free-coding-models 0.5.81 → 0.5.83

package/src/core/kilo.js

@@ -110,6 +110,13 @@ export async function startKilo(model, fcmConfig) {
         options: { baseURL: 'https://openrouter.ai/api/v1', apiKey: '{env:OPENROUTER_API_KEY}' },
         models: {}
       }
+    } else if (providerKey === 'orcarouter') {
+      config.provider.orcarouter = {
+        npm: '@ai-sdk/openai-compatible',
+        name: 'OrcaRouter',
+        options: { baseURL: 'https://api.orcarouter.ai/v1', apiKey: '{env:ORCAROUTER_API_KEY}' },
+        models: {}
+      }
     } else if (providerKey === 'huggingface') {
       config.provider.huggingface = {
         npm: '@ai-sdk/openai-compatible',

package/src/core/models-dev-index.js

@@ -44,6 +44,7 @@ export const PROVIDER_ALIASES = {
   nvidiaNim:  'nvidia',
   nvidia:     'nvidia',
   openrouter: 'openrouter',
+  orcarouter: 'orcarouter',
   groq:       'groq',
   cerebras:   'cerebras',
   github:     'github-models',

package/src/core/opencode.js

@@ -425,6 +425,13 @@ export async function startOpenCode(model, fcmConfig) {
         options: { baseURL: 'https://openrouter.ai/api/v1', apiKey: '{env:OPENROUTER_API_KEY}' },
         models: {}
       }
+    } else if (providerKey === 'orcarouter') {
+      config.provider.orcarouter = {
+        npm: '@ai-sdk/openai-compatible',
+        name: 'OrcaRouter',
+        options: { baseURL: 'https://api.orcarouter.ai/v1', apiKey: '{env:ORCAROUTER_API_KEY}' },
+        models: {}
+      }
     } else if (providerKey === 'huggingface') {
       config.provider.huggingface = {
         npm: '@ai-sdk/openai-compatible',
@@ -793,6 +800,13 @@ export async function startOpenCodeDesktop(model, fcmConfig) {
         options: { baseURL: 'https://openrouter.ai/api/v1', apiKey: '{env:OPENROUTER_API_KEY}' },
         models: {}
       }
+    } else if (providerKey === 'orcarouter') {
+      config.provider.orcarouter = {
+        npm: '@ai-sdk/openai-compatible',
+        name: 'OrcaRouter',
+        options: { baseURL: 'https://api.orcarouter.ai/v1', apiKey: '{env:ORCAROUTER_API_KEY}' },
+        models: {}
+      }
     } else if (providerKey === 'huggingface') {
       config.provider.huggingface = {
         npm: '@ai-sdk/openai-compatible',

package/src/core/ping.js

@@ -56,12 +56,17 @@ const DISABLED_THINKING_RETRY_STATUSES = new Set([400, 422])
 const disabledThinkingUnsupportedProviders = new Set()
 
 // 📖 resolveCloudflareUrl: Cloudflare's OpenAI-compatible endpoint is account-scoped.
-// 📖 We resolve {account_id} from env so provider setup can stay simple in config.
+// 📖 We resolve the placeholder from the CLOUDFLARE_ACCOUNT_ID env var so provider
+// 📖 setup can stay simple in config. Supports both the `{account_id}` placeholder
+// 📖 and the explicit `{$CLOUDFLARE_ACCOUNT_ID}` form used in sources.js.
 export function resolveCloudflareUrl(url) {
   const accountId = (process.env.CLOUDFLARE_ACCOUNT_ID || '').trim()
-  if (!url.includes('{account_id}')) return url
-  if (!accountId) return url.replace('{account_id}', 'missing-account-id')
-  return url.replace('{account_id}', encodeURIComponent(accountId))
+  const hasPlaceholder = url.includes('{$CLOUDFLARE_ACCOUNT_ID}') || url.includes('{account_id}')
+  if (!hasPlaceholder) return url
+  const replacement = accountId ? encodeURIComponent(accountId) : 'missing-account-id'
+  return url
+    .replace(/\{\$CLOUDFLARE_ACCOUNT_ID\}/g, replacement)
+    .replace(/\{account_id\}/g, replacement)
 }
 
