free-coding-models 0.5.17 → 0.5.19

package/changelog/v0.5.18.md

@@ -0,0 +1,12 @@
+# Changelog v0.5.18 - 2026-06-09
+
+### Fixed
+- Fixed the mandatory startup updater loop when the active `free-coding-models` binary is installed under one npm prefix but another Node/npm manager shadows `npm` in `PATH`. The updater now detects the npm prefix that owns the currently running package, installs into that exact prefix, and verifies that the active package version changed before relaunching.
+- Improved updater fallback instructions so manual recovery commands include the owning npm binary and `--prefix` target when needed, instead of pointing users at a different global install.
+- Stabilized the router dashboard SSE endpoints so `/api/events` and `/stream/events` flush an initial frame immediately and tests/clients do not hang while waiting for the first broadcast.
+
+### Changed
+- Restored the normal startup update path and live OpenRouter/release-date startup behavior after the temporary local debug bypass used to diagnose the update loop.
+
+### Added
+- Added regression coverage for npm-prefix-aware update command generation so future updater changes do not reintroduce the same cross-prefix loop.

package/changelog/v0.5.19.md

@@ -0,0 +1,25 @@
+# Changelog v0.5.19 - 2026-06-10
+
+### Added
+- **nvidia**: Added `nvidia/nemotron-3-ultra-550b-a55b` (S+, 1M context)
+- **groq**: Added 7 new specialized models:
+  - `whisper-large-v3`, `whisper-large-v3-turbo` (audio transcription)
+  - `canopylabs/orpheus-arabic-saudi`, `canopylabs/orpheus-v1-english` (Arabic/English speech)
+  - `meta-llama/llama-prompt-guard-2-22m`, `meta-llama/llama-prompt-guard-2-86m` (security guardrails)
+  - `openai/gpt-oss-safeguard-20b` (safety)
+
+### Fixed
+- **nvidia**: Corrected context windows for three models:
+  - `deepseek-ai/deepseek-v4-pro`: 128k → 1M
+  - `deepseek-ai/deepseek-v4-flash`: 128k → 1M
+  - `mistralai/mistral-small-4-119b-2603`: 128k → 256k
+- **nvidia**: Removed deprecated model `z-ai/glm5` (replaced by `z-ai/glm-5.1`)
+
+### Changed
+- Model counts: nvidia stable at 27, groq increased from 8 to 15.
+- Total catalog size: 161 models across 16 providers.
+
+### Notes
+- This update reflects the latest provider catalogs as of June 10, 2026.
+- All existing models were verified against official docs; only minor configuration drift was found.
+- The `audit_state.json` was updated with fresh fingerprints.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-coding-models",
-  "version": "0.5.17",
+  "version": "0.5.19",
   "description": "Find the fastest coding LLM models in seconds — ping free models from multiple providers, pick the best one for OpenCode, Cursor, or any AI coding assistant.",
   "keywords": [
     "nvidia",

