Commit History
-
fix: quality pack — crypto guard, session hash, idempotency test, integration tightening, comments (#26)
Five remaining items from the May 2026 audit: #15: Tightened integration test catalog count from >=14 to >=50 — current catalog post-V9 is 60+ rows. Loose threshold would silently miss a future migration that drops a chunk. #17: Added migration-idempotency test (server/src/__tests__/db/idempotency.test.ts): - initDb -> close -> initDb on the same file produces identical row counts. - Every catalog row has exactly one fallback_config entry. - UNIQUE(platform, model_id) holds — no duplicate rows. - Every enabled platform has a registered provider. #19: crypto.ts now validates ENCRYPTION_KEY length and hex-format at init time. A typo'd key like 'abc' previously fell through and only failed on the first encrypt() with a cryptic node:crypto error. Now throws fast with an actionable message including the command to generate a valid key. Same validation applies to the DB-persisted key path. New test file crypto-init.test.ts covers all paths (valid, too-short, too-long, non-hex env key; cor…5bd27b4 -
chore: remove dead provider classes + fix orphan test fixtures + gitignore .bak (#25)
Janitorial cleanup from the May 2026 audit: 1. Deleted server/src/providers/groq.ts and cerebras.ts (and their tests). Both were unreachable code: providers/index.ts has registered Groq and Cerebras via the generic OpenAICompatProvider since at least V4. The dedicated subclasses were only instantiated by their own tests. 2. Updated openai-compat.test.ts platform-instance fixture: - Dropped 'fireworks' row — Fireworks AI was never a registered platform. Test was passing only because of an 'as any' cast that silenced the Platform type error. - Updated 'github' baseUrl from the legacy 'models.inference.ai.azure.com' to the current 'models.github.ai/inference' (matches the actual registration after PR #18). - Added rows for 'groq', 'cerebras', and 'zhipu' so the fixture mirrors the live provider registry. Future drift between fixture and live registry will fail loudly. 3. Added '*.bak' to .gitignore — '*.db' covers freeapi.db.bak today …3ed467e -
fix(catalog): 400 on explicit unknown/disabled model + sync docs (#24)
Two cleanups from the May 2026 audit: 1. /v1/chat/completions — when the request includes an explicit `model` field that doesn't resolve to an enabled catalog row, return 400 instead of silently auto-routing to a totally different model. The silent fallthrough surprised playground users who 'forced' a disabled model and got something unrelated back without a signal. Behavior: - model omitted → auto-route via fallback (unchanged). - model matches enabled row → pin to it (unchanged). - model matches disabled row → 400 with reason 'is disabled'. - model not in catalog at all → 400 with reason 'is not in the catalog'. Both 400s carry error.code = 'model_not_found'. 2. docs/index.html stale references — removed the Hugging Face provider card (HF was dropped from the catalog in V4), updated provider count from 12 → 11 across meta description, OG description, Twitter card, hero badge, and tokens-stat sub. Removed the orphan logos/huggingface.svg. Ve…6e7fba5 -
fix: critical fix-pack (auth bypass, health, dead providers, response normalization, SSE errors) (#23)
Six related fixes from the recent codebase audit: 1. Auth bypass on /v1/chat/completions — guard was 'if (authHeader && !isLocal)' so any non-local caller that simply omitted the Authorization header skipped the check entirely. Server binds 0.0.0.0; this exposed the proxy to any LAN peer. Fix: 'if (!isLocal)' always require a valid Bearer for non-local. 2. Health-check auto-disable conflated network errors with bad keys. Three transient timeouts (15 min) silently flipped enabled=0 on perfectly valid keys (burned us this session). Fix: - validateKey() in OpenAICompatProvider/google/cohere/cloudflare no longer swallows transport errors — they propagate. - health.ts catch branch sets status='error' but does NOT increment the consecutive-failure counter. Only confirmed 401/403 (validateKey returns false) counts toward auto-disable. 3. Removed Hugging Face / Moonshot / MiniMax direct integrations from the live surface (PLATFORMS allowlist, providers…e238ae0
-
feat(catalog): migrateModelsV6 — probe-verified additions and Google RPD fix (#6)
Live-probed against real free-tier keys on 2026-04-25. Adds 8 models that returned 200 with content, drops the one OR :free route that 404s, and corrects two Google rate-limits whose catalog values were ~10x-50x too high. Adds: - Cloudflare: @cf/moonshotai/kimi-k2.5, @cf/qwen/qwen3-30b-a3b-fp8, @cf/deepseek-ai/deepseek-r1-distill-qwen-32b - Google preview: gemini-3-flash-preview, gemini-3.1-flash-lite-preview, gemini-3.1-pro-preview (Pro confirmed free-tier-eligible by the free_tier_requests quota metric in 429 errors) - OpenRouter: google/gemma-4-31b-it:free, liquid/lfm-2.5-1.2b-instruct:free Removes: - openrouter/arcee-ai/trinity-large-preview:free (404 No endpoints found) Corrects: - gemini-2.5-flash and gemini-2.5-flash-lite RPD 250/1000 -> 20. Free tier now uniformly enforces 20 RPD per model per project. Updates router test rationale: gemini-3.1-pro-preview at rank 1 now outranks Groq's gpt-oss-120b (rank 6) when keys exist for both.65b9912
-
fix(cloudflare): normalize null content to empty string for tool round-trips
Cloudflare's OpenAI-compat endpoint rejects assistant messages with content: null, even when tool_calls are present (standard OpenAI format). Added normalizeMessages() that converts null content to "" before dispatch, plus a regression test covering the null-content + tool_calls case. Also credits @moaaz12-web in README Contributors for the tool-calling PR.3d5321a -
feat: tool-calling support across providers (#3)
Moaaz Siddiquidf9abb6 -
Live-probed each tier; culled the silent tools.
Kimi, Gemma, M1, HF depart the stage, DeepSeek, Maverick, Ling, and GPT-OSS engage. Twenty-two new rows, four fade from view — Agentic rank reshapes what falls through.5e3f39f
-
Initial release of FreeLLMAPI
Self-hosted OpenAI-compatible proxy that aggregates the free tiers of fourteen LLM providers — Google, Groq, Cerebras, SambaNova, NVIDIA, Mistral, OpenRouter, GitHub Models, Hugging Face, Cohere, Cloudflare, Zhipu, Moonshot, MiniMax — behind a single /v1/chat/completions endpoint. Server: - Express + SQLite, per-provider adapters with streaming and non-streaming support, automatic fallover on 429/5xx, per-key RPM/RPD/TPM/TPD tracking, sticky sessions for multi-turn, AES-256-GCM encrypted key storage, unified bearer-token auth, periodic health checks. Client: - React + Vite + shadcn/ui admin dashboard: keys, fallback chain (drag to reorder, color-coded per-provider monthly token budget), playground, analytics with per-provider breakdowns. Tooling: - GitHub Actions CI (server tests + client build), MIT license, README with provider-by-provider ToS review. For personal experimentation, not production.2777a84