@inventec/dsh-copilot-auth 1.2.20 → 1.2.22

package/README.md

@@ -1,10 +1,9 @@
 # @inventec/dsh-copilot-auth
 
-[![Release](https://img.shields.io/github/v/release/iasiv5/dsh-copilot-auth?label=Release&sort=semver)](https://github.com/iasiv5/dsh-copilot-auth/releases)
 [![npm](https://img.shields.io/npm/v/%40inventec%2Fdsh-copilot-auth?label=npm)](https://www.npmjs.com/package/@inventec/dsh-copilot-auth)
 [![CI](https://img.shields.io/github/actions/workflow/status/iasiv5/dsh-copilot-auth/ci.yml?branch=main&label=CI)](https://github.com/iasiv5/dsh-copilot-auth/actions/workflows/ci.yml)
 [![License](https://img.shields.io/github/license/iasiv5/dsh-copilot-auth?label=License)](https://github.com/iasiv5/dsh-copilot-auth/blob/main/LICENSE)
-[![DSH](https://img.shields.io/badge/DSH-0.1.7--rc.2%20%7C%200.2.0--rc.1%2Frc.2%20verified-2563eb)](#版本兼容)
+[![DSH](https://img.shields.io/badge/DSH-0.2.1--rc.3%20verified-2563eb)](#版本兼容)
 
 为 DSH（DeepSeek Harness）内置的 GitHub Copilot 通道补上**网页设备码登录 / 注销**入口，预置开箱即用的 Copilot 提供方路由，并提供**模型列表管理**。用公司 GitHub 账号（带 Copilot 订阅）登录 DSH 的方式与其他 Copilot 客户端一致：**网页 + 设备码**，全程不填 API Token。
 
@@ -54,7 +53,7 @@ dsh plugin --profile web remove @inventec/dsh-copilot-auth       # 卸载
 | 📦 模型目录兜底 | 首次登录自动写入账号全部可用模型；你已精简 / 定制过的目录**永不覆盖**（重启、重新登录均不重置） |
 | 🎛️ 管理模型列表 | 目标状态编辑：勾选即终态，支持新增、移除、挽留与「对齐账号与目录」（见下节） |
 | 🌐 中 / 英双语 | 跟随 DSH 语言设置自动切换 |
-| 🧪 测试与 CI | 210 条单元测试（ubuntu / windows / macos 三平台矩阵）；tag 触发 npm Trusted Publishing 发布（provenance） |
+| 🧪 测试与 CI | 224 条单元测试（ubuntu / windows / macos 三平台矩阵）；tag 触发 npm Trusted Publishing 发布（provenance） |
 
 ## 管理模型列表
 
@@ -64,9 +63,9 @@ pi-ai 的模型目录是打包时硬编码的 JSON：上游新增模型在本机
 
 - **勾选即终态**：一张分组全表——**可新增**（账号可用 ∩ 目录可解析，默认不勾）、**在列**（默认勾选）、**待删除候选**（在列但账号未报告 / 目录无法解析，默认不勾＝删除提案，重新勾选即**挽留**）。应用时被保留模型的对象、顺序与定制逐字保留，被移除模型的定制随模型消失。
 - **快捷动作**：「全选 / 取消全选」作用于全表；「**对齐账号与目录**」仅在漂移时出现，一键把勾选态设为账号 ∩ 可解析；「**同时清除全部模型定制**」复选框仅在存在可清除定制时出现；摘要行常驻显示「应用后共 N 个：保留 · 新增 · 移除」。
-- **证据门控按实际 diff**：纯新增可用 24 小时内同授权的缓存；**移除类变更强制实时账号证据 + 最新目录并二次确认**（缓存下勾选删除会自动升级为实时预览）；空目标需单独确认，落显式空列表且不会被登录自动回填。
+- **证据门控按实际 diff**：纯新增可用 24 小时内同授权的缓存；**移除类变更强制实时账号证据 + 最新目录并二次确认**（缓存下勾选删除会自动升级为实时预览）；空目标需单独确认，落显式空列表且不会被登录自动回填。移除所需的实时证据会在本地会话令牌过期时**自动续期**（仅内存、不落库）；续期仍失败时，来源行会给出原因与出路（先用一次模型 / 重新授权 / 稍后重试）。
 - **生效时机**：web / 服务形态先做原子只增补丁、**重启后**生效；desktop（只读 `app.asar`）走进程内注册表注入，**当次生效、无需重启**、不碰官方产物（ADR 0003）。
-- **并发与恢复**：每个操作带服务端签发的 operationId（幂等可查、绝不重复执行）；配置并发编辑永远优先（漂移返回 409 要求重新预览）；崩溃 / 重启后可恢复，出现冲突时提供「结束旧配置意图」显式闭环。
+- **并发与恢复**：每个操作带服务端签发的 operationId（幂等可查、绝不重复执行）；配置并发编辑永远优先（漂移返回 409 要求重新预览）；崩溃 / 重启后可恢复，出现冲突时提供「结束旧配置意图」显式闭环。apply 撞上卡死的旧操作（423）且该操作已 `recovery-needed` 时，弹窗与刷新后的页面都会提供同一「结束旧配置意图」出口（know-how 032 缺口闭环）。
 
 ## 工作原理
 
@@ -80,10 +79,10 @@ pi-ai 的模型目录是打包时硬编码的 JSON：上游新增模型在本机
 
 | 插件线 | DSH 实测版本 | 说明 |
 |---|---|---|
-| **v1.2.x** | `0.1.7-rc.2` ～ `0.2.0-rc.2` | 当前线；`0.2.0` 起注意插件 peer 精确版本守卫 |
+| **v1.2.x** | `0.1.7-rc.2`、`0.2.0-rc.1/rc.2`、`0.2.1-rc.2/rc.3` | 当前线；`0.2.0` 起注意插件 peer 精确版本守卫；rc.3 Web 冒烟：`/copilot-auth/status` 200、`activated=true`、`settingsNotServed=[]`、`lastError=null` |
 | v1.1.x | `0.1.2-rc.1` ～ `0.1.5-rc.2` | 旧版线；依赖 v1.2.0 已移除的 authorization 挂载补丁，新版 DSH 上无法激活 |
 
-逐版本沿革（v1.2.0 ～ v1.2.20 完整说明与已移除能力的语义记录）见 [docs/CHANGELOG.md](./docs/CHANGELOG.md) 与 [GitHub Releases](https://github.com/iasiv5/dsh-copilot-auth/releases)。
+逐版本沿革（v1.2.0 ～ v1.2.20 完整说明与已移除能力的语义记录）见 [docs/CHANGELOG.md](./docs/CHANGELOG.md)。
 
 ## FAQ
 
@@ -121,7 +120,7 @@ base 模型（GPT-4o / 4.1 一类）不耗 premium requests；premium 模型（C
 - 自行 patch `llm-pi-ai` 整段 config 会覆盖预置路由；`settings.yaml` 的 `llm-pi-ai:` 节只能稀疏覆盖字段，无法删除预置路由本身（移除须卸载本插件）
 - 路由前缀 `/copilot-auth` 两侧硬编码，不可配置
