pi-multikey 1.8.0 → 1.9.0

package/README.md

@@ -29,7 +29,7 @@ pi install /path/to/multikey
 /multikey → Add pool… → Preset: B.AI → paste keys one per line (blank line to finish)
 ```
 
-After picking the preset, the endpoint, compat, and all 4 model definitions are wired up automatically. Models are available directly as `bai/<model-id>`, e.g. `bai/hy3`.
+After picking the preset, the endpoint, compat, and all 3 model definitions are wired up automatically. Models are available directly as `bai/<model-id>`, e.g. `bai/hy3`.
 
 ## Presets
 
@@ -40,83 +40,9 @@ Built-in presets decouple "model settings" from "keys". The data comes from b.ai
 | hy3 | 256K / 128K | text | off · low · high |
 | mimo-v2.5 | 1M / 128K | text+image | off · high (official: low/medium/high behave identically) |
 | qwen3.8-flash | 1M / 131K | text+image | off · low · medium · xhigh |
-| glm-5.3-flash | 1M / 131K | text+image | low · high · max (always thinks, no off) |
 
 > Why `null` must be explicit: pi's `getSupportedThinkingLevels` treats `mapped === null` as unsupported and hides that level, but **omitting** it is treated as supported and the level name is sent to the API verbatim; `xhigh` / `max` additionally require an explicit non-null value to be usable.
 
-### OpenCode Zen (free tier)
-
-Endpoint `https://opencode.ai/zen/v1`; keys from [opencode.ai/auth](https://opencode.ai/auth) → workspace Keys. Context / max-output are the **Zen free-tier serving limits** (opencode.ai/docs/zen); the raw models are bigger — MiMo V2.5 = 1M ctx. `muse-spark-1.3-contributor-free` uses the OpenAI **Responses** API endpoint; the other five use chat completions.
-
-Requests to this endpoint impersonate the official OpenCode client, on both probes and live requests, whenever a pool's baseUrl is `https://opencode.ai/zen/v1`:
-
-| Header | Value | Lifetime |
-|---|---|---|
-| `x-opencode-client` | `tui` | constant |
-| `User-Agent` | `opencode/0.1.50 ai-sdk/openai-compatible/3.0.41` | constant |
-| `x-opencode-session` | `ses_` + 12 hex + 14 base62 | one per pi conversation; regenerated on `/new`, resume and fork |
-| `x-opencode-request` | v4 UUID | one per machine, persisted as `deviceId` in `multikey.json` |
-
-The session id reproduces OpenCode's own `Identifier.create()`: the first 12 hex chars encode `timestamp_ms * 0x1000 + counter` bitwise-NOTed (descending), so newer conversations sort first, and the counter resets whenever the millisecond changes.
-
-| Model | ctx / max-out | Modalities | Supported thinking levels |
-|---|---|---|---|
-| big-pickle | 200K / 32K | text | always-on (no thinkingLevelMap, like pi's catalog) |
-| mimo-v2.5-free | 200K / 32K | text+image | always-on (no thinkingLevelMap) |
-| ling-3.0-flash-fin-free | 262K / 32K | text | always-on (no thinkingLevelMap) |
-| nemotron-3-ultra-free | 1M / 128K | text | always-on (no thinkingLevelMap) |
-| nemotron-3.5-lightning-free | 262K / 262K | text | always-on (no thinkingLevelMap) |
-| muse-spark-1.3-contributor-free | 1M / 131K | text+image | always-on (no reasoning_options; Responses API) |
-
-> All six models are free (zero per-token cost) for a limited time while OpenCode collects feedback; data may be used to improve the models (Nemotron free endpoints are NVIDIA trials; Muse Spark Contributor models grant Meta training permission — don't send confidential data).
->
-> Removed from the preset over time as the free list changed: `deepseek-v4-flash-free` (now **paid** on Zen), `hy3-free` (no longer offered free), and `muse-spark-1.2-contributor-free` (legacy 1.3 predecessor).
-
-### Cline Free (free tier)
-
-Endpoint `https://api.cline.bot/api/v1` (OpenAI-compatible chat completions). Cline periodically offers free models on its usage-billing API — no static API key exists; access is tied to a **Cline account** via OAuth. The preset therefore collects a credential instead of keys:
-
-- **Sign in with Cline (device flow)** — a WorkOS device code is shown; approve it in the browser at the given URL. The refresh token is stored in `multikey.json` and access tokens are minted/rotated automatically before each request and again on 401. This is the recommended path: pasted tokens rot, device-flow tokens don't.
-- **Paste a Cline access token** — from `~/.cline/data/secrets.json` (or the Cline CLI's storage). Works until the token expires, then must be replaced manually.
-
-Requests to this endpoint send the same client-identity headers the official Cline CLI sends, on probes and live requests alike:
-
-| Header | Value |
-|---|---|
-| `HTTP-Referer` / `X-Title` | `https://cline.bot` / `Cline` |
-| `X-CLIENT-TYPE` / `X-CLIENT-VERSION` | `cline-cli` / CLI version |
-| `User-Agent` | `Cline/<version>` |
-| `X-PLATFORM` / `X-PLATFORM-VERSION` | `cli` / CLI version |
-| `X-CORE-VERSION` | SDK core version |
-| `X-IS-MULTIROOT` | `false` |
-| `X-Task-ID` | v4 UUID, one per pi conversation (regenerated on `/new`, resume, fork) |
-
-Quota semantics differ from every other pool: Cline enforces a **daily, per-account, per-model** limit answered with `429 "Daily free limit reached on model X. Try again in 23h 59m"`. multikey classifies this as its own outcome — the key cools down until the server-reported reset time (shown as `cooldown 24h (daily limit)` in the status view) instead of the 20s 429 rotation, which would be meaningless here.
-
-| Model | ctx / max-out | Notes |
-|---|---|---|
-| deepseek/deepseek-v4-flash | 1M / 131K | thinking levels not yet probed |
-| meituan/longcat-2.0 | 1M / 131K | thinking levels not yet probed |
-| poolside/laguna-s-2.1:free | 128K / 16K | limits unpublished; safe defaults |
-| z-ai/glm-5.2:free | 200K / 131K | thinking levels not yet probed |
-
-> The free lineup **rotates**: retired ids answer `"model not found"`. New models appear via `GET /models` (public) — or accept the one-time preset-sync prompt when this preset ships an updated list. Context/output numbers are best-effort (server-enforced); tune them per model in `multikey.json`.
->
-> **Single-account by design.** A Cline account is meant to be used from the official IDE extension / CLI, not third-party API clients, and multi-account rotation to dodge the daily quota would violate Cline's terms. The integration exists to use *your own* account's free quota from pi; the client headers identify requests as coming from a Cline-style client. Use it accordingly.
-
-To add a preset: append one entry to the `PRESETS` array in `presets.ts`.
-
-### Preset sync
-
-Pools created from a preset are tracked: `poolFromPreset` stamps a `_preset` marker (preset id + a fingerprint of the model list) into `multikey.json`.
-
-- When a shipped preset changes (models added/removed, spec tweaks), pi asks **once** at session start: "Built-in presets changed for pool(s) … — review and align now?"
-- **Align** replaces the pool's model list with the preset's; keys, endpoint, and settings are kept. **Keep my models** — or Esc, or even a crash mid-prompt — mutes that version: the offered fingerprint is persisted *before* the dialog shows, so the same version never re-prompts.
-- When the preset changes **again** (new fingerprint), you're asked once more. Each version gets exactly one ask.
-- Hand-tuned models never trigger the automatic prompt (the preset hasn't changed since your last sync); they stay reachable via `/multikey → Check preset updates…`, which is always available regardless of muting.
-- Legacy pools (created before tracking existed) are matched by `baseUrl` and adopted into tracking the same way.
-- The fingerprint covers the preset's **models only** — compat/API/description changes don't trigger prompts.
-
 ## Configuration
 
 `~/.pi/agent/multikey.json`. On first run it auto-discovers mergeable pools from `~/.pi/agent/models.json` (≥2 providers sharing a baseUrl = you copying the provider per key), and also picks up providers pointing at `api.b.ai`; if nothing is found it generates an empty config.
@@ -178,22 +104,6 @@ The detected header style is stored as `"auth": "api-key"` only when the endpoin
 
 Changes take effect immediately (the provider is re-registered) — no restart needed.
 
-## Pointing subagents at the pool
-
-Set `agentOverrides` in `settings.json` to the pool provider:
-
-```json
-"subagents": {
-  "agentOverrides": {
-    "oracle":   { "model": "bai/glm-5.3-flash" },
-    "scout":    { "model": "bai/hy3" },
-    "worker":   { "model": "bai/mimo-v2.5" }
-  }
-}
-```
-
-`defaultProvider: "bai"` works the same way.
-
 ## How it works
 
 - The extension registers a provider via `pi.registerProvider()` with a custom `streamSimple`.

package/README.zh.md

@@ -27,7 +27,7 @@ pi install /path/to/multikey
 /multikey → Add pool… → Preset: B.AI → 逐行粘贴 key（一行一个，留空结束）
 ```
 
