTokens: 384_000,
-				thinkingLevelMap: levels({ off: "none", low: "low", high: "high", max: "max" }),
-			},
 			{
 				// docs.b.ai/llmservice/models/hy3 — Tencent modes: no_think / think_low / think_high.
 				id: "hy3",
@@ -131,7 +112,7 @@ export const PRESETS: Preset[] = [
 	{
 		id: "opencode-zen",
 		name: "OpenCode Zen",
-		description: "opencode.ai/zen free tier — Big Pickle, DeepSeek V4 Flash, MiMo V2.5, Hy3, Ling 3.0 Fin, Nemotron 3 Ultra/Lightning, Muse Spark 1.2 (8 free models)",
+		description: "opencode.ai/zen free tier — Big Pickle, MiMo V2.5, Ling 3.0 Fin, Nemotron 3 Ultra/Lightning, Muse Spark 1.3 (6 free models)",
 		defaultPoolId: "zen",
 		baseUrl: "https://opencode.ai/zen/v1",
 		api: "openai-completions",
@@ -148,22 +129,10 @@ export const PRESETS: Preset[] = [
 				maxTokens: 32_000,
 				compat: ZEN_CHAT_COMPAT,
 			},
-			{
-				// DeepSeek V4 Flash on the Zen FREE tier — id confirmed via GET /zen/v1/models
-				// (deepseek-v4-flash-free); serving limits 200K/128K from models.dev `opencode`
-				// provider. Thinking levels mirror the b.ai preset's deepseek-v4-flash
-				// (off/low/high/max; medium & xhigh alias to high server-side).
-				id: "deepseek-v4-flash-free",
-				name: "DeepSeek V4 Flash Free",
-				reasoning: true,
-				input: ["text"],
-				contextWindow: 200_000,
-				maxTokens: 128_000,
-				thinkingLevelMap: levels({ off: "none", low: "low", high: "high", max: "max" }),
-				compat: ZEN_CHAT_COMPAT,
-			},
 			{
 				// Xiaomi MiMo V2.5 omni; raw model is 1M ctx but the Zen FREE tier serves 200K/32K.
+				// Repo metadata: inputs text/image/audio/video (pi tracks text + image),
+				// reasoning via separate reasoning_content stream, no reasoning_options.
 				id: "mimo-v2.5-free",
 				name: "MiMo V2.5 Free",
 				reasoning: true,
@@ -172,19 +141,6 @@ export const PRESETS: Preset[] = [
 				maxTokens: 32_000,
 				compat: ZEN_CHAT_COMPAT,
 			},
-			{
-				// Tencent Hy3; raw model is 262K ctx but the Zen FREE tier serves 190K/64K.
-				// thinkingFormat defaults to reasoning_effort: levels map straight to Hy3's
-				// low/medium/high effort tiers; no off toggle on the free endpoint.
-				id: "hy3-free",
-				name: "Hy3 Free",
-				reasoning: true,
-				input: ["text"],
-				contextWindow: 190_000,
-				maxTokens: 64_000,
-				thinkingLevelMap: levels({ low: "low", medium: "medium", high: "high" }),
-				compat: ZEN_CHAT_COMPAT,
-			},
 			{
 				// Finance-tuned Ling 3.0 Flash; reasoning toggle only (no effort tiers).
 				id: "ling-3.0-flash-fin-free",
@@ -216,26 +172,127 @@ export const PRESETS: Preset[] = [
 				compat: ZEN_CHAT_COMPAT,
 			},
 			{
-				// Meta Muse Spark 1.2 Contributor Free — OpenAI Responses API endpoint (not chat
