pi-hypercharm-provider 1.3.39 → 1.3.40

package/AGENTS.md

@@ -23,6 +23,7 @@ When a model needs overrides, new properties, or corrections, edit the appropria
 | `scripts/update-models.js` | The sync script itself (edit only if changing how models are fetched/transformed). |
 | `identity.ts` | Every identifier this extension registers into a shared pi surface (provider id, custom api name, status/widget keys, command, prism entry type, auth key + env var, config/cache file names). `tests/identity.test.ts` enforces namespacing, uniqueness, and disjointness from the official `@charmland/pi-hyper-provider` — never hardcode one of these elsewhere. |
 | `notify.ts` | Deduplicated warning sink: fetch/parse failures go to the session UI once one is active, stderr before that, never thrown. |
+| `sync-policy.ts` | Quiet startup sync policy (TTL, key fingerprint, cross-process lock). Provider-agnostic and shared verbatim across pi-*-provider repos — keep it free of provider specifics. Also gates the footer's startup account prefetch (`hypercharm-account.json`). |
 | `prism.ts` | Hyper routing-header validation (sanitizer + persisted-entry re-validation). Pure module — no pi imports; exercised by `tests/prism.test.ts`. |
 
 ## Data Flow
@@ -64,8 +65,9 @@ Provider API  ──fetch──►  models.json  ──apply──►  patch.jso
 ## Tests
 
 `npm run check` runs `tsc --noEmit`, the dependency-free status smoke test, and
-the node:test suites (through `jiti/register` so the extension's extensionless
-TS imports resolve). `npm test` runs only the test suites.
+the test suites: the node:test suites (through `jiti/register` so the
+extension's extensionless TS imports resolve), then the vitest suites listed in
+`vitest.config.ts`. `npm test` runs only the test suites.
 
 | File | Scope |
 |------|-------|
@@ -73,6 +75,8 @@ TS imports resolve). `npm test` runs only the test suites.
 | `tests/identity.test.ts` | Co-install invariant: namespaced + unique + disjoint from the official provider's reserved names |
 | `tests/prism.test.ts` | Prism header/label sanitization and persisted-entry validation |
 | `tests/notify.test.ts` | Warning dedupe, UI routing, stale-ctx stderr fallback |
+| `tests/sync-policy.test.ts` | (vitest) Shared quiet-sync policy: TTL, fingerprint, backoff, lock — copied verbatim across pi-*-provider repos |
+| `tests/quiet-startup-sync.test.ts` | (vitest) session_start integration: no-credential/no-fetch, TTL, lock, OAuth identity, /login force, shared account snapshot, UI-only account prefetch |
 | `tests/provider.integration.test.ts` | Real pi runtime (DefaultResourceLoader + createAgentSession + ExtensionRunner): embedded catalog, catalog hot-swap/cache/retention, deprecated grace window, warning surfacing, prism entry durability, and co-installation against `tests/fixtures/official-surface.ts` |
 
 The integration suite stubs `globalThis.fetch` and emits the session lifecycle

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.3.40
+
+- Quiet startup sync: background `/v1/provider` revalidation runs only with credentials, only when the disk cache is older than 1 hour (`PI_PROVIDER_SYNC_TTL_MS`, `0` = always), missing, or fetched with different credentials, and only in one pi process at a time (lock file next to the cache). Failed refreshes back off for 5 minutes; sessions that skip adopt a cache refreshed by another process. A completed `/login` forces a revalidation.
+- OAuth sessions are fingerprinted by the stored refresh token (not the rotating access token), so token refreshes don't trigger refetches. Only a salted sha256 fingerprint is stored (`cache/hypercharm-models.sync.json`); the cache file format is unchanged.
+- The footer's session-start credits/team/devices prefetch now runs only in interactive sessions (not `pi -p` or child agents) and is shared across pi processes through `cache/hypercharm-account.json` (2-minute window). Turn-triggered balance polls are unchanged.
