free-coding-models 0.5.81 → 0.5.84

package/README.md

@@ -182,15 +182,16 @@ A large catalog of coding models from 20+ active providers, ranked by practical
 | 11 | [ZAI](https://z.ai) | 7 | S | Free Flash models only | `ZAI_API_KEY` |
 | 12 | [Scaleway](https://console.scaleway.com/iam/api-keys) | 15 | S+ → B | 1M free tokens | `SCALEWAY_API_KEY` |
 | 13 | [Alibaba DashScope](https://modelstudio.console.alibabacloud.com) | 23 | S+ → A+ | 1M free tokens/model, Singapore, 90 days | `DASHSCOPE_API_KEY` |
-| 14 | [OpenCode Zen](https://opencode.ai/zen) | 5 | S+ → A | Free with OpenCode account | Zen models ✨ |
+| 14 | [OpenCode Zen](https://opencode.ai/zen) | 7 | S+ → B+ | Free with OpenCode account | Zen models ✨ |
 | 15 | [Kilo](https://kilo.ai) | 2 | A+ | Free auto-router works without a key | optional `KILO_API_KEY` |
-| 16 | [LLM7](https://llm7.io) | 5 | S+ → B+ | Shared free tier, optional free token | optional `LLM7_API_KEY` |
+| 16 | [LLM7](https://llm7.io) | 4 | S+ → A- | Shared free tier, optional free token | optional `LLM7_API_KEY` |
 | 17 | [Routeway](https://routeway.ai) | 10 | S+ → C | Explicit `:free` zero-price models | `ROUTEWAY_API_KEY` |
 | 18 | [Novita AI](https://novita.ai) | 0 | - | No zero-price models currently | `NOVITA_API_KEY` |
 | 19 | [Ollama Cloud](https://ollama.com/pricing) | 17 | S+ → A | Free cloud usage with session/weekly limits | `OLLAMA_API_KEY` |
 | 20 | [Pollinations AI](https://enter.pollinations.ai) ⚠️ experimental | 10 | S+ → B+ | Daily Pollen grants, free tier via Pollen (see note below) | `POLLINATIONS_API_KEY` |
 | 21 | [SiliconFlow](https://cloud.siliconflow.cn/account/ak) | 3 | A → B+ | 3 models @ $0, 1000 RPM (phone SMS required) | `SILICONFLOW_API_KEY` |
 | 22 | [Requesty](https://app.requesty.ai/api-keys) | 12 | S+ → C | 200 req/day free, no card (4x OpenRouter) | `REQUESTY_API_KEY` |
+| 23 | [OrcaRouter](https://www.orcarouter.ai) | 3 | S+ → A+ | Free Hacker tier · 3 $-0 models, zero token markup | `ORCAROUTER_API_KEY` |
 
