claudish 14.18.1 → 14.18.2

package/dist/index.js

@@ -5494,7 +5494,7 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "14.18.1";
+var VERSION = "14.18.2";
 
 // src/redact.ts
 function isPlaceholder(value) {
@@ -26401,6 +26401,7 @@ var version2 = null, readForToken = null;
 
 // src/auth/antigravity-token.ts
 import { execFileSync } from "child_process";
+import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync11 } from "fs";
 import { homedir as homedir12 } from "os";
 import { join as join12 } from "path";
@@ -26408,6 +26409,8 @@ function invalidateReadStoreMemo() {
   cachedRawStore = null;
 }
 function defaultReadStore() {
+  if (process.env.CLAUDISH_DISABLE_KEYCHAIN === "1")
+    return null;
   if (process.platform !== "darwin") {
     logStderr("[Antigravity] Shared token store is macOS-only for now (other keyring backends are a follow-up).");
     return null;
@@ -26549,7 +26552,7 @@ function encodeRecord(rec) {
   return PREFIX + Buffer.from(JSON.stringify(rec), "utf8").toString("base64");
 }
 function readSharedAntigravityToken(deps = defaultDeps3) {
-  const rec = parseRecord2(deps.readStore());
+  const rec = readObservedRecord(deps);
   return rec ? rec.token : null;
 }
 function hasSharedAntigravityToken(deps = defaultDeps3) {
@@ -26596,11 +26599,44 @@ function captureAgyClientVersion(accessToken, deps) {
     log("[Antigravity] Could not read the agy version" + (kept ? `; keeping ${kept}.` : "; using the fallback version."));
   }
 }
+function antigravityTokenLineageMaterial(token) {
+  if (token.refresh_token)
+    return `refresh:${token.refresh_token}`;
+  if (token.access_token)
+    return `access:${token.access_token}`;
+  return;
+}
+function sha256(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
+function observeLineage(token) {
+  const material = token ? antigravityTokenLineageMaterial(token) : undefined;
+  observedLineage = material ? sha256(material) : null;
+  if (!observedLineage || !token?.access_token)
+    return;
+  const key = sha256(token.access_token);
+  lineageByAccessToken.delete(key);
+  lineageByAccessToken.set(key, observedLineage);
+  if (lineageByAccessToken.size > MAX_TRACKED_ACCESS_TOKENS) {
+    lineageByAccessToken.delete(lineageByAccessToken.keys().next().value);
+  }
+}
+function readObservedRecord(deps) {
+  const rec = parseRecord2(deps.readStore());
+  observeLineage(rec ? rec.token : null);
+  return rec;
+}
+function currentAntigravityTokenLineage() {
+  return observedLineage;
+}
+function lineageForAntigravityAccessToken(accessToken) {
+  return lineageByAccessToken.get(sha256(accessToken)) ?? null;
+}
 async function resolveValidToken(deps) {
   if (process.platform !== "darwin") {
     throw terminalCredentialError("[Antigravity] The shared Antigravity token store is macOS-only for now. " + "Use g@<model> with GEMINI_API_KEY on this platform.");
   }
-  const rec = parseRecord2(deps.readStore());
+  const rec = readObservedRecord(deps);
   if (!rec) {
     throw terminalCredentialError("[Antigravity] No Antigravity session found. Sign in with `claudish login antigravity`, " + "or use g@<model> with GEMINI_API_KEY " + "(get one at https://aistudio.google.com/app/apikey).");
   }
@@ -26610,7 +26646,7 @@ async function resolveValidToken(deps) {
   }
   log("[Antigravity] Access token expired/near-expiry \u2014 asking the Antigravity CLI to refresh.");
   const outcome = deps.runAgyRefresh();
-  const refreshedRec = parseRecord2(deps.readStore());
+  const refreshedRec = readObservedRecord(deps);
