mslxdff 0.1.45 → 0.1.54

package/README.md

@@ -1,162 +1,162 @@
-# mslxdff
-
-测试项目，请勿使用。
-
-Zero runtime dependencies: Node ≥ 20, built-in `node:http`, `node:crypto`, `node:test`.
-
-## What it does
-
-- `POST /v1/chat/completions` — forwards your OpenAI-format request to the upstream (with reasoning-content injection for thinking-mode DeepSeek/Kimi models), streams SSE back chunk-by-chunk, or passes through JSON for non-streaming calls.
-- `GET /v1/models` — the ~7 free models (`*-free` plus `big-pickle`), filtered from the full upstream list, cached and refreshed in the background every 2 hours.
-- `GET /health` — public liveness check.
-
-### `auto` model
-
-Omitting `model` (or passing `"auto"`) picks a free model automatically, DeepSeek first. On an upstream error the next candidate is tried in the same request; each model's last-error timestamp is recorded (persisted in the state file) so the most reliably-available model is preferred next time.
-
-### Fallback for a specific model
-
-Pointing at a specific model (e.g. `deepseek-v4-flash-free`) still gets failover: if that model errors, the request automatically falls through to the next free model so your task isn't interrupted, and the error is recorded. The model enters a cooldown window (default 60s, `MSLXDFF_MODEL_COOLDOWN_MS`); during cooldown the backup models are used directly, and afterwards your model is tried again — once it succeeds it keeps being used until it errors again.
-
-## Install & run
-
-```
-npm install      # no deps actually fetched; just links the bin
-mslxdff          # or: node bin/mslxdff.js
-```
-
-First run generates a bearer token, writes it to the state file, and prints it:
-
-```
-mslxdff listening on http://localhost:8989
-auth token: 9b5de021e914...
-endpoint:   http://localhost:8989/v1
-```
-
-### Port
-
-Default port is **8989**. Persist a different port (and hot-restart the daemon onto it if one is running):
-
-```
-mslxdff -port 8000     # set port to 8000; restarts the daemon on 8000
-mslxdff -d             # next starts reuse the persisted port (8000)
-```
-
-Priority: `-port` arg > persisted port > `PORT` env > default `8989`.
-
-### Daemon (background, stays resident)
-
-Just run `mslxdff` (no args): if no daemon is running yet, it **starts a background
-daemon and exits** — the command never holds your terminal, so `npx mslxdff` works
-the same way. If a daemon is already up, the bare command shows status + help.
-
-```
-mslxdff        # starts the background daemon (if none running); exits immediately
-mslxdff -d     # same, explicit
-mslxdff -stop  # stop it
-```
-
-Logs go to `~/.config/mslxdff/daemon.log`, the daemon pid to `daemon.pid` (both overridable via `MSLXDFF_DAEMON_DIR`). The daemon keeps running after your shell exits.
-
-### Status
-
-Running `mslxdff` with no args shows a status panel when a daemon is already up: joined groups with their members, failover targets, the free model list, the last 5 calls (model/status/latency), and the most recent error (`mslxdff -status` for status only, `mslxdff -help` for the full command reference). Call and error history are stored as JSON-lines at `calls.log` / `errors.log` in the state dir.
-
-```
-$ mslxdff -status
-mslxdff v0.1.2
-daemon:    running (pid 12345)
-endpoint:  http://localhost:8989/v1
-log dir:   C:/Users/you/.config/mslxdff
-
-models (7 free):
-  big-pickle
-  deepseek-v4-flash-free
-  ...
-
-recent calls:
-  08-03 12:00:03  deepseek-v4-flash-free  200  812ms
-  ...
-
-last error:
-  08-03 11:59:58  deepseek-v4-flash-free  429  upstream 429
-```
-
-### Update
-
-```
-mslxdff -update    # install the latest published version; restarts a running daemon
-```
-
-### Groups (join several machines by name)
-
-Run mslxdff on several machines (e.g. locally + a VPS) and join them into a named group — **the group name is the password**. When the local upstream fails for a model, the request is forwarded to a group member running the **same model** — your task keeps the model it asked for, just served from another machine with its own upstream quota.
