free-coding-models 0.5.50 → 0.5.51

package/README.md

@@ -809,6 +809,7 @@ Telemetry is enabled by default and can be disabled with any of the following:
     <td align="center" width="120"><a href="https://github.com/serajbaltu"><img src="https://avatars.githubusercontent.com/u/90699173?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="serajbaltu"></a></td>
     <td align="center" width="120"><a href="https://github.com/stgreenb"><img src="https://avatars.githubusercontent.com/u/18483964?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="stgreenb"></a></td>
     <td align="center" width="120"><a href="https://github.com/MoriDanWork"><img src="https://avatars.githubusercontent.com/u/55363096?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="MoriDanWork"></a></td>
+    <td align="center" width="120"><a href="https://github.com/fan92rus"><img src="https://avatars.githubusercontent.com/u/13201333?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="fan92rus"></a></td>
   </tr>
   <tr>
     <td align="center"><a href="https://github.com/vava-nessa"><sub><b>vava-nessa</b></sub></a></td>
@@ -820,6 +821,10 @@ Telemetry is enabled by default and can be disabled with any of the following:
     <td align="center"><a href="https://github.com/serajbaltu"><sub><b>serajbaltu</b></sub></a></td>
     <td align="center"><a href="https://github.com/stgreenb"><sub><b>stgreenb</b></sub></a></td>
     <td align="center"><a href="https://github.com/MoriDanWork"><sub><b>MoriDanWork</b></sub></a></td>
+    <td align="center"><a href="https://github.com/fan92rus"><sub><b>fan92rus</b></sub></a></td>
+  </tr>
+  <tr>
+    <td align="center" colspan="10"><sub>🛡️ <b>fan92rus</b> — Windows path traversal fix (<code>path.sep</code>)</sub></td>
   </tr>
 </table>
 

package/changelog/v0.5.51.md

@@ -0,0 +1,15 @@
+# Changelog v0.5.51 - 2026-07-25
+
+### Fixed
+- 🛡️ **Windows path traversal protection** — `serveWebStaticFile()` in `src/core/router-daemon.js` now uses `path.sep` instead of a hardcoded `/` for the path traversal guard. On Windows, `path.resolve()` returns backslash separators, which made the previous `candidate.startsWith(WEB_DIST_DIR + '/')` check always fail and serve `path_traversal_blocked` for every root request. On Linux/macOS, `path.sep === '/'` so behaviour is unchanged. *(Thanks @fan92rus! First contribution 🎉)*
+
+### Changed
+- 📦 **Deps:** bump `@tanstack/react-virtual` from `3.14.3` → `3.14.5`
+- 📦 **DevDeps:** bump `@vitejs/plugin-react` from `6.0.2` → `6.0.3`
+
+### Maintenance
+- 🧹 **kandown housekeeping:** drop stale `AGENT.md` / `AGENT_KANDOWN.md` copies, repair install, refresh agent ref
+- 🧹 **fcm-agent fixes:** `direct-scanner.js`, `ranker.js`, `scan-orchestrator.js`, `pi-progress-renderer.js`, and `extensions/index.js` refinements (312+/46-)
+
+### Contributors
+- **@fan92rus** — Windows path traversal fix (`path.sep`). Welcome aboard! 🛡️🎉

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-coding-models",
-  "version": "0.5.50",
+  "version": "0.5.51",
   "description": "Find the fastest coding LLM models in seconds — ping free models from multiple providers, pick the best one for OpenCode, Cursor, or any AI coding assistant.",
   "keywords": [
     "nvidia",

package/src/core/router-daemon.js

@@ -31,7 +31,7 @@
 
 import { createServer } from 'node:http'
 import { existsSync, readFileSync } from 'node:fs'
-import { dirname, join, resolve as resolvePath } from 'node:path'
+import { dirname, join, resolve as resolvePath, sep as pathSep } from 'node:path'
 import { fork } from 'node:child_process'
 import { randomUUID } from 'node:crypto'
 import { appendFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs'
@@ -434,7 +434,7 @@ function serveWebStaticFile(res, pathname, requestId) {
   // 📖 Without this, `pathname` like `/../../etc/passwd` escapes the dist root.
   const requested = pathname === '/' ? 'index.html' : pathname.replace(/^\/+/, '')
   const candidate = resolvePath(WEB_DIST_DIR, requested)
-  if (candidate !== WEB_DIST_DIR && !candidate.startsWith(WEB_DIST_DIR + '/')) {
+  if (candidate !== WEB_DIST_DIR && !candidate.startsWith(WEB_DIST_DIR + pathSep)) {
     sendError(res, 403, 'Forbidden', 'invalid_request_error', 'path_traversal_blocked', requestId)
     return
   }
@@ -454,7 +454,7 @@ function serveWebStaticFile(res, pathname, requestId) {
 
   if (stats.isDirectory()) {
     const dirIndex = resolvePath(candidate, 'index.html')
-    if (dirIndex.startsWith(WEB_DIST_DIR + '/') && existsSync(dirIndex)) {
+    if (dirIndex.startsWith(WEB_DIST_DIR + pathSep) && existsSync(dirIndex)) {
       serveStaticFromDist(res, dirIndex)
       return
     }