free-coding-models 0.5.80 → 0.5.83

package/src/core/provider-metadata.js

@@ -62,6 +62,10 @@ export const ENV_VAR_NAMES = {
   routeway:   'ROUTEWAY_API_KEY',
   novita:     'NOVITA_API_KEY',
   'ollama-cloud': 'OLLAMA_API_KEY',
+  pollinations: 'POLLINATIONS_API_KEY',
+  siliconflow: 'SILICONFLOW_API_KEY',
+  requesty:   'REQUESTY_API_KEY',
+  orcarouter: 'ORCAROUTER_API_KEY',
 }
 
 // 📖 OPENCODE_MODEL_MAP: sparse table of model IDs that differ between sources.js and OpenCode's
@@ -201,13 +205,6 @@ export const PROVIDER_METADATA = {
     signupHint: 'Get API key',
     rateLimits: 'Gemini free quotas vary by model and region',
   },
-  siliconflow: {
-    label: 'SiliconFlow',
-    color: chalk.rgb(178, 235, 242),
-    signupUrl: 'https://cloud.siliconflow.cn/account/ak',
-    signupHint: 'API Keys → Create',
-    rateLimits: 'Free models: usually 100 RPM, varies by model',
-  },
   together: {
     label: 'Together AI',
     color: chalk.rgb(255, 241, 118),
@@ -259,11 +256,11 @@ export const PROVIDER_METADATA = {
     rateLimits: 'Depends on provider subscription (e.g., Anthropic, OpenAI)',
   },
   'opencode-zen': {
-    label: 'OpenCode Zen',
+    label: 'OpencodeZen',
     color: chalk.rgb(139, 92, 246), // violet — distinctive from other providers
     signupUrl: 'https://opencode.ai/auth',
     signupHint: 'Login at opencode.ai/auth to get your Zen API key',
-    rateLimits: 'Free tier models — requires OpenCode Zen API key',
+    rateLimits: 'Free tier models — requires Zen API key',
     zenOnly: true,
   },
   chutes: {
@@ -312,6 +309,36 @@ export const PROVIDER_METADATA = {
     rateLimits: 'Only zero-price live chat models are listed; other Novita models are paid/trial-credit',
     paidProviderNote: 'paid — 3 free models',
   },
+  pollinations: {
+    label: 'Pollinations AI ⚠️ experimental',
+    color: chalk.rgb(255, 105, 180),
+    signupUrl: 'https://enter.pollinations.ai',
+    signupHint: 'enter.pollinations.ai → API Keys (free Pollen daily; star github.com/pollinations/pollinations to earn Pollen; 0 Pollen = 402; no purchase needed)',
+    rateLimits: 'Free via Pollen (daily grants; ~0.0001-0.003 Pollen/req; 0 Pollen = 402; experimental, system may change)',
+    detailedLimits: 'Pollen ≈ $1. Daily free Pollen via tier (seed/flower/nectar) + quests (star repo, help issue). No purchase required. Cost per request 0.0001-0.003 Pollen. If balance is 0.0000, every MISS returns 402 PAYMENT_REQUIRED and the TUI shows 402; HIT (Cloudflare cache) may still return 200 but is not reliable. Check balance at enter.pollinations.ai → API Keys. Grants reset daily at midnight UTC. Integration is experimental and not yet confirmed as stable.',
+  },
+  siliconflow: {
+    label: 'SiliconFlow',
+    color: chalk.rgb(178, 235, 242),
+    signupUrl: 'https://cloud.siliconflow.cn/account/ak',
+    signupHint: 'API Keys → Create (phone SMS verification required)',
+    rateLimits: 'Free · 3 models @ $0 · 1000 RPM · 1M tokens/day per model',
+  },
+  requesty: {
+    label: 'Requesty',
+    color: chalk.rgb(100, 149, 255),
+    signupUrl: 'https://app.requesty.ai/api-keys',
+    signupHint: 'API Keys → Create (200 req/day free, no card)',
+    rateLimits: 'Free · 200 req/day on free models (20 req/min) · no card',
+  },
+  orcarouter: {
+    label: 'OrcaRouter',
+    color: chalk.rgb(255, 138, 64),
+    signupUrl: 'https://www.orcarouter.ai',
+    signupHint: 'Register (GitHub OAuth, no credit card) → API keys',
+    rateLimits: 'Free Hacker tier · zero token markup · 3 API keys',
+    detailedLimits: 'Zero-markup AI gateway: token prices are passed through at provider rates.\nFree Hacker plan: 3 API keys, adaptive routing + automatic failover + guardrails included.\nOnly the explicit $-0 models are listed in this catalog; the orcarouter/fusion family is pay-as-you-go.',
+  },
   'ollama-cloud': {
     label: 'Ollama Cloud',
     color: chalk.rgb(230, 230, 230),

