free-coding-models 0.5.88 → 0.5.89

package/README.md

@@ -151,6 +151,12 @@ free-coding-models --daemon-stop    # stop
 
 > 📖 **Full guide (probes, circuit breaker, failover, Playground, `--sync-set`, REST API):** [`docs/router.md`](./docs/router.md)
 
+### 🧪 Router v2 engine (built in)
+
+The router daemon now runs the hardened v2 engine internally: content-validated failover (a 200 with empty or garbage output is a failure and fails over), quota-aware routing with `Retry-After` pauses, persisted circuit breakers with a DEGRADED warning state, per-request decision traces, an Anthropic `/v1/messages` endpoint, and "test via router" actions that exercise the real routing chain. Same command, same port, same endpoints - existing setups upgrade by updating the package.
+
+Open the TUI with `Shift+V` (or the "Router v2" entry in the Web Dashboard) to see the live fallback chain, per-request attempt chains and run pinned-model tests (`Ctrl+T`). Docs: [`docs/router-v2.md`](./docs/router-v2.md).
+
 ---
 
 ## 📖 CLI Flags

package/bin/free-coding-models.js

@@ -118,7 +118,7 @@ async function main() {
   ensureFavoritesConfig(config);
 
   const isDevMode = isPackageDevMode();
-  const shouldEnforceUpdate = !cliArgs.daemonStopMode && !cliArgs.daemonStatusMode;
+  const shouldEnforceUpdate = !cliArgs.daemonStopMode && !cliArgs.daemonStatusMode && !cliArgs.routerV2StopMode && !cliArgs.routerV2StatusMode;
   const startupUpdate = shouldEnforceUpdate
     ? await enforceMandatoryStartupUpdate(config, {
       saveConfig,
@@ -168,7 +168,11 @@ async function main() {
     && !cliArgs.daemonMode
     && !cliArgs.daemonBackgroundMode
     && !cliArgs.daemonStopMode
-    && !cliArgs.daemonStatusMode;
+    && !cliArgs.daemonStatusMode
+    && !cliArgs.routerV2Mode
+    && !cliArgs.routerV2BackgroundMode
+    && !cliArgs.routerV2StopMode
+    && !cliArgs.routerV2StatusMode;
   try {
     await checkConfigSecurity({ autoFix: cliArgs.fixPermissionsMode, promptAllowed });
   } catch {
@@ -210,6 +214,33 @@ async function main() {
     process.exit(result.ok ? 0 : 1);
   }
 
+  // 📖 Router v2 lifecycle flags are now ALIASES of the main daemon: the v2
+  // engine (content-validated failover, persisted breakers, decision traces,
+  // Anthropic /v1/messages) is merged into the regular router daemon on the
+  // historical port. The flags keep working for existing scripts.
+  if (cliArgs.routerV2Mode || cliArgs.routerV2BackgroundMode || cliArgs.routerV2StopMode || cliArgs.routerV2StatusMode) {
+    const {
+      getRouterDaemonStatus,
+      runRouterDaemon,
+      startRouterDaemonBackground,
+      stopRouterDaemon,
+    } = await import('../src/core/router-daemon.js');
+
+    if (cliArgs.routerV2Mode) {
+      await runRouterDaemon();
+      return;
+    }
+
+    const result = cliArgs.routerV2BackgroundMode
+      ? await startRouterDaemonBackground()
+      : cliArgs.routerV2StopMode
+        ? await stopRouterDaemon()
+        : await getRouterDaemonStatus();
+
+    console.log(JSON.stringify(result, null, 2));
+    process.exit(result.ok ? 0 : 1);
+  }
+
   // 📖 --sync-set [name] — auto-discover, probe, and populate a router set
   if (cliArgs.syncSetMode) {
     const { syncSet } = await import('../src/core/sync-set.js');

package/changelog/v0.5.89.md

@@ -0,0 +1,20 @@
+# Changelog v0.5.89 - 2026-09-06
+
+### Added
+- 🧪 **Smart Model Router v2 engine (built in)**: the regular router daemon (`--daemon-bg`, historical port) now runs the hardened v2 engine - same command, same port, same endpoints, existing setups upgrade transparently. A hardened parallel beta ran on port 19380 during development; it is retired by this release. Open the TUI overlay with `Shift+V`, or use the "Router v2" page in the Web Dashboard (BETA badge on both surfaces).
+- 🛡️ **Content-validated failover**: a 200 only counts as a success when the answer holds real content. Empty `choices`, embedded `error` objects or content-less replies now fail over to the next model, in both streaming and non-streaming. This closes the biggest v1 blind spot where free providers serving empty 200s were reported as successes.
+- ⏱️ **Body-read timeout**: a provider that sends headers but trickles (or never sends) the body can no longer hang your coding tool; the read is raced against `router.failover.bodyReadTimeoutMs` (default 30s) and fails over.
+- 🔥 **Quota-aware routing**: models answering 429 are paused for their `Retry-After` window and skipped; when every model is paused the client gets a proper `429` + `Retry-After` instead of a generic 503.
+- ⚖️ **Blame attribution**: client-caused 4xx (bad payload, unsupported fields) fail over but never damage healthy models' circuit breakers, and client disconnects never mark failures.
+- 💾 **Persisted circuit breakers**: breaker state survives daemon restarts, with a new amber `DEGRADED` warning state (60% of the failure threshold) and escalating cooldowns for repeatedly-tripping models.
+- 🔍 **Decision traces**: every response carries `x-fcm-v2-model`, `x-fcm-v2-attempts` and `x-fcm-v2-decision` headers, and every request chain (attempts, statuses, skip reasons) is persisted locally and rendered in the TUI overlay and the web page. Routing metadata only: no prompts, no keys.
+- 🤖 **Anthropic `/v1/messages` support** on the v2 port: request, response and SSE stream translation (including `tool_use` / `input_json_delta`), so Anthropic-protocol agents can use the router directly.
+- 📌 **Pinned-model requests**: `model: "fcm:@provider/modelId"` routes to one exact model through the full chain with failover disabled. New `Ctrl+T` (test selected model) and `Ctrl+Shift+T` (test all visible models) TUI hotkeys use it to test the real routing path, unlike the direct-to-provider `Ctrl+A` / `Ctrl+U` benchmarks.
+- 🚑 **Last-resort model**: optional `router.failover.lastResortModel` config gives a designated model one final shot when the whole set fails.
+- ⚡ **Fast first boot**: v2 listens before its first probe pass, removing the old first-boot stall where the router port stayed dark for up to ~36 seconds.
+
+### Security
+- 🔒 Client `x-api-key` headers are now stripped before proxying to upstream providers on v2, so the local router token can never leak to a provider.
+
+### Fixed
+- 🐛 Ghost "active requests" no longer accumulate in v2 stats when a request is rejected before routing (v1 leaks one entry per rejected request until restart).

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "free-coding-models",
-  "version": "0.5.88",
-  "description": "Find the fastest coding LLM models in seconds — ping free models from multiple providers, pick the best one for OpenCode, Cursor, or any AI coding assistant.",
+  "version": "0.5.89",
+  "description": "Find the fastest coding LLM models in seconds \u2014 ping free models from multiple providers, pick the best one for OpenCode, Cursor, or any AI coding assistant.",
   "keywords": [
     "nvidia",
     "nim",