+- Write the model cache atomically; `session_start` never awaits the network and swallows background failures.
+- Add vitest coverage for the sync policy and the session_start integration (`npm test` runs it after the node:test suites).
+
 ## 1.3.36
 
 - Pin Pi SDK development dependencies to 1.0.0 while retaining wildcard host peers.

package/README.md

@@ -24,7 +24,7 @@ Run `bun run test:pi` for offline manifest, catalog, lifecycle and streaming che
 - **DeepSeek Native Thinking** — Uses the `deepseek` thinking format for Charm Hyper requests, with native `reasoning_effort` on models that publish levels
 - **OpenAI-compatible API** via Charm Hyper's `/v1/chat/completions` endpoint
 - **OAuth Device Flow** — sign in with `/login` under the `hypercharm` provider (independent of the official provider's `hyper` registration)
-- **Official Catalog Sync** from Charm's typed `/v1/provider` endpoint, matching `@charmland/pi-hyper-provider`
+- **Official Catalog Sync** from Charm's typed `/v1/provider` endpoint, matching `@charmland/pi-hyper-provider` — refreshed quietly in the background, at most hourly and by one pi process at a time ([details](#model-sync))
 - **Reasoning Models** with provider-published on/off states and exact effort levels
 - **Attachment Support** for models the official catalog marks as attachment-capable
 
@@ -138,7 +138,11 @@ renders when the session-start or model-select credits fetch lands, and the
 session side joins it after the first HyperCharm turn completes. Selecting
 another provider hides it (`hideOnOtherProvider` defaults to `true`), the
 balance refreshes when the agent run fully settles, and sessions that never
-use HyperCharm make no status-related API calls:
+use HyperCharm make no status-related API calls. The session-start prefetch
+runs only in interactive sessions (never in `pi -p` or child agents) and is
+shared across pi processes: one process polls and writes
+`~/.pi/agent/cache/hypercharm-account.json`, and sessions started within the
+next 2 minutes render that snapshot instead of polling again:
 
 ```
 ⚡ 1.24 hc · 7 req                       Xu's Team ◆ 249 hc · 996/1k/h · 29d
@@ -209,6 +213,7 @@ Get your API key from [hyper.charm.land](https://hyper.charm.land).
 | Variable | Required | Description |
 |----------|----------|-------------|
 | `HYPERCHARM_API_KEY` | No | Your Charm Hyper API key (fallback if not in auth.json) |
+| `PI_PROVIDER_SYNC_TTL_MS` | No | Model sync freshness window in ms (default `3600000`; `0` = revalidate every session start) |
 
 ## Configuration
 
@@ -246,6 +251,25 @@ Model metadata matches Charm's official [`@charmland/pi-hyper-provider`](https:/
 
 Each entry carries the model's full level map, because `patch.json` replaces `thinkingLevelMap` wholesale rather than merging it.
 
+## Model sync
+
+Startup never waits on the network. pi starts with the cached catalog (`~/.pi/agent/cache/hypercharm-models.json`,
+falling back to the bundled `models.json`) and revalidates against `/v1/provider` in the background — only when:
+
+- HyperCharm credentials are configured (no credentials, no request),
+- the cache is older than 1 hour, missing, or was fetched with different credentials, and
+- no other pi process is already refreshing it (a `hypercharm-models.lock` file next to the cache).
+
+So `/new`, `/reload`, `pi -p` and fan-out child agents share one cache instead of each calling the API; a
+session that skips the fetch still picks up a cache another process refreshed. A failed refresh is retried after
+5 minutes at the earliest. `PI_PROVIDER_SYNC_TTL_MS` changes the window (`0` revalidates on every session start).
+Only a hash fingerprint of the credential is stored (`hypercharm-models.sync.json`), never the credential itself.