 // 📖 buildChatCompletionPingBody: Use the smallest useful chat-completion probe.
@@ -130,6 +135,11 @@ export function buildPingRequest(apiKey, modelId, providerKey, url, options = {}
     headers['HTTP-Referer'] = 'https://github.com/vava-nessa/free-coding-models'
     headers['X-Title'] = 'free-coding-models'
   }
+  if (providerKey === 'orcarouter') {
+    // 📖 OrcaRouter uses the same app-identification convention as OpenRouter.
+    headers['HTTP-Referer'] = 'https://github.com/vava-nessa/free-coding-models'
+    headers['X-Title'] = 'free-coding-models'
+  }
 
   return {
     url,

package/src/core/provider-key-tester.js

@@ -68,6 +68,7 @@ export const PROVIDER_AUTH_ENDPOINTS = {
   siliconflow:  { url: 'https://api.siliconflow.cn/v1/models',     method: 'GET' },
   pollinations: null,
   requesty:     null,
+  orcarouter:   { url: 'https://api.orcarouter.ai/v1/models',   method: 'GET' },
   together:     { url: 'https://api.together.xyz/v1/models',        method: 'GET' },
   perplexity:   { url: 'https://api.perplexity.ai/v1/models',       method: 'GET' },
   chutes:       { url: 'https://chutes.ai/v1/models',               method: 'GET' },
@@ -103,7 +104,7 @@ export async function testProviderKeyDirect(apiKey, providerKey) {
 
   const { url, method } = authConfig
   const headers = { Authorization: `Bearer ${apiKey}` }
-  if (providerKey === 'openrouter') {
+  if (providerKey === 'openrouter' || providerKey === 'orcarouter') {
     headers['HTTP-Referer'] = 'https://github.com/vava-nessa/free-coding-models'
     headers['X-Title'] = 'free-coding-models'
   }

package/src/core/provider-metadata.js

@@ -65,6 +65,7 @@ export const ENV_VAR_NAMES = {
   pollinations: 'POLLINATIONS_API_KEY',
   siliconflow: 'SILICONFLOW_API_KEY',
   requesty:   'REQUESTY_API_KEY',
+  orcarouter: 'ORCAROUTER_API_KEY',
 }
 
 // 📖 OPENCODE_MODEL_MAP: sparse table of model IDs that differ between sources.js and OpenCode's
@@ -255,11 +256,11 @@ export const PROVIDER_METADATA = {
     rateLimits: 'Depends on provider subscription (e.g., Anthropic, OpenAI)',
   },
   'opencode-zen': {
-    label: 'OpenCode Zen',
+    label: 'OpencodeZen',
     color: chalk.rgb(139, 92, 246), // violet — distinctive from other providers
     signupUrl: 'https://opencode.ai/auth',
     signupHint: 'Login at opencode.ai/auth to get your Zen API key',
-    rateLimits: 'Free tier models — requires OpenCode Zen API key',
+    rateLimits: 'Free tier models — requires Zen API key',
     zenOnly: true,
   },
   chutes: {
@@ -330,6 +331,14 @@ export const PROVIDER_METADATA = {
     signupHint: 'API Keys → Create (200 req/day free, no card)',
     rateLimits: 'Free · 200 req/day on free models (20 req/min) · no card',
   },
+  orcarouter: {
+    label: 'OrcaRouter',
+    color: chalk.rgb(255, 138, 64),
+    signupUrl: 'https://www.orcarouter.ai',
+    signupHint: 'Register (GitHub OAuth, no credit card) → API keys',
+    rateLimits: 'Free Hacker tier · zero token markup · 3 API keys',
+    detailedLimits: 'Zero-markup AI gateway: token prices are passed through at provider rates.\nFree Hacker plan: 3 API keys, adaptive routing + automatic failover + guardrails included.\nOnly the explicit $-0 models are listed in this catalog; the orcarouter/fusion family is pay-as-you-go.',
+  },
   'ollama-cloud': {
     label: 'Ollama Cloud',
     color: chalk.rgb(230, 230, 230),

package/src/core/quota-capabilities.js

@@ -64,6 +64,7 @@ export const PROVIDER_CAPABILITIES = {
   pollinations: { telemetryType: 'unknown', supportsEndpoint: false, usageDisplay: 'ok', resetCadence: 'daily' },
   siliconflow: { telemetryType: 'unknown', supportsEndpoint: false, usageDisplay: 'ok', resetCadence: 'daily' },
   requesty: { telemetryType: 'unknown', supportsEndpoint: false, usageDisplay: 'ok', resetCadence: 'daily' },
+  orcarouter: { telemetryType: 'unknown', supportsEndpoint: false, usageDisplay: 'ok', resetCadence: 'unknown' },
 }
 
