free-coding-models 0.5.16 → 0.5.18

package/changelog/v0.5.17.md

@@ -0,0 +1,13 @@
+# Changelog v0.5.17 - 2026-06-08
+
+### Fixed
+- **Docker provider key mapping** — replaced broken `sed` logic with a proper Node.js init script (`scripts/docker-init.mjs`). The script imports `ENV_VARS` from `config.js` (single source of truth) and generates clean entrypoint files. `docker-entrypoint.sh` simplified to a 1‑line Node call. Added `/api/key/:provider/test` POST endpoint to the daemon (was 404), and fixed the key test probe to use the first valid model from the provider instead of an empty string.
+- **Docker compose** — cleaned 9 stale providers, added `GEMINI_API_KEY` and `OPENCODE_ZEN_API_KEY` support.
+
+### Updated
+- **kandown** bumped from 0.4.0 → 0.8.0 (minor version bump, improved task kanban).
+- **vite-plus** bumped to 0.1.24 (dependency fix).
+- **docker/setup-qemu-action** bumped from 3 → 4 in CI (major bump, multi‑arch builds).
+
+### Added (test coverage)
+- Added tests for Docker init script key mapping and `/api/key/:provider/test` endpoint (see `test/test.js`).

package/changelog/v0.5.18.md

@@ -0,0 +1,12 @@
+# Changelog v0.5.18 - 2026-06-09
+
+### Fixed
+- Fixed the mandatory startup updater loop when the active `free-coding-models` binary is installed under one npm prefix but another Node/npm manager shadows `npm` in `PATH`. The updater now detects the npm prefix that owns the currently running package, installs into that exact prefix, and verifies that the active package version changed before relaunching.
+- Improved updater fallback instructions so manual recovery commands include the owning npm binary and `--prefix` target when needed, instead of pointing users at a different global install.
+- Stabilized the router dashboard SSE endpoints so `/api/events` and `/stream/events` flush an initial frame immediately and tests/clients do not hang while waiting for the first broadcast.
+
+### Changed
+- Restored the normal startup update path and live OpenRouter/release-date startup behavior after the temporary local debug bypass used to diagnose the update loop.
+
+### Added
+- Added regression coverage for npm-prefix-aware update command generation so future updater changes do not reintroduce the same cross-prefix loop.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-coding-models",
-  "version": "0.5.16",
+  "version": "0.5.18",
   "description": "Find the fastest coding LLM models in seconds — ping free models from multiple providers, pick the best one for OpenCode, Cursor, or any AI coding assistant.",
   "keywords": [
     "nvidia",
@@ -67,7 +67,7 @@
     "@tabler/icons-react": "^3.44.0",
     "@tanstack/react-table": "^8.21.3",
     "chalk": "^5.6.2",
-    "kandown": "^0.4.0",
+    "kandown": "^0.8.0",
     "socket.io": "^4.8.3",
     "socket.io-client": "^4.8.3"
   },
@@ -80,6 +80,6 @@
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "vite": "^8.0.16",
-    "vite-plus": "^0.1.23"
+    "vite-plus": "^0.1.24"
   }
 }

package/src/core/config.js

@@ -108,6 +108,7 @@ import { syncShellEnv } from './shell-env.js'
 
 // 📖 New JSON config path — stores all providers' API keys + enabled state
 export const CONFIG_PATH = join(homedir(), '.free-coding-models.json')
+export { ENV_VARS }
 
 // 📖 Runtime data directory — backups and local snapshots live here.
 export const DAEMON_DATA_DIR = join(homedir(), '.free-coding-models')

package/src/core/router-daemon.js

@@ -47,7 +47,7 @@ import {
   normalizeRouterConfig,
   saveConfig,
 } from './config.js'
-import { buildChatCompletionPingBody, resolveCloudflareUrl, shouldUseDisabledThinkingForProvider } from './ping.js'
+import { buildChatCompletionPingBody, ping, resolveCloudflareUrl, shouldUseDisabledThinkingForProvider } from './ping.js'
 import { benchmarkModel, BENCHMARK_TIMEOUT_MS } from './benchmark.js'
 import { sendUsageTelemetry } from './telemetry.js'
 