package/src/core/quota-capabilities.js

@@ -61,6 +61,10 @@ export const PROVIDER_CAPABILITIES = {
   routeway: { telemetryType: 'unknown', supportsEndpoint: false, usageDisplay: 'ok', resetCadence: 'unknown' },
   novita: { telemetryType: 'unknown', supportsEndpoint: false, usageDisplay: 'ok', resetCadence: 'unknown' },
   'ollama-cloud': { telemetryType: 'unknown', supportsEndpoint: false, usageDisplay: 'ok', resetCadence: 'rolling' },
+  pollinations: { telemetryType: 'unknown', supportsEndpoint: false, usageDisplay: 'ok', resetCadence: 'daily' },
+  siliconflow: { telemetryType: 'unknown', supportsEndpoint: false, usageDisplay: 'ok', resetCadence: 'daily' },
+  requesty: { telemetryType: 'unknown', supportsEndpoint: false, usageDisplay: 'ok', resetCadence: 'daily' },
+  orcarouter: { telemetryType: 'unknown', supportsEndpoint: false, usageDisplay: 'ok', resetCadence: 'unknown' },
 }
 
 /** Fallback for unrecognized providers */

package/src/core/router-daemon.js

@@ -578,7 +578,7 @@ export function cloneHeadersForUpstream(reqHeaders, apiKey, providerKey) {
   }
   headers['Content-Type'] = headers['Content-Type'] || 'application/json'
   headers.Authorization = `Bearer ${apiKey}`
-  if (providerKey === 'openrouter') {
+  if (providerKey === 'openrouter' || providerKey === 'orcarouter') {
     headers['HTTP-Referer'] = 'https://github.com/vava-nessa/free-coding-models'
     headers['X-Title'] = 'free-coding-models'
   }
@@ -3619,7 +3619,7 @@ function createDefaultProbeFn(apiKeys) {
       headers.Prefer = 'wait=4'
     } else {
       headers.Authorization = `Bearer ${apiKey}`
-      if (provider === 'openrouter') {
+      if (provider === 'openrouter' || provider === 'orcarouter') {
         headers['HTTP-Referer'] = 'https://github.com/vava-nessa/free-coding-models'
         headers['X-Title'] = 'free-coding-models'
       }

package/src/core/security.js

@@ -8,27 +8,33 @@
  * 📖 This module:
  *    - Checks config file permissions on startup
  *    - Warns user if permissions are too open
- *    - Offers auto-fix option with user confirmation
+ *    - Offers auto-fix option with user confirmation (interactive TTY only)
  *    - Fixes permissions securely (chmod 600 = user read/write only)
  *
+ * 📖 Issue #173: this check used to run un-awaited inside runApp, so the TUI
+ *    entered raw mode / the alternate screen while the prompt was still pending.
+ *    On Windows the warning + prompt were invisible and the app looked frozen.
+ *    Now checkConfigSecurity() is async, awaited by the bin entry BEFORE the TUI
+ *    starts, and it never prompts on non-TTY stdin or daemon/web/JSON surfaces.
+ *
  * 📖 Secure permissions:
  *    - 0o600 (octal 600) = user:rw, group:---, world:---
  *    - Only the file owner can read or write
  *    - This is the standard for files containing secrets (SSH keys, API keys, etc.)
  *
- * 📖 Why this matters:
- *    - Shared systems: Other users could read your API keys
- *    - Git accidents: File could be committed with wrong permissions
- *    - Backup tools: Might copy files with permissions intact
+ * 📖 Windows note: Node's chmod on win32 is best-effort (it can only toggle the
+ *    read-only attribute, NTFS ACLs still govern real access). We still try,
+ *    and the manual hint points at icacls for a real fix.
  *
  * @functions
- *   → checkConfigSecurity() — Main security check, prompts for auto-fix if needed
- *   → getConfigPermissions() — Returns file mode object for config
- *   → isConfigSecure() — Boolean check if permissions are correct
- *   → fixConfigPermissions() — Applies chmod 600 to config file
- *   → promptSecurityFix() — Interactive prompt asking user to fix permissions
+ *   → checkConfigSecurity() - Async main security check; awaited before the TUI starts
+ *   → resolveSecurityAction() - Pure gate deciding auto-fix / prompt / warn-only (in utils.js)
+ *   → getConfigPermissions() - Returns file mode object for config
+ *   → isConfigSecure() - Boolean check if permissions are correct
+ *   → fixConfigPermissions() - Applies chmod 600 to config file (best-effort on Windows)
+ *   → promptSecurityFix() - Interactive prompt asking user to fix permissions
  *
- * @exports checkConfigSecurity, isConfigSecure, fixConfigPermissions
+ * @exports checkConfigSecurity, isConfigSecure, fixConfigPermissions, formatMode, formatModeRwx
  */
 