-				// completions), effort tiers minimal..xhigh, no off. compat mirrors pi's catalog.
-				id: "muse-spark-1.2-contributor-free",
-				name: "Muse Spark 1.2 Contributor Free",
+				// Meta Muse Spark 1.3 Contributor Free — OpenAI Responses API endpoint (not chat
+				// completions). Repo metadata: no reasoning_options (always-on reasoning, no
+				// effort control), reasoning bundled into content (no separate stream field);
+				// inputs text/image/video/pdf/audio (pi tracks text + image).
+				// muse-spark-1.2-contributor-free was removed: legacy variant no longer in the
+				// free-model list at opencode.ai/docs/zen.
+				id: "muse-spark-1.3-contributor-free",
+				name: "Muse Spark 1.3 Contributor Free",
 				api: "openai-responses",
 				reasoning: true,
 				input: ["text", "image"],
 				contextWindow: 1_048_576,
 				maxTokens: 131_072,
-				thinkingLevelMap: levels({ minimal: "minimal", low: "low", medium: "medium", high: "high", xhigh: "xhigh" }),
 				compat: { sessionAffinityFormat: "openai-nosession" },
 			},
 		],
 	},
+	{
+		// Cline's free-model promotion: a Cline account (OAuth, no static API key)
+		// gets a daily per-model quota on api.cline.bot's OpenAI-compatible API.
+		// The lineup rotates — retired ids answer "model not found" — so the
+		// `_preset` sync machinery is the intended way to receive lineup updates.
+		// Context/output limits are best-effort (server-enforced); tune per model
+		// in multikey.json if a provider rejects long conversations.
+		id: "cline-free",
+		name: "Cline Free",
+		description:
+			"api.cline.bot — Cline account free tier: DeepSeek V4 Flash, Longcat 2.0, Laguna S 2.1, GLM 5.2 (daily per-model quota, lineup rotates)",
+		defaultPoolId: "cline",
+		baseUrl: "https://api.cline.bot/api/v1",
+		api: "openai-completions",
+		keyHint: "Cline account — use 'Sign in with Cline (device flow)', or paste an access token from ~/.cline/data/secrets.json",
+		models: [
+			{
+				id: "deepseek/deepseek-v4-flash",
+				name: "DeepSeek V4 Flash",
+				reasoning: true,
+				input: ["text"],
+				contextWindow: 1_000_000,
+				maxTokens: 131_072,
+			},
+			{
+				id: "meituan/longcat-2.0",
+				name: "Longcat 2.0",
+				reasoning: true,
+				input: ["text"],
+				contextWindow: 1_000_000,
+				maxTokens: 131_072,
+			},
+			{
+				id: "poolside/laguna-s-2.1:free",
+				name: "Laguna S 2.1 (Free)",
+				reasoning: true,
+				input: ["text"],
+				// Poolside doesn't publish the window; safe default, tune if needed.
+				contextWindow: 128_000,
+				maxTokens: 16_384,
+			},
+			{
+				id: "z-ai/glm-5.2:free",
+				name: "GLM 5.2 (Free)",
+				reasoning: true,
+				input: ["text"],
+				contextWindow: 200_000,
+				maxTokens: 131_072,
+			},
+		],
+	},
 ];
 