@@ -73,6 +73,7 @@ export function getRouterPortRange() {
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const CLI_ENTRY_PATH = join(__dirname, '..', '..', 'bin', 'free-coding-models.js')
+const LOCAL_VERSION = JSON.parse(readFileSync(join(__dirname, '..', '..', 'package.json'), 'utf8')).version
 const MAX_BODY_BYTES = 10 * 1024 * 1024
 const MAX_REQUEST_LOG = 200
 const MAX_SSE_CLIENTS = 10
@@ -2507,6 +2508,8 @@ class RouterRuntime {
           Connection: 'keep-alive',
           'x-request-id': requestId,
         })
+        res.flushHeaders?.()
+        res.write(': connected\n\n')
         res.write(`event: hello\ndata: ${JSON.stringify(this.statusPayload())}\n\n`)
         this.sseClients.add(res)
         req.on('close', () => this.sseClients.delete(res))
@@ -2537,6 +2540,22 @@ class RouterRuntime {
         sendJson(res, 200, getWebModelsPayload(this), { 'x-request-id': requestId })
         return
       }
+      // 📖 Stub endpoints for the web dashboard's hooks (useToolMode, useFavorites,
+      // 📖 useUpdateChecker). These were 404 before — minimal shapes that match
+      // 📖 what the dashboard hooks expect. See PR #108 for context.
+      if (req.method === 'GET' && (url.pathname === '/api/tool-mode')) {
+        sendJson(res, 200, { mode: 'opencode', tools: ['opencode', 'openclaw', 'opencode-desktop', 'opencode-web'] }, { 'x-request-id': requestId })
+        return
+      }
+      if (req.method === 'GET' && (url.pathname === '/api/favorites')) {
+        const cfg = this.config || {}
+        sendJson(res, 200, { favorites: cfg.favorites || [], pinnedAndSticky: Boolean(cfg.settings?.favoritesPinnedAndSticky) }, { 'x-request-id': requestId })
+        return
+      }
+      if (req.method === 'GET' && (url.pathname === '/api/version')) {
+        sendJson(res, 200, { local: LOCAL_VERSION, latest: null, lastReleaseDate: null, error: null }, { 'x-request-id': requestId })
+        return
+      }
       // 📖 /api/router/catalog — lightweight catalog of routeable models for
       // 📖 the Web Router Dashboard's "Add model" picker. Returns one row
       // 📖 per (provider, model) with `key`, label, tier, ctx. We filter to
@@ -2626,6 +2645,8 @@ class RouterRuntime {
           'Connection': 'keep-alive',
           'x-request-id': requestId,
         })
+        res.flushHeaders?.()
+        res.write(': connected\n\n')
         res.write(`data: ${JSON.stringify(getWebStatePayload(this))}\n\n`)
         this.sseClients.add(res)
         req.on('close', () => this.sseClients.delete(res))
@@ -2673,21 +2694,50 @@ class RouterRuntime {
         sendJson(res, result.started ? 202 : 409, result, { 'x-request-id': requestId })
         return
       }
-      if (req.method === 'GET' && url.pathname.startsWith('/api/key/')) {
-        // 📖 Reveals raw API keys — same-origin only to prevent malicious sites
-        // 📖 from exfiltrating provider credentials via XHR/fetch.
+      if (url.pathname.startsWith('/api/key/')) {
         if (!isSameOriginOrLocal(req)) {
           sendError(res, 403, 'Forbidden cross-origin request', 'invalid_request_error', 'forbidden_origin', requestId)
           return
         }
-        const providerKey = decodeURIComponent(url.pathname.slice('/api/key/'.length))
-        if (!providerKey || !sources[providerKey]) {
-          sendError(res, 404, 'Unknown provider', 'invalid_request_error', 'unknown_provider', requestId)
