@eddyskywalker/dsh-chatgpt-subscription 0.8.2 → 0.8.4

package/lib/index.js

@@ -7,8 +7,8 @@ import os, { homedir } from "node:os";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { execSync, spawn } from "node:child_process";
-import fs, { appendFileSync, constants, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, utimesSync, writeFileSync } from "node:fs";
 import fsPromises, { chmod, lstat, mkdir, open, rename, stat, unlink } from "node:fs/promises";
+import fs, { appendFileSync, constants, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, utimesSync, writeFileSync } from "node:fs";
 import http, { createServer } from "node:http";
 import { WebError } from "@deepseek-ai/dsh-web";
 import { lookup } from "node:dns/promises";
@@ -327,6 +327,125 @@ function dshHomeDir() {
 	return process.env.DSH_HOME?.trim() || path.join(os.homedir(), ".dsh");
 }
 //#endregion
+//#region src/host/common/credential-read-cache.ts
+/**
+* Identity a file-backed credential store reports when nothing is stored.
+*
+* An absent file is a *known* answer, not a cache miss: the store returns null
+* without decrypting anything, which is what makes the signed-out settings card
+* cheap to render.
+*/
+const ABSENT_CREDENTIAL = "absent";
+/**
+* Cheap identity of one credential file: its last write time and size.
+*
+* Returns {@link ABSENT_CREDENTIAL} when the file does not exist, and `null`
+* when its state cannot be established at all (a stat failure other than
+* ENOENT) — `null` disables caching for that read rather than risking a stale
+* answer.
+*/
+async function fileCredentialIdentity(path) {
+	try {
+		const stats = await stat(path);
+		return `${stats.mtimeMs}:${stats.size}`;
+	} catch (error) {
+		return isMissing$1(error) ? ABSENT_CREDENTIAL : null;
+	}
+}
+/**
+* Identity for a keyring-backed credential, which has no file to compare.
+*
+* A time bucket is the honest substitute: a burst of reads inside one bucket
+* shares a single keyring lookup, and the bucket bounds how long a write from
+* another process can go unnoticed. Fifteen seconds matches the scan cache the
+* WorkBuddy store already keeps, and stays far below the polling interval of
+* every surface that reads these credentials.
+*/
+async function keyringCredentialIdentity(ttlMs) {
+	return `bucket:${Math.floor(Date.now() / ttlMs)}`;
+}
+/**
+* In-memory snapshot of one credential read.
+*
+* Reading a credential is expensive on every platform this plugin supports:
+* Windows runs a DPAPI unprotect through a spawned `powershell.exe` (measured
+* at 200-243 ms on a real machine), macOS spawns `security`, and Linux spawns
+* `secret-tool`. One settings request reads several credentials — a pool is
+* read once per `read()` call, and a status card asks for the pool twice — so
+* opening a tab cost 3-5 process launches and took 1-3 s.
+*
+* A snapshot is reused only while the stored value is provably unchanged, so a
+* write from another process (the CLI login helper, a second Host) is still
+* observed. The identity is read *before* the value: a write that lands during
+* a read leaves the cached identity older than the stored bytes, so the next
+* read compares against a newer identity and decrypts again. Reading it after
+* would cache the older value under the newer identity and hide that write.
+*
+* Concurrent reads that observe the same identity share one in-flight read,
+* which is what makes the two reads inside `readPoolStatus` cost one launch
+* rather than two.
+*
+* Every write through the owning store calls {@link invalidate}, so the
+* write-then-read verification the pools perform still reads real storage
+* instead of the snapshot it just wrote.
+*/
+var CredentialReadCache = class {
+	identity;
+	entry = null;
+	pending = null;
+	/**
+	* @param identity - cheap identity of the stored value; `null` disables
+	*   caching for the read.
+	*/
+	constructor(identity) {
+		this.identity = identity;
+	}
+	/**
+	* Read through the snapshot.
+	*
+	* @param read - the expensive read, invoked only when the snapshot cannot
+	*   answer.
+	* @returns the stored value, or null when nothing is stored.
+	*/
+	async load(read) {
+		const identity = await this.identity().catch(() => null);
+		if (identity === null) return read();
+		if (this.entry !== null && this.entry.identity === identity) return this.entry.value;
+		if (identity === "absent") {
+			this.entry = {
+				identity,
+				value: null
+			};
+			return null;
+		}
+		if (this.pending !== null && this.pending.identity === identity) return this.pending.promise;
+		const promise = read();
+		this.pending = {
+			identity,
+			promise
+		};
+		const settle = (value) => {
+			if (this.pending !== null && this.pending.promise === promise) this.pending = null;
+			this.entry = {
+				identity,
+				value
+			};
+		};
+		promise.then(settle, () => {
+			if (this.pending !== null && this.pending.promise === promise) this.pending = null;
+		});
+		return promise;
+	}
+	/** Drop the snapshot; the next read consults storage again. */
+	invalidate() {
+		this.entry = null;
+		this.pending = null;
+	}
+};
+function isMissing$1(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+//#endregion
 //#region src/host/token-store.ts
 function parseStoredCredentials(value) {
 	if (typeof value !== "object" || value === null) throw new Error("credential bundle is not an object");
@@ -403,6 +522,14 @@ var WindowsDpapiCredentialStore = class {
 		kind: "windows-dpapi",
 		encrypted: true
 	};
+	/**
+	* Decrypted snapshot, validated against the file's own mtime and size.
+	*
+	* Every uncached read is a spawned `powershell.exe` (~200 ms), and one
+	* settings request reads several credentials, so the snapshot is what keeps a
+	* tab switch from costing seconds.
+	*/
+	cache = new CredentialReadCache(() => fileCredentialIdentity(this.path));
 	constructor(path, parse) {
 		this.path = path;
 		this.parse = parse;
@@ -410,20 +537,24 @@ var WindowsDpapiCredentialStore = class {
 		if (dirname(path) === path) throw new Error("invalid DPAPI credential path");
 	}
 	async load() {
-		const result = await runPowerShell(UNPROTECT_SCRIPT, this.path, "");
-		if (result.code === 3) return null;
-		if (result.code !== 0) throw new Error("DPAPI credential read failed");
-		try {
-			return this.parse(JSON.parse(result.stdout));
-		} catch {
-			throw new Error("DPAPI credential payload is invalid");
-		}
+		return this.cache.load(async () => {
+			const result = await runPowerShell(UNPROTECT_SCRIPT, this.path, "");
+			if (result.code === 3) return null;
+			if (result.code !== 0) throw new Error("DPAPI credential read failed");
+			try {
+				return this.parse(JSON.parse(result.stdout));
+			} catch {
+				throw new Error("DPAPI credential payload is invalid");
+			}
+		});
 	}
 	async save(value) {
 		if ((await runPowerShell(PROTECT_SCRIPT, this.path, JSON.stringify(value))).code !== 0) throw new Error("DPAPI credential write failed");
+		this.cache.invalidate();
 	}
 	async clear() {
 		if ((await runPowerShell(CLEAR_SCRIPT, this.path, "")).code !== 0) throw new Error("DPAPI credential deletion failed");
+		this.cache.invalidate();
 	}
 };
 var WindowsDpapiTokenStore = class extends WindowsDpapiCredentialStore {
@@ -485,6 +616,14 @@ function runPowerShell(script, path, stdin) {
 const DEFAULT_SERVICE = "dsh-chatgpt-subscription";
 const DEFAULT_ACCOUNT = "oauth";
 /**
+* How long one keychain read may stand in for the stored value.
+*
+* A keychain has no mtime to compare, so this is the price of not spawning
+* `security` on every read; it is far below the 60 s polling interval of the
+* surfaces that read these credentials.
+*/
+const KEYRING_READ_CACHE_TTL_MS$1 = 15e3;
+/**
 * macOS credential storage backed by the login Keychain through the built-in
 * `security` command-line tool. The payload is encrypted at rest by the
 * Keychain, so this store reports itself as encrypted like Windows DPAPI.