 /** Fallback for unrecognized providers */

package/src/core/router-daemon.js

@@ -578,7 +578,7 @@ export function cloneHeadersForUpstream(reqHeaders, apiKey, providerKey) {
   }
   headers['Content-Type'] = headers['Content-Type'] || 'application/json'
   headers.Authorization = `Bearer ${apiKey}`
-  if (providerKey === 'openrouter') {
+  if (providerKey === 'openrouter' || providerKey === 'orcarouter') {
     headers['HTTP-Referer'] = 'https://github.com/vava-nessa/free-coding-models'
     headers['X-Title'] = 'free-coding-models'
   }
@@ -3619,7 +3619,7 @@ function createDefaultProbeFn(apiKeys) {
       headers.Prefer = 'wait=4'
     } else {
       headers.Authorization = `Bearer ${apiKey}`
-      if (provider === 'openrouter') {
+      if (provider === 'openrouter' || provider === 'orcarouter') {
         headers['HTTP-Referer'] = 'https://github.com/vava-nessa/free-coding-models'
         headers['X-Title'] = 'free-coding-models'
       }

package/src/core/security.js

@@ -8,27 +8,33 @@
  * 📖 This module:
  *    - Checks config file permissions on startup
  *    - Warns user if permissions are too open
- *    - Offers auto-fix option with user confirmation
+ *    - Offers auto-fix option with user confirmation (interactive TTY only)
  *    - Fixes permissions securely (chmod 600 = user read/write only)
  *
+ * 📖 Issue #173: this check used to run un-awaited inside runApp, so the TUI
+ *    entered raw mode / the alternate screen while the prompt was still pending.
+ *    On Windows the warning + prompt were invisible and the app looked frozen.
+ *    Now checkConfigSecurity() is async, awaited by the bin entry BEFORE the TUI
+ *    starts, and it never prompts on non-TTY stdin or daemon/web/JSON surfaces.
+ *
  * 📖 Secure permissions:
  *    - 0o600 (octal 600) = user:rw, group:---, world:---
  *    - Only the file owner can read or write
  *    - This is the standard for files containing secrets (SSH keys, API keys, etc.)
  *
- * 📖 Why this matters:
- *    - Shared systems: Other users could read your API keys
- *    - Git accidents: File could be committed with wrong permissions
- *    - Backup tools: Might copy files with permissions intact
+ * 📖 Windows note: Node's chmod on win32 is best-effort (it can only toggle the
+ *    read-only attribute, NTFS ACLs still govern real access). We still try,
+ *    and the manual hint points at icacls for a real fix.
  *
  * @functions
- *   → checkConfigSecurity() — Main security check, prompts for auto-fix if needed
- *   → getConfigPermissions() — Returns file mode object for config
- *   → isConfigSecure() — Boolean check if permissions are correct
- *   → fixConfigPermissions() — Applies chmod 600 to config file
- *   → promptSecurityFix() — Interactive prompt asking user to fix permissions
+ *   → checkConfigSecurity() - Async main security check; awaited before the TUI starts
+ *   → resolveSecurityAction() - Pure gate deciding auto-fix / prompt / warn-only (in utils.js)
+ *   → getConfigPermissions() - Returns file mode object for config
+ *   → isConfigSecure() - Boolean check if permissions are correct
+ *   → fixConfigPermissions() - Applies chmod 600 to config file (best-effort on Windows)
+ *   → promptSecurityFix() - Interactive prompt asking user to fix permissions
  *
- * @exports checkConfigSecurity, isConfigSecure, fixConfigPermissions
+ * @exports checkConfigSecurity, isConfigSecure, fixConfigPermissions, formatMode, formatModeRwx
  */
 
 import fs from 'node:fs'
@@ -36,8 +42,9 @@ import path from 'node:path'
 import os from 'node:os'
 import readline from 'node:readline'
 import { CONFIG_PATH } from './config.js'
+import { resolveSecurityAction } from './utils.js'
 
