free-coding-models 0.5.87 → 0.5.89

package/README.md

@@ -27,10 +27,6 @@ free-coding-models
   <sub>Then create a free account on one of the <a href="#-providers">24 providers</a> to grab an API key.</sub>
 </p>
 
-<p align="center">
-  <img src="website/public/demo.gif" alt="free-coding-models demo" width="100%">
-</p>
-
 <p align="center">
   <sub>Made with ❤️ and ☕ by <a href="https://vanessadepraute.dev">Vanessa Depraute</a> (aka <a href="https://vavanessa.dev">Vava-Nessa</a>)</sub>
 </p>
@@ -87,10 +83,6 @@ free-coding-models --fiable              # print the single most reliable model
 - 🔀 Want one endpoint that never dies? `free-coding-models --daemon-bg` starts the [Smart Model Router](./docs/router.md).
 - 🤖 Live inside an agent? Install the [OpenCode plugin](./packages/fcm-opencode/README.md) or the [Pi extension](./packages/fcm-pi/README.md).
 
-<p align="center">
-  <img src="demo2.gif" alt="free-coding-models TUI demo" width="100%">
-</p>
-
 ---
 
 ## 🟢 Providers
@@ -159,6 +151,12 @@ free-coding-models --daemon-stop    # stop
 
 > 📖 **Full guide (probes, circuit breaker, failover, Playground, `--sync-set`, REST API):** [`docs/router.md`](./docs/router.md)
 
+### 🧪 Router v2 engine (built in)
+
+The router daemon now runs the hardened v2 engine internally: content-validated failover (a 200 with empty or garbage output is a failure and fails over), quota-aware routing with `Retry-After` pauses, persisted circuit breakers with a DEGRADED warning state, per-request decision traces, an Anthropic `/v1/messages` endpoint, and "test via router" actions that exercise the real routing chain. Same command, same port, same endpoints - existing setups upgrade by updating the package.
+
+Open the TUI with `Shift+V` (or the "Router v2" entry in the Web Dashboard) to see the live fallback chain, per-request attempt chains and run pinned-model tests (`Ctrl+T`). Docs: [`docs/router-v2.md`](./docs/router-v2.md).
+
 ---
 
 ## 📖 CLI Flags
@@ -179,7 +177,7 @@ Flags combine freely in any order. The most common:
 | `--reprobe` / `--probe-ttl <ms>` / `--show-broken` | Probe cache control |
 | `--check-drift` | Diff `sources.js` vs models.dev, exit 1 on mismatch |
 | `--config-dir <dir>` | Custom config location |
-| `--fix-permissions` / `--yes` | Auto-fix config file permissions (chmod 600) |
+| `--fix-permissions` / `--yes` | Auto-fix config file permissions (chmod 600, NTFS ACLs via icacls on Windows) |
 | `--web` | Open the Web Dashboard instead of the TUI |
 | `--daemon` / `--daemon-bg` / `--daemon-status` / `--daemon-stop` | Smart Model Router lifecycle |
 | `--sync-set [name]` | Auto-populate a router set with the currently best models |

package/bin/free-coding-models.js

@@ -118,7 +118,7 @@ async function main() {
   ensureFavoritesConfig(config);
 
   const isDevMode = isPackageDevMode();
-  const shouldEnforceUpdate = !cliArgs.daemonStopMode && !cliArgs.daemonStatusMode;
+  const shouldEnforceUpdate = !cliArgs.daemonStopMode && !cliArgs.daemonStatusMode && !cliArgs.routerV2StopMode && !cliArgs.routerV2StatusMode;
   const startupUpdate = shouldEnforceUpdate
     ? await enforceMandatoryStartupUpdate(config, {
       saveConfig,
@@ -168,7 +168,11 @@ async function main() {
     && !cliArgs.daemonMode
     && !cliArgs.daemonBackgroundMode
     && !cliArgs.daemonStopMode
-    && !cliArgs.daemonStatusMode;
+    && !cliArgs.daemonStatusMode
+    && !cliArgs.routerV2Mode
+    && !cliArgs.routerV2BackgroundMode
+    && !cliArgs.routerV2StopMode
+    && !cliArgs.routerV2StatusMode;
   try {
     await checkConfigSecurity({ autoFix: cliArgs.fixPermissionsMode, promptAllowed });
   } catch {
@@ -210,6 +214,33 @@ async function main() {
     process.exit(result.ok ? 0 : 1);
   }
 