 import fs from 'node:fs'
@@ -36,8 +42,9 @@ import path from 'node:path'
 import os from 'node:os'
 import readline from 'node:readline'
 import { CONFIG_PATH } from './config.js'
+import { resolveSecurityAction } from './utils.js'
 
-// 📖 Config file path — matches the path used in config.js (honours the
+// 📖 Config file path - matches the path used in config.js (honours the
 // 📖 --config-dir / FCM_CONFIG_DIR override when set).
 function getConfigPath() {
   return CONFIG_PATH
@@ -47,6 +54,10 @@ function getConfigPath() {
 // 📖 This means: owner can read+write, group and others have no permissions
 const SECURE_MODE = 0o600
 
+// 📖 True on Windows, where chmod is best-effort (read-only bit only) and the
+// 📖 manual fix hint should point at icacls instead of chmod.
+const IS_WINDOWS = process.platform === 'win32'
+
 // 📖 Get file stats including permissions for the config file
 // 📖 Returns null if file doesn't exist
 function getConfigPermissions() {
@@ -80,7 +91,7 @@ export function isConfigSecure() {
 }
 
 // 📖 Fix config file permissions to secure mode (chmod 600)
-// 📖 Returns true if successful, false otherwise
+// 📖 Best-effort on Windows (read-only bit); returns true if successful, false otherwise
 export function fixConfigPermissions() {
   const configPath = getConfigPath()
 
@@ -97,23 +108,21 @@ export function fixConfigPermissions() {
 }
 
 // 📖 Format permission mode in octal (e.g., 0o644 → "644")
-function formatMode(mode) {
+// 📖 Exported for unit tests
+export function formatMode(mode) {
   return (mode & 0o777).toString(8).padStart(3, '0')
 }
 
 // 📖 Format permission mode in human-readable rwx format (e.g., 0o644 → "rw-r--r--")
-function formatModeRwx(mode) {
-  const perms = []
+// 📖 Walks bits 8..0 in groups of three: owner rwx, group rwx, others rwx.
+// 📖 Bit 8 = owner read, bit 7 = owner write, bit 6 = owner exec, and so on.
+// 📖 Exported for unit tests
+export function formatModeRwx(mode) {
   const types = ['r', 'w', 'x']
+  const perms = []
 
-  for (let i = 6; i >= 0; i -= 3) {
-    for (let j = 0; j < 3; j++) {
-      if (mode & (1 << (i + j))) {
-        perms.push(types[j])
-      } else {
-        perms.push('-')
-      }
-    }
+  for (let i = 8; i >= 0; i--) {
+    perms.push(mode & (1 << i) ? types[(8 - i) % 3] : '-')
   }
 
   return [
@@ -123,10 +132,72 @@ function formatModeRwx(mode) {
   ].join(' / ')
 }
 