+For OAuth the fingerprint follows the stored refresh token rather than the short-lived access token, so routine
+token refreshes do not trigger a refetch, while a completed `/login` always forces one.
+
+The footer's session-start account prefetch uses the same policy with its own cache
+(`hypercharm-account.json`, 2-minute window), and only in interactive sessions.
+
 ## Updating Models
 
 Run the update script to fetch the latest models from the HyperCharm API:

package/identity.ts

@@ -27,6 +27,8 @@ export const PRISM_ENTRY_TYPE = `${PROVIDER_ID}-prism-route`;
 
 export const CONFIG_FILE_NAME = `${PROVIDER_ID}.json`;
 export const CACHE_FILE_NAME = `${PROVIDER_ID}-models.json`;
+/** Cross-process account snapshot (balance/team/device expiry) shared by quiet startup sync. */
+export const ACCOUNT_CACHE_FILE_NAME = `${PROVIDER_ID}-account.json`;
 
 /**
  * Every distinct namespaced identifier this extension registers or writes.
@@ -45,5 +47,6 @@ export const IDENTIFIERS: readonly string[] = Object.freeze([
 		PRISM_ENTRY_TYPE,
 		CONFIG_FILE_NAME,
 		CACHE_FILE_NAME,
+		ACCOUNT_CACHE_FILE_NAME,
 	]),
 ]);

package/index.ts

@@ -12,7 +12,12 @@
  *
  * Model resolution strategy: Stale-While-Revalidate
  *   1. Serve stale immediately: disk cache → embedded models.json (zero-latency)
- *   2. Revalidate in background: live API /v1/models → merge with embedded → cache → hot-swap
+ *   2. Revalidate in background: live API /v1/provider → merge with embedded → cache → hot-swap
+ *      Quiet startup sync (sync-policy.ts): only with credentials, only when the
+ *      disk cache is older than the TTL (1h, PI_PROVIDER_SYNC_TTL_MS), missing,
+ *      or fetched under another credential identity (OAuth: the stored refresh
+ *      token, since access tokens rotate), and only one pi process at a time
+ *      (lock file next to the cache). A completed /login forces a revalidation.
  *   3. patch.json + custom-models.json applied on top of whichever source won
  *
  * Merge order: [live|cache|embedded] → apply patch.json → merge custom-models.json
@@ -40,7 +45,11 @@
  *   everything the moment the active model belongs to another provider.
  *   Credits/team are prefetched on session start or model select when a
  *   HyperCharm model is active, so the first turn ends with data already
- *   cached. The balance is polled again on pi's agent_settled event (fires
+ *   cached. The session-start prefetch runs only with a UI (never in print
+ *   mode or child agents) and is shared across pi processes: the result is
+ *   written to cache/hypercharm-account.json and processes that start within
+ *   ACCOUNT_SYNC_TTL_MS (2 min) of it render that snapshot instead of
+ *   polling (same lock/fingerprint policy as the model sync). The balance is polled again on pi's agent_settled event (fires
  *   only once no automatic retry,
  *   compaction, or queued continuation can follow) — and nowhere else, so
  *   sessions without HyperCharm turns make zero status-related API calls.
@@ -107,9 +116,11 @@
 
 import { clampThinkingLevel, streamOpenAICompletions } from "@earendil-works/pi-ai/compat";
 import type { AssistantMessageEventStream, SimpleStreamOptions } from "@earendil-works/pi-ai/compat";
+import type { OAuthCredentials } from "@earendil-works/pi-ai";
 import { Text } from "@earendil-works/pi-tui";
 import { USER_AGENT, loginHypercharm, refreshHypercharmToken } from "./oauth";
 import {
+	ACCOUNT_CACHE_FILE_NAME,
 	API_KEY_PLACEHOLDER,
 	API_NAME,
 	CACHE_FILE_NAME,
@@ -149,6 +160,14 @@ import {
 import fs from "fs";
 import { hostname } from "os";
 import path from "path";
+import {
+	acquireModelSync,
+	cacheChangedSinceLoad,
+	keyFingerprint,
+	markCacheLoaded,
+	syncMetaPath,
+	writeFileAtomic,
+} from "./sync-policy";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -388,7 +407,8 @@ function loadCachedModels(): JsonModel[] | null {
 function cacheModels(models: JsonModel[]): void {
 	try {
 		fs.mkdirSync(CACHE_DIR, { recursive: true });
-		fs.writeFileSync(CACHE_PATH, JSON.stringify(models, null, 2) + "\n");
+		// Atomic (tmp + rename): other pi processes may be reading the cache right now.
