@ebony-vinyl/dsh-our-free-model 2.8.0 → 2.8.2

package/src/providers/registry.json

@@ -3827,63 +3827,105 @@
       "env": "KILO_API_KEY",
       "url": "https://app.kilo.ai"
     },
-    "baseUrl": "https://api.kilo.ai/api/gateway",
+    "baseUrl": "https://ai-gateway.kilo.ai/api/v1",
     "format": "openai-chat",
     "models": [
       {
         "id": "kilo-auto/free",
-        "name": "Kilo Auto Free",
+        "name": "Auto Free",
         "contextWindow": 256000,
-        "vision": null,
-        "reasoning": null
+        "vision": false,
+        "reasoning": true
       },
       {
-        "id": "nvidia/nemotron-3-super-120b-a12b:free",
-        "name": "Nemotron 3 Super 120B (Free)",
-        "contextWindow": 262144,
-        "vision": null,
-        "reasoning": null
+        "id": "nvidia/nemotron-3.5-super-vl:free",
+        "name": "NVIDIA: Nemotron 3.5 Super VL",
+        "contextWindow": 1000000,
+        "vision": true,
+        "reasoning": true
       },
       {
-        "id": "nvidia/nemotron-3-ultra-550b-a55b:free",
-        "name": "Nemotron 3 Ultra 550B (Free)",
-        "contextWindow": 1000000,
-        "vision": null,
-        "reasoning": null
+        "id": "reflection/beam-free",
+        "name": "Reflection: Beam 1.0",
+        "contextWindow": 1048576,
+        "vision": false,
+        "reasoning": true
       },
       {
-        "id": "kwaipilot/kat-coder-pro-v2.5:free",
-        "name": "Kat Coder Pro v2.5 (Free)",
+        "id": "stealth/glyph-cluster",
+        "name": "Stealth: Glyph Cluster",
         "contextWindow": 256000,
-        "vision": null,
-        "reasoning": null
+        "vision": false,
+        "reasoning": true
       },
       {
-        "id": "kilo-auto/frontier",
-        "name": "Kilo Auto Frontier",
+        "id": "stealth/crouton-alpha",
+        "name": "Crouton Alpha",
+        "contextWindow": 1048576,
+        "vision": true,
+        "reasoning": true
+      },
+      {
+        "id": "dots-studio/dots-3-note-preview:free",
+        "name": "Dots Studio: Dots3-Note Preview",
+        "contextWindow": 512000,
+        "vision": true,
+        "reasoning": true
+      },
+      {
+        "id": "nvidia/nemotron-3.5-lightning:free",
+        "name": "NVIDIA: Nemotron 3.5 Lightning",
         "contextWindow": 1000000,
-        "vision": null,
-        "reasoning": null
+        "vision": false,
+        "reasoning": true
       },
       {
-        "id": "kilo-auto/balanced",
-        "name": "Kilo Auto Balanced",
+        "id": "cohere/north-mini-code:free",
+        "name": "Cohere: North Mini Code",
+        "contextWindow": 256000,
+        "vision": false,
+        "reasoning": true
+      },
+      {
+        "id": "nvidia/nemotron-3-ultra-550b-a55b:free",
+        "name": "NVIDIA: Nemotron 3 Ultra",
         "contextWindow": 1000000,
-        "vision": null,
-        "reasoning": null
+        "vision": false,
+        "reasoning": true
+      },
+      {
+        "id": "nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free",
+        "name": "NVIDIA: Nemotron 3 Nano Omni",
+        "contextWindow": 256000,
+        "vision": true,
+        "reasoning": true
+      },
+      {
+        "id": "openrouter/free",
+        "name": "OpenRouter Free Models Router",
+        "contextWindow": 200000,
+        "vision": true,
+        "reasoning": true
       }
     ],
-    "notes": "Kilo gateway free pool; the plugin’s own Kilo channel reads the same host.",
+    "notes": "Kilo gateway free pool, snapshot 2026-11-07; the plugin’s own Kilo channel serves it keyless from the live listing — this row is the aggregate-lane fallback for a pasted key.",
     "website": "https://kilo.ai/",
     "local": false,
     "source": "fcc",
     "freeModelsHint": [
       "kilo-auto/free",
-      "nvidia/nemotron-3-super-120b-a12b:free",
+      "nvidia/nemotron-3.5-super-vl:free",
+      "reflection/beam-free",
+      "stealth/glyph-cluster",
+      "stealth/crouton-alpha",
+      "dots-studio/dots-3-note-preview:free",
+      "nvidia/nemotron-3.5-lightning:free",
+      "cohere/north-mini-code:free",
       "nvidia/nemotron-3-ultra-550b-a55b:free",
-      "kwaipilot/kat-coder-pro-v2.5:free"
+      "nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free",
+      "openrouter/free"
     ],
-    "modelsUrl": "https://api.kilo.ai/api/gateway/models"
+    "modelsUrl": "https://ai-gateway.kilo.ai/api/v1/models"
   },
   {
     "id": "kimchi",

