opencode-ufr 0.2.0 → 0.2.2

package/README.md

@@ -1,71 +1,100 @@
 # opencode-ufr
 
-An [opencode](https://opencode.ai) provider for Uni Freiburg's Open WebUI
-models. A small local gateway runs on your machine, pools your UFR API
+An [opencode](https://opencode.ai) provider for **Uni Freiburg's Open WebUI
+models**. A small local gateway runs on your machine, pools your UFR API
 key(s), and handles UFR's rate limits and outages so opencode doesn't have to.
+Off campus, it connects through the uni's Fortinet VPN **by itself** — with no
+TUN device, no admin rights and no external tools.
 
-## Requirements
-
-- opencode ≥ 2.0
-- A UFR account and API key (Open WebUI → Settings → Account → API keys)
-- [Bun](https://bun.sh) on your `PATH` for the `ufr` CLI. The plugin itself
-  needs no Bun — it runs inside opencode.
-- Off campus, the **built-in VPN** connects to UFR on its own: store your uni
-  login once (`ufr login add <user>`) and the plugin tunnels its UFR calls
-  through `fortivpn.uni-freiburg.de` — with no TUN device, no admin rights, no
-  openconnect and no changes to your routing. Your own VPNs keep working
-  untouched in parallel. See the RZ guide if you prefer a system VPN:
-  https://wiki.uni-freiburg.de/rz/doku.php?id=vpn
+```
+opencode ⇄ gateway (127.0.0.1) ⇄ [Fortinet tunnel] ⇄ openwebui.uni-freiburg.de
+                    │
+                    ├─ key pool (1…n UFR accounts)
+                    ├─ rate-limit pacing, circuit breakers, fallbacks
+                    └─ VPN when off campus (userspace TCP/IP stack)
+```
 
 ## Install
 
-Not on npm yet — install straight from GitHub:
-
 ```bash
-bun add -g github:FinleyLaempe/opencode-ufr   # puts `ufr` on PATH
-ufr connect
+bun add -g opencode-ufr              # puts `ufr` on PATH
+opencode plugin add opencode-ufr     # registers the plugin
 ```
 
-`ufr connect` asks for your UFR API key(s) — comma-separated, whitespace
-around keys is filtered, aliases (key1, key2, …) are assigned automatically —
-and optionally your uni login for the built-in VPN. Everything is verified
-against UFR and stored in the OS keyring (never on disk).
+(or add `"plugins": ["opencode-ufr"]` to your `opencode.json` manually.)
 
-Inside opencode you never need the CLI: the plugin takes over the built-in
-`/connect` panel's **Uni Freiburg** entry. It shows the API-key(s) field plus
-**Uni login (optional)** and **Uni password (optional)** — both only needed on
-a machine outside the uni network, where the built-in VPN uses them. Submitted
-credentials land in the OS keyring automatically and the gateway restarts with
-them.
+## Setup
 
-Manual alternative — add to `opencode.json`:
+**Inside opencode — the normal way:** open `/connect`, pick **Uni Freiburg**,
+and fill in:
 
-```json
-{ "plugins": ["github:FinleyLaempe/opencode-ufr"] }
-```
+| Field | Needed? |
+|---|---|
+| **API keys** | always — paste one key per UFR account, comma-separated (whitespace is filtered) |
+| **Uni login** | only off campus — e.g. `fl240@uni-freiburg.de`, empty on the uni network |
+| **Uni password** | only with a login above |
+
+Submitted credentials land in your OS keyring (never on disk), the gateway
+restarts with them, and the `unifreiburg/…` models appear in the model picker.
+
+**In a terminal — the fallback:** works before opencode ever starts.
 
-or run `opencode plugin add github:FinleyLaempe/opencode-ufr` yourself, then
-`ufr connect --keys "<key1>,<key2>"`.
+```bash
+ufr connect --keys "<key1>,<key2>"                                 # keys only
+ufr connect --login fl240@uni-freiburg.de --password … --keys "…"   # + VPN login
+```
 
-npm publication is planned; once it lands, `bunx opencode-ufr …` /
-`npx opencode-ufr …` will work without a global install.
+`ufr connect` verifies every key against UFR, assigns aliases (`key1`, `key2`,
+…) automatically and accepts keys comma- or line-separated.
 
