free-coding-models 0.5.96 → 0.5.97

package/src/core/config.js

@@ -23,8 +23,14 @@
  *       "scaleway":   "scw-xxx",
  *       "googleai":   "AIza...",
  *       "cloudflare": "cf-xxx",
- *       "zai":        "zai-xxx"
+ *       "zai":        "zai-xxx",
+ *       "onomeo":     "${ONOMEO_API_KEY}"
  *     },
+ *
+ * 📖 ${VAR} values (issue #196): an apiKeys entry of the form "${MY_VAR}" is
+ * 📖 resolved from the environment at read time. The file on disk keeps the
+ * 📖 placeholder so secrets never land on disk; saveConfig never writes the
+ * 📖 resolved value back. See getApiKey() and resolveEnvPlaceholderValue().
  *     "providers": {
  *       "nvidia":     { "enabled": true },
  *       "groq":       { "enabled": true },
@@ -106,6 +112,7 @@ import { homedir } from 'node:os'
 import { join, resolve, dirname } from 'node:path'
 import { syncShellEnv } from './shell-env.js'
 import { DEFAULT_LOCALE, normalizeLocale } from './i18n/index.js'
+import { resolveEnvPlaceholderValue } from './utils.js'
 
 // 📖 Expand leading ~/ or bare ~ to homedir so --config-dir ~/.config/... works.
 // 📖 resolve() alone does NOT expand tilde, it would treat ~ as a literal folder.
@@ -1157,12 +1164,14 @@ export function getApiKey(config, providerKey) {
   // 📖 but every consumer (ping Authorization header, tool env vars, daemon) needs
   // 📖 a single string: an array would stringify to "key1,key2" and get a
   // 📖 guaranteed 401. Return the first non-empty entry instead.
+  // 📖 ${VAR} references (issue #196) are expanded here so the file on disk
+  // 📖 can stay secret-free while every consumer gets the real value.
   const key = config?.apiKeys?.[providerKey]
   if (Array.isArray(key)) {
     const firstUsable = key.find(k => typeof k === 'string' && k.length > 0)
-    return firstUsable ?? null
+    return firstUsable !== undefined ? resolveEnvPlaceholderValue(firstUsable) : null
   }
-  if (key) return key
+  if (key) return resolveEnvPlaceholderValue(key)
 
   return null
 }

package/src/core/provider-metadata.js

@@ -348,8 +348,8 @@ export const PROVIDER_METADATA = {
     color: chalk.rgb(255, 138, 64),
     signupUrl: 'https://www.orcarouter.ai',
     signupHint: 'Register (GitHub OAuth, no credit card) → API keys',
-    rateLimits: 'Free Hacker tier · zero token markup · 3 API keys',
-    detailedLimits: 'Zero-markup AI gateway: token prices are passed through at provider rates.\nFree Hacker plan: 3 API keys, adaptive routing + automatic failover + guardrails included.\nOnly the explicit $-0 models are listed in this catalog; the orcarouter/fusion family is pay-as-you-go.',
+    rateLimits: 'Free · 10 req/min · 50 req/day · zero token markup',
+    detailedLimits: 'Zero-markup AI gateway: token prices are passed through at provider rates.\nFree tier: 10 req/min, 50 req/day, GitHub account required, hidden per-request prompt cap.\nOnly the explicit $-0 models are listed in this catalog (verified against /api/free-package/public, 2026-09-29). The orcarouter/fusion family bills the sum of its paid panel legs, it is not free.',
   },
   'vercel-gateway': {
     label: 'Vercel AI Gateway',
@@ -364,8 +364,8 @@ export const PROVIDER_METADATA = {
     color: chalk.rgb(240, 120, 60),
     signupUrl: 'https://onomeo.com/dashboard',
     signupHint: 'Sign in (email, Google or GitHub, no card) → check in daily → Dashboard → API key',
-    rateLimits: 'Daily check-in credits (50,000-200,000/day) · 12 req/min per key · 60 req/5h per account',
-    detailedLimits: 'Public beta: not every feature is guaranteed to work; feedback is welcome at https://onomeo.com/feedback.\nCredits come from a daily check-in: 50,000 on day 1, rising to 200,000/day from day 7 of a streak. No card needed.\nEvery call spends credits and the cost per reply varies by model (see https://onomeo.com/models), so this is a small allowance. Each account that has not paid can spend up to 50,000 credits/day on premium models. Optional: $5 one-time buys 1,000,000 credits.\nLimits: 12 req/min per key, 60 req per 5 hours per account, 120 per 5 hours per IP, 450 per 5 hours site-wide for accounts that have not bought credits. Health probes count against them.\nSome upstreams may train on prompts; each model page on onomeo.com says which.',
+    rateLimits: 'Free models, no credits · 12 req/min per key · 60 req/5h per account',
+    detailedLimits: 'Public beta: not every feature is guaranteed to work; feedback is welcome at https://onomeo.com/feedback.\nThe listed models are free models: they spend no credits and are limited by calls. No card needed.\nLimits: 12 req/min per key, 60 calls per 5 hours per account (a long request counts as several), 120 per 5 hours per IP, 450 per 5 hours shared site-wide by all accounts. Health probes count against them.\nPremium models spend credits from a daily check-in (20,000 on day 1, rising to 50,000/day from day 7 of a streak); each account that has not paid can spend up to 50,000 credits/day on them. Optional: $5/month buys 3,000,000 credits a month.\n31 of the 47 models may train on prompts; each model page on onomeo.com says which.',
   },
   'ollama-cloud': {
     label: 'Ollama Cloud',

