pi-free 2.2.2 → 2.2.4

package/CHANGELOG.md

@@ -7,58 +7,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [2.2.2] - 2026-06-19
+## [2.2.4] - 2026-06-27
 
-### Refactored
+### Added
 
-- `config.ts`: Introduced `PROVIDER_META` table that pairs each
-  provider's ID, env-var prefix, and typed config key. `getProviderShowPaid`
-  now delegates to a generic `resolveShowPaidForProvider` resolver
-  instead of a 17-case switch. New `PROVIDER_OPENROUTER`, `PROVIDER_OPENCODE`,
-  and `PROVIDER_FASTROUTER` constants added to `constants.ts` and used
-  in the table (DRYKISS DRY/Architecture findings).
-- `index.ts`: Wrap dynamic built-in provider import in `try/catch`
-  with full error+stack logging to both `~/.pi/free.log` and stderr
-  (DRYKISS Resilience finding).
-- `providers/bai/bai.ts`: Improve startup-failure message to point users
-  at `~/.pi/free.log` and their API key (DRYKISS Resilience finding).
+- **OpenModel AI provider** — Anthropic-compatible LLM gateway at `api.openmodel.ai` (24 models). Merges the public `/web/v1/models` catalog (real per-token pricing via `price_multiplier`, supports flags, max tokens) with the authed `/v1/models` protocol list. Registers only messages-protocol models. The current **DeepSeek V4 Flash Free Event** is automatically detected: `deepseek-v4-flash` has `price_multiplier=0` → free via Route A (no hardcoding required). 6 free models surface under `free_only`: `deepseek-v4-flash` (1M context, MoE), plus 5 DashScope Qwen models whose catalog entries have no per-token pricing. Set `OPENMODEL_API_KEY` or add `openmodel_api_key` to `~/.pi/free.json`. Toggle with `/toggle-openmodel` ([#269](https://github.com/apmantza/pi-free/pull/269)).
 
-## [2.2.1] - 2026-06-19
+- `npm run smoke:openmodel` — Live end-to-end check for the OpenModel Anthropic-Messages wire format. Reads `OPENMODEL_API_KEY` from env or `~/.pi/free.json`; skips with exit 0 when neither is set, exits 1 on any non-200 or malformed response.
 
-### Security
+- **Kilo and Cline API key authentication** — Both providers now support direct API key auth alongside OAuth. Set `KILO_API_KEY` / `CLINE_API_KEY` (or `kilo_api_key` / `cline_api_key` in `~/.pi/free.json`) to skip the OAuth flow. When a key is configured, the provider registers without OAuth and uses the key for model fetching and chat requests ([#282](https://github.com/apmantza/pi-free/pull/282)).
+
+### Removed
+
+- **AgentRouter provider** — The `agentrouter.org` gateway is unreachable from Pi: its OpenAI-compatible path returns `unauthorized client detected` for every direct API client (Codex CLI only), and the Anthropic path returned the same error for every key we tested. The "free public-welfare" tier is therefore not accessible from this extension, so the provider has been removed. Files deleted: `providers/agentrouter/agentrouter.ts`, `tests/agentrouter.test.ts`. Cleaned up: `PROVIDER_AGENTROUTER` / `BASE_URL_AGENTROUTER` in `constants.ts`, the `agentrouter_api_key` and `agentrouter_show_paid` config fields, the `PROVIDER_META` entry, `getAgentrouterApiKey` / `getAgentrouterShowPaid`, the import + `UNIQUE_PROVIDERS` slot in `index.ts`, and the `agentrouter` entry in the `freemiumProviders` Set. The corresponding `### Added` entry for AgentRouter is also removed from this release.
 
-- `~/.pi/free.json` (which contains API keys for paid providers) is now
-  written and re-tightened with mode `0600` (owner read/write only) on
-  every startup and on every write. Previously the file was world-readable
-  on Unix. No-op on Windows. Closes DRYKISS finding.
+- **Naraya AI Router provider** — The `router.naraya.ai` gateway's `/v1/*` namespace is broken (observed 2026-06-23 and counting): every request returns HTTP 200 with `content-length: 0` and no `content-type` — nginx is responding with a default 200 but the upstream API is unreachable. The marketing website (`router.naraya.ai/`) is still up, so the failure mode is the `/v1/*` reverse-proxy backend specifically. No working API = no usable provider, so Naraya has been removed. Files deleted: `providers/naraya/naraya.ts`, `tests/naraya.test.ts`. Cleaned up: `PROVIDER_NARAYA` / `BASE_URL_NARAYA` in `constants.ts`, the `naraya_api_key` and `naraya_show_paid` config fields, the `PROVIDER_META` entry, `getNarayaApiKey` / `getNarayaShowPaid`, the import + `UNIQUE_PROVIDERS` slot in `index.ts`, and the `naraya` entry in the `freemiumProviders` Set. Orphaned `MODEL_VARIANTS` entries (`mistral-medium-3-5` → `mistral-medium-3.5`, `deepseek-v4-flash-naraya` → `deepseek-v4-flash-reasoning-high-effort`) in `provider-failover/benchmark-lookup.ts` were also removed.
 