 > **Pollinations Pollen, c'est quoi ?** Pollinations ne facture pas en $ mais en **Pollen** (≈ $1). Pas besoin d'acheter : tu recois du Pollen **gratuit chaque jour** selon ton tier seed/flower/nectar via quests (star le repo `pollinations/pollinations` sur GitHub, aider sur un issue). Si ton solde affiche `0.0000` sur `enter.pollinations.ai`, tout `MISS` (prompt non cache) retourne `402 PAYMENT_REQUIRED` ("Insufficient balance ~0.0001 pollen") et le ping affichera `402`. Un `HIT` Cloudflare cache peut encore passer en `200` meme avec 0 Pollen mais ce n'est pas fiable. Verifie ton solde sur `enter.pollinations.ai` -> API Keys, complete une quest et attends le grant quotidien a minuit UTC. **Note : integration Pollinations encore experimentale et non confirmee comme stable, le systeme Pollen peut changer.**
 > **SiliconFlow & Requesty** : integrations verifiees le 2026-08-24 via `/v1/models` live et docs officielles, free tiers recurrents confirmes sans Pollen.
@@ -294,6 +295,9 @@ Press **`G`** to cycle **Auto → Dark → Light**. Recolors the full interface
 | **`;`** | Open the **Playground** chat overlay (chat with the FCM router) |
 | **`Ctrl+A`** | Run an AI Speed Test for the selected model |
 | **`Ctrl+U`** | Run the Global AI Speed Test (real provider requests) |
+| **`Shift+P`** | Re-probe failed rows only (auth fail / 429 / 404 / timeout) - no whole-list rescan |
+| **`Ctrl+Shift+P`** | Probe all configured models (404/410 check, auto-hides broken ones) |
+| **`Space`** | Expand the selected row: 2-line detail with provider, endpoint URL and the full model ID (press again or move the cursor to collapse) |
 | `R/S/C/M/O/L/A/H/V/B/U` | Sort by Rank / SWE / ContexT / Model / Origin / Last ping / Avg ping / Health / Verdict / staBility / Uptime |
 | `W` | Sort by real-world score (`Real` column — see [Runtime telemetry](#-runtime-telemetry-real-world-scores)) |
 | `Shift+W` | Open the Runtime Report overlay (per-model breakdown + recent calls) |
@@ -413,6 +417,7 @@ services:
       FREE_CODING_MODELS_TELEMETRY: "0"
       FCM_HOST: "0.0.0.0"
       OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
+      ORCAROUTER_API_KEY: ${ORCAROUTER_API_KEY:-}
     volumes:
       - fcm-data:/home/fcm
 volumes:
@@ -564,7 +569,7 @@ On first start the daemon auto-creates a `fast-coding` set from your configured
 | 🟠 **Auth error** | 401/403 — your API key is wrong for this model |
 | ⚪ **Deprecated** | Removed from the catalog — will be replaced |
 
-**3. Failover order** — models are tried in priority order; a `Recovering` / `Down` / `Auth error` model is skipped and the request goes to the next healthy one. If *all* fail, you get a `503` with a `models_tried` list in the body for debugging.
+**3. Failover order (family preserving)** — models are tried in priority order; a `Recovering` / `Down` / `Auth error` model is skipped and the request goes to the next healthy one. When a model fails, the router first looks for the **same model family on another provider** (e.g. `nvidiaNim/deepseek-v4-pro` down → `sambanova/DeepSeek-V3.1` next), so your coding assistant keeps the same model behaviour mid-conversation instead of silently switching to a different family. If no same-family alternative is healthy, it falls back to the plain priority order. Families covered: Claude, DeepSeek, Gemini, GPT, Nemotron, Llama, MiniMax, Qwen, Kimi, GLM, Mistral, OpenAI o-series. The toggle lives on the Router Dashboard's set panel (**Family failover: on/off**, on by default, stored per set as `familyFailover`), and family hops are tagged `family` in the request log of both the TUI and Web dashboard. If *all* fail, you get a `503` with a `models_tried` list in the body for debugging.
 
 **4. Auto-heal (on by default)** — at daemon start, any model in `Auth error` or `Deprecated` is swapped for a working alternative (same provider first, then cross-provider). The first time you manually add/remove/reorder a model, auto-heal switches off and your choices are preserved — so a new user with a half-broken key set lands on a usable default set by the time the dashboard renders.
 
@@ -679,6 +684,7 @@ Flags combine freely in any order. Run `free-coding-models --help` to print the
 | `--check-drift` | Diff `sources.js` against `models.dev`; exit 1 on mismatch |
 | `--no-telemetry` | Disable anonymous telemetry for this run |
 | `--config-dir <dir>` | Store `config.json` + `backups/` in `<dir>` (e.g. `--config-dir ~/.config/free-coding-models`) |
+| `--fix-permissions` / `--yes` / `-y` | Auto-fix insecure config file permissions (chmod 600) without prompting; never asked on piped stdin, daemon, web, or `--json` runs |
 
 **Tool launchers** — start the TUI pre-configured for a tool, then `Enter` writes the model into that tool's config and launches it:
 
