v0.6.7

## The dashboard loads again over plain HTTP

If you reach FreeLLMAPI at `http://<ip>:<port>` — a Docker install on your LAN, a Raspberry Pi, a home server — v0.6.6 served you a blank page. This release fixes it, and it is the reason to upgrade (#682, #687, #734, reported by @EntropyEngineer).

An origin without TLS is not a "secure context", and v0.6.6's CSP hardening did not account for that:

- `upgrade-insecure-requests` was rewriting `/assets/*` to `https://` on an origin with no TLS, so every script and stylesheet failed with `ERR_SSL_PROTOCOL_ERROR`.
- The inline theme bootstrap — the script that stops dark-mode users seeing a white flash — was blocked outright. It is now allowed by hash, and a test recomputes that hash from the real `index.html` so it cannot silently drift.
- `Cross-Origin-Opener-Policy` and `Origin-Agent-Cluster` were being sent to origins that discard them and log an error instead. They now go out only over TLS or loopback, and come back automatically behind an HTTPS reverse proxy that forwards `X-Forwarded-Proto`.
- Copy buttons had no working clipboard: `navigator.clipboard` does not exist on an insecure origin, so they either threw or silently did nothing while still flashing "Copied". They now fall back to a legacy copy and report honestly when it fails.

Nothing changes for localhost or the desktop app, both of which browsers already treat as trustworthy. `CSP_UPGRADE_INSECURE_REQUESTS=true|false` overrides the upgrade directive if your setup needs it.

## Keys

- Manage one key at a time instead of the whole provider (#705).
- Add a key to a custom endpoint without having to register a model first (#702).
- Custom endpoints survive a dashboard export/import round trip (#687).
- The display name typed on the custom endpoint form is actually applied (#715).
- Copy a single key from the list, behind the same password re-verification the export uses, instead of exporting everything to read one key back.

## Analytics and usage

- Month-to-date usage cards on the Embeddings, Image and Audio tabs (#695).
- The usage bar stays visible at zero, and is now titled "Monthly usage" (#696).
- The selected time range is remembered between visits (#712).

## Other fixes

- Reset a forgotten dashboard password with a code printed to the server log (#560).
- Cloudflare image models that require `multipart/form-data` now get it (#714).
- The version the app reports is the release version everywhere — dashboard row, desktop tray, container installs (#703). This was the known issue called out in v0.6.6.
- Releases now carry `latest.yml` / `latest-mac.yml`, the update metadata an updater reads (#718).
- The retry-budget message no longer implies it cancels in-flight attempts (#666).

## Translations and docs

- A translated-docs tree with a current zh-CN README, plus `install.md` and `api.md` in zh-CN (#689, #690, #683, #701).
- Thanks to @arsalanyavari and @suantea, credited in the contributors list (#700, #694).

## Install

```bash
docker pull ghcr.io/tashfeenahmed/freellmapi:latest
```

Desktop installers are attached below. The macOS DMG is unsigned, so on first launch use right-click then Open rather than double-clicking.

**Full changelog**: https://github.com/tashfeenahmed/freellmapi/compare/v0.6.6...v0.6.7

---
⭐ Like the free router? [Go Premium](https://freellmapi.co/?utm_source=github&utm_medium=release&utm_campaign=premium&utm_content=v0.6.7#pricing) — the live signed catalog, $19/yr, cancel anytime.