-
-```
-# on the leader machine B (must be reachable from the others):
-mslxdff -creategroup mygroup        # group name IS the password, no address needed
-
-# on machine A (and C, D, …) — give the leader's host; your own address is auto-registered:
-mslxdff -addtogroup <B-ip> mygroup
-```
-
-- Anyone who knows the group name can join — pick something unguessable, like `mygroup@mslxd-7f3k`. The leader's first joiner seeds the leader's own entry from the address it connects from, so `-creategroup` takes no address argument (default port 8989; `-addtogroup` also accepts `host:port`).
-- Joining registers your node with the leader (membership is keyed by your bearer token) and immediately pulls the member list into local failover targets.
-- Membership is persisted and re-synced on every start + every `MSLXDFF_GROUP_SYNC_MS` (default 60s), so a newly joined machine becomes a failover target on all nodes automatically.
-- Local-first: every request tries the local upstream before any group member. On local failure, members are tried round-robin for the same model; a member that just failed is skipped for `MSLXDFF_PEER_COOLDOWN_MS` (default 30s).
-- Forwarded requests carry a hop limit (`MSLXDFF_MAX_HOPS`, default 3) to prevent forwarding loops, and a model-lock so the member doesn't switch models. A→B→C chaining works as long as each member knows the others.
-- Wrong group names (or wrong tokens) are counted per source IP: `MSLXDFF_BAN_THRESHOLD` (default 5) failures ban the IP for `MSLXDFF_BAN_WINDOW_MS` (default 48h). `mslxdff -resetban [ip]` clears bans (all, or one IP).
-- `mslxdff -group sync` pulls once manually; `mslxdff -group leave <name>` detaches from a group and clears its members; `mslxdff -group list` shows groups. See `docs/adr/0005-peer-mesh.md`.
-
-```
-mslxdff -showtoken      # print the current token (creates one on first use)
-mslxdff -refresh-token  # rotate it (prints the new token, does not start the server)
-```
-
-## Client configuration
-
-Point any OpenAI-compatible client at the endpoint with the token:
-
-```
-Endpoint:   http://localhost:8989/v1
-API Key:    <the bearer token>      (sent as Authorization: Bearer <token>)
-Model:      oc/deepseek-v4-flash-free   (the oc/ prefix is optional)
-```
-
-<x-model list>
-
-```
-$ curl -H "Authorization: Bearer <token>" http://localhost:8989/v1/models
-{"object":"list","data":[{"id":"big-pickle",...},{"id":"deepseek-v4-flash-free",...}, ...]}
-</x-model list>
-
-## Environment variables
-
-| Variable | Default | Purpose |
-|---|---|---|
-| `PORT` | `8989` | listen port (used when no `-port` arg and no persisted port) |
-| `MSLXDFF_STATE_FILE` | `~/.config/mslxdff/state.json` | token/port state file (mode 0600) |
-| `MSLXDFF_DAEMON_DIR` | `~/.config/mslxdff` | daemon pid + log directory |
-| `UPSTREAM_BASE_URL` | `https://opencode.ai` | upstream base |
-| `UPSTREAM_AUTH_TOKEN` | `public` | upstream `Authorization: Bearer <…>` value |
-| `UPSTREAM_CONNECT_TIMEOUT_MS` | `30000` | upstream connect timeout |
-| `LOG_LEVEL` | `info` | (reserved) |
-| `MODELS_REFRESH_MS` | `7200000` | background model-list refresh interval (2h) |
-| `MSLXDFF_MODEL_COOLDOWN_MS` | `60000` | fallback cooldown after a model error |
-| `MSLXDFF_PEER_COOLDOWN_MS` | `30000` | peer failover cooldown |
-| `MSLXDFF_GROUP_SYNC_MS` | `60000` | group membership sync interval |
-| `MSLXDFF_MAX_HOPS` | `3` | max peer-forwarding depth |
-| `MSLXDFF_BAN_THRESHOLD` | `5` | failed joins before an IP is banned |
-| `MSLXDFF_BAN_WINDOW_MS` | `172800000` | ban duration after too many join failures (48h) |
-
-## Clients
-
-Point your OpenAI client at `http://<host>:8989/v1` (or the equivalent config seen above). Works for streaming and non-streaming chat completions.
