freebuff 0.2.10 → 0.2.12

package/README.md

@@ -43,11 +43,11 @@ and keep the extracted `freebuff` binary and `tree-sitter.wasm` together.
 
 **How can it be free?** Freebuff is supported by text ads.
 
-**What models do you use?** In full mode, the regular picker includes MiMo 2.6 Flash, GLM 5.3 Flash, DeepSeek V4.1 Flash, GPT-6 Luna, MiMo 2.6 Pro, Solar Mini 4, Solar Pro 4, Space Bunny Alpha, Gemini 3.8 Flash, Muse Spark 1.3, and GPT-6.1 Sol. Space Bunny Alpha is a beta stealth model from an anonymous provider that retains prompts. Gemini 3.8 Flash and Muse Spark 1.3 require a paid plan: without one they are listed but locked, and selecting one opens the plans page. GPT-6.1 Sol is free in the US and needs a paid plan elsewhere; its price is a temporary promotion, and every account, paid or not, gets one session a day. GPT-6 Luna and MiMo 2.6 Pro are open to every full-access account. Muse Spark 1.3 has a 1M-token context, and when it is busy or unavailable it answers on DeepSeek V4.1 Flash instead of leaving you waiting. MiMo 2.6 Flash is the CLI default, and GLM 5.3 Flash is the cheapest model to run. Limited mode uses MiMo 2.6 Flash, GLM 5.3 Flash, DeepSeek V4.1 Flash, Solar Mini 4, and Solar Pro 4; the models a paid plan unlocks there are listed too, locked until you have one. Every model is paid for in Freebucks, one price per one-hour session, shown in the model picker. Models may still serve from a quantized (Q8_0) build.
+**What models do you use?** In full mode, the regular picker includes MiMo 2.6 Flash, GLM 5.3 Flash, DeepSeek V4.1 Flash, GPT-6 Luna, MiMo 2.6 Pro, Solar Mini 4, Solar Pro 4, Space Bunny Alpha, Gemini 3.8 Flash, Muse Spark 1.3, and GPT-6.1 Sol. Space Bunny Alpha is a beta stealth model from an anonymous provider that retains prompts. Gemini 3.8 Flash and Muse Spark 1.3 require a paid plan: without one they are listed but locked, and selecting one opens the plans page. GPT-6.1 Sol is free in the US and needs a paid plan elsewhere; its price is a temporary promotion, and every account, paid or not, gets one session a day. GPT-6 Luna and MiMo 2.6 Pro are open to every full-access account. Muse Spark 1.3 has a 1M-token context, and when it is busy or unavailable it answers on DeepSeek V4.1 Flash instead of leaving you waiting. MiMo 2.6 Flash is the CLI default, and GLM 5.3 Flash is the cheapest model to run. Limited mode uses MiMo 2.6 Flash, GLM 5.3 Flash, DeepSeek V4.1 Flash, Solar Mini 4, Solar Pro 4, and Space Bunny Alpha; the models a paid plan unlocks there are listed too, locked until you have one. Every model is paid for in Freebucks, one price per one-hour session, shown in the model picker. Models may still serve from a quantized (Q8_0) build.
 
 **Which countries is Freebuff available in?** All countries. Freebuff runs in "full" mode in the US, Canada, UK, EU, and other select countries, and in "limited" mode everywhere else (or while using a VPN). See [freebuff.com](https://freebuff.com) for the full list.
 
-**What is limited mode?** Limited mode lets you use Freebuff outside the full-access countries, or while using a VPN. It includes GLM 5.3 Flash, DeepSeek V4.1 Flash, MiMo 2.6 Flash, Solar Mini 4, and Solar Pro 4. The free limited-access allowance is 25 Freebucks a day, or 20 on a VPN or proxy, and each model's price per one-hour session is shown in the picker. Today's allowance is spent first, whichever model you pick, including GLM 5.3 Flash; Freebucks you earn on the Earn page go into your wallet and are used once today's allowance runs out.
+**What is limited mode?** Limited mode lets you use Freebuff outside the full-access countries, or while using a VPN. It includes GLM 5.3 Flash, DeepSeek V4.1 Flash, MiMo 2.6 Flash, Solar Mini 4, Solar Pro 4, and Space Bunny Alpha. The free limited-access allowance is 25 Freebucks a day, or 20 on a VPN or proxy, and each model's price per one-hour session is shown in the picker. Today's allowance is spent first, whichever model you pick, including GLM 5.3 Flash; Freebucks you earn on the Earn page go into your wallet and are used once today's allowance runs out.
 
