dsh-codex-connect 0.1.0-alpha.4.34 → 0.1.0-alpha.4.36

package/INSTALL.md

@@ -1,9 +1,11 @@
 # Installation Runbook for CLI Agents
 
-Alpha 4.33 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with DSH `0.1.5-alpha.1` and pi-ai `0.85.1`.
+Published Alpha 4.35 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` model-runtime pairing using pi-ai `0.85.1`.
 
 Install `dsh-codex-connect` into one requested DeepSeek Harness profile without changing its current default model, search route, global configuration, or OAuth state.
 
+Channel snapshot on 2026-09-11: npm `alpha` points to `0.1.0-alpha.4.35`; `latest` intentionally remains on `0.1.0-alpha.4.34`. Use the exact-version commands below for 4.35. Publishing an Alpha and promoting the default installation channel are separate actions.
+
 ## Safety requirements
 
 - Never read, print, copy, move, or modify `~/.codex/auth.json`.
@@ -16,22 +18,26 @@ Install `dsh-codex-connect` into one requested DeepSeek Harness profile without
 
 ### Select an exact version before installation
 
-Check `dsh --version` before changing the requested profile. Use `dsh --help` to locate the CLI if needed; from a Harness checkout use `pnpm dsh --version`. Select an exact pair from [verified-compatibility.json](verified-compatibility.json):
+Check `dsh --version` before changing the requested profile. Use `dsh --help` to locate the CLI if needed; from a Harness checkout use `pnpm dsh --version`. The CLI string alone does not identify every installed model-runtime package: a CLI reporting `0.1.5-rc.1` can resolve `0.1.5-rc.2` packages. When the plugin is already installed, also run `dsh plugin --profile web exec dsh-codex-connect doctor --json` and inspect the installed `@deepseek-ai/dsh-llm`, `@deepseek-ai/dsh-llm-pi-ai`, and pi-ai versions. Substitute the requested profile. Select an exact pair from [verified-compatibility.json](verified-compatibility.json):
 
 | Installed DSH version | Codex Connect version to pin |
 | --- | --- |
 | `0.1.0-rc.7` | `0.1.0-alpha.4.14` |
 | `0.1.1-rc.2` | `0.1.0-alpha.4.21` |
 | `0.1.2-alpha.2` | `0.1.0-alpha.4.23` |
-| `0.1.2-rc.1` | `0.1.0-alpha.4.33` |
+| `0.1.2-rc.1` | `0.1.0-alpha.4.35` |
 | `0.1.2-alpha.5` | `0.1.0-alpha.4.25` |
-| `0.1.5-alpha.1` | `0.1.0-alpha.4.33` |
+| `0.1.5-alpha.1` | `0.1.0-alpha.4.35` |
+| `0.1.5-rc.1` | `0.1.0-alpha.4.35` |
+| `0.1.5-rc.2` | `0.1.0-alpha.4.35` |
 
 If your exact DSH version is unknown or not listed, preserve the installed host, report that the combination is unverified, and verify it before making installation changes. A missing record does not prove incompatibility, and the catalog's latest verified DSH version is not the latest upstream release. Do not recommend upgrading or downgrading DSH merely to match a row. Investigate any specific failure and seek verification of the installed combination. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
 
-Alpha 4.33 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or `0.1.5-alpha.1` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
+Alpha 4.35 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or one of `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
+
+The Alpha 4.35 rows reflect successful release-commit CI on Node 22.19.0 and 24.20.0 (840 tests each), 28 Chromium tests, Windows canary contracts, and the four-host installation/Reserve matrix. Independent post-publication checks installed the exact npm version on all four hosts, matched all 63 installed plugin files to the verified published archive, and exercised a 4.34-to-4.35 upgrade on rc.2. All eight advertised models resolved and prepared, defaults were unchanged, all optional capabilities remained disabled, and provider disposal and synthetic Reserve transitions passed. These checks are not fresh real OAuth, live Reserve/model/tool/image, or full Windows application acceptance. See [.github/ALPHA_435_RELEASE_READINESS.md](.github/ALPHA_435_RELEASE_READINESS.md) for publication, installation evidence, and limitations. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
 