package/sources.js

@@ -44,19 +44,19 @@ export const nvidiaNim = [
   ['minimaxai/minimax-m2.7',                       'MiniMax M2.7',        'S+', '80.2%', '200k'],
   ['z-ai/glm-5.1',                                 'GLM 5.1',             'S+', '77.8%', '128k'],
   ['moonshotai/kimi-k2.6',                         'Kimi K2.6',           'S+', '76.8%', '256k'],
-  ['deepseek-ai/deepseek-v4-pro',                  'DeepSeek V4 Pro',     'S+', '73.1%', '128k'],
-  ['deepseek-ai/deepseek-v4-flash',                'DeepSeek V4 Flash',   'S+', '72.0%', '128k'],
-  ['z-ai/glm5',                                    'GLM 5',               'S+', '73.8%', '200k'],
+  ['deepseek-ai/deepseek-v4-pro',                  'DeepSeek V4 Pro',     'S+', '73.1%', '1M'],
+  ['deepseek-ai/deepseek-v4-flash',                'DeepSeek V4 Flash',   'S+', '72.0%', '1M'],
   ['stepfun-ai/step-3.5-flash',                    'Step 3.5 Flash',      'S+', '74.4%', '256k'],
   ['stepfun-ai/step-3.7-flash',                    'Step 3.7 Flash',      'S+', '74.4%', '256k'],
   ['qwen/qwen3-coder-480b-a35b-instruct',          'Qwen3 Coder 480B',    'S+', '70.6%', '256k'],
+  ['nvidia/nemotron-3-ultra-550b-a55b', 'Nemotron 3 Ultra', 'S+', '-', '1M'],
   // ── S tier — SWE-bench Verified 60–70% ──
   ['qwen/qwen3-next-80b-a3b-instruct',             'Qwen3 80B Instruct',  'S',  '65.0%', '128k'],
   ['qwen/qwen3.5-397b-a17b',                       'Qwen3.5 400B VLM',    'S',  '68.0%', '128k'],
   ['openai/gpt-oss-120b',                          'GPT OSS 120B',        'S',  '60.0%', '128k'],
   ['meta/llama-4-maverick-17b-128e-instruct',      'Llama 4 Maverick',    'S',  '62.0%', '1M'],
   ['mistralai/mistral-medium-3.5-128b',             'Mistral Medium 3.5',  'S',  '66.0%', '128k'],
-  ['mistralai/mistral-small-4-119b-2603',           'Mistral Small 4',     'S',  '60.0%', '128k'],
+  ['mistralai/mistral-small-4-119b-2603',           'Mistral Small 4',     'S',  '60.0%', '256k'],
   ['qwen/qwen3.5-122b-a10b',                       'Qwen3.5 122B',        'S',  '64.0%', '128k'],
   // ── A+ tier — SWE-bench Verified 50–60% ──
   ['mistralai/mistral-large-3-675b-instruct-2512', 'Mistral Large 675B',  'A+', '58.0%', '256k'],
@@ -80,6 +80,7 @@ export const nvidiaNim = [
   // llama-3.3-70b-instruct (404), mixtral-8x22b-instruct-v0.1 (404),
   // granite-34b-code-instruct (deprecated), llama-4-scout-17b-16e-instruct (deprecated, not in nvidiaNim),
   // llama-3.1-8b-instruct (404) → replaced by llama-3.2-11b-vision-instruct
+  // Removed (2026-06-10): z-ai/glm5 (replaced by z-ai/glm-5.1)
 ]
 
 // 📖 Groq source - https://console.groq.com
@@ -93,6 +94,13 @@ export const groq = [
   ['qwen/qwen3-32b',                       'Qwen3 32B',          'A+', '50.0%', '131k'],
   ['groq/compound',                        'Groq Compound',      'A',  '45.0%', '131k'],
   ['groq/compound-mini',                   'Groq Compound Mini', 'B+', '32.0%', '131k'],
+  ['whisper-large-v3', 'Whisper', 'C', '-', '-'],
+  ['whisper-large-v3-turbo', 'Whisper Large V3 Turbo', 'C', '-', '-'],
+  ['canopylabs/orpheus-arabic-saudi', 'Canopy Labs Orpheus Arabic Saudi', 'C', '-', '4k'],
+  ['canopylabs/orpheus-v1-english', 'Canopy Labs Orpheus V1 English', 'C', '-', '4k'],
+  ['meta-llama/llama-prompt-guard-2-22m', 'Llama Prompt Guard 2 22M', 'C', '-', '512'],
+  ['meta-llama/llama-prompt-guard-2-86m', 'Prompt Guard 2 86M', 'C', '-', '512'],
+  ['openai/gpt-oss-safeguard-20b', 'Safety GPT OSS 20B', 'C', '-', '131k'],
 ]
 
 // 📖 Cerebras source - https://cloud.cerebras.ai

package/src/core/router-daemon.js

@@ -2508,6 +2508,8 @@ class RouterRuntime {
           Connection: 'keep-alive',
           'x-request-id': requestId,
         })
+        res.flushHeaders?.()
+        res.write(': connected\n\n')
         res.write(`event: hello\ndata: ${JSON.stringify(this.statusPayload())}\n\n`)
         this.sseClients.add(res)
         req.on('close', () => this.sseClients.delete(res))
@@ -2643,6 +2645,8 @@ class RouterRuntime {
           'Connection': 'keep-alive',
           'x-request-id': requestId,
         })
+        res.flushHeaders?.()
+        res.write(': connected\n\n')
         res.write(`data: ${JSON.stringify(getWebStatePayload(this))}\n\n`)
         this.sseClients.add(res)
         req.on('close', () => this.sseClients.delete(res))

