@rynfar/meridian 1.70.0 → 1.71.0

package/dist/{cli-198xnjcn.js → cli-6c6dj69q.js}

@@ -6870,6 +6870,13 @@ function ordinalSuffix(n) {
 function linkRequestAbort(signal) {
   const controller = new AbortController;
   let attached = false;
+  const linkedAt = Date.now();
+  let cause;
+  const classify = () => {
+    if (!controller.signal.aborted)
+      return "none";
+    return cause ?? "unknown_abort";
+  };
   const abort = (reason) => {
     if (!controller.signal.aborted)
       controller.abort(reason);
@@ -6889,6 +6896,19 @@ function linkRequestAbort(signal) {
         return;
       signal.removeEventListener("abort", forwardAbort);
       attached = false;
+    },
+    setCause: (labeled) => {
+      cause ??= labeled;
+    },
+    abortSnapshot: () => {
+      const snapshot = {
+        cause: classify(),
+        aborted: controller.signal.aborted
+      };
+      if (controller.signal.aborted) {
+        snapshot.elapsedMs = Math.max(0, Date.now() - linkedAt);
+      }
+      return snapshot;
     }
   };
 }
@@ -23873,6 +23893,45 @@ function canRecoverCapturedToolUses(input) {
       return false;
   }
 }
+function isStreamedToolBlockComplete(record2) {
+  if (!record2.forwardedStart)
+    return false;
+  if (!record2.naturalStop)
+    return false;
+  if (record2.startedInputObject)
+    return true;
+  if (!record2.json.trim())
+    return false;
+  try {
+    const parsed = JSON.parse(record2.json);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed);
+  } catch {
+    return false;
+  }
+}
+function canRecoverUncapturedToolUses(input) {
+  if (!input.uncapturedRecoveryEnabled)
+    return false;
+  if (!input.passthrough)
+    return false;
+  if (input.reason !== "max_turns")
+    return false;
+  if (input.attemptedMaxTurns !== 1)
+    return false;
+  if (input.capturedToolUses > 0)
+    return false;
+  if (input.streamedToolUses <= 0)
+    return false;
+  if (input.droppedToolUseIds > 0)
+    return false;
+  if (input.sawDuplicateToolUse)
+    return false;
+  if (input.forceSingleToolUse)
+    return false;
+  if (input.earlyStopFired)
+    return false;
+  return true;
+}
 function extractSdkTermination(errMsg) {
   const stderrTail = extractStderrTail(errMsg);
   const haystack = `${errMsg}
@@ -23937,6 +23996,9 @@ function formatSdkTermination(t, ctx) {
     parts.push(`deferred=${ctx.hasDeferredTools}`);
   if (ctx.sdkSessionId)
     parts.push(`session=${ctx.sdkSessionId.slice(0, 8)}`);
+  if (ctx.abort) {
+    parts.push(`abort=${ctx.abort.cause}`);
+  }
   if (t.rawTail)
     parts.push(`raw=${JSON.stringify(t.rawTail)}`);
   if (t.stderrTail)
@@ -36925,6 +36987,7 @@ function createProxyServer(config2 = {}) {
   let durableWritesRevoked = false;
   let inFlightRequests = 0;
   const activeRequestAborts = new Set;
+  const activeShutdownLabels = new Map;
   const internalHopToken = randomUUID6();
   const errorEnvelope = (shape, type, message) => shape === "anthropic" ? { type: "error", error: { type, message } } : { error: { type, message, code: null } };
   const DRAIN_MESSAGE = "Meridian is shutting down and is not accepting new requests. Retry against another instance.";
@@ -37216,6 +37279,7 @@ function createProxyServer(config2 = {}) {
         body: options.body,
         forcedProfileId: candidate,
         turnWatchdogSignal: options.turnWatchdogSignal,
+        requestAbortLink: options.requestAbortLink,
         forceFreshPriorityReplay: priorityPublication !== undefined && (options.durableRoute?.forceFreshReplay === true || options.currentProfileId !== undefined && candidate !== options.currentProfileId),
         priorityPublication,
         priorityAttemptExposure: exposure
@@ -37293,7 +37357,7 @@ data: ${JSON.stringify(lastError)}
   const handleMessages = async (c, requestMeta, options) => {
     const requestStartAt = requestMeta.queueEnteredAt;
     const requestSignal = options.turnWatchdogSignal ? AbortSignal.any([c.req.raw.signal, options.turnWatchdogSignal]) : c.req.raw.signal;
-    const requestAbort = linkRequestAbort(requestSignal);
+    const requestAbort = options.requestAbortLink ?? linkRequestAbort(requestSignal);
     let streamOwnsAbortLink = false;
     return withClaudeLogContext({ requestId: requestMeta.requestId, endpoint: requestMeta.endpoint }, async () => {
       const adapter = detectAdapter(c);
@@ -37628,6 +37692,7 @@ data: ${JSON.stringify(lastError)}
                 wantsStream: body.stream === true,
                 currentProfileId: assignedProfile,
                 turnWatchdogSignal: options.turnWatchdogSignal,
+                requestAbortLink: options.requestAbortLink,
                 publicationTurn,
                 claimTurn: trustedTurn,
                 durableRoute
@@ -38310,6 +38375,7 @@ data: ${JSON.stringify(lastError)}
                   name: toolName,
                   reason: exceedsForcedSingle ? "forced_single" : "same_tool_repeat"
                 });
+                requestAbort.setCause("passthrough_single_step");
                 requestAbort.abort("passthrough single-step complete");
               } else {
                 capturedSignatures.add(signature);
@@ -38880,7 +38946,8 @@ Subprocess stderr: ${stderrOutput}`;
                 requestSource,
                 isResume,
                 hasDeferredTools,
-                sdkSessionId: currentSessionId || resumeSessionId
+                sdkSessionId: currentSessionId || resumeSessionId,
+                abort: requestAbort.abortSnapshot()
               })} captured=${capturedToolUses.length}`, requestMeta.requestId);
               claudeLog("passthrough.max_turns_recovered", {
                 mode: "non_stream",
@@ -39165,11 +39232,14 @@ Subprocess stderr: ${stderrOutput}`;
               let nextPassthroughToolCallAssistantUuid;
               let nextPassthroughToolCallIds;
               let sawCanonicalResult = false;
+              const uncapturedToolRecoveryEnabled = env("PASSTHROUGH_UNCAPTURED_TOOL_RECOVERY") === "1";
+              const streamedToolBlockRecords = new Map;
               const silentTurnRecoveryEnabled = env("SILENT_TURN_RECOVERY") !== "0";
               let silentTurnRecoveryAttempted = false;
               let silentTurnRecovered = false;
               const streamedToolUseIds = new Set;
               let pendingTerminalDelta = null;
+              let lastAttemptMaxTurns;
               let pendingStructuredFrames = [];
               let pendingStructuredTextLength = 0;
               let terminalDeltaSent = false;
@@ -39313,6 +39383,7 @@ data: ${JSON.stringify({ type: "content_block_stop", index: idx })}
                         advisorModel
                       }, requestAbort.controller);
                       attemptMaxTurns = attemptQuery.options.maxTurns;
+                      lastAttemptMaxTurns = attemptMaxTurns;