 ### Fixed
 
-- Wrap quota monitoring and telemetry event handlers in `try/catch` so a
-  failed status-bar update or telemetry write can never break the agent
-  loop (DRYKISS resilience findings).
+- **OpenModel 404 (`route not found`)** — The shared `createReRegister` / `registerOpenAICompatible` / `createCtxReRegister` helpers in `provider-helper.ts` hardcoded `api: "openai-completions"` regardless of the provider's actual wire protocol. This silently forced OpenModel to POST to `/v1/chat/completions` even though it is an Anthropic-protocol gateway, returning `404 {"code":"NOT_FOUND","msg":"route not found"}` on every chat call. Added an optional `api` field on `OpenAICompatibleConfig` (default `"openai-completions"` for backward compatibility with the 17 existing callers) and threaded it through all three helpers. OpenModel now passes `api: "anthropic-messages"` so pi-ai dispatches to the Anthropic SDK and POSTs to `/v1/messages` correctly. New test file `tests/provider-helper-api-field.test.ts` pins the new behaviour (6 tests covering default, anthropic-messages, ctx variant, and header preservation). Live-verified end-to-end against `https://api.openmodel.ai/v1/messages` with a real `OPENMODEL_API_KEY` via `scripts/smoke-openmodel-wire-format.ts` — both non-streaming JSON (200 with Anthropic Messages shape) and streaming SSE (200 with `text/event-stream`, `event: message_start` + `event: content_block_start` + thinking deltas) work.
 
-## [2.2.0] - 2026-06-19
+(Removed: `mistral-medium-3-5` / `deepseek-v4-flash-naraya` CI matching fix and `mistral-medium-3-5` CI score fix entries — Naraya is gone, so the hyphen-form variants no longer need a benchmark lookup alias.)
 
-### Added
+### Verified clean (no fix needed)
 
-- **b.ai** provider (`api.b.ai/v1`) — OpenAI-compatible gateway with 29 models
-  (Claude Opus 4.x / Sonnet 4.x, GPT-5.x family, Gemini 3.x family, DeepSeek
-  V4 / V3.2, GLM-5.x, Kimi K2.5, Qwen 3.6-27B, MiniMax M3 / M2.7). Currently
-  advertises `MiniMax-M3` as a limited-time free promotional model; all
-  other models default to paid (visible by default). Static API key auth via
-  `BAI_API_KEY` env var or `bai_api_key` in `~/.pi/free.json`. New commands:
-  `/toggle-bai`.
+The following recent model IDs correctly miss `all-strategies-failed` because the benchmark DB genuinely has no entry for them — no fabricated scores added (pending the next `scripts/update-benchmarks.ts` run against the Artificial Analysis API):
 
-### Security
+- `minimax-m3` — latest MiniMax generation, not yet in benchmark DB
+- `claude-haiku-4-5` — Claude Haiku 4.5, not yet in benchmark DB
+- `qwen3.6-flash` — Qwen 3.6 Flash variant, not yet in benchmark DB
 
-- Bumped `@earendil-works/pi-ai`, `@earendil-works/pi-coding-agent`, and
-  `@earendil-works/pi-tui` to `^0.79.8` — resolves Dependabot advisories
-  #19 and #21 (high-severity protobufjs, ws, undici vulnerabilities in
-  `@earendil-works/pi-coding-agent`).
-- Bumped `typescript` devDep to `^6.0.3`.
-- Removed now-redundant `overrides` for `protobufjs` and `ws` (fixed
-  upstream).
+(Removed: `mistral-large (bare, from Naraya)` and `deepseek-3.2 (bare, from Naraya)` notes — Naraya is gone.)
 
 ## [2.1.1] - 2026-06-15