free-coding-models 0.5.86 → 0.5.88

package/src/core/utils.js

@@ -140,8 +140,13 @@ export const NEW_MODELS = new Set([
 ]);
 
 export const getVerdict = (r) => {
+  // 📖 401/403 rows can still carry fast measurable pings, but calling them
+  // 📖 "Perfect" let --fiable / findBestModel recommend a model that cannot serve
+  // 📖 a single authenticated request. Auth-failing rows always get the
+  // 📖 least-trustworthy health label instead.
+  if (r.status === 'auth_error' || r.status === 'noauth') return 'Not Active'
   const avg = getAvg(r)
-  const wasUpBefore = r.pings.length > 0 && r.pings.some(p => p.code === '200')
+  const wasUpBefore = (r.pings || []).length > 0 && r.pings.some(p => p.code === '200')
 
   if (r.httpCode === '429') return 'Overloaded'
   if ((r.status === 'timeout' || r.status === 'down') && wasUpBefore) return 'Unstable'
@@ -200,9 +205,10 @@ export const getVerdict = (r) => {
 // 📖 Displayed as "Up%" column in the TUI — e.g., "85%" means 85% of pings got HTTP 200.
 // 📖 This metric is useful for identifying models that are technically "up" but flaky.
 export const getUptime = (r) => {
-  if (r.pings.length === 0) return 0
-  const successful = r.pings.filter(p => p.code === '200').length
-  return Math.round((successful / r.pings.length) * 100)
+  const pings = r.pings || []
+  if (pings.length === 0) return 0
+  const successful = pings.filter(p => p.code === '200').length
+  return Math.round((successful / pings.length) * 100)
 }
 
 // 📖 getP95: Calculate the 95th percentile latency from measurable pings (HTTP 200/401).
@@ -303,11 +309,13 @@ export const sortResults = (results, sortColumn, sortDirection, { benchmarkResul
         cmp = TIER_ORDER.indexOf(a.tier) - TIER_ORDER.indexOf(b.tier)
         break
       case 'origin':
-        // 📖 Sort by providerKey (or fallback to modelId prefix) for multi-provider support
-        cmp = (a.providerKey ?? 'nvidia').localeCompare(b.providerKey ?? 'nvidia')
+        // 📖 Sort by providerKey (or fallback to modelId prefix) for multi-provider support.
+        // 📖 Explicit 'en' locale: the default is ICU-dependent, so row order would
+        // 📖 otherwise vary between machines.
+        cmp = (a.providerKey ?? 'nvidia').localeCompare(b.providerKey ?? 'nvidia', 'en')
         break
       case 'model':
-        cmp = a.label.localeCompare(b.label)
+        cmp = a.label.localeCompare(b.label, 'en')
         break
       case 'ping': {
         // 📖 Sort by LAST ping only — gives a real-time "right now" snapshot
@@ -333,7 +341,7 @@ export const sortResults = (results, sortColumn, sortDirection, { benchmarkResul
         break
       }
       case 'condition':
-        cmp = a.status.localeCompare(b.status)
+        cmp = a.status.localeCompare(b.status, 'en')
         break
       case 'verdict': {
         // 📖 Sort by verdict order — "Perfect" first, "Pending" last
@@ -391,6 +399,10 @@ export const sortResults = (results, sortColumn, sortDirection, { benchmarkResul
         break
     }
 
