pi-free 2.1.1 → 2.2.1

package/CHANGELOG.md

@@ -7,6 +7,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.2.1] - 2026-06-19
+
+### Security
+
+- `~/.pi/free.json` (which contains API keys for paid providers) is now
+  written and re-tightened with mode `0600` (owner read/write only) on
+  every startup and on every write. Previously the file was world-readable
+  on Unix. No-op on Windows. Closes DRYKISS finding.
+
+### Fixed
+
+- Wrap quota monitoring and telemetry event handlers in `try/catch` so a
+  failed status-bar update or telemetry write can never break the agent
+  loop (DRYKISS resilience findings).
+
+## [2.2.0] - 2026-06-19
+
+### Added
+
+- **b.ai** provider (`api.b.ai/v1`) — OpenAI-compatible gateway with 29 models
+  (Claude Opus 4.x / Sonnet 4.x, GPT-5.x family, Gemini 3.x family, DeepSeek
+  V4 / V3.2, GLM-5.x, Kimi K2.5, Qwen 3.6-27B, MiniMax M3 / M2.7). Currently
+  advertises `MiniMax-M3` as a limited-time free promotional model; all
+  other models default to paid (visible by default). Static API key auth via
+  `BAI_API_KEY` env var or `bai_api_key` in `~/.pi/free.json`. New commands:
+  `/toggle-bai`.
+
+### Security
+
+- Bumped `@earendil-works/pi-ai`, `@earendil-works/pi-coding-agent`, and
+  `@earendil-works/pi-tui` to `^0.79.8` — resolves Dependabot advisories
+  #19 and #21 (high-severity protobufjs, ws, undici vulnerabilities in
+  `@earendil-works/pi-coding-agent`).
+- Bumped `typescript` devDep to `^6.0.3`.
+- Removed now-redundant `overrides` for `protobufjs` and `ws` (fixed
+  upstream).
+
 ## [2.1.1] - 2026-06-15
 
 ### Fixed

package/README.md

@@ -14,7 +14,7 @@ Free and paid AI model providers for [Pi](https://pi.dev). Access **free and pai
 
 When you install pi-free, it:
 
-1. **Registers free-tier providers** with Pi's model picker — Kilo (free), Cline (free), LLM7 (free), TokenRouter (1 free model), ZenMux (paid), CrofAI (paid), Ollama Cloud (freemium), SambaNova (freemium), Codestral (freemium), DeepInfra (trial credit), Together AI (trial credit), Novita (paid), Routeway (paid), and more
+1. **Registers free-tier providers** with Pi's model picker — Kilo (free), Cline (free), LLM7 (free), TokenRouter (1 free model), ZenMux (paid), CrofAI (paid), b.ai (paid, 1 free promo model), Ollama Cloud (freemium), SambaNova (freemium), Codestral (freemium), DeepInfra (trial credit), Together AI (trial credit), Novita (paid), Routeway (paid), and more
 
 2. **Captures Pi's built-in OpenCode and OpenRouter providers** with a free/paid toggle — OpenCode and OpenRouter are now built into Pi; pi-free adds `/toggle-opencode` and `/toggle-openrouter` so you can switch between free-only and all models without restart
 
@@ -341,7 +341,7 @@ Codestral is Mistral's code-focused model via `codestral.mistral.ai`:
 
 - Free tier (Experiment plan): 2 req/min, 500K tokens/min, 1B tokens/month
 - No credit card — phone verification only
-- Sign up at https://console.mistral.ai/codestral
+- Sign up at <https://console.mistral.ai/codestral>
 
 ```bash
 export CODESTRAL_API_KEY="..."
@@ -363,7 +363,7 @@ LLM7 routes across multiple providers through a single OpenAI-compatible endpoin
 
 - Free tier: default/fast selectors, 100 req/hr, 20 req/min
 - No credit card required
-- Get free token at https://token.llm7.io/
+- Get free token at <https://token.llm7.io/>
 
 ```bash
 export LLM7_API_KEY="..."
@@ -404,6 +404,34 @@ Fast inference on custom RDU hardware:
 export SAMBANOVA_API_KEY="..."
 ```
 
+### b.ai (paid gateway with 1 free promo model)
+
+OpenAI-compatible gateway at `api.b.ai/v1` providing access to 29 frontier models:
+
+- **Anthropic**: Claude Opus 4.5–4.8, Claude Sonnet 4.5–4.6, Claude Haiku 4.5
+- **OpenAI**: GPT-5.5, GPT-5.5 Instant, GPT-5.4, GPT-5.4 Pro/Mini/Nano, GPT-5.2, GPT-5 Mini/Nano
+- **Google**: Gemini 3.1 Pro, Gemini 3 Flash, Gemini 3.5 Flash
+- **DeepSeek**: V4 Pro, V4 Flash, V3.2
+- **GLM**: GLM-5.x family
+- **Other**: Kimi K2.5, Qwen 3.6-27B, MiniMax M3 / M2.7
+
+Currently advertises `MiniMax-M3` as a limited-time free promotional model. All other models are paid — they're visible by default (toggle with `/toggle-bai` to show free-only).
+
+```bash
+export BAI_API_KEY="sk-..."
+```
+
+Or add to `~/.pi/free.json`:
+
+```json
+{
+  "bai_api_key": "sk-...",
+  "bai_show_paid": true
+}
+```
+
+Get a key at <https://b.ai/>.
+
 ---
 
 ## Slash Commands
@@ -426,6 +454,7 @@ Each provider has toggle commands to switch between free and all models:
 | `/toggle-deepinfra`     | Toggle DeepInfra (💳 trial credit)                       |
 | `/toggle-together`      | Toggle Together AI (💳 trial credit)                     |
 | `/toggle-sambanova`     | Toggle SambaNova (🔄 freemium)                           |
+| `/toggle-bai`           | Toggle b.ai (💳 paid — 1 free promo model)                |
 | `/toggle-llm7`          | Toggle LLM7 (✅ free gateway)                            |
 | `/toggle-zenmux`        | Toggle ZenMux (💳 paid)                                  |
 | `/toggle-crofai`        | Toggle CrofAI (💳 paid)                                  |
@@ -443,7 +472,6 @@ Each provider has toggle commands to switch between free and all models:
 - **For 🔧 dynamic API providers**: Filters the model list when you have an API key configured
 - **Persists your preference** to `~/.pi/free.json` for next startup
 
-
 ### Probe Commands (Health Check)
 
 Test models for errors and auto-hide broken ones:

package/banner.svg

@@ -96,7 +96,7 @@
     <text x="20" y="70" font-family="system-ui, sans-serif" font-size="11" fill="#8b9aaa">Ollama Cloud · SambaNova</text>
     <text x="20" y="90" font-family="system-ui, sans-serif" font-size="11" fill="#8b9aaa">Codestral · LLM7 · Novita</text>
     <text x="20" y="110" font-family="system-ui, sans-serif" font-size="11" fill="#8b9aaa">ZenMux · CrofAI · DeepInfra</text>
-    <text x="20" y="130" font-family="system-ui, sans-serif" font-size="11" fill="#8b9aaa">Together · TokenRouter · FastRouter</text>
+    <text x="20" y="130" font-family="system-ui, sans-serif" font-size="11" fill="#8b9aaa">Together · TokenRouter · b.ai</text>
   </g>
 
   <g transform="translate(970, 55)">