-选 preset 后 endpoint、compat、4 个模型的全部设定自动就位，模型通过
+选 preset 后 endpoint、compat、3 个模型的全部设定自动就位，模型通过
 `bai/<model-id>` 直接可用，例如 `bai/hy3`。
 
 ## Presets
@@ -41,55 +41,11 @@ DeepSeek / Tencent / 小米官方文档，并对每个 thinking 档位做过实
 | hy3 | 256K / 128K | text | off · low · high |
 | mimo-v2.5 | 1M / 128K | text+image | off · high（官方：low/medium/high 行为相同） |
 | qwen3.8-flash | 1M / 131K | text+image | off · low · medium · xhigh |
-| glm-5.3-flash | 1M / 131K | text+image | low · high · max（始终思考，无 off） |
 
 > 为什么必须显式写 `null`：pi 的 `getSupportedThinkingLevels` 把 `mapped === null`
 > 视为不支持并隐藏该档，但**省略**会被当作支持并把档名原样发给 API；
 > `xhigh` / `max` 还要求显式给出非 null 值才可用。
 
-### OpenCode Zen（免费层）
-
-端点 `https://opencode.ai/zen/v1`；密钥从 [opencode.ai/auth](https://opencode.ai/auth) → workspace Keys 获取。
-上下文/最大输出为 **Zen 免费层限制**（opencode.ai/docs/zen）；原始模型更大——MiMo V2.5 = 1M ctx。
-`muse-spark-1.3-contributor-free` 使用 OpenAI **Responses** API；其余五个使用 chat completions。
-
-只要 pool 的 baseUrl 是 `https://opencode.ai/zen/v1`，探测和真实请求都会伪装成官方 OpenCode 客户端：
-
-| 请求头 | 值 | 生命周期 |
-|---|---|---|
-| `x-opencode-client` | `tui` | 常量 |
-| `User-Agent` | `opencode/0.1.50 ai-sdk/openai-compatible/3.0.41` | 常量 |
-| `x-opencode-session` | `ses_` + 12 位十六进制 + 14 位 base62 | 每个 pi 会话一个；`/new`、resume、fork 时重新生成 |
-| `x-opencode-request` | v4 UUID | 每台机器一个，作为 `deviceId` 持久化在 `multikey.json` |
-
-session id 复现了 OpenCode 自己的 `Identifier.create()`：前 12 位十六进制编码 `timestamp_ms * 0x1000 + counter` 后按位取反（降序），因此新会话排序在前；计数器仅在毫秒变化时重置。
-
-| 模型 | ctx / max-out | 模态 | 生效 thinking 档位 |
-|---|---|---|---|
-| big-pickle | 200K / 32K | text | 始终思考（无 thinkingLevelMap，与 pi 内置目录一致） |
-| mimo-v2.5-free | 200K / 32K | text+image | 始终思考（无 thinkingLevelMap） |
-| ling-3.0-flash-fin-free | 262K / 32K | text | 始终思考（无 thinkingLevelMap） |
-| nemotron-3-ultra-free | 1M / 128K | text | 始终思考（无 thinkingLevelMap） |
-| nemotron-3.5-lightning-free | 262K / 262K | text | 始终思考（无 thinkingLevelMap） |
-| muse-spark-1.3-contributor-free | 1M / 131K | text+image | 始终思考（无 reasoning_options；Responses API） |
-
-> 以上六个模型在 OpenCode 收集反馈期间均免费（零 token 费用）；数据可能用于改进模型（Nemotron 免费端点为 NVIDIA 试用；Muse Spark Contributor 模型授权 Meta 用于训练——请勿提交机密数据）。
->
-> 免费列表变化后已从 preset 移除：`deepseek-v4-flash-free`（在 Zen 上已转为**付费**）、`hy3-free`（不再提供免费层）、`muse-spark-1.2-contributor-free`（1.3 的前身遗留变体）。
-
-新增 preset：在 `presets.ts` 的 `PRESETS` 数组里加一项即可。
-
-### Preset 同步
-
-从 preset 创建的池会被追踪：`poolFromPreset` 会在 `multikey.json` 里写入 `_preset` 标记（preset id + 模型列表的指纹）。
-
-- 内置 preset 变化（模型增删、参数调整）后，pi 会在会话启动时**只询问一次**：“内置 preset 已变化……是否立即对齐？”
-- **Align** 用 preset 的模型列表替换池的模型；密钥、endpoint、其他设置保留。**Keep my models**——以及 Esc、甚至提示中途崩溃——都会静音该版本：提供的指纹在弹窗**之前**就已持久化，同一版本绝不会重复询问。
-- preset **再次**变化（新指纹）时会再询问一次。每个版本恰好一次。
-- 手动调过参数的池不会触发自动询问（自上次同步后 preset 没变）；它们始终可以通过 `/multikey → Check preset updates…` 检查，该入口不受静音影响。
-- 旧版本创建的池（早于追踪功能）按 `baseUrl` 匹配并以同样方式纳入追踪。
-- 指纹只覆盖 preset 的**模型列表**——compat/API/描述变化不会触发询问。
-
 ## 配置
 