 ## Use
 
 Models show up in opencode as `unifreiburg/<model>`, e.g.
-`unifreiburg/ufr/coding-complex`. Everything else is the CLI:
+`unifreiburg/ufr/coding-complex` or `unifreiburg/glm-5.3-flash-llmlb`. The
+gateway starts itself the first time opencode needs it (the plugin waits up to
+40 s) and shuts down after 5 minutes idle. You never manage it directly.
 
 ```bash
-ufr status       # gateway, keys, limits, breakers, spend today
+ufr status       # gateway, keys, limits, breakers, vpn, spend today
 ufr stats        # requests, tokens and cost
-ufr keys test    # check your stored keys against UFR
-ufr keys list    # aliases
+ufr keys list    # stored aliases
+ufr keys test    # check your keys against UFR
 ufr login show   # the stored uni login
 ```
 
-The gateway starts itself the first time opencode needs it (the plugin waits
-up to 40 s for it to come up) and shuts down again after 5 minutes idle. You
-don't run or manage it directly.
+## The built-in VPN
+
+On the campus network (or the VPN you already run) UFR is reached directly and
+no tunnel opens. Off campus, the gateway:
+
+1. logs in to `fortivpn.uni-freiburg.de` with your stored uni login (TLS),
+2. negotiates PPP/IPCP over the Fortinet SSL-VPN channel (this is the same
+   protocol `openconnect --protocol=fortinet` speaks, implemented in pure
+   TypeScript — see `docs/fortinet-protocol.md`),
+3. runs a **userspace TCP/IP stack inside the gateway process** and routes its
+   UFR calls through it via a localhost CONNECT proxy.
+
+What that means in practice:
+
+- **No TUN device, no routing table changes, no admin rights** — identical
+  code on Linux, macOS and Windows.
+- **Your own VPNs keep working untouched in parallel** — the plugin's tunnel
+  exists only inside its own process and rides on whatever network the OS
+  provides.
+- **Everything is encrypted twice**: the tunnel itself is TLS 1.3, and your
+  API calls are HTTPS end-to-end to `openwebui.uni-freiburg.de` inside it.
+- `vpn.mode: "auto"` (default) only tunnels when UFR is unreachable directly;
+  `"always"` forces the tunnel (useful behind firewalls that block the campus
+  route).
+- If the tunnel dies, it reconnects with backoff — no session is lost, the
+  gateway just waits until the path is back.
+
+## More than one key
+
+UFR allows one API key per account, so one key is one account's worth of
+throughput. The key pool round-robins across all stored keys and keeps each
+under UFR's per-key limits; adding more keys only helps if they belong to
+different UFR accounts.
 
 ## What the gateway does
 
@@ -74,12 +103,6 @@ don't run or manage it directly.
 - Enforces a pool-wide cap of 800 requests/hour across all keys and models —
   UFR walls a model group for hours once it sees sustained traffic above
   roughly 900/hour.
-- **Connects to UFR on its own when you are off campus.** It logs in to the
-  uni's Fortinet gateway with your stored uni login, negotiates PPP/IPCP and
-  runs a userspace TCP/IP stack inside the gateway process: no TUN device, no
-  routes, no admin rights, identical on Linux, macOS and Windows. On campus it
-  talks to UFR directly and never opens the tunnel; `vpn.mode: "always"`
-  forces the tunnel.
 - Runs a circuit breaker per model: after repeated failures it backs off from
   30 s up to 60 minutes before probing again, instead of hammering a walled
   model.
@@ -97,15 +120,10 @@ don't run or manage it directly.
   unclean shutdown, the next start detects it's stale and takes it over
   rather than refusing to start.
 
-## More than one key
-
-UFR allows one API key per account, so one key is one account's worth of
-throughput. Adding more keys only helps if they belong to different UFR
-accounts — it does not raise any one account's limit.
-
 ## Configuration
 
-Non-secret settings live in a JSON file; keys always stay in the OS keyring.
+Non-secret settings live in a JSON file; keys and the uni login always stay in
+the OS keyring.
 
 - **Linux / macOS:** `~/.config/opencode-ufr/config.json` (state in
   `~/.local/state/opencode-ufr`, cache in `~/.cache/opencode-ufr`, data in
@@ -152,9 +170,14 @@ except `port`, which is written on first start):
 
 `port` is chosen once (preferred `47300`, next free port if taken) and then
 stays fixed across restarts. `poolPerHour: 0` disables the pool limiter.
-`transport.type: "direct"` never opens the tunnel; `"auto"` (the default)
-tunnels only when UFR is not reachable directly. `vpn.mode: "always"` tunnels
-every UFR call, useful behind firewalls that block the campus route.
+`transport.type: "direct"` never opens the tunnel.
+
+## Releases
+
+Releases are tag-driven: `scripts/release.sh 0.2.1` bumps, commits, tags and
+pushes; the workflow then verifies on Ubuntu, macOS and Windows, stages the
+package on npm (trusted publishing via OIDC — no stored tokens), and creates
+the GitHub release after a maintainer approves the staged version with 2FA.
 