                       for await (const event of runSdkQueryAttempt(attemptQuery, requestAbort.controller.signal, requestMeta, "stream", managedSdkAttemptLocators())) {
                         if (event.type === "rate_limit_event") {
                           rateLimitStore.record(profile.id, event.rate_limit_info);
@@ -39760,6 +39831,9 @@ data: ${JSON.stringify({ type: "content_block_stop", index: idx })}
                         if (eventType === "content_block_stop") {
                           flushToolArguments(clientIdx);
                           passthroughToolBlockNames.delete(eventIndex);
+                          const record3 = streamedToolBlockRecords.get(clientIdx);
+                          if (record3)
+                            record3.naturalStop = true;
                         }
                       }
                       if (eventType === "content_block_delta" && event.delta?.type === "text_delta" && shouldInjectSilentTurn({
@@ -39793,6 +39867,34 @@ data: ${JSON.stringify(event)}
                         if (typeof idx === "number")
                           openClientBlocks.delete(idx);
                       }
+                      if (passthrough && uncapturedToolRecoveryEnabled) {
+                        const clientIdx = eventIndex !== undefined ? sdkToClientIndex.get(eventIndex) ?? eventIndex : undefined;
+                        if (clientIdx !== undefined) {
+                          if (eventType === "content_block_start") {
+                            const block = event.content_block;
+                            if (block?.type === "tool_use" && typeof block?.id === "string" && block.id) {
+                              streamedToolBlockRecords.set(clientIdx, {
+                                id: block.id,
+                                name: block.name,
+                                json: "",
+                                startedInputObject: block.input !== undefined && block.input !== null,
+                                forwardedStart: true,
+                                naturalStop: false
+                              });
+                            }
+                          } else if (eventType === "content_block_delta") {
+                            const delta = event.delta;
+                            const record3 = streamedToolBlockRecords.get(clientIdx);
+                            if (record3 && delta?.type === "input_json_delta" && typeof delta.partial_json === "string") {
+                              record3.json += delta.partial_json;
+                            }
+                          } else if (eventType === "content_block_stop") {
+                            const record3 = streamedToolBlockRecords.get(clientIdx);
+                            if (record3)
+                              record3.naturalStop = true;
+                          }
+                        }
+                      }
                       if (passthrough && eventType === "message_delta" && event.delta?.stop_reason === "tool_use" && streamedToolUseIds.size > 0) {
                         flushOpenClientBlocks("drain_close");
                         if (earlyStopEnabled) {
@@ -40469,8 +40571,40 @@ Subprocess stderr: ${stderrOutput}`;
                   capturedToolUses: capturedToolUses.length,
                   abortIsOurs: sawDuplicateToolUse
                 }) && messageStartEmitted;
+                const uncapturedEligible = (() => {
+                  if (!canRecoverUncapturedToolUses({
+                    reason: sdkTerm.reason,
+                    passthrough,
+                    capturedToolUses: capturedToolUses.length,
+                    streamedToolUses: streamedToolUseIds.size,
+                    droppedToolUseIds: droppedToolUseIds.size,
+                    sawDuplicateToolUse,
+                    forceSingleToolUse,
+                    earlyStopFired,
+                    uncapturedRecoveryEnabled: uncapturedToolRecoveryEnabled,
+                    attemptedMaxTurns: lastAttemptMaxTurns
+                  }))
+                    return false;
+                  if (!messageStartEmitted || streamClosed || pendingTerminalDelta)
+                    return false;
+                  if (durableWritesRevoked)
+                    return false;
+                  if (requestAbort.abortSnapshot().aborted)
+                    return false;
+                  for (const record3 of streamedToolBlockRecords.values()) {
+                    if (!isStreamedToolBlockComplete(record3))
+                      return false;
+                    const declared = requestTools.some((t) => t.name === record3.name);
+                    if (!declared)
+                      return false;
+                  }
+                  if (streamedToolBlockRecords.size !== streamedToolUseIds.size)
+                    return false;
+                  return true;
+                })();
+                const uncapturedRecoveryActive = uncapturedEligible;
                 const recoverableCheckpoint = canRecoverAsToolUse && sdkTerm.reason === "max_turns" && Boolean(currentSessionId) && Boolean(nextPassthroughToolCallAssistantUuid) && Boolean(nextPassthroughToolCallIds?.length) && earlyStopFired && !isIndependentSession && !sawDuplicateToolUse;
-                const mustEvictBeforeRecoveredTerminal = !isIndependentSession && canRecoverAsToolUse && !recoverableCheckpoint;
+                const mustEvictBeforeRecoveredTerminal = !isIndependentSession && canRecoverAsToolUse && !recoverableCheckpoint || !isIndependentSession && uncapturedRecoveryActive && !recoverableCheckpoint;
                 if (mustEvictBeforeRecoveredTerminal || !isIndependentSession && passthrough && streamedToolUseIds.size > 0 && !sawCanonicalResult && !recoverableCheckpoint) {
                   const evicted = evictSession2(profileSessionId, profileScopedCwd, lineageMessages, mappingExpectedGeneration);
                   if (mustEvictBeforeRecoveredTerminal && !evicted) {
@@ -40478,15 +40612,16 @@ Subprocess stderr: ${stderrOutput}`;
                   }
                   claudeLog("passthrough.noncanonical_session_evicted", { mode: "stream", reason: "drain_error" });
                 }
-                if (canRecoverAsToolUse) {
+                if (canRecoverAsToolUse || uncapturedRecoveryActive) {
                   idleStalls.clear(idleStallSessionKey);
-                  diagnosticLog2.session(`${requestMeta.requestId} sdk_termination_recovered ${formatSdkTermination(sdkTerm, {
+                  diagnosticLog2.session(`${requestMeta.requestId} sdk_termination_recovered${uncapturedRecoveryActive ? "_uncaptured" : ""} ${formatSdkTermination(sdkTerm, {
                     model,
                     requestSource,
                     isResume,
                     hasDeferredTools,
