free-coding-models 0.5.80 → 0.5.83

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <strong>Find the fastest free coding model in seconds</strong><br>
-  Track ~222 models across 20 trusted free or free-limited AI providers in real time, then install the one you pick straight into your favorite coding tool.<br><br>
+  Track a large catalog of free coding models from 20+ trusted AI providers in real time, then install the one you pick straight into your favorite coding tool.<br><br>
   <strong>Works with:</strong> OpenCode CLI / Desktop / WebUI, OpenClaw, Crush, Goose, Aider, Kilo CLI, Qwen Code, OpenHands, Amp, Hermes, Continue, Cline, Xcode, Pi, ZCode, ForgeCode, Copilot and more.<br><br>
   <strong>Use Kimi K2, DeepSeek V3/V4, GPT-OSS, Qwen3, MiniMax M3, GLM, Llama 4, Gemma 4, Devstral and more — for free</strong>
 </p>
@@ -15,8 +15,8 @@
   <img src="https://img.shields.io/npm/v/free-coding-models?color=3d6b00&label=npm&logo=npm" alt="npm version" width="200"><br>
   <img src="https://img.shields.io/node/v/free-coding-models?color=3d6b00&logo=node.js" alt="node version" width="200"><br>
   <img src="https://img.shields.io/npm/l/free-coding-models?color=3d6b00" alt="license" width="200"><br>
-  <img src="https://img.shields.io/badge/models-222-3d6b00?logo=nvidia" alt="models count" width="200"><br>
-  <img src="https://img.shields.io/badge/providers-20-1a56db" alt="providers count" width="200">
+  <img src="https://img.shields.io/badge/models-large%20catalog-3d6b00?logo=nvidia" alt="models count" width="200"><br>
+  <img src="https://img.shields.io/badge/providers-20%2B-1a56db" alt="providers count" width="200">
 </p>
 
 ```bash
@@ -25,7 +25,7 @@ free-coding-models
 ```
 
 <p align="center">
-  <sub>Then create a free account on one of the <a href="#-free-ai-providers">20 providers</a> to grab an API key.</sub>
+  <sub>Then create a free account on one of the <a href="#-free-ai-providers">many providers</a> to grab an API key.</sub>
 </p>
 
 <p align="center">
@@ -60,7 +60,7 @@ free-coding-models
 
 ## 💡 Why this tool?
 
-There are **~222 cataloged free or free-limited coding models** across 20 vetted providers. Which one is fastest *right now*? Which one is actually stable, versus just lucky on the last ping?
+There is a large catalog of free and free-limited coding models from 20+ vetted providers. Which one is fastest *right now*? Which one is actually stable, versus just lucky on the last ping?
 
 `free-coding-models` (FCM) answers that by pinging every model in parallel, showing live latency, and computing a **live Stability Score (0–100)**. Average latency alone is misleading — a model that randomly spikes to 6 seconds isn't reliable. The stability score combines **p95 latency** (30%), **jitter/variance** (30%), **spike rate** (20%), and **uptime** (20%) to measure true reliability.
 
@@ -94,7 +94,7 @@ Requires **Node.js 18+**. That's the only prerequisite — FCM has a single runt
 
 ### ② Grab one free API key
 
-FCM tracks ~222 models across 20 providers, but you only need **one key** to start. The fastest sign-ups (no credit card, instant key):
+FCM tracks a large catalog of models from 20+ providers, but you only need **one key** to start. The fastest sign-ups (no credit card, instant key):
 
 - **Groq** → [console.groq.com/keys](https://console.groq.com/keys) — Llama 4, GPT-OSS, blazing fast
 - **Cerebras** → [cloud.cerebras.ai](https://cloud.cerebras.ai) — the lowest latency in the whole catalog
@@ -165,30 +165,36 @@ Once the TUI feels familiar, FCM has three more surfaces — pick the one that m
 
 ## 🟢 Free AI Providers
 
-**~222 coding models** across 20 active providers, ranked by practical free-tier usefulness. Sign up on any one of them to get a key — you only need one to start.
+A large catalog of coding models from 20+ active providers, ranked by practical free-tier usefulness. Sign up on any one of them to get a key — you only need one to start.
 