+		writeFileAtomic(CACHE_PATH, JSON.stringify(models, null, 2) + "\n");
 	} catch (err) {
 		// Non-fatal: the freshly fetched catalog still serves this session.
 		notifier.warn(`Could not write the HyperCharm model cache to ${CACHE_PATH}: ${describeError(err)}.`);
@@ -455,6 +475,7 @@ function withDeprecated(models: JsonModel[]): JsonModel[] {
 }
 
 function loadStaleModels(embeddedModels: JsonModel[]): JsonModel[] {
+	markCacheLoaded(CACHE_PATH); // stat before read: lets session_start spot newer caches
 	const cached = loadCachedModels();
 	if (!cached || cached.length === 0) return embeddedModels;
 
@@ -468,24 +489,77 @@ function loadStaleModels(embeddedModels: JsonModel[]): JsonModel[] {
 	return cached;
 }
 
-async function revalidateModels(apiKey: string | undefined, embeddedModels: JsonModel[], signal?: AbortSignal): Promise<JsonModel[] | null> {
-	if (!apiKey) return null;
-	const liveModels = await fetchLiveModels(apiKey, signal);
-	if (!liveModels || liveModels.length === 0) return null;
-	const merged = mergeWithEmbedded(liveModels, embeddedModels);
-	cacheModels(merged);
-	return merged;
+/**
+ * Background revalidation, gated by the quiet startup sync policy
+ * (sync-policy.ts): no credentials → no fetch; fresh cache (TTL) → no fetch;
+ * another process already fetching → no fetch. When skipped, a cache that
+ * another process refreshed since we loaded it is adopted from disk instead.
+ * `force` bypasses the TTL (e.g. after /login); it is still single-flight.
+ *
+ * `identity` is the stable credential identity used only for presence and the
+ * fingerprint (see credentialIdentity); `apiKey` is the bearer token we fetch with.
+ */
+async function revalidateModels(
+	apiKey: string | undefined,
+	identity: string | undefined,
+	embeddedModels: JsonModel[],
+	signal?: AbortSignal,
+	force = false,
+): Promise<JsonModel[] | null> {
+	const lease = acquireModelSync({ cachePath: CACHE_PATH, apiKey: apiKey ? identity : undefined, force });
+	if (!lease) return cacheChangedSinceLoad(CACHE_PATH) ? loadStaleModels(embeddedModels) : null;
+	let merged: JsonModel[] | null = null;
+	try {
+		const liveModels = apiKey ? await fetchLiveModels(apiKey, signal) : null;
+		if (!liveModels || liveModels.length === 0) return null;
+		merged = mergeWithEmbedded(liveModels, embeddedModels);
+		cacheModels(merged);
+		return merged;
+	} finally {
+		lease.release(merged ? "fetched" : signal?.aborted ? "aborted" : "failed");
+	}
 }
 
 // ─── API Key Resolution (via ModelRegistry) ────────────────────────────────────
 
 let cachedApiKey: string | undefined;
+// Stable identity behind cachedApiKey for the quiet-sync fingerprints.