   if (refreshedRec && !needsRefresh(refreshedRec.token, deps.now())) {
     log("[Antigravity] Shared token refreshed by the Antigravity CLI.");
     captureAgyClientVersion(refreshedRec.token.access_token, deps);
@@ -26647,8 +26683,8 @@ async function forceRefreshAntigravityToken(deps = defaultDeps3) {
   if (process.platform !== "darwin") {
     throw terminalCredentialError("[Antigravity] The shared Antigravity token store is macOS-only for now. " + "Use g@<model> with GEMINI_API_KEY on this platform.");
   }
-  _resetAntigravityTokenState();
-  const rec = parseRecord2(deps.readStore());
+  resetObservedTokenState();
+  const rec = readObservedRecord(deps);
   if (!rec) {
     throw terminalCredentialError("[Antigravity] No Antigravity session found. Sign in with `claudish login antigravity`, " + "or use g@<model> with GEMINI_API_KEY " + "(get one at https://aistudio.google.com/app/apikey).");
   }
@@ -26656,7 +26692,7 @@ async function forceRefreshAntigravityToken(deps = defaultDeps3) {
   log("[Antigravity] Upstream rejected the current token \u2014 asking the Antigravity CLI to re-mint.");
   writeSharedAntigravityToken({ ...original, expiry: new Date(deps.now() - 1000).toISOString() }, deps);
   const outcome = deps.runAgyRefresh();
-  const refreshed = parseRecord2(deps.readStore());
+  const refreshed = readObservedRecord(deps);
   const token = refreshed?.token;
   if (token && token.access_token !== original.access_token && !needsRefresh(token, deps.now())) {
     log("[Antigravity] Shared token re-minted by the Antigravity CLI.");
@@ -26666,7 +26702,7 @@ async function forceRefreshAntigravityToken(deps = defaultDeps3) {
   if (!refreshed || refreshed.token.access_token === original.access_token) {
     writeSharedAntigravityToken(original, deps);
   }
-  _resetAntigravityTokenState();
+  resetObservedTokenState();
   if (outcome.kind === "timeout" || outcome.kind === "failed") {
     const message = `[Antigravity] ${describeRefreshFailure(outcome)}`;
     if (outcome.kind === "timeout") {
@@ -26680,11 +26716,16 @@ async function forceRefreshAntigravityToken(deps = defaultDeps3) {
   throw terminalCredentialError("[Antigravity] The Antigravity session was rejected upstream and could not be re-minted. " + "Run `claudish login antigravity` to sign in again.");
 }
 function _resetAntigravityTokenState() {
+  resetObservedTokenState();
+  lineageByAccessToken.clear();
+}
+function resetObservedTokenState() {
   inFlight = null;
   cachedHasToken = null;
+  observedLineage = null;
   invalidateReadStoreMemo();
 }
-var KC_SERVICE = "gemini", KC_ACCOUNT = "antigravity", PREFIX = "go-keyring-base64:", EXPIRY_SKEW_MS = 120000, AGY_REFRESH_TIMEOUT_MS = 12000, AGY_VERSION_TIMEOUT_MS = 5000, READ_STORE_TTL_MS = 3000, cachedRawStore = null, defaultDeps3, KEYCHAIN_LOCKED_EXIT_CODES, cachedHasToken = null, HAS_TOKEN_TTL_MS = 5000, inFlight = null;
+var KC_SERVICE = "gemini", KC_ACCOUNT = "antigravity", PREFIX = "go-keyring-base64:", EXPIRY_SKEW_MS = 120000, AGY_REFRESH_TIMEOUT_MS = 12000, AGY_VERSION_TIMEOUT_MS = 5000, READ_STORE_TTL_MS = 3000, cachedRawStore = null, defaultDeps3, KEYCHAIN_LOCKED_EXIT_CODES, cachedHasToken = null, HAS_TOKEN_TTL_MS = 5000, inFlight = null, observedLineage = null, MAX_TRACKED_ACCESS_TOKENS = 8, lineageByAccessToken;
 var init_antigravity_token = __esm(() => {
   init_logger();
   init_keychain();
@@ -26697,6 +26738,7 @@ var init_antigravity_token = __esm(() => {
     now: () => Date.now()
   };
   KEYCHAIN_LOCKED_EXIT_CODES = new Set([36, 51, 128]);
+  lineageByAccessToken = new Map;
 });
 