-
-## Development
-
-```
-npm test        # node --test, no network access
-```
-
-The reference implementation is 9Router v0.5.45 (`/root/9router`); see `CLAUDE.md`, `CONTEXT.md`, and `docs/adr/` for the contract and the decisions behind it.
+# mslxdff
+
+测试项目，请勿使用。
+
+Zero runtime dependencies: Node ≥ 20, built-in `node:http`, `node:crypto`, `node:test`.
+
+## What it does
+
+- `POST /v1/chat/completions` — forwards your OpenAI-format request to the upstream (with reasoning-content injection for thinking-mode DeepSeek/Kimi models), streams SSE back chunk-by-chunk, or passes through JSON for non-streaming calls.
+- `GET /v1/models` — the ~7 free models (`*-free` plus `big-pickle`), filtered from the full upstream list, cached and refreshed in the background every 2 hours.
+- `GET /health` — public liveness check.
+
+### `auto` model
+
+Omitting `model` (or passing `"auto"`) picks a free model automatically, DeepSeek first. On an upstream error the next candidate is tried in the same request; each model's last-error timestamp is recorded (persisted in the state file) so the most reliably-available model is preferred next time.
+
+### Fallback for a specific model
+
+Pointing at a specific model (e.g. `deepseek-v4-flash-free`) still gets failover: if that model errors, the request automatically falls through to the next free model so your task isn't interrupted, and the error is recorded. The model enters a cooldown window (default 60s, `MSLXDFF_MODEL_COOLDOWN_MS`); during cooldown the backup models are used directly, and afterwards your model is tried again — once it succeeds it keeps being used until it errors again.
+
+## Install & run
+
+```
+npm install      # no deps actually fetched; just links the bin
+mslxdff          # or: node bin/mslxdff.js
+```
+
+First run generates a bearer token, writes it to the state file, and prints it:
+
+```
+mslxdff listening on http://localhost:8989
+auth token: 9b5de021e914...
+endpoint:   http://localhost:8989/v1
+```
+
+### Port
+
+Default port is **8989**. Persist a different port (and hot-restart the daemon onto it if one is running):
+
+```
+mslxdff -port 8000     # set port to 8000; restarts the daemon on 8000
+mslxdff -d             # next starts reuse the persisted port (8000)
+```
+
+Priority: `-port` arg > persisted port > `PORT` env > default `8989`.
+
+### Daemon (background, stays resident)
+
+Just run `mslxdff` (no args): if no daemon is running yet, it **starts a background
+daemon and exits** — the command never holds your terminal, so `npx mslxdff` works
+the same way. If a daemon is already up, the bare command shows status + help.
+
+```
+mslxdff        # starts the background daemon (if none running); exits immediately
+mslxdff -d     # same, explicit
+mslxdff -stop  # stop it
+```
+
+Logs go to `~/.config/mslxdff/daemon.log`, the daemon pid to `daemon.pid` (both overridable via `MSLXDFF_DAEMON_DIR`). The daemon keeps running after your shell exits.
+
+### Status
+
+Running `mslxdff` with no args shows a status panel when a daemon is already up: joined groups with their members, failover targets, the free model list, the last 5 calls (model/status/latency), and the most recent error (`mslxdff -status` for status only, `mslxdff -help` for the full command reference). Call and error history are stored as JSON-lines at `calls.log` / `errors.log` in the state dir.
+
+```
+$ mslxdff -status
+mslxdff v0.1.2
+daemon:    running (pid 12345)
+endpoint:  http://localhost:8989/v1
+log dir:   C:/Users/you/.config/mslxdff
+
+models (7 free):
+  big-pickle
+  deepseek-v4-flash-free
+  ...
