freecodego 0.1.7-alpha.2.1 → 0.1.7-alpha.2.2

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/freecodego/bundle-latest/README.md
-README.md: 0b00540c87ee0781c697d407579b7c2617190d21
-README.zh.md: 9be8ba5e80b702e0f0b442933b0e35a9643e073d
+README.md: 8d10144b93404bd365c74acfd6ed6e37c5b482b6
+README.zh.md: 59610270a1325f0808de361185235bb2ff9a8f06

package/README.md

@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-Installable single-package FreeCodeGo composition for DeepSeek Harness `freecodego@0.1.7-alpha.2.1`, targeting Harness baseline `0.1.7-alpha.2`. The npm artifact contains the compiled Host plugin, browser client, session-event prerequisite, native worker entrypoints, and the bundled Harness Agent Teams composition. A release publishes on npm's `next` dist-tag, and its plugin version intentionally matches the Harness version it targets exactly; for a reproducible install, name the version (`freecodego@0.1.7-alpha.2`) instead of the channel. Official Codex and Claude runtime binaries remain optional platform downloads — the package does not embed every platform's native binary.
+Installable single-package FreeCodeGo composition for DeepSeek Harness `freecodego@0.1.7-alpha.2.2`, targeting Harness baseline `0.1.7-alpha.2`. The npm artifact contains the compiled Host plugin, browser client, session-event prerequisite, native worker entrypoints, and the bundled Harness Agent Teams composition. A release publishes on npm's `next` dist-tag, and its plugin version intentionally matches the Harness version it targets exactly; for a reproducible install, name the version (`freecodego@0.1.7-alpha.2`) instead of the channel. Official Codex and Claude runtime binaries remain optional platform downloads — the package does not embed every platform's native binary.
 
 ## Table of Contents
 
@@ -32,7 +32,7 @@ Install the release for the Harness baseline you run; each release carries one t
 
 ```sh
 dsh plugin --profile web add --save-exact \
-  https://github.com/XiangSu-ce/dsh-plugin-freecodego/releases/download/freecodego-v0.1.7-alpha.2.1/freecodego-0.1.7-alpha.2.tgz
+  https://github.com/XiangSu-ce/dsh-plugin-freecodego/releases/download/freecodego-v0.1.7-alpha.2.2/freecodego-0.1.7-alpha.2.tgz
 ```
 
 `freecodego-0.1.7-alpha.2.tgz` is the bundle for Harness `0.1.7-alpha.2`: substitute the version you run, which the settings page shows beside the installed plugin version. The asset name is the naming contract in `packages/freecodego/AGENTS.md`.
@@ -54,15 +54,15 @@ The workflow verifies the family, builds, packs, and creates the GitHub release
 ## Free Models
 
 <!-- generated:free-models:begin by scripts/generate-free-model-tables.ts -->
-Every free row below comes from the provider's own directory, read when you open the picker, so this is what those directories returned on 2026-09-23 (sorted, where the picker keeps directory order) — and the picker is the count that is true when you look.
+Every free row below comes from the provider's own directory, read when you open the picker, so this is what those directories returned on 2026-09-24 (sorted, where the picker keeps directory order) — and the picker is the count that is true when you look.
 