 <!-- BEGIN GENERATED FREEBUFF DATA USE -->
 

package/launcher.js

@@ -1336,10 +1336,17 @@ function createLauncher(productConfig) {
 
   function installStagedBinary(
     { tempBinaryPath, version, targetKey },
-    { quiet = false } = {},
+    // keepStagingOnFailure: leave a staged update that could not be moved
+    // into place (a file locked by antivirus or another session on Windows)
+    // for the next launch to adopt, instead of downloading it all again.
+    { quiet = false, keepStagingOnFailure = false } = {},
   ) {
     const replacements = []
+    let installed = false
     const metadataTempPath = `${CONFIG.metadataPath}.new.${process.pid}`
+    // The directory the binary was staged in: this launcher's own, or one
+    // adopted from a launcher that died before it could install it.
+    const stagingDir = path.dirname(tempBinaryPath)
 
     try {
       fs.writeFileSync(
@@ -1356,10 +1363,7 @@ function createLauncher(productConfig) {
       // pre-date this change won't have the wasm and will still install —
       // they'll just hit the same crash they had before, which is fine.
       if (includeTreeSitterWasm) {
-        const tempWasmPath = path.join(
-          CONFIG.tempDownloadDir,
-          'tree-sitter.wasm',
-        )
+        const tempWasmPath = path.join(stagingDir, 'tree-sitter.wasm')
         if (fs.existsSync(tempWasmPath)) {
           const targetWasmPath = path.join(
             path.dirname(CONFIG.binaryPath),
@@ -1375,13 +1379,14 @@ function createLauncher(productConfig) {
         replacements,
       )
       commitReplacements(replacements)
+      installed = true
     } catch (error) {
       rollbackReplacements(replacements)
       throw error
     } finally {
       removeFileIfPresent(metadataTempPath)
-      if (fs.existsSync(CONFIG.tempDownloadDir)) {
-        fs.rmSync(CONFIG.tempDownloadDir, { recursive: true })
+      if ((installed || !keepStagingOnFailure) && fs.existsSync(stagingDir)) {
+        fs.rmSync(stagingDir, { recursive: true })
       }
     }
 
@@ -1545,8 +1550,15 @@ function createLauncher(productConfig) {
           if (
             runningProcess.exitCode === null &&
             runningProcess.signalCode === null
-          )
+          ) {
             pendingUpdates.set(runningProcess, stagedBinary)
+            // Closing the terminal window kills this launcher too (SIGHUP, or
+            // CTRL_CLOSE_EVENT on Windows) before the exit handler can
+            // install. Mark the staged update ready so the next launch adopts
+            // it instead of a user who never quits from inside the CLI
+            // staying on this build forever.
+            await writeStagedManifest(stagedBinary)
+          }
           return
         }
 
@@ -1605,7 +1617,7 @@ function createLauncher(productConfig) {
         fs.rmSync(CONFIG.tempDownloadDir, { recursive: true, force: true })
         return
       }
-      installStagedBinary(staged, { quiet: true })
+      installStagedBinary(staged, { quiet: true, keepStagingOnFailure: true })
       console.log(
         `Updated ${displayName} to ${staged.version}. Ready for your next launch.`,
       )
@@ -1616,6 +1628,202 @@ function createLauncher(productConfig) {
     }
   }
 
