free-coding-models 0.5.85 → 0.5.87

package/src/core/telemetry.js

@@ -10,7 +10,7 @@
  *   - PostHog is used for product analytics (`app_start`, `app_use`, and lightweight
  *     `app_action` events covering launches and key product actions).
  *   - Discord webhooks carry anonymous feature requests (J key) and bug reports (I key).
- *   - `isTelemetryEnabled()` checks: CLI flag → env var → default (enabled).
+ *   - `isTelemetryEnabled()` checks: CLI flag → env var → config opt-out → default (enabled).
  *   - `telemetryDebug()` writes to stderr only when FREE_CODING_MODELS_TELEMETRY_DEBUG=1.
  *   - `sendUsageTelemetry()` has a hard 1.2 s timeout so it never blocks startup.
  *
@@ -20,6 +20,8 @@
  *   - FREE_CODING_MODELS_POSTHOG_KEY             — override the PostHog project key
  *   - FREE_CODING_MODELS_POSTHOG_HOST            — override the PostHog host
  *   - POSTHOG_PROJECT_API_KEY / POSTHOG_HOST     — standard PostHog env vars (fallback)
+ *   - FCM_DISCORD_FEATURE_WEBHOOK                - feature request webhook URL
+ *   - FCM_DISCORD_BUG_WEBHOOK                    - bug report webhook URL
  *
  * @functions
  *   → parseTelemetryEnv(value)                    — Convert env string to boolean or null
@@ -63,12 +65,15 @@ const POSTHOG_PROJECT_KEY_DEFAULT = 'phc_5P1n8HaLof6nHM0tKJYt4bV5pj2XPb272fLVigw
 const POSTHOG_HOST_DEFAULT       = 'https://eu.i.posthog.com'
 
 // 📖 Discord feature request webhook configuration (anonymous feedback system).
-const DISCORD_WEBHOOK_URL   = 'https://discord.com/api/webhooks/1476709155992764427/hmnHNtpducvi5LClhv8DynENjUmmg9q8HI1Bx1lNix56UHqrqZf55rW95LGvNJ2W4j7D'
+// 📖 FCM_DISCORD_FEATURE_WEBHOOK: env var holding the feature-request webhook URL.
+// 📖 When unset, the feature request action reports "not configured" instead of posting.
+const DISCORD_WEBHOOK_URL   = (process.env.FCM_DISCORD_FEATURE_WEBHOOK || '').trim()
 const DISCORD_BOT_NAME      = 'TUI - Feature Requests'
 const DISCORD_EMBED_COLOR   = 0x39FF14  // Vert fluo (RGB: 57, 255, 20)
 
 // 📖 Discord bug report webhook configuration (anonymous bug reports).
-const DISCORD_BUG_WEBHOOK_URL  = 'https://discord.com/api/webhooks/1476715954409963743/5cOLf7U_891f1jwxRBLIp2RIP9xYhr4rWtOhipzKKwVdFVl1Bj89X_fB6I_uGXZiGT9E'
+// 📖 FCM_DISCORD_BUG_WEBHOOK: env var holding the bug report webhook URL.
+const DISCORD_BUG_WEBHOOK_URL  = (process.env.FCM_DISCORD_BUG_WEBHOOK || '').trim()
 const DISCORD_BUG_BOT_NAME     = 'TUI Bug Report'
 const DISCORD_BUG_EMBED_COLOR  = 0xFF5733  // Rouge (RGB: 255, 87, 51)
 
@@ -194,7 +199,7 @@ export function getTelemetryTerminal() {
 
 /**
  * 📖 Resolve telemetry effective state with clear precedence:
- * 📖 CLI flag > env var > enabled by default (forced for all users).
+ * 📖 CLI flag > env var > config opt-out > enabled by default.
  * @param {Record<string, unknown>} config
  * @param {{ noTelemetry?: boolean }} cliArgs
  * @returns {boolean}
@@ -204,7 +209,9 @@ export function isTelemetryEnabled(config, cliArgs) {
   const envTelemetry = parseTelemetryEnv(process.env.FREE_CODING_MODELS_TELEMETRY)
   if (envTelemetry !== null) return envTelemetry
   ensureTelemetryConfig(config)
-  return true
+  // 📖 Honor a persisted opt-out (config telemetry.enabled=false) set from the UI;
+  // 📖 CLI flags and FREE_CODING_MODELS_TELEMETRY still override it above.
+  return config.telemetry.enabled !== false
 }
 