-// 📖 Config file path — matches the path used in config.js (honours the
+// 📖 Config file path - matches the path used in config.js (honours the
 // 📖 --config-dir / FCM_CONFIG_DIR override when set).
 function getConfigPath() {
   return CONFIG_PATH
@@ -47,6 +54,10 @@ function getConfigPath() {
 // 📖 This means: owner can read+write, group and others have no permissions
 const SECURE_MODE = 0o600
 
+// 📖 True on Windows, where chmod is best-effort (read-only bit only) and the
+// 📖 manual fix hint should point at icacls instead of chmod.
+const IS_WINDOWS = process.platform === 'win32'
+
 // 📖 Get file stats including permissions for the config file
 // 📖 Returns null if file doesn't exist
 function getConfigPermissions() {
@@ -80,7 +91,7 @@ export function isConfigSecure() {
 }
 
 // 📖 Fix config file permissions to secure mode (chmod 600)
-// 📖 Returns true if successful, false otherwise
+// 📖 Best-effort on Windows (read-only bit); returns true if successful, false otherwise
 export function fixConfigPermissions() {
   const configPath = getConfigPath()
 
@@ -97,23 +108,21 @@ export function fixConfigPermissions() {
 }
 
 // 📖 Format permission mode in octal (e.g., 0o644 → "644")
-function formatMode(mode) {
+// 📖 Exported for unit tests
+export function formatMode(mode) {
   return (mode & 0o777).toString(8).padStart(3, '0')
 }
 
 // 📖 Format permission mode in human-readable rwx format (e.g., 0o644 → "rw-r--r--")
-function formatModeRwx(mode) {
-  const perms = []
+// 📖 Walks bits 8..0 in groups of three: owner rwx, group rwx, others rwx.
+// 📖 Bit 8 = owner read, bit 7 = owner write, bit 6 = owner exec, and so on.
+// 📖 Exported for unit tests
+export function formatModeRwx(mode) {
   const types = ['r', 'w', 'x']
+  const perms = []
 
-  for (let i = 6; i >= 0; i -= 3) {
-    for (let j = 0; j < 3; j++) {
-      if (mode & (1 << (i + j))) {
-        perms.push(types[j])
-      } else {
-        perms.push('-')
-      }
-    }
+  for (let i = 8; i >= 0; i--) {
+    perms.push(mode & (1 << i) ? types[(8 - i) % 3] : '-')
   }
 
   return [
@@ -123,10 +132,72 @@ function formatModeRwx(mode) {
   ].join(' / ')
 }
 
-// 📖 Check security and prompt for auto-fix if needed
-// 📖 Call this on startup before loading config
+// 📖 Print the insecure-permissions warning (stderr, so --json stdout stays clean)
+function printSecurityWarning(perms) {
+  const currentMode = formatMode(perms.mode)
+  const currentRwx = formatModeRwx(perms.mode)
+
+  console.error('')
+  console.error('⚠️  SECURITY WARNING ⚠️')
+  console.error('')
+  console.error(`Your config file has insecure permissions: ${currentMode} (${currentRwx})`)
+  console.error(`File: ${perms.path}`)
+  console.error('')
+  console.error('This means other users on this system may be able to read your API keys.')
+  console.error('')
+  console.error('Recommended: Fix permissions to 600 (rw-------) - owner read/write only')
+}
+
+// 📖 Print the manual fix hint. On Windows, point at icacls since Node's chmod
+// 📖 only toggles the read-only attribute there.
+function printManualFixHint() {
+  console.error('')
+  if (IS_WINDOWS) {
+    console.error('To fix manually (PowerShell), run:')
+    console.error(`  icacls "${getConfigPath()}" /inheritance:r /grant:r "$env:USERNAME:R,W"`)
+  } else {
+    console.error('To fix manually, run:')
+    console.error(`  chmod 600 ${getConfigPath()}`)
+  }
+  console.error('')
+}
+
+// 📖 Apply the fix and report the outcome. Shared by the prompt path (user said
+// 📖 yes) and the auto-fix path (--fix-permissions / --yes / -y).
+function applyFixAndReport() {
+  const success = fixConfigPermissions()
+
+  if (success) {
+    console.error('')
+    console.error('✅ Permissions fixed! Your API keys are now secure.')
+    console.error('')
+    if (IS_WINDOWS) {
+      console.error('Note: on Windows this is best-effort (read-only bit). See docs for NTFS ACLs.')
+      console.error('')
+    }
+    return { wasSecure: false, wasFixed: true }
+  }
+
+  console.error('')
+  console.error('❌ Failed to fix permissions automatically.')
+  printManualFixHint()
+  return { wasSecure: false, wasFixed: false, error: 'chmod_failed' }
+}
+
+// 📖 Check security and handle the fix flow if needed
+// 📖 Await this BEFORE starting any terminal UI (issue #173) so the warning and
+// 📖 the confirmation prompt are visible and fully resolved before raw mode /
+// 📖 the alternate screen take over.
+//
+// 📖 Options:
+//   autoFix       - true when --fix-permissions / --yes / -y was passed: apply the
+//                   fix without asking
+//   promptAllowed - false on daemon/web/JSON surfaces: never prompt there, at most
+//                   warn on stderr
+//   stdinIsTTY    - override the stdin TTY detection (tests); defaults to real detection
+//
 // 📖 Returns: { wasSecure: boolean, wasFixed: boolean, error?: string }
-export function checkConfigSecurity() {
+export async function checkConfigSecurity(options = {}) {
   const perms = getConfigPermissions()
 