-                    sdkSessionId: currentSessionId || resumeSessionId
-                  })} captured=${capturedToolUses.length}`, requestMeta.requestId);
+                    sdkSessionId: currentSessionId || resumeSessionId,
+                    abort: requestAbort.abortSnapshot()
+                  })} captured=${capturedToolUses.length}${uncapturedRecoveryActive ? ` completed=${streamedToolBlockRecords.size}` : ""}`, requestMeta.requestId);
                   flushOpenClientBlocks("recovery");
                   const unseenToolUses = capturedToolUses.filter((tu) => !streamedToolUseIds.has(tu.id));
                   for (let i = 0;i < unseenToolUses.length; i++) {
@@ -40627,7 +40762,8 @@ data: {"type":"message_stop"}
                     requestSource,
                     isResume,
                     hasDeferredTools,
-                    sdkSessionId: currentSessionId || resumeSessionId
+                    sdkSessionId: currentSessionId || resumeSessionId,
+                    abort: requestAbort.abortSnapshot()
                   })} blocks=${nextClientBlockIndex}`, requestMeta.requestId);
                   claudeLog("passthrough.capped_turn_truncated", {
                     mode: "stream",
@@ -40700,7 +40836,8 @@ data: {"type":"message_stop"}
                   requestSource,
                   isResume,
                   hasDeferredTools,
-                  sdkSessionId: currentSessionId || resumeSessionId
+                  sdkSessionId: currentSessionId || resumeSessionId,
+                  abort: requestAbort.abortSnapshot()
                 })} envelope=${messageStartEmitted ? "open" : "unopened"} blocks=${contentBlocksForwarded} ` + `text=${textEventsForwarded} tools=${capturedToolUses.length}/${streamedToolUseIds.size}`, requestMeta.requestId);
                 const streamErrTotalMs = Date.now() - requestStartAt;
                 const streamErrQueueWaitMs = totalQueueWaitMs(requestMeta);
@@ -40780,15 +40917,18 @@ data: ${JSON.stringify({
                 await abandonManagedFork("stream_complete_without_commit");
                 if (priorityRollbackRetirement)
                   await priorityRollbackRetirement;
-                requestAbort.detach();
+                if (!streamOwnsAbortLink)
+                  requestAbort.detach();
               }
             })().finally(() => {
               resolveStreamCompletion();
             });
           },
           cancel(reason) {
+            requestAbort.setCause("stream_cancel");
             requestAbort.abort(reason);
-            requestAbort.detach();
+            if (!streamOwnsAbortLink)
+              requestAbort.detach();
             requestMeta.cascadeSubtreeCancel?.("stream_cancel");
             if (!isIndependentSession && (!managedForkTarget || managedForkPublished || clientAssistantContentExposed)) {
               evictSession2(profileSessionId, profileScopedCwd, lineageMessages, mappingExpectedGeneration);
@@ -40821,7 +40961,8 @@ data: ${JSON.stringify({
         claudeLog("proxy.error", { error: errMsg, classified: classified.type });
         const sdkTerm = extractSdkTermination(errMsg);
         diagnosticLog2.error(`${requestMeta.requestId} ${formatSdkTermination(sdkTerm, {
-          requestSource: c.req.header("x-meridian-source")?.slice(0, 64) || undefined
+          requestSource: c.req.header("x-meridian-source")?.slice(0, 64) || undefined,
+          abort: requestAbort.abortSnapshot()
         })}`, requestMeta.requestId);
         const errorQueueWaitMs = totalQueueWaitMs(requestMeta);
         const errorTotalMs = Date.now() - requestStartAt;
@@ -40908,6 +41049,14 @@ data: ${JSON.stringify({
     };
     const turnWatchdogAbort = new AbortController;
     activeRequestAborts.add(turnWatchdogAbort);
+    const requestSignalForLink = AbortSignal.any([c.req.raw.signal, turnWatchdogAbort.signal]);
+    const labelClientAbort = () => {
+      if (!turnWatchdogAbort.signal.aborted)
+        requestAbortLink?.setCause("client_abort");
+    };
+    c.req.raw.signal.addEventListener("abort", labelClientAbort, { once: true });
+    const requestAbortLink = linkRequestAbort(requestSignalForLink);
+    activeShutdownLabels.set(turnWatchdogAbort, () => requestAbortLink.setCause("process_shutdown"));
     let finished = false;
     let leaseReleased = false;
     let retainSessionTurnFence = false;
@@ -40936,6 +41085,8 @@ data: ${JSON.stringify({
       if (finished)
         return;
       finished = true;
+      requestAbortLink.detach();
+      c.req.raw.signal.removeEventListener("abort", labelClientAbort);
       if (retainSessionTurnFence && (sessionTurnLease || crossProcessTurnLease)) {
         leaseReleased = true;
         if (leaseWatchdog)
@@ -40950,6 +41101,7 @@ data: ${JSON.stringify({
       sessionTreeRegistration?.release();
       sessionTreeRegistration = undefined;
       activeRequestAborts.delete(turnWatchdogAbort);
+      activeShutdownLabels.delete(turnWatchdogAbort);
       inFlightRequests--;
     };
     let body;
@@ -40981,7 +41133,10 @@ data: ${JSON.stringify({
             requestId,
             sessionKey: agentSessionId,
             parentKey: adapter.getParentSessionId?.(c, body),
-            abort: (reason) => turnWatchdogAbort.abort(reason)
+            abort: (reason) => {
+              requestAbortLink.setCause("subtree_cancel");
+              turnWatchdogAbort.abort(reason);
+            }
           });
           subtreeSessionKey = agentSessionId;
           const clientSignal = c.req.raw.signal;
@@ -41002,6 +41157,7 @@ data: ${JSON.stringify({
             leaseWatchdog = setTimeout(() => {
               claudeLog("session.turn_watchdog_abort", { requestId, heldMs: SESSION_TURN_MAX_HOLD_MS });
               plog(`[PROXY] ${requestId} session turn exceeded ${SESSION_TURN_MAX_HOLD_MS}ms — aborting without releasing its fencing lease`);
+              requestAbortLink.setCause("session_watchdog");
               turnWatchdogAbort.abort(new Error("Session turn exceeded its maximum hold time"));
             }, SESSION_TURN_MAX_HOLD_MS);
             leaseWatchdog.unref?.();
@@ -41076,7 +41232,8 @@ data: ${JSON.stringify({
       };
       const response = await handleMessages(c, requestMeta, {
         body,
-        turnWatchdogSignal: turnWatchdogAbort.signal
+        turnWatchdogSignal: turnWatchdogAbort.signal,
+        requestAbortLink
       });
       const completion = responseCompletions.get(response);
       if (completion) {
@@ -41901,6 +42058,8 @@ data: ${JSON.stringify({ response: { id: responseId, status: "failed", error: {
     },
     forceAbortInFlight: () => {
       durableWritesRevoked = true;
+      for (const label of activeShutdownLabels.values())
+        label();
       for (const controller of activeRequestAborts) {
         controller.abort(new Error("Proxy shutdown grace period elapsed"));
       }