+  // 📖 Router v2 lifecycle flags are now ALIASES of the main daemon: the v2
+  // engine (content-validated failover, persisted breakers, decision traces,
+  // Anthropic /v1/messages) is merged into the regular router daemon on the
+  // historical port. The flags keep working for existing scripts.
+  if (cliArgs.routerV2Mode || cliArgs.routerV2BackgroundMode || cliArgs.routerV2StopMode || cliArgs.routerV2StatusMode) {
+    const {
+      getRouterDaemonStatus,
+      runRouterDaemon,
+      startRouterDaemonBackground,
+      stopRouterDaemon,
+    } = await import('../src/core/router-daemon.js');
+
+    if (cliArgs.routerV2Mode) {
+      await runRouterDaemon();
+      return;
+    }
+
+    const result = cliArgs.routerV2BackgroundMode
+      ? await startRouterDaemonBackground()
+      : cliArgs.routerV2StopMode
+        ? await stopRouterDaemon()
+        : await getRouterDaemonStatus();
+
+    console.log(JSON.stringify(result, null, 2));
+    process.exit(result.ok ? 0 : 1);
+  }
+
   // 📖 --sync-set [name] — auto-discover, probe, and populate a router set
   if (cliArgs.syncSetMode) {
     const { syncSet } = await import('../src/core/sync-set.js');

package/changelog/v0.5.88.md

@@ -0,0 +1,16 @@
+# Changelog v0.5.88 - 2026-09-06
+
+### Fixed
+- **Windows: the config permissions warning no longer re-fires on every launch** (issue #173 follow-up reported by @rutexd). On Windows, Node can only report file modes 0666 (writable) or 0444 (read-only), so the old "is it 600?" check could never pass: the app warned, you answered yes, it said "fixed!", and the next launch warned again in an endless loop.
+  - The Windows security verdict now comes from the real NTFS ACL, read with `icacls <file>` and parsed by a new pure helper (`parseIcaclsOutput`). The file counts as protected when NTFS inheritance is disabled and only your user (plus trusted SYSTEM/Administrators entries, matched by name or well-known SID, locale-proof) has access.
+  - Fixing on Windows now runs `icacls "<file>" /inheritance:r /grant:r "<user>:F"` (no shell, injection-safe) instead of the no-op chmod, and the fix is **verified by re-reading the ACL** before the app claims success. No more fake "✅ Permissions fixed!".
+  - The warning now explains *what* is wrong on NTFS (inherited access, or which other principals have a grant) instead of showing a meaningless octal mode.
+- **Anti-nag guard (all platforms)**: when the fix genuinely cannot be applied or verified (rare), the app now writes a small ack marker next to the config file and stays quiet about the same warning for 30 days, instead of nagging on every single launch. Passing `--fix-permissions` / `--yes` / `-y` always bypasses the marker and retries. The marker is cleaned up as soon as a fix succeeds.
+- The manual fix hint on Windows now shows the exact `icacls` command with your real username, and the POSIX path (chmod 600) additionally re-checks the mode after chmod so success messages are always truthful.
+
+### Changed
+- `--fix-permissions` documentation now mentions it applies NTFS ACLs on Windows (README flags table).
+
+### For contributors
+- New pure helpers in `src/core/utils.js`, fully unit-tested: `parseIcaclsOutput` (icacls output parser, handles the echoed path glued to the first ACE, `(I)` inheritance markers, SIDs and localized group names) and `shouldSkipSecurityWarn` (30-day anti-nag gate, ISO string or epoch input, clock-skew safe).
+- `checkConfigSecurity()` gained an integration test covering the full lifecycle: warn once, ack, stay silent on relaunch, auto-fix bypasses the ack, marker cleanup after a successful fix.