 /**
@@ -314,6 +321,9 @@ export async function sendUsageTelemetry(config, cliArgs, payload) {
  * @returns {Promise<{ success: boolean, error: string|null }>}
  */
 export async function sendFeatureRequest(message) {
+  if (!DISCORD_WEBHOOK_URL) {
+    return { success: false, error: 'feedback webhook not configured (set FCM_DISCORD_FEATURE_WEBHOOK)' }
+  }
   try {
     // 📖 Collect anonymous telemetry for context (no personal data)
     const system = getTelemetrySystem()
@@ -361,6 +371,9 @@ export async function sendFeatureRequest(message) {
  * @returns {Promise<{ success: boolean, error: string|null }>}
  */
 export async function sendBugReport(message) {
+  if (!DISCORD_BUG_WEBHOOK_URL) {
+    return { success: false, error: 'feedback webhook not configured (set FCM_DISCORD_BUG_WEBHOOK)' }
+  }
   try {
     // 📖 Collect anonymous telemetry for context (no personal data)
     const system = getTelemetrySystem()

package/src/core/tool-launchers.js

@@ -48,7 +48,7 @@ import { ENV_VAR_NAMES, isWindows } from './provider-metadata.js'
 import { getToolMeta, TOOL_METADATA } from './tool-metadata.js'
 import { PROVIDER_METADATA } from './provider-metadata.js'
 import { resolveToolBinaryPath } from './tool-bootstrap.js'
-import { ensureDir, readJson, writeJson } from './shared-helpers.js'
+import { ensureDir, readJson, writeJson, shellSingleQuote } from './shared-helpers.js'
 import { parseContextWindow } from './endpoint-installer.js'
 import { resolveCloudflareUrl } from './ping.js'
 
@@ -70,9 +70,11 @@ function parseCtxToTokens(ctx) {
   if (!match) return null
   const num = parseFloat(match[1])
   const suffix = match[2].toLowerCase()
-  // 📖 LLM token counts use binary (1024), not decimal (1000).
-  if (suffix === 'k') return Math.round(num * 1024)
-  if (suffix === 'm') return Math.round(num * 1024 * 1024)
+  // 📖 Catalog ctx strings use DECIMAL semantics ("1M" = 1,000,000), matching
+  // 📖 parseContextWindow in endpoint-installer.js. The old 1024 multipliers made
+  // 📖 the two parsers disagree (1048576 vs 1000000) for the same catalog value.
+  if (suffix === 'k') return Math.round(num * 1000)
+  if (suffix === 'm') return Math.round(num * 1000 * 1000)
   return Math.round(num)
 }
 
@@ -414,10 +416,11 @@ function writeOpenHandsEnv(model, apiKey, baseUrl, paths = getDefaultToolPaths()
   const backupPath = backupIfExists(filePath)
   const lines = [
     '# 📖 Managed by free-coding-models',
-    `export OPENAI_API_KEY="${apiKey}"`,
+    // 📖 Single-quote the key so quotes/$()/backticks in it stay literal on `source`.
+    `export OPENAI_API_KEY=${shellSingleQuote(apiKey)}`,
     `export OPENAI_BASE_URL="${baseUrl}"`,
     `export OPENAI_MODEL="${model.modelId}"`,
-    `export LLM_API_KEY="${apiKey}"`,
+    `export LLM_API_KEY=${shellSingleQuote(apiKey)}`,
     `export LLM_BASE_URL="${baseUrl}"`,
     `export LLM_MODEL="openai/${model.modelId}"`,
   ]

package/src/core/updater.js

@@ -31,6 +31,7 @@
  *   → resolveCurrentNpmInstallTarget()   — Detect the npm prefix that owns the active package
  *   → getInstallArgs(pm, version)        — Build correct { bin, args } per package manager
  *   → getManualInstallCmd(pm, version)   — Human-readable install command string for error messages
+ *   → isNewerVersion(remote, local)      - Semver compare: true only when remote is greater
  *   → checkForUpdateDetailed()           — Fetch npm latest with explicit error info
  *   → checkForUpdate()                   — Startup wrapper, returns version string or null
  *   → isPackageDevMode()                 — Detect git/dev checkouts that must not self-update
@@ -38,7 +39,7 @@
  *   → runUpdate(latestVersion)           — Install new version via detected PM + relaunch
  * @exports
  *   detectPackageManager, resolveCurrentNpmInstallTarget, getInstallArgs, getManualInstallCmd,
- *   checkForUpdateDetailed, checkForUpdate, isPackageDevMode,
+ *   isNewerVersion, checkForUpdateDetailed, checkForUpdate, isPackageDevMode,
  *   enforceMandatoryStartupUpdate, runUpdate, fetchLastReleaseDate
  *
  * @see bin/free-coding-models.js — calls checkForUpdate() at startup and runUpdate() on confirm
@@ -232,6 +233,31 @@ export function getManualInstallCmd(pm, version, options = {}) {
   return [bin, ...args].map(shellQuoteArg).join(' ')
 }
 
+/**
+ * 📖 isNewerVersion: dependency-free semver comparison of dotted numeric versions.
+ * 📖 Update availability used to be a string inequality, so a dist-tag rollback
+ * 📖 (remote < local) triggered a pointless "downgrade" install. Only a strictly
+ * 📖 GREATER remote version counts as an update now.
+ * @param {string} remoteVersion
+ * @param {string} localVersion
+ * @returns {boolean} true only when remoteVersion > localVersion
+ */
+export function isNewerVersion(remoteVersion, localVersion) {
+  const parseParts = (v) => String(v ?? '')
+    .trim()
+    .replace(/^v/i, '')
+    .split('.')
+    .map(part => parseInt(part, 10) || 0)
+  const remote = parseParts(remoteVersion)
+  const local = parseParts(localVersion)
+  const len = Math.max(remote.length, local.length)
+  for (let i = 0; i < len; i++) {
+    const diff = (remote[i] || 0) - (local[i] || 0)
+    if (diff !== 0) return diff > 0
+  }
+  return false
+}
+
 /**
  * 📖 checkForUpdateDetailed: Fetch npm latest version with explicit error details.
  * 📖 Used by settings manual-check flow to display meaningful status in the UI.
@@ -242,7 +268,7 @@ export async function checkForUpdateDetailed() {
     const res = await fetch('https://registry.npmjs.org/free-coding-models/latest', { signal: AbortSignal.timeout(5000) })
     if (!res.ok) return { latestVersion: null, error: `HTTP ${res.status}` }
     const data = await res.json()
-    if (data.version && data.version !== LOCAL_VERSION) return { latestVersion: data.version, error: null }
+    if (data.version && isNewerVersion(data.version, LOCAL_VERSION)) return { latestVersion: data.version, error: null }
     return { latestVersion: null, error: null }
   } catch (error) {
     const message = error instanceof Error ? error.message : 'Unknown error'