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   startProxyServer
-} from "./cli-198xnjcn.js";
+} from "./cli-6c6dj69q.js";
 import"./cli-5jxyma6z.js";
 import"./cli-sry5aqdj.js";
 import"./cli-8yp89fan.js";

package/dist/meridian/index.js

@@ -13,9 +13,12 @@ var MAX_HEADER_BYTES = 768;
 var MAX_PAYLOAD_BYTES = 384;
 var TURN_DIGEST_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 var SAFE_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
-function configDirectory() {
+function meridianConfigDirectory() {
   return process.env.MERIDIAN_CONFIG_DIR ?? join(homedir(), ".config", "meridian");
 }
+function configDirectory() {
+  return meridianConfigDirectory();
+}
 function priorityAttestationKeyPath() {
   return join(configDirectory(), PRIORITY_ATTESTATION_KEY_FILE);
 }

package/dist/meridian-v2/index.js

@@ -20192,6 +20192,10 @@ var Info6 = exports_Schema.Struct({
   })
 })));
 
+// plugin/meridian-v2.ts
+import { readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join as join3 } from "node:path";
+
 // plugin/priority-attestation.ts
 import { createHash, createHmac } from "node:crypto";
 import { readFileSync } from "node:fs";
@@ -20207,9 +20211,12 @@ var MAX_HEADER_BYTES = 768;
 var MAX_PAYLOAD_BYTES = 384;
 var TURN_DIGEST_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 var SAFE_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
-function configDirectory() {
+function meridianConfigDirectory() {
   return process.env.MERIDIAN_CONFIG_DIR ?? join2(homedir(), ".config", "meridian");
 }
+function configDirectory() {
+  return meridianConfigDirectory();
+}
 function priorityAttestationKeyPath() {
   return join2(configDirectory(), PRIORITY_ATTESTATION_KEY_FILE);
 }
@@ -20307,6 +20314,9 @@ var PARENT_SESSION_ONE_SHOTS = new Set(["title", "summary"]);
 var ATTACHED_COMPACTION_AGENT = "compaction";
 var MODEL_DISCOVERY_TIMEOUT_MS = 3000;
 var PROVIDER_READY_POLL_MS = 25;
+var CATALOG_CACHE_FILE = "opencode-v2-catalog.json";
+var CATALOG_CACHE_VERSION = 1;
+var CATALOG_CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 var MERIDIAN_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
 var SESSION_AFFINITY_HEADERS = [
   "x-opencode-session",
@@ -20465,15 +20475,109 @@ async function loadMeridianModels(catalog, signal, fetcher = globalThis.fetch) {
     if (configured.length > 0) {
       const discovered = await Promise.all(configured.map(async ({ providerID, baseURL }) => {
         const models = await fetchMeridianModels(baseURL, signal, fetcher);
-        return models ? { providerID, models } : undefined;
+        return models ? { providerID, baseURL: typeof baseURL === "string" ? baseURL : undefined, models } : undefined;
       }));
-      return discovered.flatMap((result3) => result3 ? [result3] : []);
+      return {
+        configured: configured.map((provider) => provider.providerID),
+        discovered: discovered.flatMap((result3) => result3 ? [result3] : [])
+      };
     }
     if (Date.now() >= deadline)
-      return [];
+      return { configured: [], discovered: [] };
     await new Promise((resolve2) => setTimeout(resolve2, PROVIDER_READY_POLL_MS));
   }
-  return [];
+  return { configured: [], discovered: [] };
+}
+function catalogCachePath() {
+  return join3(meridianConfigDirectory(), CATALOG_CACHE_FILE);
+}
+function parseCatalogCache(value3, now3) {
+  const entries3 = new Map;
+  if (!isRecord(value3) || value3.version !== CATALOG_CACHE_VERSION)
+    return entries3;
+  if (!isRecord(value3.providers))
+    return entries3;
+  for (const [providerID, entry] of Object.entries(value3.providers)) {
+    if (!MERIDIAN_PROVIDERS.has(providerID) || !isRecord(entry))
+      continue;
+    const { baseURL, fetchedAt } = entry;
+    if (typeof baseURL !== "string" || meridianModelsURL(baseURL) === undefined)
+      continue;
+    if (typeof fetchedAt !== "number" || !Number.isSafeInteger(fetchedAt) || fetchedAt <= 0)
+      continue;
+    if (fetchedAt > now3 || now3 - fetchedAt > CATALOG_CACHE_TTL_MS)
+      continue;
+    const models = parseCachedModels(entry.models);
+    if (!models || models.length === 0)
+      continue;
+    entries3.set(providerID, { baseURL, models });
+  }
+  return entries3;
+}
+function parseCachedModels(value3) {
+  if (!Array.isArray(value3))
+    return;
+  const models = [];
+  const ids = new Set;
+  for (const item of value3) {
+    if (!isRecord(item))
+      return;
+    const { id: id2, name, contextWindow, efforts } = item;
+    if (typeof id2 !== "string" || id2.length === 0 || id2.length > 256 || /[^\x21-\x7E]/.test(id2) || ids.has(id2) || typeof name !== "string" || name.trim().length === 0 || name.length > 256 || typeof contextWindow !== "number" || !Number.isSafeInteger(contextWindow) || contextWindow <= 0 || !Array.isArray(efforts) || efforts.some((effort) => typeof effort !== "string" || !MERIDIAN_EFFORTS.includes(effort))) {
+      return;
+    }
+    ids.add(id2);
+    models.push({ id: id2, name, contextWindow, efforts });
+  }
+  return models;
+}
+function serializeCatalogCache(discovered, now3) {
+  const providers = {};
+  for (const entry of discovered) {
+    if (typeof entry.baseURL !== "string" || entry.models.length === 0)
+      continue;
+    providers[entry.providerID] = { baseURL: entry.baseURL, fetchedAt: now3, models: entry.models };
+  }
+  return `${JSON.stringify({ version: CATALOG_CACHE_VERSION, providers }, null, 2)}
+`;
+}
+function removeCatalogCache(remove4 = (path) => rmSync(path, { force: true })) {
+  try {
+    remove4(catalogCachePath());
+  } catch {}
+}
+function readCatalogCache(now3, read = (path) => readFileSync2(path, "utf-8")) {
+  try {
+    return parseCatalogCache(JSON.parse(read(catalogCachePath())), now3);
+  } catch {
+    return new Map;
+  }
+}
+function writeCatalogCache(discovered, now3, write = (path, contents) => {
+  const temporary = `${path}.${process.pid}.tmp`;
+  writeFileSync(temporary, contents, { encoding: "utf-8", mode: 384 });
+  renameSync(temporary, path);
+}) {
+  try {
+    const contents = serializeCatalogCache(discovered, now3);
+    if (contents.includes('"providers": {}'))
+      return;
+    write(catalogCachePath(), contents);
+  } catch {}
+}
+function resolveCatalogModels(catalog, discovered, cached3) {
+  if (discovered.length > 0)
+    return [...discovered];
+  const seeded = [];
+  for (const providerID of MERIDIAN_PROVIDERS) {
+    const entry = cached3.get(providerID);
+    if (!entry)
+      continue;
+    if (!catalog.provider.get(providerID))
+      continue;
+    seeded.push({ providerID, baseURL: entry.baseURL, models: [...entry.models] });
+  }
+  return seeded;
 }
 function applyMeridianModels(catalog, providerID, models) {
   for (const model of models) {
@@ -20533,19 +20637,31 @@ var MeridianV2Plugin = define({
     const modelDiscoveryController = new AbortController;
     let discoveredModels = [];
     let discoveryStarted = false;
+    const cachedModels = readCatalogCache(Date.now());
     registered.push(await context3.catalog.transform((catalog) => {
-      for (const discovered of discoveredModels) {
-        applyMeridianModels(catalog, discovered.providerID, discovered.models);
+      for (const entry of resolveCatalogModels(catalog, discoveredModels, cachedModels)) {
+        applyMeridianModels(catalog, entry.providerID, entry.models);
       }
     }));
     const discoverModels = async () => {
       if (discoveryStarted || modelDiscoveryController.signal.aborted)
         return false;
-      const models = await loadMeridianModels(context3.catalog, modelDiscoveryController.signal).catch(() => []);
-      if (models.length === 0 || modelDiscoveryController.signal.aborted)
+      const loaded = await loadMeridianModels(context3.catalog, modelDiscoveryController.signal).catch(() => ({ configured: [], discovered: [] }));
+      if (modelDiscoveryController.signal.aborted)
+        return false;
+      if (loaded.configured.length === 0) {
+        if (cachedModels.size > 0) {
+          cachedModels.clear();
+          removeCatalogCache();
+          await context3.catalog.reload();
+        }
+        return false;
+      }
+      if (loaded.discovered.length === 0)
         return false;
       discoveryStarted = true;
-      discoveredModels = models;
+      discoveredModels = loaded.discovered;
+      writeCatalogCache(loaded.discovered, Date.now());
       await context3.catalog.reload();
       return true;
     };

package/dist/meridian-v2.js

@@ -20181,6 +20181,10 @@ var Info6 = exports_Schema.Struct({
   })
 })));
 