 `~/.pi/agent/multikey.json`。首次运行时会从 `~/.pi/agent/models.json` 自动发现
@@ -152,22 +108,6 @@ JSON 后 `Reload config from disk`。
 
 改动即时生效（重新注册 provider），无需重启。
 
-## 让 subagent 用上池
-
-`settings.json` 的 agentOverrides 改成池 provider：
-
-```json
-"subagents": {
-  "agentOverrides": {
-    "oracle":   { "model": "bai/glm-5.3-flash" },
-    "scout":    { "model": "bai/hy3" },
-    "worker":   { "model": "bai/mimo-v2.5" }
-  }
-}
-```
-
-`defaultProvider: "bai"` 同理。
-
 ## 工作原理
 
 - 扩展通过 `pi.registerProvider()` 注册 provider，并提供自定义 `streamSimple`。

package/cline-auth.ts

@@ -71,6 +71,8 @@ function requireClineTokens(payload: ClineTokenResponse, message: string): Cline
 	if (!payload.success || !accessToken || !refreshToken) {
 		throw new Error(message);
 	}
+	// Return the RAW token; the workos: prefix is applied at request time by
+	// formatClineAccessToken (idempotent), so it is never doubled.
 	return { accessToken, refreshToken, expiresAt: parseExpiresAt(payload.data?.expiresAt) };
 }
 
@@ -97,6 +99,19 @@ export async function refreshClineToken(refreshToken: string): Promise<ClineToke
 	return requireClineTokens(payload, "Invalid Cline token refresh response");
 }
 
+const WORKOS_ACCESS_TOKEN_PREFIX = "workos:";
+
+/**
+ * Cline's API requires the WorkOS access token prefixed with the literal
+ * string "workos:" in the Authorization header — the official client formats
+ * every stored access token this way before sending (formatAccessToken in
+ * cline core). A raw JWT gets a generic 401 that looks like a bad key.
+ */
+export function formatClineAccessToken(accessToken: string): string {
+	const token = accessToken.trim();
+	return token.toLowerCase().startsWith(WORKOS_ACCESS_TOKEN_PREFIX) ? token : `${WORKOS_ACCESS_TOKEN_PREFIX}${token}`;
+}
+
 // Single-flight per refresh token: concurrent subagents hitting the same
 // account must share one in-flight refresh instead of racing each other.
 const inFlight = new Map<string, Promise<ClineTokenUpdate>>();
@@ -111,7 +126,12 @@ export async function ensureClineAccessToken(
 ): Promise<ClineTokenUpdate & { refreshed: boolean }> {
 	const force = options?.force === true;
 	if (!force && !isClineTokenStale(credential) && credential.accessToken) {
-		return { accessToken: credential.accessToken, refreshToken: credential.refreshToken, expiresAt: credential.expiresAt, refreshed: false };
+		return {
+			accessToken: formatClineAccessToken(credential.accessToken),
+			refreshToken: credential.refreshToken,
+			expiresAt: credential.expiresAt,
+			refreshed: false,
+		};
 	}
 	const existing = inFlight.get(credential.refreshToken);
 	if (existing) return { ...(await existing), refreshed: true };
@@ -119,7 +139,8 @@ export async function ensureClineAccessToken(
 		inFlight.delete(credential.refreshToken);
 	});
 	inFlight.set(credential.refreshToken, task);
-	return { ...(await task), refreshed: true };
+	const update = await task;
+	return { ...update, accessToken: formatClineAccessToken(update.accessToken), refreshed: true };
 }
 // ── Device flow (initial sign-in) ───────────────────────────────────────────
 
@@ -146,38 +167,64 @@ const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
 
 /**
  * Interactive sign-in: request a device code, hand the verification URL to
- * `onAuthInfo` (awaited, so the UI can show it before polling starts), poll
- * WorkOS until the user approves, then exchange for Cline tokens.
+ * `onAuthInfo`, and start polling immediately — `onAuthInfo` must NOT block
+ * until dismissal (the old code awaited a modal dialog here, so polling only
+ * began after the user pressed enter and a completed browser approval sat
+ * unnoticed). Call `onAuthorized` (via the options below) once the first poll
+ * succeeds so the UI can auto-close the panel; the panel's dismissal promise
+ * is awaited before returning so the two UI layers never interleave.
  */
 export async function loginClineDeviceFlow(options: {
-	/** Awaited once the verification URL/user code are known (e.g. show a dialog). */
+	/** Show the verification URL/user code; resolve without waiting for dismissal. */
 	onAuthInfo: (info: { url: string; userCode: string }) => Promise<void>;
+	/** Called when the browser approval is confirmed — the UI can auto-close its auth panel. */
+	onAuthorized?: () => void;
 	/** Optional progress lines while polling (e.g. append to a progress panel). */
 	onProgress?: (message: string) => void;
 }): Promise<ClineTokenUpdate> {
-	const authResponse = await fetch(`${WORKOS_API_BASE_URL}${WORKOS_DEVICE_AUTHORIZATION_PATH}`, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams({ client_id: WORKOS_CLIENT_ID }),
-		signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-	});
+	// One retry: a transient network blip here aborts the whole sign-in before
+	// the user even sees a URL (observed: "fetch failed" after ~12s once).
+	let authResponse: Response | undefined;
+	let lastFetchError: unknown;
+	for (let attempt = 1; attempt <= 2 && !authResponse; attempt++) {
+		try {
+			authResponse = await fetch(`${WORKOS_API_BASE_URL}${WORKOS_DEVICE_AUTHORIZATION_PATH}`, {
+				method: "POST",
+				headers: { "Content-Type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({ client_id: WORKOS_CLIENT_ID }),
+				signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+			});
+		} catch (error) {
+			lastFetchError = error;
+			if (attempt < 2) await sleep(1500);
+		}
+	}
+	if (!authResponse) {
+		const detail = lastFetchError instanceof Error ? `${lastFetchError.message}${lastFetchError.cause instanceof Error ? ` (${lastFetchError.cause.message})` : ""}` : String(lastFetchError);
+		throw new Error(`Cline device authorization failed: could not reach api.workos.com (${detail})`);
+	}
 	const device = (await authResponse.json().catch(() => ({}))) as WorkOSDeviceAuthorizationResponse;
 	if (!authResponse.ok || !device.device_code || !device.user_code || !device.verification_uri) {
 		const detail = device.error_description ?? (authResponse.ok ? "invalid WorkOS response" : `HTTP ${authResponse.status}`);
 		throw new Error(`Cline device authorization failed: ${detail}`);
 	}
 