+    // 📖 Non-finite differences (e.g. Infinity - Infinity) collapse to 0: a NaN
+    // 📖 comparator result makes sort order machine-dependent and unstable.
+    if (!Number.isFinite(cmp)) cmp = 0
+
     // 📖 Flip comparison for descending order
     return sortDirection === 'asc' ? cmp : -cmp
   })
@@ -485,7 +497,7 @@ export function findBestModel(results) {
 //     --daemon-status, --no-telemetry, --json, --help/-h (case-insensitive)
 //     --playground / playground subcommand (open the in-TUI chat playground)
 //     --fix-permissions / --yes / -y (auto-fix config permissions without prompting)
-//   - Value flag: --tier <letter> (the next non-flag arg is the tier value)
+//   - Value flag: --tier <letter> (also accepts the --tier=S equals form)
 //   - Probe-cache flags (t1):
 //     --reprobe / --no-cache (boolean) — force-rebuild the probe cache this run
 //     --probe-ttl <ms> (value)          — override the 24h default TTL
@@ -500,62 +512,56 @@ export function findBestModel(results) {
 //     reprobeMode, probeTtlMs, showBrokenMode }
 //
 // 📖 Note: apiKey may be null here — the main CLI falls back to env vars and saved config.
+
+// 📖 findValueFlag: collect every occurrence of a value flag, in both "--flag value"
+// 📖 and "--flag=value" forms. Equals form used to be silently ignored (the lookup
+// 📖 only matched the bare flag), and repeated flags used to leak their extra values
+// 📖 into the positional API-key slot because only the first index was marked used.
+// 📖 Returns { indices, values }: indices point at the VALUE args (for the equals
+// 📖 form, at the "--flag=value" arg itself, which is already treated as a flag).
+function findValueFlag(args, flag) {
+  const indices = []
+  const values = []
+  for (const [i, arg] of args.entries()) {
+    const lower = arg.toLowerCase()
+    if (lower.startsWith(`${flag}=`)) {
+      indices.push(i)
+      values.push(arg.slice(flag.length + 1))
+    } else if (lower === flag && args[i + 1] && !args[i + 1].startsWith('--')) {
+      indices.push(i + 1)
+      values.push(args[i + 1])
+    }
+  }
+  return { indices, values }
+}
+
+// 📖 First usable value of a flag, or null when the flag was not passed (or was
+// 📖 passed with an empty value like "--tier=").
+function firstFlagValue(found) {
+  return found.values.length > 0 && found.values[0] !== '' ? found.values[0] : null
+}
+
 export function parseArgs(argv) {
   const args = argv.slice(2)
   let apiKey = null
   const flags = []
 
-  // 📖 Determine which arg indices are consumed by --tier so we skip them
-  const tierIdx = args.findIndex(a => a.toLowerCase() === '--tier')
-  const tierValueIdx = (tierIdx !== -1 && args[tierIdx + 1] && !args[tierIdx + 1].startsWith('--'))
-    ? tierIdx + 1
-    : -1
-
-  // New value flags
-  const sortIdx = args.findIndex(a => a.toLowerCase() === '--sort')
-  const sortValueIdx = (sortIdx !== -1 && args[sortIdx + 1] && !args[sortIdx + 1].startsWith('--'))
-    ? sortIdx + 1
-    : -1
-
-  const originIdx = args.findIndex(a => a.toLowerCase() === '--origin')
-  const originValueIdx = (originIdx !== -1 && args[originIdx + 1] && !args[originIdx + 1].startsWith('--'))
-    ? originIdx + 1
-    : -1
-
-  const pingIntervalIdx = args.findIndex(a => a.toLowerCase() === '--ping-interval')
-  const pingIntervalValueIdx = (pingIntervalIdx !== -1 && args[pingIntervalIdx + 1] && !args[pingIntervalIdx + 1].startsWith('--'))
-    ? pingIntervalIdx + 1
-    : -1
-
-  // 📖 --probe-ttl <ms> — override the 24h probe-cache TTL (power users / debugging)
-  const probeTtlIdx = args.findIndex(a => a.toLowerCase() === '--probe-ttl')
-  const probeTtlValueIdx = (probeTtlIdx !== -1 && args[probeTtlIdx + 1] && !args[probeTtlIdx + 1].startsWith('--'))
-    ? probeTtlIdx + 1
-    : -1
-
-  // 📖 --sync-set [name] — auto-discover and live-probe models into a named router set
-  const syncSetIdx = args.findIndex(a => a.toLowerCase() === '--sync-set')
-  const syncSetValueIdx = (syncSetIdx !== -1 && args[syncSetIdx + 1] && !args[syncSetIdx + 1].startsWith('--'))
-    ? syncSetIdx + 1
-    : -1
-
-  // 📖 --config-dir <dir> — override where FCM's config files (config.json + backups/)
-  // 📖 live. Any directory works, e.g. --config-dir ~/.config/free-coding-models for the
-  // 📖 XDG layout. The bin entry point persists this as FCM_CONFIG_DIR before imports.
-  const configDirIdx = args.findIndex(a => a.toLowerCase() === '--config-dir')
-  const configDirValueIdx = (configDirIdx !== -1 && args[configDirIdx + 1] && !args[configDirIdx + 1].startsWith('--'))
-    ? configDirIdx + 1
-    : -1
+  // 📖 Resolve all value flags up front so every occurrence (space or equals form)
+  // 📖 can be marked consumed before the positional API-key scan runs.
+  const tierFlag = findValueFlag(args, '--tier')
+  const sortFlag = findValueFlag(args, '--sort')
+  const originFlag = findValueFlag(args, '--origin')
+  const pingIntervalFlag = findValueFlag(args, '--ping-interval')
+  const probeTtlFlag = findValueFlag(args, '--probe-ttl')
+  const syncSetFlag = findValueFlag(args, '--sync-set')
+  const configDirFlag = findValueFlag(args, '--config-dir')
+  const driftThresholdFlag = findValueFlag(args, '--drift-threshold')
 
