openwork-server 0.18.60 → 0.18.62

package/dist/opencode-plugins/openwork-gateway-quota-v2.js

@@ -13739,6 +13739,138 @@ function hasGatewayUsageLimitHttpMarker(response) {
   return response.status === 429 && response.headers.get("X-OpenWork-Error-Code") === GATEWAY_USAGE_LIMIT_ERROR_CODE && response.headers.get("X-OpenWork-Usage-State") === "blocked";
 }
 
+// ../../packages/types/src/den/inference.ts
+var INFERENCE_WINDOW_DURATIONS_MS = {
+  five_hour: 5 * 60 * 60 * 1000,
+  weekly: 7 * 24 * 60 * 60 * 1000,
+  monthly: 30 * 24 * 60 * 60 * 1000
+};
+var OPENWORK_MODELS_ALLOWANCE_ERROR_CODE = "openwork_models_allowance_reached";
+var OPENWORK_MODELS_ALLOWANCE_SOURCE = "openwork_models";
+var OPENWORK_MODELS_ALLOWANCE_MESSAGE = "Your workspace used its OpenWork Models allowance.";
+function openWorkModelsAllowanceErrorBody() {
+  return {
+    error: {
+      message: OPENWORK_MODELS_ALLOWANCE_MESSAGE,
+      type: "usage_limit_error",
+      param: null,
+      code: OPENWORK_MODELS_ALLOWANCE_ERROR_CODE,
+      source: OPENWORK_MODELS_ALLOWANCE_SOURCE
+    }
+  };
+}
+function hasOpenWorkModelsAllowanceHttpMarker(response) {
+  return response.status === 429 && response.headers.get("X-OpenWork-Error-Code") === OPENWORK_MODELS_ALLOWANCE_ERROR_CODE && response.headers.get("X-OpenWork-Usage-State") === "blocked";
+}
+var INFERENCE_ACCESS_REASONS = [
+  "admin_disabled",
+  "not_eligible",
+  "free_disabled",
+  "accounting_unavailable",
+  "free_allowance_exhausted",
+  "upstream_unavailable"
+];
+var freeInferenceProviderSummarySchema = exports_external.object({
+  state: exports_external.enum(["available", "disabled", "unavailable"]),
+  reason: exports_external.union([exports_external.enum(INFERENCE_ACCESS_REASONS), exports_external.null()]),
+  defaultPinned: exports_external.boolean(),
+  modelGroup: exports_external.object({ id: exports_external.literal("free"), name: exports_external.literal("Free") }),
+  catalog: exports_external.array(exports_external.object({ modelID: exports_external.string(), displayName: exports_external.string(), providerName: exports_external.string(), summary: exports_external.string(), recommended: exports_external.boolean(), rank: exports_external.number(), capabilities: exports_external.array(exports_external.string()) })),
+  allowance: exports_external.object({
+    usageScope: exports_external.literal("organization"),
+    allowanceScope: exports_external.literal("person"),
+    windowStartAt: exports_external.string().datetime(),
+    resetsAt: exports_external.string().datetime(),
+    weeklyLimitUsd: exports_external.number().finite().nonnegative(),
+    joinedMembers: exports_external.number().int().nonnegative(),
+    eligibleMembers: exports_external.number().int().nonnegative(),
+    exhaustedMembers: exports_external.number().int().nonnegative().nullable().describe("Current eligible members whose recorded weekly usage has reached their person-wide limit; not a probe of Gateway request headroom. Null when accounting cannot be verified."),
+    usedUsd: exports_external.number().finite().nonnegative().nullable(),
+    requestCount: exports_external.number().int().nonnegative().nullable()
+  })
+});
+var inferenceApiKeyMapSecretSchema = exports_external.record(exports_external.string(), exports_external.string()).refine((value) => Object.keys(value).length > 0, {
+  message: "api_key_map must contain at least one entry"
+});
+var inferenceAwsKeysSecretSchema = exports_external.object({
+  accessKeyId: exports_external.string().min(1),
+  secretAccessKey: exports_external.string().min(1),
+  sessionToken: exports_external.string().min(1).optional(),
+  region: exports_external.string().min(1).optional()
+});
+var inferenceGcpServiceAccountSecretSchema = exports_external.looseObject({
+  client_email: exports_external.string().min(1),
+  private_key: exports_external.string().min(1),
+  token_uri: exports_external.string().min(1)
+});
