free-coding-models 0.5.86 → 0.5.87

package/bin/free-coding-models.js

@@ -225,7 +225,10 @@ async function main() {
 
   // Validate --tier early, before entering alternate screen
   if (cliArgs.tierFilter && !TIER_LETTER_MAP[cliArgs.tierFilter]) {
-    console.error(chalk.red(`  Unknown tier "${cliArgs.tierFilter}". Valid tiers: S, A, B, C`));
+    // 📖 Strip control characters before echoing raw argv back to the terminal,
+    // 📖 otherwise an argv sequence like \r could forge fake terminal output.
+    const safeTierEcho = String(cliArgs.tierFilter).replace(/[\x00-\x1f\x7f]/g, '')
+    console.error(chalk.red(`  Unknown tier "${safeTierEcho}". Valid tiers: S, A, B, C`));
     process.exit(1);
   }
 

package/changelog/v0.5.87.md

@@ -0,0 +1,48 @@
+# Changelog v0.5.87 - 2026-09-05
+
+Full quality pass over the whole codebase: security hardening, reliability fixes, dead code removal, docs overhaul. Nothing was rebuilt from scratch: every change is a targeted fix verified against the 1068-test suite, a real TUI smoke test, and live daemon probes.
+
+### Security
+
+- **API keys are no longer served raw over HTTP**: `GET /api/key/:provider` on the daemon and the `--web` dashboard now return a masked key (`••••••••` + `hasKey`). Before, any local process (or any web page, via wildcard CORS) could read every saved provider key with one `curl`.
+- **DNS rebinding closed**: the daemon now validates the `Host` header and rejects anything that is not loopback (403) before routing.
+- **CSRF gaps closed**: `Origin: null` (sandboxed iframes) is no longer trusted, and `/daemon/shutdown`, the canonical `/sets` routes, the benchmark endpoints and the SSE streams now enforce the same-origin check. SSE connections are also capped per origin (5 of the 10 slots) so a hostile page cannot starve the real dashboard.
+- **web server (`--web` mode)**: the `Access-Control-Allow-Origin: *` wildcard is gone and the server binds `127.0.0.1` unless `FCM_HOST` says otherwise.
+- **`/v1` proxy**: no longer forwards your browser cookies upstream, no longer relays `set-cookie` / `access-control-*` headers downstream. New optional `FCM_ROUTER_TOKEN` env var adds bearer-token auth to `/v1` (off by default, useful in LAN/Docker setups).
+- **Keys on disk**: every file the endpoint installer writes (aider, goose, env files, JSON configs) is now mode `0600`, and pre-existing wide-permission files get tightened on rewrite. Env files shell-escape the key, so a key containing quotes can no longer execute commands when sourced.
+- **No more shell interpolation on POSIX**: OpenCode/Kilo/desktop launches spawn binaries directly instead of going through a shell (injection-proof by construction).
+- **Telemetry**: upstream error bodies are no longer shipped to PostHog (the module header always promised this; now it's true), `telemetry.enabled: false` in the config is finally honored, and the two hardcoded Discord webhook URLs were removed: set `FCM_DISCORD_FEATURE_WEBHOOK` / `FCM_DISCORD_BUG_WEBHOOK` to re-enable feedback.
+
+### Fixed
+
+- **Multi-key providers worked for nobody**: adding a second API key in Settings stored an array, and every request then sent `Authorization: Bearer key1,key2` (guaranteed 401). The first key is now used.
+- **Auto-hide of broken models now persists**: `saveConfig` used to silently wipe `config.hiddenModels`, so the Ctrl+Shift+P hide feature never survived a restart, and stale writers could resurrect deleted rows from the probe cache.
+- **Honest verdicts**: models whose key is rejected (401/no key) no longer show a green "Perfect" verdict and can no longer win `--fiable` / `findBestModel`: they show "Not Active".
+- **TUI memory + startup**: ping history is capped at 300 samples per model (stats are windowed instead of growing forever), and the startup burst is bounded to 5 concurrent pings instead of ~226 simultaneous requests (no more 429 storms on launch).
+- **TUI truthfulness**: the broken-rows auto-hide is no longer re-shown 83 ms after being hidden (Shift+B and the footer counter now tell the truth), Ctrl+P over the token/runtime overlays no longer opens an invisible palette that swallows keystrokes, and clicking the "AI Speed Test" footer badges launches the benchmarks instead of silently re-sorting the table.
+- **Daemon stability**: a stalled upstream stream no longer feeds the unhandled-rejection crash counter, so a flaky provider day cannot kill the daemon into a restart loop; PID files are verified before SIGTERM; `x-request-id` is clamped.
+- **OpenCode/Kilo configs**: saves are atomic, and a corrupt existing config now blocks the save with a clear message instead of being replaced from an empty base. Aider configs are only touched when they carry the FCM marker.
+- **8 providers now inject their keys into OpenCode/Kilo**: huggingface, deepinfra, fireworks, together, hyperbolic, perplexity, chutes, iflow were missing from the env-var map.