@@ -497,6 +636,15 @@ var MacKeychainCredentialStore = class {
 		kind: "macos-keychain",
 		encrypted: true
 	};
+	/**
+	* Snapshot of the last keychain read.
+	*
+	* A keychain lookup spawns `security`, and one settings request performs
+	* several of them. There is no file to compare against, so the snapshot is
+	* keyed on a short time bucket instead — see
+	* {@link keyringCredentialIdentity}.
+	*/
+	cache = new CredentialReadCache(() => keyringCredentialIdentity(KEYRING_READ_CACHE_TTL_MS$1));
 	constructor(service, account, parse) {
 		this.service = service;
 		this.account = account;
@@ -504,21 +652,23 @@ var MacKeychainCredentialStore = class {
 		if (process.platform !== "darwin") throw new Error("macOS Keychain storage requires macOS");
 	}
 	async load() {
-		const result = await runSecurity([
-			"find-generic-password",
-			"-a",
-			this.account,
-			"-s",
-			this.service,
-			"-w"
-		]);
-		if (result.code === 44) return null;
-		if (result.code !== 0) throw new Error("Keychain credential read failed");
-		try {
-			return this.parse(parseSecurityPayload(result.stdout));
-		} catch {
-			throw new Error("Keychain credential payload is invalid");
-		}
+		return this.cache.load(async () => {
+			const result = await runSecurity([
+				"find-generic-password",
+				"-a",
+				this.account,
+				"-s",
+				this.service,
+				"-w"
+			]);
+			if (result.code === 44) return null;
+			if (result.code !== 0) throw new Error("Keychain credential read failed");
+			try {
+				return this.parse(parseSecurityPayload(result.stdout));
+			} catch {
+				throw new Error("Keychain credential payload is invalid");
+			}
+		});
 	}
 	async save(value) {
 		if ((await runSecurity([
@@ -531,6 +681,7 @@ var MacKeychainCredentialStore = class {
 			JSON.stringify(value),
 			"-U"
 		])).code !== 0) throw new Error("Keychain credential write failed");
+		this.cache.invalidate();
 	}
 	async clear() {
 		const result = await runSecurity([
@@ -541,6 +692,7 @@ var MacKeychainCredentialStore = class {
 			this.service
 		]);
 		if (result.code !== 0 && result.code !== 44) throw new Error("Keychain credential deletion failed");
+		this.cache.invalidate();
 	}
 };
 /**
@@ -600,11 +752,22 @@ function runSecurity(args) {
 //#endregion
 //#region src/host/credential-store-secret-service.ts
 const UNAVAILABLE = "Linux encrypted credential storage requires secret-tool (libsecret) and an unlocked Secret Service keyring.";
+/**
+* How long one Secret Service read may stand in for the stored value.
+*
+* `secret-tool` is a process launch per lookup and one settings request performs
+* several, so the snapshot is what keeps a tab switch from costing seconds. A
+* keyring has no mtime to compare, so this bounded bucket is the substitute; it
+* is far below the 60 s polling interval of the surfaces that read these
+* credentials.
+*/
+const KEYRING_READ_CACHE_TTL_MS = 15e3;
 /** Secrets travel over stdin/stdout; command arguments contain only lookup attributes. */
 var SecretServiceCredentialStore = class {
 	service;
 	account;
 	parse;
+	cache = new CredentialReadCache(() => keyringCredentialIdentity(KEYRING_READ_CACHE_TTL_MS));
 	constructor(service, account, parse) {
 		this.service = service;
 		this.account = account;
@@ -619,14 +782,16 @@ var SecretServiceCredentialStore = class {
 		];
 	}
 	async load() {
-		const result = await runSecretTool(["lookup", ...this.attributes()]);
-		if (result.code === 1 && !result.hasStderr && result.stdout === "") return null;
-		if (result.code !== 0) throw new Error(UNAVAILABLE);
-		try {
-			return this.parse(JSON.parse(result.stdout));
-		} catch {
-			throw new Error("Secret Service credential payload is invalid");
-		}
+		return this.cache.load(async () => {
+			const result = await runSecretTool(["lookup", ...this.attributes()]);
+			if (result.code === 1 && !result.hasStderr && result.stdout === "") return null;
+			if (result.code !== 0) throw new Error(UNAVAILABLE);
+			try {
+				return this.parse(JSON.parse(result.stdout));
+			} catch {
+				throw new Error("Secret Service credential payload is invalid");
+			}
+		});
 	}
 	async save(value) {
 		const payload = JSON.stringify(value);
@@ -636,10 +801,12 @@ var SecretServiceCredentialStore = class {
 			"--label=DSH Antigravity OAuth",
 			...this.attributes()
 		], payload)).code !== 0) throw new Error(UNAVAILABLE);
+		this.cache.invalidate();
 	}
 	async clear() {
 		const result = await runSecretTool(["clear", ...this.attributes()]);
 		if (result.code !== 0 && !(result.code === 1 && !result.hasStderr)) throw new Error(UNAVAILABLE);
+		this.cache.invalidate();
 	}
 };
 function runSecretTool(args, stdin = "") {
@@ -4938,6 +5105,63 @@ function acceptIdentity(current, incoming) {
 	return typeof incoming === "string" && incoming.length > 0 ? incoming : current;
 }
 //#endregion
+//#region src/host/common/same-origin.ts
+/**
+* Whether one mutation request comes from this application's own document.
+*
+* Two shapes reach these routes:
+*
+* 1. A browser page served by this Host. The browser states its origin, and it
+*    must name the same authority the request was addressed to. A cross-site
+*    POST always states the foreign origin, so this comparison is what rejects
+*    it.
+*
+* 2. The DSH Desktop shell. Electron's `forwardWebRequest` admits only requests
+*    whose origin is the `dsh-app://app` document, then *removes* the `origin`
+*    header before forwarding to the Host — that application scheme is not an
+*    HTTP origin the Host could compare against. A forwarded request therefore
+*    arrives with no `origin` at all, addressed to the loopback Host.
+*
+* A missing `origin` is consequently accepted only when the request was
+* addressed to a loopback authority, and a stated `origin` must still match
+* exactly. This is not a CSRF opening: a browser cannot issue a cross-site POST
+* without stating the foreign origin, so every cross-site request still fails
+* the comparison — the loopback clause admits only the desktop shell's already
+* validated forward, and a request that never reached loopback keeps the strict
+* requirement.
+*
+* @param request - Incoming mutation request.
+* @returns whether the request may be treated as same-origin.
+*/
+function isSameOriginMutation(request) {
+	const host = request.headers.host;
+	if (typeof host !== "string" || host === "") return false;
+	const origin = request.headers.origin;
+	if (origin === void 0 || origin === "") return isLoopbackAuthority(host);
+	try {
+		const parsed = new URL(origin);
+		return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.host.toLowerCase() === host.toLowerCase();
+	} catch {
+		return false;
+	}
+}
+/**
+* Whether one `Host` header names the loopback interface.
+*
+* The desktop shell forwards to whatever URL the Host was started with, which
+* is a loopback authority in every supported posture (`127.0.0.1`, `localhost`,
+* or the IPv6 literal).
+*/
+function isLoopbackAuthority(host) {
+	let hostname;
+	try {
+		hostname = new URL(`http://${host}`).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return hostname === "127.0.0.1" || hostname === "localhost" || hostname === "[::1]" || hostname === "::1";
+}
+//#endregion
 //#region src/host/usage-service.ts
 /**
 * The quota card reads the same account the conversation uses, but it must keep
@@ -4979,7 +5203,7 @@ var UsageService = class {
 		this.fetchFn = options.fetchFn ?? fetch;
 		this.now = options.now ?? Date.now;
 	}
-	async status(authenticated, force = false) {
+	async status(authenticated, force = false, options = {}) {
 		if (!authenticated) return {
 			state: "signed-out",
 			...EMPTY_USAGE,
@@ -5006,12 +5230,34 @@ var UsageService = class {
 			code: "rate-limited",
 			message: "Quota refresh is temporarily rate limited."