+let cachedSyncIdentity: string | undefined;
 let revalidateAbort: AbortController | null = null;
 
+const AUTH_PATH = path.join(getAgentDir(), "auth.json");
+
+const oauthIdentity = (refresh: string): string => `oauth:${refresh}`;
+
+/**
+ * Stable credential identity for the quiet-sync fingerprint. OAuth access
+ * tokens rotate on every token refresh, so fingerprinting the resolved key
+ * would look like an account change each time. For an OAuth entry in
+ * auth.json use its refresh token instead (it changes on /login); API keys —
+ * auth.json, --api-key, HYPERCHARM_API_KEY — are static, so use the key itself.
+ * Only ever hashed (sync-policy keyFingerprint), never stored.
+ */
+function credentialIdentity(apiKey: string | undefined): string | undefined {
+	if (!apiKey) return undefined;
+	try {
+		const stored = JSON.parse(fs.readFileSync(AUTH_PATH, "utf8"))?.[PROVIDER_ID];
+		if (stored?.type === "oauth" && typeof stored.refresh === "string" && stored.refresh) {
+			return oauthIdentity(stored.refresh);
+		}
+	} catch {
+		// No/unreadable auth.json: the key resolved from elsewhere (env, --api-key).
+	}
+	return apiKey;
+}
+
 async function resolveApiKey(modelRegistry: ModelRegistry): Promise<void> {
 	cachedApiKey = await modelRegistry.getApiKeyForProvider(PROVIDER_ID) ?? undefined;
+	cachedSyncIdentity = credentialIdentity(cachedApiKey);
 }
 
+// Set by the extension entry point: runs after a /login completes.
+let onLoginComplete: ((credentials: OAuthCredentials) => void) | null = null;
+
 // ─── Status Display Configuration ──────────────────────────────────────────────
 
 const CONFIG_PATH = path.join(getAgentDir(), "extensions", "hypercharm.json");
@@ -698,6 +772,12 @@ let statusEpoch = 0;
 let lastCreditsFetchAt = 0;
 let creditsInFlight: Promise<void> | null = null;
 let metaFetched = false;
+// Bumped on every successful /v1/credits read (lets the startup sync tell a
+// fresh balance from one adopted off disk).
+let creditsOkCount = 0;
+// Absolute OAuth device-session expiry behind account.authDaysLeft (persisted
+// in the account snapshot so other processes recompute days-left correctly).
+let authExpiresAtMs: number | null = null;
 
 async function fetchJsonGet(url: string, apiKey: string, signal: AbortSignal | undefined, label: string): Promise<any | null> {
 	try {
@@ -735,6 +815,7 @@ function refreshCredits(apiKey: string | undefined, signal: AbortSignal | undefi
 			const rawBalance = typeof data?.balance === "number" ? data.balance : typeof data?.balance_usd === "number" ? data.balance_usd * 20 : undefined;
 			if (typeof rawBalance === "number" && Number.isFinite(rawBalance)) {
 				account.balance = rawBalance;
+				creditsOkCount += 1;
 			}
 		} finally {
 			creditsInFlight = null;
@@ -764,13 +845,104 @@ async function refreshAccountMeta(apiKey: string | undefined, signal?: AbortSign
 		const own = devices.items.find((d: any) => typeof d?.name === "string" && d.name === `Pi (${hostname()})`);
 		const expMs = own ? Date.parse(own.expires_at ?? "") : NaN;
 		if (!Number.isNaN(expMs)) {
-			account.authDaysLeft = Math.max(0, Math.ceil((expMs - Date.now()) / 86_400_000));
+			authExpiresAtMs = expMs;
+			account.authDaysLeft = daysUntil(expMs);
 		}
 	}
 
 	if (account.teamName !== null || account.authDaysLeft !== null) metaFetched = true;
 }
 
+function daysUntil(ms: number): number {
+	return Math.max(0, Math.ceil((ms - Date.now()) / 86_400_000));
+}
+
+// ─── Quiet Startup Account Sync ──────────────────────────────────────────────
+// Every pi process with a UI used to poll /v1/credits + /v1/teams + /v1/devices
+// on session_start. The startup prefetch now goes through the same
+// cross-process policy as the model sync (sync-policy.ts), with its own cache:
+// one process polls and writes cache/hypercharm-account.json, every other
+// process starting within ACCOUNT_SYNC_TTL_MS renders that snapshot from disk.