+        const testMatch = url.pathname.match(/^\/api\/key\/([^/]+)\/test$/)
+        if (testMatch && req.method === 'POST') {
+          const providerKey = decodeURIComponent(testMatch[1])
+          if (!sources[providerKey]) {
+            sendError(res, 404, 'Unknown provider', 'invalid_request_error', 'unknown_provider', requestId)
+            return
+          }
+          const apiKey = this.getApiKeyForProvider(providerKey)
+          if (!apiKey) {
+            sendJson(res, 200, { outcome: 'missing_key', detail: `${providerKey} has no saved API key.` }, { 'x-request-id': requestId })
+            return
+          }
+          const providerModels = sources[providerKey]?.models || []
+          const modelId = providerModels[0]?.[0] || ''
+          try {
+            const result = await ping(apiKey, modelId, providerKey, sources[providerKey].url)
+            const code = result?.code
+            if (code === '200') {
+              sendJson(res, 200, { outcome: 'ok', code: 200 }, { 'x-request-id': requestId })
+            } else if (code === '401' || code === '403') {
+              sendJson(res, 200, { outcome: 'auth_error', code: Number(code) || code }, { 'x-request-id': requestId })
+            } else {
+              sendJson(res, 200, { outcome: 'fail', code: code ?? 'ERR', detail: 'Probe did not return a 2xx' }, { 'x-request-id': requestId })
+            }
+          } catch (err) {
+            sendJson(res, 200, { outcome: 'fail', detail: err.message || 'Probe failed' }, { 'x-request-id': requestId })
+          }
+          return
+        }
+        if (req.method === 'GET') {
+          const providerKey = decodeURIComponent(url.pathname.slice('/api/key/'.length))
+          if (!providerKey || !sources[providerKey]) {
+            sendError(res, 404, 'Unknown provider', 'invalid_request_error', 'unknown_provider', requestId)
+            return
+          }
+          const rawKey = this.getApiKeyForProvider(providerKey)
+          sendJson(res, 200, { key: rawKey || null }, { 'x-request-id': requestId })
           return
         }
-        const rawKey = this.getApiKeyForProvider(providerKey)
-        sendJson(res, 200, { key: rawKey || null }, { 'x-request-id': requestId })
-        return
       }
       if (req.method === 'POST' && url.pathname === '/api/settings') {
         // 📖 Writes API keys + provider toggles — same-origin only to block
@@ -2881,7 +2931,7 @@ const PREFERRED_DEFAULT_MODELS = [
  * @param {object} [options] { probeFn: async (entry) => ({ ok, latencyMs, code }) }
  * @returns {{ name: string, models: Array, created: string }}
  */
-export async function buildDefaultRouterSet(config = {}, maxModels = 5, options = {}) {
+export async function buildDefaultRouterSet(config = {}, maxModels, options = {}) {
   const probeFn = typeof options.probeFn === 'function' ? options.probeFn : null
   const probeTimeoutMs = typeof options.probeTimeoutMs === 'number' ? options.probeTimeoutMs : 1500
   const probeBudget = typeof options.probeBudget === 'number' ? options.probeBudget : 24
@@ -2890,6 +2940,10 @@ export async function buildDefaultRouterSet(config = {}, maxModels = 5, options
     .filter(([, value]) => (Array.isArray(value) ? value.length > 0 : typeof value === 'string' && value.trim()))
     .map(([provider]) => provider))
 