 ## Model data
 

package/models.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "updated": "2026-09-28",
+  "updated": "2026-10-02",
   "defaults": {
     "context": 131072,
     "max_output": 16384
@@ -60,7 +60,11 @@
       "context": 256000
     },
     "qwen-3.5-397b-llmlb": {
-      "context": 262144
+      "context": 262144,
+      "price": {
+        "input": 0.1,
+        "output": 0.1
+      }
     },
     "qwen-3.6-27b-llmlb": {
       "context": 262144
@@ -122,7 +126,7 @@
       "vision": true
     },
     "ufr/reasoning-complex": {
-      "context": 262144,
+      "context": 1048576,
       "price": {
         "input": 0.1,
         "output": 0.1
@@ -135,7 +139,12 @@
       "context": 256000
     },
     "ufr/vision-complex": {
-      "context": 262144
+      "context": 1048576,
+      "vision": true,
+      "price": {
+        "input": 0.1,
+        "output": 0.1
+      }
     },
     "ufr/vision-fast": {
       "context": 131044
@@ -201,6 +210,15 @@
         "input": 0.3,
         "output": 0.9
       }
+    },
+    "deepseek-v4.1-flash-llmlb": {
+      "context": 1048576,
+      "vision": true,
+      "price": {
+        "input": 0.1,
+        "output": 0.1
+      },
+      "note": "context 1048576 probed live 2026-10-02 (vLLM ContextWindowExceededError named the limit); prices from the UFR portal (Lokale Modelle)"
     }
   }
 }

package/package.json

@@ -1,16 +1,44 @@
 {
   "name": "opencode-ufr",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Uni Freiburg (UFR) Open WebUI models in opencode — local gateway with key pool, UFR-aware rate limiting, circuit breaker and fallbacks",
   "license": "MIT",
   "type": "module",
   "main": "./src/plugin/index.ts",
-  "exports": { ".": "./src/plugin/index.ts" },
-  "bin": { "ufr": "bin/ufr.ts", "opencode-ufr": "bin/ufr.ts" },
-  "files": ["bin", "src", "models.json", "README.md", "LICENSE"],
-  "engines": { "bun": ">=1.3.0" },
-  "repository": { "type": "git", "url": "git+https://github.com/FinleyLaempe/opencode-ufr.git" },
-  "keywords": ["opencode", "opencode-plugin", "uni-freiburg", "open-webui"],
-  "scripts": { "test": "bun test", "typecheck": "tsc --noEmit", "prepublishOnly": "bun run typecheck && bun test" },
-  "devDependencies": { "@types/bun": "^1.3.0", "typescript": "^5.9.0" }
+  "exports": {
+    ".": "./src/plugin/index.ts"
+  },
+  "bin": {
+    "ufr": "bin/ufr.ts",
+    "opencode-ufr": "bin/ufr.ts"
+  },
+  "files": [
+    "bin",
+    "src",
+    "models.json",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "bun": ">=1.3.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/FinleyLaempe/opencode-ufr.git"
+  },
+  "keywords": [
+    "opencode",
+    "opencode-plugin",
+    "uni-freiburg",
+    "open-webui"
+  ],
+  "scripts": {
+    "test": "bun test",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "bun run typecheck && bun test"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.3.0",
+    "typescript": "^5.9.0"
+  }
 }

package/src/cli/catalog.ts

@@ -1,5 +1,5 @@
 import type { UfrModel } from "../daemon/catalog"
-import { BUNDLED_MODELS, loadModelsFile, loadUfrModels } from "../daemon/catalog-source"
+import { BUNDLED_MODELS, loadBundledModels, loadUfrModels } from "../daemon/catalog-source"
 import { loadConfig } from "../shared/config"
 import type { ModelsFile } from "../shared/models-file"
 import type { CliDeps } from "./index"
@@ -27,8 +27,7 @@ export async function cmdCatalogDiff(d: CliDeps): Promise<number> {
     return 1
   }
   const log = (m: string) => d.io.err(`${m}\n`)
-  const mf = await loadModelsFile({ url: cfg.catalog.url, cachePath: d.paths.modelsCache, etagPath: d.paths.modelsEtag,
-    bundledPath: BUNDLED_MODELS, fetch: d.fetch, log })
+  const mf = await loadBundledModels({ bundledPath: BUNDLED_MODELS })
   const ufr = await loadUfrModels({ baseUrl: cfg.upstream.baseUrl, key, cachePath: d.paths.ufrModelsCache, fetch: d.fetch, log })
   if (ufr.source !== "remote") {
     d.io.err(`cannot read UFR's live model list: ${ufr.error}\n`)

package/src/daemon/catalog-source.ts

@@ -1,48 +1,22 @@
 import { fileURLToPath } from "node:url"
-import { readJson, readText, writeFileAtomic } from "../shared/fs"
+import { readJson, writeFileAtomic } from "../shared/fs"
 import { type ModelsFile, validateModelsFile } from "../shared/models-file"
 import { VPN_MESSAGE, isVpnPage } from "../shared/vpn"
 import { type UfrModel, parseUfrModels } from "./catalog"
 
 export type FetchLike = (url: string, init?: RequestInit) => Promise<Response>
-export type ModelsSource = "remote" | "cache" | "bundled"
+export type ModelsSource = "bundled"
 
 export const BUNDLED_MODELS = fileURLToPath(new URL("../../models.json", import.meta.url))
 