+// Turn-triggered polls (model_select, agent_settled, 402, /hypercharm-status
+// refresh) are unchanged and stay throttled per process.
+
+const ACCOUNT_CACHE_PATH = path.join(CACHE_DIR, ACCOUNT_CACHE_FILE_NAME);
+/**
+ * Freshness window for the shared startup account snapshot. 2 minutes: long
+ * enough to collapse /new, /reload and fan-out bursts into one poll, short
+ * enough that a session started later shows a current balance. The balance
+ * also moves optimistically per turn and agent_settled reconciles it.
+ */
+const ACCOUNT_SYNC_TTL_MS = 2 * 60 * 1000;
+
+interface AccountSnapshot {
+	version: 1;
+	balance: number | null;
+	teamName: string | null;
+	authExpiresAt: number | null;
+}
+
+/** Render a snapshot another process wrote, if it belongs to the same credential identity. */
+function adoptAccountSnapshot(identity: string): void {
+	try {
+		const meta = JSON.parse(fs.readFileSync(syncMetaPath(ACCOUNT_CACHE_PATH), "utf8"));
+		if (meta?.keyFingerprint !== keyFingerprint(identity)) return;
+		const snap = JSON.parse(fs.readFileSync(ACCOUNT_CACHE_PATH, "utf8")) as Partial<AccountSnapshot> | null;
+		if (!snap || typeof snap !== "object") return;
+		if (typeof snap.balance === "number" && Number.isFinite(snap.balance)) account.balance = snap.balance;
+		if (typeof snap.teamName === "string" && snap.teamName.trim()) account.teamName = snap.teamName.trim();
+		if (typeof snap.authExpiresAt === "number" && Number.isFinite(snap.authExpiresAt)) {
+			authExpiresAtMs = snap.authExpiresAt;
+			account.authDaysLeft = daysUntil(snap.authExpiresAt);
+		}
+		if (account.teamName !== null || account.authDaysLeft !== null) metaFetched = true;
+	} catch {
+		// Missing/corrupt snapshot: nothing to adopt.
+	}
+}
+
+function writeAccountSnapshot(): void {
+	const snap: AccountSnapshot = {
+		version: 1,
+		balance: account.balance,
+		teamName: account.teamName,
+		authExpiresAt: authExpiresAtMs,
+	};
+	try {
+		fs.mkdirSync(CACHE_DIR, { recursive: true });
+		writeFileAtomic(ACCOUNT_CACHE_PATH, JSON.stringify(snap) + "\n");
+	} catch {
+		// Non-fatal: other processes just poll themselves.
+	}
+}
+
+/**
+ * Session-start account prefetch: adopt the shared snapshot (synchronously,
+ * before the first await, so the caller can render it at once), then poll only
+ * if this process wins the lease. Callers gate on ctx.hasUI.
