feat(nscale): accept NSCALE_TOKEN, and read ~/.env so it is found

Nscale has been empty in the published data since it was added — its
catalog is only reachable through the authenticated API, and the key was
never available to the fetcher. Two reasons, both fixed here.

The variable name: Nscale's console issues the credential as NSCALE_TOKEN,
while the fetcher only looked for NSCALE_API_KEY. Both are now accepted,
the alias kept so any existing setup or CI secret of that name still works,
and the health check's keyEnv now takes a list so "any one of these" counts
as present rather than reporting a false SKIP.

The location: load-env only read the project .env and ../AIToolkit/.env,
so a credential shared across projects in ~/.env was invisible. It now
reads every candidate that exists — project, AIToolkit, then home —
instead of only the first one found, so a key present solely in the home
file is picked up even when a project .env exists for other keys. Earlier
files still win, a variable already set in the real environment is never
overwritten, and `export FOO=` lines now parse.

Result: Nscale contributes 22 models and the health check is green across
the board for the first time (15 passed, 0 failed, 0 skipped).

NSCALE_TOKEN is wired into both workflows alongside the existing alias; the
repository secret still has to be added for CI to populate it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/healthcheck.yml

@@ -34,6 +34,7 @@ jobs:
       - run: npm install
       - name: Run fetcher health check
         env:
+          NSCALE_TOKEN: ${{ secrets.NSCALE_TOKEN }}
           NSCALE_API_KEY: ${{ secrets.NSCALE_API_KEY }}
           GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
         run: node scripts/healthcheck.js

.github/workflows/update-providers.yml

@@ -29,6 +29,7 @@ jobs:
         env:
           REQUESTY_API_KEY: ${{ secrets.REQUESTY_API_KEY }}
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          NSCALE_TOKEN: ${{ secrets.NSCALE_TOKEN }}
           NSCALE_API_KEY: ${{ secrets.NSCALE_API_KEY }}
           GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
         run: node scripts/fetch-providers.js

README.md

@@ -25,7 +25,7 @@ Compare pricing, capabilities, and benchmark scores across LLM providers — wit
 | Scaleway | EU 🇫🇷 | GDPR-compliant |
 | OVHcloud | EU 🇫🇷 | GDPR-compliant, sovereign, pay-per-token |
 | STACKIT | EU 🇩🇪 | Schwarz Group, fully sovereign (no US hyperscaler) |
-| Nscale | EEA 🇬🇧/🇳🇴 | UK HQ, EEA (Norway) hosting, pay-per-token — **needs `NSCALE_API_KEY` or stays empty** |
+| Nscale | EEA 🇬🇧/🇳🇴 | UK HQ, EEA (Norway) hosting, pay-per-token — **needs `NSCALE_TOKEN` or stays empty** |
 | EUrouter | EU 🇳🇱 | EUrouter B.V., Amsterdam; EU-only sub-processors. Routes across EU providers — but see the caveat below |
 | HostYourAI | EU 🇳🇱 | HostYourAI B.V.; open models on EU GPUs via vLLM, DPA + EU Sovereignty Mode |
 | Mistral AI | EU 🇫🇷 | GDPR-compliant |
@@ -100,7 +100,7 @@ npm run fetch:mistral       # Mistral AI
 npm run fetch:scaleway      # Scaleway
 npm run fetch:ovhcloud      # OVHcloud
 npm run fetch:stackit       # STACKIT
-npm run fetch:nscale        # Nscale (needs NSCALE_API_KEY)
+npm run fetch:nscale        # Nscale (needs NSCALE_TOKEN)
 npm run fetch:langdock      # Langdock
 npm run fetch:groq          # Groq
 npm run fetch:ionos         # IONOS
@@ -134,17 +134,22 @@ is fetched from a public, keyless source, so a clone with no `.env` at all
 still populates almost the whole table:
 
 ```
-NSCALE_API_KEY=...         # REQUIRED for Nscale — its catalog is only behind
-                           #   the API, so without this Nscale stays empty
+NSCALE_TOKEN=...           # REQUIRED for Nscale — its catalog is only behind
+                           #   the API, so without this Nscale stays empty.
+                           #   NSCALE_API_KEY is accepted as an alias
 OPENROUTER_API_KEY=...     # optional; unlocks the full catalog vs public subset
 GROQ_API_KEY=...           # optional; adds context windows to Groq models
 REQUESTY_API_KEY=...       # optional; Requesty currently returns its catalog
                            #   publicly, so this is not needed today
 ```
 
-Place in `.env` in the project root or `../AIToolkit/.env`. In CI they are read
-from repository secrets of the same name; a missing secret makes that fetcher
-skip rather than fail, so forks work without any.
+Loaded from `.env` in the project root, then `../AIToolkit/.env`, then `~/.env`
+— every one of those that exists is read, earlier files winning, so a
+credential shared across projects can live in the home file alone. A variable
+already set in the real environment is never overwritten.
+
+In CI they come from repository secrets of the same name. A missing secret
+makes that fetcher skip rather than fail, so forks work without any.
 