-The Alpha 4.33 rows reflect same-artifact isolated installation and runtime checks, bounded real-account calls, and isolated upgrades from Alpha 4.32. Fresh OAuth and manual callback acceptance used the real implementation through a temporary acceptance page. See [.github/ALPHA_433_RELEASE_READINESS.md](https://github.com/franksong2702/dsh-codex-connect/blob/main/.github/ALPHA_433_RELEASE_READINESS.md) for commands and verification limits. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
+Alpha 4.33 omits the `modelErrors` profile field required by RC model packages, producing `Cannot read properties of undefined (reading 'get')`. Alpha 4.34 contains the fix, retained in 4.35. Reauthorization or repeated model-list retries do not add a missing profile field. Pin the corrected plugin version for a verified host combination; do not delete credentials or change DSH merely to work around this failure. DSH `0.1.5-alpha.2` remains unverified.
 
 ### Install the selected version and validate
 
@@ -54,10 +60,10 @@ The Alpha 4.33 rows reflect same-artifact isolated installation and runtime chec
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.23
    ```
 
-   For DSH `0.1.2-rc.1` or `0.1.5-alpha.1`, use Alpha 4.33:
+   For DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2`, use Alpha 4.35:
 
    ```sh
-   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.33
+   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
    ```
 
    For DSH `0.1.2-alpha.5`, use Alpha 4.25:
@@ -66,7 +72,7 @@ The Alpha 4.33 rows reflect same-artifact isolated installation and runtime chec
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
    ```
 
-   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.33'` only for the DSH `0.1.2-rc.1` or `0.1.5-alpha.1` combinations.
+   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.35'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` combinations.
 
 3. Run `dsh web --help` once to compose the installed profile without starting the server. DSH `0.1.2-rc.1` prepares profile plugin dependency fallback during this step.
 4. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.
@@ -96,7 +102,7 @@ The value is a full `http://` or `https://` origin including its port, not a bar
 
 ## Optional configuration
 
-Use **Settings → Plugins → Plugin configuration → Codex Connect** for live, staged Save/Discard edits organized under Account & quota, Models, Network, and Capabilities. Switching modules preserves the draft. The same settings control `enableSearch`, `enableImageTool`, `enableImageGeneration`, and `enableAutoReview`; all four default to `false`. Enabling Auto-review permits bounded approval context, tool arguments, working directory, and the planned action to be sent to `chatgpt.com`; failures return to human approval. Enabling image generation uses the image generation capability included with the current GPT subscription and saves results as DSH attachments. Enabling search registers the provider and selects it while the capability remains enabled; disabling restores the previous provider before unregistering Codex Search. Setting `agent-default-model` to `openai-codex` remains a separate explicit change.
+Use **Settings → Plugins → Plugin configuration → Codex Connect** for live, staged Save/Discard edits organized under Account & quota, Models, Network, and Capabilities. Switching modules preserves the draft. The same settings control `enableSearch`, `enableReserveFallback`, `enableImageTool`, `enableImageGeneration`, and `enableAutoReview`; all five default to `false`. Luna Reserve is a published experiment in Alpha 4.35: enable it only when explicitly requested, never as an automatic installation step. Real-account Reserve entry and recovery remain unverified; authorization must come from the identity-matched backend response, not a generic `429` or quota percentage. Enabling Auto-review permits bounded approval context, tool arguments, working directory, and the planned action to be sent to `chatgpt.com`; failures return to human approval. Enabling image generation uses the image generation capability included with the current GPT subscription and saves results as DSH attachments. Enabling search registers the provider and selects it while the capability remains enabled; disabling restores the previous provider before unregistering Codex Search. Setting `agent-default-model` to `openai-codex` remains a separate explicit change.
 
