chore: point the free tier at freeseek.1lm.io

[lroolle]

The hosted gateway is now deployed and serving at https://freeseek.1lm.io.

Updated in the four places the old host was named:

internal/deepseek/free.go	DefaultGatewayURL — what deepseek free enrols against
README.md	the deepseek free transcript
site/index.html	the site's copy of that transcript
site/playground.js	DEFAULT_GATEWAY for the browser playground

DEEPSEEK_FREE_URL still overrides it, so anyone running their own deployment is unaffected.

Verified against the live deployment

Enrolment, both wire formats, the model filter, and the policy refusal, all through the public URL:

$ deepseek free
  solved 20 bits in 100ms (1.5M hashes)
  Enrolled. subject IMzaM2rwA9rYWuWTqqw6Zw

$ deepseek chat "Reply with exactly: public path works"
public path works
· flash · 90 in · 18 out (14 think) · ~$0.000018 · 1.65s

$ deepseek anthropic "Say OK"
OK
· flash · 85 in · 18 out · ~$0.000017 · 1.63s

$ deepseek models --json
 models: ['deepseek-v4-flash']

$ deepseek chat "hi" -m deepseek-v4-pro
Error: the free tier serves deepseek-v4-flash only, not "deepseek-v4-pro" (HTTP 400)

CORS is enabled server-side for https://thevibeworks.github.io, so the playground works against it:

$ curl -i -X OPTIONS https://freeseek.1lm.io/v1/anon/challenge \
    -H "Origin: https://thevibeworks.github.io" -H "Access-Control-Request-Method: POST"
HTTP/2 204
access-control-allow-origin: https://thevibeworks.github.io
access-control-allow-headers: authorization, content-type, x-api-key, anthropic-version

Note on ordering

This should land after #1. That PR fixes a token forgery in token.split() — a one-byte MAC verified against one byte of the real one, so 256 guesses mint a token for an attacker-chosen subject with no knowledge of the signing secret. Pointing the published default at a gateway without that fix would aim every new user at a free tier whose proof-of-work can be skipped outright. The deployment behind this URL already runs the patched build.

🤖 Generated with Claude Code

[lroolle]

Review + test report

Tested against the live deployment rather than reading the transcript: every functional claim in the description holds. One blocking defect, and it is the reason CI is already red.

Blocking: site/index.html is generated, and its generator was not updated

site/build.py still carries the old host at line 348, so the hand-edit to site/index.html is stale output:

$ python3 site/build.py --check
stale (run `python3 site/build.py`): index.html

That is the check job failing on this PR right now. Worse than a red tick: the next make site — which any later site change runs — silently reverts the hostname on the published page, and nothing would catch it because the CLI and playground would still be correct.

One line fixes it, and I verified that is the whole fix:

sed -i 's|gateway   https://free.deepseek.lroolle.com|gateway   https://freeseek.1lm.io|' site/build.py
python3 site/build.py --check   # site up to date (7 pages)

After it, regenerating produces site/index.html byte-identical to the version in this PR — the hand-edited content was right, only the source was missed. So the table in the description should read five places, not four.

Everything else verified against https://freeseek.1lm.io

Built from this branch, no key in the environment, isolated HOME:

enrol	20 bits, 315k hashes, subject issued
chat	public path works · 90 in · 29 out · ~$0.000021
anthropic	OK · 85 in · 17 out
models	["deepseek-v4-flash"] — filtered, pro not advertised
pro request	refused with the bring-your-own-key message, exit 1, not downgraded

Metering is right, which is the part worth checking rather than assuming: after those calls free status reported 2 billable requests — the refused pro request was rejected before upstream and not charged, and models cost nothing. Deployed limits match the documented ones exactly (30 / 60000 / 20000).

CORS confirmed from the real origin, including the exposed quota headers:

access-control-allow-origin: https://thevibeworks.github.io
access-control-expose-headers: X-Free-Requests-Remaining, X-Free-Input-Tokens-Remaining, ...

And the full browser path, driven through the shipped playground on the live site with dsplay.gateway pointed at the new host — so this is the real page, real origin, real gateway:

enrol   solved in 3.1s (1,004,171 hashes) — token dsf_…
send    "playground path works" · flash · 90 in · 20 out (15 think) · ~$0.000018 · 1.43s

Streaming, reasoning and the usage line all arrive.

Two notes, neither blocking

• http://localhost:* is not in the CORS allowlist — the preflight returns 204 with no access-control-allow-origin, so a locally served playground cannot talk to the hosted gateway. Fine as a policy (there is the dsplay.gateway override and DEEPSEEK_FREE_URL), but worth knowing before someone spends an afternoon on it.
• The branch is 4 commits behind main. No conflicts in these four files, but it predates both fix(gateway): pin the MAC length, and stop refunding the credit pool #1 and the site rework.

Verdict

Approve on the substance — the deployment is real, correct, and metered as documented, and the ordering call about landing after #1 was right. Needs the one-line site/build.py change before merge, or CI stays red and the site reverts itself on the next build.