 		});
+		if (options.backgroundRefresh === true && this.cache !== null) {
+			this.startBackgroundRefresh(credentials, accountKey);
+			return this.fromCache(true);
+		}
 		if (this.inFlight !== null) return this.inFlight;
 		this.inFlight = this.refreshUpstream(credentials, accountKey).finally(() => {
 			this.inFlight = null;
 		});
 		return this.inFlight;
 	}
+	/** Whether a quota refresh is running, so a caller can ask again when it lands. */
+	get refreshing() {
+		return this.inFlight !== null;
+	}
+	/**
+	* Refresh behind an answer that has already been given.
+	*
+	* The rejection is absorbed here: this refresh has no caller to receive it,
+	* and {@link fromCache} keeps serving the snapshot it failed to replace.
+	*/
+	startBackgroundRefresh(credentials, accountKey) {
+		if (this.inFlight !== null) return;
+		const task = this.refreshUpstream(credentials, accountKey).finally(() => {
+			if (this.inFlight === task) this.inFlight = null;
+		});
+		this.inFlight = task;
+		task.catch(() => void 0);
+	}
 	invalidate() {
 		this.invalidated = true;
 	}
@@ -5417,11 +5663,13 @@ function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwit
 		const url = new URL(request.url ?? "/", "http://dsh.local");
 		if (request.method === "GET" && url.pathname === `/api/dsh-chatgpt-subscription/status`) {
 			const oauthStatus = await oauth.status();
+			const quota = await usage.status(oauthStatus.authenticated, false, { backgroundRefresh: true });
 			json(response, {
 				ok: true,
 				value: {
 					...oauthStatus,
-					quota: await usage.status(oauthStatus.authenticated),
+					quota,
+					quotaRefreshing: usage.refreshing,
 					preferences: preferences.status(),
 					detectedProxy: proxyManager?.getSystemProxy() ?? null,
 					activeProxy: proxyManager?.resolveActiveProxyUrl() ?? null,
@@ -5477,7 +5725,7 @@ function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwit
 			});
 			return;
 		}
-		if (!isSameOriginMutation$4(request)) {
+		if (!isSameOriginMutation(request)) {
 			jsonError(response, 403, {
 				code: "csrf-rejected",
 				message: "Cross-origin request rejected."
@@ -5668,17 +5916,6 @@ function registerRoutes(ctx, oauth, usage, preferences, proxyManager, searchSwit
 		for (const dispose of disposers) dispose();
 	};
 }
-function isSameOriginMutation$4(request) {
-	const host = request.headers.host;
-	const origin = request.headers.origin;
-	if (typeof host !== "string" || host === "" || typeof origin !== "string" || origin === "") return false;
-	try {
-		const parsed = new URL(origin);
-		return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.host.toLowerCase() === host.toLowerCase();
-	} catch {
-		return false;
-	}
-}
 async function readJson(request) {
 	const chunks = [];
 	let total = 0;
@@ -5860,6 +6097,19 @@ function currentConfig(entry) {
 function providerId(value) {
 	return typeof value === "string" && /^[a-zA-Z0-9_-]{1,80}$/.test(value) ? value : null;
 }
+//#endregion
+//#region src/host/antigravity/port-constants.ts
+/**
+* Loopback callback ports for provider sign-in flows.
+*
+* Windows (Hyper-V/WinNAT) dynamically reserves TCP port ranges that change on
+* every reboot. A fixed callback port can land inside one and `listen` fails
+* with `EACCES` — browser authorization never opens. Flows therefore probe for
+* a usable port instead of assuming the default is free; the redirect URI the
+* provider receives carries whichever port was probed.
+*/
+/** Default loopback port the Antigravity CLI's own flow uses. */
+const DEFAULT_CALLBACK_PORT$1 = 51121;
 let cachedQuota$2;
 let quotaFetchInFlight = null;
 /** Bumped by every cache clear so an in-flight fetch cannot publish stale state. */
@@ -6147,15 +6397,49 @@ function antigravityEnv(namePart) {
 function callbackPort() {
 	const configured = Number(antigravityEnv("CALLBACK_PORT"));
 	if (Number.isInteger(configured) && configured > 0 && configured <= 65535) return configured;
-	return 51121;
+	return DEFAULT_CALLBACK_PORT$1;
+}
+/**
+* First usable loopback port for the callback listener.
+*
+* Windows (Hyper-V/WinNAT) dynamically reserves TCP port ranges that change on
+* every reboot, and the CLI's default port can land inside one — `listen` then
+* fails with `EACCES: permission denied ::1:51121` and browser authorization
+* never opens. A fixed port therefore cannot be relied on; the Google redirect
+* URI carries whatever port this returns, so any free loopback port works. A
+* configured `DSH_ANTIGRAVITY_CALLBACK_PORT` still wins — callers who set it
+* accept that the port must be usable.
+*/
+async function resolveCallbackPort(attempts = 128, host = resolveCallbackHost()) {
+	if (antigravityEnv("CALLBACK_PORT") !== void 0) return callbackPort();
+	for (let offset = 0; offset < attempts; offset += 1) if (await isPortUsable(51121 + offset, host)) return DEFAULT_CALLBACK_PORT$1 + offset;
+	throw new Error(`No usable local port for the Antigravity sign-in callback (tried ${attempts} ports from ${DEFAULT_CALLBACK_PORT$1} on ${host}). A Windows excluded-port range may cover them; set DSH_ANTIGRAVITY_CALLBACK_PORT to a free port.`);
+}
+/**
+* Whether one port can be bound on the interface the listener will use.
+*
+* The probe binds the same host `startCallbackServer` binds rather than a fixed
+* loopback literal. A port free on `127.0.0.1` can still fail on the address the
+* listener actually takes — a listener holding only the IPv6 loopback, or a
+* Windows exclusion covering that stack — and a probe that disagrees with the
+* bind reintroduces the `EACCES` this function exists to avoid.
+*/
+function isPortUsable(port, host) {
+	return new Promise((resolve) => {
+		const probe = createServer();
+		probe.once("error", () => resolve(false));
+		probe.once("listening", () => probe.close(() => resolve(true)));
+		probe.listen(port, host);
+	});
 }
 function resolveCallbackHost(raw = antigravityEnv("CALLBACK_HOST")) {
 	const host = (raw || "localhost").trim().toLowerCase();
 	if (host === "localhost" || host === "127.0.0.1" || host === "::1") return host;
 	return "localhost";
 }
-function redirectUri() {
-	return `http://${resolveCallbackHost()}:${callbackPort()}${"/oauth-callback".startsWith("/"), REDIRECT_PATH}`;
+function redirectUri(port = callbackPort(), host = resolveCallbackHost()) {
+	const path = ("/oauth-callback".startsWith("/"), REDIRECT_PATH);
+	return `http://${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}:${port}${path}`;
 }
 function clientId() {
 	return antigravityEnv("CLIENT_ID")?.trim() || DEFAULT_CLIENT_ID;
@@ -6210,7 +6494,9 @@ async function getUserEmail(token, fetchFn = fetch) {
 		return;
 	}
 }
-function startCallbackServer(expectedState) {
+async function startCallbackServer(expectedState) {
+	const host = resolveCallbackHost();
+	const port = await resolveCallbackPort(128, host);
 	return new Promise((resolve, reject) => {
 		let settled = false;
 		let timeout;
@@ -6226,7 +6512,7 @@ function startCallbackServer(expectedState) {
 			if (timeout) clearTimeout(timeout);
 			fn();
 		};
-		const callbackUrl = redirectUri();
+		const callbackUrl = redirectUri(port, host);
 		const server = createServer((request, response) => {
 			if (request.method !== "GET" && request.method !== "HEAD") {
 				response.writeHead(405, { "Content-Type": "text/plain; charset=utf-8" });
@@ -6269,14 +6555,15 @@ function startCallbackServer(expectedState) {
 			}));
 		});
 		server.on("error", reject);
-		server.listen(callbackPort(), resolveCallbackHost(), () => {
+		server.listen(port, host, () => {
 			timeout = setTimeout(() => {
 				finish(() => rejectCode(/* @__PURE__ */ new Error("OAuth callback timed out waiting for browser login")));
 				server.close();
 			}, OAUTH_CALLBACK_TIMEOUT_MS);
 			resolve({
 				server,
-				waitForCode: () => codePromise
+				waitForCode: () => codePromise,
+				callbackUrl
 			});
 		});
 	});
@@ -6346,8 +6633,7 @@ async function beginWebLogin$1(store, fetchFn = fetch, signal, onSave) {
 	if (webLoginFlow$2.status === "pending") return { ...webLoginFlow$2 };
 	const { verifier, challenge } = generatePKCE();
 	const state = base64Url(randomBytes(32));
-	const { server, waitForCode } = await startCallbackServer(state);
-	const callbackUrl = redirectUri();
+	const { server, waitForCode, callbackUrl } = await startCallbackServer(state);
 	webLoginFlow$2 = {
 		status: "pending",
 		authUrl: `${AUTH_URL}?${new URLSearchParams$1({
@@ -6440,8 +6726,7 @@ async function ensureApiKey(store, fetchFn = fetch) {
 async function loginAndSave(store, signal, onUrl, fetchFn = fetch, onProgress) {
 	const { verifier, challenge } = generatePKCE();
 	const state = base64Url(randomBytes(32));
-	const { server, waitForCode } = await startCallbackServer(state);
-	const callbackUrl = redirectUri();
+	const { server, waitForCode, callbackUrl } = await startCallbackServer(state);
 	const authUrl = `${AUTH_URL}?${new URLSearchParams$1({
 		client_id: clientId(),
 		response_type: "code",
@@ -7583,6 +7868,63 @@ var AntigravityAdapter = class extends LlmAdapter {
 	}
 };
 //#endregion
+//#region src/host/common/quota-refresh.ts
+/**
+* One quota refresh that runs behind an already-answered status call.