+- **Data quality**: 4 tier/score mismatches fixed in the catalog (S+ scale), quota snapshots no longer fake freshness, the drift report no longer drowns real drift in hundreds of false "add" rows, and the updater no longer treats an npm dist-tag rollback as an update.
+- **CLI parsing**: `--tier=S` (equals form) works, repeated flags no longer leak a value into the API key argument, sort comparators can no longer return NaN, and the invalid-tier error message strips control characters.
+- **Docker**: the entrypoint no longer pipes the daemon through `sed` (SIGTERM now reaches the real node process and exit codes are accurate), and 13 missing provider env passthroughs were added to docker-compose.
+- **Website**: 19 TypeScript errors fixed (typecheck is green again), the vendored catalog was 17 models behind the CLI (re-synced to 24 providers / 229 models), PostHog placeholder snippet and Google Fonts removed (the dashboard and site now work fully offline), unknown URLs render the styled 404, sitemap.xml added.
+
+### Added
+
+- **CI finally runs the tests**: a new "Tests" workflow runs the suite on Node 20 and 22 for every push and PR. Before this release, nothing in CI ever executed the test suite.
+- **+185 tests** (883 to 1068): 5 orphaned test files were revived from the dead (stale import paths, never executed), and new coverage covers key masking, Host rejection, multi-key handling, hiddenModels persistence, ping 401/429 classification, zero-chunk SSE failover, hostile-key shell escaping, and more.
+- **Self-updating docs**: provider tables in `docs/providers.md` are generated from `sources.js` by `scripts/generate-provider-table.mjs`, so counts can no longer drift from reality.
+- New docs: `docs/tui.md` (every key binding verified against the code), `docs/web-dashboard.md`, `docs/router.md`, `docs/resources.md`, plus `CONTRIBUTORS.md`.
+
+### Changed
+
+- **README: 67 KB to 16 KB**. Restructured around the quick start; every number, flag, key binding and path is now verified against the code (the old one claimed NVIDIA had 27 models, linked a 404 demo GIF and 5 nonexistent videos).
+- **npm package 27% lighter**: 1.8 MB to 1.3 MB packed (397 files, was 514): build-time-only web sources and duplicate favicons no longer ship, and 4.4 MB of dead root media (logo duplicates) are gone from the repo.
+- `kandown` moved to devDependencies: npm users no longer install a task-board CLI. `vite-plus` (unused) removed.
+- 200+ em dashes purged from docs and comments (project style rule).
+- The "Commit Log to Discord" action now self-diagnoses a dead webhook (404) instead of failing every push with a bare error: note that the current `DISCORD_WEBHOOK_GITHUB` secret points at a deleted webhook and needs a fresh one.
+
+### Changed (breaking-ish, opt-in)
+
+- LAN/Docker users: private-network origins are no longer implicitly trusted by the daemon. Same-origin requests keep working; other origins need `FCM_ALLOWED_ORIGINS`. `/v1` stays open by default; set `FCM_ROUTER_TOKEN` to require a token.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-coding-models",
-  "version": "0.5.86",
+  "version": "0.5.87",
   "description": "Find the fastest coding LLM models in seconds — ping free models from multiple providers, pick the best one for OpenCode, Cursor, or any AI coding assistant.",
   "keywords": [
     "nvidia",
@@ -49,6 +49,10 @@
     "web/",
     "!web/node_modules/",
     "!web/node_modules/**",
+    "!web/src/",
+    "!web/src/**",
+    "!web/public/",
+    "!web/public/**",
     "sources.js",
     "patch-openclaw.js",
     "patch-openclaw-models.js",
@@ -58,7 +62,7 @@
   ],
   "scripts": {
     "start": "node bin/free-coding-models.js",
-    "test": "node --test test/test.js test/fcm-agent-core.test.js test/patch-openclaw.test.js test/provider-metadata.test.js test/config-permission-hint.test.js test/probe-cache.test.js test/passive-quota.test.js test/runtime-telemetry.test.js test/extended-benchmarks.test.js test/models-dev.test.js test/model-merger.test.js test/config-dir.test.js test/cache-dir.test.js test/model-family.test.js",
+    "test": "node --test test/*.test.js test/test.js",
     "test:extended-benchmarks": "node --test test/extended-benchmarks.test.js",
     "test:models-dev": "node --test test/models-dev.test.js",
     "update:benchmarks": "node scripts/update-benchmarks.mjs",
@@ -76,7 +80,6 @@
     "@tabler/icons-react": "^3.44.0",
     "@tanstack/react-table": "^8.21.3",
     "chalk": "^5.6.2",
-    "kandown": "^0.52.0",
     "socket.io": "^4.8.3",
     "socket.io-client": "^4.8.3",
     "@tanstack/react-virtual": "^3.14.2"
@@ -87,9 +90,9 @@
   },
   "devDependencies": {
     "@vitejs/plugin-react": "^6.0.2",
+    "kandown": "^0.52.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
-    "vite": "^8.0.16",
-    "vite-plus": "^0.2.6"
+    "vite": "^8.0.16"
   }
 }