package/src/core/utils.js

@@ -140,8 +140,13 @@ export const NEW_MODELS = new Set([
 ]);
 
 export const getVerdict = (r) => {
+  // 📖 401/403 rows can still carry fast measurable pings, but calling them
+  // 📖 "Perfect" let --fiable / findBestModel recommend a model that cannot serve
+  // 📖 a single authenticated request. Auth-failing rows always get the
+  // 📖 least-trustworthy health label instead.
+  if (r.status === 'auth_error' || r.status === 'noauth') return 'Not Active'
   const avg = getAvg(r)
-  const wasUpBefore = r.pings.length > 0 && r.pings.some(p => p.code === '200')
+  const wasUpBefore = (r.pings || []).length > 0 && r.pings.some(p => p.code === '200')
 
   if (r.httpCode === '429') return 'Overloaded'
   if ((r.status === 'timeout' || r.status === 'down') && wasUpBefore) return 'Unstable'
@@ -200,9 +205,10 @@ export const getVerdict = (r) => {
 // 📖 Displayed as "Up%" column in the TUI — e.g., "85%" means 85% of pings got HTTP 200.
 // 📖 This metric is useful for identifying models that are technically "up" but flaky.
 export const getUptime = (r) => {
-  if (r.pings.length === 0) return 0
-  const successful = r.pings.filter(p => p.code === '200').length
-  return Math.round((successful / r.pings.length) * 100)
+  const pings = r.pings || []
+  if (pings.length === 0) return 0
+  const successful = pings.filter(p => p.code === '200').length
+  return Math.round((successful / pings.length) * 100)
 }
 
 // 📖 getP95: Calculate the 95th percentile latency from measurable pings (HTTP 200/401).
@@ -303,11 +309,13 @@ export const sortResults = (results, sortColumn, sortDirection, { benchmarkResul
         cmp = TIER_ORDER.indexOf(a.tier) - TIER_ORDER.indexOf(b.tier)
         break
       case 'origin':
-        // 📖 Sort by providerKey (or fallback to modelId prefix) for multi-provider support
-        cmp = (a.providerKey ?? 'nvidia').localeCompare(b.providerKey ?? 'nvidia')
+        // 📖 Sort by providerKey (or fallback to modelId prefix) for multi-provider support.
+        // 📖 Explicit 'en' locale: the default is ICU-dependent, so row order would
+        // 📖 otherwise vary between machines.
+        cmp = (a.providerKey ?? 'nvidia').localeCompare(b.providerKey ?? 'nvidia', 'en')
         break
       case 'model':
-        cmp = a.label.localeCompare(b.label)
+        cmp = a.label.localeCompare(b.label, 'en')
         break
       case 'ping': {
         // 📖 Sort by LAST ping only — gives a real-time "right now" snapshot
@@ -333,7 +341,7 @@ export const sortResults = (results, sortColumn, sortDirection, { benchmarkResul
         break
       }
       case 'condition':
-        cmp = a.status.localeCompare(b.status)
+        cmp = a.status.localeCompare(b.status, 'en')
         break
       case 'verdict': {
         // 📖 Sort by verdict order — "Perfect" first, "Pending" last
@@ -391,6 +399,10 @@ export const sortResults = (results, sortColumn, sortDirection, { benchmarkResul
         break
     }
 