+// plugin/meridian-v2.ts
+import { readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join as join3 } from "node:path";
+
 // plugin/priority-attestation.ts
 import { createHash, createHmac } from "node:crypto";
 import { readFileSync } from "node:fs";
@@ -20196,9 +20200,12 @@ var MAX_HEADER_BYTES = 768;
 var MAX_PAYLOAD_BYTES = 384;
 var TURN_DIGEST_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 var SAFE_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
-function configDirectory() {
+function meridianConfigDirectory() {
   return process.env.MERIDIAN_CONFIG_DIR ?? join2(homedir(), ".config", "meridian");
 }
+function configDirectory() {
+  return meridianConfigDirectory();
+}
 function priorityAttestationKeyPath() {
   return join2(configDirectory(), PRIORITY_ATTESTATION_KEY_FILE);
 }
@@ -20297,6 +20304,9 @@ var PARENT_SESSION_ONE_SHOTS = new Set(["title", "summary"]);
 var ATTACHED_COMPACTION_AGENT = "compaction";
 var MODEL_DISCOVERY_TIMEOUT_MS = 3000;
 var PROVIDER_READY_POLL_MS = 25;
+var CATALOG_CACHE_FILE = "opencode-v2-catalog.json";
+var CATALOG_CACHE_VERSION = 1;
+var CATALOG_CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 var MERIDIAN_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
 var MERIDIAN_V2_EFFORTS = MERIDIAN_EFFORTS;
 var SESSION_AFFINITY_HEADERS = [
@@ -20456,15 +20466,109 @@ async function loadMeridianModels(catalog, signal, fetcher = globalThis.fetch) {
     if (configured.length > 0) {
       const discovered = await Promise.all(configured.map(async ({ providerID, baseURL }) => {
         const models = await fetchMeridianModels(baseURL, signal, fetcher);
-        return models ? { providerID, models } : undefined;
+        return models ? { providerID, baseURL: typeof baseURL === "string" ? baseURL : undefined, models } : undefined;
       }));
-      return discovered.flatMap((result3) => result3 ? [result3] : []);
+      return {
+        configured: configured.map((provider) => provider.providerID),
+        discovered: discovered.flatMap((result3) => result3 ? [result3] : [])
+      };
     }
     if (Date.now() >= deadline)
-      return [];
+      return { configured: [], discovered: [] };
     await new Promise((resolve2) => setTimeout(resolve2, PROVIDER_READY_POLL_MS));
   }
-  return [];
+  return { configured: [], discovered: [] };
+}
+function catalogCachePath() {
+  return join3(meridianConfigDirectory(), CATALOG_CACHE_FILE);
+}
+function parseCatalogCache(value3, now3) {
+  const entries3 = new Map;
+  if (!isRecord(value3) || value3.version !== CATALOG_CACHE_VERSION)
+    return entries3;
+  if (!isRecord(value3.providers))
+    return entries3;
+  for (const [providerID, entry] of Object.entries(value3.providers)) {
+    if (!MERIDIAN_PROVIDERS.has(providerID) || !isRecord(entry))
+      continue;
+    const { baseURL, fetchedAt } = entry;
+    if (typeof baseURL !== "string" || meridianModelsURL(baseURL) === undefined)
+      continue;
+    if (typeof fetchedAt !== "number" || !Number.isSafeInteger(fetchedAt) || fetchedAt <= 0)
+      continue;
+    if (fetchedAt > now3 || now3 - fetchedAt > CATALOG_CACHE_TTL_MS)
+      continue;
+    const models = parseCachedModels(entry.models);
+    if (!models || models.length === 0)
+      continue;
+    entries3.set(providerID, { baseURL, models });
+  }
+  return entries3;
+}
+function parseCachedModels(value3) {
+  if (!Array.isArray(value3))
+    return;
+  const models = [];
+  const ids = new Set;
+  for (const item of value3) {
+    if (!isRecord(item))
+      return;
+    const { id: id2, name, contextWindow, efforts } = item;
+    if (typeof id2 !== "string" || id2.length === 0 || id2.length > 256 || /[^\x21-\x7E]/.test(id2) || ids.has(id2) || typeof name !== "string" || name.trim().length === 0 || name.length > 256 || typeof contextWindow !== "number" || !Number.isSafeInteger(contextWindow) || contextWindow <= 0 || !Array.isArray(efforts) || efforts.some((effort) => typeof effort !== "string" || !MERIDIAN_EFFORTS.includes(effort))) {
+      return;
+    }
+    ids.add(id2);
+    models.push({ id: id2, name, contextWindow, efforts });
+  }
+  return models;
+}
+function serializeCatalogCache(discovered, now3) {
+  const providers = {};
+  for (const entry of discovered) {
+    if (typeof entry.baseURL !== "string" || entry.models.length === 0)
+      continue;
+    providers[entry.providerID] = { baseURL: entry.baseURL, fetchedAt: now3, models: entry.models };
+  }
+  return `${JSON.stringify({ version: CATALOG_CACHE_VERSION, providers }, null, 2)}
+`;
+}
+function removeCatalogCache(remove4 = (path) => rmSync(path, { force: true })) {
+  try {
+    remove4(catalogCachePath());
+  } catch {}
+}
+function readCatalogCache(now3, read = (path) => readFileSync2(path, "utf-8")) {
+  try {
+    return parseCatalogCache(JSON.parse(read(catalogCachePath())), now3);
+  } catch {
+    return new Map;
+  }
+}
+function writeCatalogCache(discovered, now3, write = (path, contents) => {
+  const temporary = `${path}.${process.pid}.tmp`;
+  writeFileSync(temporary, contents, { encoding: "utf-8", mode: 384 });
+  renameSync(temporary, path);
+}) {
+  try {
+    const contents = serializeCatalogCache(discovered, now3);
+    if (contents.includes('"providers": {}'))
+      return;
+    write(catalogCachePath(), contents);
+  } catch {}
+}
+function resolveCatalogModels(catalog, discovered, cached3) {
+  if (discovered.length > 0)
+    return [...discovered];
+  const seeded = [];
+  for (const providerID of MERIDIAN_PROVIDERS) {
+    const entry = cached3.get(providerID);
+    if (!entry)
+      continue;
+    if (!catalog.provider.get(providerID))
+      continue;
+    seeded.push({ providerID, baseURL: entry.baseURL, models: [...entry.models] });
+  }
+  return seeded;
 }
 function applyMeridianModels(catalog, providerID, models) {
   for (const model of models) {
@@ -20527,19 +20631,31 @@ var MeridianV2Plugin = define({
     const modelDiscoveryController = new AbortController;
     let discoveredModels = [];
     let discoveryStarted = false;
+    const cachedModels = readCatalogCache(Date.now());
     registered.push(await context3.catalog.transform((catalog) => {
-      for (const discovered of discoveredModels) {
-        applyMeridianModels(catalog, discovered.providerID, discovered.models);
+      for (const entry of resolveCatalogModels(catalog, discoveredModels, cachedModels)) {
+        applyMeridianModels(catalog, entry.providerID, entry.models);
       }
     }));
     const discoverModels = async () => {
       if (discoveryStarted || modelDiscoveryController.signal.aborted)
         return false;
-      const models = await loadMeridianModels(context3.catalog, modelDiscoveryController.signal).catch(() => []);
-      if (models.length === 0 || modelDiscoveryController.signal.aborted)
+      const loaded = await loadMeridianModels(context3.catalog, modelDiscoveryController.signal).catch(() => ({ configured: [], discovered: [] }));
+      if (modelDiscoveryController.signal.aborted)
+        return false;
+      if (loaded.configured.length === 0) {
+        if (cachedModels.size > 0) {
+          cachedModels.clear();
+          removeCatalogCache();
+          await context3.catalog.reload();
+        }
+        return false;
+      }
+      if (loaded.discovered.length === 0)
         return false;
       discoveryStarted = true;
-      discoveredModels = models;
+      discoveredModels = loaded.discovered;
+      writeCatalogCache(loaded.discovered, Date.now());
       await context3.catalog.reload();
       return true;
     };
@@ -20667,8 +20783,14 @@ var MeridianV2Plugin = define({
 });
 var meridian_v2_default = MeridianV2Plugin;
 export {
+  writeCatalogCache,
   shouldDetachFromParentSession,
+  serializeCatalogCache,
+  resolveCatalogModels,
+  removeCatalogCache,
+  readCatalogCache,
   parseMeridianModels,
+  parseCatalogCache,
   meridianModelsURL,
   loadMeridianModels,
   isRootV2Session,
@@ -20677,6 +20799,7 @@ export {
   fetchMeridianModels,
   fallbackAgentTraits,
   meridian_v2_default as default,
+  catalogCachePath,
   applyMeridianV2Headers,
   applyMeridianModels,
   SUPPORTED_OPENCODE_V2_VERSION,