 | # | Provider | Models | Tier range | Free tier | Env var |
 |---|----------|--------|-----------|-----------|--------|
-| 1 | [NVIDIA NIM](https://build.nvidia.com) | 27 | S+ → C | ~40 RPM (no credit card) | `NVIDIA_API_KEY` |
-| 2 | [Groq](https://console.groq.com/keys) | 8 | S → B | 30 RPM, 1K‑14.4K req/day (no credit card) | `GROQ_API_KEY` |
+| 1 | [NVIDIA NIM](https://build.nvidia.com) | 25 | S+ → C | ~40 RPM (no credit card) | `NVIDIA_API_KEY` |
+| 2 | [Groq](https://console.groq.com/keys) | 5 | S → B | 30 RPM, 1K‑14.4K req/day (no credit card) | `GROQ_API_KEY` |
 | 3 | [Cerebras](https://cloud.cerebras.ai) | 2 | S+ → S | 30 RPM, 1M tokens/day (no credit card) | `CEREBRAS_API_KEY` |
-| 4 | [Google AI Studio](https://aistudio.google.com/apikey) | 7 | S+ → A | Gemini free quotas vary by model/region | `GOOGLE_API_KEY` |
-| 5 | [GitHub Models](https://models.github.ai) | 15 | S+ → C | Quota depends on GitHub/Copilot tier | `GITHUB_TOKEN` |
-| 6 | [Mistral La Plateforme](https://console.mistral.ai/api-keys) | 5 | S+ → A | Experiment plan, free evaluation tier | `MISTRAL_API_KEY` |
-| 7 | [Cloudflare Workers AI](https://dash.cloudflare.com) | 16 | S+ → B | 10K neurons/day, 300 RPM (no credit card) | `CLOUDFLARE_API_TOKEN` + `CLOUDFLARE_ACCOUNT_ID` |
-| 8 | [OpenRouter](https://openrouter.ai/keys) | 24 | S+ → C | 50 req/day free, 1K/day with $10 spend | `OPENROUTER_API_KEY` |
-| 9 | [SambaNova](https://cloud.sambanova.ai/apis) | 7 | S+ → B+ | Small developer quota, useful for light usage | `SAMBANOVA_API_KEY` |
-| 10 | [OVHcloud AI Endpoints](https://endpoints.ai.cloud.ovh.net) | 10 | S → B | 2 req/min/IP free, 400 RPM with key | `OVH_AI_ENDPOINTS_ACCESS_TOKEN` |
-| 11 | [Codestral](https://console.mistral.ai/api-keys) | 1 | B+ | 30 RPM, 2K req/day | `MISTRAL_API_KEY` |
-| 12 | [ZAI](https://z.ai) | 2 | S | Free Flash models only | `ZAI_API_KEY` |
-| 13 | [Scaleway](https://console.scaleway.com/iam/api-keys) | 10 | S+ → B | 1M free tokens | `SCALEWAY_API_KEY` |
-| 14 | [Alibaba DashScope](https://modelstudio.console.alibabacloud.com) | 11 | S+ → A+ | 1M free tokens/model, Singapore, 90 days | `DASHSCOPE_API_KEY` |
-| 15 | [OpenCode Zen](https://opencode.ai/zen) | 5 | S+ → A | Free with OpenCode account | Zen models ✨ |
-| 16 | [Kilo](https://kilo.ai) | 1 | A+ | Free auto-router works without a key | optional `KILO_API_KEY` |
-| 17 | [LLM7](https://llm7.io) | 4 | S+ → B+ | Shared free tier, optional free token | optional `LLM7_API_KEY` |
-| 18 | [Routeway](https://routeway.ai) | 15 | S+ → C | Explicit `:free` zero-price models | `ROUTEWAY_API_KEY` |
-| 19 | [Novita AI](https://novita.ai) | 4 | S+ → S | Only zero-price live chat models included | `NOVITA_API_KEY` |
-| 20 | [Ollama Cloud](https://ollama.com/pricing) | 17 | S+ → A | Free cloud usage with session/weekly limits | `OLLAMA_API_KEY` |
+| 4 | [Google AI Studio](https://aistudio.google.com/apikey) | 10 | S+ → A | Gemini free quotas vary by model/region | `GOOGLE_API_KEY` |
+| 5 | [Mistral La Plateforme](https://console.mistral.ai/api-keys) | 6 | S+ → A | Experiment plan, free evaluation tier | `MISTRAL_API_KEY` |
+| 6 | [Cloudflare Workers AI](https://dash.cloudflare.com) | 19 | S+ → B | 10K neurons/day, 300 RPM (no credit card) | `CLOUDFLARE_API_TOKEN` + `CLOUDFLARE_ACCOUNT_ID` |