package/src/semver.js

@@ -0,0 +1,40 @@
+/**
+ * Semver comparison shared by the self-updater and the extension platform.
+ * Lives apart from updater.js because the standalone package deliberately
+ * ships without the updater — the extension runtime still needs to compare a
+ * registry entry's minHost against the host version.
+ */
+
+/** Parse `1.2.3` / `1.2.3-rc.4` into a comparable tuple; `null` when malformed. */
+export function parseVersion(value) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([\w.]+))?$/.exec(String(value ?? '').trim())
+  if (match === null) return null
+  const pre = match[4] === undefined ? null : match[4].split('.')
+  return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]), pre }
+}
+
+/** -1 | 0 | 1 in semver precedence; a pre-release sorts before its release. */
+export function compareVersions(a, b) {
+  const left = parseVersion(a)
+  const right = parseVersion(b)
+  if (left === null || right === null) return a === b ? 0 : a > b ? 1 : -1
+  for (const key of ['major', 'minor', 'patch']) {
+    if (left[key] !== right[key]) return left[key] < right[key] ? -1 : 1
+  }
+  if (left.pre === null && right.pre === null) return 0
+  if (left.pre === null) return 1
+  if (right.pre === null) return -1
+  const width = Math.max(left.pre.length, right.pre.length)
+  for (let i = 0; i < width; i += 1) {
+    const x = left.pre[i]
+    const y = right.pre[i]
+    if (x === undefined) return -1
+    if (y === undefined) return 1
+    const xn = /^\d+$/.test(x)
+    const yn = /^\d+$/.test(y)
+    if (xn && yn && Number(x) !== Number(y)) return Number(x) < Number(y) ? -1 : 1
+    if (xn !== yn) return xn ? -1 : 1
+    if (x !== y) return x < y ? -1 : 1
+  }
+  return 0
+}

package/src/store.js

@@ -159,6 +159,15 @@ export const SETTINGS_INITIAL = {
   version: 1,
   /** Master switch: when off the routes stay registered but serve nothing. */
   enabled: true,
+  /** Allow installing unsigned local plugin packages from disk. Off by
+   *  default: the signed marketplace is the trust root, and a local package is
+   *  an explicit developer action with its own warning and badge. */
+  developerPlugins: false,
+  /** Install extension updates automatically once the registry tick runs and
+   *  the newer version has soaked past its supply-chain window (see
+   *  AUTO_UPDATE_SOAK_MS in src/extensions.js). Off by default: the update
+   *  badge is the prompt, the button is the decision. */
+  autoUpdateExtensions: false,
   /** Show region-limited models in the picker as soon as they answer. */
   exposeRegionModels: true,
   /** Advertisement only: retain catalog entries and historical model resolution. */
@@ -167,8 +176,15 @@ export const SETTINGS_INITIAL = {
   hideEacModels: false,
   /** Minutes between background catalog refreshes. Automatic availability
    *  probing is disabled by owner policy; only the manual reprobe button sends
-   *  probe requests. */
+   *  probe requests. Since 2.8.1 this cadence also cannot re-fetch the listing
+   *  more often than once a listing window (see src/core/runtime.js). */
   probeIntervalMinutes: 15,
+  /** The OpenCode lane's own proxy exit (issue #708's method): when set, this
+   *  lane's requests dial through it instead of the process's global egress,
+   *  which is how a burned per-IP quota window is left behind. Empty means the
+   *  global outlet when one runs, then the HTTP(S)_PROXY environment, then
+   *  direct. Never auto-rotated — the address is the user's own. */
+  freeLane: { proxyUrl: '' },
   /** Serve the OpenAI-compatible forward listener for other local harnesses. */
   forward: {
     enabled: false,

package/src/stream.js

@@ -88,11 +88,13 @@ function argumentsCutMidway(raw) {
 }
 
 class BlockSink {
-  constructor(yieldChunk, startIndex, checkpointLimit, onProgress) {
+  constructor(yieldChunk, startIndex, checkpointLimit, onProgress, renameMap) {
     this.emit = yieldChunk
     this.next = startIndex
     this.onProgress = typeof onProgress === 'function' ? onProgress : () => {}
-    /** @type {Map<string, {index:number, kind:string, text:string, id?:string, name?:string, args?:string}>} */
+    /** The rename map the raw Chat tool names resolve through. */
+    this.renameMap = renameMap
+    /** @type {Map<string, {index:number, kind:string, text:string, id?:string, name?:string, rawName?:string, args?:string}>} */
     this.open = new Map()
     this.usage = undefined
     this.sawReasoning = false
@@ -186,10 +188,40 @@ class BlockSink {
       && (block.name !== priorName || block.id !== priorId)) this.onProgress()
   }
 