+*
+* A status card used to block on the upstream quota request whenever its
+* snapshot had aged past the line's TTL — measured at up to 3.6 s on a real
+* machine, on a tab whose other work answers in milliseconds. A snapshot that
+* exists can answer immediately instead, with the refresh running behind it.
+*
+* The outcome is remembered here rather than dropped: a refresh that keeps
+* failing would otherwise look exactly like a snapshot that never aged, and the
+* card would show old numbers with no hint of why they stopped moving.
+*
+* The caller still decides whether the snapshot may answer at all. No snapshot,
+* or one belonging to another account, has to be fetched before the card can be
+* rendered — those paths call {@link run} and wait.
+*/
+var QuotaRefresh = class {
+	pending = null;
+	error = null;
+	/**
+	* Start one refresh behind the answer.
+	*
+	* A refresh that is already running is not duplicated; the caller can see
+	* that one is in flight through {@link refreshing} and ask again when it
+	* lands.
+	*/
+	start(refresh) {
+		if (this.pending !== null) return;
+		const task = refresh().then(() => {
+			this.error = null;
+		}, (cause) => {
+			this.error = cause instanceof Error ? cause.message : String(cause);
+		}).finally(() => {
+			if (this.pending === task) this.pending = null;
+		});
+		this.pending = task;
+	}
+	/** Run one refresh and wait for it, recording the same outcome. */
+	async run(refresh) {
+		try {
+			await refresh();
+			this.error = null;
+		} catch (cause) {
+			this.error = cause instanceof Error ? cause.message : String(cause);
+		}
+	}
+	/** Whether a refresh started here is still running. */
+	get refreshing() {
+		return this.pending !== null;
+	}
+	/** Message from the most recent failed refresh, or null when none failed. */
+	lastError() {
+		return this.error;
+	}
+};
+//#endregion
 //#region src/host/antigravity/routes.ts
 function sendJson$5(response, status, body) {
 	response.writeHead(status, { "Content-Type": "application/json" });
@@ -7646,6 +7988,7 @@ async function getAntigravityWebStatus(store, modelSettings, preferences, accoun
 	};
 }
 function registerAntigravityRoutes(ctx, store, modelSettings, preferences, fetchFn = fetch, accountPool = new AccountPoolStore(void 0, void 0, store)) {
+	const quotaRefresh = new QuotaRefresh();
 	return ctx.webServer.register({
 		kind: "prefix",
 		path: "/antigravity/api",
@@ -7657,10 +8000,17 @@ function registerAntigravityRoutes(ctx, store, modelSettings, preferences, fetch
 					const credentials = await store.read();
 					const authenticated = !!(credentials?.access || credentials?.access_token);
 					const cached = getCachedQuota();
-					if (authenticated && (!cached || Date.now() - (cached.fetchedAt || 0) > 12e4)) await fetchAccountQuota(store, modelSettings, fetchFn).catch(() => void 0);
+					if (authenticated && (!cached || Date.now() - (cached.fetchedAt || 0) > 12e4)) {
+						const refresh = () => fetchAccountQuota(store, modelSettings, fetchFn);
+						if (cached === void 0) await quotaRefresh.run(refresh);
+						else quotaRefresh.start(refresh);
+					}
 					return sendJson$5(response, 200, {
 						ok: true,
-						value: await getAntigravityWebStatus(store, modelSettings, preferences, accountPool)
+						value: {
+							...await getAntigravityWebStatus(store, modelSettings, preferences, accountPool),
+							quotaRefreshing: quotaRefresh.refreshing
+						}
 					});
 				}
 				if (path === "login" || path === "accounts/login") {
@@ -9092,6 +9442,103 @@ function commandCodePlanLabel(planId) {
 	return resolveCommandCodePlan(planId)?.name ?? planId;
 }
 //#endregion
+//#region src/host/common/catalog-snapshot.ts
+/**
+* Persistent snapshot for one provider's live model catalog.
+*
+* The in-memory catalog caches keep a process alive between requests, but they
+* start cold: on the first call after a restart (or a plugin reinstall) the
+* picker and the settings page both wait on the upstream listing before they
+* can render anything, and an unreachable endpoint turns that wait into the
+* full discovery timeout — "the model server is unavailable" on a fresh
+* install. The catalog is not fast-moving data, so the last successful listing
+* is persisted to `<DSH_HOME>/storages/` and rehydrated into the in-memory
+* cache on first use. A snapshot the caller can read is therefore available
+* from the very first call, with no network in the path.
+*
+* Writes are best-effort: persistence is an optimization, never a capability.
+* A read-only home or a locked file must not fail the fetch that produced the
+* snapshot.
+*/
+/** File name of the persisted snapshot for one catalog. */
+function catalogSnapshotPath(name) {
+	return path.join(dshHomeDir(), "storages", `${name}-catalog.json`);
+}
+/**
+* Snapshot name for one catalog *and* one credential scope.
+*
+* A persisted snapshot answers before any credential is read — that is the whole
+* point of it — so the file itself has to carry the scope it was fetched under.
+* Otherwise the first call after a restart, for any account, is answered by
+* whatever listing some other scope happened to persist last: a Kimi listing
+* fetched for the mainland-cn endpoint would answer a global caller with models
+* and context windows that region does not serve, and a Command Code listing
+* fetched against one API environment would answer the other.
+*
+* The scope is part of the file name rather than of the payload because a caller
+* that cannot name the account — the harness resolves this catalog with no token
+* at all — still has to find the snapshot its own scope owns.
+*
+* Everything outside `[a-z0-9]` is folded to `_`, so no scope can escape the
+* `storages` directory.
+*/
+function catalogSnapshotName(base, scope) {
+	const normalized = scope.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+	return normalized === "" ? base : `${base}-${normalized}`;
+}
+/**
+* Read the persisted snapshot for one catalog.
+*
+* Shape errors and unreadable files both return `undefined` — the caller keeps
+* its in-memory state, and the next successful fetch overwrites the file.