-	await options.onAuthInfo({
+	// Hand the URL to the UI but do NOT wait for the panel to be dismissed —
+	// polling must start now, or an already-completed browser approval goes
+	// unnoticed until the user dismisses the panel manually.
+	const panelDismissed = options.onAuthInfo({
 		url: device.verification_uri_complete ?? device.verification_uri,
 		userCode: device.user_code,
-	});
+	}).catch(() => {});
 
 	const expiresInSeconds = device.expires_in ?? DEVICE_AUTH_EXPIRES_IN_SECONDS;
 	const deadline = Date.now() + expiresInSeconds * 1000;
 	let intervalSeconds = Math.max(1, device.interval ?? DEVICE_AUTH_INTERVAL_SECONDS);
 	let workosTokens: { access: string; refresh: string } | undefined;
+	let pollCount = 0;
 
 	while (Date.now() <= deadline) {
+		pollCount++;
 		const pollResponse = await fetch(`${WORKOS_API_BASE_URL}${WORKOS_AUTHENTICATE_PATH}`, {
 			method: "POST",
 			headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -194,6 +241,8 @@ export async function loginClineDeviceFlow(options: {
 				throw new Error("Invalid WorkOS token response");
 			}
 			workosTokens = { access: payload.access_token, refresh: payload.refresh_token };
+			options.onAuthorized?.();
+			await panelDismissed;
 			break;
 		}
 		switch (payload.error) {
@@ -206,7 +255,9 @@ export async function loginClineDeviceFlow(options: {
 				await sleep(intervalSeconds * 1000);
 				break;
 			case "access_denied":
+				throw new Error(`Cline authorization failed: ${payload.error_description ?? payload.error}`);
 			case "expired_token":
+				throw new Error(`Cline authorization timed out: ${payload.error_description ?? payload.error}`);
 			case "invalid_grant":
 				throw new Error(`Cline authorization failed: ${payload.error_description ?? payload.error}`);
 			default:

package/config.ts

@@ -11,7 +11,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import type { ProviderModelConfig } from "@earendil-works/pi-coding-agent";
 import type { AuthStyle } from "./probe.ts";
-import { currentDeviceId, currentSessionId, currentTaskId, setDeviceId } from "./identity.ts";
+import { currentRequestId, currentSessionId, currentTaskId, turnKeyOf } from "./identity.ts";
 
 /** Safe model defaults applied when a spec doesn't say otherwise (edit in multikey.json). */
 export const DEFAULT_CONTEXT_WINDOW = 128_000;
@@ -109,12 +109,6 @@ export interface PoolConfig {
 
 export interface KeypoolConfig {
 	pools: PoolConfig[];
-	/**
-	 * Stable per-install UUID sent as `x-opencode-request` to OpenCode Zen.
-	 * Generated once and reused forever, so every request from this machine
-	 * carries the same device identity.
-	 */
-	deviceId?: string;
 }
 
 export function configPath(): string {
@@ -300,27 +294,9 @@ export function loadConfig(): { config: KeypoolConfig; created: boolean; migrate
 	}
 	const raw = JSON.parse(readFileSync(path, "utf-8")) as KeypoolConfig;
 	const config = normalize(raw);
-	// Adopt any stored device id into the identity module; a config predating
-	// deviceId gets one assigned by ensureDeviceId() in the caller.
-	if (config.deviceId) setDeviceId(config.deviceId);
 	return { config, created: false };
 }
 
-/**
- * Make sure a persisted device id exists for configs that expose an OpenCode
- * Zen pool, saving only when it actually changed anything. Pools that never
- * talk to Zen leave the file untouched.
- */
-export function ensureDeviceId(config: KeypoolConfig): void {
-	if (config.deviceId) {
-		setDeviceId(config.deviceId);
-		return;
-	}
-	if (!config.pools.some((pool) => isOpenCodeZenEndpoint(pool.baseUrl))) return;
-	config.deviceId = currentDeviceId();
-	saveConfig(config);
-}
-
 export function saveConfig(config: KeypoolConfig): void {
 	const path = configPath();
 	mkdirSync(dirname(path), { recursive: true });
@@ -335,8 +311,7 @@ export function normalize(config: KeypoolConfig): KeypoolConfig {
 		if (!pool.baseUrl || typeof pool.baseUrl !== "string") continue;
 		normalized.push(normalizePool(pool));
 	}
-	const deviceId = typeof config.deviceId === "string" && config.deviceId.trim() ? config.deviceId.trim() : undefined;
-	return { pools: normalized, deviceId };
+	return { pools: normalized };
 }
 
 /** Structural check so a malformed credential in the JSON file can't break a pool. */
@@ -448,15 +423,20 @@ export function endpointHeaders(baseUrl: string): Record<string, string> {
 /**
  * Per-request identity headers a known endpoint expects.
  *
- * OpenCode Zen reads `x-opencode-session` for per-conversation routing and
- * `x-opencode-request` as the caller's device id, so these must be generated
- * at request time rather than baked into the provider registration.
+ * OpenCode Zen reads `x-opencode-session` as the conversation id and
+ * `x-opencode-request` as the id of the user message being answered, so these
+ * must be computed at request time rather than baked into the provider
+ * registration. `messages` lets the caller key the request id to the current
+ * turn (see turnKeyOf); omit it for one-shot calls outside a conversation.
  * Cline reads `X-Task-ID` as a per-conversation correlation id.
  */
-export function endpointIdentityHeaders(baseUrl: string | undefined): Record<string, string> {
+export function endpointIdentityHeaders(baseUrl: string | undefined, messages?: readonly unknown[]): Record<string, string> {
 	if (isClineEndpoint(baseUrl ?? "")) return { "X-Task-ID": currentTaskId() };
 	if (!isOpenCodeZenEndpoint(baseUrl ?? "")) return {};
-	return { "x-opencode-session": currentSessionId(), "x-opencode-request": currentDeviceId() };
+	return {
+		"x-opencode-session": currentSessionId(),
+		"x-opencode-request": currentRequestId(messages ? turnKeyOf(messages) : undefined),
+	};
 }
 