package/changelog/v0.5.89.md

@@ -0,0 +1,20 @@
+# Changelog v0.5.89 - 2026-09-06
+
+### Added
+- 🧪 **Smart Model Router v2 engine (built in)**: the regular router daemon (`--daemon-bg`, historical port) now runs the hardened v2 engine - same command, same port, same endpoints, existing setups upgrade transparently. A hardened parallel beta ran on port 19380 during development; it is retired by this release. Open the TUI overlay with `Shift+V`, or use the "Router v2" page in the Web Dashboard (BETA badge on both surfaces).
+- 🛡️ **Content-validated failover**: a 200 only counts as a success when the answer holds real content. Empty `choices`, embedded `error` objects or content-less replies now fail over to the next model, in both streaming and non-streaming. This closes the biggest v1 blind spot where free providers serving empty 200s were reported as successes.
+- ⏱️ **Body-read timeout**: a provider that sends headers but trickles (or never sends) the body can no longer hang your coding tool; the read is raced against `router.failover.bodyReadTimeoutMs` (default 30s) and fails over.
+- 🔥 **Quota-aware routing**: models answering 429 are paused for their `Retry-After` window and skipped; when every model is paused the client gets a proper `429` + `Retry-After` instead of a generic 503.
+- ⚖️ **Blame attribution**: client-caused 4xx (bad payload, unsupported fields) fail over but never damage healthy models' circuit breakers, and client disconnects never mark failures.
+- 💾 **Persisted circuit breakers**: breaker state survives daemon restarts, with a new amber `DEGRADED` warning state (60% of the failure threshold) and escalating cooldowns for repeatedly-tripping models.
+- 🔍 **Decision traces**: every response carries `x-fcm-v2-model`, `x-fcm-v2-attempts` and `x-fcm-v2-decision` headers, and every request chain (attempts, statuses, skip reasons) is persisted locally and rendered in the TUI overlay and the web page. Routing metadata only: no prompts, no keys.
+- 🤖 **Anthropic `/v1/messages` support** on the v2 port: request, response and SSE stream translation (including `tool_use` / `input_json_delta`), so Anthropic-protocol agents can use the router directly.
+- 📌 **Pinned-model requests**: `model: "fcm:@provider/modelId"` routes to one exact model through the full chain with failover disabled. New `Ctrl+T` (test selected model) and `Ctrl+Shift+T` (test all visible models) TUI hotkeys use it to test the real routing path, unlike the direct-to-provider `Ctrl+A` / `Ctrl+U` benchmarks.
+- 🚑 **Last-resort model**: optional `router.failover.lastResortModel` config gives a designated model one final shot when the whole set fails.
+- ⚡ **Fast first boot**: v2 listens before its first probe pass, removing the old first-boot stall where the router port stayed dark for up to ~36 seconds.
+
+### Security
+- 🔒 Client `x-api-key` headers are now stripped before proxying to upstream providers on v2, so the local router token can never leak to a provider.
+
+### Fixed
+- 🐛 Ghost "active requests" no longer accumulate in v2 stats when a request is rejected before routing (v1 leaks one entry per rejected request until restart).

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "free-coding-models",
-  "version": "0.5.87",
-  "description": "Find the fastest coding LLM models in seconds — ping free models from multiple providers, pick the best one for OpenCode, Cursor, or any AI coding assistant.",
+  "version": "0.5.89",
+  "description": "Find the fastest coding LLM models in seconds \u2014 ping free models from multiple providers, pick the best one for OpenCode, Cursor, or any AI coding assistant.",
   "keywords": [
     "nvidia",
     "nim",
@@ -94,5 +94,10 @@
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "vite": "^8.0.16"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
   }
 }