package/sources.js

@@ -274,7 +274,7 @@ export const zai = [
   ['zai/glm-4.7-flash', 'GLM-4.7-Flash', 'A+', '59.2%', '200k'], // Fixed (2026-07-27): ctx '203k' → '200k' per official docs
   ['zai/glm-4.5-flash', 'GLM-4.5-Flash', 'S', '59.2%', '128k'],
   ['zai/glm-5-turbo', 'GLM-5-Turbo', 'S', '-', '200k'], // Added (2026-08-13)
-  ['zai/glm-4.7', 'GLM-4.7', 'S', '73.8%', '200k'], // Added (2026-08-13)
+  ['zai/glm-4.7', 'GLM-4.7', 'S+', '73.8%', '200k'], // Added (2026-08-13); tier fixed: 73.8% >= 70% is S+ on the documented scale
   ['zai/glm-4.6', 'GLM-4.6', 'S', '68.0%', '200k'], // Added (2026-08-13)
   // Removed (2026-08-23): zai/glm-4.7-flashx, zai/glm-5v-turbo, zai/glm-4.6v — now paid-only ("Insufficient balance or no resource package" per ping test)
   // ── A tier — SWE-bench Verified 40–50% ──
@@ -407,7 +407,7 @@ export const opencodeZen = [
 export const kilo = [
   ['kilo-auto/free',                         'Kilo Auto Free',      'A+', '-',     '256k'],
   // Removed (2026-09-05): kilo-auto/small (Kilo Auto Small) - no longer free: gateway now lists it with isFree=false and paid pricing ($0.05/M prompt, $0.40/M completion); it routes to paid small models
-  ['thinkingmachines/inkling-small:free', 'Thinking Machines Inkling Small (free)', 'A+', '80.2%', '1M'],
+  ['thinkingmachines/inkling-small:free', 'Thinking Machines Inkling Small (free)', 'S+', '80.2%', '1M'], // tier fixed: 80.2% >= 70% is S+ on the documented scale
   ['stepfun/step-3.7-flash:free', 'StepFun Step 3.7 Flash (free)', 'A+', '-', '262k'],
   ['poolside/laguna-s-2.1:free', 'Poolside Laguna S 2.1 (free)', 'A+', '-', '262k'],
   ['nvidia/nemotron-3-ultra-550b-a55b:free', 'NVIDIA Nemotron 3 Ultra (free)', 'A+', '-', '1M'],
@@ -418,8 +418,8 @@ export const kilo = [
   ['nvidia/nemotron-3.5-lightning:free', 'NVIDIA Nemotron 3.5 Lightning (free)', 'B+', '-', '1M'],
   ['dots-studio/dots-3-note-preview:free', 'Dots Studio Dots3-Note Preview (free)', 'B+', '-', '512k'],
   ['openrouter/free', 'OpenRouter Free Models Router', 'B', '-', '200k'],
-  ['minimax/minimax-m3:free', 'MiniMax M3 (free)', 'S', '80.5%', '1M'],
-  ['thinkingmachines/inkling:free', 'Thinking Machines Inkling (free)', 'S', '80.2%', '1M'],
+  ['minimax/minimax-m3:free', 'MiniMax M3 (free)', 'S+', '80.5%', '1M'], // tier fixed: 80.5% >= 70% is S+ on the documented scale
+  ['thinkingmachines/inkling:free', 'Thinking Machines Inkling (free)', 'S+', '80.2%', '1M'], // tier fixed: 80.2% >= 70% is S+ on the documented scale
 ]
 
 // 📖 LLM7 source - https://api.llm7.io/v1

package/src/core/cache.js

@@ -135,8 +135,10 @@ export function saveCache(results, providerTier = 'normal') {
       providerTier
     }
 
-    // 📖 Write with secure permissions (user read/write only)
+    // 📖 Write with secure permissions (user read/write only).
+    // 📖 chmod also tightens pre-existing files created before the mode option was added.
     fs.writeFileSync(cachePath, JSON.stringify(cache, null, 2), { mode: 0o600 })
+    fs.chmodSync(cachePath, 0o600)
   } catch (err) {
     // 📖 Silently fail on write errors — caching is optional
   }

package/src/core/config.js

@@ -249,6 +249,9 @@ function isPlainObject(value) {
 }
 
 function cloneConfigValue(value) {
+  // 📖 Sets (hiddenModels) have no JSON representation and would come back as {}
+  // 📖 after the round-trip, breaking every `instanceof Set` consumer in the TUI.
+  if (value instanceof Set) return new Set(value)
   return JSON.parse(JSON.stringify(value))
 }
 