-// 📖 Check security and prompt for auto-fix if needed
-// 📖 Call this on startup before loading config
+// 📖 Print the insecure-permissions warning (stderr, so --json stdout stays clean)
+function printSecurityWarning(perms) {
+  const currentMode = formatMode(perms.mode)
+  const currentRwx = formatModeRwx(perms.mode)
+
+  console.error('')
+  console.error('⚠️  SECURITY WARNING ⚠️')
+  console.error('')
+  console.error(`Your config file has insecure permissions: ${currentMode} (${currentRwx})`)
+  console.error(`File: ${perms.path}`)
+  console.error('')
+  console.error('This means other users on this system may be able to read your API keys.')
+  console.error('')
+  console.error('Recommended: Fix permissions to 600 (rw-------) - owner read/write only')
+}
+
+// 📖 Print the manual fix hint. On Windows, point at icacls since Node's chmod
+// 📖 only toggles the read-only attribute there.
+function printManualFixHint() {
+  console.error('')
+  if (IS_WINDOWS) {
+    console.error('To fix manually (PowerShell), run:')
+    console.error(`  icacls "${getConfigPath()}" /inheritance:r /grant:r "$env:USERNAME:R,W"`)
+  } else {
+    console.error('To fix manually, run:')
+    console.error(`  chmod 600 ${getConfigPath()}`)
+  }
+  console.error('')
+}
+
+// 📖 Apply the fix and report the outcome. Shared by the prompt path (user said
+// 📖 yes) and the auto-fix path (--fix-permissions / --yes / -y).
+function applyFixAndReport() {
+  const success = fixConfigPermissions()
+
+  if (success) {
+    console.error('')
+    console.error('✅ Permissions fixed! Your API keys are now secure.')
+    console.error('')
+    if (IS_WINDOWS) {
+      console.error('Note: on Windows this is best-effort (read-only bit). See docs for NTFS ACLs.')
+      console.error('')
+    }
+    return { wasSecure: false, wasFixed: true }
+  }
+
+  console.error('')
+  console.error('❌ Failed to fix permissions automatically.')
+  printManualFixHint()
+  return { wasSecure: false, wasFixed: false, error: 'chmod_failed' }
+}
+
+// 📖 Check security and handle the fix flow if needed
+// 📖 Await this BEFORE starting any terminal UI (issue #173) so the warning and
+// 📖 the confirmation prompt are visible and fully resolved before raw mode /
+// 📖 the alternate screen take over.
+//
+// 📖 Options:
+//   autoFix       - true when --fix-permissions / --yes / -y was passed: apply the
+//                   fix without asking
+//   promptAllowed - false on daemon/web/JSON surfaces: never prompt there, at most
+//                   warn on stderr
+//   stdinIsTTY    - override the stdin TTY detection (tests); defaults to real detection
+//
 // 📖 Returns: { wasSecure: boolean, wasFixed: boolean, error?: string }
-export function checkConfigSecurity() {
+export async function checkConfigSecurity(options = {}) {
   const perms = getConfigPermissions()
 
   // 📖 No file yet = nothing to check
@@ -139,24 +210,38 @@ export function checkConfigSecurity() {
     return { wasSecure: true, wasFixed: false }
   }
 
-  // 📖 Security issue detected! Show warning and offer fix.
-  const currentMode = formatMode(perms.mode)
-  const currentRwx = formatModeRwx(perms.mode)
+  // 📖 Pure gate (see utils.js): decides auto-fix vs prompt vs warn-only.
+  const action = resolveSecurityAction({
+    configExists: true,
+    isSecure: false,
+    autoFixRequested: options.autoFix === true,
+    stdinIsTTY: options.stdinIsTTY ?? (process.stdin?.isTTY === true),
+    promptAllowed: options.promptAllowed !== false,
+  })
 
-  console.error('')
-  console.error('⚠️  SECURITY WARNING ⚠️')
-  console.error('')
-  console.error(`Your config file has insecure permissions: ${currentMode} (${currentRwx})`)
-  console.error(`File: ${perms.path}`)
-  console.error('')
-  console.error('This means other users on this system may be able to read your API keys.')
-  console.error('')
-  console.error('Recommended: Fix permissions to 600 (rw-------) — owner read/write only')
+  if (action === 'none') {
+    return { wasSecure: true, wasFixed: false }
+  }
+
+  // 📖 Security issue detected! Print the warning first so it is on screen
+  // 📖 no matter which path follows.
+  printSecurityWarning(perms)
+
+  if (action === 'auto-fix') {
+    return applyFixAndReport()
+  }
+
+  if (action === 'warn-only') {
+    console.error('Running non-interactively (piped stdin or daemon/web mode), so skipping the prompt.')
+    printManualFixHint()
+    return { wasSecure: false, wasFixed: false, error: 'non_interactive' }
+  }
 
   return promptSecurityFix()
 }
 
 // 📖 Interactive prompt asking user if they want to auto-fix
+// 📖 Only reached on a real interactive TTY (gated in checkConfigSecurity)
 // 📖 Returns: { wasSecure: boolean, wasFixed: boolean, error?: string }
 async function promptSecurityFix() {
   const rl = readline.createInterface({
@@ -165,37 +250,22 @@ async function promptSecurityFix() {
   })
 
   try {
-    const answer = await new Promise((resolve) => {
+    const rawAnswer = await new Promise((resolve) => {
       rl.question('Fix permissions automatically? (Y/n): ', resolve)
     })
 
     rl.close()
 