-/** models.json: remote (ETag) → last good cache → copy shipped in the package. */
-export async function loadModelsFile(o: {
-  url: string
-  cachePath: string
-  etagPath: string
+/**
+ * The fixes file ships with the package (models.json in the release) — no
+ * remote pull. Model data updates arrive with plugin updates; UFR's live
+ * model list supplies everything else.
+ */
+export async function loadBundledModels(o: {
   bundledPath?: string
-  fetch: FetchLike
-  log: (m: string) => void
 }): Promise<{ file: ModelsFile; source: ModelsSource }> {
-  const cached = await readJson(o.cachePath)
-  const etag = cached ? (await readText(o.etagPath))?.trim() : undefined
-  try {
-    const res = await o.fetch(o.url, {
-      headers: etag ? { "If-None-Match": etag } : {},
-      signal: AbortSignal.timeout(15_000),
-    })
-    if (res.status === 304 && cached) return { file: validateModelsFile(cached), source: "remote" }
-    if (!res.ok) throw new Error(`HTTP ${res.status}`)
-    const text = await res.text()
-    const file = validateModelsFile(JSON.parse(text)) // validate before it can replace a good cache
-    await writeFileAtomic(o.cachePath, text)
-    const tag = res.headers.get("etag")
-    if (tag) await writeFileAtomic(o.etagPath, tag)
-    return { file, source: "remote" }
-  } catch (e) {
-    o.log(`models.json: remote copy unavailable or invalid (${(e as Error).message}) — using the ${cached ? "cached" : "bundled"} copy`)
-  }
-  if (cached) {
-    try {
-      return { file: validateModelsFile(cached), source: "cache" }
-    } catch (e) {
-      o.log(`models.json: cached copy invalid (${(e as Error).message})`)
-    }
-  }
   const bundled: unknown = JSON.parse(await Bun.file(o.bundledPath ?? BUNDLED_MODELS).text())
   return { file: validateModelsFile(bundled), source: "bundled" }
 }

package/src/daemon/catalog.ts

@@ -46,19 +46,23 @@ function toPrice(p: Price | undefined): ModelPrice | null {
   return { input: p.input, output: p.output, cacheRead: p.cache_read ?? p.input, cacheWrite: p.cache_write ?? p.input }
 }
 
-export function buildCatalog(ufr: UfrModel[], file: ModelsFile, opts: { allowPaid: boolean }): Catalog {
+export function buildCatalog(ufr: UfrModel[], file: ModelsFile, opts: { allowPaid: boolean; probes?: Record<string, { context: number; at: number }> }): Catalog {
   const warnings: string[] = []
   const exclude = new Set(file.exclude)
+  const probes = opts.probes ?? {}
   const models = new Map<string, Model>()
   for (const u of ufr) {
     const e = file.models[u.id]
+    // precedence: models.json entry (measured, ships with releases) > auto-probe > defaults
+    const probed = probes[u.id]?.context
+    const context = e?.context ?? probed ?? file.defaults.context
     models.set(u.id, {
       id: u.id,
       name: u.name,
       tier: u.tier,
       vision: e?.vision ?? u.vision,
       tools: e?.tools ?? true,
-      context: e?.context ?? file.defaults.context,
+      context,
       maxOutput: e?.max_output ?? file.defaults.max_output,
       price: toPrice(e?.price),
       hasEntry: e !== undefined,

package/src/daemon/daemon.ts

@@ -11,8 +11,11 @@ import { startOfLocalDay } from "../shared/time"
 import { VERSION } from "../shared/version"
 import { type BreakerState, BreakerRegistry } from "./breaker"
 import { type Catalog, EMPTY_CATALOG, buildCatalog, listModels } from "./catalog"
-import { type FetchLike, type ModelsSource, loadModelsFile, loadUfrModels } from "./catalog-source"
+import { type FetchLike, type ModelsSource, loadBundledModels, loadUfrModels } from "./catalog-source"
+import type { ModelsFile } from "../shared/models-file"
 import { type KeyInfo, KeyPool, type KeySnapshot } from "./keypool"
+import { loadProbes, probeContextLimit, saveProbe } from "./probe"
+import { type UfrModel } from "./catalog"
 import { Router } from "./router"
 import { startServer } from "./server"
 import { Stats } from "./stats"
@@ -58,6 +61,8 @@ export type DaemonOptions = {
   idleCheckMs?: number
   /** Backoff after UFR's model list failed to load (VPN down, UFR unreachable); the last delay repeats. */
   catalogRetryMs?: number[]
+  /** Auto-probe the context limit of unknown models (default: on). */
+  probes?: boolean
   onStopped?: () => void
 }
 