package/dist/proxy/errors.d.ts

@@ -2,6 +2,7 @@
  * Error classification for SDK errors.
  * Maps raw error messages to structured HTTP error responses.
  */
+import type { AbortCauseSnapshot } from "./requestAbort";
 export interface ClassifiedError {
     status: number;
     type: string;
@@ -167,6 +168,58 @@ export declare function canRecoverCapturedToolUses(input: {
     capturedToolUses: number;
     abortIsOurs: boolean;
 }): boolean;
+/**
+ * Per-block completeness record for a tool_use the client received on the
+ * wire (uncaptured-recovery tracker). Populated only by real forwarding;
+ * `naturalStop` is set exclusively when the block's own content_block_stop
+ * was enqueued — a synthetic flush closure never counts, because a dangling
+ * block's arguments may be incomplete.
+ */
+export interface StreamedToolBlockRecord {
+    id: string;
+    name: string;
+    /** Accumulated input_json_delta partials (plus any inline start input). */
+    json: string;
+    /** True when the block carried an inline input object at start (no deltas). */
+    startedInputObject: boolean;
+    forwardedStart: boolean;
+    naturalStop: boolean;
+}
+/**
+ * Is a streamed-but-uncaptured tool call complete and executable?
+ * Pure function — no I/O.
+ */
+export declare function isStreamedToolBlockComplete(record: StreamedToolBlockRecord): boolean;
+/**
+ * Can a failed passthrough turn whose tool_use blocks fully streamed but
+ * were NEVER captured by the PreToolUse hook still be delivered as a
+ * tool-use response?
+ *
+ * This is the 2026-09-10 0a95wd-tusk incident shape: an abort landing
+ * between stream completion and tool dispatch makes the CLI yield
+ * `max_turns_reached` WITHOUT running the hook, so captures are empty even
+ * though every streamed block is complete and names a declared client tool.
+ * This is a materially different trust basis from
+ * `canRecoverCapturedToolUses` (which requires the hook to have seen the
+ * calls) and is therefore a separate predicate, not a relaxed count.
+ *
+ * Callers must further verify: the attempted maxTurns was 1, the kill switch
+ * is enabled, no cancellation of any kind fired, no forced-single/duplicate/
+ * early-stop state exists, and the envelope is still open. Every streamed
+ * block must pass `isStreamedToolBlockComplete`.
+ */
+export declare function canRecoverUncapturedToolUses(input: {
+    reason: SdkTermination["reason"];
+    passthrough: boolean;
+    capturedToolUses: number;
+    streamedToolUses: number;
+    droppedToolUseIds: number;
+    sawDuplicateToolUse: boolean;
+    forceSingleToolUse: boolean;
+    earlyStopFired: boolean;
+    uncapturedRecoveryEnabled: boolean;
+    attemptedMaxTurns: number | undefined;
+}): boolean;
 export declare function extractSdkTermination(errMsg: string): SdkTermination;
 /**
  * Render an SdkTermination plus request context as a single greppable log line.
@@ -182,5 +235,7 @@ export declare function formatSdkTermination(t: SdkTermination, ctx: {
     isResume?: boolean;
     hasDeferredTools?: boolean;
     sdkSessionId?: string;
+    /** Abort-cause snapshot: which Meridian-linked producer fired, if any. */
+    abort?: AbortCauseSnapshot;
 }): string;
 //# sourceMappingURL=errors.d.ts.map

package/dist/proxy/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/proxy/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAc1D;AAoKD,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEpF;AAqFD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,CA0L7E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,aAAa,GAAG,iBAAiB,CAAA;AAEtE;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAahG;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAI3E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGxD;AAuBD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,SAAS,IAAI,MAAM,CAEhG;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,GAAG,eAAe,GAAG,kBAAkB,GAAG,SAAS,CAAA;IACnG,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;wCAEoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAuBD;;;;;;GAMG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;IAChC,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,OAAO,CAAA;CACrB,GAAG,OAAO,CAYV;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAiEpE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,cAAc,EACjB,GAAG,EAAE;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GACA,MAAM,CAYR"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/proxy/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAExD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAc1D;AAoKD,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEpF;AAqFD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,CA0L7E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,aAAa,GAAG,iBAAiB,CAAA;AAEtE;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAahG;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAI3E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGxD;AAuBD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,SAAS,IAAI,MAAM,CAEhG;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,GAAG,eAAe,GAAG,kBAAkB,GAAG,SAAS,CAAA;IACnG,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;wCAEoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAuBD;;;;;;GAMG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;IAChC,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,OAAO,CAAA;CACrB,GAAG,OAAO,CAYV;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAA;IACZ,+EAA+E;IAC/E,kBAAkB,EAAE,OAAO,CAAA;IAC3B,cAAc,EAAE,OAAO,CAAA;IACvB,WAAW,EAAE,OAAO,CAAA;CACrB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAaT;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;IAChC,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;IACxB,iBAAiB,EAAE,MAAM,CAAA;IACzB,mBAAmB,EAAE,OAAO,CAAA;IAC5B,kBAAkB,EAAE,OAAO,CAAA;IAC3B,cAAc,EAAE,OAAO,CAAA;IACvB,yBAAyB,EAAE,OAAO,CAAA;IAClC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAA;CACtC,GAAG,OAAO,CAeV;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAiEpE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,cAAc,EACjB,GAAG,EAAE;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,kBAAkB,CAAA;CAC3B,GACA,MAAM,CAkBR"}

package/dist/proxy/requestAbort.d.ts

@@ -1,7 +1,43 @@
+/**
+ * Request-scoped abort link with an abort-cause registry.
+ *
+ * Meridian aborts a request's SDK query from several producers (client
+ * disconnect, cancelled response body, session turn watchdog, subtree
+ * cancellation, process shutdown, the proxy's own passthrough single-step
+ * abort). When a capped turn then dies with an opaque SDK termination, the
+ * operator needs to know WHICH producer fired — or that none did, which is
+ * the discriminating marker for the uncaptured-tool-turn incident
+ * (2026-09-10 0a95wd-tusk): an externally-initiated CLI abort masqueraded as
+ * "Reached maximum number of turns (1)".
+ *
+ * The registry latches the FIRST classified cause. `abortSnapshot` is the
+ * single read side used by diagnostics. `cause: "none"` means no
+ * Meridian-linked abort was observed — it is NOT proof that no abort occurred
+ * inside the CLI subprocess; only that nothing Meridian controls aborted.
+ */
+export type RequestAbortCause = "client_abort" | "stream_cancel" | "session_watchdog" | "process_shutdown" | "subtree_cancel" | "passthrough_single_step" | "unknown_abort";
+export declare const REQUEST_ABORT_CAUSES: readonly RequestAbortCause[];
+export interface AbortCauseSnapshot {
+    /** First classified cause; "none" when the observed signal never aborted. */
+    cause: RequestAbortCause | "none";
+    /** Whether the linked controller's signal is aborted. */
+    aborted: boolean;
+    /** Monotonic ms from link creation to abort; undefined when not aborted. */
+    elapsedMs?: number;
+}
 export interface RequestAbortLink {
     controller: AbortController;
     abort: (reason?: unknown) => void;
     detach: () => void;
+    /**
+     * Latch the classified cause of an impending abort. First call wins; later
+     * labels are ignored so the earliest producer owns the diagnosis. Callers
+     * should label BEFORE invoking abort, and may label a cause that arrives
+     * with an already-aborted signal.
+     */
+    setCause: (cause: RequestAbortCause) => void;
+    /** Read-side snapshot for diagnostics and telemetry. */
+    abortSnapshot: () => AbortCauseSnapshot;
 }
 /** Forward an HTTP request abort into the SDK query lifecycle. */
 export declare function linkRequestAbort(signal: AbortSignal): RequestAbortLink;

package/dist/proxy/requestAbort.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestAbort.d.ts","sourceRoot":"","sources":["../../src/proxy/requestAbort.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,eAAe,CAAA;IAC3B,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;IACjC,MAAM,EAAE,MAAM,IAAI,CAAA;CACnB;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAyBtE"}
+{"version":3,"file":"requestAbort.d.ts","sourceRoot":"","sources":["../../src/proxy/requestAbort.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,gBAAgB,GAChB,yBAAyB,GACzB,eAAe,CAAA;AAEnB,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAQnD,CAAA;AAEV,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAAA;IACjC,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAA;IAChB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,eAAe,CAAA;IAC3B,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;IACjC,MAAM,EAAE,MAAM,IAAI,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAA;IAC5C,wDAAwD;IACxD,aAAa,EAAE,MAAM,kBAAkB,CAAA;CACxC;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAgDtE"}