   // 📖 Set of arg indices that are values for flags (not API keys)
   const skipIndices = new Set()
-  if (tierValueIdx !== -1) skipIndices.add(tierValueIdx)
-  if (sortValueIdx !== -1) skipIndices.add(sortValueIdx)
-  if (originValueIdx !== -1) skipIndices.add(originValueIdx)
-  if (pingIntervalValueIdx !== -1) skipIndices.add(pingIntervalValueIdx)
-  if (syncSetValueIdx !== -1) skipIndices.add(syncSetValueIdx)
-  if (probeTtlValueIdx !== -1) skipIndices.add(probeTtlValueIdx)
-  if (configDirValueIdx !== -1) skipIndices.add(configDirValueIdx)
+  for (const found of [tierFlag, sortFlag, originFlag, pingIntervalFlag, probeTtlFlag, syncSetFlag, configDirFlag, driftThresholdFlag]) {
+    for (const idx of found.indices) skipIndices.add(idx)
+  }
 
   for (const [i, arg] of args.entries()) {
     // 📖 -y is a boolean flag (security auto-fix), never an API key
@@ -610,7 +616,7 @@ export function parseArgs(argv) {
 
   // 📖 --sync-set [name] — auto-discover and populate a router set with best available models
   const syncSetMode = flags.includes('--sync-set')
-  const syncSetName = syncSetValueIdx !== -1 ? args[syncSetValueIdx] : null
+  const syncSetName = firstFlagValue(syncSetFlag)
 
   // 📖 --web / --gui / web subcommand — launch the web dashboard instead of the TUI
   const webMode = flags.includes('--web') || flags.includes('--gui') || args[0] === 'web'
@@ -626,10 +632,11 @@ export function parseArgs(argv) {
   const hideUnconfigured = flags.includes('--hide-unconfigured')
   const showUnconfigured = flags.includes('--show-unconfigured')
 
-  let tierFilter = tierValueIdx !== -1 ? args[tierValueIdx].toUpperCase() : null
-  let sortColumn = sortValueIdx !== -1 ? args[sortValueIdx].toLowerCase() : null
-  let originFilter = originValueIdx !== -1 ? args[originValueIdx] : null
-  let pingInterval = pingIntervalValueIdx !== -1 ? parseInt(args[pingIntervalValueIdx], 10) : null
+  let tierFilter = firstFlagValue(tierFlag)?.toUpperCase() ?? null
+  let sortColumn = firstFlagValue(sortFlag)?.toLowerCase() ?? null
+  let originFilter = firstFlagValue(originFlag)
+  let pingIntervalRaw = firstFlagValue(pingIntervalFlag)
+  let pingInterval = pingIntervalRaw !== null ? parseInt(pingIntervalRaw, 10) : null
   let sortDirection = sortDesc ? 'desc' : (sortAscFlag ? 'asc' : null)
 
   // 📖 Profile system removed - API keys now persist permanently across all sessions
@@ -645,19 +652,14 @@ export function parseArgs(argv) {
   // 📖 --probe-ttl overrides the 24h default; --show-broken un-hides broken models for this run.
   const reprobeMode = flags.includes('--reprobe') || flags.includes('--no-cache')
   const showBrokenMode = flags.includes('--show-broken')
-  const probeTtlRaw = probeTtlValueIdx !== -1 ? args[probeTtlValueIdx] : null
+  const probeTtlRaw = firstFlagValue(probeTtlFlag)
   const probeTtlMs = probeTtlRaw !== null ? parseInt(probeTtlRaw, 10) : null
 
