Desktop

• The dashboard window never shows a sign-in form any more. The desktop app runs as a hidden local account with a random password nobody knows. Whenever its session was rejected, after a month of uptime or a stray 401, the window fell through to the web login form, which nobody could fill in, and guessing at it tripped the 15-minute lockout. The window now asks the app for a fresh session and carries on. If that ever fails it says so and asks you to quit and reopen. Browsers reaching a desktop or self-hosted server keep the normal login. (#1171)
• Password reset copy tells the truth. The reset form now says the code is written to the server log and is never emailed, with a Docker hint, in all 60 dashboard languages. The lockout message says how long to wait and that a restart clears it. (#1171)

Providers

• ElectronHub and Experiential Labs join the router with first-class adapters: key validation against the authenticated account endpoint, shared-quota grouping, dashboard entries, and detection of proxy error banners that arrive inside HTTP 200 responses, including split streaming chunks. Model rows come from the live catalog as usual. (#1169)

Routing

• Cooldown ceiling. A new routing setting caps the router's own bench guesses (the 2 min / 10 min / 1 h / 24 h escalation ladder and the day-long 402/403 benches) so a few relay-style failures cannot park a whole pool for a day. Provider-stated retry times are never shortened. Fallback page → routing options → "Longest automatic cooldown". (#1166, fixes #952)
• Router pressure "Clear all". One button drops every penalty, cooldown and bench at once instead of one key at a time. (#1166, addresses #1049)

Docs

• Per-language docs tree under docs/en and docs/zh-cn, the four remaining Chinese stubs translated, and a sweep of stale link texts and changelog hashes. (#1138, #1167, #1168)
• README credits @qatcod, @CooperSheroy and @shahidbeig-a11y. (#1165)

Full changelog: v0.9.7...v0.9.8

⭐ Like the free router? Go Premium — the live signed catalog, $19/yr, cancel anytime.

Desktop

• The app now shows in the Dock. Until now the menu-bar icon was the only sign FreeLLMAPI was running, which is a weak signal normally and no signal when macOS 26 hides the icon or a notched display clips it. A new Show in Dock checkbox in the tray menu turns it off again for the menu-bar-only look; either way applies live, no relaunch. Clicking the Dock icon opens the dashboard. (#1151, #1153)
• Signing in to the dashboard from a browser works on desktop installs. The hidden account the app creates is desktop@localhost, and the login form rejected that address before checking the password, so no desktop user could ever sign in. Login now matches the address instead of validating its shape. Signup is unchanged. (#1152)

Release pipeline

• macOS installers sign again on GitHub's current macos-26 runner image, and installers are attached to the release directly with gh rather than through a third-party action. (#1148, #1149, #1150)

Full changelog: v0.9.6...v0.9.7

⭐ Like the free router? Go Premium — the live signed catalog, $19/yr, cancel anytime.

Fixes

• macOS 26 (Tahoe): the app is reachable again when the menu bar hides its icon. Tahoe lets you hide any app's menu-bar icon (System Settings → Menu Bar). With FreeLLMAPI hidden, the tray was still created without any error and simply never drawn, which left the app running with a working API and nothing at all to click. It now notices its icon is not on the menu bar, tells you where the setting is, and offers to open the dashboard. Reopening the app from Finder opens the dashboard too — macOS delivers that as an activate event, which the app used to ignore. (#1146, closes #807)

Providers

• AMD Radeon Cloud (TokenFactory). (#1145)

Full changelog: v0.9.5...v0.9.6

⭐ Like the free router? Go Premium — the live signed catalog, $19/yr, cancel anytime.

Routing

• Task-type-aware routing: send x-freellm-task-type: code or chat to nudge the bandit weights toward intelligence or speed for that request. Code is also detected from unambiguous markers in the prompt. The fastest, reliable and custom strategies are never adjusted. (#1128)
• The share of the weight shift is tunable via GET/PUT /api/settings/task-weight-share; 0 turns it off. (#1129)

Models and quota

• /v1/models now reports execution_status per model (ready, needsKey, exhausted) using the router's own cooldown, rate-window and key-scope checks, and accepts ?execution_status= as a filter. (#1101)
• New GET /v1/quota-forecast endpoint: remaining daily headroom per quota pool with a low-balance flag before the UTC reset. (#1111)

Cache

• The response cache can now persist to SQLite so it survives restarts. Opt out with RESPONSE_CACHE_PERSIST=0. Only active when the cache itself is enabled, and note that it stores model responses on disk in plaintext. (#1097)
• Analytics shows a cache card with hit rate and saved tokens when the cache is on. (#1117)

MCP

• The /mcp endpoint has an on/off switch (GET/PUT /api/settings/enable-mcp) and a toggle under Keys → agent compatibility. Existing installs stay on; fresh installs start with it off. A disabled server answers 403 on every verb. (#1073)