@@ -370,7 +373,9 @@ function normalizeRouterName(value, fallback = '') {
 }
 
 function normalizePositiveInteger(value, fallback, { min = 1, max = Number.MAX_SAFE_INTEGER } = {}) {
-  if (value === null || value === undefined || value === '') return fallback
+  // 📖 Booleans coerce through Number() (true -> 1) and would turn a malformed
+  // 📖 "router.port: true" into port 1, so non-numeric types fall back instead.
+  if (typeof value === 'boolean' || value === null || value === undefined || value === '') return fallback
   const numeric = Number(value)
   if (!Number.isFinite(numeric)) return fallback
   return Math.max(min, Math.min(max, Math.round(numeric)))
@@ -610,6 +615,19 @@ function mergeEndpointInstalls(diskEndpointInstalls, incomingEndpointInstalls) {
   return [...merged.values()]
 }
 
+// 📖 mergeHiddenModels: union of the disk auto-hide set with the live one, so a
+// 📖 stale writer (daemon autosave, second TUI) cannot wipe probe-hidden models.
+// 📖 When the incoming config explicitly disables auto-hide, the incoming set wins
+// 📖 so the TUI's "unhide all" toggle actually stays cleared instead of being
+// 📖 resurrected from disk on every save.
+function mergeHiddenModels(diskSet, incomingSet, incomingAutoHideDisabled) {
+  if (incomingAutoHideDisabled) return incomingSet
+  const merged = new Set()
+  for (const entry of diskSet) merged.add(entry)
+  for (const entry of incomingSet) merged.add(entry)
+  return merged
+}
+
 
 
 /**
@@ -629,7 +647,18 @@ export function buildPersistedConfig(incomingConfig, diskConfig = _emptyConfig()
       ? cloneConfigValue(normalizedIncoming.apiKeys)
       : { ...normalizedDisk.apiKeys, ...normalizedIncoming.apiKeys },
     providers: { ...normalizedDisk.providers, ...normalizedIncoming.providers },
-    settings: cloneConfigValue(normalizedIncoming.settings),
+    // 📖 Shallow-merge settings per top-level key: replacing wholesale let
+    // 📖 concurrent surfaces (TUI, web dashboard, daemon autosave) clobber each
+    // 📖 other's unrelated settings. Incoming wins per key.
+    settings: { ...normalizedDisk.settings, ...normalizedIncoming.settings },
+    // 📖 hiddenModels used to be dropped here entirely, so every saveConfig wiped
+    // 📖 the auto-hide list both on disk and in the live config object. Merge it
+    // 📖 so the Set serializer in saveConfig can persist it again.
+    hiddenModels: mergeHiddenModels(
+      normalizedDisk.hiddenModels,
+      normalizedIncoming.hiddenModels,
+      normalizedIncoming.settings.autoHideBrokenModels === false,
+    ),
     favorites: options.replaceFavorites === true
       ? [...normalizedIncoming.favorites]
       : mergeOrderedUniqueStrings(normalizedIncoming.favorites, normalizedDisk.favorites),
@@ -960,8 +989,10 @@ function createBackup() {
       mkdirSync(backupDir, { mode: 0o700, recursive: true })
     }
 
-    // 📖 Create timestamped backup
-    const timestamp = new Date().toISOString().replace(/[:.]/g, '').slice(0, -5) + 'Z'
+    // 📖 Create timestamped backup. Full timestamp including seconds: the old
+    // 📖 slice(0, -5) truncated them, so two saves <10s apart overwrote the same
+    // 📖 backup file and lost the older snapshot.
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '') + 'Z'
     const backupPath = join(backupDir, `config.${timestamp}.json`)
     const backupContent = readFileSync(CONFIG_PATH, 'utf8')
     writeFileSync(backupPath, backupContent, { mode: 0o600 })
@@ -1107,8 +1138,15 @@ export function getApiKey(config, providerKey) {
     if (candidate && process.env[candidate]) return process.env[candidate]
   }
 