   // 📖 Drift detection flags (t5):
   // 📖 --check-drift (boolean) — print a drift report vs models.dev, exit non-zero on mismatch.
   // 📖 --drift-threshold <N> (value) — only fail when N+ mismatches are found.
   const checkDriftMode = flags.includes('--check-drift')
-  const driftThresholdIdx = args.findIndex(a => a.toLowerCase() === '--drift-threshold')
-  const driftThresholdValueIdx = (driftThresholdIdx !== -1 && args[driftThresholdIdx + 1] && !args[driftThresholdIdx + 1].startsWith('--'))
-    ? driftThresholdIdx + 1
-    : -1
-  if (driftThresholdValueIdx !== -1) skipIndices.add(driftThresholdValueIdx)
-  const driftThresholdRaw = driftThresholdValueIdx !== -1 ? args[driftThresholdValueIdx] : null
+  const driftThresholdRaw = firstFlagValue(driftThresholdFlag)
   const driftThreshold = driftThresholdRaw !== null ? parseInt(driftThresholdRaw, 10) : null
 
   return {
@@ -716,7 +718,7 @@ export function parseArgs(argv) {
     // 📖 Runtime telemetry flag (t3) — see src/core/runtime-telemetry.js
     clearRuntimeMode,
     // 📖 Config location flag — see src/core/config.js getConfigDir()
-    configDir: configDirValueIdx !== -1 ? args[configDirValueIdx] : null,
+    configDir: firstFlagValue(configDirFlag),
     // 📖 Security auto-fix flag - see src/core/security.js checkConfigSecurity()
     fixPermissionsMode,
   }
@@ -748,6 +750,103 @@ export function resolveSecurityAction({ configExists, isSecure, autoFixRequested
   return 'prompt'
 }
 