@@ -902,6 +908,8 @@ A: Yes — see [`sources.js`](./sources.js) for the model catalog format.
     <td align="center" width="120"><a href="https://github.com/Muhammad95959"><img src="https://avatars.githubusercontent.com/u/75130655?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="Muhammad95959"></a></td>
     <td align="center" width="120"><a href="https://github.com/FaintFlower"><img src="https://avatars.githubusercontent.com/u/310248465?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="FaintFlower"></a></td>
     <td align="center" width="120"><a href="https://github.com/lehneres"><img src="https://avatars.githubusercontent.com/u/7437288?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="lehneres"></a></td>
+    <td align="center" width="120"><a href="https://github.com/ia-S-on"><img src="https://avatars.githubusercontent.com/u/200600946?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="ia-S-on"></a></td>
+    <td align="center" width="120"><a href="https://github.com/bangla24bdrang-lab"><img src="https://avatars.githubusercontent.com/u/321290409?v=4&s=80" width="80" height="80" style="border-radius:50%" alt="bangla24bdrang-lab"></a></td>
   </tr>
   <tr>
     <td align="center"><a href="https://github.com/vava-nessa"><sub><b>vava-nessa</b></sub></a></td>
@@ -917,18 +925,26 @@ A: Yes — see [`sources.js`](./sources.js) for the model catalog format.
     <td align="center"><a href="https://github.com/Muhammad95959"><sub><b>Muhammad95959</b></sub></a></td>
     <td align="center"><a href="https://github.com/FaintFlower"><sub><b>FaintFlower</b></sub></a></td>
     <td align="center"><a href="https://github.com/lehneres"><sub><b>lehneres</b></sub></a></td>
+    <td align="center"><a href="https://github.com/ia-S-on"><sub><b>ia-S-on</b></sub></a></td>
+    <td align="center"><a href="https://github.com/bangla24bdrang-lab"><sub><b>bangla24bdrang-lab</b></sub></a></td>
   </tr>
   <tr>
-    <td align="center" colspan="13"><sub>🛡️ <b>fan92rus</b> — Windows path traversal fix (<code>path.sep</code>)</sub></td>
+    <td align="center" colspan="15"><sub>🛡️ <b>fan92rus</b> — Windows path traversal fix (<code>path.sep</code>)</sub></td>
   </tr>
   <tr>
-    <td align="center" colspan="13"><sub>📁 <b>Muhammad95959</b> — <code>--config-dir</code> flag & XDG support</sub></td>
+    <td align="center" colspan="15"><sub>📁 <b>Muhammad95959</b> — <code>--config-dir</code> flag & XDG support</sub></td>
   </tr>
   <tr>
-    <td align="center" colspan="13"><sub>⭐ <b>FaintFlower</b> — Star History chart mirror fix</sub></td>
+    <td align="center" colspan="15"><sub>⭐ <b>FaintFlower</b> — Star History chart mirror fix</sub></td>
   </tr>
   <tr>
-    <td align="center" colspan="13"><sub>🚀 <b>lehneres</b> — Proxmox VE installation scripts</sub></td>
+    <td align="center" colspan="15"><sub>🚀 <b>lehneres</b> — Proxmox VE installation scripts</sub></td>
+  </tr>
+  <tr>
+    <td align="center" colspan="15"><sub>🌩️ <b>ia-S-on</b> — Cloudflare <code>{account_id}</code> env resolution in launch paths</sub></td>
+  </tr>
+  <tr>
+    <td align="center" colspan="15"><sub>🐬 <b>bangla24bdrang-lab</b> — OrcaRouter provider integration</sub></td>
   </tr>
 </table>
 