+    // 📖 Non-finite differences (e.g. Infinity - Infinity) collapse to 0: a NaN
+    // 📖 comparator result makes sort order machine-dependent and unstable.
+    if (!Number.isFinite(cmp)) cmp = 0
+
     // 📖 Flip comparison for descending order
     return sortDirection === 'asc' ? cmp : -cmp
   })
@@ -485,7 +497,7 @@ export function findBestModel(results) {
 //     --daemon-status, --no-telemetry, --json, --help/-h (case-insensitive)
 //     --playground / playground subcommand (open the in-TUI chat playground)
 //     --fix-permissions / --yes / -y (auto-fix config permissions without prompting)
-//   - Value flag: --tier <letter> (the next non-flag arg is the tier value)
+//   - Value flag: --tier <letter> (also accepts the --tier=S equals form)
 //   - Probe-cache flags (t1):
 //     --reprobe / --no-cache (boolean) — force-rebuild the probe cache this run
 //     --probe-ttl <ms> (value)          — override the 24h default TTL
@@ -500,62 +512,56 @@ export function findBestModel(results) {
 //     reprobeMode, probeTtlMs, showBrokenMode }
 //
 // 📖 Note: apiKey may be null here — the main CLI falls back to env vars and saved config.
+
+// 📖 findValueFlag: collect every occurrence of a value flag, in both "--flag value"
+// 📖 and "--flag=value" forms. Equals form used to be silently ignored (the lookup
+// 📖 only matched the bare flag), and repeated flags used to leak their extra values
+// 📖 into the positional API-key slot because only the first index was marked used.
+// 📖 Returns { indices, values }: indices point at the VALUE args (for the equals
+// 📖 form, at the "--flag=value" arg itself, which is already treated as a flag).
+function findValueFlag(args, flag) {
+  const indices = []
+  const values = []
+  for (const [i, arg] of args.entries()) {
+    const lower = arg.toLowerCase()
+    if (lower.startsWith(`${flag}=`)) {
+      indices.push(i)
+      values.push(arg.slice(flag.length + 1))
+    } else if (lower === flag && args[i + 1] && !args[i + 1].startsWith('--')) {
+      indices.push(i + 1)
+      values.push(args[i + 1])
+    }
+  }
+  return { indices, values }
+}
+
+// 📖 First usable value of a flag, or null when the flag was not passed (or was
+// 📖 passed with an empty value like "--tier=").
+function firstFlagValue(found) {
+  return found.values.length > 0 && found.values[0] !== '' ? found.values[0] : null
+}
+
 export function parseArgs(argv) {
   const args = argv.slice(2)
   let apiKey = null
   const flags = []
 
-  // 📖 Determine which arg indices are consumed by --tier so we skip them
-  const tierIdx = args.findIndex(a => a.toLowerCase() === '--tier')
-  const tierValueIdx = (tierIdx !== -1 && args[tierIdx + 1] && !args[tierIdx + 1].startsWith('--'))
-    ? tierIdx + 1
-    : -1
-
-  // New value flags
-  const sortIdx = args.findIndex(a => a.toLowerCase() === '--sort')
-  const sortValueIdx = (sortIdx !== -1 && args[sortIdx + 1] && !args[sortIdx + 1].startsWith('--'))
-    ? sortIdx + 1
-    : -1
-
-  const originIdx = args.findIndex(a => a.toLowerCase() === '--origin')
-  const originValueIdx = (originIdx !== -1 && args[originIdx + 1] && !args[originIdx + 1].startsWith('--'))
-    ? originIdx + 1
-    : -1
-
-  const pingIntervalIdx = args.findIndex(a => a.toLowerCase() === '--ping-interval')
-  const pingIntervalValueIdx = (pingIntervalIdx !== -1 && args[pingIntervalIdx + 1] && !args[pingIntervalIdx + 1].startsWith('--'))
-    ? pingIntervalIdx + 1
-    : -1
-
-  // 📖 --probe-ttl <ms> — override the 24h probe-cache TTL (power users / debugging)
-  const probeTtlIdx = args.findIndex(a => a.toLowerCase() === '--probe-ttl')
-  const probeTtlValueIdx = (probeTtlIdx !== -1 && args[probeTtlIdx + 1] && !args[probeTtlIdx + 1].startsWith('--'))
-    ? probeTtlIdx + 1
-    : -1
-
-  // 📖 --sync-set [name] — auto-discover and live-probe models into a named router set
-  const syncSetIdx = args.findIndex(a => a.toLowerCase() === '--sync-set')
-  const syncSetValueIdx = (syncSetIdx !== -1 && args[syncSetIdx + 1] && !args[syncSetIdx + 1].startsWith('--'))
-    ? syncSetIdx + 1
-    : -1
-
-  // 📖 --config-dir <dir> — override where FCM's config files (config.json + backups/)
-  // 📖 live. Any directory works, e.g. --config-dir ~/.config/free-coding-models for the
-  // 📖 XDG layout. The bin entry point persists this as FCM_CONFIG_DIR before imports.
-  const configDirIdx = args.findIndex(a => a.toLowerCase() === '--config-dir')
-  const configDirValueIdx = (configDirIdx !== -1 && args[configDirIdx + 1] && !args[configDirIdx + 1].startsWith('--'))
-    ? configDirIdx + 1
-    : -1
+  // 📖 Resolve all value flags up front so every occurrence (space or equals form)
+  // 📖 can be marked consumed before the positional API-key scan runs.
+  const tierFlag = findValueFlag(args, '--tier')
+  const sortFlag = findValueFlag(args, '--sort')
+  const originFlag = findValueFlag(args, '--origin')
+  const pingIntervalFlag = findValueFlag(args, '--ping-interval')
+  const probeTtlFlag = findValueFlag(args, '--probe-ttl')
+  const syncSetFlag = findValueFlag(args, '--sync-set')
+  const configDirFlag = findValueFlag(args, '--config-dir')
+  const driftThresholdFlag = findValueFlag(args, '--drift-threshold')
 