+// 📖 parseIcaclsOutput: PURE parser for Windows `icacls <file>` output, used by
+// 📖 the config security check to get a REAL answer about NTFS access.
+// 📖 WHY: on win32 Node reports POSIX-style modes as 0666 (writable) or 0444
+// 📖 (read-only) only - 0600 is unreachable - so the old `(mode & 0o777) === 0o600`
+// 📖 test was always false and the warning re-fired on every launch (issue #173
+// 📖 follow-up from rutexd). Only the ACL tells the truth on NTFS.
+// 📖
+// 📖 Sample output we must handle (ACEs, one per line, path on the first line):
+//   C:\Users\rutex\.free-coding-models.json NT AUTHORITY\SYSTEM:(I)(F)
+//                                           BUILTIN\Administrators:(I)(F)
+//                                           DESKTOP-XYZ\rutex:(F)
+//   Successfully processed 1 files; Failed processing 0 files
+// 📖 `(I)` marks an inherited ACE, so "inheritance disabled" = no `(I)` anywhere.
+// 📖 Locale-proof whitelists: names are machine-localized, so we whitelist by
+// 📖 substring (SYSTEM, Administra* covers Administrators/Administrateurs) and
+// 📖 by well-known SID (S-1-5-18 = SYSTEM, S-1-5-32-544 = Administrators), plus
+// 📖 the current user (case-insensitive, domain-qualified or bare).
+// 📖
+// 📖 Params:
+//   output   - raw stdout of `icacls <path>` (string)
+//   userName - current user name (string), e.g. "rutex"
+//   filePath - the exact path passed to icacls (optional but STRONGLY
+//              recommended: icacls echoes it on the first line, glued to the
+//              first ACE, and paths/account names can both contain spaces)
+// 📖 Returns { inheritanceEnabled, othersHaveAccess, ownerHasAccess, grants }
+//   grants = [{ name, flags }] for every ACE line; empty when output unparseable.
+export function parseIcaclsOutput({ output, userName, filePath = '' }) {
+  const text = String(output ?? '')
+  const user = String(userName ?? '').trim().toLowerCase()
+  const knownPath = String(filePath ?? '')
+  const lines = text.split(/\r?\n/)
+
+  // 📖 The rights/flags groups always end the line: "(I)(F)", "(F)", "(R,W)"...
+  const aceTail = /((?:\([^)]*\)\s*)+)$/
+  const grants = []
+  for (const rawLine of lines) {
+    const tail = aceTail.exec(rawLine)
+    if (!tail) continue
+
+    let before = rawLine.slice(0, tail.index).trim()
+    if (before === '') continue
+    // 📖 Drop the colon that separates the account name from its flags.
+    before = before.replace(/:$/, '').trim()
+    // 📖 First ACE shares its line with the echoed path: strip the path we
+    // 📖 passed to icacls. Without a known path, keep only the segment after
+    // 📖 the last whitespace (exact for simple names; callers should pass
+    // 📖 filePath when the path or account name contains spaces).
+    if (knownPath && before.startsWith(knownPath)) {
+      before = before.slice(knownPath.length).trim()
+    } else if (knownPath === '' && /\s/.test(before)) {
+      before = before.slice(before.lastIndexOf(' ') + 1).trim()
+    }
+    if (before === '') continue
+    grants.push({ name: before, flags: tail[1].replace(/\s+/g, '') })
+  }
+
+  const isTrusted = (name) => {
+    const n = name.toLowerCase()
+    if (user !== '' && (n === user || n.endsWith('\\' + user))) return true
+    if (n.includes('system') || n.includes('s-1-5-18')) return true
+    if (n.includes('administra') || n.includes('s-1-5-32-544')) return true
+    return false
+  }
+
+  const inheritanceEnabled = grants.some((g) => g.flags.includes('I'))
+  const others = grants.filter((g) => !isTrusted(g.name)).map((g) => g.name)
+  const ownerHasAccess = grants.some((g) => {
+    const n = g.name.toLowerCase()
+    return user !== '' && (n === user || n.endsWith('\\' + user))
+  })
+
+  return {
+    inheritanceEnabled,
+    othersHaveAccess: others.length > 0,
+    ownerHasAccess,
+    grants,
+    otherNames: others,
+  }
+}
+
+// 📖 shouldSkipSecurityWarn: PURE anti-nag gate for the config security warning.
+// 📖 WHY: when the permission fix cannot be applied or verified (rare: icacls
+// 📖 missing on Windows, chmod failing on POSIX), the insecure state persists and
+// 📖 the warning used to re-fire on every single launch. Once we warned and the
+// 📖 fix did not stick, stay quiet for `intervalDays` (default 30) instead of
+// 📖 nagging daily. `--fix-permissions` bypasses the gate in the caller.
+// 📖 Params: ackedAt - last warning timestamp (ms epoch or ISO string or null)
+//           now - current time in ms epoch; intervalDays - quiet window length
+// 📖 Returns true only when ackedAt parses AND is less than intervalDays old.
+export function shouldSkipSecurityWarn({ ackedAt, now = Date.now(), intervalDays = 30 }) {
+  if (ackedAt === null || ackedAt === undefined || ackedAt === '') return false
+  const then = typeof ackedAt === 'number' ? ackedAt : Date.parse(String(ackedAt))
+  if (!Number.isFinite(then)) return false
+  const intervalMs = Math.max(0, intervalDays) * 24 * 60 * 60 * 1000
+  return now - then < intervalMs && now >= then
+}
+
 // 📖 detectTerminalCapabilities: PURE terminal capability probe for TUI overlays.
 // 📖 WHY: basic server consoles (IPMI/KVM viewers, ASPEED framebuffer, serial
 // 📖 terminals) often run 80x24 or smaller with no or limited color support, and
@@ -1031,6 +1130,9 @@ export function getVersionStatusInfo(updateState, latestVersion, startupLatestVe
  * @returns {string} JSON string of formatted results
  */
 export function formatResultsAsJSON(results, sortBy = 'avg', limit = 0) {
+  // 📖 Only slice for a usable positive limit: a negative limit used to drop the
+  // 📖 last row(s) via slice(0, -1), and 0/undefined means "all results".
+  const effectiveLimit = Number.isInteger(limit) && limit > 0 ? limit : undefined
   const formatted = results
     .map((r, idx) => ({
       rank: r.idx || idx + 1,
@@ -1050,7 +1152,7 @@ export function formatResultsAsJSON(results, sortBy = 'avg', limit = 0) {
       status: r.status || null,
       httpCode: r.httpCode || null
     }))
-    .slice(0, limit || undefined)
+    .slice(0, effectiveLimit)
 