package/dist/proxy/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/proxy/server.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACtE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;AAGvD,YAAY,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,WAAW,GACZ,MAAM,aAAa,CAAA;AAKpB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AA4EnG,OAAO,EACL,kBAAkB,EAElB,WAAW,EACX,oBAAoB,EAMpB,KAAK,aAAa,EAGnB,MAAM,mBAAmB,CAAA;AAI1B,OAAO,EAKL,iBAAiB,EACjB,mBAAmB,EAKpB,MAAM,iBAAiB,CAAA;AA0CxB,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;AACjD,YAAY,EAAE,aAAa,EAAE,CAAA;AAsY7B,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,OAAO,CAAC,WAAW,CAAM,GAAG,WAAW,CAs8OhF;AAWD,wBAAgB,gCAAgC,IAAI,IAAI,CAavD;AAED,wBAAsB,gBAAgB,CAAC,MAAM,GAAE,OAAO,CAAC,WAAW,CAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA8NhG"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/proxy/server.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACtE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;AAGvD,YAAY,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,WAAW,GACZ,MAAM,aAAa,CAAA;AAKpB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AA4EnG,OAAO,EACL,kBAAkB,EAElB,WAAW,EACX,oBAAoB,EAMpB,KAAK,aAAa,EAGnB,MAAM,mBAAmB,CAAA;AAI1B,OAAO,EAKL,iBAAiB,EACjB,mBAAmB,EAKpB,MAAM,iBAAiB,CAAA;AA0CxB,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;AACjD,YAAY,EAAE,aAAa,EAAE,CAAA;AA+Y7B,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,OAAO,CAAC,WAAW,CAAM,GAAG,WAAW,CAsmPhF;AAWD,wBAAgB,gCAAgC,IAAI,IAAI,CAavD;AAED,wBAAsB,gBAAgB,CAAC,MAAM,GAAE,OAAO,CAAC,WAAW,CAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA8NhG"}

package/dist/server.js

@@ -11,7 +11,7 @@ import {
   runObserveHook,
   runTransformHook,
   startProxyServer
-} from "./cli-198xnjcn.js";
+} from "./cli-6c6dj69q.js";
 import"./cli-5jxyma6z.js";
 import"./cli-sry5aqdj.js";
 import"./cli-8yp89fan.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rynfar/meridian",
-  "version": "1.70.0",
+  "version": "1.71.0",
   "description": "Local Anthropic API powered by your Claude Max subscription. One subscription, every agent.",
   "type": "module",
   "main": "./dist/server.js",

package/plugin/meridian-v2.ts

@@ -18,11 +18,14 @@
 import * as Plugin from "@opencode-ai/plugin/promise/plugin"
 import { Model } from "@opencode-ai/schema/model"
 import type { CatalogDraft } from "@opencode-ai/plugin/promise/catalog"
+import { readFileSync, renameSync, rmSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
 import {
   PRIORITY_ATTESTATION_HEADER,
   createPriorityAttestation,
   deleteHeader,
   getHeader,
+  meridianConfigDirectory,
   setHeader,
   type MutableHeaders,
 } from "./priority-attestation"
@@ -36,6 +39,25 @@ const PARENT_SESSION_ONE_SHOTS = new Set(["title", "summary"])
 const ATTACHED_COMPACTION_AGENT = "compaction"
 const MODEL_DISCOVERY_TIMEOUT_MS = 3_000
 const PROVIDER_READY_POLL_MS = 25
+
+/**
+ * Catalog cache, for the cold-start gap (#1008).
+ *
+ * Discovery cannot begin until OpenCode has finished assembling the catalog, so
+ * the first request against a freshly started server used to see only
+ * OpenCode's built-in models.dev entries and rejected a Meridian-only variant
+ * with `provider.no-route`. Awaiting the catalog inside `setup` deadlocks the
+ * server, so the seed has to come from somewhere that is not the catalog: a
+ * plain file, read synchronously before the first transform runs.
+ *
+ * The entry records the base URL it was discovered from and is only applied to a
+ * provider still pointed at that URL, so repointing OpenCode at a different
+ * Meridian cannot apply another one's models.
+ */
+const CATALOG_CACHE_FILE = "opencode-v2-catalog.json"
+const CATALOG_CACHE_VERSION = 1
+/** Bounds how stale a seed can be if discovery never succeeds again. */
+const CATALOG_CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1_000
 // The plugin tree does not import from src/, so this mirrors VALID_EFFORTS in
 // src/proxy/effort.ts. A test asserts the two stay identical. Filtering in this
 // order also gives every model its variants low -> max regardless of the order
@@ -152,6 +174,8 @@ export interface MeridianModel {
 
 export interface MeridianProviderModels {
   providerID: string
+  /** The URL these models came from, so a cached seed is never applied to another. */
+  baseURL?: string
   models: MeridianModel[]
 }
 
@@ -260,11 +284,17 @@ function isLegacyMeridianBaseURL(baseURL: unknown): boolean {
   }
 }
 