+var authorizationRevisionSchema = exports_external.string().regex(/^[A-Za-z0-9_-]{43}$/);
+var microsoftTenantIdSchema = exports_external.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
+var inferenceOauthTokenSecretSchema = exports_external.object({
+  accessToken: exports_external.string().min(1),
+  refreshToken: exports_external.string().min(1).optional(),
+  tokenType: exports_external.string().min(1).optional(),
+  googleIdentity: exports_external.object({
+    subject: exports_external.string().min(1).max(255),
+    email: exports_external.email(),
+    emailVerified: exports_external.literal(true),
+    clientId: exports_external.string().min(1),
+    authorizationRevision: authorizationRevisionSchema.optional()
+  }).optional(),
+  microsoftIdentity: exports_external.object({
+    tenantId: microsoftTenantIdSchema,
+    objectId: exports_external.string().min(1).max(255),
+    userName: exports_external.string().min(1).max(320).nullable(),
+    clientId: exports_external.string().min(1),
+    authorizationRevision: authorizationRevisionSchema
+  }).optional()
+});
+var awsAccountIdSchema = exports_external.string().regex(/^\d{12}$/);
+var awsPermissionSetNameSchema = exports_external.string().regex(/^[\w+=,.@-]{1,32}$/);
+var awsSsoStartUrlSchema = exports_external.string().max(2048).refine((value) => {
+  try {
+    const url2 = new URL(value);
+    return url2.protocol === "https:" && !url2.username && !url2.password && !url2.search && !url2.hash && !url2.port && /^[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:awsapps\.com|app\.aws)$/i.test(url2.hostname);
+  } catch {
+    return false;
+  }
+}, { message: "Use the AWS access portal URL, for example https://d-xxxxxxxxxx.awsapps.com/start." });
+var awsRegionSchema = exports_external.string().max(32).regex(/^[a-z]{2}(?:-[a-z]+)+-\d{1,2}$/);
+var gatewayAwsSsoSettingsSchema = exports_external.object({
+  startUrl: awsSsoStartUrlSchema,
+  region: awsRegionSchema,
+  accountId: awsAccountIdSchema,
+  roleName: awsPermissionSetNameSchema
+}).strict();
+var inferenceAwsSsoSecretSchema = exports_external.object({
+  accessToken: exports_external.string().min(1).max(16384),
+  refreshToken: exports_external.string().min(1).max(16384),
+  clientId: exports_external.string().min(1).max(4096),
+  clientSecret: exports_external.string().min(1).max(16384),
+  clientSecretExpiresAt: exports_external.number().int().positive(),
+  sso: gatewayAwsSsoSettingsSchema,
+  identity: exports_external.object({
+    arn: exports_external.string().min(1).max(2048),
+    userName: exports_external.string().min(1).max(320).nullable(),
+    authorizationRevision: authorizationRevisionSchema
+  })
+});
+var GATEWAY_MEMBER_SIGN_IN_METHODS = ["google", "aws_sso", "microsoft"];
+var gatewayMemberConnectionsResponseSchema = exports_external.object({
+  connections: exports_external.array(exports_external.object({
+    providerId: exports_external.string(),
+    signInMethod: exports_external.enum(GATEWAY_MEMBER_SIGN_IN_METHODS).default("google"),
+    credentialSetId: exports_external.string(),
+    providerName: exports_external.string(),
+    name: exports_external.string(),
+    ready: exports_external.boolean(),
+    hasAccess: exports_external.boolean(),
+    hasCredential: exports_external.boolean(),
+    configurationRequired: exports_external.boolean().default(false),
+    authorizationRevision: exports_external.string().nullable(),
+    accountEmail: exports_external.string().nullable()
+  }))
+});
+
 // src/gateway-quota.ts
 var GATEWAY_QUOTA_MESSAGE = "You have reached your AI Gateway usage limit.";
 var MAX_ERROR_BYTES = 16384;
@@ -13761,6 +13893,61 @@ function gatewayBase(id, baseURL) {
     return;
   }
 }
+function openWorkModelsBase(id, baseURL) {
+  if (id !== "openwork" || typeof baseURL !== "string")
+    return;
+  try {
+    const url2 = new URL(baseURL);
+    if (!["https:", "http:"].includes(url2.protocol) || url2.username || url2.password || url2.search || url2.hash)