   return JSON.stringify(formatted, null, 2)
 }

package/src/tui/app.js

@@ -93,7 +93,7 @@ import chalk from 'chalk'
 import { createRequire } from 'module'
 import { randomUUID } from 'crypto'
 import { MODELS, sources } from '../../sources.js'
-import { getAvg, getVerdict, getUptime, getP95, getJitter, getStabilityScore, sortResults, filterByTier, findBestModel, parseArgs, TIER_ORDER, VERDICT_ORDER, TIER_LETTER_MAP, scoreModelForTask, getTopRecommendations, TASK_TYPES, PRIORITY_TYPES, CONTEXT_BUDGETS, formatCtxWindow, labelFromId, formatResultsAsJSON } from '../core/utils.js'
+import { getAvg, getVerdict, getUptime, getP95, getJitter, getStabilityScore, sortResults, filterByTier, parseArgs, TIER_ORDER, VERDICT_ORDER, TIER_LETTER_MAP, scoreModelForTask, getTopRecommendations, TASK_TYPES, PRIORITY_TYPES, CONTEXT_BUDGETS, formatResultsAsJSON } from '../core/utils.js'
 import { loadConfig, saveConfig, getApiKey, resolveApiKeys, addApiKey, removeApiKey, isProviderEnabled, persistApiKeysForProvider } from '../core/config.js'
 import { buildMergedModels } from '../core/model-merger.js'
 import { loadOpenCodeConfig, saveOpenCodeConfig } from '../core/opencode-config.js'
@@ -101,7 +101,7 @@ import { usageForRow as _usageForRow } from '../core/usage-reader.js'
 import { buildProviderModelTokenKey, loadTokenUsageByProviderModel } from '../core/token-usage-reader.js'
 import { parseOpenRouterResponse, fetchProviderQuota as _fetchProviderQuotaFromModule, getAllQuotas as _getAllPassiveQuotasFromModule } from '../core/provider-quota-fetchers.js'
 import { isKnownQuotaTelemetry } from '../core/quota-capabilities.js'
-import { ALT_ENTER, ALT_LEAVE, ALT_HOME, PING_TIMEOUT, PING_INTERVAL, FPS, COL_MODEL, COL_MS, CELL_W, FRAMES, TIER_CYCLE, VERDICT_CYCLE, HEALTH_CYCLE, SETTINGS_OVERLAY_BG, HELP_OVERLAY_BG, RECOMMEND_OVERLAY_BG, OVERLAY_PANEL_WIDTH, TABLE_HEADER_LINES, TABLE_FOOTER_LINES, TABLE_FIXED_LINES, WIDTH_WARNING_MIN_COLS, msCell, spinCell } from '../core/constants.js'
+import { ALT_ENTER, ALT_LEAVE, ALT_HOME, PING_TIMEOUT, PING_INTERVAL, FPS, FRAMES, TIER_CYCLE, VERDICT_CYCLE, HEALTH_CYCLE, SETTINGS_OVERLAY_BG, HELP_OVERLAY_BG, RECOMMEND_OVERLAY_BG, OVERLAY_PANEL_WIDTH, TABLE_HEADER_LINES, TABLE_FOOTER_LINES, TABLE_FIXED_LINES, WIDTH_WARNING_MIN_COLS } from '../core/constants.js'
 import { TIER_COLOR } from './tier-colors.js'
 import { resolveCloudflareUrl, buildPingRequest, ping, extractQuotaPercent, getProviderQuotaPercentCached, usagePlaceholderForProvider } from '../core/ping.js'
 import { runFiableMode, filterByTierOrExit, fetchOpenRouterFreeModels } from '../core/analysis.js'
@@ -109,12 +109,12 @@ import { PROVIDER_METADATA, ENV_VAR_NAMES, isWindows, isMac } from '../core/prov
 import { parseTelemetryEnv, isTelemetryDebugEnabled, telemetryDebug, ensureTelemetryConfig, getTelemetryDistinctId, getTelemetrySystem, getTelemetryTerminal, isTelemetryEnabled, sendUsageTelemetry } from '../core/telemetry.js'
 import { ensureFavoritesConfig, toFavoriteKey, syncFavoriteFlags, toggleFavoriteModel, reorderFavorite, pruneOrphanedFavorites } from '../core/favorites.js'
 import { checkForUpdateDetailed, checkForUpdate, runUpdate, fetchLastReleaseDate } from '../core/updater.js'
-import { createTuiState, PING_MODE_INTERVALS, PING_MODE_CYCLE, SPEED_MODE_DURATION_MS, IDLE_SLOW_AFTER_MS, intervalToPingMode } from './tui-state.js'
+import { createTuiState, PING_MODE_INTERVALS, PING_MODE_CYCLE, SPEED_MODE_DURATION_MS, IDLE_SLOW_AFTER_MS, PING_HISTORY_CAP, intervalToPingMode } from './tui-state.js'
 import { createPingLoop } from '../core/ping-loop.js'
 import { createTuiFilters } from './tui-filters.js'
 import { promptApiKey } from '../core/setup.js'
 import { syncShellEnv, ensureShellRcSource, removeShellEnv } from '../core/shell-env.js'
-import { stripAnsi, maskApiKey, displayWidth, padEndDisplay, tintOverlayLines, keepOverlayTargetVisible, sliceOverlayLines, calculateViewport, sortResultsWithPinnedFavorites, adjustScrollOffset } from './render-helpers.js'
+import { displayWidth, padEndDisplay, tintOverlayLines, keepOverlayTargetVisible, sliceOverlayLines, sortResultsWithPinnedFavorites, adjustScrollOffset, runWithConcurrency } from './render-helpers.js'
 import { renderTable, PROVIDER_COLOR } from './render-table.js'
 import { setOpenCodeModelData, startOpenCode, startOpenCodeDesktop, startOpenCodeWeb } from '../core/opencode.js'
 import { startKilo } from '../core/kilo.js'
@@ -478,6 +478,12 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
   let ticker = null
   let onKeyPress = null
   let onMouseData = null  // 📖 Mouse data listener — set after createMouseEventHandler
+  // 📖 The variables above hold raw handler functions, but what actually gets
+  // 📖 registered on process.stdin are the WRAPPERS below. stopUi used to remove
+  // 📖 the raw functions (a silent no-op) - it now removes these tracked
+  // 📖 wrappers so launch/update paths really detach the listeners.
+  let keypressWrapper = null
+  let mouseDataWrapper = null
   let pingModel = null
 