+*/
+async function readCatalogSnapshot(name, parseModels) {
+	try {
+		const content = await fsPromises.readFile(catalogSnapshotPath(name), "utf8");
+		const parsed = JSON.parse(content);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+		const record = parsed;
+		const fetchedAt = record.fetchedAt;
+		if (typeof fetchedAt !== "number" || !Number.isFinite(fetchedAt) || fetchedAt <= 0) return void 0;
+		const models = parseModels(record.models);
+		if (models === void 0 || models.length === 0) return void 0;
+		return {
+			fetchedAt,
+			models
+		};
+	} catch {
+		return;
+	}
+}
+/** Persist one snapshot; a failure is logged nowhere and never thrown. */
+async function writeCatalogSnapshot(name, models, fetchedAt) {
+	try {
+		const filePath = catalogSnapshotPath(name);
+		await fsPromises.mkdir(path.dirname(filePath), { recursive: true });
+		const tmp = `${filePath}.tmp.${Date.now()}`;
+		await fsPromises.writeFile(tmp, JSON.stringify({
+			fetchedAt,
+			models
+		}, null, 2), "utf8");
+		await fsPromises.rename(tmp, filePath);
+	} catch {}
+}
+/**
+* Warm an in-memory cache from the persisted snapshot when it is fresher than
+* what the cache currently holds. Called lazily on the first cache miss of a
+* process, so a restart serves the previous listing without waiting on the
+* network.
+*
+* @returns the snapshot's `fetchedAt`, or `0` when no usable snapshot exists —
+*   the caller then fetches as before.
+*/
+async function rehydrateCatalogCache(name, parseModels, accept, currentFetchedAt) {
+	const snapshot = await readCatalogSnapshot(name, parseModels);
+	if (snapshot === void 0 || snapshot.fetchedAt <= currentFetchedAt) return 0;
+	accept(snapshot.fetchedAt, snapshot.models);
+	return snapshot.fetchedAt;
+}
+//#endregion
 //#region src/host/command-code/client.ts
 const CLI_VERSION = "1.0.0";
 /**
@@ -9649,6 +10096,15 @@ function extractUnlimited(payload) {
 }
 let cachedCatalog$2;
 let catalogInFlight$2 = null;
+/**
+* Snapshot scopes already consulted in this process.
+*
+* One entry per API environment rather than a single flag: the persisted file is
+* scoped to the environment it was fetched for (see `catalogSnapshotName`), so
+* each environment consults its own file once, and a scope with no snapshot is
+* not re-read on every cache miss.
+*/
+const catalogSnapshotScopesLoaded$2 = /* @__PURE__ */ new Set();
 /** Parse the public `/provider/v1/models` payload. */
 function parseProviderModels(payload) {
 	const root = asRecord$6(payload) ?? {};
@@ -9691,27 +10147,65 @@ async function fetchProviderModels(options = {}) {
 	if (!response.ok) throw new Error(`Command Code model catalog failed: ${response.status}`);
 	return parseProviderModels(await response.json());
 }
-/** Cached catalog with a TTL; a failed refresh keeps the previous snapshot. */
+/** Cached catalog with a TTL; a failed refresh keeps the previous snapshot.
+*
+* On the first cache miss of a process the persisted snapshot is rehydrated
+* first, so a restart serves the previous listing without waiting on the
+* network. An expired snapshot still answers immediately (stale) while a
+* refresh runs in the background — the catalog is not fast-moving data, and
+* waiting on an unreachable endpoint turned a restart into the full discovery
+* timeout on every model resolution.
+*/
 async function loadProviderModels(options = {}) {
-	if (!options.force && cachedCatalog$2 && Date.now() - cachedCatalog$2.fetchedAt < 18e5) return cachedCatalog$2.models;
+	if (options.force === true) return refreshProviderModels$1(options);
+	const current = cachedCatalog$2;
+	if (current !== void 0 && Date.now() - current.fetchedAt < 18e5) return current.models;
+	if (catalogInFlight$2) return catalogInFlight$2;
+	if (current !== void 0) {
+		refreshProviderModels$1(options).catch(() => void 0);
+		return current.models;
+	}
+	const { apiEnv } = options;
+	const scope = apiEnv ?? resolveApiEnv();
+	if (!catalogSnapshotScopesLoaded$2.has(scope)) {
+		catalogSnapshotScopesLoaded$2.add(scope);
+		const rehydratedAt = await rehydrateCatalogCache(catalogSnapshotName("command-code", scope), parseProviderModels, (fetchedAt, models) => {
+			cachedCatalog$2 = {
+				models,
+				fetchedAt
+			};
+		}, 0);
+		const warm = cachedCatalog$2;
+		if (rehydratedAt > 0 && warm !== void 0) {
+			refreshProviderModels$1(options).catch(() => void 0);
+			return warm.models;
+		}
+	}
+	return refreshProviderModels$1(options);
+}
+/** One in-flight, single-flighted fetch of the live catalog. */
+function refreshProviderModels$1(options = {}) {
 	if (catalogInFlight$2) return catalogInFlight$2;
 	const request = fetchProviderModels(options).then((models) => {
-		if (models.length > 0) cachedCatalog$2 = {
-			models,
-			fetchedAt: Date.now()
-		};
+		if (models.length > 0) {
+			const fetchedAt = Date.now();
+			cachedCatalog$2 = {
+				models,
+				fetchedAt
+			};
+			writeCatalogSnapshot(catalogSnapshotName("command-code", options.apiEnv ?? resolveApiEnv()), models, fetchedAt);
+		}
 		return models.length > 0 ? models : cachedCatalog$2?.models ?? [];
 	}).catch(() => cachedCatalog$2?.models ?? []);
 	catalogInFlight$2 = request;
-	try {
-		return await request;
-	} finally {
+	return request.finally(() => {
 		if (catalogInFlight$2 === request) catalogInFlight$2 = null;
-	}
+	});
 }
 function clearCachedCatalog$3() {
 	cachedCatalog$2 = void 0;
 	catalogInFlight$2 = null;
+	catalogSnapshotScopesLoaded$2.clear();
 }
 async function getJson(path, apiKey, options = {}) {
 	const response = await (options.fetchFn ?? fetch)(`${apiBaseUrl(options.apiEnv ?? resolveApiEnv())}${path}`, {
@@ -11717,17 +12211,6 @@ function sendMethodNotAllowed$3(response) {
 		error: "Method Not Allowed"
 	});
 }
-function isSameOriginMutation$3(request) {
-	const host = request.headers.host;
-	const origin = request.headers.origin;
-	if (typeof host !== "string" || host === "" || typeof origin !== "string" || origin === "") return false;
-	try {
-		const parsed = new URL(origin);
-		return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.host.toLowerCase() === host.toLowerCase();
-	} catch {
-		return false;
-	}
-}
 async function readRequestJson$3(request) {
 	return new Promise((resolve, reject) => {
 		const chunks = [];
@@ -11852,6 +12335,7 @@ function registerCommandCodeRoutes(ctx, store, modelSettings, preferences, optio
 		const data = accountPool === void 0 ? null : await accountPool.read().catch(() => null);
 		return data?.activeAccountId ?? data?.accounts.find((account) => account.isPrimary)?.id ?? data?.accounts[0]?.id;
 	};
+	const quotaRefresh = new QuotaRefresh();
 	return ctx.webServer.register({
 		kind: "prefix",
 		path: ROUTE_PREFIX$3,
@@ -11864,15 +12348,22 @@ function registerCommandCodeRoutes(ctx, store, modelSettings, preferences, optio
 					const credentials = await store.read();
 					const targetId = await activeAccountId();
 					const cached = getCachedQuotaFor$1(targetId);
-					if ((credentials !== null || targetId !== void 0) && (cached === void 0 || Date.now() - (cached.fetchedAt || 0) > 12e4)) await fetchAccountQuota$1(quotaStore, fetchFn, false, targetId).catch(() => void 0);
+					if ((credentials !== null || targetId !== void 0) && (cached === void 0 || Date.now() - (cached.fetchedAt || 0) > 12e4)) {
+						const refresh = () => fetchAccountQuota$1(quotaStore, fetchFn, false, targetId);