   // 📖 No file yet = nothing to check
@@ -139,24 +210,38 @@ export function checkConfigSecurity() {
     return { wasSecure: true, wasFixed: false }
   }
 
-  // 📖 Security issue detected! Show warning and offer fix.
-  const currentMode = formatMode(perms.mode)
-  const currentRwx = formatModeRwx(perms.mode)
+  // 📖 Pure gate (see utils.js): decides auto-fix vs prompt vs warn-only.
+  const action = resolveSecurityAction({
+    configExists: true,
+    isSecure: false,
+    autoFixRequested: options.autoFix === true,
+    stdinIsTTY: options.stdinIsTTY ?? (process.stdin?.isTTY === true),
+    promptAllowed: options.promptAllowed !== false,
+  })
 
-  console.error('')
-  console.error('⚠️  SECURITY WARNING ⚠️')
-  console.error('')
-  console.error(`Your config file has insecure permissions: ${currentMode} (${currentRwx})`)
-  console.error(`File: ${perms.path}`)
-  console.error('')
-  console.error('This means other users on this system may be able to read your API keys.')
-  console.error('')
-  console.error('Recommended: Fix permissions to 600 (rw-------) — owner read/write only')
+  if (action === 'none') {
+    return { wasSecure: true, wasFixed: false }
+  }
+
+  // 📖 Security issue detected! Print the warning first so it is on screen
+  // 📖 no matter which path follows.
+  printSecurityWarning(perms)
+
+  if (action === 'auto-fix') {
+    return applyFixAndReport()
+  }
+
+  if (action === 'warn-only') {
+    console.error('Running non-interactively (piped stdin or daemon/web mode), so skipping the prompt.')
+    printManualFixHint()
+    return { wasSecure: false, wasFixed: false, error: 'non_interactive' }
+  }
 
   return promptSecurityFix()
 }
 
 // 📖 Interactive prompt asking user if they want to auto-fix
+// 📖 Only reached on a real interactive TTY (gated in checkConfigSecurity)
 // 📖 Returns: { wasSecure: boolean, wasFixed: boolean, error?: string }
 async function promptSecurityFix() {
   const rl = readline.createInterface({
@@ -165,37 +250,22 @@ async function promptSecurityFix() {
   })
 
   try {
-    const answer = await new Promise((resolve) => {
+    const rawAnswer = await new Promise((resolve) => {
       rl.question('Fix permissions automatically? (Y/n): ', resolve)
     })
 
     rl.close()
 