 - 模型目录「**只增不更新**」：合并只补充本机从未见过的条目，上游对已有 id 的元数据修正不会同步（ADR 0001）
-- DSH rc 版本耦合：实测 `0.1.7-rc.2` 与 `0.2.0-rc.1 / rc.2`，peer 仅 `@deepseek-ai/cordis@^4.0.2`
+- DSH rc 版本耦合：实测 `0.1.7-rc.2`、`0.2.0-rc.1/rc.2` 与 `0.2.1-rc.2/rc.3`；rc.3 Web 冒烟见「版本兼容」，peer 仅 `@deepseek-ai/cordis@^4.0.2`
 - DSH 升级后的目录自愈仅在 pi-ai 基线版本不变时按已确认条目只增重放；跨基线且条目缺失时上报 `self-heal-incompatible`，不修改安装树（重新执行一次手动刷新即可在新基线上激活）
 - 并发保护为宿主单进程内 mutex，不支持多实例 / 多进程并发操作同一安装目录
 - 目录 fsync 仅在 POSIX 执行：Windows 无目录 fsync 语义（必然 `EPERM`），直接跳过，一致性由 NTFS 元数据日志保证（v1.2.3 起）
@@ -131,7 +130,7 @@ base 模型（GPT-4o / 4.1 一类）不耗 premium requests；premium 模型（C
 
 ```bash
 npm install
-npm test        # node:test：210 条（CI 跑 ubuntu/windows/macos 三平台矩阵）
+npm test        # node:test：224 条（CI 跑 ubuntu/windows/macos 三平台矩阵）
 npm run build   # esbuild 打包 client 到 lib/client.js（__ModuleLoader__ 信封）
 npm pack --dry-run
 npm run capture # 截取 README 预览图（需本机 DSH 实例；详见脚本头注）

package/icon.svg

@@ -0,0 +1,18 @@
+<svg width="36" height="36" viewBox="0 0 36 36" fill="none" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="dsh-copilot-auth">
+  <!-- dsh-copilot-auth 认证：斜向钥匙（环尾含青色轴点）= 设备码登录与凭据入库 -->
+  <circle cx="12.5" cy="12.5" r="6" stroke="url(#b)" stroke-width="4" fill="none"/>
+  <circle cx="12.5" cy="12.5" r="2.2" fill="url(#t)"/>
+  <path d="M17 17L27.5 27.5" stroke="url(#b)" stroke-width="4" stroke-linecap="round"/>
+  <path d="M24 24L27.5 20.5" stroke="url(#b)" stroke-width="3.4" stroke-linecap="round"/>
+  <path d="M27.5 27.5L31 24" stroke="url(#b)" stroke-width="3.4" stroke-linecap="round"/>
+  <defs>
+    <linearGradient id="b" x1="6.5" y1="6.5" x2="31" y2="27.5" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#69B9FF"/>
+      <stop offset="1" stop-color="#324DE2"/>
+    </linearGradient>
+    <linearGradient id="t" x1="10.3" y1="10.3" x2="14.7" y2="14.7" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#45E7A4"/>
+      <stop offset="1" stop-color="#05909D"/>
+    </linearGradient>
+  </defs>
+</svg>

package/lib/client.js

@@ -192,6 +192,9 @@ function reduce(state, event) {
       if (event.type === "retire-request" && state.name === "result") {
         return [{ name: "retireConfirm", result: state.result }, null];
       }
+      if (event.type === "retire-request" && state.name === "busy" && state.active?.phaseResult?.status === "recovery-needed") {
+        return [{ name: "retireConfirm", active: state.active }, null];
+      }
       if (event.type === "dismiss" && state.name === "failed") {
         return [{ ...initial, flags: state.flags }, null];
       }
@@ -200,6 +203,9 @@ function reduce(state, event) {
         if (!event.status) return [state, null];
         if (refresh?.lastError === "state-corrupt") return [{ ...state, name: "failed", error: "state-corrupt" }, null];
         const base = fromRefresh({ ...initial, name: "idle" }, refresh);
+        if (refresh?.activeOperation?.phaseResult?.status === "recovery-needed") {
+          return [{ ...base, name: "busy", active: refresh.activeOperation }, null];
+        }
         if (restartStates.has(refresh?.lastResult?.status ?? "") || refresh?.pendingRestart === true) {
           return [{ ...base, name: "pendingRestart", result: refresh.lastResult }, null];
         }
@@ -341,14 +347,16 @@ function reduce(state, event) {
     }
     case "retireConfirm": {
       if (event.type === "retire-confirm") {
-        return [{ name: "retiring", operationId: state.result?.operationId, result: state.result }, { type: "retire", operationId: state.result?.operationId }];