@@ -243,7 +248,7 @@ export async function startDaemon(o: DaemonOptions): Promise<RunningDaemon> {
     const timers: ReturnType<typeof setInterval>[] = []
     let stopping = false
     // UFR's model list failed (VPN not up yet, UFR unreachable): retry with backoff
-    // (60 s → 120 s → 300 s → 900 s, then every 900 s; no step longer than refreshHours)
+    // (60 s → 120 s → 300 s → 900 s, then every 900 s)
     // so connecting the VPN later needs no daemon restart.
     const retryMs = o.catalogRetryMs ?? [60_000, 120_000, 300_000, 900_000]
     let retryTimer: ReturnType<typeof setTimeout> | null = null
@@ -259,7 +264,7 @@ export async function startDaemon(o: DaemonOptions): Promise<RunningDaemon> {
     }
     const scheduleCatalogRetry = () => {
       if (stopping || retryTimer) return
-      const delay = Math.min(retryMs[Math.min(retries, retryMs.length - 1)]!, config.catalog.refreshHours * 3_600_000)
+      const delay = Math.min(retryMs[Math.min(retries, retryMs.length - 1)]!, 900_000)
       retries++
       retryTimer = setTimeout(() => {
         retryTimer = null
@@ -273,12 +278,50 @@ export async function startDaemon(o: DaemonOptions): Promise<RunningDaemon> {
     const reach: StatusJson["upstream"] = { ok: null, message: "", at: 0 }
     let catalog: Catalog = EMPTY_CATALOG
     let catalogInfo: Omit<StatusJson["catalog"], "models" | "warnings"> = { source: "none", ufrSource: "none", loadedAt: 0 }
+    let probeStore = loadProbes((k) => db.getKv(k))
+    let probing = false
+    /** Measure models UFR serves but models.json does not describe (one at a time, off the hot path). */
+    const scheduleProbes = async (ufrModels: UfrModel[], file: ModelsFile): Promise<void> => {
+      if (probing || keyInfos.length === 0 || o.probes === false) return
+      const unknown = ufrModels
+        .map((u) => u.id)
+        .filter((id) => file.models[id] === undefined && probeStore[id] === undefined)
+      if (unknown.length === 0) return
+      probing = true
+      try {
+        for (const id of unknown.slice(0, 2)) {
+          if (stopping) break
+          const result = await probeContextLimit({
+            model: id,
+            baseUrl: config.upstream.baseUrl,
+            key: keyInfos[0]!.secret,
+            transport,
+            log,
+          })
+          if (result) {
+            if (stopping) break
+            saveProbe(probeStore, id, result, (k, v) => {
+              if (stopping) return
+              try { db.setKv(k, v) } catch { /* db already closed */ }
+            })
+            log(`context probe ${id}: ${result.context} tokens (${result.how})`)
+          }
+        }
+        if (unknown.length > 0) {
+          const mf2 = await loadBundledModels({ bundledPath: o.bundledModelsPath })
+          catalog = buildCatalog(ufrModels, mf2.file, { allowPaid: config.allowPaid, probes: probeStore })
+          catalogInfo = { ...catalogInfo, loadedAt: now() }
+        }
+      } finally {
+        probing = false
+      }
+    }
     const refreshCatalog = async () => {
-      const mf = await loadModelsFile({ url: config.catalog.url, cachePath: p.modelsCache, etagPath: p.modelsEtag,
-        bundledPath: o.bundledModelsPath, fetch: f, log })
+      // fixes ship with the package; UFR's live list is fetched through the transport (vpn-aware)
+      const mf = await loadBundledModels({ bundledPath: o.bundledModelsPath })
       const ufr = await loadUfrModels({ baseUrl: config.upstream.baseUrl, key: keyInfos[0]?.secret ?? null,
         cachePath: p.ufrModelsCache, fetch: (u, i) => transport.fetch(u, i), log })
-      catalog = buildCatalog(ufr.models, mf.file, { allowPaid: config.allowPaid })
+      catalog = buildCatalog(ufr.models, mf.file, { allowPaid: config.allowPaid, probes: probeStore })
       catalogInfo = { source: mf.source, ufrSource: ufr.source, loadedAt: now() }
       if (ufr.error) Object.assign(reach, { ok: false, message: ufr.error, at: now() })
       else if (reach.ok !== true) Object.assign(reach, { ok: true, message: "", at: now() })
@@ -286,6 +329,7 @@ export async function startDaemon(o: DaemonOptions): Promise<RunningDaemon> {
       // Keys are read once at start: without one a retry can never succeed.
       if (ufr.error && keyInfos.length > 0) scheduleCatalogRetry()
       else clearCatalogRetry()
+      void scheduleProbes(ufr.models, mf.file).catch(() => {}) // must not outlive a shutdown
     }
     await refreshCatalog()
 