 // ── Cline (api.cline.bot) ────────────────────────────────────────────────────

package/identity.ts

@@ -1,101 +1,113 @@
 /**
- * Client identity for endpoints that expect an OpenCode-style client.
+ * Client identity headers for endpoints that gate on them.
  *
- * OpenCode Zen keys its per-conversation routing/telemetry off two headers we
- * have to synthesize: `x-opencode-session` (one id per conversation, reused for
- * its whole lifetime) and `x-opencode-request` (one UUID per device, persisted
- * in multikey.json). Both are generated here; persistence stays in config.ts.
+ * OpenCode Zen — opencode.ai/zen identifies the calling client with four headers,
+ * set in packages/opencode/src/session/llm/request.ts (LLMRequestPrep.prepare)
+ * whenever the provider id starts with "opencode":
+ *
+ *   x-opencode-client   flags.client ("tui" for the terminal client)
+ *   User-Agent          opencode/<InstallationVersion>
+ *   x-opencode-session  input.sessionID  ("ses_" + Identifier.create(descending))
+ *   x-opencode-request  input.user.id, the id of the user message being answered
+ *                       ("msg_" + Identifier.create(ascending))
+ *
+ * prompt.ts resolves `lastUser` once per turn and passes that same message into
+ * every step of the agentic loop, so one user turn — including retries — reuses
+ * one request id. pi exposes neither a session id nor message ids to a custom
+ * stream function (UserMessage is just { role, content, timestamp }), so we mint
+ * ids in the same format and keep them alive for the same span opencode would.
+ *
+ * Cline — api.cline.bot correlates a conversation with `X-Task-ID`, a v4 uuid.
  */
 
-import { randomBytes, randomUUID } from "node:crypto";
-
-/** OpenCode's identifier alphabet: 12 hex chars of time, then 14 base62 chars. */
-const BASE62 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-const ID_LENGTH = 26;
-const TIME_HEX_LENGTH = 12;
+import { createHash, randomBytes } from "node:crypto";
 
-// Monotonic counter within a millisecond, reset when the clock ticks — same
-// rule OpenCode uses so ids sort correctly by creation time.
-let lastTimestamp = 0;
-let counter = 0;
+/** Alphabet used by opencode's Identifier.create (packages/schema/src/identifier.ts). */
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
 
 /**
- * Reproduce OpenCode's `Identifier.create()`:
- * `timestamp_ms * 0x1000 + counter`, bitwise-NOTed for descending order, as
- * 6 big-endian bytes of hex, followed by 14 random base62 characters.
- *
- * The 48-bit window truncates today's millisecond timestamps, which is exactly
- * what OpenCode ships — the low bits still order ids newest-first.
+ * Port of opencode's Identifier.create(): a sortable, KSUID-like 26-char suffix.
+ * The first 12 chars are the hex of `(timestamp_ms * 0x1000 + counter)`, bitwise
+ * NOT'd for descending ids so newer ids sort first; the last 14 are random base62.
+ * The counter resets whenever the millisecond changes.
  */
-export function createIdentifier(descending = true, timestamp = Date.now()): string {
-	if (timestamp !== lastTimestamp) {
-		lastTimestamp = timestamp;
-		counter = 0;
-	}
-	counter++;
-
-	const current = BigInt(timestamp) * 0x1000n + BigInt(counter);
-	const value = descending ? ~current : current;
-	let time = "";
-	for (let index = 0; index < 6; index++) {
-		const byte = Number((value >> BigInt(40 - 8 * index)) & 0xffn);
-		time += byte.toString(16).padStart(2, "0");
+let lastTs = 0;
+let count = 0;
+export function createIdentifier(descending: boolean, ts: number = Date.now()): string {
+	if (ts !== lastTs) {
+		lastTs = ts;
+		count = 0;
 	}
-
-	const bytes = randomBytes(ID_LENGTH - TIME_HEX_LENGTH);
-	let rest = "";
-	for (const byte of bytes) rest += BASE62[byte % 62];
-	return `${time}${rest}`;
+	const time = BigInt(ts) * 0x1000n + BigInt(count++);
+	const value = descending ? ~time & 0xffffffffffffn : time;
+	const hex = value.toString(16).padStart(12, "0");
+	let id = hex;
+	for (const byte of randomBytes(14)) id += ALPHABET[byte % ALPHABET.length];
+	return id;
 }
 
-/** A session id in OpenCode's format: `ses_` + 26 descending-sortable chars. */
+/** New session identifier, matching opencode's `SessionID.ascending()` ("ses_" + 26). */
 export function createSessionId(): string {
 	return `ses_${createIdentifier(true)}`;
 }
 
-/** A fresh device identifier (plain v4 UUID, like OpenCode's client). */
-export function createDeviceId(): string {
-	return randomUUID();
+/** New message identifier, matching opencode's `MessageID.ascending()` ("msg_" + 26). */
+export function createMessageId(): string {
+	return `msg_${createIdentifier(false)}`;
 }
 
-/** A per-conversation task id (plain v4 UUID, like Cline's X-Task-ID). */
-export function createTaskId(): string {
-	return randomUUID();
+/**
+ * Stable key for "the turn we are currently answering" — opencode's `lastUser`.
+ * pi rebuilds message objects between requests, so object identity is useless;
+ * the last user message's timestamp plus a digest of its content stays equal
+ * across every step of the same turn.
+ */
+export function turnKeyOf(messages: readonly unknown[]): string | undefined {
+	for (let i = messages.length - 1; i >= 0; i--) {
+		const m = messages[i] as { role?: string; timestamp?: number; content?: unknown } | undefined;
+		if (m?.role !== "user") continue;
+		const digest = createHash("sha1").update(JSON.stringify(m.content ?? "")).digest("hex");
+		return `${m.timestamp ?? 0}:${digest}`;
+	}
+	return undefined;
 }
 
 let sessionId: string | undefined;
-let deviceId: string | undefined;
+let requestId: string | undefined;
+let turnKey: string | undefined;
 let taskId: string | undefined;
 