+    // 📖 Normalise: readline can resolve with undefined when stdin closes mid-prompt
+    const answer = String(rawAnswer ?? '').trim().toLowerCase()
+
     // 📖 Default to yes if user just presses Enter
-    if (answer.toLowerCase() === 'y' || answer === '') {
-      const success = fixConfigPermissions()
-
-      if (success) {
-        console.error('')
-        console.error('✅ Permissions fixed! Your API keys are now secure.')
-        console.error('')
-        return { wasSecure: false, wasFixed: true }
-      } else {
-        console.error('')
-        console.error('❌ Failed to fix permissions automatically.')
-        console.error('')
-        console.error('Run this command manually:')
-        console.error(`  chmod 600 ${getConfigPath()}`)
-        console.error('')
-        return { wasSecure: false, wasFixed: false, error: 'chmod_failed' }
-      }
+    if (answer === 'y' || answer === '') {
+      return applyFixAndReport()
     } else {
       console.error('')
       console.error('⚠️  Permissions not fixed. Your API keys may be at risk.')
-      console.error('')
-      console.error('To fix later, run:')
-      console.error(`  chmod 600 ${getConfigPath()}`)
-      console.error('')
+      printManualFixHint()
       return { wasSecure: false, wasFixed: false, error: 'user_declined' }
     }
   } catch (err) {
@@ -203,10 +273,7 @@ async function promptSecurityFix() {
     // 📖 If we can't prompt (e.g., non-interactive TTY), just warn and continue
     console.error('')
     console.error('⚠️  Unable to prompt for permission fix (non-interactive terminal?)')
-    console.error('')
-    console.error('To fix manually, run:')
-    console.error(`  chmod 600 ${getConfigPath()}`)
-    console.error('')
+    printManualFixHint()
     return { wasSecure: false, wasFixed: false, error: 'no_tty' }
   }
 }

package/src/core/sync-set.js

@@ -192,7 +192,7 @@ function buildHeaders(providerKey, apiKey) {
     'Content-Type': 'application/json',
     Authorization: `Bearer ${apiKey}`,
   }
-  if (providerKey === 'openrouter') {
+  if (providerKey === 'openrouter' || providerKey === 'orcarouter') {
     headers['HTTP-Referer'] = 'https://github.com/vava-nessa/free-coding-models'
     headers['X-Title'] = 'free-coding-models'
   }

package/src/core/tool-launchers.js

@@ -50,6 +50,7 @@ import { PROVIDER_METADATA } from './provider-metadata.js'
 import { resolveToolBinaryPath } from './tool-bootstrap.js'
 import { ensureDir, readJson, writeJson } from './shared-helpers.js'
 import { parseContextWindow } from './endpoint-installer.js'
+import { resolveCloudflareUrl } from './ping.js'
 
 const OPENAI_COMPAT_ENV_KEYS = [
   'OPENAI_API_KEY',
@@ -108,10 +109,15 @@ function backupIfExists(filePath) {
 function getProviderBaseUrl(providerKey) {
   const url = sources[providerKey]?.url
   if (!url) return null
-  return url
+  let resolvedUrl = url
     .replace(/\/chat\/completions$/i, '')
     .replace(/\/responses$/i, '')
     .replace(/\/predictions$/i, '')
+  // 📖 Cloudflare uses account_id in URL - resolve from CLOUDFLARE_ACCOUNT_ID env var
+  if (providerKey === 'cloudflare') {
+    resolvedUrl = resolveCloudflareUrl(resolvedUrl)
+  }
+  return resolvedUrl
 }
 
 function deleteEnvKeys(env, keys) {
@@ -579,9 +585,9 @@ export function writeZCodeConfig(model, config, paths = getDefaultToolPaths()) {
 
   const providerKey = model.providerKey || 'nvidia'
   const apiKey = getApiKey(config, providerKey)
-  const baseUrl = sources[providerKey]?.url
-    ? sources[providerKey].url.replace(/\/chat\/completions$/i, '').replace(/\/responses$/i, '').replace(/\/predictions$/i, '')
-    : null
+  // 📖 Use getProviderBaseUrl so Cloudflare's {account_id} placeholder is resolved
+  // 📖 (raw sources[].url would leave it literal and ZCode would fail on Cloudflare models).
+  const baseUrl = getProviderBaseUrl(providerKey)
   const providerId = `fcm-${providerKey}`
   const providerLabel = `FCM ${sources[providerKey]?.name || providerKey}`
 