   // 📖 Set of arg indices that are values for flags (not API keys)
   const skipIndices = new Set()
-  if (tierValueIdx !== -1) skipIndices.add(tierValueIdx)
-  if (sortValueIdx !== -1) skipIndices.add(sortValueIdx)
-  if (originValueIdx !== -1) skipIndices.add(originValueIdx)
-  if (pingIntervalValueIdx !== -1) skipIndices.add(pingIntervalValueIdx)
-  if (syncSetValueIdx !== -1) skipIndices.add(syncSetValueIdx)
-  if (probeTtlValueIdx !== -1) skipIndices.add(probeTtlValueIdx)
-  if (configDirValueIdx !== -1) skipIndices.add(configDirValueIdx)
+  for (const found of [tierFlag, sortFlag, originFlag, pingIntervalFlag, probeTtlFlag, syncSetFlag, configDirFlag, driftThresholdFlag]) {
+    for (const idx of found.indices) skipIndices.add(idx)
+  }
 
   for (const [i, arg] of args.entries()) {
     // 📖 -y is a boolean flag (security auto-fix), never an API key
@@ -610,7 +616,7 @@ export function parseArgs(argv) {
 
   // 📖 --sync-set [name] — auto-discover and populate a router set with best available models
   const syncSetMode = flags.includes('--sync-set')
-  const syncSetName = syncSetValueIdx !== -1 ? args[syncSetValueIdx] : null
+  const syncSetName = firstFlagValue(syncSetFlag)
 
   // 📖 --web / --gui / web subcommand — launch the web dashboard instead of the TUI
   const webMode = flags.includes('--web') || flags.includes('--gui') || args[0] === 'web'
@@ -626,10 +632,11 @@ export function parseArgs(argv) {
   const hideUnconfigured = flags.includes('--hide-unconfigured')
   const showUnconfigured = flags.includes('--show-unconfigured')
 
-  let tierFilter = tierValueIdx !== -1 ? args[tierValueIdx].toUpperCase() : null
-  let sortColumn = sortValueIdx !== -1 ? args[sortValueIdx].toLowerCase() : null
-  let originFilter = originValueIdx !== -1 ? args[originValueIdx] : null
-  let pingInterval = pingIntervalValueIdx !== -1 ? parseInt(args[pingIntervalValueIdx], 10) : null
+  let tierFilter = firstFlagValue(tierFlag)?.toUpperCase() ?? null
+  let sortColumn = firstFlagValue(sortFlag)?.toLowerCase() ?? null
+  let originFilter = firstFlagValue(originFlag)
+  let pingIntervalRaw = firstFlagValue(pingIntervalFlag)
+  let pingInterval = pingIntervalRaw !== null ? parseInt(pingIntervalRaw, 10) : null
   let sortDirection = sortDesc ? 'desc' : (sortAscFlag ? 'asc' : null)
 
   // 📖 Profile system removed - API keys now persist permanently across all sessions
@@ -645,19 +652,14 @@ export function parseArgs(argv) {
   // 📖 --probe-ttl overrides the 24h default; --show-broken un-hides broken models for this run.
   const reprobeMode = flags.includes('--reprobe') || flags.includes('--no-cache')
   const showBrokenMode = flags.includes('--show-broken')
-  const probeTtlRaw = probeTtlValueIdx !== -1 ? args[probeTtlValueIdx] : null
+  const probeTtlRaw = firstFlagValue(probeTtlFlag)
   const probeTtlMs = probeTtlRaw !== null ? parseInt(probeTtlRaw, 10) : null
 
   // 📖 Drift detection flags (t5):
   // 📖 --check-drift (boolean) — print a drift report vs models.dev, exit non-zero on mismatch.
   // 📖 --drift-threshold <N> (value) — only fail when N+ mismatches are found.
   const checkDriftMode = flags.includes('--check-drift')
-  const driftThresholdIdx = args.findIndex(a => a.toLowerCase() === '--drift-threshold')
-  const driftThresholdValueIdx = (driftThresholdIdx !== -1 && args[driftThresholdIdx + 1] && !args[driftThresholdIdx + 1].startsWith('--'))
-    ? driftThresholdIdx + 1
-    : -1
-  if (driftThresholdValueIdx !== -1) skipIndices.add(driftThresholdValueIdx)
-  const driftThresholdRaw = driftThresholdValueIdx !== -1 ? args[driftThresholdValueIdx] : null
+  const driftThresholdRaw = firstFlagValue(driftThresholdFlag)
   const driftThreshold = driftThresholdRaw !== null ? parseInt(driftThresholdRaw, 10) : null
 
   return {
@@ -716,7 +718,7 @@ export function parseArgs(argv) {
     // 📖 Runtime telemetry flag (t3) — see src/core/runtime-telemetry.js
     clearRuntimeMode,
     // 📖 Config location flag — see src/core/config.js getConfigDir()
-    configDir: configDirValueIdx !== -1 ? args[configDirValueIdx] : null,
+    configDir: firstFlagValue(configDirFlag),
     // 📖 Security auto-fix flag - see src/core/security.js checkConfigSecurity()
     fixPermissionsMode,
   }
@@ -1031,6 +1033,9 @@ export function getVersionStatusInfo(updateState, latestVersion, startupLatestVe
  * @returns {string} JSON string of formatted results
  */
 export function formatResultsAsJSON(results, sortBy = 'avg', limit = 0) {
+  // 📖 Only slice for a usable positive limit: a negative limit used to drop the
+  // 📖 last row(s) via slice(0, -1), and 0/undefined means "all results".
+  const effectiveLimit = Number.isInteger(limit) && limit > 0 ? limit : undefined
   const formatted = results
     .map((r, idx) => ({
       rank: r.idx || idx + 1,
@@ -1050,7 +1055,7 @@ export function formatResultsAsJSON(results, sortBy = 'avg', limit = 0) {
       status: r.status || null,
       httpCode: r.httpCode || null
     }))
-    .slice(0, limit || undefined)
+    .slice(0, effectiveLimit)
 