+| 7 | [OpenRouter](https://openrouter.ai/keys) | 14 | S+ → C | 50 req/day free, 1K/day with $10 spend | `OPENROUTER_API_KEY` |
+| 8 | [SambaNova](https://cloud.sambanova.ai/apis) | 6 | S+ → B+ | Small developer quota, useful for light usage | `SAMBANOVA_API_KEY` |
+| 9 | [OVHcloud AI Endpoints](https://endpoints.ai.cloud.ovh.net) | 10 | S → B | 2 req/min/IP free, 400 RPM with key | `OVH_AI_ENDPOINTS_ACCESS_TOKEN` |
+| 10 | [Codestral](https://console.mistral.ai/api-keys) | 1 | B+ | 30 RPM, 2K req/day | `MISTRAL_API_KEY` |
+| 11 | [ZAI](https://z.ai) | 7 | S | Free Flash models only | `ZAI_API_KEY` |
+| 12 | [Scaleway](https://console.scaleway.com/iam/api-keys) | 15 | S+ → B | 1M free tokens | `SCALEWAY_API_KEY` |
+| 13 | [Alibaba DashScope](https://modelstudio.console.alibabacloud.com) | 23 | S+ → A+ | 1M free tokens/model, Singapore, 90 days | `DASHSCOPE_API_KEY` |
+| 14 | [OpenCode Zen](https://opencode.ai/zen) | 7 | S+ → B+ | Free with OpenCode account | Zen models ✨ |
+| 15 | [Kilo](https://kilo.ai) | 2 | A+ | Free auto-router works without a key | optional `KILO_API_KEY` |
+| 16 | [LLM7](https://llm7.io) | 4 | S+ → A- | Shared free tier, optional free token | optional `LLM7_API_KEY` |
+| 17 | [Routeway](https://routeway.ai) | 10 | S+ → C | Explicit `:free` zero-price models | `ROUTEWAY_API_KEY` |
+| 18 | [Novita AI](https://novita.ai) | 0 | - | No zero-price models currently | `NOVITA_API_KEY` |
+| 19 | [Ollama Cloud](https://ollama.com/pricing) | 17 | S+ → A | Free cloud usage with session/weekly limits | `OLLAMA_API_KEY` |
+| 20 | [Pollinations AI](https://enter.pollinations.ai) ⚠️ experimental | 10 | S+ → B+ | Daily Pollen grants, free tier via Pollen (see note below) | `POLLINATIONS_API_KEY` |
+| 21 | [SiliconFlow](https://cloud.siliconflow.cn/account/ak) | 3 | A → B+ | 3 models @ $0, 1000 RPM (phone SMS required) | `SILICONFLOW_API_KEY` |
+| 22 | [Requesty](https://app.requesty.ai/api-keys) | 12 | S+ → C | 200 req/day free, no card (4x OpenRouter) | `REQUESTY_API_KEY` |
+| 23 | [OrcaRouter](https://www.orcarouter.ai) | 3 | S+ → A+ | Free Hacker tier · 3 $-0 models, zero token markup | `ORCAROUTER_API_KEY` |
+
+> **Pollinations Pollen, c'est quoi ?** Pollinations ne facture pas en $ mais en **Pollen** (≈ $1). Pas besoin d'acheter : tu recois du Pollen **gratuit chaque jour** selon ton tier seed/flower/nectar via quests (star le repo `pollinations/pollinations` sur GitHub, aider sur un issue). Si ton solde affiche `0.0000` sur `enter.pollinations.ai`, tout `MISS` (prompt non cache) retourne `402 PAYMENT_REQUIRED` ("Insufficient balance ~0.0001 pollen") et le ping affichera `402`. Un `HIT` Cloudflare cache peut encore passer en `200` meme avec 0 Pollen mais ce n'est pas fiable. Verifie ton solde sur `enter.pollinations.ai` -> API Keys, complete une quest et attends le grant quotidien a minuit UTC. **Note : integration Pollinations encore experimentale et non confirmee comme stable, le systeme Pollen peut changer.**
+> **SiliconFlow & Requesty** : integrations verifiees le 2026-08-24 via `/v1/models` live et docs officielles, free tiers recurrents confirmes sans Pollen.
 