+  /**
+   * Buffer one fragment of a Chat tool call's wire name (`toolNameFragment`).
+   *
+   * Some gateways split `tool_calls[].function.name` across delta frames — and
+   * resolving every fragment on arrival used to fold a half name into a wrong
+   * or unknown tool, surfacing ghost calls (opencode2api v1.4.7 buffers the
+   * same way). The raw name accumulates here and resolves through
+   * {@link resolveRawName} once the call's arguments start or the block closes;
+   * until then the emitted deltas simply carry no name, which downstream
+   * consumers already tolerate (arguments can legitimately precede a name).
+   */
+  toolNameFragment(key, id, fragment) {
+    const block = this.slot(key, 'tool-call')
+    if (id) block.id = id
+    // Real servers repeat the *complete* name on every delta; a genuinely split
+    // name arrives as disjoint fragments. Extend when the fragment continues
+    // (or repeats) what we hold, concatenate only when it cannot be a repeat —
+    // that covers both shapes without ever doubling a repeated name.
+    const held = typeof block.rawName === 'string' ? block.rawName : ''
+    block.rawName = fragment.startsWith(held) ? fragment : held + fragment
+  }
+
+  /** Resolve a buffered raw wire name once, right before its first consumer needs it. */
+  #resolveRawName(block) {
+    if (block.name || typeof block.rawName !== 'string' || block.rawName === '') return
+    block.name = restoreToolName(block.rawName, this.renameMap)
+    this.onProgress()
+  }
+
   toolArgs(key, delta) {
     this.sawToolCall = true
     if (!delta) return
     const block = this.slot(key, 'tool-call')
+    this.#resolveRawName(block)
     block.args += delta
     // Arguments can arrive before the wire has named the call (a Claude-relay
     // stream does exactly this). The harness re-reads every chunk through a
@@ -211,6 +243,7 @@ class BlockSink {
       if (block.kind === 'text' && block.text !== '') this.emit({ type: 'block-end', index: block.index, block: { type: 'text', text: block.text } })
       else if (block.kind === 'reasoning' && block.text !== '') this.emit({ type: 'block-end', index: block.index, block: { type: 'reasoning', text: block.text } })
       else if (block.kind === 'tool-call') {
+        this.#resolveRawName(block)
         // Arguments that never parse are an unexecutable call. The gateway
         // reports finish "tool_calls" even when the output ceiling cut the JSON
         // mid-string (verified live 2026-09-25), so the finish token alone
@@ -359,7 +392,9 @@ function feedChat(sink, payload, renameMap, onFinish) {
       sink.sawToolCall = true
       const key = sink.toolKey(call)
       const name = call.function?.name
-      if (typeof name === 'string' && name !== '') sink.toolStart(key, call.id ?? '', restoreToolName(name, renameMap))
+      // The name is buffered, not resolved per fragment: split frames used to
+      // fold a half name into a ghost tool (see BlockSink.toolNameFragment).
+      if (typeof name === 'string' && name !== '') sink.toolNameFragment(key, call.id ?? '', name)
       else if (call.id) sink.toolStart(key, call.id, '')
       if (call.function?.arguments) sink.toolArgs(key, call.function.arguments)
     }
@@ -506,7 +541,7 @@ export async function * readStream(lines, wire, renameMap, now = () => Date.now(
   const outbox = []
   const startIndex = Number.isSafeInteger(options?.startIndex) && options.startIndex >= 0 ? options.startIndex : 0
   const checkpointLimit = Number.isSafeInteger(options?.checkpointLimit) && options.checkpointLimit >= 0 ? options.checkpointLimit : 131072
-  const sink = new BlockSink(chunk => outbox.push(chunk), startIndex, checkpointLimit, options?.onProgress)
+  const sink = new BlockSink(chunk => outbox.push(chunk), startIndex, checkpointLimit, options?.onProgress, renameMap)
   const state = { usage: undefined, finish: undefined, sawFinish: false, sawUsage: false, sawToolCall: false, firstDeltaAt: undefined, sawReasoning: false, sawText: false, brokenToolCall: false }
   const snapshot = () => ({
     ...state,

