pi-free 2.0.7 → 2.0.9

package/CHANGELOG.md

@@ -5,6 +5,102 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Changed
+
+- **Package scope migration** — Updated all peer dependency imports from `@mariozechner/*` to `@earendil-works/*` (`pi-ai`, `pi-coding-agent`, `pi-tui`) to match the upstream scope rename in `@earendil-works/pi` v0.74.0.
+
+## [2.0.8] - 2026-05-07
+
+### Added
+
+- **Codestral provider** — Mistral's code-focused model via codestral.mistral.ai.
+  Free tier (Experiment plan): 2 req/min, 500K tokens/min, 1B tokens/month.
+  Uses pi's built-in Mistral SDK (`mistral-conversations` API type).
+
+- **LLM7.io provider** — OpenAI-compatible API gateway routing across
+  multiple providers (OpenAI, Mistral, Google, DeepSeek, etc.). Free tier:
+  default/fast selectors, 100 req/hr, 20 req/min.
+
+- **DeepInfra provider** — AI inference cloud with 100+ open-source models.
+  $5 one-time credit on signup (no credit card). Models fetched dynamically.
+  Shown as trial credit provider in `/free-providers`.
+
+- **SambaNova provider** — Fast inference on custom RDU hardware with
+  OpenAI-compatible API. All models accessible on free tier (no credit card):
+  20-480 RPM. Models include Llama 3.3 70B, DeepSeek-V3/R1, Llama 4 Maverick.
+  Shown as freemium provider in `/free-providers`.
+
+### Changed
+
+- **Codestral: fixed HTTP 422 error** — Switched API type from
+  `openai-completions` to `mistral-conversations`. The OpenAI completions
+  adapter was sending unrecognized fields (`stream_options`, `store`,
+  `max_completion_tokens`) that Mistral's API rejects with 422.
+
+### Fixed
+
+- **Toggle commands persist across sessions for all providers** — Providers using
+  `setupProvider` (zenmux, crofai, llm7, sambanova, deepinfra) were always
+  registering `freeModels` on startup, ignoring the persisted `show_paid` config.
+  Now each provider reads its config getter and registers the correct initial
+  model set. Fixes #149.
+
+### Security
+
+- **Log injection prevention** — `scripts/update-benchmarks.ts` sanitizes external
+  API data (CRLF stripping) before logging. Fixes SonarCloud S1075.
+
+### Reliability
+
+- **Prefer `String#replaceAll()` over `String#replace()`** — Replaced all 7 flagged
+  instances. Where regex is unnecessary (2/7), switched to string literal form.
+  Fixes SonarCloud S4144.
+
+### Added
+
+- **`agents.md`** — Codebase guide for AI agents covering architecture, patterns,
+  conventions, testing, and the Pi extension API.
+
+### Added
+
+- **Passive quota monitoring** — Extracts rate-limit headers from every
+  provider response via `after_provider_response` event (no extra API calls).
+  Tries 6 header format variants (`x-ratelimit-remaining`,
+  `ratelimit-remaining-requests-day`, etc.). Shows remaining quota in the
+  status bar with warning icons when ≤25% or ≤10%. Fixes #147.
+
+### Fixed
+
+- **Missing `g` flag on `replaceAll` regexps broke model filtering** —
+  `String.prototype.replaceAll()` requires a global RegExp; 20+ patterns in
+  `benchmark-lookup.ts` were missing it, causing a `TypeError` that prevented
+  models from appearing for providers like cline and kilo. Added `/g` flag to
+  all affected patterns. Fixes #151.
+
+### Changed
+
+- **Resolved ~280 SonarCloud issues across 21 files** — Bulk code-quality
+  cleanup including: stripping trailing zeros from `toFixed()` (S7748),
+  `global` → `globalThis` (S7764), `parseFloat` → `Number.parseFloat` (S7773),
+  naming unnamed async exports (S7726), `String.raw` for path strings (S7780),
+  top-level await over promise chains (S7785), re-export from source (S7763),
+  `.at(-1)` over `[length-1]` (S7755), `node:fs` protocol imports (S7772),
+  and logging user-controlled data sanitization (S5145). Fixes #148.
+
+### Security
+
+- **Bump `basic-ftp` 5.3.0 → 5.3.1** — Patches GHSA-rpmf-866q-6p89 (high
+  severity): malicious FTP server could cause client-side DoS via unbounded
+  multiline control response buffering. Fixes `npm audit` finding.
+
+### Refactored
+
+- **Extracted shared model-fetch helper** — `fetchOpenAICompatibleModels()`
+  in `lib/util.ts` eliminates ~120 lines of duplicated fetch→parse→map
+  boilerplate across CrofAI, DeepInfra, and SambaNova providers.
+
 ## [2.0.6] - 2026-05-02
 