-  // 📖 Config file value
+  // 📖 Config file value. addApiKey() stores a provider's extra keys as an array,
+  // 📖 but every consumer (ping Authorization header, tool env vars, daemon) needs
+  // 📖 a single string: an array would stringify to "key1,key2" and get a
+  // 📖 guaranteed 401. Return the first non-empty entry instead.
   const key = config?.apiKeys?.[providerKey]
+  if (Array.isArray(key)) {
+    const firstUsable = key.find(k => typeof k === 'string' && k.length > 0)
+    return firstUsable ?? null
+  }
   if (key) return key
 
   return null

package/src/core/endpoint-installer.js

@@ -40,14 +40,14 @@
  * @see src/tool-metadata.js
  */
 
-import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { MODELS, sources } from '../../sources.js'
 import { getApiKey, saveConfig } from './config.js'
 import { ENV_VAR_NAMES, PROVIDER_METADATA } from './provider-metadata.js'
 import { getToolMeta } from './tool-metadata.js'
-import { ensureDir, readJson as sharedReadJson } from './shared-helpers.js'
+import { ensureDir, readJson as sharedReadJson, shellSingleQuote, atomicWriteJson } from './shared-helpers.js'
 
 // 📖 replicate uses /v1/predictions (not /chat/completions), so it's not OpenAI-compatible.
 // 📖 zai and opencode-zen ARE OpenAI-compatible and CAN be installed into any tool.
@@ -90,10 +90,21 @@ function readJson(filePath, fallback = {}) {
   return sharedReadJson(filePath, fallback)
 }
 
+// 📖 These configs carry plaintext API keys - 0600 at creation, chmod after write
+// 📖 so pre-existing wide-permission files get tightened too (mode only applies at creation).
+function writeSecretFile(filePath, content) {
+  ensureDirFor(filePath)
+  writeFileSync(filePath, content, { mode: 0o600 })
+  chmodSync(filePath, 0o600)
+}
+
 function writeJson(filePath, value, { backup = true } = {}) {
   ensureDirFor(filePath)
   const backupPath = backup ? backupIfExists(filePath) : null
-  writeFileSync(filePath, JSON.stringify(value, null, 2) + '\n')
+  // 📖 Atomic tmp + rename via the shared helper instead of an in-place
+  // 📖 writeFileSync, so a crash mid-write can never truncate a tool config.
+  // 📖 0600 because these configs carry plaintext API keys.
+  atomicWriteJson(filePath, value, 0o600)
   return backupPath
 }
 
@@ -123,7 +134,7 @@ function writeSimpleYamlMap(filePath, entries) {
   const lines = Object.keys(entries)
     .sort()
     .map((key) => `${key}: ${JSON.stringify(String(entries[key] ?? ''))}`)
-  writeFileSync(filePath, lines.join('\n') + '\n')
+  writeSecretFile(filePath, lines.join('\n') + '\n')
   return backupPath
 }
 
@@ -463,8 +474,7 @@ function installIntoAider(providerKey, models, apiKey, paths) {
     `model: openai/${primaryModel.modelId}`,
     '',
   ]
-  ensureDirFor(paths.aiderConfigPath)
-  writeFileSync(paths.aiderConfigPath, lines.join('\n'))
+  writeSecretFile(paths.aiderConfigPath, lines.join('\n'))
   return { path: paths.aiderConfigPath, backupPath, providerId, modelCount: models.length }
 }
 
@@ -505,11 +515,12 @@ function installIntoQwen(providerKey, models, apiKey, paths) {
 
 // 📖 installIntoEnvBasedTool handles tools that rely on env vars only.
 // 📖 We write a small .env-style helper file so users can source it before launching.
-function installIntoEnvBasedTool(providerKey, models, apiKey, toolMode) {
+// 📖 `paths` is optional and lets tests override the env file location.
+function installIntoEnvBasedTool(providerKey, models, apiKey, toolMode, paths = {}) {
   const providerId = getManagedProviderId(providerKey)
   const home = homedir()
   const envFileName = `.fcm-${toolMode}-env`
-  const envFilePath = join(home, envFileName)
+  const envFilePath = paths?.envFilePath ?? join(home, envFileName)
   const primaryModel = models[0]
   const effectiveApiKey = apiKey
   const effectiveBaseUrl = resolveProviderBaseUrl(providerKey)
@@ -519,17 +530,17 @@ function installIntoEnvBasedTool(providerKey, models, apiKey, toolMode) {
     '# 📖 Managed by free-coding-models — source this file before launching the tool',
     `# 📖 Provider: ${getProviderLabel(providerKey)} (${models.length} models)`,
     '# 📖 Connection: Direct provider',
-    `export OPENAI_API_KEY="${effectiveApiKey}"`,
+    // 📖 Single-quote the key so quotes/$()/backticks in it stay literal on `source`.
+    `export OPENAI_API_KEY=${shellSingleQuote(effectiveApiKey)}`,
     `export OPENAI_BASE_URL="${effectiveBaseUrl}"`,
     `export OPENAI_MODEL="${effectiveModelId}"`,
-    `export LLM_API_KEY="${effectiveApiKey}"`,
+    `export LLM_API_KEY=${shellSingleQuote(effectiveApiKey)}`,
     `export LLM_BASE_URL="${effectiveBaseUrl}"`,
     `export LLM_MODEL="openai/${effectiveModelId}"`,
   ]
 