+						if (cached === void 0) await quotaRefresh.run(refresh);
+						else quotaRefresh.start(refresh);
+					}
 					return sendJson$3(response, 200, {
 						ok: true,
-						value: await readStatus()
+						value: {
+							...await readStatus(),
+							quotaRefreshing: quotaRefresh.refreshing
+						}
 					});
 				}
 				if (path === "login") {
 					if (method !== "POST") return sendMethodNotAllowed$3(response);
-					if (!isSameOriginMutation$3(request)) return sendJson$3(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$3(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -11893,7 +12384,7 @@ function registerCommandCodeRoutes(ctx, store, modelSettings, preferences, optio
 				}
 				if (path === "login/apikey") {
 					if (method !== "POST") return sendMethodNotAllowed$3(response);
-					if (!isSameOriginMutation$3(request)) return sendJson$3(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$3(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -11913,7 +12404,7 @@ function registerCommandCodeRoutes(ctx, store, modelSettings, preferences, optio
 				}
 				if (path === "connection/test") {
 					if (method !== "POST") return sendMethodNotAllowed$3(response);
-					if (!isSameOriginMutation$3(request)) return sendJson$3(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$3(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -11958,7 +12449,7 @@ function registerCommandCodeRoutes(ctx, store, modelSettings, preferences, optio
 						value: await readStatus()
 					});
 					if (method !== "POST") return sendMethodNotAllowed$3(response);
-					if (!isSameOriginMutation$3(request)) return sendJson$3(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$3(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -11986,7 +12477,7 @@ function registerCommandCodeRoutes(ctx, store, modelSettings, preferences, optio
 				}
 				if (path === "catalog/refresh") {
 					if (method !== "POST") return sendMethodNotAllowed$3(response);
-					if (!isSameOriginMutation$3(request)) return sendJson$3(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$3(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -12014,7 +12505,7 @@ function registerCommandCodeRoutes(ctx, store, modelSettings, preferences, optio
 						});
 					}
 					if (method !== "POST") return sendMethodNotAllowed$3(response);
-					if (!isSameOriginMutation$3(request)) return sendJson$3(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$3(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -12040,7 +12531,7 @@ function registerCommandCodeRoutes(ctx, store, modelSettings, preferences, optio
 				}
 				if (path === "logout") {
 					if (method !== "POST") return sendMethodNotAllowed$3(response);
-					if (!isSameOriginMutation$3(request)) return sendJson$3(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$3(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -13338,8 +13829,18 @@ async function modelRequestHeaders(accessToken, wire) {
 	});
 }
 let catalogCache = null;
+/**
+* Snapshot scopes already consulted in this process.
+*
+* One entry per region rather than a single flag: the persisted file is scoped
+* to the region it was fetched for (see `catalogSnapshotName`), so each region
+* consults its own file once, and a scope that has no snapshot is not re-read on
+* every cache miss.
+*/
+const catalogSnapshotScopesLoaded$1 = /* @__PURE__ */ new Set();
 function clearCachedCatalog$2() {
 	catalogCache = null;
+	catalogSnapshotScopesLoaded$1.clear();
 }
 /**
 * Read one model entry from the live catalog.
@@ -13389,10 +13890,34 @@ function parseCatalogModel(value) {
 * model. A caller that passes `accessToken` still keys the cache on the token,
 * because a different account can see a different listing.
 */
-async function loadProviderModels$1(options = {}) {
+function loadProviderModels$1(options = {}) {
+	return options.force === true ? refreshProviderModels(options) : cachedOrRevalidate(options);
+}
+async function cachedOrRevalidate(options) {
 	const region = options.region ?? await resolveRegion();
 	let accessToken = options.accessToken;
-	if (options.force !== true && catalogCache !== null && (accessToken === void 0 ? catalogCache.region === region : catalogCache.key === `${region}:${accessToken.slice(-8)}`) && Date.now() - catalogCache.fetchedAt < 18e5) return catalogCache.models;
+	if (catalogCache !== null && (accessToken === void 0 ? catalogCache.region === region : catalogCache.key === `${region}:${accessToken.slice(-8)}`) && Date.now() - catalogCache.fetchedAt < 18e5) return catalogCache.models;
+	if (catalogCache !== null && (accessToken === void 0 ? catalogCache.region === region : catalogCache.key === `${region}:${accessToken.slice(-8)}`)) {
+		refreshProviderModels(options).catch(() => void 0);
+		return catalogCache.models;
+	}
+	if (!catalogSnapshotScopesLoaded$1.has(region)) {
+		catalogSnapshotScopesLoaded$1.add(region);
+		if (await rehydrateCatalogCache(catalogSnapshotName("kimi-code", region), parsePersistedCatalogModels, (fetchedAt, models) => {
+			catalogCache = {
+				fetchedAt,
+				models,
+				key: `${region}:persisted`,
+				region
+			};
+		}, catalogCache?.fetchedAt ?? 0) > 0) {
+			refreshProviderModels({
+				...options,
+				region
+			}).catch(() => void 0);
+			return catalogCache.models;
+		}
+	}
 	if (accessToken === void 0) {
 		if (options.store === void 0) return [];
 		try {
@@ -13405,7 +13930,31 @@ async function loadProviderModels$1(options = {}) {
 		}
 	}
 	const cacheKey = `${region}:${accessToken.slice(-8)}`;
-	if (options.force !== true && catalogCache !== null && catalogCache.key === cacheKey && Date.now() - catalogCache.fetchedAt < 18e5) return catalogCache.models;
+	if (catalogCache !== null && catalogCache.key === cacheKey && Date.now() - catalogCache.fetchedAt < 18e5) return catalogCache.models;
+	return refreshProviderModels({
+		...options,
+		accessToken,
+		region
+	});
+}
+/** One in-flight, single-flighted fetch of the live listing. */
+function refreshProviderModels(options) {
+	return performListing(options);
+}
+async function performListing(options) {
+	const region = options.region ?? await resolveRegion();
+	let accessToken = options.accessToken;
+	if (accessToken === void 0) {
+		if (options.store === void 0) return [];
+		try {
+			accessToken = (await ensureAccessToken(options.store, {
+				fetchFn: options.fetchFn,
+				signal: options.signal
+			})).accessToken;
+		} catch {
+			return [];
+		}
+	}
 	const response = await (options.fetchFn ?? fetch)(openAIUrl(MODELS_PATH$1, region), {
 		headers: await kimiCodeHeaders(accessToken, "openai"),
 		signal: timeoutSignal$2(options.signal, DISCOVERY_TIMEOUT_MS$2)
@@ -13418,11 +13967,27 @@ async function loadProviderModels$1(options = {}) {
 	catalogCache = {
 		fetchedAt: Date.now(),
 		models,
-		key: cacheKey,
+		key: cacheKeyOf(region, accessToken),
 		region
 	};
+	writeCatalogSnapshot(catalogSnapshotName("kimi-code", region), models, catalogCache.fetchedAt);
 	return models;
 }
+function cacheKeyOf(region, accessToken) {
+	return `${region}:${accessToken.slice(-8)}`;
+}
+/** Shape check for a persisted snapshot.
+*
+* Entries are already in the parsed catalog shape, so they are accepted as
+* they are: routing them through `parseCatalogModel` again would drop every
+* one (that parser reads the raw listing's `context_length`, not the parsed
+* entry's `contextWindow`). Only the identity field is checked.