@@ -969,8 +985,9 @@ Curated resources kept **outside** the active CLI catalog — IDE extensions, co
 
 | Provider | Free limits | Notable models |
 |----------|-------------|----------------|
+| [OrcaRouter](https://www.orcarouter.ai) | Free Hacker tier, zero token markup, 3 API keys | DeepSeek V4 Flash (Free), Tencent Hy3 (Free), Qwen3.8 27B (Free) |
 | [OpenRouter](https://openrouter.ai/keys) | 50 req/day, 1K/day with $10 purchase | Qwen3-Coder, Tencent HY3, Laguna, Gemma 4 |
-| [Google AI Studio](https://aistudio.google.com/apikey) | Varies by Gemini model and region | Gemini 3.1 Pro Preview, Gemini 2.5 Flash |
+| [Google AI Studio](https://aistudio.google.com/apikey) | Varies by Gemini model and region | Gemini 3.8 Flash, Gemini 2.5 Pro |
 | [NVIDIA NIM](https://build.nvidia.com) | ~40 RPM | MiniMax M2.7, GLM 5.1, Kimi K2.6 |
 | [GitHub Models](https://models.github.ai) | Depends on GitHub/Copilot tier | GPT-4.1, DeepSeek V3, Llama 4 |
 | [Groq](https://console.groq.com/keys) | 1K–14.4K req/day (model-dependent) | Llama 3.3 70B, Llama 4 Scout, GPT-OSS |

package/bin/free-coding-models.js

@@ -37,6 +37,7 @@ import { ensureFavoritesConfig } from '../src/core/favorites.js';
 import { buildCliHelpText } from '../src/tui/cli-help.js';
 import { ALT_LEAVE } from '../src/core/constants.js';
 import { enforceMandatoryStartupUpdate, isPackageDevMode } from '../src/core/updater.js';
+import { checkConfigSecurity } from '../src/core/security.js';
 import { runApp } from '../src/tui/app.js';
 
 // Global error handlers to ensure terminal is restored if something crashes catastrophically
@@ -155,6 +156,25 @@ async function main() {
     } catch {}
   }
 
+  // 📖 Config security check (issue #173): the insecure-permission warning and its
+  // 📖 "Fix permissions automatically?" prompt must fully resolve BEFORE any surface
+  // 📖 takes over the terminal. It used to run un-awaited inside runApp, so the TUI
+  // 📖 covered the prompt (invisible on Windows) and the app looked frozen.
+  // 📖 Daemon / web dashboard / JSON surfaces pass promptAllowed=false so at most a
+  // 📖 warning + manual hint goes to stderr, and the daemon can never hang on a prompt.
+  // 📖 --fix-permissions / --yes / -y auto-applies chmod 600 (best-effort on Windows).
+  const promptAllowed = !cliArgs.webMode
+    && !cliArgs.jsonMode
+    && !cliArgs.daemonMode
+    && !cliArgs.daemonBackgroundMode
+    && !cliArgs.daemonStopMode
+    && !cliArgs.daemonStatusMode;
+  try {
+    await checkConfigSecurity({ autoFix: cliArgs.fixPermissionsMode, promptAllowed });
+  } catch {
+    // 📖 A security-check failure must never block the app from starting.
+  }
+
   // 📖 Standalone web dashboard: same full-catalog ping UI as the TUI, served
   // 📖 locally with Socket.IO/SSE/REST realtime updates.
   if (cliArgs.webMode) {