 | Provider | Free models | Directory |
 |---|---|---|
 | **OpenCode** | `big-pickle`, `deepseek-v4-flash-free`, `jev-1.13-free`, `ling-3.0-flash-fin-free`, `mimo-v2.5-free`, `mimo-v2.6-flash-free`, `muse-spark-1.2`, `muse-spark-1.2-contributor-free`, `muse-spark-1.3`, `muse-spark-1.3-contributor-free`, `nemotron-3-ultra-free`, `nemotron-3.5-lightning-free`, `space-bunny-free` | 13 of 80 rows; public, no sign-in |
-| **Kilo** | `cohere/north-mini-code:free`, `dots-studio/dots-3-note-preview:free`, `inclusionai/ling-3.0-flash-fin:free`, `inclusionai/ling-3.0-flash-sante:free`, `inclusionai/ling-3.0-flash-vl:free`, `kilo-auto/free`, `liquid/lfm-2.5-2.6b:free`, `nex-agi/nex-n2.5-mini:free`, `nex-agi/nex-n2.5-pro:free`, `nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free`, `nvidia/nemotron-3-super-120b-a12b:free`, `nvidia/nemotron-3-ultra-550b-a55b:free`, `nvidia/nemotron-3.5-content-safety:free`, `nvidia/nemotron-3.5-lightning:free`, `openrouter/free`, `poolside/laguna-s-2.1:free`, `poolside/laguna-xs-2.1:free`, `qwen/qwen3.8-27b:free`, `stepfun/step-3.7-flash:free`, `thinkingmachines/inkling-small:free`, `z-ai/glm-5.2:free` | 21 of 394 rows; public, 200 requests/hour per egress IP |
+| **Kilo** | `cohere/north-mini-code:free`, `dots-studio/dots-3-note-preview:free`, `inclusionai/ling-3.0-flash-fin:free`, `inclusionai/ling-3.0-flash-sante:free`, `kilo-auto/free`, `liquid/lfm-2.5-2.6b:free`, `nex-agi/nex-n2.5-mini:free`, `nex-agi/nex-n2.5-pro:free`, `nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free`, `nvidia/nemotron-3-super-120b-a12b:free`, `nvidia/nemotron-3-ultra-550b-a55b:free`, `nvidia/nemotron-3.5-content-safety:free`, `nvidia/nemotron-3.5-lightning:free`, `openrouter/free`, `poolside/laguna-s-2.1:free`, `poolside/laguna-xs-2.1:free`, `qwen/qwen3.8-27b:free`, `stealth/space-bunny-alpha`, `stepfun/step-3.7-flash:free`, `thinkingmachines/inkling-small:free`, `z-ai/glm-5.2:free` | 21 of 393 rows; public, 200 requests/hour per egress IP |
 | **Logfare** | chat `claude-opus-4.6`, `deepseek-v3.2`, `deepseek-v4-pro-0813`, `gemma-4-26b`, `glm-5`, `glm-5.3`, `glm-5.3-flash`, `grok-4.6`, `kimi-k2.5`, `kimi-k2.6`, `kimi-k2.7-code`, `kimi-k3`, `logfare/auto`, `moondream3.1`, `qwen-3.8-27b`, `step-3.7-flash`; images `flux-1-schnell`, `flux-2-dev`, `flux-2-klein-4b`, `flux-2-klein-9b`, `sdxl-lightning`; audio `melotts`, `whisper-large-v3-turbo`; other routes `aura-2-en`, `lucid-origin`, `nova-3`, `phoenix-1.0` | 27 rows; 20 need a training-data opt-in, the other 7 do not |
 | **Qoder** | `Qwen 3.8 Flash` (route `qmodel_38flash`) | the free flash route, plus daily check-in campaigns |
-| **NVIDIA** | `google/gemma-4-31b-it`, `moonshotai/kimi-k3`, `z-ai/glm-5.3`, `z-ai/glm-5.3-flash` — the roster also names `deepseek-ai/deepseek-v4-flash-0731` and `deepseek-ai/deepseek-v4-pro-0813`, which are gone from NVIDIA's live catalogue of 82 rows | an API key is required to call them; cross-checked 2026-09-23 |
+| **NVIDIA** | `google/gemma-4-31b-it`, `moonshotai/kimi-k3`, `z-ai/glm-5.3`, `z-ai/glm-5.3-flash` — the roster also names `deepseek-ai/deepseek-v4-flash-0731` and `deepseek-ai/deepseek-v4-pro-0813`, which are gone from NVIDIA's live catalogue of 82 rows | an API key is required to call them; cross-checked 2026-09-24 |
 | **SenseNova** | `deepseek-v4-flash`, `deepseek-v4-pro`, `glm-5.2`, `kimi-k3`, `sensenova-6.8-flash-lite` — 1M context and 128K output each | roster ships in the bundle; an API key is required |
 | **TRAE** | the rows its directory lists | free credits reset daily, per account |
 | **Cline** | the rows the directory marks `×0 · 官方免费模型` | an account pool |

package/README.zh.md

@@ -9,7 +9,7 @@ kind: "package-bundle"
 