+      return;
+    url2.pathname = url2.pathname.replace(/\/+$/, "");
+    if (!url2.pathname.endsWith("/api/v1"))
+      return;
+    return url2;
+  } catch {
+    return;
+  }
+}
+async function isOpenWorkModelsAllowanceResponse(base, url2, response) {
+  if (url2.origin !== base.origin || !url2.pathname.startsWith(`${base.pathname}/`) || response.url && new URL(response.url).origin !== base.origin || !hasOpenWorkModelsAllowanceHttpMarker(response))
+    return false;
+  const body = await readBoundedJson(response);
+  return record2(body) && record2(body.error) && body.error.code === OPENWORK_MODELS_ALLOWANCE_ERROR_CODE && body.error.source === OPENWORK_MODELS_ALLOWANCE_SOURCE;
+}
+async function readBoundedJson(response) {
+  const reader = response.clone().body?.getReader();
+  if (!reader)
+    return null;
+  let timer;
+  const expired = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(null), BODY_TIMEOUT_MS);
+  });
+  const read = async () => {
+    let size = 0;
+    let text = "";
+    const decoder = new TextDecoder;
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      size += chunk.value.byteLength;
+      if (size > MAX_ERROR_BYTES)
+        return null;
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+    return JSON.parse(text + decoder.decode());
+  };
+  try {
+    return await Promise.race([read(), expired]);
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+    reader.cancel().catch(() => {
+      return;
+    });
+  }
+}
 async function isGatewayQuotaResponse(base, url2, response) {
   if (url2.origin !== base.origin || !url2.pathname.startsWith(`${base.pathname}/`) || response.url && new URL(response.url).origin !== base.origin || !hasGatewayUsageLimitHttpMarker(response))
     return false;

package/dist/opencode-plugins/openwork-gateway-quota.js

@@ -14053,6 +14053,138 @@ function hasGatewayUsageLimitHttpMarker(response) {
   return response.status === 429 && response.headers.get("X-OpenWork-Error-Code") === GATEWAY_USAGE_LIMIT_ERROR_CODE && response.headers.get("X-OpenWork-Usage-State") === "blocked";
 }
 
+// ../../packages/types/src/den/inference.ts
+var INFERENCE_WINDOW_DURATIONS_MS = {
+  five_hour: 5 * 60 * 60 * 1000,
+  weekly: 7 * 24 * 60 * 60 * 1000,
+  monthly: 30 * 24 * 60 * 60 * 1000
+};
+var OPENWORK_MODELS_ALLOWANCE_ERROR_CODE = "openwork_models_allowance_reached";
+var OPENWORK_MODELS_ALLOWANCE_SOURCE = "openwork_models";
+var OPENWORK_MODELS_ALLOWANCE_MESSAGE = "Your workspace used its OpenWork Models allowance.";
+function openWorkModelsAllowanceErrorBody() {
+  return {
+    error: {
+      message: OPENWORK_MODELS_ALLOWANCE_MESSAGE,
+      type: "usage_limit_error",
+      param: null,
+      code: OPENWORK_MODELS_ALLOWANCE_ERROR_CODE,
+      source: OPENWORK_MODELS_ALLOWANCE_SOURCE
+    }
+  };
+}
+function hasOpenWorkModelsAllowanceHttpMarker(response) {
+  return response.status === 429 && response.headers.get("X-OpenWork-Error-Code") === OPENWORK_MODELS_ALLOWANCE_ERROR_CODE && response.headers.get("X-OpenWork-Usage-State") === "blocked";
+}
+var INFERENCE_ACCESS_REASONS = [
+  "admin_disabled",
+  "not_eligible",
+  "free_disabled",
+  "accounting_unavailable",
+  "free_allowance_exhausted",
+  "upstream_unavailable"
+];
+var freeInferenceProviderSummarySchema = exports_external.object({
+  state: exports_external.enum(["available", "disabled", "unavailable"]),
+  reason: exports_external.union([exports_external.enum(INFERENCE_ACCESS_REASONS), exports_external.null()]),
+  defaultPinned: exports_external.boolean(),
+  modelGroup: exports_external.object({ id: exports_external.literal("free"), name: exports_external.literal("Free") }),
+  catalog: exports_external.array(exports_external.object({ modelID: exports_external.string(), displayName: exports_external.string(), providerName: exports_external.string(), summary: exports_external.string(), recommended: exports_external.boolean(), rank: exports_external.number(), capabilities: exports_external.array(exports_external.string()) })),