 // src/auth/antigravity-user.ts
@@ -26749,6 +26791,26 @@ function resetAntigravityUserCache() {
   agServedCache = null;
   agServedCacheAt = 0;
   agServedCacheVersion = null;
+  cachedAgLineage = null;
+}
+function syncAccountCaches() {
+  const lineage = currentAntigravityTokenLineage();
+  if (lineage === cachedAgLineage)
+    return;
+  if (cachedAgProjectId || agServedCache) {
+    log("[Antigravity] Token lineage changed; dropping the cached project, tier and models.");
+  }
+  resetAntigravityUserCache();
+  cachedAgLineage = lineage;
+}
+function lineageOfToken(accessToken) {
+  return lineageForAntigravityAccessToken(accessToken) ?? currentAntigravityTokenLineage();
+}
+function mayPublishFor(lineage) {
+  if (currentAntigravityTokenLineage() !== lineage)
+    return false;
+  syncAccountCaches();
+  return true;
 }
 async function callLoadCodeAssistAntigravity(accessToken) {
   const res = await fetch(`${apiBase()}:loadCodeAssist`, {
@@ -26766,7 +26828,9 @@ async function callLoadCodeAssistAntigravity(accessToken) {
   return await res.json();
 }
 async function setupAntigravityUser(accessToken) {
-  if (cachedAgProjectId && cachedAgTierId) {
+  syncAccountCaches();
+  const lineage = lineageOfToken(accessToken);
+  if (lineage === cachedAgLineage && cachedAgProjectId && cachedAgTierId) {
     return { projectId: cachedAgProjectId, tierId: cachedAgTierId };
   }
   const loadRes = await callLoadCodeAssistAntigravity(accessToken);
@@ -26776,13 +26840,18 @@ async function setupAntigravityUser(accessToken) {
   if (!projectId) {
     throw makeTerminalSetupError("Antigravity did not return a project for this account. Sign in to Antigravity " + "(`claudish login antigravity`) and try again, or use g@<model> with GEMINI_API_KEY " + "(get one at https://aistudio.google.com/app/apikey).");
   }
-  cachedAgProjectId = projectId;
-  cachedAgTierId = resolvedTier;
-  cachedAgTierName = loadRes.paidTier?.name || null;
+  if (mayPublishFor(lineage)) {
+    cachedAgProjectId = projectId;
+    cachedAgTierId = resolvedTier;
+    cachedAgTierName = loadRes.paidTier?.name || null;
+  } else {
+    log("[Antigravity] Token lineage changed during setup; the result is not cached.");
+  }
   log(`[Antigravity] User set up, project: ${projectId}, tier: ${resolvedTier}`);
   return { projectId, tierId: resolvedTier };
 }
 function getAntigravityTierDisplayName() {
+  syncAccountCaches();
   if (!cachedAgTierName && !cachedAgTierId)
     return "Antigravity";
   const id = cachedAgTierId || "";
@@ -26872,6 +26941,9 @@ async function fetchAntigravityAvailableModelsRaw(accessToken, projectId, opts)
   }
 }
 async function getServedAntigravityModels(accessToken, projectId, opts) {
+  syncAccountCaches();
+  const lineage = lineageOfToken(accessToken);
+  const ownList = lineage === cachedAgLineage;
   const now = Date.now();
   const version = antigravityClientVersion();
   if (agServedCache && agServedCacheVersion !== version) {
@@ -26879,9 +26951,10 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
     agServedCache = null;
     agServedCacheAt = 0;
   }
-  if (!opts?.force && agServedCache && now - agServedCacheAt < SERVED_MODELS_TTL_MS) {
+  if (!opts?.force && ownList && agServedCache && now - agServedCacheAt < SERVED_MODELS_TTL_MS) {
     return agServedCache;
   }
+  const prior = ownList ? agServedCache : null;
   try {
     const raw = await fetchAntigravityAvailableModelsRaw(accessToken, projectId);
     if (raw.kind === "unreachable") {
@@ -26929,7 +27002,7 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
             deprecatedReplacements[oldId] = info.newModelId;
         }
         const agentModelIds = flattenAgentModelSorts(data.agentModelSorts);
-        agServedCache = {
+        const served = {
           servedIds,
           defaultId,
           meta,
@@ -26937,26 +27010,34 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
           deprecatedReplacements,
           ...agentModelIds ? { agentModelIds } : {}
         };
+        if (!mayPublishFor(lineage)) {
+          log("[Antigravity] Token lineage changed during discovery; the result is not cached.");
+          return served;
+        }
+        agServedCache = served;
         agServedCacheAt = now;
         agServedCacheVersion = raw.clientVersion;
-        return agServedCache;
+        return served;
       }
     }
   } catch (err) {
     log(`[Antigravity] fetchAvailableModels error: ${err}`);
   }
-  if (agServedCache)
-    return agServedCache;
+  if (prior)
+    return prior;
   return { servedIds: [], defaultId: null, meta: {} };
 }
 function peekServedAntigravityModels() {
   if (!agServedCache || agServedCacheVersion !== antigravityClientVersion())
     return null;
+  if (cachedAgLineage !== currentAntigravityTokenLineage())
+    return null;
   return agServedCache;
 }
-var ANTIGRAVITY_DEFAULT_HOST = "https://daily-cloudcode-pa.googleapis.com", SERVED_MODELS_TTL_MS, ANTIGRAVITY_IDE_TYPE = "ANTIGRAVITY", AGY_FALLBACK_CLIENT_VERSION = "1.1.9", cachedAgProjectId = null, cachedAgTierId = null, cachedAgTierName = null, agServedCache = null, agServedCacheAt = 0, agServedCacheVersion = null;
+var ANTIGRAVITY_DEFAULT_HOST = "https://daily-cloudcode-pa.googleapis.com", SERVED_MODELS_TTL_MS, ANTIGRAVITY_IDE_TYPE = "ANTIGRAVITY", AGY_FALLBACK_CLIENT_VERSION = "1.1.9", cachedAgProjectId = null, cachedAgTierId = null, cachedAgTierName = null, cachedAgLineage = null, agServedCache = null, agServedCacheAt = 0, agServedCacheVersion = null;
 var init_antigravity_user = __esm(() => {
   init_logger();
+  init_antigravity_token();
   SERVED_MODELS_TTL_MS = 10 * 60 * 1000;
 });
 