package/changelog/v0.5.82.md

@@ -0,0 +1,23 @@
+# Changelog v0.5.82 - 2026-09-05
+
+### Added
+- 🐬 **New provider: OrcaRouter** (PR #176 by @bangla24bdrang-lab) — zero-markup AI gateway, Free Hacker tier, 3 $-0 models (DeepSeek V4 Flash Free S+, Tencent Hy3 Free S, Qwen3.8 27B Free A+), all verified live on `api.orcarouter.ai/v1/models`. Wired across every surface: TUI, router daemon, benchmark, sync-set, Kilo/OpenCode launchers, key tester, docs and docker-compose (`ORCAROUTER_API_KEY`).
+- 📚 **OpenRouter catalog refresh** (PR #178 by @Muhammad95959): 9 new free models verified live at $0 — MiniMax M2.7, MiniMax M3, GLM-5.2, Nemotron 3 Super ctx fix, Ling 3.0 Flash Fin, Inkling, Inkling Small, Dots 3 Note Preview.
+- 🏗️ **NVIDIA NIM**: Muse Glimmer 30B + Kimi K3 added; Nemotron Nano 30B id fixed to `nvidia/nemotron-nano-3-30b-a3b` (old id confirmed 410 Gone live).
+- 🇨🇳 **SambaNova**: MiniMax M3 added (verified live via `/v1/models`).
+- ✨ **OpenCode Zen**: Laguna S 2.1 Free restored and Ling 3.0 Flash Fin Free added — both present on the live `/v1/models` (66 models checked).
+- 🌐 **Google AI Studio**: Gemini 3.8 Flash added (free tier confirmed on the official pricing page).
+
+### Fixed
+- ☁️ **Cloudflare `{account_id}` in launch paths** (PR #170 by @ia-S-on): the placeholder is now resolved from `CLOUDFLARE_ACCOUNT_ID` in ZCode/Goose config writes and pings (both `{account_id}` and `{$CLOUDFLARE_ACCOUNT_ID}` forms supported, URL-encoded). Fixes 404/400 when launching Cloudflare models in external tools.
+- 🚀 **Release workflow** (PR #177 by @Muhammad95959): publishing steps are skipped cleanly when the `NPM_TOKEN` secret is missing (fork-friendly).
+- 🔍 **LLM7 catalog corrected against the live API**: reverted 9 entries from PR #178 that are paid (`tier=pro`, `usage_based_only`) or nonexistent — glm-5.3, glm-5.3-flash, gemini-3.5-flash-low, gpt-5.4, gpt-5.4-mini, gpt-5.5, gpt-5.6-sol, grok-4.5, grok-4.6. Fixed `gpt-oss:20b` → `gpt-oss` (live ctx 131k). Removed gemini-3.1-flash-lite (now paid). The free turbo tier is exactly: minimax-m2.7, gpt-oss, mistral-Nemo-Instruct-2407, codestral-latest.
+- 🇫🇷 **Scaleway catalog**: reverted 3 unverified removals — Devstral 2 123B, Pixtral 12B and Qwen3 235B are all still Serverless per the official docs (checked 2026-09-05); dropped the false gemma-3-27b-it EOL claim (still served, 40k ctx).
+- 🌐 **Google AI catalog**: restored gemini-2.5-pro and gemini-3-flash-preview (free tier confirmed on the official pricing page); kept the gemini-3.1-pro-preview removal (free tier really is "Not available"); removed gemini-2.0-flash (not on the pricing page).
+- ⚙️ **Cerebras**: removed MiniMax M3 (HTTP 404 "Model does not exist" on live ping). **OpenCode Zen**: removed hy3-free (absent from live `/v1/models`).
+- 🖥️ **Website catalog mirror synced**: `website/src/_fcm-sources/sources.js` had drifted behind main (missing the NIM cleanup, the Cloudflare URL fix and OrcaRouter) — it is now an exact mirror of `sources.js`.
+- 🤖 dependabot: `dependabot/fetch-metadata` v2 → v3 (PR #163).
+
+### Changed
+- 📖 README + website docs: provider counts updated (OpenCode Zen 7, LLM7 4), Google AI notable models refreshed.
+- 🙏 Two new contributors: @ia-S-on and @bangla24bdrang-lab. Welcome!