 > 💡 One key is enough to start. Add more at any time by pressing **`P`** inside the TUI (or via the Web Dashboard **Settings** page). A few providers (`Kilo`, `LLM7`, OVHcloud sandbox) can even answer without a key, with tighter shared limits.
 
@@ -231,7 +237,7 @@ To protect you, FCM:
 
 The TUI is the heart of FCM. Launch it with `free-coding-models` and you get a live, sortable table of every model — real latency, stability, verdict, and a one-key launch into your coding tool.
 
-<p align="center"><video src="website/public/videos/tui-first-launch.mp4" alt="First launch — ~222 models ping in parallel" autoplay muted loop playsinline width="100%"></video></p>
+<p align="center"><video src="website/public/videos/tui-first-launch.mp4" alt="First launch — many models ping in parallel" autoplay muted loop playsinline width="100%"></video></p>
 
 ### First-run flow
 
@@ -289,6 +295,9 @@ Press **`G`** to cycle **Auto → Dark → Light**. Recolors the full interface
 | **`;`** | Open the **Playground** chat overlay (chat with the FCM router) |
 | **`Ctrl+A`** | Run an AI Speed Test for the selected model |
 | **`Ctrl+U`** | Run the Global AI Speed Test (real provider requests) |
+| **`Shift+P`** | Re-probe failed rows only (auth fail / 429 / 404 / timeout) - no whole-list rescan |
+| **`Ctrl+Shift+P`** | Probe all configured models (404/410 check, auto-hides broken ones) |
+| **`Space`** | Expand the selected row: 2-line detail with provider, endpoint URL and the full model ID (press again or move the cursor to collapse) |
 | `R/S/C/M/O/L/A/H/V/B/U` | Sort by Rank / SWE / ContexT / Model / Origin / Last ping / Avg ping / Health / Verdict / staBility / Uptime |
 | `W` | Sort by real-world score (`Real` column — see [Runtime telemetry](#-runtime-telemetry-real-world-scores)) |
 | `Shift+W` | Open the Runtime Report overlay (per-model breakdown + recent calls) |
@@ -408,6 +417,7 @@ services:
       FREE_CODING_MODELS_TELEMETRY: "0"
       FCM_HOST: "0.0.0.0"
       OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
+      ORCAROUTER_API_KEY: ${ORCAROUTER_API_KEY:-}
     volumes:
       - fcm-data:/home/fcm
 volumes:
@@ -674,6 +684,7 @@ Flags combine freely in any order. Run `free-coding-models --help` to print the
 | `--check-drift` | Diff `sources.js` against `models.dev`; exit 1 on mismatch |
 | `--no-telemetry` | Disable anonymous telemetry for this run |
 | `--config-dir <dir>` | Store `config.json` + `backups/` in `<dir>` (e.g. `--config-dir ~/.config/free-coding-models`) |
+| `--fix-permissions` / `--yes` / `-y` | Auto-fix insecure config file permissions (chmod 600) without prompting; never asked on piped stdin, daemon, web, or `--json` runs |
 
 **Tool launchers** — start the TUI pre-configured for a tool, then `Enter` writes the model into that tool's config and launches it:
 
@@ -761,7 +772,7 @@ Every routed request through the daemon feeds a persistent per-model telemetry f
 
 ### Features at a glance
 
-- **Parallel pings** — all ~222 models tested simultaneously via native `fetch`
+- **Parallel pings** — all models tested simultaneously via native `fetch`
 - **AI benchmark columns** — `Ctrl+A` / `Ctrl+U` split into AI Latency + TPS; optional Startup AI Speed Scan
 - **Adaptive monitoring** — 2s burst for 60s → 10s normal → 30s idle
 - **Stability score** — composite 0–100 (p95, jitter, spike rate, uptime)
@@ -801,7 +812,7 @@ A: Yes — see [`sources.js`](./sources.js) for the model catalog format.
 
 ## ⚖️ Model Licensing & Commercial Use
 
-**Short answer:** the ~222 cataloged models are API/CLI-served models where generated-output ownership is generally granted by the provider/model terms. **You own the generated output** — code, text, or otherwise — and can use it commercially. The licenses below govern the *model weights themselves*, not your generated content.
+**Short answer:** the cataloged models are API/CLI-served where generated-output ownership is generally granted by the provider/model terms. **You own the generated output** — code, text, or otherwise — and can use it commercially. The licenses below govern the *model weights themselves*, not your generated content.
 