+  /**
+   * Deferred staging directories are `<tempDownloadDirName>-<pid>`, plus
+   * `<…>-<pid>.adopting` while a later launcher installs one it adopted. The
+   * pid is the launcher that owns the directory.
+   */
+  const STAGED_MANIFEST_NAME = 'staged.json'
+
+  function parseStagingDirOwner(name) {
+    const prefix = `${tempDownloadDirName}-`
+    if (!name.startsWith(prefix)) return null
+    const match = /^(\d{1,10})(?:\.adopting)?$/.exec(name.slice(prefix.length))
+    return match ? Number(match[1]) : null
+  }
+
+  function isProcessAlive(pid) {
+    try {
+      process.kill(pid, 0)
+      return true
+    } catch (error) {
+      // EPERM: it exists, it just is not ours to signal.
+      return error?.code === 'EPERM'
+    }
+  }
+
+  /**
+   * Record that a staged update is complete: the version, target and sha256 of
+   * every file installStagedBinary() will move. Written last and renamed into
+   * place, so a launcher killed mid-download or mid-extraction leaves a
+   * directory without one, which is only ever deleted. Best effort: a failure
+   * here leaves the exit-time install exactly as it was.
+   *
+   * The hashes are this launcher's own record, checked again before adoption
+   * so a file truncated or altered on disk since is never installed. They are
+   * not a second trust root: the archive was verified against npm's sha256 at
+   * download, and anything able to write this directory can already write the
+   * installed binary next to it.
+   */
+  async function writeStagedManifest({ tempBinaryPath, version, targetKey }) {
+    const stagingDir = path.dirname(tempBinaryPath)
+    const manifestPath = path.join(stagingDir, STAGED_MANIFEST_NAME)
+    const tempManifestPath = `${manifestPath}.tmp`
+    try {
+      const files = {
+        [CONFIG.binaryName]: await computeFileSha256(tempBinaryPath),
+      }
+      const wasmPath = path.join(stagingDir, 'tree-sitter.wasm')
+      if (includeTreeSitterWasm && fs.existsSync(wasmPath)) {
+        files['tree-sitter.wasm'] = await computeFileSha256(wasmPath)
+      }
+      fs.writeFileSync(
+        tempManifestPath,
+        JSON.stringify({ version, target: targetKey, files }),
+      )
+      fs.renameSync(tempManifestPath, manifestPath)
+    } catch {
+      try {
+        removeFileIfPresent(tempManifestPath)
+      } catch {
+        // The directory may already be gone: installed at exit, or removed.
+      }
+    }
+  }
+
+  function readStagedManifest(stagingDir) {
+    try {
+      const manifest = JSON.parse(
+        fs.readFileSync(path.join(stagingDir, STAGED_MANIFEST_NAME), 'utf8'),
+      )
+      const files = manifest?.files
+      if (
+        !isStrictReleaseVersion(manifest?.version) ||
+        !PLATFORM_TARGETS[manifest?.target] ||
+        !files ||
+        typeof files !== 'object' ||
+        !isSha256Hex(files[CONFIG.binaryName]) ||
+        Object.entries(files).some(
+          ([name, digest]) =>
+            !isAllowedArchiveEntry(name, null) || !isSha256Hex(digest),
+        )
+      ) {
+        return null
+      }
+      return { version: manifest.version, targetKey: manifest.target, files }
+    } catch {
+      return null
+    }
+  }
+
+  async function stagedFilesMatch(stagingDir, files) {
+    for (const [name, digest] of Object.entries(files)) {
+      const filePath = path.join(stagingDir, name)
+      if (!fs.existsSync(filePath)) return false
+      const verification = await verifyFileSha256(filePath, digest)
+      if (!verification.ok) return false
+    }
+    // Nothing unlisted may ride along into the install (the wasm is moved
+    // whenever it is present).
+    return fs
+      .readdirSync(stagingDir)
+      .every((name) => name === STAGED_MANIFEST_NAME || name in files)
+  }
+
+  /**
+   * Install an update a previous launcher downloaded but never installed, and
+   * delete what dead launchers left behind.
+   *
+   * A deferred update is installed by the launcher's exit handler, which runs
+   * only when the CLI exits on its own. Closing the terminal window or tab
+   * (SIGHUP; CTRL_CLOSE_EVENT on Windows) kills the launcher first, so a user
+   * who always leaves that way never updated: each launch downloaded the same
+   * release again and left another full copy of the binary in a
+   * `<tempDownloadDirName>-<pid>` directory.
+   *
+   * Runs before the binary starts, so nothing of ours holds the files. A
+   * directory whose owner is still running belongs to a live session that
+   * will install it on exit and is left alone. Claiming by rename means two
+   * launchers starting together never install the same directory twice.
+   * Never throws: a failure here must not stop the CLI from starting.
+   */
+  function removeDirQuietly(dir) {
+    try {
+      fs.rmSync(dir, { recursive: true, force: true })
+    } catch {
+      // Locked (Windows) or already gone; the next launch tries again.
+    }
+  }
+
+  async function adoptOrphanedStagedUpdates() {
+    if (!deferUpdatesUntilExit) return null
+    try {
+      const orphans = []
+      for (const name of fs.readdirSync(CONFIG.configDir)) {
+        const owner = parseStagingDirOwner(name)
+        if (owner === null) continue
+        // Our own pid was just assigned to us, so a directory under it is a
+        // leftover from an earlier process that had the same pid.
+        if (owner !== process.pid && isProcessAlive(owner)) continue
+        const dir = path.join(CONFIG.configDir, name)
+        orphans.push({ dir, staged: readStagedManifest(dir) })
+      }
+      if (orphans.length === 0) return null
+
+      orphans.sort((a, b) =>
+        a.staged && b.staged
+          ? compareVersions(b.staged.version, a.staged.version)
+          : a.staged
+            ? -1
+            : b.staged
+              ? 1
+              : 0,
+      )
+
+      const installedVersion = getCurrentVersion()
+      let adoptedVersion = null
+      for (const { dir, staged } of orphans) {
+        if (
+          adoptedVersion === null &&
+          staged &&
+          (installedVersion === null ||
+            compareVersions(installedVersion, staged.version) < 0) &&
+          isTargetAllowedForThisMachine(staged.targetKey)
+        ) {
+          const claimedDir = `${CONFIG.tempDownloadDir}.adopting`
+          try {
+            fs.renameSync(dir, claimedDir)
+          } catch {
+            continue // Another launcher claimed it first.
+          }
+          try {
+            if (await stagedFilesMatch(claimedDir, staged.files)) {
+              installStagedBinary(
+                {
+                  tempBinaryPath: path.join(claimedDir, CONFIG.binaryName),
+                  version: staged.version,
+                  targetKey: staged.targetKey,
+                },
+                { quiet: true, keepStagingOnFailure: true },
+              )
+              adoptedVersion = staged.version
+            } else {
+              removeDirQuietly(claimedDir)
+            }
+          } catch {
+            // Rolled back by installStagedBinary, which kept the directory.
+            // It is ours until we exit, then any later launch retries it.
+          }
+          continue
+        }
+        removeDirQuietly(dir)
+      }
+      return adoptedVersion
+    } catch {
+      return null
+    }
+  }
+
   /**
    * Make captured output safe to print back to the terminal.
    *
@@ -1845,6 +2053,12 @@ function createLauncher(productConfig) {
           ...process.env,
           ...optionEnv,
           CODEBUFF_LAUNCHER_PID: String(process.pid),
+          // Which npm wrapper started this binary. The wrapper never updates
+          // itself, so this is how launch telemetry tells an install that
+          // cannot install deferred updates from one that can.
+          ...(wrapperVersion
+            ? { CODEBUFF_LAUNCHER_VERSION: String(wrapperVersion) }
+            : {}),
         },
       })
     } catch (err) {
@@ -2069,6 +2283,7 @@ function createLauncher(productConfig) {
     }
     if (startupBanner.length > 0) console.log('')
 