 ## 概述
 
-面向 DeepSeek Harness `freecodego@0.1.7-alpha.2.1` 的可安装单包 FreeCodeGo 组合，目标 Harness 基线为 `0.1.7-alpha.2`。npm 产物包含编译后的 Host 插件、浏览器端 client、会话事件前置包、原生 worker 入口，以及随包交付的 Harness Agent Teams 组合。发布产物使用 npm 的 `next` dist-tag，且其插件版本刻意与所面向的 Harness 版本完全一致；需要可复现安装时请指定版本（`freecodego@0.1.7-alpha.2`），而不是渠道名。官方 Codex 与 Claude 运行时二进制仍按平台可选下载——本包不内嵌每个平台的原生二进制。
+面向 DeepSeek Harness `freecodego@0.1.7-alpha.2.2` 的可安装单包 FreeCodeGo 组合，目标 Harness 基线为 `0.1.7-alpha.2`。npm 产物包含编译后的 Host 插件、浏览器端 client、会话事件前置包、原生 worker 入口，以及随包交付的 Harness Agent Teams 组合。发布产物使用 npm 的 `next` dist-tag，且其插件版本刻意与所面向的 Harness 版本完全一致；需要可复现安装时请指定版本（`freecodego@0.1.7-alpha.2`），而不是渠道名。官方 Codex 与 Claude 运行时二进制仍按平台可选下载——本包不内嵌每个平台的原生二进制。
 
 ## 目录
 
@@ -32,7 +32,7 @@ kind: "package-bundle"
 
 ```sh
 dsh plugin --profile web add --save-exact \
-  https://github.com/XiangSu-ce/dsh-plugin-freecodego/releases/download/freecodego-v0.1.7-alpha.2.1/freecodego-0.1.7-alpha.2.tgz
+  https://github.com/XiangSu-ce/dsh-plugin-freecodego/releases/download/freecodego-v0.1.7-alpha.2.2/freecodego-0.1.7-alpha.2.tgz
 ```
 
 `freecodego-0.1.7-alpha.2.tgz` 就是面向 Harness `0.1.7-alpha.2` 的 bundle：请替换为你实际运行的版本，设置页会把它显示在已装插件版本旁边。资产名即 `packages/freecodego/AGENTS.md` 里的命名约定。
@@ -54,15 +54,15 @@ gh workflow run release-freecodego.yml --ref freecodego-v<version>
 ## 免费模型
 
 <!-- generated:free-models:begin by scripts/generate-free-model-tables.ts -->
-下面每一行都来自各提供商自己的目录，在你打开选择器时读取；也就是说，这是那些目录在 2026-09-23 返回的结果（按名称排序，选择器里保持目录顺序），而选择器里的数量才是你查看时真正成立的数量。
+下面每一行都来自各提供商自己的目录，在你打开选择器时读取；也就是说，这是那些目录在 2026-09-24 返回的结果（按名称排序，选择器里保持目录顺序），而选择器里的数量才是你查看时真正成立的数量。
 