 Apply only requested choices and preserve unrelated keys:
 
@@ -104,6 +110,7 @@ Apply only requested choices and preserve unrelated keys:
 - id: llm-openai-codex
   config:
     enableSearch: true
+    enableReserveFallback: false
     enableImageTool: false
     enableImageGeneration: false
     enableAutoReview: false

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: abaac5cb3f80c204f01c6b804fff06e649a75298
-docs/README.zh.md: fe1383a7deaeaf355782ee6cf79f296e0f3cbaad
+README.md: 5c2bff3d29c1366e52035ac809f119a2fdca47fc
+docs/README.zh.md: f629b3789be4b361ffd4045dff7fa6acf92770ff

package/README.md

@@ -12,19 +12,21 @@ Codex Connect adds the `openai-codex` model provider to the normal Harness agent
 
 ## Quick start
 
-This guide describes the published pairing below. Check `dsh --version` first; for another DSH version, use [Installation and upgrades](INSTALL.md). A moving npm tag such as `alpha` is not a compatibility guarantee.
+This guide describes the published pairings below. Check `dsh --version` first and use `doctor --json` to inspect the installed model-runtime packages: an rc.1 CLI can resolve rc.2 packages. For other versions, use [Installation and upgrades](INSTALL.md). A moving npm tag such as `alpha` is not a compatibility guarantee.
 
 | Requirement | Verified pairing |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.33` |
-| DeepSeek Harness | `0.1.2-rc.1` or `0.1.5-alpha.1` |
+| Codex Connect | `0.1.0-alpha.4.35` |
+| DeepSeek Harness | `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | Account | ChatGPT OAuth with access to the requested Codex model; availability is decided by OpenAI |
 
+As of 2026-09-11, npm `alpha` points to 4.35 while `latest` intentionally remains on 4.34. Use the exact version below for 4.35; this recommendation does not promote the default installation channel.
+
 ### 1. Install
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.33
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
 dsh web
 ```
 
@@ -69,10 +71,15 @@ All options below are off on a fresh installation. Edit them in **Settings → P
 |---|---|---|
 | Proxy | `enableProxy` | Credential-free HTTP(S), scoped to this plugin's traffic. A failed proxy request does not silently retry directly. |
 | Codex Search | `enableSearch` | Selects Codex for the entire profile's search route; disabling restores the previously active route. |
+| Luna Reserve | `enableReserveFallback` | Uses the hidden Reserve route only when the backend explicitly authorizes it for the captured account; never changes global defaults or retries a generic `429`. |
 | Image viewing | `enableImageTool` | Adds `view_image` to vision-capable models for local files and validated public HTTP(S) images. |
 | GPT Image generation | `enableImageGeneration` | Prompt-only generation; availability, dimensions, and quota remain account- and service-controlled. |
 | Auto-review | `enableAutoReview` | Sends bounded approval context, tool arguments, working directory, and the planned action to `chatgpt.com`, with confirmation on first enablement. Failures return to human approval. |
 
+**Published experiment:** Alpha 4.35 includes Luna Reserve fallback, disabled by default. Real-account Reserve entry and recovery remain unverified; Alpha 4.34 does not include this feature.
+
+With `enableReserveFallback: true`, the account UI and agent routing share one identity-bound quota state. Background refresh follows the returned quota windows; fresh state is reused across agent steps. The plugin enters `gpt-reserve` only with complete, non-FedRAMP account/user identity and backend Luna Reserve authorization, then restores the session's previous model and reasoning effort after confirmed ordinary-usage recovery. Reserve has its own allowance, is hidden from the model picker, and is not unlimited. The backend decides eligibility; reset times alone do not authorize a switch. This version supports known `gpt-5.6-luna` metadata only. See [Luna Reserve fallback](docs/reference.md#luna-reserve-fallback) for refresh, identity, and verification limits.
+
 Use the image generation capability included with your current GPT subscription. Generated originals are stored separately from attachment previews; disabling the capability or uninstalling the plugin does not delete them. See [Configuration and recovery](docs/reference.md#search-and-image-tools) for storage and access rules.
 
 Auto-review operates after Harness policy requires approval; it does not bypass that policy. See [Auto-review behavior](docs/auto-review.md) before enabling it.

package/cordis.patch.yml

@@ -6,6 +6,8 @@
       config:
         enableProxy: false
         enableSearch: false
+        enableReserveFallback: false
+        enableNativeCompaction: false
         enableImageTool: false
         enableImageGeneration: false
         enableAutoReview: false

package/docs/README.zh.md

@@ -12,19 +12,21 @@ Codex Connect 为标准 Harness agent loop 添加 `openai-codex` 模型提供方
 
 ## 快速开始
 
-本指南介绍下方已发布的组合。请先运行 `dsh --version`；其他 DSH 版本请查阅[安装与升级](../INSTALL.md)。`alpha` 等会移动的 npm tag 不代表兼容性保证。
+本指南介绍下方已发布的组合。请先运行 `dsh --version`，并用 `doctor --json` 检查实际安装的模型运行库：rc.1 CLI 可能解析到 rc.2 包。其他版本请查阅[安装与升级](../INSTALL.md)。`alpha` 等会移动的 npm tag 不代表兼容性保证。
 
 | 要求 | 已验证组合 |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.33` |
-| DeepSeek Harness | `0.1.2-rc.1` 或 `0.1.5-alpha.1` |
+| Codex Connect | `0.1.0-alpha.4.35` |
+| DeepSeek Harness | `0.1.2-rc.1`、`0.1.5-alpha.1`、`0.1.5-rc.1` 或 `0.1.5-rc.2` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | 账户 | 通过 ChatGPT OAuth 使用所请求的 Codex 模型；可用性由 OpenAI 决定 |
 
+截至 2026-09-11，npm `alpha` 指向 4.35，`latest` 则有意保留在 4.34。安装 4.35 请使用下方精确版本命令；文档推荐更新不代表默认安装渠道已提升。
+
 ### 1. 安装
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.33
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
 dsh web
 ```
 