+  // 📖 Scale default set size with configured providers so users with many
+  // 📖 keys get a richer default router set (PR #108 idea, kept from the
+  // 📖 previous sync version).
+  if (maxModels === undefined) maxModels = Math.max(5, keyedProviders.size * 2)
   const entries = []
   for (const [providerKey, source] of Object.entries(sources)) {
     if (!isRouteableProvider(providerKey)) continue

package/src/core/updater.js

@@ -28,6 +28,7 @@
  *
  * @functions
  *   → detectPackageManager()             — Detect which PM owns the current installation
+ *   → resolveCurrentNpmInstallTarget()   — Detect the npm prefix that owns the active package
  *   → getInstallArgs(pm, version)        — Build correct { bin, args } per package manager
  *   → getManualInstallCmd(pm, version)   — Human-readable install command string for error messages
  *   → checkForUpdateDetailed()           — Fetch npm latest with explicit error info
@@ -36,7 +37,7 @@
  *   → enforceMandatoryStartupUpdate()    — Mandatory startup self-update with two-failure fallback
  *   → runUpdate(latestVersion)           — Install new version via detected PM + relaunch
  * @exports
- *   detectPackageManager, getInstallArgs, getManualInstallCmd,
+ *   detectPackageManager, resolveCurrentNpmInstallTarget, getInstallArgs, getManualInstallCmd,
  *   checkForUpdateDetailed, checkForUpdate, isPackageDevMode,
  *   enforceMandatoryStartupUpdate, runUpdate, fetchLastReleaseDate
  *
@@ -47,15 +48,42 @@ import chalk from 'chalk'
 import { createRequire } from 'module'
 import { fileURLToPath } from 'url'
 import { dirname, join } from 'path'
-import { accessSync, constants, existsSync } from 'fs'
+import { accessSync, constants, existsSync, readFileSync } from 'fs'
 
 const require = createRequire(import.meta.url)
 const readline = require('readline')
 const pkg = require('../../package.json')
 const LOCAL_VERSION = pkg.version
 const PACKAGE_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..')
+const PACKAGE_NAME = 'free-coding-models'
 export const UPDATE_FAILURE_THRESHOLD = 2
 
+/**
+ * 📖 resolveCurrentNpmInstallTarget: detect the npm prefix that owns this exact
+ * 📖 running package, not just the first `npm` found in PATH. Users can run FCM
+ * 📖 from one global install while another Node manager shadows `npm`; updating
+ * 📖 the shadow prefix leaves the active binary stale and creates an update loop.
+ * @param {string} [packageRoot]
+ * @returns {{ packageRoot: string, prefix: string, bin: string } | null}
+ */
+export function resolveCurrentNpmInstallTarget(packageRoot = PACKAGE_ROOT) {
+  const normalizedRoot = String(packageRoot || '').replace(/\\/g, '/')
+  const suffix = `/lib/node_modules/${PACKAGE_NAME}`
+  if (!normalizedRoot.endsWith(suffix)) return null
+
+  const prefix = packageRoot.slice(0, packageRoot.length - suffix.length)
+  if (!prefix) return null
+
+  const npmBinName = process.platform === 'win32' ? 'npm.cmd' : 'npm'
+  const npmBin = join(prefix, 'bin', npmBinName)
+
+  return {
+    packageRoot,
+    prefix,
+    bin: existsSync(npmBin) ? npmBin : 'npm',
+  }
+}
+
 /**
  * 📖 detectPackageManager: figure out which package manager owns the current installation.
  * 📖 Checks import.meta.url (package install path), process.argv[1] (script entry),
@@ -141,27 +169,48 @@ export function buildOutdatedWarningMessage(latestVersion, failures = UPDATE_FAI
  * 📖 Each PM has different syntax for global install — this normalises them.
  * @param {'npm' | 'bun' | 'pnpm' | 'yarn'} pm
  * @param {string} version
+ * @param {{ prefix?: string, bin?: string }} [options]
  * @returns {{ bin: string, args: string[] }}
  */
-export function getInstallArgs(pm, version) {
-  const pkg = `free-coding-models@${version}`
+export function getInstallArgs(pm, version, options = {}) {
+  const pkg = `${PACKAGE_NAME}@${version}`
   switch (pm) {
     case 'bun':   return { bin: 'bun',   args: ['add', '-g', pkg] }
     case 'pnpm':  return { bin: 'pnpm',  args: ['add', '-g', pkg] }
     case 'yarn':  return { bin: 'yarn',  args: ['global', 'add', pkg] }
-    default:      return { bin: 'npm',   args: ['i', '-g', pkg, '--prefer-online'] }
+    default: {
+      const args = ['i', '-g']
+      if (options.prefix) args.push('--prefix', options.prefix)
+      args.push(pkg, '--prefer-online')
+      return { bin: options.bin || 'npm', args }
+    }
   }
 }
 