 export function findPreset(id: string): Preset | undefined {
 	return PRESETS.find((p) => p.id === id);
 }
 
+/**
+ * Stable fingerprint of a preset's model list (sha256, first 16 hex chars).
+ * Both sides of the comparison come from presets.ts builds, so JSON key order
+ * is deterministic. Covers models only — compat/api/description changes don't
+ * trigger update prompts.
+ */
+export function presetFingerprint(preset: Preset): string {
+	return createHash("sha256").update(JSON.stringify(preset.models)).digest("hex").slice(0, 16);
+}
+
+export interface PresetModelDiff {
+	/** Shipped by the preset but missing from the pool. */
+	added: PoolModelConfig[];
+	/** Still in the pool but no longer shipped by the preset. */
+	removed: PoolModelConfig[];
+	/** Same model id, different spec (per-field comparison, order-insensitive). */
+	changed: { id: string; fields: string[] }[];
+}
+
+/** Compare a pool's current models against the shipped preset models. */
+export function diffPresetModels(poolModels: PoolModelConfig[], presetModels: PoolModelConfig[]): PresetModelDiff {
+	const poolById = new Map(poolModels.map((m) => [m.id, m]));
+	const presetById = new Map(presetModels.map((m) => [m.id, m]));
+	const added = presetModels.filter((m) => !poolById.has(m.id));
+	const removed = poolModels.filter((m) => !presetById.has(m.id));
+	const changed: PresetModelDiff["changed"] = [];
+	for (const presetModel of presetModels) {
+		const poolModel = poolById.get(presetModel.id);
+		if (!poolModel) continue;
+		const keys = new Set([...Object.keys(poolModel), ...Object.keys(presetModel)]);
+		const pool = poolModel as unknown as Record<string, unknown>;
+		const preset = presetModel as unknown as Record<string, unknown>;
+		const fields = [...keys].filter((key) => JSON.stringify(pool[key]) !== JSON.stringify(preset[key]));
+		if (fields.length > 0) changed.push({ id: presetModel.id, fields });
+	}
+	return { added, removed, changed };
+}
+
+/** Human-readable diff lines for prompts and menus (may be empty). */
+export function describePresetDiff(diff: PresetModelDiff): string[] {
+	const lines: string[] = [];
+	if (diff.added.length > 0) lines.push(`+ added by preset: ${diff.added.map((m) => m.id).join(", ")}`);
+	if (diff.removed.length > 0) lines.push(`− removed from preset: ${diff.removed.map((m) => m.id).join(", ")}`);
+	for (const change of diff.changed) lines.push(`~ changed: ${change.id} (${change.fields.join(", ")})`);
+	return lines;
+}
+
 /** Materialize a preset into a pool config with the given keys. */
 export function poolFromPreset(preset: Preset, poolId: string, keys: string[]): PoolConfig {
 	return {
@@ -249,5 +306,7 @@ export function poolFromPreset(preset: Preset, poolId: string, keys: string[]):
 		keys: keys.map((key, i) => ({ key, label: `key-${i + 1}`, enabled: true })),
 		// Deep copy so per-pool edits never mutate the shipped preset.
 		models: JSON.parse(JSON.stringify(preset.models)) as PoolModelConfig[],
+		// Track the preset version so future preset updates can offer a one-time align.
+		_preset: { id: preset.id, fingerprint: presetFingerprint(preset) },
 	};
 }

package/probe.ts

@@ -1,4 +1,4 @@
-import { endpointHeaders } from "./config.ts";
+import { endpointHeaders, endpointIdentityHeaders } from "./config.ts";
 
 /**
  * Endpoint probing: auto-detect the auth header style and fetch the model list.
@@ -63,7 +63,7 @@ async function fetchJson(url: string, headers: Record<string, string>, timeoutMs
 	try {
 		const response = await fetch(url, {
 			method: "GET",
-			headers: { Accept: "application/json", ...endpointHeaders(baseUrl ?? url), ...headers },
+			headers: { Accept: "application/json", ...endpointHeaders(baseUrl ?? url), ...endpointIdentityHeaders(baseUrl ?? url), ...headers },
 			signal: AbortSignal.timeout(timeoutMs),
 		});
 		let body: unknown;
@@ -144,16 +144,27 @@ export function parseModelsResponse(body: unknown): RemoteModel[] {
  * Verify a key with a minimal chat completion (a few tokens at most). Returns
  * "ok" when auth was accepted (2xx, or 4xx that clearly got past auth like a
  * bad-model/params 400/404), "rejected" on 401/403, "error" on network trouble.
+ * `onLog` receives the server's rejection body so the TUI can show why.
  */
-async function chatProbe(baseUrl: string, style: AuthStyle, key: string, modelId: string): Promise<"ok" | "rejected" | "error"> {
+async function chatProbe(baseUrl: string, style: AuthStyle, key: string, modelId: string, onLog?: (line: string) => void): Promise<"ok" | "rejected" | "error"> {
 	try {
 		const response = await fetch(`${trimSlash(baseUrl)}/chat/completions`, {
 			method: "POST",
-			headers: { "Content-Type": "application/json", ...endpointHeaders(baseUrl), ...authHeaders(style, key) },
+			headers: {
+				"Content-Type": "application/json",
+				...endpointHeaders(baseUrl),
+				...endpointIdentityHeaders(baseUrl),
+				...authHeaders(style, key),
+			},
 			body: JSON.stringify({ model: modelId, max_tokens: 4, messages: [{ role: "user", content: "ping" }] }),
 			signal: AbortSignal.timeout(CHAT_TIMEOUT_MS),
 		});
-		if (response.status === 401 || response.status === 403) return "rejected";
+		if (response.status === 401 || response.status === 403) {
+			const text = await response.text().catch(() => "");
+			const flat = text.replace(/\s+/g, " ").trim();
+			if (flat) onLog?.(`   ↳ server said: ${flat.slice(0, 160)}`);
+			return "rejected";
+		}
 		return "ok"; // 2xx, or 4xx past auth (bad model / params) — auth itself worked.
 	} catch {
 		return "error";
@@ -221,7 +232,7 @@ export async function probeEndpoint(
 		let verified: AuthStyle | undefined;
 		for (const style of styles) {
 			emit(`auth check: 1-token chat on "${chatModelId}" with ${style === "bearer" ? "Bearer" : "x-api-key"}…`);
-			const verdict = await chatProbe(baseUrl, style, key, chatModelId);
+			const verdict = await chatProbe(baseUrl, style, key, chatModelId, emit);
 			if (verdict === "ok") {
 				verified = style;
 				emit(`   accepted ✓ (style: ${style === "bearer" ? "Authorization: Bearer" : "x-api-key"})`);