   // 📖 scheduleNextPing: wrapper that defers to the factory version, passing the current runPingCycle.
@@ -505,7 +511,9 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
         r.verdict = cachedModel.verdict
         r.status = cachedModel.status
         r.httpCode = cachedModel.httpCode
-        r.pings = cachedModel.pings || []
+        // 📖 Trim restored history to PING_HISTORY_CAP so an oversized cache
+        // 📖 file cannot instantly reintroduce the unbounded-growth problem.
+        r.pings = (cachedModel.pings || []).slice(-PING_HISTORY_CAP)
       }
     }
   }
@@ -621,6 +629,13 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
       }
 
       r.pings.push({ ms, code })
+      // 📖 Cap ping history (PING_HISTORY_CAP = 300): r.pings used to grow
+      // 📖 unbounded and getAvg/getP95/getVerdict/getStabilityScore rescan it
+      // 📖 per row at ~12 FPS. Stats (uptime, avg) now roll over the last
+      // 📖 300 pings instead of the entire session; the oldest entries shift out.
+      if (r.pings.length > PING_HISTORY_CAP) {
+        r.pings.splice(0, r.pings.length - PING_HISTORY_CAP)
+      }
 
       // 📖 Probe-cache (t1): record the result so future runs can skip healthy models
       // 📖 and auto-hide broken ones. Uses the module-level in-memory cache; flushed
@@ -767,8 +782,9 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
     clearTimeout(state.pingIntervalObj)
     clearInterval(state.versionRecheckTimer)
     stopRouterDashboardClient(state)
-    if (onKeyPress) process.stdin.removeListener('keypress', onKeyPress)
-    if (onMouseData) process.stdin.removeListener('data', onMouseData)
+    // 📖 Remove the actual registered wrappers (see keypressWrapper/mouseDataWrapper).
+    if (keypressWrapper) process.stdin.removeListener('keypress', keypressWrapper)
+    if (mouseDataWrapper) process.stdin.removeListener('data', mouseDataWrapper)
     if (process.stdin.isTTY && resetRawMode) process.stdin.setRawMode(false)
     process.stdin.pause()
     process.stdout.write(ALT_LEAVE)
@@ -837,6 +853,7 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
     sortResultsWithPinnedFavorites,
     adjustScrollOffset,
     applyTierFilter,
+    getPingModel: () => pingModel,
     PING_INTERVAL,
     TIER_CYCLE,
     ORIGIN_CYCLE,
@@ -948,7 +965,7 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
     }
   })
 
-  process.stdin.on('keypress', async (str, key) => {
+  keypressWrapper = async (str, key) => {
     try {
       // 📖 Skip keypress events that originate from mouse escape sequences.
       // 📖 readline may partially parse SGR mouse sequences as garbage keypresses.
@@ -963,18 +980,20 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
       console.error(chalk.yellow('\nPlease file an issue at https://github.com/vava-nessa/free-coding-models/issues or join the Discord to report this to the author.'));
       process.exit(1);
     }
-  })
+  }
+  process.stdin.on('keypress', keypressWrapper)
 