 | 提供商 | 免费模型 | 目录 |
 |---|---|---|
 | **OpenCode** | `big-pickle`、`deepseek-v4-flash-free`、`jev-1.13-free`、`ling-3.0-flash-fin-free`、`mimo-v2.5-free`、`mimo-v2.6-flash-free`、`muse-spark-1.2`、`muse-spark-1.2-contributor-free`、`muse-spark-1.3`、`muse-spark-1.3-contributor-free`、`nemotron-3-ultra-free`、`nemotron-3.5-lightning-free`、`space-bunny-free` | 80 行中的 13 行；公开，无需登录 |
-| **Kilo** | `cohere/north-mini-code:free`、`dots-studio/dots-3-note-preview:free`、`inclusionai/ling-3.0-flash-fin:free`、`inclusionai/ling-3.0-flash-sante:free`、`inclusionai/ling-3.0-flash-vl:free`、`kilo-auto/free`、`liquid/lfm-2.5-2.6b:free`、`nex-agi/nex-n2.5-mini:free`、`nex-agi/nex-n2.5-pro:free`、`nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free`、`nvidia/nemotron-3-super-120b-a12b:free`、`nvidia/nemotron-3-ultra-550b-a55b:free`、`nvidia/nemotron-3.5-content-safety:free`、`nvidia/nemotron-3.5-lightning:free`、`openrouter/free`、`poolside/laguna-s-2.1:free`、`poolside/laguna-xs-2.1:free`、`qwen/qwen3.8-27b:free`、`stepfun/step-3.7-flash:free`、`thinkingmachines/inkling-small:free`、`z-ai/glm-5.2:free` | 394 行中的 21 行；公开，每个出口 IP 每小时 200 次 |
+| **Kilo** | `cohere/north-mini-code:free`、`dots-studio/dots-3-note-preview:free`、`inclusionai/ling-3.0-flash-fin:free`、`inclusionai/ling-3.0-flash-sante:free`、`kilo-auto/free`、`liquid/lfm-2.5-2.6b:free`、`nex-agi/nex-n2.5-mini:free`、`nex-agi/nex-n2.5-pro:free`、`nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free`、`nvidia/nemotron-3-super-120b-a12b:free`、`nvidia/nemotron-3-ultra-550b-a55b:free`、`nvidia/nemotron-3.5-content-safety:free`、`nvidia/nemotron-3.5-lightning:free`、`openrouter/free`、`poolside/laguna-s-2.1:free`、`poolside/laguna-xs-2.1:free`、`qwen/qwen3.8-27b:free`、`stealth/space-bunny-alpha`、`stepfun/step-3.7-flash:free`、`thinkingmachines/inkling-small:free`、`z-ai/glm-5.2:free` | 393 行中的 21 行；公开，每个出口 IP 每小时 200 次 |
 | **Logfare** | 对话 `claude-opus-4.6`、`deepseek-v3.2`、`deepseek-v4-pro-0813`、`gemma-4-26b`、`glm-5`、`glm-5.3`、`glm-5.3-flash`、`grok-4.6`、`kimi-k2.5`、`kimi-k2.6`、`kimi-k2.7-code`、`kimi-k3`、`logfare/auto`、`moondream3.1`、`qwen-3.8-27b`、`step-3.7-flash`；图片 `flux-1-schnell`、`flux-2-dev`、`flux-2-klein-4b`、`flux-2-klein-9b`、`sdxl-lightning`；音频 `melotts`、`whisper-large-v3-turbo`；其他路由 `aura-2-en`、`lucid-origin`、`nova-3`、`phoenix-1.0` | 27 行；20 行需要训练数据授权，其余 7 行不需要 |
 | **Qoder** | `Qwen 3.8 Flash`（路由 `qmodel_38flash`） | 免费 flash 路由，另有每日签到活动 |
-| **NVIDIA** | `google/gemma-4-31b-it`、`moonshotai/kimi-k3`、`z-ai/glm-5.3`、`z-ai/glm-5.3-flash` —— 名单里另有 `deepseek-ai/deepseek-v4-flash-0731` 与 `deepseek-ai/deepseek-v4-pro-0813`，这两个名字已不在 NVIDIA 实时目录（82 行）中 | 调用需要 API key；核对于 2026-09-23 |
+| **NVIDIA** | `google/gemma-4-31b-it`、`moonshotai/kimi-k3`、`z-ai/glm-5.3`、`z-ai/glm-5.3-flash` —— 名单里另有 `deepseek-ai/deepseek-v4-flash-0731` 与 `deepseek-ai/deepseek-v4-pro-0813`，这两个名字已不在 NVIDIA 实时目录（82 行）中 | 调用需要 API key；核对于 2026-09-24 |
 | **SenseNova** | `deepseek-v4-flash`、`deepseek-v4-pro`、`glm-5.2`、`kimi-k3`、`sensenova-6.8-flash-lite` —— 均为 1M 上下文 / 128K 输出 | 名单随 bundle 内置；需要 API key |
 | **TRAE** | 其目录列出的那些行 | 免费额度每日重置，按账号 |
 | **Cline** | 目录标记 `×0 · 官方免费模型` 的那些行 | 账号池 |