-/** Current conversation's session id, created on first use. */
-export function currentSessionId(): string {
-	if (!sessionId) sessionId = createSessionId();
-	return sessionId;
-}
-
-/** Drop the cached session id so the next request starts a new conversation. */
-export function resetSessionId(): void {
+/** Forget the current conversation (called on session_start for new/resume/fork). */
+export function resetConversation(): void {
 	sessionId = undefined;
+	requestId = undefined;
+	turnKey = undefined;
+	taskId = undefined;
 }
 
-/** Seed the device id from config (call once at startup). */
-export function setDeviceId(id: string): void {
-	if (id) deviceId = id;
+/** The session id for the current conversation, created on first use. */
+export function currentSessionId(): string {
+	if (!sessionId) sessionId = createSessionId();
+	return sessionId;
 }
 
-/** Current device id, generated on first use if config had none. */
-export function currentDeviceId(): string {
-	if (!deviceId) deviceId = createDeviceId();
-	return deviceId;
+/**
+ * The request id for the turn identified by `key` (opencode's `input.user.id`
+ * equivalent). A new key mints a fresh "msg_" id and the same key keeps returning
+ * it; a missing key means there is no conversation context to key on (a probe,
+ * say), so it mints a fresh id without disturbing the cached turn.
+ */
+export function currentRequestId(key: string | undefined): string {
+	if (key === undefined) return createMessageId();
+	if (!requestId || key !== turnKey) {
+		requestId = createMessageId();
+		turnKey = key;
+	}
+	return requestId;
 }
 
-/** Current conversation's task id (Cline X-Task-ID), created on first use. */
+/** Cline's X-Task-ID: one v4 uuid per conversation. */
 export function currentTaskId(): string {
-	if (!taskId) taskId = createTaskId();
+	if (!taskId) taskId = crypto.randomUUID();
 	return taskId;
 }
-
-/** Drop the cached task id so the next request starts a new conversation. */
-export function resetTaskId(): void {
-	taskId = undefined;
-}

package/index.ts

@@ -11,8 +11,8 @@
 
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { getApiProvider, type Api } from "@earendil-works/pi-ai";
-import { configPath, endpointHeaders, ensureDeviceId, loadConfig, saveConfig, toProviderModels, type KeypoolConfig, type PoolConfig } from "./config.ts";
-import { resetSessionId, resetTaskId } from "./identity.ts";
+import { configPath, endpointHeaders, loadConfig, saveConfig, toProviderModels, type KeypoolConfig, type PoolConfig } from "./config.ts";
+import { resetConversation } from "./identity.ts";
 import { KeyPool } from "./pool.ts";
 import { createRotatingStreamSimple } from "./stream.ts";
 import { runManager, maybeOfferPresetUpdates, type ManagerHooks } from "./manage.ts";
@@ -36,8 +36,6 @@ export default function multikey(pi: ExtensionAPI) {
 
 	const pools = new Map<string, KeyPool>();
 	for (const pool of config.pools) pools.set(pool.id, new KeyPool(pool));
-	// OpenCode Zen needs a stable per-device id; persist one when a Zen pool exists.
-	ensureDeviceId(config);
 
 	let ui: ExtensionContext["ui"] | undefined;
 	const notify = (message: string) => {
@@ -65,9 +63,6 @@ export default function multikey(pi: ExtensionAPI) {
 		const keyPool = pools.get(pool.id) ?? new KeyPool(pool);
 		keyPool.updateConfig(pool);
 		pools.set(pool.id, keyPool);
-		// A Zen pool needs a durable device identity; adopt one before the first
-		// request goes out (no-op once multikey.json has a deviceId).
-		ensureDeviceId(config);
 
 		pi.registerProvider(pool.id, {
 			name: pool.name ?? pool.id,
@@ -139,13 +134,10 @@ export default function multikey(pi: ExtensionAPI) {
 
 	pi.on("session_start", async (event, ctx) => {
 		ui = ctx.ui;
-	// One OpenCode session id / Cline task id per conversation: /new, resume and
-	// fork switch to a different conversation, so drop the cached ids for those.
-	if (event.reason === "new" || event.reason === "resume" || event.reason === "fork") {
-		resetSessionId();
-		resetTaskId();
-	}
-		ensureDeviceId(config);
+		// One OpenCode session id / request id and one Cline task id per
+		// conversation: /new, resume and fork switch conversations, so drop the
+		// cached ids for those (but not on plain startup or an extension reload).
+		if (event.reason === "new" || event.reason === "resume" || event.reason === "fork") resetConversation();
 		for (const { id, reason } of skipped) {
 			notify(`multikey: provider "${id}" not available — ${reason}. Fix it via /multikey → Manage pools.`);
 		}

package/manage.ts

@@ -21,8 +21,9 @@ import {
 import type { KeyPool } from "./pool.ts";
 import { PRESETS, findPreset, poolFromPreset, presetFingerprint, diffPresetModels, describePresetDiff, type Preset, type PresetModelDiff } from "./presets.ts";
 import { probeEndpoint, type ProbeResult, type RemoteModel } from "./probe.ts";
-import { describeClineCredential, ensureClineAccessToken, loginClineDeviceFlow } from "./cline-auth.ts";
-import { inputNumber, pickMany, selectOne, showInfo, withProgress } from "./tui.ts";
+import { spawn } from "node:child_process";
+import { describeClineCredential, ensureClineAccessToken, formatClineAccessToken, loginClineDeviceFlow } from "./cline-auth.ts";
+import { inputNumber, pickMany, selectOne, showInfo, showInfoWithHandle, withProgress, type InfoPanelHandle } from "./tui.ts";
 
 type CommandContext = Parameters<Parameters<ExtensionAPI["registerCommand"]>[1]["handler"]>[1];
 
@@ -97,6 +98,25 @@ function formatCooldown(ms: number): string {
 	return `${Math.ceil(ms / 3_600_000)}h`;
 }
 