@@ -27318,7 +27399,7 @@ var init_credential_file = __esm(() => {
 
 // src/auth/oauth-manager.ts
 import { exec as exec2 } from "child_process";
-import { createHash as createHash3, randomBytes as randomBytes5 } from "crypto";
+import { createHash as createHash4, randomBytes as randomBytes5 } from "crypto";
 import { existsSync as existsSync12, mkdirSync as mkdirSync10, unlinkSync as unlinkSync5 } from "fs";
 import { homedir as homedir13 } from "os";
 import { join as join13 } from "path";
@@ -27421,7 +27502,7 @@ class OAuthManager {
     return randomBytes5(64).toString("base64url");
   }
   generateCodeChallenge(verifier) {
-    return createHash3("sha256").update(verifier).digest("base64url");
+    return createHash4("sha256").update(verifier).digest("base64url");
   }
   async openBrowser(url, message) {
     try {
@@ -28787,9 +28868,9 @@ var init_registry2 = __esm(() => {
 });
 
 // src/code-mode/ids.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function sha256Hex(input) {
-  return createHash4("sha256").update(input).digest("hex");
+  return createHash5("sha256").update(input).digest("hex");
 }
 function accountKeyFromBinding(binding) {
   const auth = binding?.auth;
@@ -28827,8 +28908,8 @@ function decodeNestedId(id) {
   return { execKey: match[1], seq: Number(match[2]) };
 }
 function uuidV5(namespace, name) {
-  const ns = createHash4("sha256").update(namespace).digest().subarray(0, 16);
-  const hash = createHash4("sha1").update(ns).update(name).digest();
+  const ns = createHash5("sha256").update(namespace).digest().subarray(0, 16);
+  const hash = createHash5("sha1").update(ns).update(name).digest();
   const bytes = Buffer.from(hash.subarray(0, 16));
   bytes[6] = bytes[6] & 15 | 80;
   bytes[8] = bytes[8] & 63 | 128;
@@ -29190,7 +29271,7 @@ var init_exec_tool = __esm(() => {
 });
 
 // src/code-mode/hashes.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function withoutCacheMarkers(value) {
   if (Array.isArray(value))
     return value.map(withoutCacheMarkers);
@@ -29213,7 +29294,7 @@ function canonicalJson(value) {
   return `{${body}}`;
 }
 function inputHash(input) {
-  return createHash5("sha256").update(canonicalJson(input ?? {})).digest("hex");
+  return createHash6("sha256").update(canonicalJson(input ?? {})).digest("hex");
 }
 function compareIds(a, b) {
   const da = decodeNestedId(a);
@@ -29224,7 +29305,7 @@ function compareIds(a, b) {
 }
 function batchHash(entries) {
   const ordered = [...entries].sort((a, b) => compareIds(a.toolUseId, b.toolUseId));
-  const hash = createHash5("sha256");
+  const hash = createHash6("sha256");
   for (const entry of ordered) {
     const canonical = entry.result ? canonicalJson([
       entry.toolUseId,
@@ -29238,7 +29319,7 @@ function batchHash(entries) {
   return hash.digest("hex");
 }
 function completionKey(batchHashes) {
-  const hash = createHash5("sha256");
+  const hash = createHash6("sha256");
   for (const h of batchHashes) {
     hash.update(h);
     hash.update(`
@@ -33371,9 +33452,9 @@ var init_prelude = __esm(() => {
 });
 
 // src/code-mode/sandbox/script-runtime.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 function seedNumber(seed) {
-  return createHash6("sha256").update(seed).digest().readUInt32BE(0);
+  return createHash7("sha256").update(seed).digest().readUInt32BE(0);
 }
 function utf8Bytes2(text) {
   return Buffer.byteLength(text, "utf8");
@@ -33919,9 +34000,9 @@ var init_script_runtime = __esm(() => {
 });
 