+ */
+async function startupAccountSync(apiKey: string | undefined, identity: string | undefined, signal: AbortSignal): Promise<void> {
+	if (!apiKey || !identity) return;
+	adoptAccountSnapshot(identity);
+	const lease = acquireModelSync({
+		cachePath: ACCOUNT_CACHE_PATH,
+		apiKey: identity,
+		ttlMs: ACCOUNT_SYNC_TTL_MS,
+		isValidCache: (d) => d != null,
+	});
+	if (!lease) return;
+	let ok = false;
+	try {
+		const before = creditsOkCount;
+		metaFetched = false;
+		await Promise.all([refreshCredits(apiKey, signal, true), refreshAccountMeta(apiKey, signal)]);
+		ok = !signal.aborted && creditsOkCount > before;
+		if (ok) writeAccountSnapshot();
+	} finally {
+		lease.release(ok ? "fetched" : signal.aborted ? "aborted" : "failed");
+	}
+}
+
 // ─── Status Rendering ─────────────────────────────────────────────────────────
 
 function currentProviderId(ctx: ExtensionContext): string | undefined {
@@ -882,6 +1054,7 @@ function resetStatusState(): void {
 	outOfCreditsNotified = false;
 	lastCreditsFetchAt = 0;
 	metaFetched = false;
+	authExpiresAtMs = null;
 }
 
 /** Commit per-turn pending capture into session state (after tees settle). */
@@ -1117,7 +1290,11 @@ function makeProviderConfig(models: JsonModel[] = currentModels) {
 		streamSimple: streamHypercharm,
 		oauth: {
 			name: PROVIDER_DISPLAY_NAME,
-			login: (callbacks) => loginHypercharm(callbacks),
+			login: async (callbacks) => {
+				const credentials = await loginHypercharm(callbacks);
+				onLoginComplete?.(credentials);
+				return credentials;
+			},
 			refreshToken: (credentials, signal) => refreshHypercharmToken(credentials, signal),
 			getApiKey: (credentials) => String(credentials.access ?? ""),
 		},
@@ -1139,6 +1316,32 @@ export default function (pi: ExtensionAPI) {
 
 	pi.registerProvider(PROVIDER_ID, makeProviderConfig(staleModels));
 
+	// Revalidate the catalog (quiet startup sync policy) and hot-swap on success.
+	const syncModels = (epoch: number, signal: AbortSignal | undefined, force: boolean): Promise<void> =>
+		revalidateModels(cachedApiKey, cachedSyncIdentity, embeddedModels, signal, force).then((freshBase) => {
+			if (freshBase && epoch === statusEpoch && !signal?.aborted) {
+				currentModels = buildModels(freshBase, customModels, patches);
+				pi.registerProvider(PROVIDER_ID, makeProviderConfig());
+			}
+		});
+
+	// A completed /login means new credentials: adopt them and force a
+	// revalidation (still single-flight). Deferred so pi persists the
+	// credential first; never blocks or fails the login itself.
+	onLoginComplete = (credentials) => {
+		const access = String(credentials.access ?? "");
+		if (!access) return;
+		cachedApiKey = access;
+		cachedSyncIdentity = typeof credentials.refresh === "string" && credentials.refresh ? oauthIdentity(credentials.refresh) : access;
+		// New account: team/device metadata and the throttle start over.
+		metaFetched = false;
+		lastCreditsFetchAt = 0;
+		const epoch = statusEpoch;
+		setTimeout(() => {
+			void syncModels(epoch, revalidateAbort?.signal, true).catch(() => {});
+		}, 0);
+	};
+
 	pi.registerCommand(STATUS_COMMAND, {
 		description: "Configure the HyperCharm footer status (session spend, balance, rate limits)",
 		handler: async (args, ctx) => {
@@ -1163,31 +1366,29 @@ export default function (pi: ExtensionAPI) {
 		// over anything that touched provider registration during load.
 		pi.registerProvider(PROVIDER_ID, makeProviderConfig());
 
-		// A failure here used to vanish: no key resolved meant no refresh and no
-		// diagnostics. Surface it, then continue — without a key we serve the
-		// embedded/cached catalog.
-		resolveApiKey(ctx.modelRegistry)
+		// Fire-and-forget: never await network here — startup must not block on
+		// the provider API. Nothing is awaited and every rejection is swallowed.
+		// A key-resolution failure is surfaced (it used to vanish), then we keep
+		// serving the embedded/cached catalog.
+		void resolveApiKey(ctx.modelRegistry)
 			.catch((err) => {
 				notifier.warn(`Unable to resolve HyperCharm credentials: ${describeError(err)} — serving cached/embedded models.`);
 			})
 			.then(() => {
-			// A session replacement while the key resolved invalidated the
-			// captured ctx (fast-resume, /new, /fork); nothing below may touch it.