 ### Security
@@ -61,7 +157,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - **Consistent `isFreeModel` helper with Route A/B logic** — Created a unified helper for free model detection that automatically detects whether a provider exposes pricing:
-
   - **Route A (pricing-exposed)**: Model is free if `cost === 0` OR `"free"` in name (OR logic)
   - **Route B (non-pricing-exposed)**: Model is free only if `"free"` in name
   - Dynamic detection: If ALL models have cost === 0, assumes pricing not exposed → uses Route B
@@ -123,7 +218,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - **Model matching debug logging** — Added `~/.pi/modelmatch.log` to diagnose which models get Coding Index scores and which don't:
-
   - Logs every matching attempt with provider, model ID, normalization strategy, and result
   - CSV-like format: `timestamp|provider|modelId|modelName|action|strategy|normalizedId|matchKey|codingIndex|details`
   - Provider-specific normalizers for better matching:
@@ -138,7 +232,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Enhanced benchmark lookup** — `enhanceModelNameWithCodingIndex()` now accepts optional `provider` parameter for provider-aware normalization
 
 - **Static 404 model blocklist for NVIDIA** — Probed all 136 models from `integrate.api.nvidia.com/v1/models` and identified 57 that return 404 "Function not found" on `/v1/chat/completions`. These are now hard-filtered so they never appear in the model selector:
-
   - Covers discontinued models (`databricks/dbrx-instruct`, `meta/codellama-70b`, `meta/llama2-70b`, `ibm/granite-*`, etc.)
   - Covers embedding-only models listed as chat-capable (`nvidia/nv-embed-v1`, `nvidia/nv-embedqa-*`, `snowflake/arctic-embed-l`, etc.)
   - Covers stale API catalog entries (`mistralai/mistral-large`, `mistralai/mistral-large-2-instruct`, `writer/palmyra-*`, etc.)
@@ -149,7 +242,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **`scripts/probe-nvidia.mjs`** — Standalone Node.js script to reproduce the probe. Reads `~/.pi/free.json` for the API key, batches 20 requests at a time with 10s timeout, and prints all broken model IDs for adding to the blocklist.
 
 - **Ollama Cloud 403 handling** — Same pattern as NVIDIA 404s for Ollama Cloud:
-
   - `OLLAMA_KNOWN_403_MODELS` blocklist for models that return 403 "access denied"
   - `/probe-ollama` command to test all models on-demand, auto-hide broken ones, and re-register
   - `scripts/probe-ollama.mjs` standalone script for blocklist maintenance
@@ -173,7 +265,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - **Cloudflare provider now fetches models dynamically** — Replaced static 19-model hardcoded list with live API fetch from `api.cloudflare.com/client/v4/accounts/{account_id}/ai/models`:
-
   - Automatically discovers all 30+ text generation models (was manually maintaining 19)
   - Smart filtering excludes embeddings, image generation, speech, translation, and vision-only models via regex patterns
   - Metadata inference from model IDs: detects vision (`vision`/`multimodal`), reasoning (`r1`/`thinking`/`qwq`), context windows, and estimated costs
@@ -201,7 +292,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - **OpenRouter moved to built-in toggle system** — OpenRouter is now handled by `lib/built-in-toggle.ts` alongside OpenCode for a unified approach:
-
   - Removed from `providers/dynamic-built-in/index.ts`
   - Eliminated duplicate toggle command registration logic
   - Consolidated toggle persistence with other built-in providers
@@ -233,7 +323,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Breaking Changes
 
 - **Removed Fireworks provider** — Fireworks is now a built-in Pi provider (added in pi 0.68.1), so the extension's Fireworks provider has been removed to avoid conflicts:
-
   - Deleted `providers/fireworks/fireworks.ts` and `tests/fireworks.test.ts`
   - Removed all Fireworks configuration options from `config.ts` (`fireworks_api_key`, `fireworks_show_paid`)
   - Users should now use Pi's built-in Fireworks support with `FIREWORKS_API_KEY`
@@ -256,7 +345,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Removed
 
 - **Removed paid model warning on selection** — Deleted the `model_select` event handler that showed:
-
   - `⚠️ Paid model selected (${model.id}). Use "/free off" to enable paid models.`
   - This warning was redundant since the global `/free` toggle and provider toggles already control model visibility
 
@@ -274,7 +362,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - **Cloudflare Workers AI provider** — New provider for Cloudflare's serverless GPU platform:
-
   - 50+ open-source models: Llama 4, Mistral Small 3.1, Qwen 2.5/3, DeepSeek R1, Gemma 4, Kimi K2.5/2.6, and more
   - **10,000 Neurons/day FREE tier** (resets daily at 00:00 UTC)
   - **$0.011 per 1,000 Neurons** beyond free allocation
@@ -283,7 +370,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Create token at https://dash.cloudflare.com/profile/api-tokens
 
 - **Unified dynamic built-in providers module** — New `providers/dynamic-built-in/` module that dynamically fetches models from Pi's built-in providers when users have API keys:
-
   - **Mistral** (`MISTRAL_API_KEY`) — Fetches from `api.mistral.ai/v1/models`
   - **Groq** (`GROQ_API_KEY`) — Fetches from `api.groq.com/openai/v1/models`
   - **Cerebras** (`CEREBRAS_API_KEY`) — Fetches from `api.cerebras.ai/v1/models`