 // src/code-mode/turn-records.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 function sha256Hex2(text) {
-  return createHash7("sha256").update(text).digest("hex");
+  return createHash8("sha256").update(text).digest("hex");
 }
 function recordKey(sessionKey, anchor) {
   return `${sessionKey}\x00${anchor}`;
@@ -34758,9 +34839,9 @@ var init_tool_results = __esm(() => {
 });
 
 // src/code-mode/transliterate.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 function transliteratedCallId(firstToolUseId) {
-  return `call_${createHash8("sha256").update(firstToolUseId).digest("hex").slice(0, 32)}`;
+  return `call_${createHash9("sha256").update(firstToolUseId).digest("hex").slice(0, 32)}`;
 }
 function callExpression(use, names) {
   const name = typeof use.name === "string" ? use.name : "";
@@ -34834,12 +34915,12 @@ function relayNestedInput(block, repair) {
 }
 
 // src/code-mode/input-builder.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 function blocksOf2(message) {
   return message && Array.isArray(message.content) ? message.content : [];
 }
 function sha256Hex3(text) {
-  return createHash9("sha256").update(text).digest("hex");
+  return createHash10("sha256").update(text).digest("hex");
 }
 function reasoningKey(item) {
   if (typeof item.id === "string" && item.id)
@@ -35590,7 +35671,7 @@ var init_stores = __esm(() => {
 });
 
 // src/code-mode/request.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 function isLiteFallbackActive(model, now = Date.now()) {
   const until = liteFallbackUntil.get(model.toLowerCase());
   if (until === undefined)
@@ -35633,7 +35714,7 @@ function applyCodeModeToPayload(payload, ctx) {
   if (shape === "lite") {
     const reasoning = liteReasoning(payload, ctx.modelInfo);
     if (reasoning) {
-      const toolsHash = createHash10("sha256").update(JSON.stringify(ctx.execTool)).digest("hex");
+      const toolsHash = createHash11("sha256").update(JSON.stringify(ctx.execTool)).digest("hex");
       payload.reasoning = reasoning;
       delete payload.tools;
       delete payload.instructions;
@@ -37911,7 +37992,7 @@ var init_output_capture = __esm(() => {
 });
 
 // src/hooks/telemetry/aggregate.ts
-import { createHash as createHash11, randomBytes as randomBytes6 } from "crypto";
+import { createHash as createHash12, randomBytes as randomBytes6 } from "crypto";
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync11 } from "fs";
 import { homedir as homedir19 } from "os";
 import { dirname as dirname11, join as join19 } from "path";
@@ -37935,7 +38016,7 @@ function contextFillPct(peakTokens, window2 = enforcedContextWindow) {
   return Math.min(100, Math.max(0, Math.round(peakTokens / window2 * 100)));
 }
 function hashSessionId(rawSessionId, model) {
-  return createHash11("sha256").update(`${SESSION_SALT}:${rawSessionId}:${model}`).digest("hex");
+  return createHash12("sha256").update(`${SESSION_SALT}:${rawSessionId}:${model}`).digest("hex");
 }
 function setTelemetryConsent(value) {
   consent = value;
@@ -42128,7 +42209,7 @@ class AntigravityCredentialProvider {
     const token = readSharedAntigravityToken();
     if (!token)
       return;
-    const lineage = token.refresh_token ? `refresh:${token.refresh_token}` : token.access_token ? `access:${token.access_token}` : undefined;
+    const lineage = antigravityTokenLineageMaterial(token);
     return lineage ? `${lineage}
 ${antigravityHost()}` : undefined;
   }
@@ -44741,7 +44822,7 @@ var init_dist12 = __esm(() => {
 
 // src/auth/codex-pkce.ts
 import { exec as exec4 } from "child_process";
-import { createHash as createHash12, randomBytes as randomBytes7 } from "crypto";
+import { createHash as createHash13, randomBytes as randomBytes7 } from "crypto";
 import { createServer } from "http";
 import { promisify as promisify3 } from "util";
 function loginClaims(idToken) {
@@ -44853,7 +44934,7 @@ function waitForCallback(options, deps) {
 async function loginCodexPkce(deps = {}) {
   log("[CodexOAuth] Starting OAuth login flow");
   const verifier = randomBytes7(64).toString("base64url");
-  const challenge = createHash12("sha256").update(verifier).digest("base64url");
+  const challenge = createHash13("sha256").update(verifier).digest("base64url");
   const state = randomBytes7(32).toString("base64url");
   const options = {
     port: 1455,
@@ -48533,10 +48614,6 @@ var init_dynamic_models_catalog_store = __esm(() => {
 