package/src/core/updater.js

@@ -28,6 +28,7 @@
  *
  * @functions
  *   → detectPackageManager()             — Detect which PM owns the current installation
+ *   → resolveCurrentNpmInstallTarget()   — Detect the npm prefix that owns the active package
  *   → getInstallArgs(pm, version)        — Build correct { bin, args } per package manager
  *   → getManualInstallCmd(pm, version)   — Human-readable install command string for error messages
  *   → checkForUpdateDetailed()           — Fetch npm latest with explicit error info
@@ -36,7 +37,7 @@
  *   → enforceMandatoryStartupUpdate()    — Mandatory startup self-update with two-failure fallback
  *   → runUpdate(latestVersion)           — Install new version via detected PM + relaunch
  * @exports
- *   detectPackageManager, getInstallArgs, getManualInstallCmd,
+ *   detectPackageManager, resolveCurrentNpmInstallTarget, getInstallArgs, getManualInstallCmd,
  *   checkForUpdateDetailed, checkForUpdate, isPackageDevMode,
  *   enforceMandatoryStartupUpdate, runUpdate, fetchLastReleaseDate
  *
@@ -47,15 +48,42 @@ import chalk from 'chalk'
 import { createRequire } from 'module'
 import { fileURLToPath } from 'url'
 import { dirname, join } from 'path'
-import { accessSync, constants, existsSync } from 'fs'
+import { accessSync, constants, existsSync, readFileSync } from 'fs'
 
 const require = createRequire(import.meta.url)
 const readline = require('readline')
 const pkg = require('../../package.json')
 const LOCAL_VERSION = pkg.version
 const PACKAGE_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..')
+const PACKAGE_NAME = 'free-coding-models'
 export const UPDATE_FAILURE_THRESHOLD = 2
 
+/**
+ * 📖 resolveCurrentNpmInstallTarget: detect the npm prefix that owns this exact
+ * 📖 running package, not just the first `npm` found in PATH. Users can run FCM
+ * 📖 from one global install while another Node manager shadows `npm`; updating
+ * 📖 the shadow prefix leaves the active binary stale and creates an update loop.
+ * @param {string} [packageRoot]
+ * @returns {{ packageRoot: string, prefix: string, bin: string } | null}
+ */
+export function resolveCurrentNpmInstallTarget(packageRoot = PACKAGE_ROOT) {
+  const normalizedRoot = String(packageRoot || '').replace(/\\/g, '/')
+  const suffix = `/lib/node_modules/${PACKAGE_NAME}`
+  if (!normalizedRoot.endsWith(suffix)) return null
+
+  const prefix = packageRoot.slice(0, packageRoot.length - suffix.length)
+  if (!prefix) return null
+
+  const npmBinName = process.platform === 'win32' ? 'npm.cmd' : 'npm'
+  const npmBin = join(prefix, 'bin', npmBinName)
+
+  return {
+    packageRoot,
+    prefix,
+    bin: existsSync(npmBin) ? npmBin : 'npm',
+  }
+}
+
 /**
  * 📖 detectPackageManager: figure out which package manager owns the current installation.
  * 📖 Checks import.meta.url (package install path), process.argv[1] (script entry),
@@ -141,27 +169,48 @@ export function buildOutdatedWarningMessage(latestVersion, failures = UPDATE_FAI
  * 📖 Each PM has different syntax for global install — this normalises them.
  * @param {'npm' | 'bun' | 'pnpm' | 'yarn'} pm
  * @param {string} version
+ * @param {{ prefix?: string, bin?: string }} [options]
  * @returns {{ bin: string, args: string[] }}
  */
-export function getInstallArgs(pm, version) {
-  const pkg = `free-coding-models@${version}`
+export function getInstallArgs(pm, version, options = {}) {
+  const pkg = `${PACKAGE_NAME}@${version}`
   switch (pm) {
     case 'bun':   return { bin: 'bun',   args: ['add', '-g', pkg] }
     case 'pnpm':  return { bin: 'pnpm',  args: ['add', '-g', pkg] }
     case 'yarn':  return { bin: 'yarn',  args: ['global', 'add', pkg] }
-    default:      return { bin: 'npm',   args: ['i', '-g', pkg, '--prefer-online'] }
+    default: {
+      const args = ['i', '-g']
+      if (options.prefix) args.push('--prefix', options.prefix)
+      args.push(pkg, '--prefer-online')
+      return { bin: options.bin || 'npm', args }
+    }
   }
 }
 