+export interface MeridianCatalogLoad {
+  /** Providers whose base URL still looks like Meridian, reachable or not. */
+  readonly configured: string[]
+  readonly discovered: MeridianProviderModels[]
+}
+
 export async function loadMeridianModels(
   catalog: MeridianCatalogClient,
   signal: AbortSignal,
   fetcher: ModelFetcher = globalThis.fetch,
-): Promise<MeridianProviderModels[]> {
+): Promise<MeridianCatalogLoad> {
   const deadline = Date.now() + MODEL_DISCOVERY_TIMEOUT_MS
   while (!signal.aborted) {
     const providers = await Promise.all([...MERIDIAN_PROVIDERS].map(async (providerID) => {
@@ -281,14 +311,176 @@ export async function loadMeridianModels(
     if (configured.length > 0) {
       const discovered = await Promise.all(configured.map(async ({ providerID, baseURL }) => {
         const models = await fetchMeridianModels(baseURL, signal, fetcher)
-        return models ? { providerID, models } : undefined
+        return models ? { providerID, baseURL: typeof baseURL === "string" ? baseURL : undefined, models } : undefined
       }))
-      return discovered.flatMap(result => result ? [result] : [])
+      return {
+        configured: configured.map(provider => provider.providerID),
+        discovered: discovered.flatMap(result => result ? [result] : []),
+      }
     }
-    if (Date.now() >= deadline) return []
+    if (Date.now() >= deadline) return { configured: [], discovered: [] }
     await new Promise<void>((resolve) => setTimeout(resolve, PROVIDER_READY_POLL_MS))
   }
-  return []
+  return { configured: [], discovered: [] }
+}
+
+export interface CachedProviderCatalog {
+  readonly baseURL: string
+  readonly models: readonly MeridianModel[]
+}
+
+export function catalogCachePath(): string {
+  return join(meridianConfigDirectory(), CATALOG_CACHE_FILE)
+}
+
+/**
+ * Validate a cache document as strictly as a discovery response.
+ *
+ * A corrupt or hand-edited file must seed nothing rather than write junk into
+ * the catalog, so every failure returns an empty map.
+ */
+export function parseCatalogCache(value: unknown, now: number): Map<string, CachedProviderCatalog> {
+  const entries = new Map<string, CachedProviderCatalog>()
+  if (!isRecord(value) || value.version !== CATALOG_CACHE_VERSION) return entries
+  if (!isRecord(value.providers)) return entries
+  for (const [providerID, entry] of Object.entries(value.providers)) {
+    if (!MERIDIAN_PROVIDERS.has(providerID) || !isRecord(entry)) continue
+    const { baseURL, fetchedAt } = entry
+    if (typeof baseURL !== "string" || meridianModelsURL(baseURL) === undefined) continue
+    if (typeof fetchedAt !== "number" || !Number.isSafeInteger(fetchedAt) || fetchedAt <= 0) continue
+    if (fetchedAt > now || now - fetchedAt > CATALOG_CACHE_TTL_MS) continue
+    const models = parseCachedModels(entry.models)
+    if (!models || models.length === 0) continue
+    entries.set(providerID, { baseURL, models })
+  }
+  return entries
+}
+
+function parseCachedModels(value: unknown): MeridianModel[] | undefined {
+  if (!Array.isArray(value)) return undefined
+  const models: MeridianModel[] = []
+  const ids = new Set<string>()
+  for (const item of value) {
+    if (!isRecord(item)) return undefined
+    const { id, name, contextWindow, efforts } = item
+    if (
+      typeof id !== "string"
+      || id.length === 0
+      || id.length > 256
+      || /[^\x21-\x7E]/.test(id)
+      || ids.has(id)
+      || typeof name !== "string"
+      || name.trim().length === 0
+      || name.length > 256
+      || typeof contextWindow !== "number"
+      || !Number.isSafeInteger(contextWindow)
+      || contextWindow <= 0
+      || !Array.isArray(efforts)
+      || efforts.some(effort => typeof effort !== "string" || !MERIDIAN_EFFORTS.includes(effort as never))
+    ) {
+      return undefined
+    }
+    ids.add(id)
+    models.push({ id, name, contextWindow, efforts: efforts as string[] })
+  }
+  return models
+}
+
+export function serializeCatalogCache(
+  discovered: readonly MeridianProviderModels[],
+  now: number,
+): string {
+  const providers: Record<string, unknown> = {}
+  for (const entry of discovered) {
+    if (typeof entry.baseURL !== "string" || entry.models.length === 0) continue
+    providers[entry.providerID] = { baseURL: entry.baseURL, fetchedAt: now, models: entry.models }
+  }
+  return `${JSON.stringify({ version: CATALOG_CACHE_VERSION, providers }, null, 2)}\n`
+}
+
+/**
+ * Drop the seed. Called when no Meridian-shaped provider is configured any
+ * more, so a later cold start cannot describe a provider this catalog no longer
+ * points at. Best effort, like the write.
+ */
+export function removeCatalogCache(remove: (path: string) => void = path => rmSync(path, { force: true })): void {
+  try {
+    remove(catalogCachePath())
+  } catch {
+    // Ignored on purpose: a stale seed is corrected by the next discovery.
+  }
+}
+
+/** Read the seed. Any failure — missing, unreadable, corrupt — seeds nothing. */
+export function readCatalogCache(
+  now: number,
+  read: (path: string) => string = path => readFileSync(path, "utf-8"),
+): Map<string, CachedProviderCatalog> {
+  try {
+    return parseCatalogCache(JSON.parse(read(catalogCachePath())), now)
+  } catch {
+    return new Map()
+  }
+}
+
+/**
+ * Persist the seed for the next cold start. Best effort: a cache we cannot write
+ * costs a deferred catalog on the next start, which is the old behaviour, so it
+ * must never interrupt a working session.
+ */
+export function writeCatalogCache(
+  discovered: readonly MeridianProviderModels[],
+  now: number,
+  write: (path: string, contents: string) => void = (path, contents) => {
+    // Rename onto the target so a concurrent reader never sees a partial file.
+    const temporary = `${path}.${process.pid}.tmp`
+    writeFileSync(temporary, contents, { encoding: "utf-8", mode: 0o600 })
+    renameSync(temporary, path)
+  },
+): void {
+  try {
+    const contents = serializeCatalogCache(discovered, now)
+    if (contents.includes('"providers": {}')) return
+    write(catalogCachePath(), contents)
+  } catch {
+    // Ignored on purpose: see above.
+  }
+}
+
+/**
+ * The only thing choosing a seed needs from the draft: whether a provider is
+ * still in the catalog. Narrower than `CatalogDraft` on purpose, so the decision
+ * stays unit-testable without standing up a whole branded provider record.
+ */
+export interface CatalogProviderProbe {
+  readonly provider: { get(providerID: string): unknown }
+}
+
+/**
+ * Choose what the transform should write: live discovery when it has landed,
+ * otherwise the cached seed.
+ *
+ * The seed cannot be validated against the provider's configured URL here. A
+ * draft `Provider.Info` exposes only `id`, `name`, `activation`, `package`,
+ * `integrationID` and `headers` — verified on beta-18866, where the whole
+ * record contains no URL at all. So the seed is applied optimistically to any
+ * Meridian provider that still exists in the catalog, and `discoverModels`
+ * corrects or drops it once it can read the real URL.
+ */
+export function resolveCatalogModels(
+  catalog: CatalogProviderProbe,
+  discovered: readonly MeridianProviderModels[],
+  cached: ReadonlyMap<string, CachedProviderCatalog>,
+): MeridianProviderModels[] {
+  if (discovered.length > 0) return [...discovered]
+  const seeded: MeridianProviderModels[] = []
+  for (const providerID of MERIDIAN_PROVIDERS) {
+    const entry = cached.get(providerID)
+    if (!entry) continue
+    if (!catalog.provider.get(providerID)) continue
+    seeded.push({ providerID, baseURL: entry.baseURL, models: [...entry.models] })
+  }
+  return seeded
 }
 
 /**
@@ -391,19 +583,41 @@ const MeridianV2Plugin = Plugin.define({
     const modelDiscoveryController = new AbortController()
     let discoveredModels: MeridianProviderModels[] = []
     let discoveryStarted = false
+    // Read synchronously, before the first transform can run. Awaiting the
+    // catalog here would deadlock the server, which is why the seed is a file
+    // and not a catalog read (#1008).
+    const cachedModels = readCatalogCache(Date.now())
 
     registered.push(await context.catalog.transform((catalog) => {
-      for (const discovered of discoveredModels) {
-        applyMeridianModels(catalog, discovered.providerID, discovered.models)
+      for (const entry of resolveCatalogModels(catalog, discoveredModels, cachedModels)) {
+        applyMeridianModels(catalog, entry.providerID, entry.models)
       }
     }))
 
     const discoverModels = async () => {
       if (discoveryStarted || modelDiscoveryController.signal.aborted) return false
-      const models = await loadMeridianModels(context.catalog, modelDiscoveryController.signal).catch(() => [])
-      if (models.length === 0 || modelDiscoveryController.signal.aborted) return false
+      const loaded = await loadMeridianModels(context.catalog, modelDiscoveryController.signal)
+        .catch((): MeridianCatalogLoad => ({ configured: [], discovered: [] }))
+      if (modelDiscoveryController.signal.aborted) return false
+      if (loaded.configured.length === 0) {
+        // Nothing here points at Meridian any more — the user repointed the
+        // provider. A seed from a previous run would describe a different
+        // endpoint, so drop it and rebuild the catalog without it.
+        if (cachedModels.size > 0) {
+          cachedModels.clear()
+          removeCatalogCache()
+          await context.catalog.reload()
+        }
+        return false
+      }
+      // Configured but unreachable: keep the seed. It is the last thing Meridian
+      // actually served, which beats OpenCode's models.dev entries.
+      if (loaded.discovered.length === 0) return false
       discoveryStarted = true
-      discoveredModels = models
+      discoveredModels = loaded.discovered
+      // Seed the next cold start before the reload, so a crash mid-reload still
+      // leaves the catalog available to the following process.
+      writeCatalogCache(loaded.discovered, Date.now())
       await context.catalog.reload()
       return true
     }

package/plugin/priority-attestation.ts

@@ -32,10 +32,20 @@ export interface PriorityAttestationSignInput {
   readonly issuedAt: number
 }
 
-function configDirectory(): string {
+/**
+ * Meridian's own configuration directory, as the plugin sees it.
+ *
+ * Exported because the V2 plugin also keeps its catalog cache here: the plugin
+ * tree must not import from src/, so this is the one place the resolution lives.
+ */
+export function meridianConfigDirectory(): string {
   return process.env.MERIDIAN_CONFIG_DIR ?? join(homedir(), ".config", "meridian")
 }
 
+function configDirectory(): string {
+  return meridianConfigDirectory()
+}
+
 export function priorityAttestationKeyPath(): string {
   return join(configDirectory(), PRIORITY_ATTESTATION_KEY_FILE)
 }