@@ -375,8 +419,9 @@ export async function startDaemon(o: DaemonOptions): Promise<RunningDaemon> {
     await writeFileAtomic(p.daemonFile, JSON.stringify({ port, pid: process.pid, version: VERSION, startedAt }) + "\n", 0o600)
 
     timers.push(setInterval(() => {
+      // pick up new UFR models periodically (the fixes file only changes with a plugin update)
       refreshCatalog().catch((e) => log(`catalog refresh failed: ${(e as Error).message}`))
-    }, config.catalog.refreshHours * 3_600_000))
+    }, 6 * 3_600_000))
     timers.push(setInterval(() => db.setKv("breakers", JSON.stringify(breakers.snapshot())), 30_000))
     timers.push(setInterval(() => db.prune(now() - 90 * 86_400_000), 86_400_000))
     if (o.exitOnIdle !== false) {

package/src/daemon/probe.ts

@@ -0,0 +1,113 @@
+/**
+ * Auto-probe for models UFR serves but models.json does not describe yet:
+ * one oversized request makes vLLM name its real context limit in the error
+ * ("This model's maximum context length is N tokens"). Results are stored in
+ * the stats DB and survive restarts — new models measure themselves, no
+ * patches needed.
+ */
+
+import type { FetchLike } from "./catalog-source"
+
+const LIMIT_RES = [
+  /context length is (\d+)/i,
+  /maximum context length[^\d]{0,40}(\d+)/i,
+  /context window[^\d]{0,30}(\d+)/i,
+]
+
+export function parseLimitFromBody(body: string): number | null {
+  for (const re of LIMIT_RES) {
+    const m = re.exec(body)
+    if (m) {
+      const n = Number(m[1])
+      if (Number.isFinite(n) && n >= 1024) return n
+    }
+  }
+  return null
+}
+
+/** Prompt filler: ~4.5 chars per token for prose-like text. */
+function fillerForTokens(tokens: number): string {
+  return "The quick brown fox jumps over the lazy dog. ".repeat(Math.ceil((tokens * 4.5) / 45))
+}
+
+export type ProbeResult = { context: number; how: "error-named" | "accepted-floor" } | null
+
+/**
+ * Ladder probe: sizes in tokens. The first error either names the limit
+ * (done) or marks the ceiling; the last success sets the floor.
+ */
+export async function probeContextLimit(o: {
+  model: string
+  baseUrl: string
+  key: string
+  transport: { name: string; fetch(url: string, init?: RequestInit): Promise<Response> }
+  sizes?: number[] // token counts to try, in order
+  log: (m: string) => void
+}): Promise<ProbeResult> {
+  const sizes = o.sizes ?? [300_000, 600_000, 1_048_000, 1_500_000]
+  let floor = 0
+  for (const tokens of sizes) {
+    const body = JSON.stringify({
+      model: o.model,
+      max_tokens: 1,
+      messages: [{ role: "user", content: fillerForTokens(tokens) + "\n\nReply with exactly: OK" }],
+    })
+    let res: Response
+    try {
+      res = await o.transport.fetch(`${o.baseUrl}/chat/completions`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${o.key}`, "Content-Type": "application/json" },
+        body,
+        signal: AbortSignal.timeout(180_000),
+        redirect: "manual",
+      })
+    } catch (e) {
+      o.log(`context probe ${o.model}: transport error at ${tokens} tokens (${(e as Error).message})`)
+      return floor > 0 ? { context: floor, how: "accepted-floor" } : null
+    }
+    if (res.ok) {
+      const j = (await res.json().catch(() => null)) as { usage?: { prompt_tokens?: number } } | null
+      floor = j?.usage?.prompt_tokens ?? tokens
+      continue // accepted: try the next rung
+    }
+    const text = await res.text().catch(() => "")
+    const named = parseLimitFromBody(text)
+    if (named) {
+      o.log(`context probe ${o.model}: the server names the limit: ${named} tokens`)
+      return { context: named, how: "error-named" }
+    }
+    if (res.status === 400 || res.status === 413) {
+      o.log(`context probe ${o.model}: rejected at ${tokens} tokens without naming a limit`)
+      return floor > 0 ? { context: floor, how: "accepted-floor" } : null
+    }
+    // rate limit / auth / anything else: not a context answer, retry later
+    o.log(`context probe ${o.model}: HTTP ${res.status} — will retry later`)
+    return null
+  }
+  return floor > 0 ? { context: floor, how: "accepted-floor" } : null
+}
+
+export const PROBE_KV_KEY = "ctxprobes"
+
+type ProbeStore = Record<string, { context: number; at: number }>
+
+export function loadProbes(getKv: (k: string) => string | null): ProbeStore {
+  try {
+    const raw = getKv(PROBE_KV_KEY)
+    const parsed = raw ? JSON.parse(raw) : null
+    return parsed && typeof parsed === "object" ? (parsed as ProbeStore) : {}
+  } catch {
+    return {}
+  }
+}
+
+export function saveProbe(
+  store: ProbeStore,
+  model: string,
+  result: ProbeResult,
+  setKv: (k: string, v: string) => void,
+): void {
+  if (!result) return
+  store[model] = { context: result.context, at: Date.now() }
+  setKv(PROBE_KV_KEY, JSON.stringify(store))
+}