 // src/providers/dynamic-models-catalog.ts
 import { createHmac as createHmac2, randomBytes as randomBytes11 } from "crypto";
-function isPersistedListProvider(provider) {
-  const def = getProviderByName(provider);
-  return def !== undefined && def.modelDiscovery !== undefined && !def.isLocal && (def.tier === "subscription" || def.tier === "dynamic-subscription");
-}
 function nowOf2(opts) {
   return opts?.now ? opts.now() : Date.now();
 }
@@ -48740,6 +48817,7 @@ var init_dynamic_models_catalog = __esm(() => {
   inFlight4 = new Map;
   listeners = new Set;
   credentials.onInvalidate((name) => {
+    invalidateModelDiscovery(name);
     if (name) {
       identityMemo.delete(name);
       liveMemory.delete(name);
@@ -50183,6 +50261,7 @@ var init_devin_request = __esm(() => {
 });
 
 // src/providers/devin/devin-models.ts
+import { createHash as createHash14 } from "crypto";
 function unaryMetadata(apiKey) {
   return msg(bytes(1, "chisel"), bytes(2, DEVIN_CLI_VERSION), bytes(3, apiKey), bytes(4, "en"), bytes(5, process.platform), bytes(7, DEVIN_CLI_VERSION));
 }
@@ -50370,20 +50449,25 @@ function decodeAllowedUids(body) {
   }
   return uids;
 }
+function hashApiKey(apiKey) {
+  return createHash14("sha256").update(apiKey).digest("hex");
+}
 async function getServedDevinModels(opts) {
   const now = Date.now();
-  if (!opts?.force && modelsCatalogCache && now - modelsCatalogCacheAt < MODELS_CATALOG_TTL_MS)
-    return modelsCatalogCache;
   const apiKey = opts?.apiKey ?? readDevinApiKey();
   if (!apiKey)
-    return modelsCatalogCache ?? [];
+    return [];
+  const keyHash = hashApiKey(apiKey);
+  const sameKeyCache = modelsCatalogCacheKeyHash === keyHash ? modelsCatalogCache : null;
+  if (!opts?.force && sameKeyCache && now - modelsCatalogCacheAt < MODELS_CATALOG_TTL_MS)
+    return sameKeyCache;
   try {
     const [configs, allowed] = await Promise.all([
       fetchDevinModelConfigs(apiKey),
       fetchDevinAllowedUids(apiKey)
     ]);
     if (configs.length === 0)
-      return modelsCatalogCache ?? [];
+      return sameKeyCache ?? [];
     const entitled = new Set(allowed);
     const served = configs.filter((config) => config.contextWindow > 0 && (entitled.size === 0 || entitled.has(config.uid)));
     if (entitled.size === 0) {
@@ -50391,13 +50475,14 @@ async function getServedDevinModels(opts) {
     }
     modelsCatalogCache = served;
     modelsCatalogCacheAt = now;
+    modelsCatalogCacheKeyHash = keyHash;
     return served;
   } catch (err) {
     log(`[Devin] served-model discovery error: ${err}`);
-    return modelsCatalogCache ?? [];
+    return sameKeyCache ?? [];
   }
 }
-var MODEL_CONFIGS_PATH = "/exa.api_server_pb.ApiServerService/GetCliModelConfigs", TEAM_SETTINGS_PATH = "/exa.seat_management_pb.SeatManagementService/GetCliTeamSettings", MODELS_CATALOG_TTL_MS, UNARY_TIMEOUT_MS = 1e4, modelsCatalogCache = null, modelsCatalogCacheAt = 0;
+var MODEL_CONFIGS_PATH = "/exa.api_server_pb.ApiServerService/GetCliModelConfigs", TEAM_SETTINGS_PATH = "/exa.seat_management_pb.SeatManagementService/GetCliTeamSettings", MODELS_CATALOG_TTL_MS, UNARY_TIMEOUT_MS = 1e4, modelsCatalogCache = null, modelsCatalogCacheAt = 0, modelsCatalogCacheKeyHash = null;
 var init_devin_models = __esm(() => {
   init_logger();
   init_devin_credentials();
@@ -50863,6 +50948,7 @@ var init_model_discovery_builtins = __esm(() => {
 });
 