+        return [{ name: "retiring", operationId: state.result?.operationId ?? state.active?.operationId, result: state.result, active: state.active }, { type: "retire", operationId: state.result?.operationId ?? state.active?.operationId }];
       }
-      if (event.type === "cancel") return [{ name: "result", result: state.result }, null];
+      if (event.type === "cancel") return state.active ? [{ name: "busy", active: state.active }, null] : [{ name: "result", result: state.result }, null];
       return [state, null];
     }
     case "retiring": {
       if (event.type === "retire-ok") return [{ ...state, name: "checking" }, { type: "status" }];
-      if (event.type === "retire-fail") return [{ name: "result", result: state.result, retireError: event.error }, null];
+      if (event.type === "retire-fail") {
+        return state.active ? [{ name: "busy", active: state.active, retireError: event.error }, null] : [{ name: "result", result: state.result, retireError: event.error }, null];
+      }
       return [state, null];
     }
     default:
@@ -680,6 +688,10 @@ var DICTS = {
     skippedModels: "Upstream entries skipped by validation",
     srcLive: "Account models: live",
     srcCache: "Account models: cached at {time}; removals require upgrading to live evidence",
+    srcCacheExpired: "Account models: cached at {time}. The session token is expired and could not be auto-renewed \u2014 chat with any Copilot model once; if it still fails, sign out and authorize again.",
+    srcCacheRejected: "Account models: cached at {time}. The local token was rejected by GitHub (possibly re-authorized on another device) \u2014 sign out and authorize again.",
+    srcCacheNetwork: "Account models: cached at {time}. Live evidence is temporarily unreachable \u2014 reopen this dialog later to retry.",
+    srcCacheNoSession: "Account models: cached at {time}. No local session token \u2014 authorize first.",
     srcStale: "The cache has no trusted timestamp, is expired, or belongs to changed authorization; reference only.",
     srcLatest: "Catalog source: latest pi-ai from npm",
     srcLocal: "Catalog source: local (npm fetch failed)",
@@ -767,6 +779,10 @@ var DICTS = {
     skippedModels: "\u88AB\u6821\u9A8C\u8DF3\u8FC7\u7684\u4E0A\u6E38\u6761\u76EE",
     srcLive: "\u8D26\u53F7\u6A21\u578B\uFF1A\u5B9E\u65F6\u83B7\u53D6",
     srcCache: "\u8D26\u53F7\u6A21\u578B\uFF1A\u7F13\u5B58\uFF0C\u83B7\u53D6\u4E8E {time}\uFF1B\u79FB\u9664\u7C7B\u66F4\u6539\u9700\u5347\u7EA7\u4E3A\u5B9E\u65F6\u8BC1\u636E",
+    srcCacheExpired: "\u8D26\u53F7\u6A21\u578B\uFF1A\u7F13\u5B58\uFF0C\u83B7\u53D6\u4E8E {time}\u3002\u4F1A\u8BDD\u4EE4\u724C\u5DF2\u8FC7\u671F\uFF0C\u672A\u80FD\u81EA\u52A8\u7EED\u671F\u2014\u2014\u5148\u7528\u4EFB\u4E00 Copilot \u6A21\u578B\u5BF9\u8BDD\u4E00\u6B21\uFF1B\u82E5\u4ECD\u5931\u8D25\uFF0C\u8BF7\u9000\u51FA\u767B\u5F55\u5E76\u91CD\u65B0\u6388\u6743\u3002",
+    srcCacheRejected: "\u8D26\u53F7\u6A21\u578B\uFF1A\u7F13\u5B58\uFF0C\u83B7\u53D6\u4E8E {time}\u3002\u672C\u5730\u4EE4\u724C\u88AB GitHub \u62D2\u7EDD\uFF08\u53EF\u80FD\u5DF2\u5728\u53E6\u4E00\u53F0\u8BBE\u5907\u91CD\u65B0\u6388\u6743\uFF09\u2014\u2014\u8BF7\u9000\u51FA\u767B\u5F55\u5E76\u91CD\u65B0\u6388\u6743\u3002",
+    srcCacheNetwork: "\u8D26\u53F7\u6A21\u578B\uFF1A\u7F13\u5B58\uFF0C\u83B7\u53D6\u4E8E {time}\u3002\u6682\u65F6\u65E0\u6CD5\u83B7\u53D6\u5B9E\u65F6\u8BC1\u636E\u2014\u2014\u7A0D\u540E\u91CD\u5F00\u6B64\u7A97\u53E3\u91CD\u8BD5\u3002",
+    srcCacheNoSession: "\u8D26\u53F7\u6A21\u578B\uFF1A\u7F13\u5B58\uFF0C\u83B7\u53D6\u4E8E {time}\u3002\u672C\u5730\u65E0\u4F1A\u8BDD\u4EE4\u724C\u2014\u2014\u8BF7\u5148\u5B8C\u6210\u6388\u6743\u3002",