@@ -69,10 +71,15 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 |---|---|---|
 | 代理 | `enableProxy` | 不带凭据的 HTTP(S)，只作用于本插件流量。代理请求失败不会静默改走直连。 |
 | Codex 搜索 | `enableSearch` | 将整个 profile 的搜索路由切换为 Codex；关闭后恢复之前的路由。 |
+| Luna Reserve | `enableReserveFallback` | 只在服务端为当前已固定账户明确授权时使用隐藏的 Reserve 路由；不修改全局默认模型，也不因普通 `429` 重试。 |
 | 图片查看 | `enableImageTool` | 为视觉模型添加 `view_image`，读取本地文件和经过校验的公网 HTTP(S) 图片。 |
 | GPT Image 图片生成 | `enableImageGeneration` | 只接受提示词；可用性、尺寸和额度仍由账户及服务端控制。 |
 | 自动审查 | `enableAutoReview` | 将有界的审批上下文、工具参数、工作目录和待执行动作发送到 `chatgpt.com`，首次启用需要确认。失败时交还人工审批。 |
 
+**已发布的实验功能：** Alpha 4.35 包含 Luna Reserve 回退，仍默认关闭。真实账户进入 Reserve 及恢复普通模型的过程仍未验证；Alpha 4.34 不包含该功能。
+
+启用 `enableReserveFallback: true` 后，账户 UI 和 agent 路由共用一份绑定身份的额度状态，按服务端返回的额度窗口后台刷新；有效状态可跨 agent step 复用。只有身份完整、非 FedRAMP 且服务端授权时，插件才进入 `gpt-reserve`；普通额度确认恢复后，切回该会话先前的模型和推理强度。Reserve 有自己的额度，不出现在模型选择器中，也不是无限额度。资格由服务端决定，重置时间本身不授权切换。当前版本只支持已知的 `gpt-5.6-luna` 元数据。刷新、身份和验证限制见 [Luna Reserve 回退](reference.zh.md#luna-reserve-回退)。
+
 使用你当前 GPT 订阅计划提供的图片生成能力。生成原文件与附件预览分开保存；关闭能力或卸载插件不会删除这些文件。存储和访问规则见[配置与恢复](reference.zh.md#搜索与图片工具)。
 