+    // 📖 Normalise: readline can resolve with undefined when stdin closes mid-prompt
+    const answer = String(rawAnswer ?? '').trim().toLowerCase()
+
     // 📖 Default to yes if user just presses Enter
-    if (answer.toLowerCase() === 'y' || answer === '') {
-      const success = fixConfigPermissions()
-
-      if (success) {
-        console.error('')
-        console.error('✅ Permissions fixed! Your API keys are now secure.')
-        console.error('')
-        return { wasSecure: false, wasFixed: true }
-      } else {
-        console.error('')
-        console.error('❌ Failed to fix permissions automatically.')
-        console.error('')
-        console.error('Run this command manually:')
-        console.error(`  chmod 600 ${getConfigPath()}`)
-        console.error('')
-        return { wasSecure: false, wasFixed: false, error: 'chmod_failed' }
-      }
+    if (answer === 'y' || answer === '') {
+      return applyFixAndReport()
     } else {
       console.error('')
       console.error('⚠️  Permissions not fixed. Your API keys may be at risk.')
-      console.error('')
-      console.error('To fix later, run:')
-      console.error(`  chmod 600 ${getConfigPath()}`)
-      console.error('')
+      printManualFixHint()
       return { wasSecure: false, wasFixed: false, error: 'user_declined' }
     }
   } catch (err) {
@@ -203,10 +273,7 @@ async function promptSecurityFix() {
     // 📖 If we can't prompt (e.g., non-interactive TTY), just warn and continue
     console.error('')
     console.error('⚠️  Unable to prompt for permission fix (non-interactive terminal?)')
-    console.error('')
-    console.error('To fix manually, run:')
-    console.error(`  chmod 600 ${getConfigPath()}`)
-    console.error('')
+    printManualFixHint()
     return { wasSecure: false, wasFixed: false, error: 'no_tty' }
   }
 }

package/src/core/sync-set.js

@@ -192,7 +192,7 @@ function buildHeaders(providerKey, apiKey) {
     'Content-Type': 'application/json',
     Authorization: `Bearer ${apiKey}`,
   }
-  if (providerKey === 'openrouter') {
+  if (providerKey === 'openrouter' || providerKey === 'orcarouter') {
     headers['HTTP-Referer'] = 'https://github.com/vava-nessa/free-coding-models'
     headers['X-Title'] = 'free-coding-models'
   }

package/src/core/tool-launchers.js

@@ -50,6 +50,7 @@ import { PROVIDER_METADATA } from './provider-metadata.js'
 import { resolveToolBinaryPath } from './tool-bootstrap.js'
 import { ensureDir, readJson, writeJson } from './shared-helpers.js'
 import { parseContextWindow } from './endpoint-installer.js'
+import { resolveCloudflareUrl } from './ping.js'
 
 const OPENAI_COMPAT_ENV_KEYS = [
   'OPENAI_API_KEY',
@@ -108,10 +109,15 @@ function backupIfExists(filePath) {
 function getProviderBaseUrl(providerKey) {
   const url = sources[providerKey]?.url
   if (!url) return null
-  return url
+  let resolvedUrl = url
     .replace(/\/chat\/completions$/i, '')
     .replace(/\/responses$/i, '')
     .replace(/\/predictions$/i, '')
+  // 📖 Cloudflare uses account_id in URL - resolve from CLOUDFLARE_ACCOUNT_ID env var
+  if (providerKey === 'cloudflare') {
+    resolvedUrl = resolveCloudflareUrl(resolvedUrl)
+  }
+  return resolvedUrl
 }
 
 function deleteEnvKeys(env, keys) {
@@ -579,9 +585,9 @@ export function writeZCodeConfig(model, config, paths = getDefaultToolPaths()) {
 
   const providerKey = model.providerKey || 'nvidia'
   const apiKey = getApiKey(config, providerKey)
-  const baseUrl = sources[providerKey]?.url
-    ? sources[providerKey].url.replace(/\/chat\/completions$/i, '').replace(/\/responses$/i, '').replace(/\/predictions$/i, '')
-    : null
+  // 📖 Use getProviderBaseUrl so Cloudflare's {account_id} placeholder is resolved
+  // 📖 (raw sources[].url would leave it literal and ZCode would fail on Cloudflare models).
+  const baseUrl = getProviderBaseUrl(providerKey)
   const providerId = `fcm-${providerKey}`
   const providerLabel = `FCM ${sources[providerKey]?.name || providerKey}`
 