@@ -838,7 +844,11 @@ export function prepareExternalToolLaunch(mode, model, config, options = {}) {
   }
 
   if (mode === 'goose') {
-    const gooseBaseUrl = sources[model.providerKey]?.url || baseUrl || ''
+    // 📖 Always use the resolved provider base URL from buildToolEnv (getProviderBaseUrl),
+    // 📖 which substitutes Cloudflare's {account_id} placeholder via resolveCloudflareUrl.
+    // 📖 Using the raw sources[].url would leave the literal {account_id} in the Goose
+    // 📖 provider config, so Goose would POST to /accounts/{account_id}/... and 400.
+    const gooseBaseUrl = baseUrl
     const gooseModelId = resolveLauncherModelId(model)
     const result = writeGooseConfig({ ...model, modelId: gooseModelId }, apiKey, gooseBaseUrl, model.providerKey, paths)
     env.GOOSE_PROVIDER = `fcm-${model.providerKey}`

package/src/core/utils.js

@@ -409,6 +409,30 @@ export function filterByTier(results, tierLetter) {
   return results.filter(r => allowed.includes(r.tier))
 }
 
+// 📖 PROBE_FAILED_STATUSES: row health states that count as "failed" for the
+// 📖 Shift+P re-probe action (issue #168). Covers the errors a user actually sees
+// 📖 in the table: dead endpoints (404/410/5xx/ERR → 'down'), rate limits
+// 📖 (429 → 'down'), rejected keys ('auth_error') and network timeouts.
+// 📖 'noauth' is deliberately excluded: those rows have no API key, so an
+// 📖 authenticated probe cannot even run for them.
+export const PROBE_FAILED_STATUSES = new Set(['down', 'timeout', 'auth_error'])
+
+// 📖 isProbeFailedRow: True when a single result row is currently showing an
+// 📖 error state worth re-probing. Hidden rows are skipped on purpose: Shift+P
+// 📖 re-probes what the user can SEE failing, not rows the probe already hid.
+export function isProbeFailedRow(row) {
+  return !!row && !row.hidden && PROBE_FAILED_STATUSES.has(row.status)
+}
+
+// 📖 selectProbeFailedRows: Filter a results array down to the rows that are
+// 📖 currently failing (auth fail / 429 / 404 / timeout). Pure helper used by
+// 📖 the TUI Shift+P "re-probe failed rows only" action (issue #168) so users
+// 📖 can retry 1-2 flaky providers without burning quota on the whole list.
+export function selectProbeFailedRows(results) {
+  if (!Array.isArray(results)) return []
+  return results.filter(isProbeFailedRow)
+}
+
 // 📖 findBestModel: Pick the single best model from a results array.
 // 📖 Used by --fiable mode to output the most reliable model after 10s of analysis.
 //
@@ -460,6 +484,7 @@ export function findBestModel(results) {
 //     --daemon, --daemon-bg, --daemon-stop,
 //     --daemon-status, --no-telemetry, --json, --help/-h (case-insensitive)
 //     --playground / playground subcommand (open the in-TUI chat playground)
+//     --fix-permissions / --yes / -y (auto-fix config permissions without prompting)
 //   - Value flag: --tier <letter> (the next non-flag arg is the tier value)
 //   - Probe-cache flags (t1):
 //     --reprobe / --no-cache (boolean) — force-rebuild the probe cache this run
@@ -533,7 +558,8 @@ export function parseArgs(argv) {
   if (configDirValueIdx !== -1) skipIndices.add(configDirValueIdx)
 
   for (const [i, arg] of args.entries()) {
-    if (arg.startsWith('--') || arg === '-h') {
+    // 📖 -y is a boolean flag (security auto-fix), never an API key
+    if (arg.startsWith('--') || arg === '-h' || arg === '-y') {
       flags.push(arg.toLowerCase())
     } else if (skipIndices.has(i)) {
       // 📖 Skip — this is a value for --tier, not an API key
@@ -577,6 +603,11 @@ export function parseArgs(argv) {
   const daemonStopMode = flags.includes('--daemon-stop')
   const daemonStatusMode = flags.includes('--daemon-status')
 
+  // 📖 --fix-permissions / --yes / -y - auto-answer "yes" to the config-permission
+  // 📖 security prompt (chmod 600, best-effort on Windows) so scripts, CI and
+  // 📖 non-interactive terminals never hang on a hidden prompt. Issue #173.
+  const fixPermissionsMode = flags.includes('--fix-permissions') || flags.includes('--yes') || flags.includes('-y')
+
   // 📖 --sync-set [name] — auto-discover and populate a router set with best available models
   const syncSetMode = flags.includes('--sync-set')
   const syncSetName = syncSetValueIdx !== -1 ? args[syncSetValueIdx] : null
@@ -686,9 +717,65 @@ export function parseArgs(argv) {
     clearRuntimeMode,
     // 📖 Config location flag — see src/core/config.js getConfigDir()
     configDir: configDirValueIdx !== -1 ? args[configDirValueIdx] : null,
+    // 📖 Security auto-fix flag - see src/core/security.js checkConfigSecurity()
+    fixPermissionsMode,
   }
 }
 