-  ensureDirFor(envFilePath)
   const backupPath = backupIfExists(envFilePath)
-  writeFileSync(envFilePath, envLines.join('\n') + '\n')
+  writeSecretFile(envFilePath, envLines.join('\n') + '\n')
   return { path: envFilePath, backupPath, providerId, modelCount: models.length }
 }
 

package/src/core/installed-models-manager.js

@@ -7,8 +7,7 @@
  *   - Scan all supported tool configs for installed models
  *   - Parse tool-specific config files (YAML, JSON)
  *   - Soft-delete models with backup to ~/.free-coding-models-backups.json
- *   - Launch tools with selected models
- *   - Reinstall FCM endpoints for providers
+ *   (launch + reinstall live in tool-launchers.js / endpoint-installer.js)
  *
  *   📖 Supported tools:
  *   - Goose (~/.config/goose/config.yaml + custom_providers/*.json)
@@ -36,16 +35,14 @@
  *   → parseOpenHandsConfig — Parse OpenHands env file
  *   → parseAmpConfig — Parse Amp JSON config
  *   → softDeleteModel — Remove model from config with backup
- *   → launchToolWithModel — Launch tool with specific model
- *   → reinstallEndpoint — Reinstall FCM endpoint for provider
  *
- * @exports scanAllToolConfigs, softDeleteModel, launchToolWithModel, reinstallEndpoint
+ * @exports scanAllToolConfigs, parseToolConfig, softDeleteModel
  *
- * @see src/tool-launchers.js — for launch functions
+ * @see src/tool-launchers.js - for launch functions (launchToolWithModel lives there)
  * @see src/endpoint-installer.js — for reinstall logic
  */
 
-import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs'
+import { readFileSync, existsSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join, dirname } from 'node:path'
 import { sources } from '../../sources.js'
@@ -211,17 +208,6 @@ function parseCrushConfig(paths = getToolConfigPaths()) {
           canLaunch: true,
         })
       }
-      if (config.models?.small?.model) {
-        models.push({
-          modelId: config.models.small.model + '-small',
-          label: `${config.models.small.model} (small)`,
-          tier: '-',
-          sweScore: '-',
-          providerKey: 'external',
-          isExternal: true,
-          canLaunch: true,
-        })
-      }
 
     return {
       isValid: true,
@@ -677,13 +663,46 @@ function loadBackups() {
 
 /**
  * 📖 Save backups to ~/.free-coding-models-backups.json
+ * 📖 Written 0600 (snapshots may contain tool config content) with a chmod after
+ * 📖 write so pre-existing wide-permission files get tightened too.
  */
 function saveBackups(backups) {
   const dir = dirname(BACKUP_PATH)
   if (!existsSync(dir)) {
     mkdirSync(dir, { recursive: true })
   }
-  writeFileSync(BACKUP_PATH, JSON.stringify(backups, null, 2))
+  writeFileSync(BACKUP_PATH, JSON.stringify(backups, null, 2), { mode: 0o600 })
+  chmodSync(BACKUP_PATH, 0o600)
+}
+
+// 📖 Backups keep a copy of the original tool config so deletions can be
+// 📖 inspected later. Key-like fields are stripped recursively (and by line for
+// 📖 non-JSON configs) so plaintext API keys never land in the backups file.
+const BACKUP_SENSITIVE_KEYS = new Set(['api_key', 'apiKey', 'keys', 'token'])
+
+function stripSensitiveFields(value) {
+  if (Array.isArray(value)) return value.map(stripSensitiveFields)
+  if (value && typeof value === 'object') {
+    const out = {}
+    for (const [key, val] of Object.entries(value)) {
+      if (BACKUP_SENSITIVE_KEYS.has(key)) continue
+      out[key] = stripSensitiveFields(val)
+    }
+    return out
+  }
+  return value
+}
+
+function sanitizeBackupConfig(content) {
+  try {
+    return JSON.stringify(stripSensitiveFields(JSON.parse(content)), null, 2)
+  } catch {
+    // 📖 Non-JSON config (goose/aider YAML etc.): drop whole key-bearing lines.
+    return content
+      .split('\n')
+      .filter((line) => !/^(#|\s)*(export\s+)?[\w-]*(api[_-]?key|token|keys)[\w-]*\s*[:=]/i.test(line))
+      .join('\n')
+  }
 }
 