   return JSON.stringify(formatted, null, 2)
 }

package/src/tui/app.js

@@ -93,7 +93,7 @@ import chalk from 'chalk'
 import { createRequire } from 'module'
 import { randomUUID } from 'crypto'
 import { MODELS, sources } from '../../sources.js'
-import { getAvg, getVerdict, getUptime, getP95, getJitter, getStabilityScore, sortResults, filterByTier, findBestModel, parseArgs, TIER_ORDER, VERDICT_ORDER, TIER_LETTER_MAP, scoreModelForTask, getTopRecommendations, TASK_TYPES, PRIORITY_TYPES, CONTEXT_BUDGETS, formatCtxWindow, labelFromId, formatResultsAsJSON } from '../core/utils.js'
+import { getAvg, getVerdict, getUptime, getP95, getJitter, getStabilityScore, sortResults, filterByTier, parseArgs, TIER_ORDER, VERDICT_ORDER, TIER_LETTER_MAP, scoreModelForTask, getTopRecommendations, TASK_TYPES, PRIORITY_TYPES, CONTEXT_BUDGETS, formatResultsAsJSON } from '../core/utils.js'
 import { loadConfig, saveConfig, getApiKey, resolveApiKeys, addApiKey, removeApiKey, isProviderEnabled, persistApiKeysForProvider } from '../core/config.js'
 import { buildMergedModels } from '../core/model-merger.js'
 import { loadOpenCodeConfig, saveOpenCodeConfig } from '../core/opencode-config.js'
@@ -101,7 +101,7 @@ import { usageForRow as _usageForRow } from '../core/usage-reader.js'
 import { buildProviderModelTokenKey, loadTokenUsageByProviderModel } from '../core/token-usage-reader.js'
 import { parseOpenRouterResponse, fetchProviderQuota as _fetchProviderQuotaFromModule, getAllQuotas as _getAllPassiveQuotasFromModule } from '../core/provider-quota-fetchers.js'
 import { isKnownQuotaTelemetry } from '../core/quota-capabilities.js'
-import { ALT_ENTER, ALT_LEAVE, ALT_HOME, PING_TIMEOUT, PING_INTERVAL, FPS, COL_MODEL, COL_MS, CELL_W, FRAMES, TIER_CYCLE, VERDICT_CYCLE, HEALTH_CYCLE, SETTINGS_OVERLAY_BG, HELP_OVERLAY_BG, RECOMMEND_OVERLAY_BG, OVERLAY_PANEL_WIDTH, TABLE_HEADER_LINES, TABLE_FOOTER_LINES, TABLE_FIXED_LINES, WIDTH_WARNING_MIN_COLS, msCell, spinCell } from '../core/constants.js'
+import { ALT_ENTER, ALT_LEAVE, ALT_HOME, PING_TIMEOUT, PING_INTERVAL, FPS, FRAMES, TIER_CYCLE, VERDICT_CYCLE, HEALTH_CYCLE, SETTINGS_OVERLAY_BG, HELP_OVERLAY_BG, RECOMMEND_OVERLAY_BG, OVERLAY_PANEL_WIDTH, TABLE_HEADER_LINES, TABLE_FOOTER_LINES, TABLE_FIXED_LINES, WIDTH_WARNING_MIN_COLS } from '../core/constants.js'
 import { TIER_COLOR } from './tier-colors.js'
 import { resolveCloudflareUrl, buildPingRequest, ping, extractQuotaPercent, getProviderQuotaPercentCached, usagePlaceholderForProvider } from '../core/ping.js'
 import { runFiableMode, filterByTierOrExit, fetchOpenRouterFreeModels } from '../core/analysis.js'
@@ -109,12 +109,12 @@ import { PROVIDER_METADATA, ENV_VAR_NAMES, isWindows, isMac } from '../core/prov
 import { parseTelemetryEnv, isTelemetryDebugEnabled, telemetryDebug, ensureTelemetryConfig, getTelemetryDistinctId, getTelemetrySystem, getTelemetryTerminal, isTelemetryEnabled, sendUsageTelemetry } from '../core/telemetry.js'
 import { ensureFavoritesConfig, toFavoriteKey, syncFavoriteFlags, toggleFavoriteModel, reorderFavorite, pruneOrphanedFavorites } from '../core/favorites.js'
 import { checkForUpdateDetailed, checkForUpdate, runUpdate, fetchLastReleaseDate } from '../core/updater.js'
-import { createTuiState, PING_MODE_INTERVALS, PING_MODE_CYCLE, SPEED_MODE_DURATION_MS, IDLE_SLOW_AFTER_MS, intervalToPingMode } from './tui-state.js'
+import { createTuiState, PING_MODE_INTERVALS, PING_MODE_CYCLE, SPEED_MODE_DURATION_MS, IDLE_SLOW_AFTER_MS, PING_HISTORY_CAP, intervalToPingMode } from './tui-state.js'
 import { createPingLoop } from '../core/ping-loop.js'
 import { createTuiFilters } from './tui-filters.js'
 import { promptApiKey } from '../core/setup.js'
 import { syncShellEnv, ensureShellRcSource, removeShellEnv } from '../core/shell-env.js'
-import { stripAnsi, maskApiKey, displayWidth, padEndDisplay, tintOverlayLines, keepOverlayTargetVisible, sliceOverlayLines, calculateViewport, sortResultsWithPinnedFavorites, adjustScrollOffset } from './render-helpers.js'
+import { displayWidth, padEndDisplay, tintOverlayLines, keepOverlayTargetVisible, sliceOverlayLines, sortResultsWithPinnedFavorites, adjustScrollOffset, runWithConcurrency } from './render-helpers.js'
 import { renderTable, PROVIDER_COLOR } from './render-table.js'
 import { setOpenCodeModelData, startOpenCode, startOpenCodeDesktop, startOpenCodeWeb } from '../core/opencode.js'
 import { startKilo } from '../core/kilo.js'
@@ -478,6 +478,12 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
   let ticker = null
   let onKeyPress = null
   let onMouseData = null  // 📖 Mouse data listener — set after createMouseEventHandler
+  // 📖 The variables above hold raw handler functions, but what actually gets
+  // 📖 registered on process.stdin are the WRAPPERS below. stopUi used to remove
+  // 📖 the raw functions (a silent no-op) - it now removes these tracked
+  // 📖 wrappers so launch/update paths really detach the listeners.
+  let keypressWrapper = null
+  let mouseDataWrapper = null
   let pingModel = null
 