 // src/providers/model-discovery.ts
+import { createHash as createHash15 } from "crypto";
 function toModelsCatalogEntry(model) {
   const { id, ...rest } = model;
   return { wireId: id, ...rest };
@@ -50873,6 +50959,10 @@ function registerModelDiscoveryFetcher(format, fetcher) {
 function getModelDiscoveryFetcher(format) {
   return _fetchers.get(format);
 }
+async function accountFingerprint(providerName) {
+  const identity = await credentials.accountIdentity(providerName, { allowOpPrompt: false });
+  return identity ? createHash15("sha256").update(identity).digest("hex") : undefined;
+}
 function recordFailure(failure) {
   _failures.set(failure.provider, failure);
   log(`[model-discovery:${failure.provider}] ${describeDiscoveryFailure(failure)}`);
@@ -50910,15 +51000,20 @@ function describeDiscoveryFailure(failure) {
       return `the endpoint answered${at} but listed no models`;
   }
 }
+function invalidationCount(providerName) {
+  return invalidationsOfAll + (invalidationsByProvider.get(providerName) ?? 0);
+}
 function invalidateModelDiscovery(provider) {
   if (provider) {
     _cache2.delete(provider);
     _failures.delete(provider);
     coldRefreshes.delete(provider);
+    invalidationsByProvider.set(provider, (invalidationsByProvider.get(provider) ?? 0) + 1);
   } else {
     _cache2.clear();
     _failures.clear();
     coldRefreshes.clear();
+    invalidationsOfAll++;
   }
 }
 function registryModelsEndpoint(providerName, def) {
@@ -51041,7 +51136,6 @@ async function discoverViaFetcher(providerName, format) {
   }
   _failures.delete(providerName);
   log(`[model-discovery:${providerName}] discovered ${models.length} models`);
-  _cache2.set(providerName, { models, expiresAt: Date.now() + CACHE_TTL_MS2 });
   return { kind: "served", models };
 }
 async function discoverProviderModelsCatalog(providerName) {
@@ -51075,9 +51169,32 @@ function peekDiscoveredModels(providerName) {
   return cached && cached.expiresAt > Date.now() ? cached.models : undefined;
 }
 async function discoverEveryServedModel(providerName) {
+  if (!getProviderByName(providerName)?.modelDiscovery) {
+    return { kind: "unsupported", reason: "no-descriptor" };
+  }
+  const invalidationsBefore = invalidationCount(providerName);
+  const perAccount = isPersistedListProvider(providerName);
+  const accountBefore = perAccount ? await accountFingerprint(providerName) : undefined;
   const cached = _cache2.get(providerName);
-  if (cached && cached.expiresAt > Date.now())
+  if (cached && cached.expiresAt > Date.now() && cached.account === accountBefore) {
     return { kind: "served", models: cached.models };
+  }
+  const outcome = await fetchServedModels(providerName);
+  if (outcome.kind !== "served")
+    return outcome;
+  const accountAfter = perAccount ? await accountFingerprint(providerName) : undefined;
+  if (accountBefore && accountAfter && accountBefore !== accountAfter)
+    return outcome;
+  if (invalidationCount(providerName) !== invalidationsBefore)
+    return outcome;
+  _cache2.set(providerName, {
+    models: outcome.models,
+    expiresAt: Date.now() + CACHE_TTL_MS2,
+    account: accountAfter ?? accountBefore
+  });
+  return outcome;
+}
+async function fetchServedModels(providerName) {
   const def = getProviderByName(providerName);
   const descriptor = def?.modelDiscovery;
   if (!def || !descriptor)
@@ -51171,7 +51288,6 @@ async function discoverEveryServedModel(providerName) {
   const models = parsed.models;
   _failures.delete(providerName);
   log(`[model-discovery:${providerName}] discovered ${models.length} models from ${endpoint}: ` + models.map((m) => `${m.id}(${m.contextWindow ?? "?"})`).join(", "));
-  _cache2.set(providerName, { models, expiresAt: Date.now() + CACHE_TTL_MS2 });
   return { kind: "served", models };
 }
 async function discoverProviderModels(providerName) {
@@ -51234,7 +51350,7 @@ function rankDiscoveredModels(models) {
     return diff !== 0 ? diff : compareByReleaseDateDesc(a, b);
   });
 }
-var _fetchers, CACHE_TTL_MS2, FETCH_TIMEOUT_MS3 = 5000, _cache2, _failures, coldRefreshes, MIN_CREATED_SECONDS = 946684800, MAX_CREATED_SECONDS = 4102444800, CONTINUATION_FIELDS, LIVE_DISCOVERY_BOUND_MS = 2000;
+var _fetchers, CACHE_TTL_MS2, FETCH_TIMEOUT_MS3 = 5000, _cache2, _failures, coldRefreshes, invalidationsByProvider, invalidationsOfAll = 0, MIN_CREATED_SECONDS = 946684800, MAX_CREATED_SECONDS = 4102444800, CONTINUATION_FIELDS, LIVE_DISCOVERY_BOUND_MS = 2000;
 var init_model_discovery = __esm(() => {
   init_authority();
   init_logger();
@@ -51245,6 +51361,7 @@ var init_model_discovery = __esm(() => {
   _cache2 = new Map;
   _failures = new Map;
   coldRefreshes = new Map;
+  invalidationsByProvider = new Map;
   CONTINUATION_FIELDS = ["has_more", "next", "next_page", "next_page_token"];
 });
 