@@ -838,7 +844,11 @@ export function prepareExternalToolLaunch(mode, model, config, options = {}) {
   }
 
   if (mode === 'goose') {
-    const gooseBaseUrl = sources[model.providerKey]?.url || baseUrl || ''
+    // 📖 Always use the resolved provider base URL from buildToolEnv (getProviderBaseUrl),
+    // 📖 which substitutes Cloudflare's {account_id} placeholder via resolveCloudflareUrl.
+    // 📖 Using the raw sources[].url would leave the literal {account_id} in the Goose
+    // 📖 provider config, so Goose would POST to /accounts/{account_id}/... and 400.
+    const gooseBaseUrl = baseUrl
     const gooseModelId = resolveLauncherModelId(model)
     const result = writeGooseConfig({ ...model, modelId: gooseModelId }, apiKey, gooseBaseUrl, model.providerKey, paths)
     env.GOOSE_PROVIDER = `fcm-${model.providerKey}`

package/src/core/utils.js

@@ -409,6 +409,30 @@ export function filterByTier(results, tierLetter) {
   return results.filter(r => allowed.includes(r.tier))
 }
 
+// 📖 PROBE_FAILED_STATUSES: row health states that count as "failed" for the
+// 📖 Shift+P re-probe action (issue #168). Covers the errors a user actually sees
+// 📖 in the table: dead endpoints (404/410/5xx/ERR → 'down'), rate limits
+// 📖 (429 → 'down'), rejected keys ('auth_error') and network timeouts.
+// 📖 'noauth' is deliberately excluded: those rows have no API key, so an
+// 📖 authenticated probe cannot even run for them.
+export const PROBE_FAILED_STATUSES = new Set(['down', 'timeout', 'auth_error'])
+
+// 📖 isProbeFailedRow: True when a single result row is currently showing an
+// 📖 error state worth re-probing. Hidden rows are skipped on purpose: Shift+P
+// 📖 re-probes what the user can SEE failing, not rows the probe already hid.
+export function isProbeFailedRow(row) {
+  return !!row && !row.hidden && PROBE_FAILED_STATUSES.has(row.status)
+}
+
+// 📖 selectProbeFailedRows: Filter a results array down to the rows that are
+// 📖 currently failing (auth fail / 429 / 404 / timeout). Pure helper used by
+// 📖 the TUI Shift+P "re-probe failed rows only" action (issue #168) so users
+// 📖 can retry 1-2 flaky providers without burning quota on the whole list.
+export function selectProbeFailedRows(results) {
+  if (!Array.isArray(results)) return []
+  return results.filter(isProbeFailedRow)
+}
+
 // 📖 findBestModel: Pick the single best model from a results array.
 // 📖 Used by --fiable mode to output the most reliable model after 10s of analysis.
 //
@@ -460,6 +484,7 @@ export function findBestModel(results) {
 //     --daemon, --daemon-bg, --daemon-stop,
 //     --daemon-status, --no-telemetry, --json, --help/-h (case-insensitive)
 //     --playground / playground subcommand (open the in-TUI chat playground)
+//     --fix-permissions / --yes / -y (auto-fix config permissions without prompting)
 //   - Value flag: --tier <letter> (the next non-flag arg is the tier value)
 //   - Probe-cache flags (t1):
 //     --reprobe / --no-cache (boolean) — force-rebuild the probe cache this run
@@ -533,7 +558,8 @@ export function parseArgs(argv) {
   if (configDirValueIdx !== -1) skipIndices.add(configDirValueIdx)
 
   for (const [i, arg] of args.entries()) {
-    if (arg.startsWith('--') || arg === '-h') {
+    // 📖 -y is a boolean flag (security auto-fix), never an API key
+    if (arg.startsWith('--') || arg === '-h' || arg === '-y') {
       flags.push(arg.toLowerCase())
     } else if (skipIndices.has(i)) {
       // 📖 Skip — this is a value for --tier, not an API key
@@ -577,6 +603,11 @@ export function parseArgs(argv) {
   const daemonStopMode = flags.includes('--daemon-stop')
   const daemonStatusMode = flags.includes('--daemon-status')
 