   // 📖 scheduleNextPing: wrapper that defers to the factory version, passing the current runPingCycle.
@@ -505,7 +511,9 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
         r.verdict = cachedModel.verdict
         r.status = cachedModel.status
         r.httpCode = cachedModel.httpCode
-        r.pings = cachedModel.pings || []
+        // 📖 Trim restored history to PING_HISTORY_CAP so an oversized cache
+        // 📖 file cannot instantly reintroduce the unbounded-growth problem.
+        r.pings = (cachedModel.pings || []).slice(-PING_HISTORY_CAP)
       }
     }
   }
@@ -621,6 +629,13 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
       }
 
       r.pings.push({ ms, code })
+      // 📖 Cap ping history (PING_HISTORY_CAP = 300): r.pings used to grow
+      // 📖 unbounded and getAvg/getP95/getVerdict/getStabilityScore rescan it
+      // 📖 per row at ~12 FPS. Stats (uptime, avg) now roll over the last
+      // 📖 300 pings instead of the entire session; the oldest entries shift out.
+      if (r.pings.length > PING_HISTORY_CAP) {
+        r.pings.splice(0, r.pings.length - PING_HISTORY_CAP)
+      }
 
       // 📖 Probe-cache (t1): record the result so future runs can skip healthy models
       // 📖 and auto-hide broken ones. Uses the module-level in-memory cache; flushed
@@ -767,8 +782,9 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
     clearTimeout(state.pingIntervalObj)
     clearInterval(state.versionRecheckTimer)
     stopRouterDashboardClient(state)
-    if (onKeyPress) process.stdin.removeListener('keypress', onKeyPress)
-    if (onMouseData) process.stdin.removeListener('data', onMouseData)
+    // 📖 Remove the actual registered wrappers (see keypressWrapper/mouseDataWrapper).
+    if (keypressWrapper) process.stdin.removeListener('keypress', keypressWrapper)
+    if (mouseDataWrapper) process.stdin.removeListener('data', mouseDataWrapper)
     if (process.stdin.isTTY && resetRawMode) process.stdin.setRawMode(false)
     process.stdin.pause()
     process.stdout.write(ALT_LEAVE)
@@ -837,6 +853,7 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
     sortResultsWithPinnedFavorites,
     adjustScrollOffset,
     applyTierFilter,
+    getPingModel: () => pingModel,
     PING_INTERVAL,
     TIER_CYCLE,
     ORIGIN_CYCLE,
@@ -948,7 +965,7 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
     }
   })
 
-  process.stdin.on('keypress', async (str, key) => {
+  keypressWrapper = async (str, key) => {
     try {
       // 📖 Skip keypress events that originate from mouse escape sequences.
       // 📖 readline may partially parse SGR mouse sequences as garbage keypresses.
@@ -963,18 +980,20 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
       console.error(chalk.yellow('\nPlease file an issue at https://github.com/vava-nessa/free-coding-models/issues or join the Discord to report this to the author.'));
       process.exit(1);
     }
-  })
+  }
+  process.stdin.on('keypress', keypressWrapper)
 