@@ -59790,12 +59907,12 @@ var init_ollamacloud = __esm(() => {
 });
 
 // src/providers/transport/conversation-key.ts
-import { createHash as createHash13, randomBytes as randomBytes13 } from "crypto";
+import { createHash as createHash16, randomBytes as randomBytes13 } from "crypto";
 function conversationKey(claudeRequest) {
   const sessionId = extractSessionId(claudeRequest);
   if (!sessionId)
     return `claudish_${FALLBACK_CONVERSATION_KEY}`;
-  return `claudish_${createHash13("sha256").update(sessionId).digest("hex").slice(0, 32)}`;
+  return `claudish_${createHash16("sha256").update(sessionId).digest("hex").slice(0, 32)}`;
 }
 var FALLBACK_CONVERSATION_KEY;
 var init_conversation_key = __esm(() => {
@@ -61315,6 +61432,10 @@ function getProviderByName(name) {
     return builtin;
   return getRuntimeProviders().get(name);
 }
+function isPersistedListProvider(provider) {
+  const def = getProviderByName(provider);
+  return def !== undefined && def.modelDiscovery !== undefined && !def.isLocal && (def.tier === "subscription" || def.tier === "dynamic-subscription");
+}
 function getApiKeyInfo(providerName) {
   const def = getProviderByName(providerName);
   if (!def)
@@ -74653,14 +74774,14 @@ var init_prehydrate = __esm(() => {
 });
 
 // src/auth/claude-code-facts.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import { homedir as homedir33 } from "os";
 import { isAbsolute as isAbsolute2, resolve as resolve4 } from "path";
 function defaultConfigDir(env) {
   return resolve4(env.HOME || homedir33(), ".claude");
 }
 function configDirHash(configDir) {
-  return createHash14("sha256").update(configDir).digest("hex").slice(0, 8);
+  return createHash17("sha256").update(configDir).digest("hex").slice(0, 8);
 }
 function claudeCodeKeychainService(env = process.env) {
   const raw = env.CLAUDE_CONFIG_DIR?.trim();
@@ -122069,14 +122190,14 @@ function reportFetchFailure(state, cache, now) {
   if (state === "stale") {
     const ageMs = now.getTime() - Date.parse(cache.lastUpdated);
     const ageStr = humanizeAge(ageMs);
-    process.stderr.write(`WARNING: Catalog stale (${ageStr}). Using cached version. Run \`claudish --models-refresh\` to retry.
+    process.stderr.write(`WARNING: The ${MODEL_CATALOG_NAME} is stale (${ageStr}). Using cached version. Run \`claudish --models-refresh\` to retry.
 `);
     return "warned";
   }
   if (state === "fresh") {
     const ageMs = now.getTime() - Date.parse(cache.lastUpdated);
     const ageStr = humanizeAge(ageMs);
-    process.stderr.write(`WARNING: Catalog refresh failed (cache age ${ageStr}). Using cached version.
+    process.stderr.write(`WARNING: Could not refresh the ${MODEL_CATALOG_NAME} (cache age ${ageStr}). Using cached version.
 `);
     return "warned";
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudish",
-  "version": "14.18.1",
+  "version": "14.18.2",
   "description": "Run Claude Code with any model - OpenRouter, Ollama, LM Studio & local models",
   "type": "module",
   "main": "./dist/index.js",
@@ -71,10 +71,10 @@
     "ai"
   ],
   "optionalDependencies": {
-    "@claudish/magmux-darwin-arm64": "14.18.1",
-    "@claudish/magmux-darwin-x64": "14.18.1",
-    "@claudish/magmux-linux-arm64": "14.18.1",
-    "@claudish/magmux-linux-x64": "14.18.1"
+    "@claudish/magmux-darwin-arm64": "14.18.2",
+    "@claudish/magmux-darwin-x64": "14.18.2",
+    "@claudish/magmux-linux-arm64": "14.18.2",
+    "@claudish/magmux-linux-x64": "14.18.2"
   },
   "author": "Jack Rudenko <i@madappgang.com>",
   "license": "MIT",