 自动审查在 Harness 策略判定需要审批后执行，不会绕过该策略。启用前请阅读[自动审查行为](auto-review.zh.md)。

package/docs/agent-notes/dsh-016-candidate-validation.md

@@ -0,0 +1,27 @@
+# DSH 0.1.6 candidate validation
+
+DSH `0.1.6-alpha.1` is a candidate, not a declared supported host. This change does not widen peer dependencies, change `compatibility.json` or `verified-compatibility.json`, publish a release, or upgrade a user profile. Track full acceptance in #207.
+
+## Automated scope
+
+The installation checker now exercises the packed plugin with image generation enabled in addition to its existing provider, Reserve and durable native-compaction checks. It runs the exact host's tool registry and PTC dispatch bridge, validates the rendered image-reference envelope against its typed preview, downloads the original bytes through the registered route, and verifies that a fork inheriting the PTC event can download the original while an earlier fork and an unrelated Session cannot.
+
+The image provider, preview store and code-execution backend are synthetic. The fixture invokes the host-supplied PTC binding; it does not execute arbitrary source, test the real Node PTC process, make provider requests, authenticate a browser, or claim browser rendering. Original storage and the plugin download handler are real. The candidate uses `ptcRuntime`; the existing declared hosts use `codeRuntime`. Both dispatch event names are checked through the actual host, not fabricated session events.
+
+The same-artifact matrix refuses missing image evidence, failed fork authorization checks and nonzero real-provider request counts. Existing browser component regression remains a separate baseline-host check, not proof of the candidate Web composition.
+
+## API assessment
+
+The main plugin does not subscribe to the removed `agent/session-start` event. Its existing image-download and Auto-review readers use `snapshotEvents()`, which the candidate still implements but marks deprecated; deprecation alone does not prove a runtime break. The unmerged Split experiment has separate lifecycle dependencies and is not covered by this assessment. Upstream PTC package/service renaming and the new process backend require explicit coverage before expanding support.
+
+## User acceptance before support expansion
+
+Use a separate disposable DSH home and workspace. Do not upgrade or restart an existing service, copy real account files, or import private session history as part of an automated check. A user must authorize live requests and sign in to the test profile.
+
+- Open the candidate Web UI and confirm plugin settings, model selection, reasoning controls and Fast controls render and retain explicit choices.
+- Sign in and complete one ordinary text/tool round trip; verify cancellation and reload/reconnect behavior.
+- With image generation explicitly enabled, generate one image through PTC, inspect the actual card, download original and preview, and check reload and fork access. Synthetic provider results do not replace this check.
+- Exercise only the optional search, proxy, quota, Auto-review or native-compaction features included in the intended deployment. Record untested features rather than treating default-off loading as their acceptance.
+- Record the exact host version, plugin commit/artifact, Node version and observed results without credentials or private transcript content.
+
+After acceptance, update the supported-host metadata together in a separate release change. Publishing and deployment remain separately authorized actions.