     srcStale: "\u7F13\u5B58\u7F3A\u5C11\u53EF\u4FE1\u65F6\u95F4\u3001\u5DF2\u8FC7\u671F\u6216\u6388\u6743\u5DF2\u53D8\u5316\uFF0C\u4EC5\u4F9B\u53C2\u8003\u3002",
     srcLatest: "\u76EE\u5F55\u6765\u6E90\uFF1Anpm \u6700\u65B0 pi-ai",
     srcLocal: "\u76EE\u5F55\u6765\u6E90\uFF1A\u672C\u5730\u76EE\u5F55\uFF08npm \u62C9\u53D6\u5931\u8D25\uFF09",
@@ -929,6 +945,14 @@ function sampleThemeSurface() {
   const bg = m ? `rgb(${m[1].split(",").slice(0, 3).join(",")})` : "#fff";
   return { bg, fg: cs.color || "inherit" };
 }
+function cacheCopyKey(reason) {
+  return {
+    "access-expired": "srcCacheExpired",
+    "token-rejected": "srcCacheRejected",
+    "network": "srcCacheNetwork",
+    "no-session": "srcCacheNoSession"
+  }[reason] ?? null;
+}
 function RefreshModal({ t, flow, onSelect, onConfirm, onCancel, onOverlay }) {
   const p = flow.preview;
   const isStale = p.evidence?.stale === true;
@@ -984,7 +1008,7 @@ function RefreshModal({ t, flow, onSelect, onConfirm, onCancel, onOverlay }) {
     onConfirm({});
   };
   const sourceLine = [
-    p.evidence?.source === "live" ? t("srcLive") : p.evidence?.source === "cache" ? t("srcCache").replace("{time}", String(p.evidence?.fetchedAt ?? "")) : null,
+    p.evidence?.source === "live" ? t("srcLive") : p.evidence?.source === "cache" ? (cacheCopyKey(p.evidence?.reason) ? t(cacheCopyKey(p.evidence?.reason)) : t("srcCache")).replace("{time}", String(p.evidence?.fetchedAt ?? "")) : null,
     p.catalogSource === "latest" ? t("srcLatest") : p.catalogSource === "overlay" ? t("srcOverlay") : t("srcLocal")
   ].filter(Boolean).join(" \xB7 ");
   const groupDefs = [
@@ -1319,8 +1343,10 @@ function CopilotSection({ t = (key) => DICTS.en[key] ?? key }) {
       ] }),
       flow.name === "busy" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.banner, children: [
         "\u24D8 ",
-        t("busy")
+        t("busy"),
+        flow.retireError ? `\uFF08${flow.retireError}\uFF09` : ""
       ] }),
+      flow.name === "busy" && flow.active?.phaseResult?.status === "recovery-needed" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.secondary }, onClick: () => drive({ type: "retire-request" }), children: t("retireBtn") }) }),
       flow.name === "resultUnknown" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.error, children: [
           "\u26A0 ",

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@inventec/dsh-copilot-auth",
-  "version": "1.2.20",
-  "description": "为内置 Copilot 提供方补设备码登录设置页，预置开箱路由；凭据入内置凭据库，模型目录兜底不覆盖定制。v1.2.19：管理模型列表 v3 目标状态编辑（分组全表/挽留/对齐/清空语义告知）＋单次确认＋移除请求撤回＋退出残影修复。v1.2.18：授权失败附网络失败码＋人性化提示。适配 DSH 0.1.7+（≤0.1.5 请用 1.1.x）。",
+  "version": "1.2.22",
+  "description": "为内置 Copilot 提供方补设备码登录设置页，预置开箱路由；凭据入内置凭据库，模型目录兜底不覆盖定制。v1.2.19：管理模型列表 v3 目标状态编辑（分组全表/挽留/对齐/清空语义告知）＋单次确认＋移除请求撤回＋退出残影修复。v1.2.18：授权失败附网络失败码＋人性化提示。适配 DSH 0.1.7+（≤0.1.5 请用 1.1.x）。v1.2.21：移除前实时证据自动续期（ephemeral 不落库＋负缓存 5min）＋缓存证据原因分型文案＋busy 卡死 retire 出口与水合判序修正（032）。",
+  "icon": "./icon.svg",
   "type": "module",
   "license": "MIT",
   "author": "iasi",
@@ -38,7 +39,8 @@
     "src/model-update.mjs",
     "src/refresh-service.mjs",
     "src/refresh-transaction.mjs",
-    "src/catalog-overlay.json"
+    "src/catalog-overlay.json",
+    "icon.svg"
   ],
   "scripts": {
     "build": "node scripts/build-client.mjs",
@@ -59,6 +61,9 @@
     "yaml": "^2.5.0"
   },
   "dsh": {
+    "engines": {
+      "dsh": ">=0.1.7-rc.2"
+    },
     "bundle": {
       "patch": "./cordis.patch.yml"
     },

package/src/copilot-models.mjs

@@ -2,8 +2,11 @@
 // ⚠️ 显式耦合 pi-ai 0.84.4：COPILOT_HEADERS / COPILOT_API_VERSION / normalizeDomain /
 // getGitHubCopilotBaseUrl / parseGitHubCopilotModelCatalog 的语义逐行抄录自
