free-coding-models 0.5.88 → 0.5.90

package/src/core/ping.js

@@ -8,17 +8,20 @@
  *   endpoint quota polling with caching.
  *
  *   🎯 Key features:
- *   - Provider-specific request building (handles Replicate, Cloudflare, OpenRouter)
+ *   - Provider-specific request building (handles Replicate, Cloudflare, OpenRouter,
+ *     OpenCode Zen mandatory session header)
  *   - Async ping with timeout and abort controller
  *   - Quota extraction from rate limit headers (multiple variants supported)
  *   - Cached provider quota polling with TTL and error backoff
- *   - Cloudflare account ID resolution from environment
+ *   - Cloudflare account-id resolution from env var, stored config or zero-setup
+ *     auto-discovery via the /accounts endpoint (see ./cloudflare-account.js)
  *   - Per-provider circuit-breaker on 429 (issue #146): pauses ALL models of a provider
  *     when the provider returns a quota-exhausted response, so the ping loop stops
  *     hammering the user's daily quota while the provider's retry window is active.
  *
  *   → Functions:
- *   - `resolveCloudflareUrl`: Resolve {account_id} placeholder from CLOUDFLARE_ACCOUNT_ID env var
+ *   - `getProviderSessionHeaders`: Extra mandatory headers per provider (e.g. OpenCode Zen session id)
+ *   - `resolveCloudflareUrl`: Resolve {account_id} placeholders (env > cache > stored config, issue #181)
  *   - `buildChatCompletionPingBody`: Build minimal chat-completion probe payloads with thinking disabled
  *   - `markDisabledThinkingUnsupported`: Cache strict providers that reject the optional thinking control
  *   - `shouldUseDisabledThinkingForProvider`: Decide whether a provider should receive disabled-thinking probes
@@ -38,13 +41,21 @@
  *
  *   ⚙️ Configuration:
  *   - PING_TIMEOUT: Timeout in ms for ping requests (default: 15000)
- *   - CLOUDFLARE_ACCOUNT_ID: Env var for Cloudflare Workers AI account ID
+ *   - CLOUDFLARE_ACCOUNT_ID: Env var for the Cloudflare Workers AI account id
+ *     (fallbacks: stored settings.cloudflareAccountId, then auto-discovery via
+ *     the /accounts endpoint, handled in ./cloudflare-account.js)
  *
  *   @see {@link ../src/provider-quota-fetchers.js} Quota fetching implementation
  *   @see {@link ../src/quota-capabilities.js} Quota telemetry + Usage behavior detection
  */
 
+import { randomUUID } from 'node:crypto'
 import { PING_TIMEOUT } from './constants.js'
+import {
+  applyCloudflareAccountId,
+  getCloudflareAccountIdSync,
+  ensureCloudflareAccountId,
+} from './cloudflare-account.js'
 import { fetchProviderQuota as _fetchProviderQuotaFromModule, extractQuota as _extractQuotaFromModule, processResponseHeaders as _processResponseHeadersFromModule } from './provider-quota-fetchers.js'
 import { supportsUsagePercent } from './quota-capabilities.js'
 import {
@@ -56,17 +67,15 @@ const DISABLED_THINKING_RETRY_STATUSES = new Set([400, 422])
 const disabledThinkingUnsupportedProviders = new Set()
 
 // 📖 resolveCloudflareUrl: Cloudflare's OpenAI-compatible endpoint is account-scoped.
-// 📖 We resolve the placeholder from the CLOUDFLARE_ACCOUNT_ID env var so provider
-// 📖 setup can stay simple in config. Supports both the `{account_id}` placeholder
-// 📖 and the explicit `{$CLOUDFLARE_ACCOUNT_ID}` form used in sources.js.
-export function resolveCloudflareUrl(url) {
-  const accountId = (process.env.CLOUDFLARE_ACCOUNT_ID || '').trim()
-  const hasPlaceholder = url.includes('{$CLOUDFLARE_ACCOUNT_ID}') || url.includes('{account_id}')
-  if (!hasPlaceholder) return url
-  const replacement = accountId ? encodeURIComponent(accountId) : 'missing-account-id'
-  return url
-    .replace(/\{\$CLOUDFLARE_ACCOUNT_ID\}/g, replacement)
-    .replace(/\{account_id\}/g, replacement)
+// 📖 We resolve the placeholder from the CLOUDFLARE_ACCOUNT_ID env var, the
+// 📖 in-process cache or the stored config settings (issue #181), so provider
+// 📖 setup can stay simple. Supports both the `{account_id}` placeholder and
+// 📖 the explicit `{$CLOUDFLARE_ACCOUNT_ID}` form used in sources.js.
+// 📖 When nothing resolves, the historical 'missing-account-id' segment keeps
+// 📖 verdicts stable. Async paths should call ensureCloudflareAccountId() first
+// 📖 so zero-setup auto-discovery can populate the cache (see ping()).
+export function resolveCloudflareUrl(url, options = {}) {
+  return applyCloudflareAccountId(url, getCloudflareAccountIdSync(options))
 }
 
 // 📖 buildChatCompletionPingBody: Use the smallest useful chat-completion probe.
@@ -97,6 +106,25 @@ export function shouldUseDisabledThinkingForProvider(providerKey) {
   return !disabledThinkingUnsupportedProviders.has(providerKey)
 }
 