package/stream.ts

@@ -1,7 +1,10 @@
 /**
  * Rotating streamSimple: wraps the underlying pi-ai API implementation, picks a
  * key from the pool for every request, and transparently retries on 429/401/403
- * with the next key (marking a cooldown on the failed key).
+ * with the next key (marking a cooldown on the failed key). OAuth-backed keys
+ * (Cline accounts) refresh their access token pre-request and on 401, and a
+ * Cline daily-quota 429 cools the key down until the server-reported reset
+ * time instead of triggering normal rotation.
  *
  * Events are only relayed to the caller once the attempt is known to be healthy,
  * so a rotated attempt never produces duplicate/partial output.
@@ -19,9 +22,29 @@ import {
 	type SimpleStreamOptions,
 } from "@earendil-works/pi-ai";
 import type { KeyOutcome, KeyPool, Lease } from "./pool.ts";
+import { endpointIdentityHeaders, isClineEndpoint } from "./config.ts";
+import { ensureClineAccessToken, formatClineAccessToken } from "./cline-auth.ts";
 
 const RATE_LIMIT_RE = /\b429\b|rate\s*limit|too many requests|quota\s*(exceed|limit)|requests per minute|requests per day/i;
 const INVALID_KEY_RE = /\b40[13]\b|unauthorized|forbidden|invalid\s*(api\s*)?key|incorrect\s*(api\s*)?key|authentication/i;
+/**
+ * Cline free models enforce a daily per-account quota and answer with
+ * `"Daily free limit reached on model X. Try again in 23h 59m"`. This is NOT
+ * a rotation-worthy 429 — the cooldown is the server-reported reset time.
+ */
+const CLINE_QUOTA_RE = /free limit reached on model/i;
+const CLINE_RESET_RE = /try again in\s*(?:(\d+)\s*h)?\s*(?:(\d+)\s*m)?\s*(?:(\d+)\s*s)?/i;
+
+/** Parse the "Try again in Xh Ym Zs" countdown from a Cline quota 429 body. */
+export function parseClineQuotaResetMs(message: string): number | undefined {
+	const match = CLINE_RESET_RE.exec(message.toLowerCase());
+	if (!match) return undefined;
+	const hours = Number(match[1] ?? 0);
+	const minutes = Number(match[2] ?? 0);
+	const seconds = Number(match[3] ?? 0);
+	const ms = hours * 3_600_000 + minutes * 60_000 + seconds * 1000;
+	return ms > 0 ? ms : undefined;
+}
 
 interface CapturedResponse {
 	status: number;
@@ -30,7 +53,7 @@ interface CapturedResponse {
 
 export type Notifier = (message: string) => void;
 