+
+recent calls:
+  08-03 12:00:03  deepseek-v4-flash-free  200  812ms
+  ...
+
+last error:
+  08-03 11:59:58  deepseek-v4-flash-free  429  upstream 429
+```
+
+### Update
+
+```
+mslxdff -update    # install the latest published version; restarts a running daemon
+```
+
+### Groups (join several machines by name)
+
+Run mslxdff on several machines (e.g. locally + a VPS) and join them into a named group — **the group name is the password**. When the local upstream fails for a model, the request is forwarded to a group member running the **same model** — your task keeps the model it asked for, just served from another machine with its own upstream quota.
+
+```
+# on the leader machine B (must be reachable from the others):
+mslxdff -creategroup mygroup        # group name IS the password, no address needed
+
+# on machine A (and C, D, …) — give the leader's host; your own address is auto-registered:
+mslxdff -addtogroup <B-ip> mygroup
+```
+
+- Anyone who knows the group name can join — pick something unguessable, like `mygroup@mslxd-7f3k`. The leader's first joiner seeds the leader's own entry from the address it connects from, so `-creategroup` takes no address argument (default port 8989; `-addtogroup` also accepts `host:port`).
+- Joining registers your node with the leader (membership is keyed by your bearer token) and immediately pulls the member list into local failover targets.
+- Membership is persisted and re-synced on every start + every `MSLXDFF_GROUP_SYNC_MS` (default 60s), so a newly joined machine becomes a failover target on all nodes automatically.
+- Local-first: every request tries the local upstream before any group member. On local failure, members are tried round-robin for the same model; a member that just failed is skipped for `MSLXDFF_PEER_COOLDOWN_MS` (default 30s).
+- Forwarded requests carry a hop limit (`MSLXDFF_MAX_HOPS`, default 3) to prevent forwarding loops, and a model-lock so the member doesn't switch models. A→B→C chaining works as long as each member knows the others.
+- Wrong group names (or wrong tokens) are counted per source IP: `MSLXDFF_BAN_THRESHOLD` (default 5) failures ban the IP for `MSLXDFF_BAN_WINDOW_MS` (default 48h). `mslxdff -resetban [ip]` clears bans (all, or one IP).
+- `mslxdff -group sync` pulls once manually; `mslxdff -group leave <name>` detaches from a group and clears its members; `mslxdff -group list` shows groups. See `docs/adr/0005-peer-mesh.md`.
+
+```
+mslxdff -showtoken      # print the current token (creates one on first use)
+mslxdff -refresh-token  # rotate it (prints the new token, does not start the server)
+```
+
+## Client configuration
+
+Point any OpenAI-compatible client at the endpoint with the token:
+
+```
+Endpoint:   http://localhost:8989/v1
+API Key:    <the bearer token>      (sent as Authorization: Bearer <token>)
+Model:      oc/deepseek-v4-flash-free   (the oc/ prefix is optional)
+```
+
+<x-model list>
+
+```
+$ curl -H "Authorization: Bearer <token>" http://localhost:8989/v1/models
+{"object":"list","data":[{"id":"big-pickle",...},{"id":"deepseek-v4-flash-free",...}, ...]}
+</x-model list>
+
+## Environment variables
+
+| Variable | Default | Purpose |
+|---|---|---|
+| `PORT` | `8989` | listen port (used when no `-port` arg and no persisted port) |
+| `MSLXDFF_STATE_FILE` | `~/.config/mslxdff/state.json` | token/port state file (mode 0600) |
+| `MSLXDFF_DAEMON_DIR` | `~/.config/mslxdff` | daemon pid + log directory |
+| `UPSTREAM_BASE_URL` | `https://opencode.ai` | upstream base |
+| `UPSTREAM_AUTH_TOKEN` | `public` | upstream `Authorization: Bearer <…>` value |
+| `UPSTREAM_CONNECT_TIMEOUT_MS` | `30000` | upstream connect timeout |
+| `LOG_LEVEL` | `info` | (reserved) |
+| `MODELS_REFRESH_MS` | `7200000` | background model-list refresh interval (2h) |
+| `MSLXDFF_MODEL_COOLDOWN_MS` | `60000` | fallback cooldown after a model error |
+| `MSLXDFF_PEER_COOLDOWN_MS` | `30000` | peer failover cooldown |
+| `MSLXDFF_GROUP_SYNC_MS` | `60000` | group membership sync interval |
+| `MSLXDFF_MAX_HOPS` | `3` | max peer-forwarding depth |
+| `MSLXDFF_BAN_THRESHOLD` | `5` | failed joins before an IP is banned |
+| `MSLXDFF_BAN_WINDOW_MS` | `172800000` | ban duration after too many join failures (48h) |
+
+## Clients
+
+Point your OpenAI client at `http://<host>:8989/v1` (or the equivalent config seen above). Works for streaming and non-streaming chat completions.