 ## Deployment
 

scripts/healthcheck.js

@@ -20,14 +20,15 @@
  */
 
 const path = require('path');
-// Load local .env (project or ../AIToolkit) so keyed-provider detection is
-// deterministic before we probe process.env. No-op in CI (uses real secrets).
+// Load local .env (project, ../AIToolkit, then ~/.env) so keyed-provider
+// detection is deterministic before we probe process.env. No-op in CI.
 require('./load-env').loadEnv();
 
 // key: provider module under scripts/providers/
 // min: lowest model count we still consider healthy (set well below the live
 //      count so normal catalog churn never trips it, but a broken scraper does)
-// keyEnv: env var required to reach the source (null = public scrape)
+// keyEnv: env var(s) required to reach the source (null = public scrape).
+//         An array means any one of them is enough.
 const CHECKS = [
   { key: 'scaleway',          min: 8,   keyEnv: null },
   { key: 'ovhcloud',          min: 10,  keyEnv: null },
@@ -39,7 +40,7 @@ const CHECKS = [
   { key: 'ionos',             min: 5,   keyEnv: null },
   { key: 'black-forest-labs', min: 6,   keyEnv: null },
   { key: 'nebius',            min: 10,  keyEnv: null },
-  { key: 'nscale',            min: 5,   keyEnv: 'NSCALE_API_KEY' },
+  { key: 'nscale',            min: 5,   keyEnv: ['NSCALE_TOKEN', 'NSCALE_API_KEY'] },
   { key: 'eurouter',          min: 80,  keyEnv: null },
   { key: 'hostyourai',        min: 15,  keyEnv: null },
   { key: 'requesty',          min: 40,  keyEnv: null },
@@ -69,8 +70,9 @@ async function main() {
     const { key, min, keyEnv } = check;
     let providerName = key;
 
-    if (keyEnv && !process.env[keyEnv]) {
-      results.push({ key, providerName, status: 'SKIP', count: null, note: `no ${keyEnv}` });
+    const keyEnvs = keyEnv == null ? [] : (Array.isArray(keyEnv) ? keyEnv : [keyEnv]);
+    if (keyEnvs.length && !keyEnvs.some((k) => process.env[k])) {
+      results.push({ key, providerName, status: 'SKIP', count: null, note: `no ${keyEnvs.join(' / ')}` });
       continue;
     }
 

scripts/load-env.js

@@ -2,27 +2,35 @@
 
 /**
  * Shared environment loader.
- * Checks local project .env first, then ../AIToolkit/.env as a fallback.
- * Only sets variables that are not already present in process.env.
+ *
+ * Reads, in order of precedence: the project .env, then ../AIToolkit/.env,
+ * then ~/.env for credentials shared across projects on the same machine.
+ * Every existing file is read rather than only the first one found, so a key
+ * that lives only in the home file is still picked up when a project .env
+ * exists for other keys. Earlier files win, and a variable already set in
+ * the real environment (as in CI) is never overwritten.
  */
 
 const fs   = require('fs');
+const os   = require('os');
 const path = require('path');
 
 function loadEnv() {
   const candidates = [
     path.join(__dirname, '..', '.env'),
     path.join(__dirname, '..', '..', 'AIToolkit', '.env'),
+    path.join(os.homedir(), '.env'),
   ];
-  const envPath = candidates.find((p) => fs.existsSync(p));
-  if (!envPath) return;
 
-  const content = fs.readFileSync(envPath, 'utf8');
-  for (const line of content.split('\n')) {
-    const m = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
-    if (m && process.env[m[1]] === undefined) {
-      // Strip optional surrounding quotes
-      process.env[m[1]] = m[2].trim().replace(/^(['"])(.*)\1$/, '$2');
+  for (const envPath of candidates) {
+    if (!fs.existsSync(envPath)) continue;
+    const content = fs.readFileSync(envPath, 'utf8');
+    for (const line of content.split('\n')) {
+      const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/);
+      if (m && process.env[m[1]] === undefined) {
+        // Strip optional surrounding quotes
+        process.env[m[1]] = m[2].trim().replace(/^(['"])(.*)\1$/, '$2');
+      }
     }
   }
 }

scripts/providers/nscale.js

@@ -13,8 +13,8 @@
  * output). The endpoint carries no type/capability fields, so those are
  * derived from the model id (as the Requesty/Scaleway fetchers do).
  *
- * Requires NSCALE_API_KEY (local ../AIToolkit/.env or a CI secret). Without it
- * the fetcher skips and the provider keeps its existing data.
+ * Requires NSCALE_TOKEN (or NSCALE_API_KEY) from a local .env or a CI secret.
+ * Without it the fetcher skips and the provider keeps its existing data.
  */
 
 const { loadEnv } = require('../load-env');
@@ -23,7 +23,10 @@ const { getJson } = require('../fetch-utils');
 
 const API_URL = 'https://inference.api.nscale.com/v1/models';
 
-const loadApiKey = () => process.env.NSCALE_API_KEY || null;
+// NSCALE_TOKEN is the name Nscale's own console hands out (and what the shared
+// .env uses); NSCALE_API_KEY is kept as an alias so existing setups and the CI
+// secret of that name keep working.
+const loadApiKey = () => process.env.NSCALE_API_KEY || process.env.NSCALE_TOKEN || null;
 
 const EMBED_KEYWORDS = ['embed', 'bge', 'gte', 'e5-', 'stella', 'arctic-embed', 'nomic-embed'];
 const IMAGE_KEYWORDS = ['flux', 'stable-diffusion', 'sdxl', 'sd3', 'text-to-image'];
@@ -56,7 +59,7 @@ function classify(id) {
 async function fetchNscale() {
   const apiKey = loadApiKey();
   if (!apiKey) {
-    console.warn('  (no NSCALE_API_KEY found – skipping Nscale)');
+    console.warn('  (no NSCALE_TOKEN / NSCALE_API_KEY found – skipping Nscale)');
     return [];
   }