 // @earendil-works/pi-ai@0.84.4 dist/auth/oauth/github-copilot.js。
-// 不实现 token 获取/刷新/policy 修改；语义漂移或任何失败一律由调用方回退凭证缓存
+// 不实现 token 获取/policy 修改；token 刷新仅限 v1.2.21 起的 ephemeral 续期（见文末，
+// 只存内存、绝不落库）；其余语义漂移或任何失败一律由调用方回退凭证缓存
 // （payload.availableModelIds）。pi-ai 升级后本文件必须对照新版源码复核。
+// v1.2.21 增抄：copilot_internal/v2/token 续期语义抄录自 pi-ai dist/auth/oauth/github-copilot.js
+// refreshGitHubCopilotAccessToken（0.84.4 与 0.87.1 该函数 diff 为空）；ephemeral 使用、绝不落库。
 
 // ↓↓↓ 以下常量抄录自 pi-ai 0.84.4 dist/auth/oauth/github-copilot.js（勿改值）
 const COPILOT_HEADERS = {
@@ -107,7 +110,48 @@ export async function fetchLiveAvailableModelIds({ credential, fetchImpl } = {})
     signal: AbortSignal.timeout(5000),
   });
   if (!response.ok) {
-    throw new Error(`${response.status} ${response.statusText}: GET ${baseUrl}/models`);
+    // 携 status 供调用方证据分型（401/403 → token-rejected；其余 → network），与 refreshEphemeralAccess 同款
+    throw Object.assign(new Error(`${response.status} ${response.statusText}: GET ${baseUrl}/models`), { status: response.status });
   }
   return parseAvailableModelIds(await response.json(), allowPolicyFallback);
 }
+
+// 本地解析 access（tid 会话令牌）内的 exp=（秒 → 毫秒）；缺失/不可解析 → null。
+// 零网络：调用方据此在发请求前判断"是否需要续期"。
+export function parseAccessExpiryMs(access) {
+  const match = String(access ?? "").match(/exp=(\d+)/);
+  return match ? Number(match[1]) * 1000 : null;
+}
+
+// 铸一枚新的短命 tid：GET copilot_internal/v2/token（Bearer = 长期 ghu）。
+// 语义抄录自 pi-ai refreshGitHubCopilotAccessToken（见文件头）；单次尝试、5s 超时、
+// 不重试、结果仅存内存（调用方绝不写回凭据库）。HTTP 失败抛错并携 status 供分型
+// （401/403 → 长期令牌被拒；其余/网络 → network）。错误消息保真对齐 0.87.1 L261/L264。
+export async function refreshEphemeralAccess({ refreshToken, enterpriseUrl, fetchImpl } = {}) {
+  if (typeof refreshToken !== "string" || refreshToken === "" || typeof fetchImpl !== "function") {
+    throw new Error("refreshToken and fetchImpl required");
+  }
+  const domain = normalizeDomain(enterpriseUrl) ?? "github.com";
+  const url = `https://api.${domain}/copilot_internal/v2/token`;
+  const response = await fetchImpl(url, {
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${refreshToken}`,
+      ...COPILOT_HEADERS,
+    },
+    signal: AbortSignal.timeout(5000),
+  });
+  if (!response.ok) {
+    throw Object.assign(new Error(`${response.status} ${response.statusText}: GET ${url}`), { status: response.status });
+  }
+  const raw = await response.json();
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Invalid Copilot token response");
+  }
+  const token = raw.token;
+  const expiresAt = raw.expires_at;
+  if (typeof token !== "string" || typeof expiresAt !== "number") {
+    throw new Error("Invalid Copilot token response fields");
+  }
+  return { access: token, expiresAtMs: expiresAt * 1000 - 5 * 60 * 1000 };
+}

package/src/refresh-flow.mjs

@@ -3,7 +3,9 @@
 // 状态：idle → previewing → confirming（勾选→materialize 循环；缓存证据＋删除提案时
 // 自动 live 升级：闩锁、硬失败回退 materialize、软降级置 staleNotice）→ applying →
 // result / pendingRestart / checking / busy / resultUnknown；recovery-needed 经
-// retireConfirm → retiring → 重新预览闭环。
+// retireConfirm → retiring → 重新预览闭环；busy 态在 active.phaseResult.status ===
+// "recovery-needed" 时同样提供 retire 出口（032），水合时该判据优先于旧 lastResult
+// （防旧 "applied" 遮蔽卡死操作），retire 失败回 busy 可重试。
 // 关键规则：
 //  - 勾选集合即终态；选择变化经 basePreviewId 从原快照 materialize（不重新取数）
 //  - 确认门按实际 diff：removed>0 ∨ clearOverrides ∨ 空目标 → 二次确认；空目标另需 empty
@@ -108,6 +110,10 @@ export function reduce(state, event) {
       if (event.type === "retire-request" && state.name === "result") {
         return [{ name: "retireConfirm", result: state.result }, null];
       }