package/src/subscription-completion.js

@@ -335,10 +335,11 @@ function credentialRedactor(secrets, deliver) {
  * complete() may override it with request.resolveImage for that call only.
  */
 export function createSubscriptionRuntime({
-  subscriptions, stats, logger, fetchImpl = globalThis.fetch, timeoutMs = 300000, resolveImage,
+  subscriptions, stats, logger, fetchImpl = globalThis.fetch, timeoutMs = 300000, resolveImage, onPayload,
 } = {}) {
   if (typeof subscriptions?.list !== 'function' || typeof subscriptions?.resolve !== 'function'
     || (resolveImage !== undefined && typeof resolveImage !== 'function')
+    || (onPayload !== undefined && typeof onPayload !== 'function')
     || typeof fetchImpl !== 'function' || !Number.isFinite(timeoutMs) || timeoutMs < 1 || timeoutMs > 300000) {
     throw failure('INVALID_INPUT', 'Invalid subscription runtime configuration', 400)
   }
@@ -388,6 +389,14 @@ export function createSubscriptionRuntime({
         onChunk(chunk)
         foldForwardOutcome(outcome, chunk)
       })
+      let body = payload
+      if (onPayload !== undefined) {
+        // The owner's body seam (enhancement extensions on the magpie lane):
+        // fail-open is the hook's own contract, but a broken seam itself must
+        // not take the turn down — ship the unmodified payload instead.
+        try { body = (await Promise.race([onPayload(payload, { provider: config.provider, model: config.model, wire: config.wire }), interrupted])) ?? payload }
+        catch (error) { if (controller.signal.aborted) throw error }
+      }
       try {
         response = await Promise.race([fetchImpl(config.endpoint, {
           method: 'POST', redirect: 'error', signal: controller.signal,
@@ -395,7 +404,7 @@ export function createSubscriptionRuntime({
             ...config.headers, 'content-type': 'application/json', accept: 'text/event-stream',
             ...(config.provider === 'gemini' ? { 'user-agent': `GeminiCLI/0.61.0/${config.model} (${process.platform}; ${process.arch}; terminal)` } : {}),
           },
-          body: JSON.stringify(payload),
+          body: JSON.stringify(body),
         }), interrupted])
       } catch (error) {
         if (controller.signal.aborted) throw error

package/src/updater.js

@@ -161,39 +161,11 @@ const restartRequiredVersions = globalThis[RESTART_MARKER] ??= new Map()
 const UPGRADE_LOCKS = Symbol.for('our-free-model.upgrade-locks')
 const upgradeLocks = globalThis[UPGRADE_LOCKS] ??= new Set()
 
-/** Parse `1.2.3` / `1.2.3-rc.4` into a comparable tuple; `null` when malformed. */
-export function parseVersion(value) {
-  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([\w.]+))?$/.exec(String(value ?? '').trim())
-  if (match === null) return null
-  const pre = match[4] === undefined ? null : match[4].split('.')
-  return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]), pre }
-}
-
-/** -1 | 0 | 1 in semver precedence; a pre-release sorts before its release. */
-export function compareVersions(a, b) {
-  const left = parseVersion(a)
-  const right = parseVersion(b)
-  if (left === null || right === null) return a === b ? 0 : a > b ? 1 : -1
-  for (const key of ['major', 'minor', 'patch']) {
-    if (left[key] !== right[key]) return left[key] < right[key] ? -1 : 1
-  }
-  if (left.pre === null && right.pre === null) return 0
-  if (left.pre === null) return 1
-  if (right.pre === null) return -1
-  const width = Math.max(left.pre.length, right.pre.length)
-  for (let i = 0; i < width; i += 1) {
-    const x = left.pre[i]
-    const y = right.pre[i]
-    if (x === undefined) return -1
-    if (y === undefined) return 1
-    const xn = /^\d+$/.test(x)
-    const yn = /^\d+$/.test(y)
-    if (xn && yn && Number(x) !== Number(y)) return Number(x) < Number(y) ? -1 : 1
-    if (xn !== yn) return xn ? -1 : 1
-    if (x !== y) return x < y ? -1 : 1
-  }
-  return 0
-}
+// Semver comparison lives in ./semver.js — the standalone package ships
+// without the updater but with the extension platform, which compares a
+// registry entry's minHost against the host version.
+import { parseVersion, compareVersions } from './semver.js'
+export { parseVersion, compareVersions }
 