+  // 📖 --fix-permissions / --yes / -y - auto-answer "yes" to the config-permission
+  // 📖 security prompt (chmod 600, best-effort on Windows) so scripts, CI and
+  // 📖 non-interactive terminals never hang on a hidden prompt. Issue #173.
+  const fixPermissionsMode = flags.includes('--fix-permissions') || flags.includes('--yes') || flags.includes('-y')
+
   // 📖 --sync-set [name] — auto-discover and populate a router set with best available models
   const syncSetMode = flags.includes('--sync-set')
   const syncSetName = syncSetValueIdx !== -1 ? args[syncSetValueIdx] : null
@@ -686,9 +717,65 @@ export function parseArgs(argv) {
     clearRuntimeMode,
     // 📖 Config location flag — see src/core/config.js getConfigDir()
     configDir: configDirValueIdx !== -1 ? args[configDirValueIdx] : null,
+    // 📖 Security auto-fix flag - see src/core/security.js checkConfigSecurity()
+    fixPermissionsMode,
   }
 }
 
+// ─── Config Security Gating (issue #173) ─────────────────────────────────────
+
+// 📖 resolveSecurityAction: pure decision helper that tells the startup security
+// 📖 check what it should do about insecure config file permissions.
+//
+// 📖 Why: the security warning + "Fix permissions automatically?" prompt used to
+// 📖 run un-awaited while the TUI entered raw mode / the alternate screen, so the
+// 📖 prompt was invisible (worst on Windows) and the app looked frozen. This gate
+// 📖 guarantees: never prompt without an interactive surface, never prompt a
+// 📖 daemon/web/JSON surface, and always auto-fix when a yes-flag is passed.
+//
+// 📖 Params:
+//   configExists     - does the config file exist (no file = nothing to secure)
+//   isSecure         - are permissions already 0600
+//   autoFixRequested - user passed --fix-permissions / --yes / -y
+//   stdinIsTTY       - is stdin an interactive terminal
+//   promptAllowed    - is this an interactive surface (TUI)? false for daemon/web/JSON
+//
+// 📖 Returns one of: 'none' | 'auto-fix' | 'warn-only' | 'prompt'
+export function resolveSecurityAction({ configExists, isSecure, autoFixRequested, stdinIsTTY, promptAllowed }) {
+  if (!configExists || isSecure) return 'none'
+  if (autoFixRequested) return 'auto-fix'
+  if (!stdinIsTTY || !promptAllowed) return 'warn-only'
+  return 'prompt'
+}
+
+// 📖 detectTerminalCapabilities: PURE terminal capability probe for TUI overlays.
+// 📖 WHY: basic server consoles (IPMI/KVM viewers, ASPEED framebuffer, serial
+// 📖 terminals) often run 80x24 or smaller with no or limited color support, and
+// 📖 the palette/overlays must degrade instead of overflowing or painting garbage.
+// 📖 Everything is injected by the caller (env, size, TTY) so tests never touch
+// 📖 process.env and the function stays deterministic.
+//
+// 📖 Rules:
+//   - FORCE_COLOR wins over NO_COLOR (same precedence chalk uses).
+//   - NO_COLOR (non-empty, per no-color.org spec) disables color.
+//   - Not a TTY, TERM missing / "dumb" / "unknown" disables color, unless
+//     COLORTERM is set (some terminals export only COLORTERM).
+//   - compact = size too tight for the roomy overlay layout (cols < 90 or rows < 24,
+//     thresholds chosen so a plain 80x24 console gets the space-saving layout).
+//
+// 📖 Returns { colorSupported: boolean, compact: boolean }
+export function detectTerminalCapabilities({ env = {}, cols = 80, rows = 24, isTTY = true } = {}) {
+  const term = String(env.TERM ?? '').trim().toLowerCase()
+  const colorterm = String(env.COLORTERM ?? '').trim().toLowerCase()
+  const force = env.FORCE_COLOR
+  const forceOn = force !== undefined && force !== '' && force !== '0' && force !== 'false'
+  const noColor = env.NO_COLOR !== undefined && env.NO_COLOR !== ''
+  const termUsable = term !== '' && term !== 'dumb' && term !== 'unknown'
+  const colorSupported = forceOn || (!noColor && isTTY !== false && (termUsable || colorterm !== ''))
+  const compact = Math.floor(cols) < 90 || Math.floor(rows) < 24
+  return { colorSupported, compact }
+}
+
 // ─── Smart Recommend — Scoring Engine ─────────────────────────────────────────
 
 // 📖 Task types for the Smart Recommend questionnaire.