v0.7.2 — global auto-refresh + security hardening

Highlights

Global auto-refresh (v0.7.2): a host-side scheduler re-queries all providers every 2 minutes (refreshIntervalMs, 0 disables) and serves a warm cache — the Settings page, composer chip and query_ai_quota tool all answer instantly. A new refresh Remote method powers user-triggered refreshes, with concurrent calls deduplicated into a single fetch round.

Security hardening (v0.7.1): independent review follow-up —

• Kimi OAuth refresh: per-file mutex + re-read inside the lock (no refresh_token replay under concurrent tool/browser refreshes); rotated-token persist retried once
• fetchJson: timeout now covers the response body (not just headers); 4 MB body cap; codex app-server stdout capped
• Provider-controlled strings (plan / labels / currency / resetsAt) sanitized before reaching LLM tool output

Install

dsh plugin --profile web add github:Carrick-K7/dsh-ai-quota

Restart dsh web afterwards.