package/src/core/router-daemon.js

@@ -310,7 +310,10 @@ export function isPrivateNetworkHostname(hostname) {
 }
 
 // 📖 Cache the FCM_ALLOWED_ORIGINS env var split into a Set on first access.
-// 📖 Format: comma-separated origin URLs, e.g. "http://mybox:19280,http://10.0.0.5:19280"
+// 📖 Format: comma-separated origin URLs, e.g. "http://mybox:19280,http://10.0.0.5:19280".
+// 📖 The special entry "*" allowlists every origin: the user explicitly opted
+// 📖 out of origin checking, which is handy for LAN/Docker setups where the
+// 📖 dashboard hostname changes (mDNS names, DHCP IPs).
 let _allowedOriginsCache = null
 function getAllowedOrigins() {
   if (_allowedOriginsCache === null) {
@@ -323,6 +326,16 @@ function getAllowedOrigins() {
   return _allowedOriginsCache
 }
 
+function isWildcardOriginsEnabled() {
+  return getAllowedOrigins().includes('*')
+}
+
+// 📖 Test-only: drop the cached FCM_ALLOWED_ORIGINS list so a test that
+// 📖 mutates process.env sees fresh parsing instead of the first-read value.
+export function resetAllowedOriginsCacheForTest() {
+  _allowedOriginsCache = null
+}
+
 // 📖 v2: CORS for loopback (and explicitly allowed) origins so a browser
 // dashboard served from another local port (web dashboard 3333) can call
 // this daemon directly without a proxy.
@@ -335,7 +348,8 @@ function applyCors(req, res) {
   } catch {
     return
   }
-  const allowed = isLoopbackHostname(hostname) || getAllowedOrigins().includes(origin)
+  const allowed =
+    isWildcardOriginsEnabled() || isLoopbackHostname(hostname) || getAllowedOrigins().includes(origin)
   if (!allowed) return
   res.setHeader('Access-Control-Allow-Origin', origin)
   res.setHeader('Vary', 'Origin')
@@ -363,6 +377,11 @@ export function isSameOriginOrLocal(req) {
   // 📖 No Origin/Referer → non-browser caller (curl, native app). Allow.
   if (candidates.length === 0) return true
 
+  // 📖 FCM_ALLOWED_ORIGINS="*" is an explicit operator decision to trust any
+  // 📖 origin (LAN/Docker setups with changing hostnames). Host-header
+  // 📖 validation still applies to every request.
+  if (isWildcardOriginsEnabled()) return true
+
   let hostHeader = typeof req.headers.host === 'string' ? req.headers.host.toLowerCase() : ''
   for (const c of candidates) {
     try {

package/src/core/shell-env.js

@@ -41,6 +41,7 @@ import { join } from 'node:path'
 import * as readline from 'node:readline'
 import chalk from 'chalk'
 import { ENV_VAR_NAMES } from './provider-metadata.js'
+import { isPureEnvPlaceholder } from './utils.js'
 import { saveConfig } from './config.js'
 
 // 📖 Unique marker used to identify the source line we inject into shell rc files.
@@ -126,6 +127,11 @@ export function buildEnvContent(config, shell) {
     const value = Array.isArray(rawValue) ? rawValue[0] : rawValue
     if (!value || typeof value !== 'string') continue
 
+    // 📖 Issue #196: a config value of "${MY_KEY}" means the key comes from the
+    // 📖 user's own environment. Never export the literal placeholder into the
+    // 📖 rc/env file, it would clobber the real variable on every shell start.
+    if (isPureEnvPlaceholder(value)) continue
+
     const safeValue = value.replace(/'/g, "'\\''")
 
     if (isFish) {

package/src/core/utils.js

@@ -1168,3 +1168,25 @@ export function formatResultsAsJSON(results, sortBy = 'avg', limit = 0) {
 
   return JSON.stringify(formatted, null, 2)
 }
+
+// 📖 Issue #196: ${VAR} placeholder support inside config apiKeys values.
+// 📖 The config file on disk keeps the literal placeholder, so saveConfig never
+// 📖 writes the resolved secret back; expansion happens only in memory, at the
+// 📖 moment a consumer reads the key (getApiKey, tool env sync). Only the
+// 📖 explicit ${NAME} form is recognized, so a literal key containing a bare
+// 📖 "$" is never mangled. An unset variable leaves the placeholder untouched:
+// 📖 probes will fail auth, which is the honest signal that something is off.
+export function resolveEnvPlaceholderValue(value) {
+  if (typeof value !== 'string') return value
+  return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (placeholder, name) => {
+    const resolved = process.env[name]
+    return typeof resolved === 'string' ? resolved : placeholder
+  })
+}
+
+// 📖 True when the value is nothing but one ${VAR} reference. Used by the
+// 📖 shell rc/env generator to skip entries the user's own environment already
+// 📖 provides (exporting the literal placeholder would clobber the real var).
+export function isPureEnvPlaceholder(value) {
+  return typeof value === 'string' && /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(value.trim())
+}