+  allowance: exports_external.object({
+    usageScope: exports_external.literal("organization"),
+    allowanceScope: exports_external.literal("person"),
+    windowStartAt: exports_external.string().datetime(),
+    resetsAt: exports_external.string().datetime(),
+    weeklyLimitUsd: exports_external.number().finite().nonnegative(),
+    joinedMembers: exports_external.number().int().nonnegative(),
+    eligibleMembers: exports_external.number().int().nonnegative(),
+    exhaustedMembers: exports_external.number().int().nonnegative().nullable().describe("Current eligible members whose recorded weekly usage has reached their person-wide limit; not a probe of Gateway request headroom. Null when accounting cannot be verified."),
+    usedUsd: exports_external.number().finite().nonnegative().nullable(),
+    requestCount: exports_external.number().int().nonnegative().nullable()
+  })
+});
+var inferenceApiKeyMapSecretSchema = exports_external.record(exports_external.string(), exports_external.string()).refine((value) => Object.keys(value).length > 0, {
+  message: "api_key_map must contain at least one entry"
+});
+var inferenceAwsKeysSecretSchema = exports_external.object({
+  accessKeyId: exports_external.string().min(1),
+  secretAccessKey: exports_external.string().min(1),
+  sessionToken: exports_external.string().min(1).optional(),
+  region: exports_external.string().min(1).optional()
+});
+var inferenceGcpServiceAccountSecretSchema = exports_external.looseObject({
+  client_email: exports_external.string().min(1),
+  private_key: exports_external.string().min(1),
+  token_uri: exports_external.string().min(1)
+});
+var authorizationRevisionSchema = exports_external.string().regex(/^[A-Za-z0-9_-]{43}$/);
+var microsoftTenantIdSchema = exports_external.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
+var inferenceOauthTokenSecretSchema = exports_external.object({
+  accessToken: exports_external.string().min(1),
+  refreshToken: exports_external.string().min(1).optional(),
+  tokenType: exports_external.string().min(1).optional(),
+  googleIdentity: exports_external.object({
+    subject: exports_external.string().min(1).max(255),
+    email: exports_external.email(),
+    emailVerified: exports_external.literal(true),
+    clientId: exports_external.string().min(1),
+    authorizationRevision: authorizationRevisionSchema.optional()
+  }).optional(),
+  microsoftIdentity: exports_external.object({
+    tenantId: microsoftTenantIdSchema,
+    objectId: exports_external.string().min(1).max(255),
+    userName: exports_external.string().min(1).max(320).nullable(),
+    clientId: exports_external.string().min(1),
+    authorizationRevision: authorizationRevisionSchema
+  }).optional()
+});
+var awsAccountIdSchema = exports_external.string().regex(/^\d{12}$/);
+var awsPermissionSetNameSchema = exports_external.string().regex(/^[\w+=,.@-]{1,32}$/);
+var awsSsoStartUrlSchema = exports_external.string().max(2048).refine((value) => {
+  try {
+    const url2 = new URL(value);
+    return url2.protocol === "https:" && !url2.username && !url2.password && !url2.search && !url2.hash && !url2.port && /^[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:awsapps\.com|app\.aws)$/i.test(url2.hostname);
+  } catch {
+    return false;
+  }
+}, { message: "Use the AWS access portal URL, for example https://d-xxxxxxxxxx.awsapps.com/start." });
+var awsRegionSchema = exports_external.string().max(32).regex(/^[a-z]{2}(?:-[a-z]+)+-\d{1,2}$/);
+var gatewayAwsSsoSettingsSchema = exports_external.object({
+  startUrl: awsSsoStartUrlSchema,
+  region: awsRegionSchema,
+  accountId: awsAccountIdSchema,
+  roleName: awsPermissionSetNameSchema
+}).strict();
+var inferenceAwsSsoSecretSchema = exports_external.object({
+  accessToken: exports_external.string().min(1).max(16384),