+    await adoptOrphanedStagedUpdates()
     await ensureBinaryReady()
 
     const child = spawnInstalledBinary()
@@ -2099,6 +2314,7 @@ function createLauncher(productConfig) {
       isStartupCpuFeatureCrash,
       stderrReportsMissingCpuFeature,
       tryFallbackToBaseline,
+      adoptOrphanedStagedUpdates,
       printCrashDiagnostics,
       checkForUpdates,
       spawnInstalledBinary,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "freebuff",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "The world's strongest free coding agent",
   "license": "MIT",
   "bin": {
@@ -44,13 +44,13 @@
     "provenance": false
   },
   "binaryChecksums": {
-    "linux-x64": "a4e6e88bf289fcf86c862cb621d7e8aa0c0c7fdd2f8d230b16ab8f018d151755",
-    "linux-x64-baseline": "29011714d3989e67993bdb058730028fb3cea607d09c291e07c06df05228b69c",
-    "linux-arm64": "917b1997cc6deee8fbc7db5f2db213e4dab5aec8737d9abf0e149c9473f39b90",
-    "darwin-x64": "40fd75bdd6e56cd085bb2187f624819a43912ec18d7e57f8236b1fe7367a37d5",
-    "darwin-x64-baseline": "e47b9f6c7b88bd3a58b516c131cd7e0261fd1f7ed23f1984027bb1302136c6de",
-    "darwin-arm64": "7919611702a2ad304d78bace06dc02bdb3d5f6e0fd8f87410ce0472626df3fe2",
-    "win32-x64": "387a07df0ccde41e5820c91b4007c56aa6f090625483013226a222918fbd8cad",
-    "win32-x64-baseline": "c087e91f8d58b1c932f8722efd4f13a5f9994f9389b8ce5bb0d5d1c5ae5cadf7"
+    "linux-x64": "81f302486b36e899f6331db8e9455715babbc1d433e9a8ca89876c249934c11f",
+    "linux-x64-baseline": "878e5a7ce680ef760b98cfa0018a6c6d8b8491fd07ce24f2bb22ba7238cd728f",
+    "linux-arm64": "77c53975789adeb177538cdc2ecd6421c719bfa7e3e2f82d9296faff54ef7cd1",
+    "darwin-x64": "6f8f35e5183ae9cc3f5a8c779d2bc40628954a19207d6e91b09a047f1bb5d514",
+    "darwin-x64-baseline": "1ac896557ee832619c3e35ece9a23c0c6ccd25f30da0fbc71d60930cbd818e0a",
+    "darwin-arm64": "91c785e6272be6d3a3524b4385074094287fb20d402ab1d44a1b2d5c538ff135",
+    "win32-x64": "bb9431f278900f8c198356f31fcaaf7a33eedc05414508be43cc425d9730f2f0",
+    "win32-x64-baseline": "3112c60da99e72881c9a45a7e0c2f00e02c3a557919aca1489809a48ab4e1091"
   }
 }