 /**
@@ -830,11 +849,15 @@ export function softDeleteModel(toolMode, modelId, paths = getToolConfigPaths())
       id: `${toolMode}-${modelId}-${new Date().toISOString()}`,
       toolMode,
       modelId,
-      originalConfig: originalContent,
+      originalConfig: sanitizeBackupConfig(originalContent),
       configPath,
       disabledAt: new Date().toISOString(),
       reason: 'user_deleted',
     })
+    // 📖 Keep the backup list bounded: only the 20 most recent deletions survive.
+    if (backups.disabledModels.length > 20) {
+      backups.disabledModels = backups.disabledModels.slice(-20)
+    }
     saveBackups(backups)
 
     return { success: true }

package/src/core/kilo-config.js

@@ -6,36 +6,82 @@
  *   📖 Kilo is a fork of OpenCode and uses the same config structure,
  *   📖 but stored in a different directory: ~/.config/kilo/opencode.json
  *
+ *   📖 Data-loss guard (mirrors opencode-config.js): an existing config that
+ *   📖 fails to parse returns null from `loadKiloConfig`, and `saveKiloConfig`
+ *   📖 refuses to write over an unreadable file instead of replacing the
+ *   📖 user's config with an empty base.
+ *
  * @functions
- *   → `loadKiloConfig` — read `~/.config/kilo/opencode.json` safely
- *   → `saveKiloConfig` — write `opencode.json` with a simple backup
+ *   → `loadKiloConfig` - read `~/.config/kilo/opencode.json` safely (null when unreadable)
+ *   → `saveKiloConfig` - write `opencode.json` atomically with a simple backup
  *
  * @exports loadKiloConfig, saveKiloConfig
  */
 
-import { readFileSync, writeFileSync, copyFileSync, existsSync, mkdirSync } from 'node:fs'
+import { readFileSync, copyFileSync, existsSync, mkdirSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
+import { atomicWriteJson } from './shared-helpers.js'
 
 const KILO_CONFIG_DIR = join(homedir(), '.config', 'kilo')
 const KILO_CONFIG_PATH = join(KILO_CONFIG_DIR, 'opencode.json')
 const KILO_BACKUP_PATH = join(KILO_CONFIG_DIR, 'opencode.json.bak')
 
+const UNREADABLE_CONFIG_HINT = `  ⚠ ${KILO_CONFIG_PATH} contains invalid JSON and was NOT modified. Fix or remove the file, then retry.`
+
+/**
+ * 📖 True when the file exists, is non-empty, and does not parse as JSON.
+ */
+function isExistingFileUnreadable(configPath) {
+  if (!existsSync(configPath)) return false
+  try {
+    const raw = readFileSync(configPath, 'utf8')
+    if (!raw.trim()) return false
+    JSON.parse(raw)
+    return false
+  } catch {
+    return true
+  }
+}
+
 export function loadKiloConfig() {
   try {
     if (existsSync(KILO_CONFIG_PATH)) {
-      return JSON.parse(readFileSync(KILO_CONFIG_PATH, 'utf8'))
+      const raw = readFileSync(KILO_CONFIG_PATH, 'utf8')
+      if (!raw.trim()) return {}
+      try {
+        return JSON.parse(raw)
+      } catch {
+        // 📖 Existing non-empty file with broken JSON: signal "unreadable" so
+        // 📖 callers never build a save on an empty base and wipe the file.
+        return null
+      }
     }
   } catch {}
   return {}
 }
 
+/**
+ * 📖 Save kilo opencode.json atomically (tmp + rename) with a one-shot backup.
+ * 📖 Returns false and aborts instead of overwriting an unreadable file.
+ * @param {object|null} config
+ * @returns {boolean} true when written
+ */
 export function saveKiloConfig(config) {
+  if (config === null || config === undefined) {
+    console.error(UNREADABLE_CONFIG_HINT)
+    return false
+  }
+  if (isExistingFileUnreadable(KILO_CONFIG_PATH)) {
+    console.error(UNREADABLE_CONFIG_HINT)
+    return false
+  }
   mkdirSync(KILO_CONFIG_DIR, { recursive: true })
   if (existsSync(KILO_CONFIG_PATH)) {
     copyFileSync(KILO_CONFIG_PATH, KILO_BACKUP_PATH)
   }
-  writeFileSync(KILO_CONFIG_PATH, JSON.stringify(config, null, 2) + '\n')
+  atomicWriteJson(KILO_CONFIG_PATH, config, 0o600)
+  return true
 }
 
 export function getKiloConfigPath() {

package/src/core/kilo.js

@@ -7,7 +7,7 @@ import chalk from 'chalk'
 import { sources } from '../../sources.js'
 import { loadKiloConfig, saveKiloConfig, getKiloConfigPath } from './kilo-config.js'
 import { getApiKey } from './config.js'
-import { ENV_VAR_NAMES, OPENCODE_MODEL_MAP } from './provider-metadata.js'
+import { ENV_VAR_NAMES, OPENCODE_MODEL_MAP, isWindows } from './provider-metadata.js'
 import { resolveToolBinaryPath } from './tool-bootstrap.js'
 