+*/
+function parsePersistedCatalogModels(value) {
+	if (!Array.isArray(value)) return void 0;
+	const models = value.filter((entry) => typeof entry === "object" && entry !== null && typeof entry.id === "string" && entry.id !== "" && typeof entry.contextWindow === "number" && entry.contextWindow > 0);
+	return models.length > 0 ? models : void 0;
+}
 /** Choose the wire dialect for one model, from the live catalog when it says. */
 function wireForCatalogEntry(modelId, catalog) {
 	if (catalog.find((model) => model.id === modelId)?.protocol === "anthropic") return "anthropic";
@@ -16219,17 +16784,6 @@ function sendMethodNotAllowed$2(response) {
 		error: "Method Not Allowed"
 	});
 }
-function isSameOriginMutation$2(request) {
-	const host = request.headers.host;
-	const origin = request.headers.origin;
-	if (typeof host !== "string" || host === "" || typeof origin !== "string" || origin === "") return false;
-	try {
-		const parsed = new URL(origin);
-		return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.host.toLowerCase() === host.toLowerCase();
-	} catch {
-		return false;
-	}
-}
 async function readRequestJson$2(request) {
 	return new Promise((resolve, reject) => {
 		const chunks = [];
@@ -16356,6 +16910,7 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 			credentials: target?.credentials
 		};
 	};
+	const quotaRefresh = new QuotaRefresh();
 	return ctx.webServer.register({
 		kind: "prefix",
 		path: ROUTE_PREFIX$2,
@@ -16367,29 +16922,29 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 					if (method !== "GET") return sendMethodNotAllowed$2(response);
 					const poolActive = await activeAccount();
 					const cached = getCachedQuotaFor(poolActive.id ?? null);
-					let quotaError = null;
-					if (poolActive.credentials !== void 0 && (cached === null || Date.now() - (cached.fetchedAt || 0) > 12e4)) try {
-						await fetchAccountQuota$2(store, {
+					if (poolActive.credentials !== void 0 && (cached === null || Date.now() - (cached.fetchedAt || 0) > 12e4)) {
+						const refresh = () => fetchAccountQuota$2(store, {
 							fetchFn,
 							...accountPool === void 0 ? {} : {
 								credentials: poolActive.credentials,
 								accountId: poolActive.id
 							}
 						});
-					} catch (error) {
-						quotaError = error instanceof Error ? error.message : String(error);
+						if (cached === null) await quotaRefresh.run(refresh);
+						else quotaRefresh.start(refresh);
 					}
 					return sendJson$2(response, 200, {
 						ok: true,
 						value: {
 							...await readStatus(),
-							quotaError
+							quotaError: quotaRefresh.lastError(),
+							quotaRefreshing: quotaRefresh.refreshing
 						}
 					});
 				}
 				if (path === "login") {
 					if (method !== "POST") return sendMethodNotAllowed$2(response);
-					if (!isSameOriginMutation$2(request)) return sendJson$2(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$2(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -16413,7 +16968,7 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "login/cancel") {
 					if (method !== "POST") return sendMethodNotAllowed$2(response);
-					if (!isSameOriginMutation$2(request)) return sendJson$2(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$2(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -16425,7 +16980,7 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "connection/test") {
 					if (method !== "POST") return sendMethodNotAllowed$2(response);
-					if (!isSameOriginMutation$2(request)) return sendJson$2(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$2(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -16452,7 +17007,7 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "quota") {
 					if (method !== "GET" && method !== "POST") return sendMethodNotAllowed$2(response);
-					if (method === "POST" && !isSameOriginMutation$2(request)) return sendJson$2(response, 403, {
+					if (method === "POST" && !isSameOriginMutation(request)) return sendJson$2(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -16493,7 +17048,7 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 						value: await readStatus()
 					});
 					if (method !== "POST") return sendMethodNotAllowed$2(response);
-					if (!isSameOriginMutation$2(request)) return sendJson$2(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$2(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -16521,7 +17076,7 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "catalog/refresh") {
 					if (method !== "POST") return sendMethodNotAllowed$2(response);
-					if (!isSameOriginMutation$2(request)) return sendJson$2(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$2(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -16552,7 +17107,7 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 						});
 					}
 					if (method !== "POST") return sendMethodNotAllowed$2(response);
-					if (!isSameOriginMutation$2(request)) return sendJson$2(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$2(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -16578,7 +17133,7 @@ function registerKimiCodeRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "logout") {
 					if (method !== "POST") return sendMethodNotAllowed$2(response);
-					if (!isSameOriginMutation$2(request)) return sendJson$2(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$2(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -18853,10 +19408,20 @@ let cachedCatalog$1;
 let catalogInFlight$1 = null;
 let catalogInFlightRegion$1 = null;
 const CATALOG_CACHE_TTL_MS$1 = 1800 * 1e3;
+/**
+* Snapshot scopes already consulted in this process.
+*
+* One entry per region rather than a single flag: the persisted file is scoped
+* to the region it was fetched for (see `catalogSnapshotName`), so each region
+* consults its own file once, and a scope with no snapshot is not re-read on
+* every cache miss.
+*/
+const catalogSnapshotScopesLoaded = /* @__PURE__ */ new Set();
 function clearCachedCatalog() {
 	cachedCatalog$1 = void 0;
 	catalogInFlight$1 = null;
 	catalogInFlightRegion$1 = null;
+	catalogSnapshotScopesLoaded.clear();
 }
 /**
 * Fetch the live catalog for one account.
@@ -18873,32 +19438,73 @@ async function fetchConfigCatalog(credentials, options = {}) {
 	if (!response.ok) throw new Error(`${PROVIDER_NAME$1} model catalog failed: ${response.status}`);
 	return parseConfigModels(await response.json(), credentials.region);
 }
-/** Cached catalog with a TTL; a failed refresh keeps the previous snapshot. */
+/** Cached catalog with a TTL; a failed refresh keeps the previous snapshot.
+*
+* On the first cache miss of a process the persisted snapshot is rehydrated
+* first, so a restart serves the previous listing without waiting on the
+* network. An expired snapshot still answers immediately (stale) while a
+* refresh runs in the background — the catalog is not fast-moving data, and
+* waiting on an unreachable gateway turned a restart into the full discovery
+* timeout on every model resolution.