+function shellQuoteArg(arg) {
+  const value = String(arg)
+  if (/^[A-Za-z0-9_./:@+=,-]+$/.test(value)) return value
+  return `'${value.replace(/'/g, "'\\''")}'`
+}
+
+function getCurrentInstallOptions(pm = detectPackageManager()) {
+  const installTarget = pm === 'npm' ? resolveCurrentNpmInstallTarget() : null
+  return pm === 'npm' && installTarget ? {
+    prefix: installTarget.prefix,
+    bin: installTarget.bin,
+  } : {}
+}
+
 /**
  * 📖 getManualInstallCmd: human-readable command string for error / fallback messages.
  * @param {'npm' | 'bun' | 'pnpm' | 'yarn'} pm
  * @param {string} version
+ * @param {{ prefix?: string, bin?: string }} [options]
  * @returns {string}
  */
-export function getManualInstallCmd(pm, version) {
-  const { bin, args } = getInstallArgs(pm, version)
-  return `${bin} ${args.join(' ')}`
+export function getManualInstallCmd(pm, version, options = {}) {
+  const { bin, args } = getInstallArgs(pm, version, options)
+  return [bin, ...args].map(shellQuoteArg).join(' ')
 }
 
 /**
@@ -262,14 +311,16 @@ export async function enforceMandatoryStartupUpdate(config, options = {}) {
     base.allowedOutdated = true
     base.warningMessage = buildOutdatedWarningMessage(latestVersion, failures)
     console.log(chalk.red(`  ${base.warningMessage}`))
-    console.log(chalk.dim(`  Manual update: ${getManualInstallCmd(detectPackageManager(), latestVersion)}`))
+    const pm = detectPackageManager()
+    console.log(chalk.dim(`  Manual update: ${getManualInstallCmd(pm, latestVersion, getCurrentInstallOptions(pm))}`))
     console.log()
     return base
   }
 
   base.blocked = true
   console.log(chalk.red('  ✖ Mandatory update failed. FCM will retry on the next launch.'))
-  console.log(chalk.dim(`  Attempt ${failures}/${UPDATE_FAILURE_THRESHOLD}. Manual update: ${getManualInstallCmd(detectPackageManager(), latestVersion)}`))
+  const pm = detectPackageManager()
+  console.log(chalk.dim(`  Attempt ${failures}/${UPDATE_FAILURE_THRESHOLD}. Manual update: ${getManualInstallCmd(pm, latestVersion, getCurrentInstallOptions(pm))}`))
   console.log()
   return base
 }
@@ -305,9 +356,10 @@ export async function fetchLastReleaseDate() {
  * 📖 Bun installs to ~/.bun/install/global/ (always user-writable) so sudo is never needed.
  * 📖 For npm/pnpm/yarn we probe their global root/prefix paths and check writability.
  * @param {'npm' | 'bun' | 'pnpm' | 'yarn'} pm
+ * @param {{ packageRoot: string, prefix: string, bin: string } | null} [installTarget]
  * @returns {{ needsSudo: boolean, checkedPath: string|null }}
  */
-function detectGlobalInstallPermission(pm) {
+function detectGlobalInstallPermission(pm, installTarget = null) {
   if (pm === 'bun') {
     return { needsSudo: false, checkedPath: null }
   }
@@ -326,13 +378,20 @@ function detectGlobalInstallPermission(pm) {
       if (dir) candidates.push(dir)
     } catch {}
   } else {
+    if (installTarget?.prefix) {
+      candidates.push(join(installTarget.prefix, 'lib', 'node_modules'))
+      candidates.push(installTarget.prefix)
+    }
+
+    const npmBin = installTarget?.bin || 'npm'
+
     try {
-      const npmRoot = execFileSync('npm', ['root', '-g'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+      const npmRoot = execFileSync(npmBin, ['root', '-g'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
       if (npmRoot) candidates.push(npmRoot)
     } catch {}
 
     try {
-      const npmPrefix = execFileSync('npm', ['prefix', '-g'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+      const npmPrefix = execFileSync(npmBin, ['prefix', '-g'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
       if (npmPrefix) candidates.push(npmPrefix)
     } catch {}
   }
@@ -348,6 +407,28 @@ function detectGlobalInstallPermission(pm) {
   return { needsSudo: false, checkedPath: candidates[0] || null }
 }
 