package/src/daemon/vpn/tcp.ts

@@ -49,6 +49,8 @@ const DEFAULT_MSS = 1360 // fits a 1400-byte tunnel MTU with IP+TCP headers
 const DEFAULT_RTO_MS = 500
 const DEFAULT_MAX_RETRANSMITS = 6
 const RECV_WINDOW = 65535
+const CWND_START = 4 // segments in flight before the first ACK (slow start)
+const CWND_MAX = 64
 
 export function freshLocalPort(): number {
   return 32768 + Math.floor(Math.random() * 20000)
@@ -65,8 +67,11 @@ export class TcpConn {
   private rcvNext = 0 // next byte we expect from the peer (RCV.NXT)
   private peerWindow = 0
   private peerMss = 536
-  private outQueue: QueueEntry[] = []
+  private outQueue: QueueEntry[] = [] // not yet sent
+  private flightQueue: QueueEntry[] = [] // sent, not yet acked (retransmit source)
   private earlyQueue: Uint8Array[] = [] // application data written while syn-sent
+  private cwnd = CWND_START // congestion window in segments (slow start)
+  private dupAcks = 0
   private finQueued = false
   private finSent = false
   private closeFired = false
@@ -145,7 +150,7 @@ export class TcpConn {
   }
 
   get buffered(): number {
-    return this.outQueue.reduce((n, e) => n + e.bytes.length, 0)
+    return this.outQueue.reduce((n, e) => n + e.bytes.length, 0) + this.flightBytes()
   }
 
   // -- inbound -------------------------------------------------------------
@@ -219,7 +224,6 @@ export class TcpConn {
       return
     }
 
-    if (this.finQueued && !this.outQueue.some((e) => e.len > 0) && this.unacked === 0) this.maybeSendFin()
     this.flush()
   }
 
@@ -239,17 +243,16 @@ export class TcpConn {
     const seg: TcpSegment = { header, payload, options }
     const bytes = buildDatagram({ src: this.info.local, dst: this.info.remote, segment: seg })
     this.sendPkt(bytes)
-    if (queueLen > 0) this.outQueue.push({ seq: this.seq, len: queueLen, bytes })
+    if (queueLen > 0) this.flightQueue.push({ seq: this.seq, len: queueLen, bytes }) // sent: tracks in flight
   }
 
   private flush(): void {
-    let inFlight = this.unacked
+    let inFlight = this.flightBytes()
     let sent = false
+    const limit = Math.min(Math.max(this.peerWindow, 1), this.cwnd * this.effMss())
     while (this.outQueue.length > 0) {
       const e = this.outQueue[0]!
-      if (e.len > 0) break // SYN/FIN marker: only retransmits move it
-      const window = Math.max(this.peerWindow, 1)
-      if (inFlight + e.bytes.length > window) break
+      if (inFlight + e.bytes.length > limit) break
       const header = {
         srcPort: this.info.localPort,
         dstPort: this.info.remotePort,
@@ -262,15 +265,23 @@ export class TcpConn {
       this.sendPkt(buildDatagram({ src: this.info.local, dst: this.info.remote, segment: { header, payload: e.bytes } }))
       inFlight += e.bytes.length
       sent = true
-      this.outQueue.shift()
+      this.flightQueue.push(this.outQueue.shift()!)
     }
     if (sent) this.armRto()
     if (this.finQueued && this.buffered === 0) this.maybeSendFin()
     if (this.buffered === 0) this.events.onDrain?.(this)
   }
 