package/dist/bootstrap.js

@@ -1356,6 +1356,38 @@ var FreeCodeGoMobileAuthClient = class {
   async sendVerifyCode(email, signal) {
     return { countdown: finiteNumber$1((await this.request("/send-verify-code", { email }, signal)).countdown, "countdown") };
   }
+  /**
+  * Ask the gateway to mail a password-reset code to one address.
+  *
+  * `method: 'code'` is what makes this the desktop flow: without it the gateway
+  * mails a browser link built from its own frontend URL instead, which a
+  * webview has nowhere to land. The gateway answers the same way whether or not
+  * the address is registered — that is deliberate anti-enumeration behaviour on
+  * its side, not an answer about this account.
+  * @param email - the address to send the reset code to.
+  * @param signal - aborts the request when the caller cancels.
+  */
+  async requestPasswordResetCode(email, signal) {
+    await this.request("/forgot-password", {
+      email,
+      method: "code"
+    }, signal);
+  }
+  /**
+  * Replace the account's password using the emailed reset code.
+  *
+  * Deliberately returns no tokens: the gateway does not issue a session here, so
+  * signing in stays a separate, explicit step with the new password.
+  * @param input - the address, the code, and the new password.
+  * @param signal - aborts the request when the caller cancels.
+  */
+  async resetPassword(input, signal) {
+    await this.request("/reset-password", {
+      email: input.email,
+      verify_code: input.verifyCode,
+      new_password: input.newPassword
+    }, signal);
+  }
   /** Register and return an authenticated token pair to the host caller.
   * @param signal - aborts the request when the caller cancels.
   * @param input - the address, password, and remember-me intent.
@@ -1463,12 +1495,18 @@ function tokens(payload) {
     tokenType: "Bearer"
   };
 }
+var addressLocalPart = (email) => {
+  const at2 = email.indexOf("@");
+  return (at2 <= 0 ? email : email.slice(0, at2)).trim();
+};
 function user(payload) {
   const avatarUrl = typeof payload.avatar_url === "string" && payload.avatar_url.trim() !== "" ? payload.avatar_url.trim() : typeof payload.avatarUrl === "string" && payload.avatarUrl.trim() !== "" ? payload.avatarUrl.trim() : void 0;
+  const email = requiredString(payload.email, "user.email");
+  const username = typeof payload.username === "string" && payload.username.trim() !== "" ? payload.username.trim() : addressLocalPart(email);
   return {
     id: finiteNumber$1(payload.id, "user.id"),
-    username: requiredString(payload.username, "user.username"),
-    email: requiredString(payload.email, "user.email"),
+    username,
+    email,
     ...avatarUrl === void 0 ? {} : { avatarUrl },
     role: requiredString(payload.role, "user.role"),
     balance: finiteNumber$1(payload.balance, "user.balance"),
@@ -1810,6 +1848,31 @@ var FreeCodeGoAccountCoordinator = class {
     return this.auth.sendVerifyCode(email, signal);
   }
   /**
+  * Mail a password-reset code for one address.
+  *
+  * Straight through to the gateway: recovery is the one account operation that
+  * needs no session, no vault write and no identity, so there is nothing here
+  * for the coordinator to keep.
+  * @param email - the address the reset code is sent to.
+  * @param signal - aborts the request when the caller cancels.
+  */
+  async requestPasswordResetCode(email, signal) {
+    return this.auth.requestPasswordResetCode(email, signal);
+  }
+  /**
+  * Replace the password using the emailed reset code.
+  *
+  * It deliberately does not sign in afterwards — the gateway issues no session
+  * here — so the caller keeps the login form as the next step. A reset also
+  * invalidates nothing locally: this machine's stored password, if the user
+  * asked for one to be kept, is the caller's business to rewrite.
+  * @param input - the address, the code, and the new password.