 | License | Models | Commercial Output |
 |---------|--------|:-----------------:|
@@ -897,6 +908,8 @@ A: Yes — see [`sources.js`](./sources.js) for the model catalog format.
     <td align="center" width="120"><a href="https://github.com/Muhammad95959"><img src="https://avatars.githubusercontent.com/u/75130655?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="Muhammad95959"></a></td>
     <td align="center" width="120"><a href="https://github.com/FaintFlower"><img src="https://avatars.githubusercontent.com/u/310248465?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="FaintFlower"></a></td>
     <td align="center" width="120"><a href="https://github.com/lehneres"><img src="https://avatars.githubusercontent.com/u/7437288?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="lehneres"></a></td>
+    <td align="center" width="120"><a href="https://github.com/ia-S-on"><img src="https://avatars.githubusercontent.com/u/200600946?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="ia-S-on"></a></td>
+    <td align="center" width="120"><a href="https://github.com/bangla24bdrang-lab"><img src="https://avatars.githubusercontent.com/u/321290409?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="bangla24bdrang-lab"></a></td>
   </tr>
   <tr>
     <td align="center"><a href="https://github.com/vava-nessa"><sub><b>vava-nessa</b></sub></a></td>
@@ -912,18 +925,26 @@ A: Yes — see [`sources.js`](./sources.js) for the model catalog format.
     <td align="center"><a href="https://github.com/Muhammad95959"><sub><b>Muhammad95959</b></sub></a></td>
     <td align="center"><a href="https://github.com/FaintFlower"><sub><b>FaintFlower</b></sub></a></td>
     <td align="center"><a href="https://github.com/lehneres"><sub><b>lehneres</b></sub></a></td>
+    <td align="center"><a href="https://github.com/ia-S-on"><sub><b>ia-S-on</b></sub></a></td>
+    <td align="center"><a href="https://github.com/bangla24bdrang-lab"><sub><b>bangla24bdrang-lab</b></sub></a></td>
   </tr>
   <tr>
-    <td align="center" colspan="13"><sub>🛡️ <b>fan92rus</b> — Windows path traversal fix (<code>path.sep</code>)</sub></td>
+    <td align="center" colspan="15"><sub>🛡️ <b>fan92rus</b> — Windows path traversal fix (<code>path.sep</code>)</sub></td>
   </tr>
   <tr>
-    <td align="center" colspan="13"><sub>📁 <b>Muhammad95959</b> — <code>--config-dir</code> flag & XDG support</sub></td>
+    <td align="center" colspan="15"><sub>📁 <b>Muhammad95959</b> — <code>--config-dir</code> flag & XDG support</sub></td>
   </tr>
   <tr>
-    <td align="center" colspan="13"><sub>⭐ <b>FaintFlower</b> — Star History chart mirror fix</sub></td>
+    <td align="center" colspan="15"><sub>⭐ <b>FaintFlower</b> — Star History chart mirror fix</sub></td>
   </tr>
   <tr>
-    <td align="center" colspan="13"><sub>🚀 <b>lehneres</b> — Proxmox VE installation scripts</sub></td>
+    <td align="center" colspan="15"><sub>🚀 <b>lehneres</b> — Proxmox VE installation scripts</sub></td>
+  </tr>
+  <tr>
+    <td align="center" colspan="15"><sub>🌩️ <b>ia-S-on</b> — Cloudflare <code>{account_id}</code> env resolution in launch paths</sub></td>
+  </tr>
+  <tr>
+    <td align="center" colspan="15"><sub>🐬 <b>bangla24bdrang-lab</b> — OrcaRouter provider integration</sub></td>
   </tr>
 </table>
 
@@ -964,8 +985,9 @@ Curated resources kept **outside** the active CLI catalog — IDE extensions, co
 
 | Provider | Free limits | Notable models |
 |----------|-------------|----------------|
+| [OrcaRouter](https://www.orcarouter.ai) | Free Hacker tier, zero token markup, 3 API keys | DeepSeek V4 Flash (Free), Tencent Hy3 (Free), Qwen3.8 27B (Free) |
 | [OpenRouter](https://openrouter.ai/keys) | 50 req/day, 1K/day with $10 purchase | Qwen3-Coder, Tencent HY3, Laguna, Gemma 4 |
-| [Google AI Studio](https://aistudio.google.com/apikey) | Varies by Gemini model and region | Gemini 3.1 Pro Preview, Gemini 2.5 Flash |
+| [Google AI Studio](https://aistudio.google.com/apikey) | Varies by Gemini model and region | Gemini 3.8 Flash, Gemini 2.5 Pro |
 | [NVIDIA NIM](https://build.nvidia.com) | ~40 RPM | MiniMax M2.7, GLM 5.1, Kimi K2.6 |
 | [GitHub Models](https://models.github.ai) | Depends on GitHub/Copilot tier | GPT-4.1, DeepSeek V3, Llama 4 |
 | [Groq](https://console.groq.com/keys) | 1K–14.4K req/day (model-dependent) | Llama 3.3 70B, Llama 4 Scout, GPT-OSS |

package/bin/free-coding-models.js

@@ -37,6 +37,7 @@ import { ensureFavoritesConfig } from '../src/core/favorites.js';
 import { buildCliHelpText } from '../src/tui/cli-help.js';
 import { ALT_LEAVE } from '../src/core/constants.js';
 import { enforceMandatoryStartupUpdate, isPackageDevMode } from '../src/core/updater.js';
+import { checkConfigSecurity } from '../src/core/security.js';
 import { runApp } from '../src/tui/app.js';
 