+
+## Development
+
+```
+npm test        # node --test, no network access
+```
+
+The reference implementation is 9Router v0.5.45 (`/root/9router`); see `CLAUDE.md`, `CONTEXT.md`, and `docs/adr/` for the contract and the decisions behind it.

package/bin/mslxdff.js

@@ -8,8 +8,10 @@ import { DEFAULT_PORT, defaultStateFile } from "../src/state.js";
 import { createRouter } from "../src/routes.js";
 import { createUpstreamClient } from "../src/upstream.js";
 import { createModelsService } from "../src/models.js";
-import { loadToken, refreshToken, setPort, getPort, loadGroupsJoined, saveGroupsJoined, loadModelErrors, savePreferredModel } from "../src/state.js";
+import { loadToken, refreshToken, setPort, getPort, loadGroupsJoined, saveGroupsJoined, loadModelErrors, savePreferredModel, loadPreferredModel } from "../src/state.js";
 import { getPreferredModel } from "../src/auto.js";
+import { normalizeModel } from "../src/reasoning.js";
+import { syncToWorkbuddy, workbuddyModelsPath } from "../src/sync-workbuddy.js";
 import { startDaemon, stopDaemon, writePid, pidFile, logFile, readPid, readPidVersion, isPidAlive } from "../src/daemon.js";
 import { createAutoSelector } from "../src/auto.js";
 import { createPeersService } from "../src/peers.js";
@@ -191,22 +193,43 @@ if (args.includes("-model") || args.includes("-models")) {
     process.exit(1);
   }
   const cacheFile = join(logDir(), "models.json");
-  try {
-    let ids = [];
-    let cachedAt = null;
-    const cached = readModelsCache(cacheFile);
-    if (cached) {
-      ids = (cached.data || []).map((m) => m.id).filter(Boolean);
-      cachedAt = cached.cachedAt || null;
-    } else {
+  // 主动刷新：每次执行都尝试拉取上游最新列表（4s 超时），成功则更新缓存，失败则回退到 stale
+  async function tryRefreshModels() {
+    try {
       const models = createModelsService({
         baseUrl: process.env.UPSTREAM_BASE_URL || "https://opencode.ai",
         headers: createUpstreamClient({}).headers,
         refreshMs: 0,
         cacheFile,
       });
-      const list = await models.get();
-      ids = (list.data || []).map((m) => m.id).filter(Boolean);
+      // 4s 超时，避免阻塞
+      const list = await Promise.race([
+        models.get(),
+        new Promise((_, rej) => setTimeout(() => rej(new Error("refresh timeout")), 4000)),
+      ]);
+      return list;
+    } catch {
+      return null;
+    }
+  }
+  try {
+    let ids = [];
+    let cachedAt = null;
+    let refreshed = null;
+    // 每次都主动尝试刷新
+    refreshed = await tryRefreshModels();
+    if (refreshed?.data) {
+      ids = (refreshed.data || []).map((m) => m.id).filter(Boolean);
+      cachedAt = refreshed.cachedAt || Date.now();
+    } else {
+      const cached = readModelsCache(cacheFile);
+      if (cached) {
+        ids = (cached.data || []).map((m) => m.id).filter(Boolean);
+        cachedAt = cached.cachedAt || null;
+      } else {
+        // 无缓存且刷新失败，尝试一次兜底 fetch（已在 tryRefreshModels 中尝试过，此处直接报错）
+        throw new Error("no cached models and refresh failed");
+      }
     }
     if (!ids.length) {
       console.log("no models available — try: mslxdff -model refresh");
@@ -244,6 +267,74 @@ if (args.includes("-model") || args.includes("-models")) {
   process.exit(0);
 }
 