+  * @param signal - aborts the request when the caller cancels.
+  */
+  async resetPassword(input, signal) {
+    return this.auth.resetPassword(input, signal);
+  }
+  /**
   * Authenticate and store a successful token pair in the host vault.
   *
   * The intent of this attempt is recorded here and committed in
@@ -58685,6 +58748,16 @@ async function sendVerifyCode(host, email) {
   if (host.account === void 0) throw backendNotConfigured();
   return host.account.sendVerifyCode(email);
 }
+async function forgotPassword(host, email) {
+  if (host.account === void 0) throw backendNotConfigured();
+  await host.account.requestPasswordResetCode(email);
+  return { sent: true };
+}
+async function resetPassword(host, input) {
+  if (host.account === void 0) throw backendNotConfigured();
+  await host.account.resetPassword(input);
+  return { reset: true };
+}
 async function login(host, input) {
   if (host.account === void 0) throw backendNotConfigured();
   const result = await host.account.login({
@@ -68011,6 +68084,8 @@ var FreeCodeGoHarnessPlugin = (() => {
   let _accountDetail_decorators;
   let _register_decorators;
   let _sendVerifyCode_decorators;
+  let _forgotPassword_decorators;
+  let _resetPassword_decorators;
   let _login_decorators;
   let _rememberedPassword_decorators;
   let _oauthLogin_decorators;
@@ -68237,6 +68312,8 @@ var FreeCodeGoHarnessPlugin = (() => {
       _accountDetail_decorators = [Remote("accountDetail")];
       _register_decorators = [Remote("accountRegister")];
       _sendVerifyCode_decorators = [Remote("accountSendVerifyCode")];
+      _forgotPassword_decorators = [Remote("accountForgotPassword")];
+      _resetPassword_decorators = [Remote("accountResetPassword")];
       _login_decorators = [Remote("accountLogin")];
       _rememberedPassword_decorators = [Remote("accountRememberedPassword")];
       _oauthLogin_decorators = [Remote("accountOAuthLogin")];
@@ -69800,6 +69877,28 @@ var FreeCodeGoHarnessPlugin = (() => {
         },
         metadata: _metadata
       }, null, _instanceExtraInitializers);
+      __esDecorate(this, null, _forgotPassword_decorators, {
+        kind: "method",
+        name: "forgotPassword",
+        static: false,
+        private: false,
+        access: {
+          has: (obj) => "forgotPassword" in obj,
+          get: (obj) => obj.forgotPassword
+        },
+        metadata: _metadata
+      }, null, _instanceExtraInitializers);
+      __esDecorate(this, null, _resetPassword_decorators, {
+        kind: "method",
+        name: "resetPassword",
+        static: false,
+        private: false,
+        access: {
+          has: (obj) => "resetPassword" in obj,
+          get: (obj) => obj.resetPassword
+        },
+        metadata: _metadata
+      }, null, _instanceExtraInitializers);
       __esDecorate(this, null, _login_decorators, {
         kind: "method",
         name: "login",
@@ -75474,6 +75573,22 @@ ${plan.text}
       return sendVerifyCode(this.accountRemotesHost, email);
     }
     /**
+    * Mail the password-reset code for an existing account.
+    * @param email - the address the reset code is sent to.
+    * @returns whether the gateway accepted the request.
+    */
+    async forgotPassword(email) {
+      return forgotPassword(this.accountRemotesHost, email);
+    }
+    /**
+    * Replace a password using the emailed reset code.
+    * @param input - the address, the emailed code, and the new password.
+    * @returns whether the gateway accepted the new password.
+    */
+    async resetPassword(input) {
+      return resetPassword(this.accountRemotesHost, input);
+    }
+    /**
     * Sign in with a password, keeping the issued tokens in the Host vault.
     * @param input - credentials and the remember-me intent of this attempt.
     * @returns the account snapshot after the sign-in.