-export function createRotatingStreamSimple(pool: KeyPool, apiName: string, notify: Notifier) {
+export function createRotatingStreamSimple(pool: KeyPool, apiName: string, notify: Notifier, onConfigDirty?: () => void) {
 	const impl = getApiProvider(apiName as Api);
 	if (!impl) throw new Error(`multikey: no API provider registered for api: ${apiName}`);
 	// Auth style: "api-key" providers want the key in x-api-key (some reject
@@ -50,19 +73,55 @@ export function createRotatingStreamSimple(pool: KeyPool, apiName: string, notif
 
 			for (let attempt = 0; attempt < maxAttempts; attempt++) {
 				let lease: Lease;
+				// One forced-token-refresh retry per acquired lease (401 → refresh → retry).
+				let refreshedForLease = false;
 				try {
 					lease = await pool.acquire(options?.signal);
 				} catch {
 					emitAborted(out, model);
 					return;
 				}
+				// OAuth-backed keys (Cline accounts) don't carry a static key: mint a
+				// fresh access token from the stored refresh token before every request.
+				let apiKey = lease.key;
+				if (lease.credential?.kind === "cline-oauth") {
+					try {
+						const fresh = await ensureClineAccessToken(lease.credential);
+						if (fresh.refreshed) {
+							pool.applyClineCredential(lease, fresh);
+							onConfigDirty?.();
+						}
+						// Cline's API requires the "workos:" prefix; formatClineAccessToken
+						// is idempotent, so this also repairs keys stored before the fix.
+						apiKey = formatClineAccessToken(fresh.accessToken);
+					} catch (error) {
+						// The stale token may still work; if not, the 401 path below
+						// force-refreshes once before giving up on this key.
+						notify(
+							`multikey[${pool.config.id}]: token refresh failed on ${lease.label} (${error instanceof Error ? error.message : String(error)}) — trying stored token`,
+						);
+					}
+				} else if (isClineEndpoint(pool.config.baseUrl)) {
+					// Static (pasted) key on the Cline endpoint: same prefix rule applies.
+					apiKey = formatClineAccessToken(apiKey);
+				}
 
 				try {
 					const captured: CapturedResponse = { status: 0 };
+					// Identity headers (session / request) are per-request, so they are
+					// merged here rather than baked into the provider registration.
+					// Providers apply options.headers last, so these win over the static
+					// pool headers. The message list keys the request id to the current
+					// turn, so retries of one turn share it like opencode's lastUser does.
+					const identityBaseUrl = model.baseUrl || pool.config.baseUrl;
 					const attemptOptions: SimpleStreamOptions = {
 						...options,
-						apiKey: lease.key,
-						headers: authStyle === "api-key" ? { ...options?.headers, "x-api-key": lease.key } : options?.headers,
+						apiKey,
+						headers: {
+							...options?.headers,
+							...endpointIdentityHeaders(identityBaseUrl, context.messages),
+							...(authStyle === "api-key" ? { "x-api-key": apiKey } : {}),
+						},
 						onResponse: (response) => {
 							captured.status = response.status;
 							const ra = response.headers?.["retry-after"];
@@ -82,10 +141,31 @@ export function createRotatingStreamSimple(pool: KeyPool, apiName: string, notif
 					// Attempt failed. Only rotate when nothing was relayed yet; if content
 					// already streamed, the failure is surfaced as-is (mid-stream 429 is rare).
 					if (verdict.kind === "rotate" && !verdict.relayedAny) {
+						// 401 on an OAuth key usually means an expired access token: force a
+						// refresh and retry the same account once, without burning a rotation.
+						if (
+							verdict.outcome === "invalid" &&
+							lease.credential?.kind === "cline-oauth" &&
+							!refreshedForLease
+						) {
+							refreshedForLease = true;
+							try {
+								const fresh = await ensureClineAccessToken(lease.credential, { force: true });
+								pool.applyClineCredential(lease, fresh);
+								onConfigDirty?.();
+								notify(`multikey[${pool.config.id}]: 401 on ${lease.label} — Cline token refreshed, retrying`);
+								attempt--; // retry the same key; the request never got going
+								continue;
+							} catch (error) {
+								notify(
+									`multikey[${pool.config.id}]: Cline token refresh failed on ${lease.label} (${error instanceof Error ? error.message : String(error)})`,
+								);
+							}
+						}
 						lastProblem = verdict.problem;
-						pool.report(lease, verdict.outcome, verdict.outcome === "rate_limited" ? verdict.cooldownMs : undefined);
+						pool.report(lease, verdict.outcome, verdict.cooldownMs);
 						notify(
-							`multikey[${pool.config.id}]: ${verdict.outcome === "rate_limited" ? "429" : "auth error"} on ${lease.label} (${pool.mask(lease.key)}), rotating to another key`,
+							`multikey[${pool.config.id}]: ${describeOutcome(verdict.outcome)} on ${lease.label} (${pool.mask(lease.key)}), rotating to another key`,
 						);
 						continue;
 					}
@@ -198,6 +278,11 @@ function classify(
 	message: string,
 	captured: CapturedResponse,
 ): { outcome: KeyOutcome; cooldownMs?: number } | undefined {
+	// Quota marker wins over the generic 429/status rules: the reset countdown
+	// in the body is the real cooldown, not the retry-after header.
+	if (CLINE_QUOTA_RE.test(message)) {
+		return { outcome: "quota_exhausted", cooldownMs: parseClineQuotaResetMs(message) };
+	}
 	const fromStatus = classifyStatus(captured);
 	if (fromStatus) return fromStatus;
 	if (RATE_LIMIT_RE.test(message)) return { outcome: "rate_limited" };
@@ -205,6 +290,20 @@ function classify(
 	return undefined;
 }
 