+      // 032：busy 态的 retire 出口——仅当卡死操作已 recovery-needed（静止核实后清，绝不写配置）
+      if (event.type === "retire-request" && state.name === "busy" && state.active?.phaseResult?.status === "recovery-needed") {
+        return [{ name: "retireConfirm", active: state.active }, null];
+      }
       if (event.type === "dismiss" && state.name === "failed") {
         return [{ ...initial, flags: state.flags }, null];
       }
@@ -116,6 +122,10 @@ export function reduce(state, event) {
         if (!event.status) return [state, null];
         if (refresh?.lastError === "state-corrupt") return [{ ...state, name: "failed", error: "state-corrupt" }, null];
         const base = fromRefresh({ ...initial, name: "idle" }, refresh);
+        // 032 水合判序：卡死操作（recovery-needed）优先于旧 lastResult，防旧 "applied" 遮蔽 busy 死锁
+        if (refresh?.activeOperation?.phaseResult?.status === "recovery-needed") {
+          return [{ ...base, name: "busy", active: refresh.activeOperation }, null];
+        }
         if (restartStates.has(refresh?.lastResult?.status ?? "") || refresh?.pendingRestart === true) {
           return [{ ...base, name: "pendingRestart", result: refresh.lastResult }, null];
         }
@@ -271,14 +281,20 @@ export function reduce(state, event) {
     }
     case "retireConfirm": {
       if (event.type === "retire-confirm") {
-        return [{ name: "retiring", operationId: state.result?.operationId, result: state.result }, { type: "retire", operationId: state.result?.operationId }];
+        // 双入口：result 入口携 result；busy 入口（032）携 active——operationId 二选一
+        return [{ name: "retiring", operationId: state.result?.operationId ?? state.active?.operationId, result: state.result, active: state.active }, { type: "retire", operationId: state.result?.operationId ?? state.active?.operationId }];
       }
-      if (event.type === "cancel") return [{ name: "result", result: state.result }, null];
+      if (event.type === "cancel") return state.active ? [{ name: "busy", active: state.active }, null] : [{ name: "result", result: state.result }, null];
       return [state, null];
     }
     case "retiring": {
       if (event.type === "retire-ok") return [{ ...state, name: "checking" }, { type: "status" }];
-      if (event.type === "retire-fail") return [{ name: "result", result: state.result, retireError: event.error }, null];
+      if (event.type === "retire-fail") {
+        // 032：busy 入口失败回 busy 可重试；result 入口维持既有落点
+        return state.active
+          ? [{ name: "busy", active: state.active, retireError: event.error }, null]
+          : [{ name: "result", result: state.result, retireError: event.error }, null];
+      }
       return [state, null];
     }
     default:

package/src/refresh-service.mjs

@@ -1,6 +1,7 @@
 // refresh-service.mjs — 预览服务与账号证据（T8）。
 // 职责：内存预览快照（10 分钟、选择从原快照重算、operationId 绑定选择）、
-// 账号证据门禁（移除类变更需 live＋latest；纯新增允许 ≤24h 同 intentVersion 缓存；stale 只参考不可应用）、
+// 账号证据门禁（移除类变更需 live＋latest；纯新增允许 ≤24h 同 intentVersion 缓存；stale 只参考不可应用）
+// ＋tid 过期自愈（v2/token 铸 ephemeral tid：内存、不落库、单次尝试、负缓存 5min、按 exp 复用）、
 // apply 幂等（同 operationId 返回已知结果；activeOperation 未终结时新 apply 423）、
 // boot/apply/retire 同一队列串行。
 // 事务内核（T9）经 transaction 注入：{runApply({snapshot}), bootRecover(), retire({operationId})}。
@@ -11,10 +12,11 @@ import { join } from "node:path";
 import { readJson, writeJsonAtomic, createMutex } from "./atomic-json.mjs";
 import { CREDENTIAL_KEY } from "./shared.mjs";
 import { buildModelChange } from "./model-update.mjs";
-import { fetchLiveAvailableModelIds } from "./copilot-models.mjs";
+import { fetchLiveAvailableModelIds, parseAccessExpiryMs, refreshEphemeralAccess } from "./copilot-models.mjs";
 