+// ─── Config Security Gating (issue #173) ─────────────────────────────────────
+
+// 📖 resolveSecurityAction: pure decision helper that tells the startup security
+// 📖 check what it should do about insecure config file permissions.
+//
+// 📖 Why: the security warning + "Fix permissions automatically?" prompt used to
+// 📖 run un-awaited while the TUI entered raw mode / the alternate screen, so the
+// 📖 prompt was invisible (worst on Windows) and the app looked frozen. This gate
+// 📖 guarantees: never prompt without an interactive surface, never prompt a
+// 📖 daemon/web/JSON surface, and always auto-fix when a yes-flag is passed.
+//
+// 📖 Params:
+//   configExists     - does the config file exist (no file = nothing to secure)
+//   isSecure         - are permissions already 0600
+//   autoFixRequested - user passed --fix-permissions / --yes / -y
+//   stdinIsTTY       - is stdin an interactive terminal
+//   promptAllowed    - is this an interactive surface (TUI)? false for daemon/web/JSON
+//
+// 📖 Returns one of: 'none' | 'auto-fix' | 'warn-only' | 'prompt'
+export function resolveSecurityAction({ configExists, isSecure, autoFixRequested, stdinIsTTY, promptAllowed }) {
+  if (!configExists || isSecure) return 'none'
+  if (autoFixRequested) return 'auto-fix'
+  if (!stdinIsTTY || !promptAllowed) return 'warn-only'
+  return 'prompt'
+}
+
+// 📖 detectTerminalCapabilities: PURE terminal capability probe for TUI overlays.
+// 📖 WHY: basic server consoles (IPMI/KVM viewers, ASPEED framebuffer, serial
+// 📖 terminals) often run 80x24 or smaller with no or limited color support, and
+// 📖 the palette/overlays must degrade instead of overflowing or painting garbage.
+// 📖 Everything is injected by the caller (env, size, TTY) so tests never touch
+// 📖 process.env and the function stays deterministic.
+//
+// 📖 Rules:
+//   - FORCE_COLOR wins over NO_COLOR (same precedence chalk uses).
+//   - NO_COLOR (non-empty, per no-color.org spec) disables color.
+//   - Not a TTY, TERM missing / "dumb" / "unknown" disables color, unless
+//     COLORTERM is set (some terminals export only COLORTERM).
+//   - compact = size too tight for the roomy overlay layout (cols < 90 or rows < 24,
+//     thresholds chosen so a plain 80x24 console gets the space-saving layout).
+//
+// 📖 Returns { colorSupported: boolean, compact: boolean }
+export function detectTerminalCapabilities({ env = {}, cols = 80, rows = 24, isTTY = true } = {}) {
+  const term = String(env.TERM ?? '').trim().toLowerCase()
+  const colorterm = String(env.COLORTERM ?? '').trim().toLowerCase()
+  const force = env.FORCE_COLOR
+  const forceOn = force !== undefined && force !== '' && force !== '0' && force !== 'false'
+  const noColor = env.NO_COLOR !== undefined && env.NO_COLOR !== ''
+  const termUsable = term !== '' && term !== 'dumb' && term !== 'unknown'
+  const colorSupported = forceOn || (!noColor && isTTY !== false && (termUsable || colorterm !== ''))
+  const compact = Math.floor(cols) < 90 || Math.floor(rows) < 24
+  return { colorSupported, compact }
+}
+
 // ─── Smart Recommend — Scoring Engine ─────────────────────────────────────────
 
 // 📖 Task types for the Smart Recommend questionnaire.

package/src/tui/app.js

@@ -143,7 +143,6 @@ import {
   isProviderQuotaPaused,
   listPausedProviders,
 } from '../core/provider-cooldown.js'
-import { checkConfigSecurity } from '../core/security.js'
 import { buildCliHelpText } from './cli-help.js'
 import { detectActiveTheme, THEME_BG_RGB, getTheme, patchThemeBg } from './theme.js'
 
@@ -271,10 +270,9 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
   detectActiveTheme(config.settings?.theme || 'auto')
 
   // 📖 Check config file security — warn and offer auto-fix if permissions are too open
-  const securityCheck = checkConfigSecurity()
-  if (!securityCheck.wasSecure && !securityCheck.wasFixed) {
-    // 📖 User declined auto-fix or it failed — continue anyway, just warned
-  }
+  // 📖 (issue #173): this moved to bin/free-coding-models.js BEFORE runApp so the
+  // 📖 warning + prompt are visible and resolved before the alternate screen / raw
+  // 📖 mode take over. Do not call checkConfigSecurity() here again.
 