 // Global error handlers to ensure terminal is restored if something crashes catastrophically
@@ -155,6 +156,25 @@ async function main() {
     } catch {}
   }
 
+  // 📖 Config security check (issue #173): the insecure-permission warning and its
+  // 📖 "Fix permissions automatically?" prompt must fully resolve BEFORE any surface
+  // 📖 takes over the terminal. It used to run un-awaited inside runApp, so the TUI
+  // 📖 covered the prompt (invisible on Windows) and the app looked frozen.
+  // 📖 Daemon / web dashboard / JSON surfaces pass promptAllowed=false so at most a
+  // 📖 warning + manual hint goes to stderr, and the daemon can never hang on a prompt.
+  // 📖 --fix-permissions / --yes / -y auto-applies chmod 600 (best-effort on Windows).
+  const promptAllowed = !cliArgs.webMode
+    && !cliArgs.jsonMode
+    && !cliArgs.daemonMode
+    && !cliArgs.daemonBackgroundMode
+    && !cliArgs.daemonStopMode
+    && !cliArgs.daemonStatusMode;
+  try {
+    await checkConfigSecurity({ autoFix: cliArgs.fixPermissionsMode, promptAllowed });
+  } catch {
+    // 📖 A security-check failure must never block the app from starting.
+  }
+
   // 📖 Standalone web dashboard: same full-catalog ping UI as the TUI, served
   // 📖 locally with Socket.IO/SSE/REST realtime updates.
   if (cliArgs.webMode) {

package/changelog/v0.5.81.md

@@ -0,0 +1,25 @@
+# Changelog v0.5.81 - 2026-08-24
+
+### Added
+- **3 new free recurring providers** (total 22 providers, ~207 models)
+  - **Pollinations AI** — 10 models `gen.pollinations.ai/v1` : `laguna`, `minimax-m2.7`, `qwen-coder`, `deepseek`, `kimi-code`, `openai`, `gemma-4-31b`, `gpt-oss`, `qwen3.7-flash`, `nemotron-3.5-lightning` — free via daily Pollen grants (Quest 3.25) , ⚠️ experimental integration not yet confirmed stable (Pollen system may change, `MISS` = 402 when balance 0, `HIT` cache may still 200)
+  - **SiliconFlow** — 3 models `api.siliconflow.cn/v1` : `THUDM/GLM-Z1-9B-0414`, `Qwen/Qwen3-8B`, `deepseek-ai/DeepSeek-R1-Distill-Qwen-7B` — 3 models @ $0 forever, 1000 RPM, phone SMS required, verified 2026-08-24 via pricing page
+  - **Requesty** — 12 models `router.requesty.ai/v1` : `nvidia/nemotron-3-ultra-550b-a55b`, `poolside/laguna-xs.2`, `nvidia/nemotron-3-super`, `poolside/laguna-m.1`, `google/gemma-4-31b-it`, `nvidia/nemotron-3-nano-omni`, `nvidia/nemotron-3-nano`, `nvidia/nemotron-3.5-lightning-30b-a3b`, `mistral/leanstral-1-5`, `novita/ling-3.0-tiny`, `nvidia/content-safety`, `nvidia/muse-glimmer-30b` — 200 req/day free no card, 4x OpenRouter, verified live via `GET /v1/models` 676 models 12 zero-price
+- **Provider metadata** for the 3 new providers: `ENV_VAR_NAMES` (`POLLINATIONS_API_KEY`, `SILICONFLOW_API_KEY`, `REQUESTY_API_KEY`), `PROVIDER_METADATA` labels/couleurs/signupHint/rateLimits with detailed Pollen explanation, `PROVIDER_CAPABILITIES` daily reset, `PROVIDER_AUTH_ENDPOINTS` fixes
+- **Theme colors** for `pollinations` (pink) and `requesty` (blue) in both dark/light palettes
+- **Pollen help** in Settings overlay and README/website: explains Pollen ≈ $1, daily Quest grants via tier/quests, 0 Pollen = 402, HIT vs MISS, wallet `enter.pollinations.ai`, grants at midnight UTC, experimental note
+
+### Changed
+- **README** : removed hard-coded total counts everywhere (super chiant a maintenir) — `~207 models across 22 providers` -> `a large catalog of free coding models from 20+ providers`, badges `models-207` -> `models-large catalog` `providers-22` -> `providers-20+`, `~222` video caption -> `many`, `Parallel pings all ~207` -> `all models`, `~207 cataloged` -> `the cataloged`; provider table updated to 22 rows with real per-provider counts and new Pollinations/SiliconFlow/Requesty rows, added Pollen explainer block after table (with experimental warning) and SiliconFlow/Requesty verified note; removed GitHub Models from active table (retired 2026-07-30)
+- **Website docs** : `website/src/content/docs/introduction.mdx` and `quick-start.mdx` and `core/providers.mdx` and `docs/development.md` and `routes/index.tsx` hero `222+` -> `Many` — same generic wording, no hard totals
+- **Pollinations experimental flag** : README and `website/src/content/docs/core/providers.mdx` mark Pollinations `⚠️ experimental` and note `not yet confirmed stable`
+
+### Fixed
+- **SiliconFlow baseURL** : `api.siliconflow.com` -> `api.siliconflow.cn` in `src/core/opencode.js` (2 sites) and `src/core/kilo.js` and `src/core/provider-key-tester.js` `siliconflow` endpoint now `https://api.siliconflow.cn/v1/models`
+- **Provider key tester** : `pollinations` and `requesty` set to `null` (their `/v1/models` are public without auth, so auth-only probe would always 200 and give false ok, now it falls back to ping which correctly shows 402 when balance 0)
+- **Sync** : `sync-website-sources.sh` run -> `website/src/_fcm-sources/sources.js` updated to 22 providers
+
+### Verified
+- `pnpm test` 813 pass 0 fail
+- `node -e import('./sources.js')` 22 providers 207 models 0 dups
+- Live probes 2026-08-24: Pollinations `sk_GCaY...` and `sk_0dSR...` both `402` on MISS with `0.0000` balance (HIT still 200 via fallback), Quest wallet `3.25` not yet linked to keys (Budget ∞ but still 0), Requesty 12 zero-price confirmed, SiliconFlow pricing page verified