package/docs/agent-notes/ptc-image-presentation.md

@@ -0,0 +1,18 @@
+# Image presentation through PTC
+
+Fixes the presentation failure reported in issue #205.
+
+DSH 0.1.5-rc.2 intentionally invokes `output.presentationMeta` only for top-level tools. Its `tool/ptc-dispatch` event preserves rendered content, not that metadata. Therefore image generation can succeed while the nested tool view cannot decode a result.
+
+The plugin now renders a bounded, versioned text envelope containing original/preview references alongside its typed image attachments. The tool view validates the envelope and requires an exact match to those image attachments. It does not parse arbitrary prose, accept raw paths, or infer an original from a preview hash. Existing direct-tool metadata remains authoritative; malformed metadata is not silently bypassed.
+
+Old PTC sessions without the envelope recover their typed previews and preview downloads. Their original IDs were not preserved in nested result content, so this fallback deliberately does not advertise an original download. New results support both representations. Fork authorization also recognizes successful inherited PTC events, preserving the immutable inherited-prefix and stored-original checks. Both the legacy `tool/code-dispatch` and current `tool/ptc-dispatch` event names are supported.
+
+## Verification
+
+- Decoder tests: legacy previews, full envelopes, missing/mismatched attachments, duplicate/oversized/malformed envelopes, invalid references.
+- Component tests: nested PTC cards recover galleries and download controls with and without original references.
+- Route tests: inherited PTC originals work; failed/wrong-tool/non-inherited events remain denied.
+- Existing direct calls, original integrity and nested/restored session tests remain applicable.
+
+This change does not change image-provider selection, copy files into a workspace, expose the plugin storage directory, or add a filesystem sidebar integration. A successful generator result proves storage, not that the browser rendered it; operational acceptance must inspect the actual card.

package/docs/agent-notes/shared-reserve-quota.md

@@ -0,0 +1,9 @@
+# Shared Luna Reserve quota state
+
+One plugin-owned quota service supplies both the account UI and Reserve routing. It coalesces concurrent usage GETs and schedules adaptive refresh from the last successful completion. Repeated reads preserve that deadline. Reset times accelerate observation without granting permission; only an identity-matched backend response authorizes Reserve or ordinary-usage recovery.
+
+The in-memory cache holds at most sixteen account/user entries. Account mutations, configuration changes, and disposal revoke the epoch signal carried by undispatched local permits. Each entry also owns a snapshot signal: starting a refresh (successful or failed) or evicting that entry revokes its old undispatched permits without revoking other identities. Return-target reads and writes recheck this combined authority before changing routes, including recovery to an ordinary model. Caller cancellation detaches its waiter without cancelling shared transport. Disposal aborts the epoch and awaits authentication and transport operations before closing the proxy manager. Failed responses remove cached decisions and receive a five-second retry deadline; raw provider failures are not retained in public errors.
+
+Ordinary and Reserve allowances are distinct. Explicit exhaustion of both stops routing. A typed account-quota failure invalidates stale state and permits at most one fresh, authorized transition per turn; generic request-rate failures do not enter this path. Return selections remain session/account-bound private files. Reserve model calls use Luna defaults and the existing context-window restriction remains unchanged.
+
+Verification uses synthetic credentials and HTTP responses through the quota service, account API, assembled agent loop, and installed host matrix. It does not establish actual account eligibility or production quota availability.