 const PREVIEW_TTL_MS = 10 * 60 * 1000;
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const HEAL_RETRY_MS = 5 * 60 * 1000; // 自愈失败负缓存：期间不再打 v2/token
 
 function flowError(code, message, extra = {}) {
   const err = new Error(message ?? code);
@@ -25,40 +27,6 @@ function flowError(code, message, extra = {}) {
 
 const iso = (ts) => new Date(ts).toISOString();
 
-// 账号证据：live GET 成功才写缓存（fetchedAt＋intentVersion）；缓存仅 ≤24h 且同
-// intentVersion 时可作纯新增的应用依据；否则 stale——预览可展示参考，apply 被拒（Q7/Q16）。
-// 移除类变更（removed>0）在 apply 时强制 live 证据＋latest 目录（removals-need-live，Q35/R2）；
-// live 拉取失败回退有效缓存属软降级，由 client 端升级/禁用逻辑兜底（R4-3），服务端门最终兜底。
-async function resolveAccountEvidence(ctx, { scope, readIntentVersion, clock, fetchImpl }) {
-  const iv = readIntentVersion();
-  const cacheFile = join(scope.dataDir, "account-model-cache.json");
-  const readCache = () => {
-    try {
-      return readJson(cacheFile);
-    } catch {
-      return undefined;
-    }
-  };
-  const record = await ctx.credentials.readRecord(CREDENTIAL_KEY);
-  const payload = record?.payload ?? {};
-  if (payload.access) {
-    try {
-      const ids = await fetchLiveAvailableModelIds({ credential: payload, fetchImpl });
-      const fetchedAt = iso(clock.now()); // 单次取时：缓存值与返回值同源（避免毫秒漂移）
-      mkdirSync(scope.dataDir, { recursive: true });
-      writeJsonAtomic(cacheFile, { ids, fetchedAt, intentVersion: iv });
-      return { source: "live", ids, fetchedAt, stale: false };
-    } catch { /* 回退缓存判定 */ }
-  }
-  const cache = readCache();
-  if (cache && Array.isArray(cache.ids) && typeof cache.fetchedAt === "string"
-    && Number.isFinite(Date.parse(cache.fetchedAt))
-    && clock.now() - Date.parse(cache.fetchedAt) <= CACHE_TTL_MS
-    && cache.intentVersion === iv) {
-    return { source: "cache", ids: cache.ids, fetchedAt: cache.fetchedAt, stale: false };
-  }
-  return { source: "stale", ids: Array.isArray(cache?.ids) ? cache.ids : [], fetchedAt: cache?.fetchedAt ?? null, stale: true };
-}
 
 export function createRefreshService(ctx, {
   scope,
@@ -74,6 +42,80 @@ export function createRefreshService(ctx, {
   };
   const queue = createMutex();
   const snapshots = new Map(); // previewId -> snapshot（内存态；重启即失效，幂等走持久状态）
+  // 自愈三态（N1，纯内存；dispose/重启即清）：已铸的 ephemeral tid、失败负缓存时刻与原因
+  let ephemeral = null;
+  let healBlockedUntil = 0;
+  let healBlockedReason = null;
+
+  // 账号证据（v1.2.21 起闭包内化）：live GET 成功才写缓存（fetchedAt＋intentVersion）；缓存仅 ≤24h
+  // 且同 intentVersion 时可作纯新增的应用依据；否则 stale——预览可展示参考，apply 被拒（Q7/Q16）。
+  // 移除类变更（removed>0）在 apply 时强制 live 证据＋latest 目录（removals-need-live，Q35/R2）。
+  // 自愈（N1）：tid 过期且记录带 refresh 时经 v2/token 铸 ephemeral tid——a 复用（未过 exp 不重铸）、
+  // b 负缓存期内沿用上次失败原因、c 单次续期；任何失败沿用软降级回退有效缓存，并给出 reason 分型。
+  async function resolveAccountEvidence({ clock, fetchImpl }) {
+    const iv = readIntentVersion();
+    const cacheFile = join(scope.dataDir, "account-model-cache.json");
+    const readCache = () => {
+      try {
+        return readJson(cacheFile);
+      } catch {
+        return undefined;
+      }
+    };
+    const record = await ctx.credentials.readRecord(CREDENTIAL_KEY);
+    const payload = record?.payload ?? {};
+    let reason = null;
+    let access = payload?.access;
+    if (!access) {
+      reason = "no-session";
+    } else {
+      const expMs = parseAccessExpiryMs(access);
+      const accessExpired = expMs !== null && expMs <= clock.now();
+      if (accessExpired && typeof payload.refresh === "string" && payload.refresh !== "") {
+        if (ephemeral && clock.now() < ephemeral.expiresAtMs) {
+          access = ephemeral.access; // a. 复用：不打续期