package/changelog/v0.5.83.md

@@ -0,0 +1,22 @@
+# Changelog v0.5.83 - 2026-09-05
+
+Three community issues fixed in one pass, all focused on day-to-day TUI reliability: a hidden Windows prompt, probe ergonomics, and the command palette on small server consoles.
+
+### Added
+
+- 🔧 `--fix-permissions` (also `--yes` / `-y`): fix insecure config file permissions (chmod 600) without any prompt, ideal for scripts and CI (#173)
+- ⌨️ Shift+P: re-probe ONLY the models currently failing (404 / 410 / 429 / 401...) instead of re-testing the whole list, for quick rescans after an auth blip (#168)
+- ⌨️ Space: expand the selected row into a 2-line detail card showing provider, key status, endpoint URL, full model id, tier, SWE score, context window, last ping and HTTP code. Space again or moving the cursor collapses it (#168)
+- 🖥️ Command palette degrades gracefully: compact layout on small screens, plain-text rendering when the terminal has no color support (NO_COLOR, TERM=dumb, basic KVM consoles) (#169)
+
+### Fixed
+
+- 🪟 Windows: the config permission security warning and its "Fix permissions automatically? (Y/n)" prompt were rendered behind the TUI, making the app look frozen; the check now runs and resolves BEFORE the interactive UI starts (#173)
+- 💥 TUI crash during the 404 probe: a progress-bar accounting bug (RangeError on a negative repeat) could kill the whole process mid-probe (#168)
+- 🎛️ Ctrl+Shift+P was unreachable: the palette intercepted it first; the binding now works and palette commands can never take the TUI down via an unhandled rejection (#168)
+- 📐 Command palette rows overflowed up to 47 columns past the terminal edge on 80-column consoles (truncated mid-word, garbled right border); rows are now composed under a strict ANSI-aware width budget, the panel clamps to any terminal size down to 40x12, and margins are actively cleared (#169)
+
+### Changed
+
+- 📖 Help overlay, README and AGENTS.md key reference updated to document Shift+P, Ctrl+Shift+P and Space
+- 🧹 website: strict-null fixes in the changelog loader (first batch of pre-existing typecheck errors)