 // 📖 Map source model IDs to Kilo built-in IDs (same as OpenCode).
@@ -45,7 +45,9 @@ async function spawnKilo(args, providerKey, fcmConfig) {
   const { spawn } = await import('child_process')
   const child = spawn(resolveToolBinaryPath('kilo') || 'kilo', finalArgs, {
     stdio: 'inherit',
-    shell: true,
+    // 📖 Windows keeps a shell because npm-installed CLIs resolve to .cmd shims;
+    // 📖 everywhere else the resolved absolute binary path is spawned directly.
+    shell: isWindows,
     detached: false,
     env: childEnv
   })
@@ -75,7 +77,7 @@ export async function startKilo(model, fcmConfig) {
   console.log(chalk.dim(`  Model: ${modelRef}`))
   console.log()
 
-  const config = loadKiloConfig()
+  const config = loadKiloConfig() || {}
 
   if (!config.provider) config.provider = {}
   if (!config.provider[providerKey]) {

package/src/core/legacy-proxy-cleanup.js

@@ -23,7 +23,7 @@
  * @exports cleanupLegacyProxyArtifacts
  */
 
-import { existsSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from 'node:fs'
+import { chmodSync, existsSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 
@@ -82,7 +82,9 @@ function noteError(summary, filePath, error) {
 }
 
 // 📖 Thin wrappers: readJsonFile propagates parse errors (callers have try/catch).
-// 📖 writeJsonFile appends a trailing newline for clean diffs.
+// 📖 writeJsonFile appends a trailing newline for clean diffs. These configs can
+// 📖 carry plaintext API keys, so tighten permissions after every write (chmod
+// 📖 also fixes pre-existing files that were created wide-permission).
 function readJsonFile(filePath, fallback = null) {
   if (!existsSync(filePath)) return fallback
   return JSON.parse(readFileSync(filePath, 'utf8'))
@@ -90,6 +92,7 @@ function readJsonFile(filePath, fallback = null) {
 
 function writeJsonFile(filePath, value) {
   writeFileSync(filePath, JSON.stringify(value, null, 2) + '\n')
+  chmodSync(filePath, 0o600)
 }
 
 function deleteFileIfExists(filePath, summary) {
@@ -262,7 +265,8 @@ function writeSimpleYamlMap(filePath, entries) {
   const lines = Object.keys(entries)
     .sort()
     .map((key) => `${key}: ${JSON.stringify(String(entries[key] ?? ''))}`)
-  writeFileSync(filePath, lines.join('\n') + '\n')
+  writeFileSync(filePath, lines.join('\n') + '\n', { mode: 0o600 })
+  chmodSync(filePath, 0o600)
 }
 
 function cleanupGoose(paths, summary) {
@@ -328,8 +332,16 @@ function cleanupAider(filePath, summary) {
   if (!existsSync(filePath)) return
   try {
     const content = readFileSync(filePath, 'utf8')
-    const isLegacyProxyConfig = content.includes('FCM Proxy V2') || /openai-api-base:\s*http:\/\/127\.0\.0\.1:/i.test(content)
+    // 📖 Only treat the file as proxy-era when BOTH signals hold: the FCM proxy
+    // 📖 banner we used to write AND a loopback openai-api-base. Matching on the
+    // 📖 loopback base alone deleted unrelated local setups (e.g. ollama) wholesale.
+    const isLegacyProxyConfig = content.includes('FCM Proxy V2')
+      && /openai-api-base:\s*http:\/\/127\.0\.0\.1:/i.test(content)
     if (isLegacyProxyConfig) {
+      // 📖 Back up before any unlink: the file may contain user edits we cannot
+      // 📖 reconstruct.
+      const backupPath = `${filePath}.backup-${Date.now()}`
+      try { writeFileSync(backupPath, content, { mode: 0o600 }) } catch { /* best-effort */ }
       unlinkSync(filePath)
       noteRemovedFile(summary, filePath)
     }
@@ -341,7 +353,12 @@ function cleanupAider(filePath, summary) {
 function cleanupAmp(filePath, summary) {
   updateJsonFile(filePath, (config) => {
     let removedEntries = 0
-    const usesLegacyLocalhost = typeof config['amp.url'] === 'string' && /127\.0\.0\.1|localhost/.test(config['amp.url'])
+    // 📖 The old proxy wrote its identity into the URL. Only loopback URLs that
+    // 📖 are actually FCM proxy artifacts (banner value in the URL) are removed;
+    // 📖 a user's own localhost amp.url (ollama, llama.cpp, ...) stays untouched.
+    const usesLegacyLocalhost = typeof config['amp.url'] === 'string'
+      && /127\.0\.0\.1|localhost/.test(config['amp.url'])
+      && /fcm|free-coding-models/i.test(config['amp.url'])
     if (usesLegacyLocalhost) {
       delete config['amp.url']
       removedEntries += 1