-			if (epoch !== statusEpoch) return;
-			// Prefetch credits/team metadata only when a HyperCharm model is active
-			// (pi-neuralwatt also prefetches so the first turn ends with data, but
-			// gating here avoids API calls in sessions that never use the provider).
-			if (currentProviderId(ctx) === PROVIDER_ID) {
-				updateStatusAfter(refreshCredits(cachedApiKey, statusSignal, true), ctx);
-				updateStatusAfter(refreshAccountMeta(cachedApiKey, statusSignal), ctx);
-			}
-			revalidateModels(cachedApiKey, embeddedModels, signal).then((freshBase) => {
-				if (freshBase && epoch === statusEpoch && !signal.aborted) {
-					currentModels = buildModels(freshBase, customModels, patches);
-					pi.registerProvider(PROVIDER_ID, makeProviderConfig());
+				// A session replacement while the key resolved invalidated the
+				// captured ctx (fast-resume, /new, /fork); nothing below may touch it.
+				if (epoch !== statusEpoch) return;
+				// Prefetch credits/team metadata only when a HyperCharm model is
+				// active and there is a UI to show it (print mode and child agents
+				// never render the footer), deduped across pi processes.
+				if (ctx.hasUI && currentProviderId(ctx) === PROVIDER_ID) {
+					const accountSync = startupAccountSync(cachedApiKey, cachedSyncIdentity, statusSignal);
+					updateStatus(ctx); // renders an adopted snapshot right away
+					updateStatusAfter(accountSync.catch(() => {}), ctx);
 				}
-			});
-		});
+				return syncModels(epoch, signal, false);
+			})
+			.catch(() => { /* keep serving the stale catalog */ });
 	});
 
 	pi.on("model_select", (event, ctx) => {

package/package.json

@@ -1,9 +1,18 @@
 {
   "name": "pi-hypercharm-provider",
-  "version": "1.3.39",
+  "version": "1.3.40",
   "description": "HyperCharm provider extension for pi - Access DeepSeek, GLM, Kimi, Qwen, MiniMax, Gemma, and GPT-OSS models through the Charm Hyper API",
   "type": "module",
   "main": "index.ts",
+  "scripts": {
+    "clean": "echo 'nothing to clean'",
+    "build": "echo 'nothing to build'",
+    "check": "tsc --noEmit && npm run smoke && npm test",
+    "smoke": "node tests/status.smoke.ts",
+    "test": "node --import jiti/register --test tests/identity.test.ts tests/prism.test.ts tests/notify.test.ts tests/provider.integration.test.ts && vitest run",
+    "update-models": "node scripts/update-models.js",
+    "test:pi": "node scripts/test-pi-compat.mjs"
+  },
   "keywords": [
     "pi",
     "extension",
@@ -35,7 +44,8 @@
     "@earendil-works/pi-tui": "1.1.0",
     "@types/node": "^24.10.1",
     "jiti": "2.7.0",
-    "typescript": "6.0.3"
+    "typescript": "6.0.3",
+    "vitest": "4.1.7"
   },
   "author": "",
   "license": "MIT",
@@ -43,14 +53,5 @@
     "extensions": [
       "./index.ts"
     ]
-  },
-  "scripts": {
-    "clean": "echo 'nothing to clean'",
-    "build": "echo 'nothing to build'",
-    "check": "tsc --noEmit && npm run smoke && npm test",
-    "smoke": "node tests/status.smoke.ts",
-    "test": "node --import jiti/register --test tests/identity.test.ts tests/prism.test.ts tests/notify.test.ts tests/provider.integration.test.ts",
-    "update-models": "node scripts/update-models.js",
-    "test:pi": "node scripts/test-pi-compat.mjs"
   }
-}
+}