package/changelog/v0.5.84.md

@@ -0,0 +1,32 @@
+# Changelog v0.5.84 - 2026-09-05
+
+### Changed
+
+- Full catalog audit of all 23 providers against official docs and live model APIs (2026-09-05): 28 removals, 42 additions, 37 config fixes, 147 models confirmed unchanged. Catalog goes from 208 to 225 models.
+
+Provider by provider:
+
+- **Kilo**: the free gateway exploded from 2 to 19 models. Added MiniMax M3 (80.5% SWE-bench Verified, 1M ctx), Thinking Machines Inkling + Inkling Small (1M ctx), StepFun Step 3.7 Flash, Poolside Laguna S 2.1, NVIDIA Nemotron 3 Ultra + 3 Super + 3.5 Lightning, Cohere North Mini Code, Dots3-Note Preview, MiniMax M2.7 and the OpenRouter free router alias. `kilo-auto/small` is now paid and was removed.
+- **NVIDIA NIM**: removed models that are gone or deprecated (gpt-oss-120b API deprecated 2026-09-02, kimi-k2.6 404, nemotron-nano-3, llama-3.2-11b-vision without endpoint). Added DeepSeek V4 Pro (1M ctx) and Nemotron 3.5 Lightning 30B. kimi-k3 and nemotron-3-super now serve 1M contexts. MiniMax M3 is kept with a deprecation notice (NVIDIA shutdown 2026-09-08).
+- **Scaleway**: applied the July 2026 EOL wave. Removed Devstral 2, Gemma 3 27B and Holo2 (EOL already passed). Qwen3 Coder 30B and Pixtral 12B stay listed with an EOL 2026-10-01 warning since they still answer. The service now bills per token with the first 1M tokens free.
+- **Routeway**: the free catalog was gutted from 13 to 4 models. Kept DeepSeek V4 Flash, MiniMax M2.7 and Muse Glimmer 30B (contexts slashed to 42k/42k/131k) and added Kimi K2.6 as the only new free model. 10 free variants are now paid-only.
+- **Cloudflare Workers AI**: kimi-k2.6, kimi-k2.7-code and glm-5.2 moved behind Workers Paid billing and were removed from the free list. Fixed 7 inflated context windows (docs say 24k to 256k, not 128k). Added qwen3.8-27b (262k ctx) as the only new free coder-usable model.
+- **Qwen / Model Studio**: added the new Qwen3.8 family (qwen3.8-max, qwen3.8-flash, qwen3.8-2.4t-a95b, qwen3.8-27b), each with 1M context and a 1M-token international free quota. All 23 existing models verified unchanged.
+- **Z.ai**: added the new coding-plan flagship GLM-5.3 (1M ctx, released 2026-08-18). Filled in official SWE-bench Verified scores for GLM-4.7 (73.8%) and GLM-4.6 (68.0%).
+- **Mistral**: the three Ministral 3 models now serve 256k context (was 128k). Added Z.ai GLM 5.2 (1M ctx, public preview on La Plateforme).
+- **Groq**: added qwen/qwen3.8-27b preview. Fixed gpt-oss-20b SWE-bench score to the official 60.7%. None of the catalog models are on the deprecation list.
+- **Cerebras**: gemma-4-31b was pulled from free public endpoints on 2026-09-03 and is replaced by qwen-3.8-27b (64k free ctx).
+- **Pollinations**: added 3 anonymous-free models: glm-5.3 (1M ctx), Kimi K2.6 (80.2%) and MiniMax M3 (80.5%).
+- **SiliconFlow**: DeepSeek-R1-Distill-Qwen-7B was delisted. Added DeepSeek-R1-0528-Qwen3-8B, Qwen3.5-4B, Qwen2.5-7B-Instruct and GLM-4-9B-0414. Both surviving models actually serve 131k context, not 32k.
+- **OpenRouter**: fixed 7 wrong context windows against the live API (GLM-5.2 is 256k, not 1M; Inkling models are 1M; MiniMax M2.7 is 192k). Added ling-3.0-flash-sante:free.
+- **Ollama Cloud**: added glm-5.3 and glm-5.3-flash. Fixed context windows for glm-5.2 (976k), minimax-m3 (512k) and gemma4:31b (256k).
+- **Novita**: the empty free catalog is restored with 2 time-limited $0/M models: Ling 3.0 Flash Fin and Ling 3.0 Flash Sante (256k ctx, coding + function calling).
+- **SambaNova**: MiniMax-M3 context is now 1M tokens (was 196k).
+- **Codestral**: context fixed to 256k. Still free via Mistral's Experiment tier (~1B tokens/month).
+- **Requesty**: fixed the model id typo `nvidia/nemotron-nano-3-30b-a3b` to the real `nvidia/nemotron-3-nano-30b-a3b`.
+- **OVHcloud**: added 2 free Qwen3Guard moderation models (beta) and fixed Qwen2.5-VL-72B context to 32k. The chat LLMs are now paid per Mtoken but stay listed for now since they still answer.
+- **googleai, llm7, orcarouter**: verified live and unchanged, nothing to update.
+
+### Fixed
+
+- Tests: the t8 family-failover tests now use `openai/gpt-oss-20b` as NVIDIA primary because gpt-oss-120b was removed from the NVIDIA catalog (deprecated 2026-09-02). The NVIDIA test-model discovery expectations match the new catalog head.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-coding-models",
-  "version": "0.5.81",
+  "version": "0.5.84",
   "description": "Find the fastest coding LLM models in seconds — ping free models from multiple providers, pick the best one for OpenCode, Cursor, or any AI coding assistant.",
   "keywords": [
     "nvidia",
@@ -58,7 +58,7 @@
   ],
   "scripts": {
     "start": "node bin/free-coding-models.js",
-    "test": "node --test test/test.js test/fcm-agent-core.test.js test/patch-openclaw.test.js test/provider-metadata.test.js test/config-permission-hint.test.js test/probe-cache.test.js test/passive-quota.test.js test/runtime-telemetry.test.js test/extended-benchmarks.test.js test/models-dev.test.js test/model-merger.test.js test/config-dir.test.js test/cache-dir.test.js",
+    "test": "node --test test/test.js test/fcm-agent-core.test.js test/patch-openclaw.test.js test/provider-metadata.test.js test/config-permission-hint.test.js test/probe-cache.test.js test/passive-quota.test.js test/runtime-telemetry.test.js test/extended-benchmarks.test.js test/models-dev.test.js test/model-merger.test.js test/config-dir.test.js test/cache-dir.test.js test/model-family.test.js",
     "test:extended-benchmarks": "node --test test/extended-benchmarks.test.js",
     "test:models-dev": "node --test test/models-dev.test.js",
     "update:benchmarks": "node scripts/update-benchmarks.mjs",