+function shellQuoteArg(arg) {
+  const value = String(arg)
+  if (/^[A-Za-z0-9_./:@+=,-]+$/.test(value)) return value
+  return `'${value.replace(/'/g, "'\\''")}'`
+}
+
+function getCurrentInstallOptions(pm = detectPackageManager()) {
+  const installTarget = pm === 'npm' ? resolveCurrentNpmInstallTarget() : null
+  return pm === 'npm' && installTarget ? {
+    prefix: installTarget.prefix,
+    bin: installTarget.bin,
+  } : {}
+}
+
 /**
  * 📖 getManualInstallCmd: human-readable command string for error / fallback messages.
  * @param {'npm' | 'bun' | 'pnpm' | 'yarn'} pm
  * @param {string} version
+ * @param {{ prefix?: string, bin?: string }} [options]
  * @returns {string}
  */
-export function getManualInstallCmd(pm, version) {
-  const { bin, args } = getInstallArgs(pm, version)
-  return `${bin} ${args.join(' ')}`
+export function getManualInstallCmd(pm, version, options = {}) {
+  const { bin, args } = getInstallArgs(pm, version, options)
+  return [bin, ...args].map(shellQuoteArg).join(' ')
 }
 
 /**
@@ -262,14 +311,16 @@ export async function enforceMandatoryStartupUpdate(config, options = {}) {
     base.allowedOutdated = true
     base.warningMessage = buildOutdatedWarningMessage(latestVersion, failures)
     console.log(chalk.red(`  ${base.warningMessage}`))
-    console.log(chalk.dim(`  Manual update: ${getManualInstallCmd(detectPackageManager(), latestVersion)}`))
+    const pm = detectPackageManager()
+    console.log(chalk.dim(`  Manual update: ${getManualInstallCmd(pm, latestVersion, getCurrentInstallOptions(pm))}`))
     console.log()
     return base
   }
 
   base.blocked = true
   console.log(chalk.red('  ✖ Mandatory update failed. FCM will retry on the next launch.'))
-  console.log(chalk.dim(`  Attempt ${failures}/${UPDATE_FAILURE_THRESHOLD}. Manual update: ${getManualInstallCmd(detectPackageManager(), latestVersion)}`))
+  const pm = detectPackageManager()
+  console.log(chalk.dim(`  Attempt ${failures}/${UPDATE_FAILURE_THRESHOLD}. Manual update: ${getManualInstallCmd(pm, latestVersion, getCurrentInstallOptions(pm))}`))
   console.log()
   return base
 }
@@ -305,9 +356,10 @@ export async function fetchLastReleaseDate() {
  * 📖 Bun installs to ~/.bun/install/global/ (always user-writable) so sudo is never needed.
  * 📖 For npm/pnpm/yarn we probe their global root/prefix paths and check writability.
  * @param {'npm' | 'bun' | 'pnpm' | 'yarn'} pm
+ * @param {{ packageRoot: string, prefix: string, bin: string } | null} [installTarget]
  * @returns {{ needsSudo: boolean, checkedPath: string|null }}
  */
-function detectGlobalInstallPermission(pm) {
+function detectGlobalInstallPermission(pm, installTarget = null) {
   if (pm === 'bun') {
     return { needsSudo: false, checkedPath: null }
   }
@@ -326,13 +378,20 @@ function detectGlobalInstallPermission(pm) {
       if (dir) candidates.push(dir)
     } catch {}
   } else {
+    if (installTarget?.prefix) {
+      candidates.push(join(installTarget.prefix, 'lib', 'node_modules'))
+      candidates.push(installTarget.prefix)
+    }
+
+    const npmBin = installTarget?.bin || 'npm'
+
     try {
-      const npmRoot = execFileSync('npm', ['root', '-g'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+      const npmRoot = execFileSync(npmBin, ['root', '-g'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
       if (npmRoot) candidates.push(npmRoot)
     } catch {}
 
     try {
-      const npmPrefix = execFileSync('npm', ['prefix', '-g'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+      const npmPrefix = execFileSync(npmBin, ['prefix', '-g'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
       if (npmPrefix) candidates.push(npmPrefix)
     } catch {}
   }
@@ -348,6 +407,28 @@ function detectGlobalInstallPermission(pm) {
   return { needsSudo: false, checkedPath: candidates[0] || null }
 }
 