+// -setto workbuddy [modelId]: set default model and sync to WorkBuddy models.json
+if (args.includes("-setto") || args.includes("--setto")) {
+  const idx = args.findIndex((x) => x === "-setto" || x === "--setto");
+  const target = args[idx + 1];
+  if (target !== "workbuddy") {
+    console.error("usage: mslxdff -setto workbuddy [modelId]");
+    process.exit(1);
+  }
+  const raw = args[idx + 2] && !String(args[idx + 2]).startsWith("-") ? String(args[idx + 2]).trim() : null;
+  let id;
+  if (raw) {
+    if (raw === "auto" || !raw) {
+      console.error("modelId 不能为 auto 或空");
+      process.exit(1);
+    }
+    const norm = normalizeModel(raw);
+    if (!norm) {
+      console.error("modelId 不能为空");
+      process.exit(1);
+    }
+    savePreferredModel(norm);
+    console.log(`default model set to: ${norm} (daemon hot-reloads on next request)`);
+    id = norm;
+  } else {
+    id = loadPreferredModel() || getPreferredModel();
+    if (!id) {
+      console.error("no preferred model set; use: mslxdff -setto workbuddy <modelId>");
+      process.exit(1);
+    }
+  }
+  // 主动刷新模型列表（每次 -setto 都尝试，保证 deepseek 等最新模型可见；失败不阻断同步）
+  try {
+    const cacheFile = join(logDir(), "models.json");
+    const models = createModelsService({
+      baseUrl: process.env.UPSTREAM_BASE_URL || "https://opencode.ai",
+      headers: createUpstreamClient({}).headers,
+      refreshMs: 0,
+      cacheFile,
+    });
+    const fresh = await Promise.race([
+      models.get(),
+      new Promise((_, rej) => setTimeout(() => rej(new Error("refresh timeout")), 4000)),
+    ]);
+    if (fresh?.data?.length) {
+      const ids = fresh.data.map((m) => m.id);
+      if (!ids.includes(id)) {
+        console.log(`warn: "${id}" not in current free list (${ids.length} models), still syncing to WorkBuddy`);
+      }
+    }
+  } catch {
+    // refresh failed, still proceed with sync using stale/cached list
+  }
+  try {
+    const { token } = await loadToken();
+    const persisted = getPort();
+    const envPort = Number(process.env.MSLXDFF_PORT);
+    const port = persisted !== null ? persisted : (Number.isInteger(envPort) && envPort > 0 ? envPort : 8989);
+    const file = workbuddyModelsPath();
+    const r = await syncToWorkbuddy({ id, token, port, file });
+    console.log(`synced to WorkBuddy: ${r.action} "${id}" @ ${file}`);
+    console.log(`  url: http://127.0.0.1:${port}/v1/chat/completions`);
+  } catch (err) {
+    console.error(`failed to sync to WorkBuddy: ${String(err?.message || err)}`);
+    process.exit(1);
+  }
+  process.exit(0);
+}
+
 // 交互式选择器：↑/↓ 移动，Enter 确认，q/Esc 取消；ANSI 原地重绘
 async function pickInteractive(items, startCursor = 0) {
   const { renderChooser, renderChooserHelp, parseKey } = await import("../src/chooser.js");
@@ -873,6 +964,11 @@ if (created) {
   console.log(`auth token: ${token}`);
 }
 console.log(`endpoint:   http://${host}:${addr.port}/v1`);
+try {
+  const { hedgeDelayMs } = await import("../src/routes/hedge.js");
+  const hd = hedgeDelayMs();
+  console.log(`hedge:      ${hd ? `${hd}ms` : "off"} (MSLXDFF_HEDGE_DELAY_MS)`);
+} catch {}
 
 // Periodically pull the freshest member lists for every joined group so a
 // new member becomes a failover peer on all nodes without manual re-joining.