+*/
 async function loadConfigCatalog(credentials, options = {}) {
-	if (!options.force && cachedCatalog$1 !== void 0 && cachedCatalog$1.region === credentials.region && Date.now() - cachedCatalog$1.fetchedAt < CATALOG_CACHE_TTL_MS$1) return cachedCatalog$1.models;
+	if (options.force === true) return refreshConfigCatalog(credentials, options);
+	if (cachedCatalog$1 !== void 0 && cachedCatalog$1.region === credentials.region && Date.now() - cachedCatalog$1.fetchedAt < CATALOG_CACHE_TTL_MS$1) return cachedCatalog$1.models;
+	if (cachedCatalog$1 !== void 0 && cachedCatalog$1.region === credentials.region) {
+		refreshConfigCatalog(credentials, options).catch(() => void 0);
+		return cachedCatalog$1.models;
+	}
+	if (!catalogSnapshotScopesLoaded.has(credentials.region)) {
+		catalogSnapshotScopesLoaded.add(credentials.region);
+		if (await rehydrateCatalogCache(catalogSnapshotName("workbuddy", credentials.region), (value) => {
+			if (!Array.isArray(value)) return void 0;
+			const models = [];
+			for (const entry of value) {
+				if (typeof entry !== "object" || entry === null) continue;
+				const record = entry;
+				if (typeof record.id !== "string" || record.id === "") continue;
+				if (!(Array.isArray(record.regions) ? record.regions : [record.region]).includes(credentials.region)) continue;
+				models.push(entry);
+			}
+			return models.length > 0 ? models : void 0;
+		}, (fetchedAt, models) => {
+			cachedCatalog$1 = {
+				region: credentials.region,
+				models,
+				fetchedAt
+			};
+		}, 0) > 0) {
+			refreshConfigCatalog(credentials, options).catch(() => void 0);
+			return cachedCatalog$1.models;
+		}
+	}
+	return refreshConfigCatalog(credentials, options);
+}
+/** One in-flight, single-flighted fetch of the live catalog. */
+function refreshConfigCatalog(credentials, options = {}) {
 	if (catalogInFlight$1 && catalogInFlightRegion$1 === credentials.region) return catalogInFlight$1;
 	const sameRegionCache = () => cachedCatalog$1?.region === credentials.region ? cachedCatalog$1.models : [];
 	const request = fetchConfigCatalog(credentials, options).then((models) => {
 		if (models.length > 0) {
+			const fetchedAt = Date.now();
 			cachedCatalog$1 = {
 				region: credentials.region,
 				models,
-				fetchedAt: Date.now()
+				fetchedAt
 			};
+			writeCatalogSnapshot(catalogSnapshotName("workbuddy", credentials.region), models, fetchedAt);
 			return models;
 		}
 		return sameRegionCache();
 	}).catch(() => sameRegionCache());
 	catalogInFlight$1 = request;
 	catalogInFlightRegion$1 = credentials.region;
-	try {
-		return await request;
-	} finally {
+	return request.finally(() => {
 		if (catalogInFlight$1 === request) {
 			catalogInFlight$1 = null;
 			catalogInFlightRegion$1 = null;
 		}
-	}
+	});
 }
 function formatAmount$1(value) {
 	if (value === void 0 || !Number.isFinite(value)) return null;
@@ -19300,17 +19906,6 @@ function sendMethodNotAllowed$1(response) {
 		error: "Method Not Allowed"
 	});
 }
-function isSameOriginMutation$1(request) {
-	const host = request.headers.host;
-	const origin = request.headers.origin;
-	if (typeof host !== "string" || host === "" || typeof origin !== "string" || origin === "") return false;
-	try {
-		const parsed = new URL(origin);
-		return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.host.toLowerCase() === host.toLowerCase();
-	} catch {
-		return false;
-	}
-}
 async function readRequestJson$1(request) {
 	return new Promise((resolve, reject) => {
 		const chunks = [];
@@ -19426,6 +20021,7 @@ async function getWorkBuddyWebStatus(store, modelSettings, preferences, options
 /** Register the WorkBuddy settings routes under `/workbuddy/api`. */
 function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options = {}) {
 	const fetchFn = options.fetchFn ?? fetch;
+	const quotaRefresh = new QuotaRefresh();
 	const disposeRoutes = ctx.webServer.register({
 		kind: "prefix",
 		path: ROUTE_PREFIX$1,
@@ -19449,11 +20045,16 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 					const quotaMatches = cached?.account.id === (credentials === null ? void 0 : accountFromCredentials$1(credentials).id);
 					if (credentials !== null && (!quotaMatches || cached === void 0 || Date.now() - (cached.fetchedAt || 0) > 12e4)) {
 						if (!quotaMatches) clearCachedQuota$3();
-						await fetchAccountQuota$3(store, fetchFn, false, settings.selectedAccountId, settings.hiddenAccountIds).catch(() => void 0);
+						const refresh = () => fetchAccountQuota$3(store, fetchFn, false, settings.selectedAccountId, settings.hiddenAccountIds);
+						if (cached === void 0 || !quotaMatches) await quotaRefresh.run(refresh);
+						else quotaRefresh.start(refresh);
 					}
 					return sendJson$1(response, 200, {
 						ok: true,
-						value: await getWorkBuddyWebStatus(store, modelSettings, preferences, options)
+						value: {
+							...await getWorkBuddyWebStatus(store, modelSettings, preferences, options),
+							quotaRefreshing: quotaRefresh.refreshing
+						}
 					});
 				}
 				if (path === "accounts") {
@@ -19477,7 +20078,7 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "accounts/login") {
 					if (method !== "POST") return sendMethodNotAllowed$1(response);
-					if (!isSameOriginMutation$1(request)) return sendJson$1(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$1(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -19505,7 +20106,7 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "accounts/action") {
 					if (method !== "POST") return sendMethodNotAllowed$1(response);
-					if (!isSameOriginMutation$1(request)) return sendJson$1(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$1(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -19633,7 +20234,7 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "quota") {
 					if (method !== "GET" && method !== "POST") return sendMethodNotAllowed$1(response);
-					if (method === "POST" && !isSameOriginMutation$1(request)) return sendJson$1(response, 403, {
+					if (method === "POST" && !isSameOriginMutation(request)) return sendJson$1(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -19646,7 +20247,7 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "connection/test") {
 					if (method !== "POST") return sendMethodNotAllowed$1(response);
-					if (!isSameOriginMutation$1(request)) return sendJson$1(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$1(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -19711,7 +20312,7 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 						value: await getWorkBuddyWebStatus(store, modelSettings, preferences, options)
 					});
 					if (method !== "POST") return sendMethodNotAllowed$1(response);
-					if (!isSameOriginMutation$1(request)) return sendJson$1(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$1(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -19760,7 +20361,7 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "catalog/refresh") {
 					if (method !== "POST") return sendMethodNotAllowed$1(response);
-					if (!isSameOriginMutation$1(request)) return sendJson$1(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$1(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -19787,7 +20388,7 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "accounts/strategy") {
 					if (method !== "POST") return sendMethodNotAllowed$1(response);
-					if (!isSameOriginMutation$1(request)) return sendJson$1(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$1(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -19809,7 +20410,7 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "checkin/now") {
 					if (method !== "POST") return sendMethodNotAllowed$1(response);
-					if (!isSameOriginMutation$1(request)) return sendJson$1(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$1(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -19826,7 +20427,7 @@ function registerWorkBuddyRoutes(ctx, store, modelSettings, preferences, options
 				}
 				if (path === "rescan") {
 					if (method !== "POST") return sendMethodNotAllowed$1(response);
-					if (!isSameOriginMutation$1(request)) return sendJson$1(response, 403, {
+					if (!isSameOriginMutation(request)) return sendJson$1(response, 403, {
 						ok: false,
 						error: "Cross-origin request rejected."
 					});
@@ -22168,17 +22769,6 @@ function sendMethodNotAllowed(response) {
 		error: "Method Not Allowed"
 	});
 }
-function isSameOriginMutation(request) {
-	const host = request.headers.host;
-	const origin = request.headers.origin;
-	if (typeof host !== "string" || host === "" || typeof origin !== "string" || origin === "") return false;
-	try {
-		const parsed = new URL(origin);
-		return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.host.toLowerCase() === host.toLowerCase();
-	} catch {
-		return false;
-	}
-}
 async function readRequestJson(request) {
 	return new Promise((resolve, reject) => {
 		const chunks = [];
@@ -22282,6 +22872,7 @@ async function getZhipuWebStatus(store, modelSettings, preferences, options = {}
 function registerZhipuRoutes(ctx, store, modelSettings, preferences, options = {}) {
 	const fetchFn = options.fetchFn ?? fetch;
 	const readStatus = (quotaError = null) => getZhipuWebStatus(store, modelSettings, preferences, options, quotaError);
+	const quotaRefresh = new QuotaRefresh();
 	return ctx.webServer.register({
 		kind: "prefix",
 		path: ROUTE_PREFIX,
@@ -22295,18 +22886,19 @@ function registerZhipuRoutes(ctx, store, modelSettings, preferences, options = {
 					const cached = getCachedQuota$4();
 					const accountId = credentials === null ? null : zhipuAccountKey(credentials);
 					const stale = cached === void 0 || cached.account.id !== accountId || Date.now() - (cached.fetchedAt || 0) > 12e4;
-					let quotaError = null;
+					const accountMatches = cached !== void 0 && cached.account.id === accountId;
 					if (credentials !== null && stale) {
-						if (cached !== void 0 && cached.account.id !== accountId) clearCachedQuota$4();
-						try {
-							await fetchAccountQuota$4(credentials, { fetchFn });
-						} catch (error) {
-							quotaError = error instanceof Error ? error.message : String(error);
-						}
+						if (!accountMatches) clearCachedQuota$4();
+						const refresh = () => fetchAccountQuota$4(credentials, { fetchFn });
+						if (accountMatches) quotaRefresh.start(refresh);
+						else await quotaRefresh.run(refresh);
 					}
 					return sendJson(response, 200, {
 						ok: true,
-						value: await readStatus(quotaError)
+						value: {
+							...await readStatus(quotaRefresh.lastError()),
+							quotaRefreshing: quotaRefresh.refreshing
+						}
 					});
 				}
 				/**