+// 📖 getProviderSessionHeaders: extra mandatory headers a provider requires beyond
+// 📖 the standard Content-Type/Authorization pair, centralised so probes (ping.js),
+// 📖 the router daemon and the web dashboard all send identical headers instead of
+// 📖 duplicating per-provider knowledge (issue #181).
+// 📖 OpenCode Zen rejects every request without an `x-opencode-session` header with
+// 📖 HTTP 400 MissingSessionID ("OpenCode's free tier can only be used in OpenCode").
+// 📖 The Zen docs describe a stable per-conversation session id, so we generate ONE
+// 📖 uuid per process at module load: every request this process sends shares the
+// 📖 same identity, mirroring how the real OpenCode client behaves and keeping the
+// 📖 value stable across repeated probes.
+const OPENCODE_ZEN_SESSION_ID = randomUUID()
+
+export function getProviderSessionHeaders(providerKey) {
+  if (providerKey === 'opencode-zen') {
+    return { 'x-opencode-session': OPENCODE_ZEN_SESSION_ID }
+  }
+  return {}
+}
+
 // 📖 buildPingRequest: Build provider-specific ping request.
 // 📖 Handles Replicate's /v1/predictions format, Cloudflare's account_id in URL,
 // 📖 and standard OpenAI-compliant chat completions with provider-specific headers.
@@ -128,7 +156,7 @@ export function buildPingRequest(apiKey, modelId, providerKey, url, options = {}
     }
   }
 
-  const headers = { 'Content-Type': 'application/json' }
+  const headers = { 'Content-Type': 'application/json', ...getProviderSessionHeaders(providerKey) }
   if (apiKey) headers.Authorization = `Bearer ${apiKey}`
   if (providerKey === 'openrouter') {
     // 📖 OpenRouter recommends optional app identification headers.
@@ -178,6 +206,14 @@ async function isDisabledThinkingRejected(resp, req) {
 // 📖 A 401 response still tells us the server is UP and gives us real latency.
 // 📖 Returns { code, ms, quotaPercent }
 export async function ping(apiKey, modelId, providerKey, url) {
+  // 📖 Cloudflare zero-setup (issue #181): before building the request, give the
+  // 📖 account-id resolver a chance to auto-discover the id from the stored API
+  // 📖 key. Done BEFORE the timer starts so a one-time discovery round-trip never
+  // 📖 pollutes the measured latency or races PING_TIMEOUT. No-op when the id is
+  // 📖 already known from env/cache/config.
+  if (providerKey === 'cloudflare') {
+    await ensureCloudflareAccountId()
+  }
   const ctrl  = new AbortController()
   const timer = setTimeout(() => ctrl.abort(), PING_TIMEOUT)
   const t0    = performance.now()

package/src/core/provider-key-tester.js

@@ -27,7 +27,7 @@
  *          runProviderKeyTest, PROVIDER_AUTH_ENDPOINTS
  */
 
-import { ping } from './ping.js'
+import { ping, getProviderSessionHeaders, resolveCloudflareUrl } from './ping.js'
 import { sleep } from './shared-helpers.js'
 
 // ─── Constants ────────────────────────────────────────────────────────────────
@@ -295,12 +295,19 @@ export async function runProviderKeyTest(apiKey, providerKey, source, options =
 
   // 📖 Slow path: ping-based verification (providers without auth endpoint or timeouts).
   const discoveredModelIds = []
-  const modelsUrl = buildProviderModelsUrl(source?.url)
+  // 📖 Cloudflare's models URL is account-scoped (issue #181): resolve the
+  // 📖 {$CLOUDFLARE_ACCOUNT_ID} placeholder so discovery reaches the real API
+  // 📖 instead of 404ing on the raw catalog URL and silently falling back.
+  const modelsUrl = providerKey === 'cloudflare'
+    ? resolveCloudflareUrl(buildProviderModelsUrl(source?.url) || '')
+    : buildProviderModelsUrl(source?.url)
   let discoveryNote = ''
 
   if (modelsUrl) {
     try {
-      const headers = { Authorization: `Bearer ${apiKey}` }
+      // 📖 Mandatory per-provider headers (issue #181): OpenCode Zen gates every
+      // 📖 request (model discovery included) behind `x-opencode-session`.
+      const headers = { Authorization: `Bearer ${apiKey}`, ...getProviderSessionHeaders(providerKey) }
       if (providerKey === 'openrouter') {
         headers['HTTP-Referer'] = 'https://github.com/vava-nessa/free-coding-models'
         headers['X-Title'] = 'free-coding-models'

package/src/core/provider-metadata.js

@@ -228,7 +228,7 @@ export const PROVIDER_METADATA = {
     label: 'Cloudflare Workers AI',
     color: chalk.rgb(255, 204, 128),
     signupUrl: 'https://dash.cloudflare.com',
-    signupHint: 'Create AI API token + set CLOUDFLARE_ACCOUNT_ID',
+    signupHint: 'Create AI API token (account id auto-discovered; CLOUDFLARE_ACCOUNT_ID optional)',
     rateLimits: 'Free: 10k neurons/day, text-gen 300 RPM',
   },
   perplexity: {