+/** Short human label for a rotation notify line. */
+function describeOutcome(outcome: KeyOutcome): string {
+	switch (outcome) {
+		case "rate_limited":
+			return "429";
+		case "quota_exhausted":
+			return "daily free limit reached";
+		case "invalid":
+			return "auth error";
+		default:
+			return "error";
+	}
+}
+
 function baseMessage(model: Model<Api>, stopReason: "error" | "aborted", errorMessage?: string): AssistantMessage {
 	return {
 		role: "assistant",

package/tui.ts

@@ -161,6 +161,69 @@ export async function showInfo(ctx: CommandContext, title: string, lines: string
 	});
 }
 
+export interface InfoPanelHandle {
+	/** Resolves when the panel closes (user enter/esc, or close()). */
+	closed: Promise<void>;
+	/** Close the panel programmatically; no-op if the user already dismissed it. */
+	close(): void;
+}
+
+/**
+ * Non-blocking variant of {@link showInfo}: returns a handle immediately so the
+ * caller can auto-close the panel when something finishes (e.g. an OAuth device
+ * flow detects browser approval) while the user can still dismiss it manually.
+ * Dismissing the panel never cancels whatever is running behind it.
+ */
+export function showInfoWithHandle(ctx: CommandContext, title: string, lines: string[]): InfoPanelHandle {
+	let resolveClosed: (() => void) | undefined;
+	const closed = new Promise<void>((resolve) => {
+		resolveClosed = resolve;
+	});
+	let doneFn: (() => void) | undefined;
+	let settled = false;
+	const finish = () => {
+		if (settled) return;
+		settled = true;
+		try {
+			doneFn?.();
+		} catch {
+			// Panel may already be gone; the closed promise is what matters.
+		}
+		resolveClosed?.();
+	};
+
+	void ctx.ui.custom<void>((tui, theme, _kb, done) => {
+		doneFn = done;
+		let cachedLines: string[] | undefined;
+		return {
+			render(width: number) {
+				if (cachedLines) return cachedLines;
+				const w = Math.max(10, width);
+				const out: string[] = [];
+				const add = (line = "") => out.push(truncateToWidth(line, w));
+				const border = theme.fg("accent", "─".repeat(w));
+				add(border);
+				add(` ${theme.fg("accent", theme.bold(title))}`);
+				add();
+				for (const line of lines) add(` ${line}`);
+				add();
+				add(theme.fg("dim", " esc/enter dismiss (keeps running)"));
+				add(border);
+				cachedLines = out;
+				return out;
+			},
+			invalidate() {
+				cachedLines = undefined;
+			},
+			handleInput(data: string) {
+				if (matchesKey(data, Key.escape) || matchesKey(data, Key.enter)) finish();
+			},
+		};
+	});
+
+	return { closed, close: finish };
+}
+
 /** Simple toggle list (multi-select), returns selected values or null on cancel. */
 export async function pickMany(
 	ctx: CommandContext,