+  refreshToken: exports_external.string().min(1).max(16384),
+  clientId: exports_external.string().min(1).max(4096),
+  clientSecret: exports_external.string().min(1).max(16384),
+  clientSecretExpiresAt: exports_external.number().int().positive(),
+  sso: gatewayAwsSsoSettingsSchema,
+  identity: exports_external.object({
+    arn: exports_external.string().min(1).max(2048),
+    userName: exports_external.string().min(1).max(320).nullable(),
+    authorizationRevision: authorizationRevisionSchema
+  })
+});
+var GATEWAY_MEMBER_SIGN_IN_METHODS = ["google", "aws_sso", "microsoft"];
+var gatewayMemberConnectionsResponseSchema = exports_external.object({
+  connections: exports_external.array(exports_external.object({
+    providerId: exports_external.string(),
+    signInMethod: exports_external.enum(GATEWAY_MEMBER_SIGN_IN_METHODS).default("google"),
+    credentialSetId: exports_external.string(),
+    providerName: exports_external.string(),
+    name: exports_external.string(),
+    ready: exports_external.boolean(),
+    hasAccess: exports_external.boolean(),
+    hasCredential: exports_external.boolean(),
+    configurationRequired: exports_external.boolean().default(false),
+    authorizationRevision: exports_external.string().nullable(),
+    accountEmail: exports_external.string().nullable()
+  }))
+});
+
 // src/gateway-quota.ts
 var GATEWAY_QUOTA_MESSAGE = "You have reached your AI Gateway usage limit.";
 var MAX_ERROR_BYTES = 16384;
@@ -14075,6 +14207,61 @@ function gatewayBase(id, baseURL) {
     return;
   }
 }
+function openWorkModelsBase(id, baseURL) {
+  if (id !== "openwork" || typeof baseURL !== "string")
+    return;
+  try {
+    const url2 = new URL(baseURL);
+    if (!["https:", "http:"].includes(url2.protocol) || url2.username || url2.password || url2.search || url2.hash)
+      return;
+    url2.pathname = url2.pathname.replace(/\/+$/, "");
+    if (!url2.pathname.endsWith("/api/v1"))
+      return;
+    return url2;
+  } catch {
+    return;
+  }
+}
+async function isOpenWorkModelsAllowanceResponse(base, url2, response) {
+  if (url2.origin !== base.origin || !url2.pathname.startsWith(`${base.pathname}/`) || response.url && new URL(response.url).origin !== base.origin || !hasOpenWorkModelsAllowanceHttpMarker(response))
+    return false;
+  const body = await readBoundedJson(response);
+  return record2(body) && record2(body.error) && body.error.code === OPENWORK_MODELS_ALLOWANCE_ERROR_CODE && body.error.source === OPENWORK_MODELS_ALLOWANCE_SOURCE;
+}
+async function readBoundedJson(response) {
+  const reader = response.clone().body?.getReader();
+  if (!reader)
+    return null;
+  let timer;
+  const expired = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(null), BODY_TIMEOUT_MS);
+  });
+  const read = async () => {
+    let size = 0;
+    let text = "";
+    const decoder = new TextDecoder;
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      size += chunk.value.byteLength;
+      if (size > MAX_ERROR_BYTES)
+        return null;
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+    return JSON.parse(text + decoder.decode());
+  };
+  try {
+    return await Promise.race([read(), expired]);
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+    reader.cancel().catch(() => {
+      return;
+    });
+  }
+}
 async function isGatewayQuotaResponse(base, url2, response) {
   if (url2.origin !== base.origin || !url2.pathname.startsWith(`${base.pathname}/`) || response.url && new URL(response.url).origin !== base.origin || !hasGatewayUsageLimitHttpMarker(response))
     return false;
@@ -14114,38 +14301,60 @@ async function isGatewayQuotaResponse(base, url2, response) {
 }
 
 // src/opencode-plugins/openwork-gateway-quota.ts
+function noRetryFetch(base, matches, error48) {
+  return async (input, init) => {
+    const response = await globalThis.fetch(input, init);
+    const url2 = new URL(input instanceof Request ? input.url : input.toString());
+    if (!await matches(base, url2, response))