+/**
+ * Best-effort browser open for device-flow verification URLs. Never throws;
+ * a missing opener only means the user has to paste the URL manually (the
+ * auth panel always shows the URL as a fallback).
+ */
+function tryOpenBrowser(url: string): boolean {
+	const platform = process.platform;
+	const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+	const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+	try {
+		const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+		child.on("error", () => {}); // opener missing — the panel shows the URL anyway
+		child.unref();
+		return true;
+	} catch {
+		return false;
+	}
+}
+
 /**
  * Collect a Cline account credential: the WorkOS device flow (recommended —
  * refresh tokens keep the access token alive) or a manually pasted access
@@ -117,40 +137,67 @@ async function collectClineKeys(ctx: CommandContext, hooks: ManagerHooks): Promi
 	]);
 	if (how === "device") {
 		let credential: KeyCredential;
+		let panel: InfoPanelHandle | undefined;
 		try {
-			const tokens = await withProgress(ctx, "Cline sign-in", async (update) =>
-				loginClineDeviceFlow({
-					onAuthInfo: async ({ url, userCode }) => {
-						await showInfo(ctx, "Authorize Cline", [
-							"Open this URL in your browser and approve the sign-in:",
-							"",
-							url,
-							"",
-							`User code: ${userCode}`,
-							"",
-							"Sign-in continues automatically once you approve.",
-						]);
-					},
-					onProgress: (message) => update(message),
-				}),
-			);
+			// withProgress swallows task errors and resolves undefined, so capture
+			// the real error here and rethrow it below — `undefined` tokens used to
+			// crash with "cannot read properties of undefined" and mask the failure.
+			let loginError: unknown;
+			const tokens = await withProgress(ctx, "Cline sign-in", async (update) => {
+				try {
+					return await loginClineDeviceFlow({
+							onAuthInfo: async ({ url, userCode }) => {
+								const opened = tryOpenBrowser(url);
+								panel = showInfoWithHandle(ctx, "Authorize Cline", [
+									opened
+										? "A browser window should have opened — approve the sign-in there."
+										: "Open this URL in your browser and approve the sign-in:",
+									"",
+									...(opened ? ["If no window opened, paste this URL:", url] : [url]),
+									"",
+									`User code: ${userCode}`,
+									"",
+									"Sign-in continues automatically once you approve — you can dismiss this panel any time.",
+								]);
+								await panel.closed;
+							},
+						onAuthorized: () => {
+							update("Browser authorization confirmed — exchanging tokens…");
+							panel?.close();
+						},
+						onProgress: (message) => update(message),
+					});
+				} catch (error) {
+					loginError = error;
+					throw error;
+				}
+			});
+			if (!tokens) throw loginError ?? new Error("Cline sign-in failed");
+			// Store the access token with Cline's required "workos:" prefix (same
+			// convention as the official CLI's providers.json); formatting is
+			// idempotent, so the request path can safely format again.
+			const accessToken = formatClineAccessToken(tokens.accessToken);
 			credential = {
 				kind: "cline-oauth",
 				refreshToken: tokens.refreshToken,
-				accessToken: tokens.accessToken,
+				accessToken,
 				expiresAt: tokens.expiresAt,
 			};
 		} catch (error) {
 			await showInfo(ctx, "Cline sign-in failed", [error instanceof Error ? error.message : String(error)]);
 			return undefined;
+		} finally {
+			panel?.close();
 		}
-		return [{ key: credential.accessToken ?? credential.refreshToken, label: "cline-account", enabled: true, credential }];
+		return [{ key: formatClineAccessToken(credential.accessToken ?? credential.refreshToken), label: "cline-account", enabled: true, credential }];
 	}
 	if (how === "paste") {
 		const raw = await ctx.ui.input("Cline access token", "paste the token");
 		const value = raw?.trim();
 		if (!value) return undefined;
-		return [{ key: value, label: "cline-account", enabled: true }];
+		// Cline's API rejects raw JWTs — the access token must carry the
+		// "workos:" prefix (formatClineAccessToken is idempotent).
+		return [{ key: formatClineAccessToken(value), label: "cline-account", enabled: true }];
 	}
 	return undefined;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-multikey",
-	"version": "1.8.0",
+	"version": "1.9.0",
 	"description": "One pi provider backed by many API keys: automatic 429 rotation, per-request key leases for concurrent subagents, and a /multikey management TUI",
 	"keywords": [
 		"pi-package",
@@ -10,6 +10,8 @@
 		"api-keys",
 		"rate-limit",
 		"429",
+		"cline",
+		"oauth",
 		"provider",
 		"key-pool",
 		"bai",

package/presets.ts

@@ -57,7 +57,7 @@ export const PRESETS: Preset[] = [
 	{
 		id: "b-ai",
 		name: "B.AI",
-		description: "api.b.ai — Hunyuan Hy3, MiMo V2.5, Qwen3.8, GLM 5.3 (4 models)",
+		description: "api.b.ai — Hunyuan Hy3, MiMo V2.5, Qwen3.8 (3 models)",
 		defaultPoolId: "bai",
 		baseUrl: "https://api.b.ai/v1",
 		api: "openai-completions",
@@ -96,17 +96,6 @@ export const PRESETS: Preset[] = [
 				maxTokens: 131_072,
 				thinkingLevelMap: levels({ off: "none", low: "low", medium: "medium", xhigh: "xhigh" }),
 			},
-			{
-				// docs.b.ai/llmservice/models/glm-5-3-flash — always thinks (off unsupported);
-				// reasoning_effort: low/high/max, default max.
-				id: "glm-5.3-flash",
-				name: "GLM 5.3 Flash",
-				reasoning: true,
-				input: ["text", "image"],
-				contextWindow: 1_000_000,
-				maxTokens: 131_072,
-				thinkingLevelMap: levels({ low: "low", high: "high", max: "max" }),
-			},
 		],
 	},
 	{