@@ -1177,6 +1273,7 @@ Usage:
   mslxdff -update                  update mslxdff to the latest published version
   mslxdff -showtoken               print the current auth token
   mslxdff -refresh-token           rotate the auth token (prints the new one)
+  mslxdff -setto workbuddy [modelId]  set default model and sync to WorkBuddy models.json (insert or update 127.0.0.1/v1 entry)
   mslxdff -creategroup <name>      create a group on this node (the group name is the password)
   mslxdff -addtogroup <leader-host> <name> [--broadband]  join a group via its leader host (default port 8989) — broadband: 宽带动态IP成员（经Leader中继，无需公网入站，默认127.0.0.1）
   mslxdff -group sync              pull the freshest member list for all joined groups
@@ -1203,6 +1300,7 @@ Environment:
   MSLXDFF_MAX_HOPS           max peer-forwarding depth (default 3)
   MSLXDFF_BAN_THRESHOLD   failed joins before an ip is banned (default 5)
   MSLXDFF_BAN_WINDOW_MS   ban duration after too many failures (default 48h)
+  MSLXDFF_HEDGE_DELAY_MS  hedge peer race when local stream first chunk slow (default 1000, 0/off to disable)
   MSLXDFF_AUTO_UPDATE   auto-update: hourly by default, 0/off/false to disable, 1/true or ms
   MSLXDFF_AUTO_UPDATE_MS  same as above, explicit ms (overrides AUTO_UPDATE)
 `);

package/docs/adr/0001-reasoning-content-injection.md

@@ -1,14 +1,14 @@
-# ADR-0001: Inject a reasoning_content placeholder on outbound assistant messages
-
-The Zen upstream's thinking-mode models (deepseek-family at minimum) return
-`400 "The reasoning_content in the thinking mode must be passed back"` when a
-multi-turn request echoes an assistant message without its `reasoning_content`.
-Clients speaking plain OpenAI format never send that field, so the proxy writes
-a `" "` placeholder into assistant messages before forwarding. Scope is `all`
-for deepseek-family models and `tool_calls` for kimi-family models; messages
-that already carry non-empty `reasoning_content` are left untouched.
-
-The alternative — telling clients to manage `reasoning_content` themselves —
-would break standard OpenAI-compatible clients, so the proxy eats this
-compatibility cost instead. Matches `/root/9router` v0.5.45
+# ADR-0001: Inject a reasoning_content placeholder on outbound assistant messages
+
+The Zen upstream's thinking-mode models (deepseek-family at minimum) return
+`400 "The reasoning_content in the thinking mode must be passed back"` when a
+multi-turn request echoes an assistant message without its `reasoning_content`.
+Clients speaking plain OpenAI format never send that field, so the proxy writes
+a `" "` placeholder into assistant messages before forwarding. Scope is `all`
+for deepseek-family models and `tool_calls` for kimi-family models; messages
+that already carry non-empty `reasoning_content` are left untouched.
+
+The alternative — telling clients to manage `reasoning_content` themselves —
+would break standard OpenAI-compatible clients, so the proxy eats this
+compatibility cost instead. Matches `/root/9router` v0.5.45
 `open-sse/utils/reasoningContentInjector.js`.

package/docs/adr/0002-models-free-filter.md

@@ -1,12 +1,12 @@
-# ADR-0002: /v1/models exposes only free models, matched by suffix or whitelist
-
-The upstream `/zen/v1/models` list contains ~60 models; exposing them all would
-pollute clients with paid models this proxy can't serve for free. `/v1/models`
-therefore filters to: `id` ending in `-free`, OR the explicit whitelist entry
-`big-pickle`. The whitelist exists because `big-pickle` is a free model without
-the `-free` suffix, and a suffix-only filter would silently drop it.