+      return response;
+    response.body?.cancel().catch(() => {
+      return;
+    });
+    throw error48(url2, response);
+  };
+}
 var OpenWorkGatewayQuota = async () => ({
   config: async (config2) => {
     for (const [id, provider] of Object.entries(config2.provider ?? {})) {
-      if (!record2(provider) || !record2(provider.options))
-        continue;
-      const options = provider.options;
-      const base = gatewayBase(id, options.baseURL);
-      if (!base || options.fetch !== undefined)
+      if (!record2(provider))
         continue;
-      options.fetch = async (input, init) => {
-        const response = await globalThis.fetch(input, init);
-        const url2 = new URL(input instanceof Request ? input.url : input.toString());
-        if (!await isGatewayQuotaResponse(base, url2, response))
-          return response;
-        response.body?.cancel().catch(() => {
-          return;
-        });
-        throw new APICallError({
-          message: GATEWAY_QUOTA_MESSAGE,
+      const models = openWorkModelsBase(id, record2(provider.options) ? provider.options.baseURL ?? provider.api : provider.api);
+      if (models) {
+        const options2 = record2(provider.options) ? provider.options : {};
+        if (options2.fetch !== undefined)
+          continue;
+        options2.fetch = noRetryFetch(models, isOpenWorkModelsAllowanceResponse, (url2, response) => new APICallError({
+          message: OPENWORK_MODELS_ALLOWANCE_MESSAGE,
           url: `${url2.origin}${url2.pathname}`,
           requestBodyValues: undefined,
           statusCode: response.status,
           responseHeaders: Object.fromEntries(response.headers),
-          responseBody: JSON.stringify({ error: {
-            type: "usage_limit_error",
-            code: GATEWAY_USAGE_LIMIT_ERROR_CODE,
-            source: "openwork_gateway",
-            message: GATEWAY_QUOTA_MESSAGE
-          } }),
+          responseBody: JSON.stringify(openWorkModelsAllowanceErrorBody()),
           isRetryable: false
-        });
-      };
+        }));
+        provider.options = options2;
+        continue;
+      }
+      if (!record2(provider.options))
+        continue;
+      const options = provider.options;
+      const base = gatewayBase(id, options.baseURL);
+      if (!base || options.fetch !== undefined)
+        continue;
+      options.fetch = noRetryFetch(base, isGatewayQuotaResponse, (url2, response) => new APICallError({
+        message: GATEWAY_QUOTA_MESSAGE,
+        url: `${url2.origin}${url2.pathname}`,
+        requestBodyValues: undefined,
+        statusCode: response.status,
+        responseHeaders: Object.fromEntries(response.headers),
+        responseBody: JSON.stringify({ error: {
+          type: "usage_limit_error",
+          code: GATEWAY_USAGE_LIMIT_ERROR_CODE,
+          source: "openwork_gateway",
+          message: GATEWAY_QUOTA_MESSAGE
+        } }),
+        isRetryable: false
+      }));
     }
   }
 });

package/dist/opencode-plugins/openwork-provider-sync-v2.js

@@ -2944,6 +2944,87 @@ function toProviderRecord(provider, apiKey) {
   return { info, models };
 }
 
+// ../../packages/opencode-plugin/src/inventory-fetch.ts
+function abortError(signal) {
+  return signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
+}
+function createInventoryFetchHub() {
+  const shared = new Map;
+  let sequence = 0;
+  const ticket = () => ++sequence;
+  const start = (key, request) => {
+    const controller = new AbortController;
+    const entry = {
+      startedAfter: ++sequence,
+      controller,
+      joiners: 0,
+      settled: false,
+      result: fetchGatewayInventory(request.fetch, request.session, controller.signal, request.scope)
+    };
+    const settle = () => {
+      entry.settled = true;
+      if (shared.get(key) === entry)
+        shared.delete(key);
+    };
+    entry.result.then(settle, settle);
+    shared.set(key, entry);
+    return entry;