package/probe.ts

@@ -144,8 +144,9 @@ export function parseModelsResponse(body: unknown): RemoteModel[] {
  * Verify a key with a minimal chat completion (a few tokens at most). Returns
  * "ok" when auth was accepted (2xx, or 4xx that clearly got past auth like a
  * bad-model/params 400/404), "rejected" on 401/403, "error" on network trouble.
+ * `onLog` receives the server's rejection body so the TUI can show why.
  */
-async function chatProbe(baseUrl: string, style: AuthStyle, key: string, modelId: string): Promise<"ok" | "rejected" | "error"> {
+async function chatProbe(baseUrl: string, style: AuthStyle, key: string, modelId: string, onLog?: (line: string) => void): Promise<"ok" | "rejected" | "error"> {
 	try {
 		const response = await fetch(`${trimSlash(baseUrl)}/chat/completions`, {
 			method: "POST",
@@ -158,7 +159,12 @@ async function chatProbe(baseUrl: string, style: AuthStyle, key: string, modelId
 			body: JSON.stringify({ model: modelId, max_tokens: 4, messages: [{ role: "user", content: "ping" }] }),
 			signal: AbortSignal.timeout(CHAT_TIMEOUT_MS),
 		});
-		if (response.status === 401 || response.status === 403) return "rejected";
+		if (response.status === 401 || response.status === 403) {
+			const text = await response.text().catch(() => "");
+			const flat = text.replace(/\s+/g, " ").trim();
+			if (flat) onLog?.(`   ↳ server said: ${flat.slice(0, 160)}`);
+			return "rejected";
+		}
 		return "ok"; // 2xx, or 4xx past auth (bad model / params) — auth itself worked.
 	} catch {
 		return "error";
@@ -226,7 +232,7 @@ export async function probeEndpoint(
 		let verified: AuthStyle | undefined;
 		for (const style of styles) {
 			emit(`auth check: 1-token chat on "${chatModelId}" with ${style === "bearer" ? "Bearer" : "x-api-key"}…`);
-			const verdict = await chatProbe(baseUrl, style, key, chatModelId);
+			const verdict = await chatProbe(baseUrl, style, key, chatModelId, emit);
 			if (verdict === "ok") {
 				verified = style;
 				emit(`   accepted ✓ (style: ${style === "bearer" ? "Authorization: Bearer" : "x-api-key"})`);

package/stream.ts

@@ -22,8 +22,8 @@ import {
 	type SimpleStreamOptions,
 } from "@earendil-works/pi-ai";
 import type { KeyOutcome, KeyPool, Lease } from "./pool.ts";
-import { endpointIdentityHeaders } from "./config.ts";
-import { ensureClineAccessToken } from "./cline-auth.ts";
+import { endpointIdentityHeaders, isClineEndpoint } from "./config.ts";
+import { ensureClineAccessToken, formatClineAccessToken } from "./cline-auth.ts";
 
 const RATE_LIMIT_RE = /\b429\b|rate\s*limit|too many requests|quota\s*(exceed|limit)|requests per minute|requests per day/i;
 const INVALID_KEY_RE = /\b40[13]\b|unauthorized|forbidden|invalid\s*(api\s*)?key|incorrect\s*(api\s*)?key|authentication/i;
@@ -91,7 +91,9 @@ export function createRotatingStreamSimple(pool: KeyPool, apiName: string, notif
 							pool.applyClineCredential(lease, fresh);
 							onConfigDirty?.();
 						}
-						apiKey = fresh.accessToken;
+						// Cline's API requires the "workos:" prefix; formatClineAccessToken
+						// is idempotent, so this also repairs keys stored before the fix.
+						apiKey = formatClineAccessToken(fresh.accessToken);
 					} catch (error) {
 						// The stale token may still work; if not, the 401 path below
 						// force-refreshes once before giving up on this key.
@@ -99,20 +101,25 @@ export function createRotatingStreamSimple(pool: KeyPool, apiName: string, notif
 							`multikey[${pool.config.id}]: token refresh failed on ${lease.label} (${error instanceof Error ? error.message : String(error)}) — trying stored token`,
 						);
 					}
+				} else if (isClineEndpoint(pool.config.baseUrl)) {
+					// Static (pasted) key on the Cline endpoint: same prefix rule applies.
+					apiKey = formatClineAccessToken(apiKey);
 				}
 
 				try {
 					const captured: CapturedResponse = { status: 0 };
-					// Identity headers (session / device) are per-request, so they are merged
-					// here rather than baked into the provider registration. Providers apply
-					// options.headers last, so these win over the static pool headers.
+					// Identity headers (session / request) are per-request, so they are
+					// merged here rather than baked into the provider registration.
+					// Providers apply options.headers last, so these win over the static
+					// pool headers. The message list keys the request id to the current
+					// turn, so retries of one turn share it like opencode's lastUser does.
 					const identityBaseUrl = model.baseUrl || pool.config.baseUrl;
 					const attemptOptions: SimpleStreamOptions = {
 						...options,
 						apiKey,
 						headers: {
 							...options?.headers,
-							...endpointIdentityHeaders(identityBaseUrl),
+							...endpointIdentityHeaders(identityBaseUrl, context.messages),
 							...(authStyle === "api-key" ? { "x-api-key": apiKey } : {}),
 						},
 						onResponse: (response) => {

package/tui.ts

@@ -161,6 +161,69 @@ export async function showInfo(ctx: CommandContext, title: string, lines: string
 	});
 }
 
+export interface InfoPanelHandle {
+	/** Resolves when the panel closes (user enter/esc, or close()). */
+	closed: Promise<void>;
+	/** Close the panel programmatically; no-op if the user already dismissed it. */
+	close(): void;
+}
+
+/**
+ * Non-blocking variant of {@link showInfo}: returns a handle immediately so the
+ * caller can auto-close the panel when something finishes (e.g. an OAuth device
+ * flow detects browser approval) while the user can still dismiss it manually.
+ * Dismissing the panel never cancels whatever is running behind it.
+ */
+export function showInfoWithHandle(ctx: CommandContext, title: string, lines: string[]): InfoPanelHandle {
+	let resolveClosed: (() => void) | undefined;
+	const closed = new Promise<void>((resolve) => {
+		resolveClosed = resolve;
+	});
+	let doneFn: (() => void) | undefined;
+	let settled = false;
+	const finish = () => {
+		if (settled) return;
+		settled = true;
+		try {
+			doneFn?.();
+		} catch {
+			// Panel may already be gone; the closed promise is what matters.
+		}
+		resolveClosed?.();
+	};
+
+	void ctx.ui.custom<void>((tui, theme, _kb, done) => {
+		doneFn = done;
+		let cachedLines: string[] | undefined;
+		return {
+			render(width: number) {
+				if (cachedLines) return cachedLines;
+				const w = Math.max(10, width);
+				const out: string[] = [];
+				const add = (line = "") => out.push(truncateToWidth(line, w));
+				const border = theme.fg("accent", "─".repeat(w));
+				add(border);
+				add(` ${theme.fg("accent", theme.bold(title))}`);
+				add();
+				for (const line of lines) add(` ${line}`);
+				add();
+				add(theme.fg("dim", " esc/enter dismiss (keeps running)"));
+				add(border);
+				cachedLines = out;
+				return out;
+			},
+			invalidate() {
+				cachedLines = undefined;
+			},
+			handleInput(data: string) {
+				if (matchesKey(data, Key.escape) || matchesKey(data, Key.enter)) finish();
+			},
+		};
+	});
+
+	return { closed, close: finish };
+}
+
 /** Simple toggle list (multi-select), returns selected values or null on cancel. */
 export async function pickMany(
 	ctx: CommandContext,