+  private effMss(): number {
+    return Math.min(this.peerMss, this.opts.mss ?? DEFAULT_MSS)
+  }
+
+  private flightBytes(): number {
+    return this.flightQueue.reduce((n, e) => n + e.bytes.length, 0)
+  }
+
   private maybeSendFin(): void {
-    if (this.finSent || this.outQueue.some((e) => e.len > 0)) return // FIN already in flight
+    if (this.finSent || this.flightQueue.some((e) => e.len > 0)) return // FIN already in flight
     this.finSent = true
     this.sendSegment({ flags: FIN | ACK }, new Uint8Array(0), 1)
     this.seq = (this.seq + 1) >>> 0
@@ -297,17 +308,29 @@ export class TcpConn {
     if (window > 0) this.peerWindow = window
     const unacked = this.unacked
     const newly = (ack - this.acked) >>> 0
-    if (newly === 0 || newly > unacked) return // stale or covering more than we sent
+    if (newly === 0 || newly > unacked) {
+      // duplicate ACK: the peer is missing something after `acked`
+      if (unacked > 0 && ++this.dupAcks >= 3) {
+        this.dupAcks = 0
+        this.cwnd = Math.max(Math.floor(this.cwnd / 2), CWND_START) // multiplicative decrease
+        const first = this.flightQueue[0]!
+        if (first) this.sendPkt(first.bytes) // fast retransmit, no RTO wait
+      }
+      return
+    }
+    this.dupAcks = 0
+    // slow start: one segment of window per acked segment, bounded by the peer window
+    this.cwnd = Math.min(Math.ceil(this.cwnd + newly / this.effMss()), CWND_MAX)
     this.acked = ack
     this.retransmits = 0
     this.rto = this.opts.rtoMs ?? DEFAULT_RTO_MS
-    // drop fully acknowledged queue entries
-    while (this.outQueue.length > 0) {
-      const e = this.outQueue[0]!
+    // drop fully acknowledged entries from the flight queue
+    while (this.flightQueue.length > 0) {
+      const e = this.flightQueue[0]!
       if ((e.seq + e.len) >>> 0 > ack || (e.len === 0 && e.seq + e.bytes.length > ack)) break
-      this.outQueue.shift()
+      this.flightQueue.shift()
     }
-    if (this.outQueue.length === 0 && this.unacked === 0) {
+    if (this.flightQueue.length === 0 && this.unacked === 0) {
       if (this.timer) { clearTimeout(this.timer); this.timer = null }
     }
     if (this.state === "fin-wait-1" && this.unacked === 0) this.state = "fin-wait-2"
@@ -335,8 +358,13 @@ export class TcpConn {
       return
     }
     this.rto = Math.min(this.rto * 2, 5_000)
-    const first = this.outQueue[0]!
-    this.sendPkt(first.bytes) // go-back-N: resend oldest unacked segment
+    this.cwnd = CWND_START // collapse the window: the burst was too much
+    this.dupAcks = 0
+    // true go-back-N: resend EVERY unacked segment, not just the first —
+    // a burst can lose several at once, one-per-RTO would never recover
+    for (const e of this.flightQueue) {
+      this.sendPkt(e.bytes)
+    }
     this.armRto()
   }
 

package/src/shared/config.ts

@@ -19,7 +19,6 @@ export type Config = {
   breaker: { tripThreshold: number; ladderS: number[]; probeTimeoutS: number }
   allowPaid: boolean
   dailyBudgetUsd: number
-  catalog: { url: string; refreshHours: number }
   idleShutdownMin: number
 }
 
@@ -44,7 +43,6 @@ export const DEFAULTS: Config = {
   breaker: { tripThreshold: 3, ladderS: [30, 120, 300, 900, 1800, 3600], probeTimeoutS: 120 },
   allowPaid: false,
   dailyBudgetUsd: 20,
-  catalog: { url: "https://raw.githubusercontent.com/FinleyLaempe/opencode-ufr/main/models.json", refreshHours: 6 },
   idleShutdownMin: 5,
 }
 
@@ -72,8 +70,6 @@ const RULES: Record<string, Rule> = {
   "breaker.probeTimeoutS": "int>=1",
   allowPaid: "bool",
   dailyBudgetUsd: "num>=0",
-  "catalog.url": "str",
-  "catalog.refreshHours": "int>=1",
   idleShutdownMin: "int>=1",
 }
 
@@ -88,7 +84,6 @@ const MAX: Record<string, number> = {
   "limits.poolMaxWaitS": 86_400,
   "breaker.ladderS": 86_400,
   "breaker.probeTimeoutS": 86_400,
-  "catalog.refreshHours": 168,
   idleShutdownMin: 1_440,
 }
 

package/src/shared/paths.ts

@@ -12,8 +12,6 @@ export type Paths = {
   lockFile: string
   logFile: string
   statsDb: string
-  modelsCache: string
-  modelsEtag: string
   ufrModelsCache: string
 }
 
@@ -55,8 +53,6 @@ export function resolvePaths(
     lockFile: join(stateDir, "daemon.lock"),
     logFile: join(stateDir, "daemon.log"),
     statsDb: join(dataDir, "stats.db"),
-    modelsCache: join(cacheDir, "models.json"),
-    modelsEtag: join(cacheDir, "models.etag"),
     ufrModelsCache: join(cacheDir, "ufr-models.json"),
   }
 }