-
-A plain `endsWith("-free")` filter was considered and rejected for exactly that
-reason. Matches `/root/9router` v0.5.45
-`src/app/api/providers/suggested-models/filters.js`
+# ADR-0002: /v1/models exposes only free models, matched by suffix or whitelist
+
+The upstream `/zen/v1/models` list contains ~60 models; exposing them all would
+pollute clients with paid models this proxy can't serve for free. `/v1/models`
+therefore filters to: `id` ending in `-free`, OR the explicit whitelist entry
+`big-pickle`. The whitelist exists because `big-pickle` is a free model without
+the `-free` suffix, and a suffix-only filter would silently drop it.
+
+A plain `endsWith("-free")` filter was considered and rejected for exactly that
+reason. Matches `/root/9router` v0.5.45
+`src/app/api/providers/suggested-models/filters.js`
 (`KNOWN_FREE_OPENCODE_MODELS = ["big-pickle"]`).

package/docs/adr/0003-zero-state-no-auth.md

@@ -1,10 +1,10 @@
-# ADR-0003: Zero-state, no-DB, no-account local proxy
-
-Status: partially superseded by [ADR-0004](./0004-bearer-token.md) — the
-no-auth clause below is replaced; the zero-DB / no-account / no-cloud principles
-stand.
-
-By design this proxy holds no database, no token store, no account rotation,
-and no cloud sync. A single static bearer token is the only credential, kept
-in a 0600 state file (see ADR-0004); everything else is stateless per-process
+# ADR-0003: Zero-state, no-DB, no-account local proxy
+
+Status: partially superseded by [ADR-0004](./0004-bearer-token.md) — the
+no-auth clause below is replaced; the zero-DB / no-account / no-cloud principles
+stand.
+
+By design this proxy holds no database, no token store, no account rotation,
+and no cloud sync. A single static bearer token is the only credential, kept
+in a 0600 state file (see ADR-0004); everything else is stateless per-process
 memory at most.

package/docs/adr/0004-bearer-token.md

@@ -1,18 +1,18 @@
-# ADR-0004: Single static bearer token, persisted in a 0600 state file
-
-The proxy requires a bearer token on `/v1/*` so an accidentally-exposed port
-isn't an open relay. There is no account system: the token is a random
-`crypto` 32-byte value (hex), generated once on first run, persisted to a
-state file (default `~/.config/mslxdff/state.json`, `0600`, path overridable
-via `MSLXDFF_STATE_FILE`), and printed to stdout on creation. Rotate with
-`mslxdff -refresh-token`, which regenerates, rewrites the file, prints the
-new token, and exits (does not start the server).
-
-Auth is enforced with a constant-time string compare on
-`Authorization: Bearer <token>`; mismatches get `401` with `WWW-Authenticate`.
-`/health` stays public (no token). Tokens never appear in logs.
-
-Alternatives rejected: a fixed default token (same key on every install),
-per-user accounts (needs a DB — that's the 9Router provisioning surface we
-rejected in ADR-0003), and unauthenticated local-only binding (fragile;
+# ADR-0004: Single static bearer token, persisted in a 0600 state file
+
+The proxy requires a bearer token on `/v1/*` so an accidentally-exposed port
+isn't an open relay. There is no account system: the token is a random
+`crypto` 32-byte value (hex), generated once on first run, persisted to a
+state file (default `~/.config/mslxdff/state.json`, `0600`, path overridable
+via `MSLXDFF_STATE_FILE`), and printed to stdout on creation. Rotate with
+`mslxdff -refresh-token`, which regenerates, rewrites the file, prints the
+new token, and exits (does not start the server).
+
+Auth is enforced with a constant-time string compare on
+`Authorization: Bearer <token>`; mismatches get `401` with `WWW-Authenticate`.
+`/health` stays public (no token). Tokens never appear in logs.
+
+Alternatives rejected: a fixed default token (same key on every install),
+per-user accounts (needs a DB — that's the 9Router provisioning surface we
+rejected in ADR-0003), and unauthenticated local-only binding (fragile;
 a proxy relay deserves an explicit secret even on localhost).