+function readCurrentPackageVersion() {
+  try {
+    const data = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8'))
+    return typeof data.version === 'string' ? data.version : null
+  } catch {
+    return null
+  }
+}
+
+function verifyCurrentInstallUpdated(latestVersion, installTarget) {
+  if (!installTarget) return
+
+  const installedVersion = readCurrentPackageVersion()
+  if (installedVersion === latestVersion) return
+
+  const actual = installedVersion ? `v${installedVersion}` : 'an unknown version'
+  throw new Error(
+    `Update command completed, but the active install at ${installTarget.packageRoot} still reports ${actual}. ` +
+    'The package manager likely installed into another global prefix.'
+  )
+}
+
 /**
  * 📖 hasSudoCommand: lightweight guard so we don't suggest sudo on systems where it does not exist.
  * @returns {boolean}
@@ -402,11 +483,16 @@ function relaunchCurrentProcess() {
  * 📖 installUpdateCommand: run global install using the detected package manager, optionally prefixed with sudo.
  * @param {string} latestVersion
  * @param {boolean} useSudo
+ * @param {{ packageRoot: string, prefix: string, bin: string } | null} [installTarget]
  */
-function installUpdateCommand(latestVersion, useSudo) {
+function installUpdateCommand(latestVersion, useSudo, installTarget = null) {
   const { execFileSync } = require('child_process')
   const pm = detectPackageManager()
-  const { bin, args } = getInstallArgs(pm, latestVersion)
+  const installOptions = pm === 'npm' && installTarget ? {
+    prefix: installTarget.prefix,
+    bin: installTarget.bin,
+  } : {}
+  const { bin, args } = getInstallArgs(pm, latestVersion, installOptions)
 
   if (useSudo) {
     execFileSync('sudo', [bin, ...args], { stdio: 'inherit', shell: false })
@@ -433,7 +519,12 @@ export function runUpdate(latestVersion, options = {}) {
   console.log()
 
   const pm = detectPackageManager()
-  const { needsSudo, checkedPath } = detectGlobalInstallPermission(pm)
+  const installTarget = pm === 'npm' ? resolveCurrentNpmInstallTarget() : null
+  const installOptions = pm === 'npm' && installTarget ? {
+    prefix: installTarget.prefix,
+    bin: installTarget.bin,
+  } : {}
+  const { needsSudo, checkedPath } = detectGlobalInstallPermission(pm, installTarget)
   const sudoAvailable = process.platform !== 'win32' && hasSudoCommand()
   let lastError = null
 
@@ -444,7 +535,8 @@ export function runUpdate(latestVersion, options = {}) {
   }
 
   try {
-    installUpdateCommand(latestVersion, needsSudo && sudoAvailable)
+    installUpdateCommand(latestVersion, needsSudo && sudoAvailable, installTarget)
+    verifyCurrentInstallUpdated(latestVersion, installTarget)
     console.log()
     console.log(chalk.green(`  ✅ Update complete! Version ${latestVersion} installed.`))
     console.log()
@@ -452,13 +544,14 @@ export function runUpdate(latestVersion, options = {}) {
     return { ok: true }
   } catch (err) {
     lastError = err
-    const manualCmd = getManualInstallCmd(pm, latestVersion)
+    const manualCmd = getManualInstallCmd(pm, latestVersion, installOptions)
     console.log()
     if (isPermissionError(err) && !needsSudo && sudoAvailable) {
       console.log(chalk.yellow(`  ⚠ Permission denied during ${pm} global install. Retrying with sudo...`))
       console.log()
       try {
-        installUpdateCommand(latestVersion, true)
+        installUpdateCommand(latestVersion, true, installTarget)
+        verifyCurrentInstallUpdated(latestVersion, installTarget)
         console.log()
         console.log(chalk.green(`  ✅ Update complete with sudo! Version ${latestVersion} installed.`))
         console.log()
@@ -484,5 +577,3 @@ export function runUpdate(latestVersion, options = {}) {
   if (exitOnFailure) process.exit(1)
   return { ok: false, error: lastError }
 }
-
-