   // 📖 Mouse data listener: parses SGR mouse escape sequences from raw stdin
   // 📖 and dispatches structured events (click, scroll, double-click) to the mouse handler.
-  process.stdin.on('data', (data) => {
+  mouseDataWrapper = (data) => {
     try {
       if (onMouseData) onMouseData(data)
     } catch (err) {
       // 📖 Mouse errors are non-fatal — log and continue so the TUI doesn't crash.
       // 📖 This could happen on terminals that send unexpected mouse sequences.
     }
-  })
+  }
+  process.stdin.on('data', mouseDataWrapper)
 
   process.on('SIGCONT', noteUserActivity)
 
@@ -1075,8 +1094,15 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
         // 📖 Freeze the full table (including countdown and spinner glyphs) while
         // 📖 the command palette is open so the background remains perfectly static.
         state.commandPaletteFrozenTable = renderTable(tableOpts)
+        tableContent = state.commandPaletteFrozenTable
+      } else {
+        // 📖 The frozen table is already on screen and cannot change while the
+        // 📖 palette is open, so repaint the palette alone. Repainting the full
+        // table every frame made large terminals flicker: the write gets split
+        // into chunks, so the terminal showed the bare table for a moment
+        // before the palette overlay painted over it, 30 times per second.
+        tableContent = null
       }
-      tableContent = state.commandPaletteFrozenTable
     } else {
       state.commandPaletteFrozenTable = null
       tableContent = renderTable(tableOpts)
@@ -1096,12 +1122,10 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
         ? overlays.renderPlayground()
       : state.tokenUsageOpen
         ? overlays.renderTokenUsage()
-      : state.routerOnboardingOpen
-        ? overlays.renderRouterOnboarding()
       : state.incompatibleFallbackOpen
         ? overlays.renderIncompatibleFallback()
       : state.commandPaletteOpen
-        ? tableContent + overlays.renderCommandPalette()
+        ? (tableContent || '') + overlays.renderCommandPalette()
       : state.recommendOpen
         ? overlays.renderRecommend()
         : state.helpVisible
@@ -1200,7 +1224,14 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
   const initialDueModels = state.results.filter(r => !isCacheFresh(r.providerKey, r.modelId, {
     ttlMs: state.probeCacheTtlMs,
   }))
-  const initialPing = Promise.all(initialDueModels.map(r => pingModel(r)))
+  // 📖 Startup burst runs through runWithConcurrency(…, 5) - the same bounded
+  // 📖 helper the 404 probe uses. The old Promise.all fired up to ~226
+  // 📖 simultaneous pings at once, a guaranteed 429 storm on rate-limited
+  // 📖 providers (and per-task errors are captured instead of rejecting the batch).
+  const initialPing = runWithConcurrency(
+    initialDueModels.map(r => () => pingModel(r)),
+    5
+  )
 
   // 📖 Continuous ping loop with mode-driven cadence.
   const runPingCycle = async () => {

package/src/tui/command-palette.js

@@ -9,7 +9,7 @@
  *   → `fuzzyMatchCommand` — scores a query against one string and returns match positions
  *   → `filterCommandPaletteEntries` — returns sorted command matches for a query
  *
- * @exports { buildCommandPaletteTree, flattenCommandTree, fuzzyMatchCommand, filterCommandPaletteEntries }
+ * @exports { buildCommandPaletteTree, flattenCommandTree, fuzzyMatchCommand, filterCommandPaletteEntries, COMMAND_PALETTE_MAX_RESULTS, clampPaletteCursor }
  *
  * @see src/key-handler.js
  * @see src/overlays.js
@@ -17,6 +17,25 @@
 
 import { TOOL_METADATA, TOOL_MODE_ORDER } from '../core/tool-metadata.js'
 import { sources } from '../../sources.js'
+import { sanitizePingInterval } from './tui-state.js'
+
+// 📖 Max result rows the palette renders (overlays.js slices to this). The
+// 📖 cursor must never point past the rendered slice, so key-handler clamps
+// 📖 with clampPaletteCursor() against the same constant.
+export const COMMAND_PALETTE_MAX_RESULTS = 80
+
+/**
+ * 📖 clampPaletteCursor: Keep the palette cursor inside the RENDERED slice.
+ * 📖 The overlay only paints the first COMMAND_PALETTE_MAX_RESULTS rows, so a
+ * 📖 cursor clamped against the full result list could sit on an invisible row.
+ * @param {number} cursor
+ * @param {number} totalResults
+ * @returns {number}
+ */
+export function clampPaletteCursor(cursor, totalResults) {
+  const max = Math.max(0, Math.min(totalResults, COMMAND_PALETTE_MAX_RESULTS) - 1)
+  return Math.min(Math.max(0, cursor), max)
+}
 
 const PROVIDER_FILTER_COMMANDS = Object.entries(sources).map(([providerKey, source]) => {
   const label = source?.name || providerKey
@@ -229,7 +248,8 @@ export function buildCommandPaletteTree(visibleModels = [], config = null) {
 
   // 📖 Update Normal mode label if config is provided
   if (config) {
-    const normalInterval = config.settings?.pingInterval ?? 10000
+    // 📖 Guard against 0/negative/garbage pingInterval (same rule as tui-state).
+    const normalInterval = sanitizePingInterval(config.settings?.pingInterval, 10000)
     const normalSec = Math.round(normalInterval / 1000)
     const actionsNode = tree.find(n => n.id === 'actions')
     const pingNode = actionsNode?.children.find(n => n.id === 'action-ping-mode')