Security and operations

• npm run rotate-encryption-key re-encrypts every stored secret (provider keys, proxy credentials, client profile keys, Fetch Relay token) under a new ENCRYPTION_KEY, with --dry-run. (#1113)
• CI: GitHub Actions bumped to current majors and pinned to full commit SHAs, Dependabot keeps them fresh, server test coverage is reported on the Node 22 leg, and ESLint now runs for the server and CLI workspaces. (#1067, #1118, #1119, #1121)

Fixes

• setup-opencode writes limit.output, which OpenCode's config schema requires. Shipped as CLI 0.5.1 on npm. (#1055)

Docs

• QwenPaw setup guide in English and Chinese. Thanks @qinghuanandejiangshi. (#1137)

Thanks to @suantea and @yfdyh000 for the contributions in this release.

Full changelog: v0.9.4...v0.9.5

⭐ Like the free router? Go Premium — the live signed catalog, $19/yr, cancel anytime.

Fixes

• Dashboard premium upsell shows the correct price again: $19/yr, $49 lifetime. v0.9.3 shipped with $29/$79 copy in the dashboard locales and README; the checkout itself charges $19/$49.

Full changelog: v0.9.3...v0.9.4

⭐ Like the free router? Go Premium — the live signed catalog, $19/yr, cancel anytime.

Fixes

• Proxy always returns a usage block, so agents such as CodeBuddy show context-window counts even when the upstream omits it (#1084, #1120)
• Structured-output JSON is enforced on streaming responses too (#985)
• Moonshot assistant partial-prefill flag is preserved through the proxy (#1040)
• TRUST_PROXY is honoured for client IPs behind a reverse proxy (#1041)
• Playground scroll stays inside its transcript pane (#1037)

Performance

• Quota panel no longer ranks the whole observation log on every poll (#1123)
• Quota observation log is pruned in 5k-row chunks (#1124)
• Covering index for the latency percentile queries (#1019)

Providers and agents

• Sail Research adapter (#1125)
• AtomCode added to the agents catalog (#1025)

Analytics

• Sortable columns on the recent-calls, usage-by-key and per-model tables (#495)
• Full error message on hover in the recent-errors table (#489)

Desktop

• Linux build now ships an .rpm alongside the AppImage and tar.xz (#981)

Docs

• Docs reorganised into per-domain folders with overviews and changelogs (#979)

⭐ Like the free router? Go Premium — the live signed catalog, $19/yr, cancel anytime.

Outbound Fetch Relay (opt-in)

• New Fetch Relay transport for the outbound proxy (#975, by @w0fv1). Instead of a CONNECT or SOCKS proxy, provider requests can be forwarded through a relay endpoint you host, such as the Cloudflare Worker in examples/fetch-relay-worker/. Useful when a regional block sits between you and a provider and you can deploy a Worker but not run a proxy box.
• Off by default: the transport only activates when you pick it in Keys → Outbound proxy, or set PROXY_MODE=fetch-relay alongside PROXY_URL. Existing PROXY_URL / HTTPS_PROXY / ALL_PROXY values keep the forward transport.
• Relay URLs must be https:// (loopback excepted), the relay token is encrypted at rest and never returned by the API, streaming and abort pass straight through, and the Test button now reports a relay side 401/403 as a failure instead of success.
• Bear in mind that a relay terminates TLS, so it sees the provider key and request body. Only point this at a relay you control. See docs/fetch-relay.md.

Docker

• The image now starts through a small root entrypoint that fixes ownership of /app/server/data (and the directories behind FREEAPI_DB_PATH / FREEAPI_DB_BACKUP_PATH) before dropping to the node user (#972, by @hiiamwaffledev). This fixes the SQLITE_CANTOPEN / EACCES failure on Railway, Render and similar hosts that mount persistent volumes as root. The chown is skipped when ownership is already right and never aborts startup if it cannot run.
• Note for Kubernetes users: the image's default user is now root at start. The node process itself still runs as uid 1000, but a runAsNonRoot: true policy will reject the image; set runAsUser: 1000 explicitly, in which case the entrypoint skips the chown.

Streaming

• When a client asks for usage via stream_options.include_usage and the upstream never sends a usage frame, the gateway now emits one with its own estimate, flagged "estimated": true so cost tooling can tell it apart from provider-reported numbers (#686, by @oppih). Image tokens are included in the estimate.

Desktop

• Mac builds are signed and notarized, including the DMG itself, so the right-click → Open workaround is no longer needed (#1034, #1035, #1036). Closes #373 and #943.

Full changelog: v0.8.9...v0.9.0

⭐ Like the free router? Go Premium — the live signed catalog, $19/yr, cancel anytime.

⭐ Like the free router? Go Premium — the live signed catalog, $19/yr, cancel anytime.