+        } else if (clock.now() < healBlockedUntil) {
+          reason = healBlockedReason ?? "access-expired"; // b. 负缓存：沿用上次失败原因
+          access = undefined;
+        } else {
+          try { // c. 续期：单次尝试，成功清负缓存
+            const minted = await refreshEphemeralAccess({ refreshToken: payload.refresh, enterpriseUrl: payload.enterpriseUrl, fetchImpl });
+            ephemeral = minted;
+            healBlockedUntil = 0;
+            healBlockedReason = null;
+            if (clock.now() < minted.expiresAtMs) access = minted.access;
+          } catch (error) {
+            healBlockedUntil = clock.now() + HEAL_RETRY_MS;
+            healBlockedReason = error?.status === 401 || error?.status === 403 ? "token-rejected" : "network";
+            reason = healBlockedReason;
+            access = undefined;
+          }
+        }
+      } else if (accessExpired) {
+        reason = "access-expired"; // 过期且无 refresh：无从续期，跳过 live GET
+        access = undefined;
+      }
+    }
+    if (access) {
+      try {
+        const ids = await fetchLiveAvailableModelIds({ credential: { ...payload, access }, fetchImpl });
+        const fetchedAt = iso(clock.now()); // 单次取时：缓存值与返回值同源（避免毫秒漂移）
+        mkdirSync(scope.dataDir, { recursive: true });
+        writeJsonAtomic(cacheFile, { ids, fetchedAt, intentVersion: iv });
+        return { source: "live", ids, fetchedAt, stale: false, reason: null };
+      } catch (error) {
+        reason = error?.status === 401 || error?.status === 403 ? "token-rejected" : "network";
+      }
+    }
+    const cache = readCache();
+    if (cache && Array.isArray(cache.ids) && typeof cache.fetchedAt === "string"
+      && Number.isFinite(Date.parse(cache.fetchedAt))
+      && clock.now() - Date.parse(cache.fetchedAt) <= CACHE_TTL_MS
+      && cache.intentVersion === iv) {
+      return { source: "cache", ids: cache.ids, fetchedAt: cache.fetchedAt, stale: false, reason };
+    }
+    return { source: "stale", ids: Array.isArray(cache?.ids) ? cache.ids : [], fetchedAt: cache?.fetchedAt ?? null, stale: true, reason };
+  }
   const getFetch = () => fetchImpl ?? globalThis.fetch?.bind(globalThis);
   const resolveCatalog = deps.resolveCatalog;
   const describeConfigView = deps.describeConfigView;
@@ -140,7 +182,7 @@ export function createRefreshService(ctx, {
       snapshots.set(snap.previewId, snap);
       return projectPreview(snap);
     }
-    const evidence = await resolveAccountEvidence(ctx, { scope, readIntentVersion, clock, fetchImpl: getFetch() });
+    const evidence = await resolveAccountEvidence({ clock, fetchImpl: getFetch() });
     const catalog = await resolveCatalog(catalogSource);
     const config = await describeConfigView();
     const intentVersion = readIntentVersion();
@@ -174,7 +216,7 @@ export function createRefreshService(ctx, {
       operationId: snap.operationId,
       operation: snap.operation,
       expiresAt: iso(snap.expiresAt),
-      evidence: { source: snap.evidence.source, fetchedAt: snap.evidence.fetchedAt, stale: snap.evidence.stale },
+      evidence: { source: snap.evidence.source, fetchedAt: snap.evidence.fetchedAt, stale: snap.evidence.stale, reason: snap.evidence.reason ?? null },
       catalogSource: snap.catalog.catalogSource,
       catalogError: snap.catalog.catalogError ?? null,
       skipped: snap.catalog.skipped ?? [],
@@ -280,6 +322,9 @@ export function createRefreshService(ctx, {
 
   function dispose() {
     snapshots.clear();
+    ephemeral = null;
+    healBlockedUntil = 0;
+    healBlockedReason = null;
   }
 
   // 诊断/测试观察面：当前内存快照数（含未过期；过期项在下次 preview 入口清扫）