+  };
+  const fetch2 = async (request) => {
+    if (request.signal?.aborted)
+      throw abortError(request.signal);
+    const key = `${inventorySessionKey(request.session)}:${request.scope}`;
+    const entry = shared.get(key);
+    const current = entry && !entry.settled && entry.startedAfter > request.ticket ? entry : start(key, request);
+    current.joiners += 1;
+    const leave = () => {
+      current.joiners -= 1;
+      if (current.joiners === 0 && !current.settled)
+        current.controller.abort();
+    };
+    const signal = request.signal;
+    if (!signal) {
+      try {
+        return await current.result;
+      } finally {
+        leave();
+      }
+    }
+    let onAbort;
+    const aborted = new Promise((_, reject) => {
+      onAbort = () => reject(abortError(signal));
+      signal.addEventListener("abort", onAbort, { once: true });
+    });
+    try {
+      return await Promise.race([current.result, aborted]);
+    } finally {
+      if (onAbort)
+        signal.removeEventListener("abort", onAbort);
+      leave();
+    }
+  };
+  return Object.freeze({ ticket: Object.freeze(ticket), fetch: Object.freeze(fetch2) });
+}
+function hub() {
+  let current = globalThis.__openworkGatewayInventoryFetches;
+  if (!current) {
+    current = createInventoryFetchHub();
+    Object.defineProperty(globalThis, "__openworkGatewayInventoryFetches", {
+      value: current,
+      writable: false,
+      configurable: false,
+      enumerable: false
+    });
+  }
+  return current;
+}
+function inventoryRequestTicket() {
+  return hub().ticket();
+}
+function fetchSharedGatewayInventory(request) {
+  return hub().fetch(request);
+}
+
 // ../../packages/opencode-plugin/src/desktop.ts
 var CACHE_KEY = "desktop/provider-inventory";
 var digest = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
@@ -3100,9 +3181,10 @@ function createDesktopProviderPlugin(deps = {}) {
         const accountKey = key;
         const generation = epoch;
         const current = () => !lifetime.signal.aborted && generation === epoch;
+        const ticket = inventoryRequestTicket();
         running = (async () => {
           try {
-            const gateway = await fetchGatewayInventory(inventoryFetch(source), inventorySession(source), refreshController.signal, "desktop");
+            const gateway = await fetchSharedGatewayInventory({ fetch: inventoryFetch(source), session: inventorySession(source), scope: "desktop", ticket, signal: refreshController.signal });
             if (!current())
               return;
             const next = { version: 1, connectionKey: accountKey, apiBaseUrl: source.apiBaseUrl, fetchedAt: now(), gateway, mcp: null };
@@ -3662,6 +3744,7 @@ function createPlugin(deps = {}) {
         });
       };
       const refreshOnce = async (force) => {
+        const ticket = inventoryRequestTicket();
         const epoch = generation;
         const current = () => !disposed && epoch === generation;
         const connection = await ctx.integration.connection.active(INTEGRATION_ID).catch(() => {
@@ -3744,7 +3827,7 @@ function createPlugin(deps = {}) {
             return;
           syncStream(session, liveProviderSync);
           const [gateway, mcp] = await Promise.all([
-            options.providers ? fetchGatewayInventory(fetcher, session, refreshController.signal).then((inventory2) => ({ providers: inventory2.providers, apiKey: inventory2.apiKey })) : Promise.resolve(null),
+            options.providers ? fetchSharedGatewayInventory({ fetch: fetcher, session, scope: "den", ticket, signal: refreshController.signal }).then((inventory2) => ({ providers: inventory2.providers, apiKey: inventory2.apiKey })) : Promise.resolve(null),
             options.mcp ? (async () => {
               const previous = sameAccount?.mcp?.token ?? null;
               const token = previous && !mcpTokenNeedsRenewal(previous, now()) ? previous : await mintMcpToken(fetcher, session);