package/changelog/v0.5.82.md

@@ -0,0 +1,23 @@
+# Changelog v0.5.82 - 2026-09-05
+
+### Added
+- 🐬 **New provider: OrcaRouter** (PR #176 by @bangla24bdrang-lab) — zero-markup AI gateway, Free Hacker tier, 3 $-0 models (DeepSeek V4 Flash Free S+, Tencent Hy3 Free S, Qwen3.8 27B Free A+), all verified live on `api.orcarouter.ai/v1/models`. Wired across every surface: TUI, router daemon, benchmark, sync-set, Kilo/OpenCode launchers, key tester, docs and docker-compose (`ORCAROUTER_API_KEY`).
+- 📚 **OpenRouter catalog refresh** (PR #178 by @Muhammad95959): 9 new free models verified live at $0 — MiniMax M2.7, MiniMax M3, GLM-5.2, Nemotron 3 Super ctx fix, Ling 3.0 Flash Fin, Inkling, Inkling Small, Dots 3 Note Preview.
+- 🏗️ **NVIDIA NIM**: Muse Glimmer 30B + Kimi K3 added; Nemotron Nano 30B id fixed to `nvidia/nemotron-nano-3-30b-a3b` (old id confirmed 410 Gone live).
+- 🇨🇳 **SambaNova**: MiniMax M3 added (verified live via `/v1/models`).
+- ✨ **OpenCode Zen**: Laguna S 2.1 Free restored and Ling 3.0 Flash Fin Free added — both present on the live `/v1/models` (66 models checked).
+- 🌐 **Google AI Studio**: Gemini 3.8 Flash added (free tier confirmed on the official pricing page).
+
+### Fixed
+- ☁️ **Cloudflare `{account_id}` in launch paths** (PR #170 by @ia-S-on): the placeholder is now resolved from `CLOUDFLARE_ACCOUNT_ID` in ZCode/Goose config writes and pings (both `{account_id}` and `{$CLOUDFLARE_ACCOUNT_ID}` forms supported, URL-encoded). Fixes 404/400 when launching Cloudflare models in external tools.
+- 🚀 **Release workflow** (PR #177 by @Muhammad95959): publishing steps are skipped cleanly when the `NPM_TOKEN` secret is missing (fork-friendly).
+- 🔍 **LLM7 catalog corrected against the live API**: reverted 9 entries from PR #178 that are paid (`tier=pro`, `usage_based_only`) or nonexistent — glm-5.3, glm-5.3-flash, gemini-3.5-flash-low, gpt-5.4, gpt-5.4-mini, gpt-5.5, gpt-5.6-sol, grok-4.5, grok-4.6. Fixed `gpt-oss:20b` → `gpt-oss` (live ctx 131k). Removed gemini-3.1-flash-lite (now paid). The free turbo tier is exactly: minimax-m2.7, gpt-oss, mistral-Nemo-Instruct-2407, codestral-latest.
+- 🇫🇷 **Scaleway catalog**: reverted 3 unverified removals — Devstral 2 123B, Pixtral 12B and Qwen3 235B are all still Serverless per the official docs (checked 2026-09-05); dropped the false gemma-3-27b-it EOL claim (still served, 40k ctx).
+- 🌐 **Google AI catalog**: restored gemini-2.5-pro and gemini-3-flash-preview (free tier confirmed on the official pricing page); kept the gemini-3.1-pro-preview removal (free tier really is "Not available"); removed gemini-2.0-flash (not on the pricing page).
+- ⚙️ **Cerebras**: removed MiniMax M3 (HTTP 404 "Model does not exist" on live ping). **OpenCode Zen**: removed hy3-free (absent from live `/v1/models`).
+- 🖥️ **Website catalog mirror synced**: `website/src/_fcm-sources/sources.js` had drifted behind main (missing the NIM cleanup, the Cloudflare URL fix and OrcaRouter) — it is now an exact mirror of `sources.js`.
+- 🤖 dependabot: `dependabot/fetch-metadata` v2 → v3 (PR #163).
+
+### Changed
+- 📖 README + website docs: provider counts updated (OpenCode Zen 7, LLM7 4), Google AI notable models refreshed.
+- 🙏 Two new contributors: @ia-S-on and @bangla24bdrang-lab. Welcome!