   // 📖 Apply CLI overrides for settings
   if (cliArgs.sortColumn) config.settings.sortColumn = cliArgs.sortColumn
@@ -1045,6 +1043,10 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
       probeTotal: state.probeTotal,
       probeCompleted: state.probeCompleted,
       probeHiddenCount: state.probeHiddenCount,
+      // 📖 Space-expanded row (issue #168): "providerKey/modelId" or null
+      expandedRowKey: state.expandedRowKey ?? null,
+      // 📖 Non-fatal action error chip (issue #168): only shown while fresh
+      actionErrorMsg: (state.actionErrorMsgUntil || 0) > Date.now() ? state.actionErrorMsg : null,
       // 📖 Probe-cache (t1): footer chip stats
       probeCacheHits: state.probeCacheHits || 0,
       probeCacheMisses: state.probeCacheMisses || 0,

package/src/tui/cli-help.js

@@ -49,6 +49,7 @@ const CONFIG_FLAGS = [
   { flag: '--daemon-stop', description: 'Gracefully stop the FCM Router daemon' },
   { flag: '--sync-set [name]', description: 'Auto-discover and live-probe models into a router set' },
   { flag: '--config-dir <dir>', description: 'Store config.json + backups/ in <dir> (e.g. --config-dir ~/.config/free-coding-models for the XDG layout)' },
+  { flag: '--fix-permissions, --yes, -y', description: 'Auto-fix insecure config file permissions (chmod 600) without prompting; safe for scripts and CI' },
   { flag: '--no-telemetry', description: 'Disable anonymous telemetry for this run' },
   { flag: '--help, -h', description: 'Print this help and exit' },
 ]

package/src/tui/command-palette.js

@@ -45,7 +45,7 @@ const TOOL_MODE_DESCRIPTIONS = {
   hermes: 'Launch Hermes Agent with the selected model.',
   'continue': 'Launch Continue CLI with the selected model.',
   cline: 'Launch Cline CLI with the selected model.',
-  caveman: 'Caveman Code — token-efficient coding agent (launch with Caveman tool only).',
+  caveman: 'Caveman Code - token-efficient coding agent (launch with Caveman tool only).',
   jcode: 'Launch jcode coding agent with the selected model.',
 }
 
@@ -201,7 +201,8 @@ const BASE_COMMAND_TREE = [
       },
       { id: 'action-cycle-theme', label: 'Cycle theme', shortcut: 'G', icon: '🌗', description: 'Switch dark/light/auto', keywords: ['theme', 'dark', 'light', 'auto'] },
       { id: 'action-reset-view', label: 'Reset view', shortcut: 'N', icon: '\u{1F504}', description: 'Reset filters and sort', keywords: ['reset', 'view', 'sort', 'filters'] },
-      { id: 'action-probe-404', label: 'Probe 404 Models', shortcut: 'Ctrl+Shift+P', icon: '\u{1F50D}', description: 'Test all configured models for 404/410 errors. Auto-hides broken models.', keywords: ['probe', '404', 'broken', 'dead', 'health', 'check', 'test', 'verify'] },
+      { id: 'action-probe-failed', label: 'Re-probe Failed Models', shortcut: 'Shift+P', icon: '\u{1F50D}', description: 'Re-test only rows showing errors (auth fail / 429 / 404 / timeout) - not the whole list.', keywords: ['probe', 'failed', 'retry', '429', 'auth', 'error', 'broken', 'rescan', 'health'] },
+      { id: 'action-probe-404', label: 'Probe All Models (404)', shortcut: 'Ctrl+Shift+P', icon: '\u{1F50D}', description: 'Test all configured models for 404/410 errors. Auto-hides broken models.', keywords: ['probe', '404', 'broken', 'dead', 'health', 'check', 'test', 'verify', 'all'] },
       { id: 'action-toggle-auto-hide-broken', label: 'Toggle Auto-hide Broken Models', icon: '\u{1F6A9}', description: 'Enable/disable auto-hiding of 404/410 models. Unhides all when disabled.', keywords: ['auto', 'hide', 'broken', '404', 'models', 'toggle', 'probe'] },
     ],
   },