+function readCurrentPackageVersion() {
+  try {
+    const data = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8'))
+    return typeof data.version === 'string' ? data.version : null
+  } catch {
+    return null
+  }
+}
+
+function verifyCurrentInstallUpdated(latestVersion, installTarget) {
+  if (!installTarget) return
+
+  const installedVersion = readCurrentPackageVersion()
+  if (installedVersion === latestVersion) return
+
+  const actual = installedVersion ? `v${installedVersion}` : 'an unknown version'
+  throw new Error(
+    `Update command completed, but the active install at ${installTarget.packageRoot} still reports ${actual}. ` +
+    'The package manager likely installed into another global prefix.'
+  )
+}
+
 /**
  * 📖 hasSudoCommand: lightweight guard so we don't suggest sudo on systems where it does not exist.
  * @returns {boolean}
@@ -402,11 +483,16 @@ function relaunchCurrentProcess() {
  * 📖 installUpdateCommand: run global install using the detected package manager, optionally prefixed with sudo.
  * @param {string} latestVersion
  * @param {boolean} useSudo
+ * @param {{ packageRoot: string, prefix: string, bin: string } | null} [installTarget]
  */
-function installUpdateCommand(latestVersion, useSudo) {
+function installUpdateCommand(latestVersion, useSudo, installTarget = null) {
   const { execFileSync } = require('child_process')
   const pm = detectPackageManager()
-  const { bin, args } = getInstallArgs(pm, latestVersion)
+  const installOptions = pm === 'npm' && installTarget ? {
+    prefix: installTarget.prefix,
+    bin: installTarget.bin,
+  } : {}
+  const { bin, args } = getInstallArgs(pm, latestVersion, installOptions)
 
   if (useSudo) {
     execFileSync('sudo', [bin, ...args], { stdio: 'inherit', shell: false })
@@ -433,7 +519,12 @@ export function runUpdate(latestVersion, options = {}) {
   console.log()
 
   const pm = detectPackageManager()
-  const { needsSudo, checkedPath } = detectGlobalInstallPermission(pm)
+  const installTarget = pm === 'npm' ? resolveCurrentNpmInstallTarget() : null
+  const installOptions = pm === 'npm' && installTarget ? {
+    prefix: installTarget.prefix,
+    bin: installTarget.bin,
+  } : {}
+  const { needsSudo, checkedPath } = detectGlobalInstallPermission(pm, installTarget)
   const sudoAvailable = process.platform !== 'win32' && hasSudoCommand()
   let lastError = null
 
@@ -444,7 +535,8 @@ export function runUpdate(latestVersion, options = {}) {
   }
 
   try {
-    installUpdateCommand(latestVersion, needsSudo && sudoAvailable)
+    installUpdateCommand(latestVersion, needsSudo && sudoAvailable, installTarget)
+    verifyCurrentInstallUpdated(latestVersion, installTarget)
     console.log()
     console.log(chalk.green(`  ✅ Update complete! Version ${latestVersion} installed.`))
     console.log()
@@ -452,13 +544,14 @@ export function runUpdate(latestVersion, options = {}) {
     return { ok: true }
   } catch (err) {
     lastError = err
-    const manualCmd = getManualInstallCmd(pm, latestVersion)
+    const manualCmd = getManualInstallCmd(pm, latestVersion, installOptions)
     console.log()
     if (isPermissionError(err) && !needsSudo && sudoAvailable) {
       console.log(chalk.yellow(`  ⚠ Permission denied during ${pm} global install. Retrying with sudo...`))
       console.log()
       try {
-        installUpdateCommand(latestVersion, true)
+        installUpdateCommand(latestVersion, true, installTarget)
+        verifyCurrentInstallUpdated(latestVersion, installTarget)
         console.log()
         console.log(chalk.green(`  ✅ Update complete with sudo! Version ${latestVersion} installed.`))
         console.log()
@@ -484,5 +577,3 @@ export function runUpdate(latestVersion, options = {}) {
   if (exitOnFailure) process.exit(1)
   return { ok: false, error: lastError }
 }
-
-