package/changelog/v0.5.83.md

@@ -0,0 +1,22 @@
+# Changelog v0.5.83 - 2026-09-05
+
+Three community issues fixed in one pass, all focused on day-to-day TUI reliability: a hidden Windows prompt, probe ergonomics, and the command palette on small server consoles.
+
+### Added
+
+- 🔧 `--fix-permissions` (also `--yes` / `-y`): fix insecure config file permissions (chmod 600) without any prompt, ideal for scripts and CI (#173)
+- ⌨️ Shift+P: re-probe ONLY the models currently failing (404 / 410 / 429 / 401...) instead of re-testing the whole list, for quick rescans after an auth blip (#168)
+- ⌨️ Space: expand the selected row into a 2-line detail card showing provider, key status, endpoint URL, full model id, tier, SWE score, context window, last ping and HTTP code. Space again or moving the cursor collapses it (#168)
+- 🖥️ Command palette degrades gracefully: compact layout on small screens, plain-text rendering when the terminal has no color support (NO_COLOR, TERM=dumb, basic KVM consoles) (#169)
+
+### Fixed
+
+- 🪟 Windows: the config permission security warning and its "Fix permissions automatically? (Y/n)" prompt were rendered behind the TUI, making the app look frozen; the check now runs and resolves BEFORE the interactive UI starts (#173)
+- 💥 TUI crash during the 404 probe: a progress-bar accounting bug (RangeError on a negative repeat) could kill the whole process mid-probe (#168)
+- 🎛️ Ctrl+Shift+P was unreachable: the palette intercepted it first; the binding now works and palette commands can never take the TUI down via an unhandled rejection (#168)
+- 📐 Command palette rows overflowed up to 47 columns past the terminal edge on 80-column consoles (truncated mid-word, garbled right border); rows are now composed under a strict ANSI-aware width budget, the panel clamps to any terminal size down to 40x12, and margins are actively cleared (#169)
+
+### Changed
+
+- 📖 Help overlay, README and AGENTS.md key reference updated to document Shift+P, Ctrl+Shift+P and Space
+- 🧹 website: strict-null fixes in the changelog loader (first batch of pre-existing typecheck errors)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-coding-models",
-  "version": "0.5.80",
+  "version": "0.5.83",
   "description": "Find the fastest coding LLM models in seconds — ping free models from multiple providers, pick the best one for OpenCode, Cursor, or any AI coding assistant.",
   "keywords": [
     "nvidia",
@@ -76,7 +76,7 @@
     "@tabler/icons-react": "^3.44.0",
     "@tanstack/react-table": "^8.21.3",
     "chalk": "^5.6.2",
-    "kandown": "^0.50.0",
+    "kandown": "^0.52.0",
     "socket.io": "^4.8.3",
     "socket.io-client": "^4.8.3",
     "@tanstack/react-virtual": "^3.14.2"