   // 📖 Mouse data listener: parses SGR mouse escape sequences from raw stdin
   // 📖 and dispatches structured events (click, scroll, double-click) to the mouse handler.
-  process.stdin.on('data', (data) => {
+  mouseDataWrapper = (data) => {
     try {
       if (onMouseData) onMouseData(data)
     } catch (err) {
       // 📖 Mouse errors are non-fatal — log and continue so the TUI doesn't crash.
       // 📖 This could happen on terminals that send unexpected mouse sequences.
     }
-  })
+  }
+  process.stdin.on('data', mouseDataWrapper)
 
   process.on('SIGCONT', noteUserActivity)
 
@@ -1103,8 +1122,6 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
         ? overlays.renderPlayground()
       : state.tokenUsageOpen
         ? overlays.renderTokenUsage()
-      : state.routerOnboardingOpen
-        ? overlays.renderRouterOnboarding()
       : state.incompatibleFallbackOpen
         ? overlays.renderIncompatibleFallback()
       : state.commandPaletteOpen
@@ -1207,7 +1224,14 @@ export async function runApp(cliArgs, config, startupOptions = {}) {
   const initialDueModels = state.results.filter(r => !isCacheFresh(r.providerKey, r.modelId, {
     ttlMs: state.probeCacheTtlMs,
   }))
-  const initialPing = Promise.all(initialDueModels.map(r => pingModel(r)))
+  // 📖 Startup burst runs through runWithConcurrency(…, 5) - the same bounded
+  // 📖 helper the 404 probe uses. The old Promise.all fired up to ~226
+  // 📖 simultaneous pings at once, a guaranteed 429 storm on rate-limited
+  // 📖 providers (and per-task errors are captured instead of rejecting the batch).
+  const initialPing = runWithConcurrency(
+    initialDueModels.map(r => () => pingModel(r)),
+    5
+  )
 
   // 📖 Continuous ping loop with mode-driven cadence.
   const runPingCycle = async () => {

package/src/tui/command-palette.js

@@ -9,7 +9,7 @@
  *   → `fuzzyMatchCommand` — scores a query against one string and returns match positions
  *   → `filterCommandPaletteEntries` — returns sorted command matches for a query
  *
- * @exports { buildCommandPaletteTree, flattenCommandTree, fuzzyMatchCommand, filterCommandPaletteEntries }
+ * @exports { buildCommandPaletteTree, flattenCommandTree, fuzzyMatchCommand, filterCommandPaletteEntries, COMMAND_PALETTE_MAX_RESULTS, clampPaletteCursor }
  *
  * @see src/key-handler.js
  * @see src/overlays.js
@@ -17,6 +17,25 @@
 
 import { TOOL_METADATA, TOOL_MODE_ORDER } from '../core/tool-metadata.js'
 import { sources } from '../../sources.js'
+import { sanitizePingInterval } from './tui-state.js'
+
+// 📖 Max result rows the palette renders (overlays.js slices to this). The
+// 📖 cursor must never point past the rendered slice, so key-handler clamps
+// 📖 with clampPaletteCursor() against the same constant.
+export const COMMAND_PALETTE_MAX_RESULTS = 80
+
+/**
+ * 📖 clampPaletteCursor: Keep the palette cursor inside the RENDERED slice.
+ * 📖 The overlay only paints the first COMMAND_PALETTE_MAX_RESULTS rows, so a
+ * 📖 cursor clamped against the full result list could sit on an invisible row.
+ * @param {number} cursor
+ * @param {number} totalResults
+ * @returns {number}
+ */
+export function clampPaletteCursor(cursor, totalResults) {
+  const max = Math.max(0, Math.min(totalResults, COMMAND_PALETTE_MAX_RESULTS) - 1)
+  return Math.min(Math.max(0, cursor), max)
+}
 
 const PROVIDER_FILTER_COMMANDS = Object.entries(sources).map(([providerKey, source]) => {
   const label = source?.name || providerKey
@@ -229,7 +248,8 @@ export function buildCommandPaletteTree(visibleModels = [], config = null) {
 
   // 📖 Update Normal mode label if config is provided
   if (config) {
-    const normalInterval = config.settings?.pingInterval ?? 10000
+    // 📖 Guard against 0/negative/garbage pingInterval (same rule as tui-state).
+    const normalInterval = sanitizePingInterval(config.settings?.pingInterval, 10000)
     const normalSec = Math.round(normalInterval / 1000)
     const actionsNode = tree.find(n => n.id === 'actions')
     const pingNode = actionsNode?.children.find(n => n.id === 'action-ping-mode')