 /** Detect a plugin install whose package files still belong to a package-manager store. */
 export function packageUsesHardLinks(pkgDir) {

package/src/upstream.js

@@ -422,6 +422,45 @@ export function ensureFreeLaneEnvironment(body, style, environment = {}) {
   appendSystemContext(body, shape, `Here is some useful information about the environment you are running in:\n<env>\n  Working directory: ${line(cwd)}\n  Platform: ${line(platform)}\n</env>`)
 }
 
+/**
+ * The request shapes the free tier reads as a conversation-title generator
+ * (`title.IsTitleRequest`, opencode2api v1.4.7): no tools declared, one to
+ * three turns, no assistant/tool/function turn, and a title marker in the
+ * system or leading text.
+ *
+ * The reference stopped shaping these bodies in v1.4.7 with a measured reason:
+ * the free tier answers an agent-shaped tool list on a toolless title call
+ * with 403/429. This lane injects the full official prompt and 13-tool set on
+ * every body, so the harness's title round-trips used to ship exactly that
+ * shape whenever the local title answer was switched off. A title request now
+ * ships as the caller wrote it — no prompt injection, no tool append, no
+ * renames.
+ */
+const TITLE_MARKERS = /generate a title|write a title|create a title|come up with a title|title (?:for|of) (?:this|the) (?:conversation|chat|session|exchange|request)|conversation title|summarize (?:this|the) conversation/i
+
+export function isTitleRequest(body, style) {
+  if (!body || typeof body !== 'object') return false
+  if ((Array.isArray(body.tools) && body.tools.length > 0) || (Array.isArray(body.functions) && body.functions.length > 0)) return false
+  if (body.tool_choice !== undefined) return false
+  const shape = shapeOf(style)
+  const textOf = value => typeof value === 'string' ? value
+    : Array.isArray(value) ? value.map(part => part?.text ?? '').join('\n') : ''
+  let turns
+  let leading = ''
+  if (shape === 'flat') {
+    turns = (Array.isArray(body.input) ? body.input : []).filter(item => item !== null && typeof item === 'object' && typeof item.role === 'string')
+    leading = textOf(body.instructions)
+  } else {
+    turns = (Array.isArray(body.messages) ? body.messages : []).filter(message => message !== null && typeof message === 'object')
+    leading = shape === 'claude' ? textOf(body.system) : ''
+  }
+  if (turns.length === 0 || turns.length > 3) return false
+  for (const turn of turns) {
+    if (!['user', 'system', 'developer'].includes(String(turn.role ?? ''))) return false
+  }
+  return TITLE_MARKERS.test(`${leading}\n${turns.map(turn => textOf(turn.content)).join('\n')}`)
+}
+
 /**
  * Satisfy the v2 free-tier fingerprint on `body`, shaped as the reference
  * gateway shapes it (opencode2api v1.4.6, see the module header):
@@ -452,6 +491,10 @@ export function applyFingerprint(body, style) {
   const shape = shapeOf(style)
   if (!body || typeof body !== 'object') return new ToolRenameMap()
 
+  // 0. Title requests ship unshaped: an agent-shaped tool list on a toolless
+  // title call is a 403/429 the reference measured (see isTitleRequest).
+  if (isTitleRequest(body, style)) return new ToolRenameMap()
+
   // 1. Official system prompt (the reference injects before shaping tools).
   injectOfficialPrompt(body, shape)
 

package/vendor/channel-pack/NOTICE.md

@@ -43,7 +43,7 @@ OFM_ESBUILD_DIR=/tmp/ofm-channel-build npm run channel-pack
 - `src/index.ts`：增加可选 `disableOpencode` 挂载配置；OFM 开启它时跳过重复 OpenCode adapter、默认匿名账号和能力表预热，保留历史账号及凭据。省略时维持上游行为。
 - `src/channel-pack-rpc.ts`：追加同一配置，关闭时拒绝 `opencode.*` 与通用 `account.create(provider=opencode)`。
 - 打包入口改为 `src/index.ts`；宿主模块仍保持外部，undici 内联。
-- 再构建使用 esbuild 0.25.12，undici 8.11.2 沿用根目录锁文件，未借此升级运行依赖。
+- 再构建使用 esbuild 0.25.12，undici 8.12.2 使用根目录锁文件，与插件和独立端的运行产物保持一致。
 - `src/credential-expiry.ts` 与 `src/credit-expiry-window.ts` 提供渠道间共享的纯函数。积分临时窗口默认 15 天，可通过 `DSH_CREDIT_EXPIRING_WINDOW_DAYS` 显式设置为非负天数。
 
 本目录**不含**上游的浏览器半身（`plugin-src/client`）与其设置页——