package/docs/experiments/native-compaction-lifecycle.md

@@ -0,0 +1,85 @@
+# Native compaction: durable lifecycle gate
+
+Tracking: [PR #197](https://github.com/franksong2702/dsh-codex-connect/pull/197), [mechanism #196](https://github.com/franksong2702/dsh-codex-connect/issues/196), [context experiment #65](https://github.com/franksong2702/dsh-codex-connect/issues/65), [roadmap #195](https://github.com/franksong2702/dsh-codex-connect/issues/195).
+
+Status: **unreleased prototype**, creation disabled by default. The published npm `0.1.0-alpha.4.35` does not contain this experiment even though the development branch has not bumped the package version.
+
+## What this gate actually exercises
+
+The fixture uses real, unmodified DSH AgentRegistry, AgentLoop, BasicCompactionEngine, SessionStore, token meter and JSONL persistence. Only provider responses and credentials are synthetic. It does not manually manufacture a checkpoint or substitute a mock session store for the lifecycle proof.
+
+For each physical JSONL encoding (`none` and `zstd`, using each host's normal writer format), independent Node processes run these phases:
+
+1. **Write:** run two real agent turns, invoke `ctx.compaction.compactNow`, require a useful replacement, check correlated compaction events and source references, and read the actual persisted artifact. Store a digest of the identified checkpoint and its visible surface for the next process.
+2. **Resume and fork:** start with no live sessions and native checkpoint creation disabled. Resume the parent through `ctx.agents.resume`, check the restored checkpoint and surface, and complete a tool-call/result round trip. Verify the next provider payload includes the unchanged opaque item and encrypted reasoning replay, not a textual marker. Create a factory-owned fork through `ctx.agents.create` using a verified completed parent prefix, explicit inherited-event count and parent lineage. Persist the child and verify later parent work leaves the child's stored bytes unchanged.
+3. **Resume child:** open the child in another fresh process, check exact inherited-prefix ownership, then run a new tool call with a different correlation id. The child's request uses its own session/cache identity; the parent's stored artifact remains unchanged.
+4. **Failure paths:** run the real transaction with HTTP rejection, a truncated response, empty encrypted content, incomplete terminal status, an oversized checkpoint, an oversized stream, and explicit caller cancellation. Failed native attempts may commit only the ordinary summary. Cancellation preserves the original surface and emits no fallback request. Every scenario is disposed, resumed and continued.
+
+5. **Automatic triggers:** run nine isolated scenarios through actual AgentLoop `agent/pre-step` and `agent/request-error` hooks: pressure, below threshold, auto disabled, overflow recovery, unrelated errors, bounded repeated overflow, failed recovery without progress, repeated pressure compaction, and an unshrinkable newest-message tail. The fixture verifies a new completed or failed turn, correlated compaction events, checkpoint replacement/replay, and preservation of the original surface when no replacement commits.
+
+The installed checker launches ten separate processes per exact host (five phases per encoding). The four-host installation matrix therefore exercises 40 processes, including eight automatic-phase processes that each run all nine scenarios, in addition to its ordinary install, model, settings and Reserve checks. It imports the plugin from the installed profile and DSH modules from the exact isolated host, rather than substituting the source tree's DSH dependencies.
+
+Source tests reuse the same assertions with recreated Cordis contexts. They are useful regressions, but **context recreation is not the process-restart proof**; the installed checker supplies that proof separately.
+
+The supported host generations do not share one storage-service API: `0.1.2-rc.1` exposes `readRaw`, while `0.1.5-alpha.1` uses read/write handles instead. Physical verification deliberately reads the disposable fixture's JSONL files directly, matches the header's exact session identity, and compares stored-byte digests. Actual write, restore and fork operations still go through the respective host's real APIs. This is not a private adapter or storage shim added to the shipped plugin. In handle-based hosts a bare `ctx.sessions.fork` does not acquire a persistence writer; the fixture therefore creates the seeded child through the Agent factory, which owns persistence admission and teardown.
+
+## Failure-driven corrections
+
+The initial prototype validated the number and position of compaction items but not whether `encrypted_content` was usable. The empty-content lifecycle fixture exposed that a useless native checkpoint could be committed. Encoding and decoding now require nonempty encrypted content and a valid optional identity, and restrict retained items to the deliberately supported user-message projection.
+
+Checkpoint encoding can fail even after a provider stream completes (for example, the local checkpoint size limit). Encoding must remain inside the pre-emission fallback boundary; otherwise an exception in a detached success callback can leave a consumer waiting without a terminal event. The bridge now contains those failures and also terminates synchronous fallback setup/iterator errors. Error response bodies and parser readers are released, and native stream bytes and terminal status are checked before accepting output.
+
+Two additional boundary regressions cover the full retained JSON array (brackets, commas and multibyte UTF-8) and composition with pi-ai payload observers. The 64,000-byte ceiling includes all array syntax. If an external `onPayload` observer returns `undefined`, the wrapper preserves its transformed payload instead of causing pi-ai to reuse the original, unexpanded input. Sync, async, mutating-observer and explicit-replacement callbacks are exercised through the installed provider implementation.
+
+## Automatic-trigger scope and retention boundary
+
+Pressure scenarios use an isolated 8,192-token model-capacity override and DSH's actual token meter; overflow scenarios remain below their configured pressure threshold and rely on the adapter classifying a synthetic context-window error. No DSH method is overridden to fabricate triggering. Provider errors, usage and encrypted items remain synthetic. This demonstrates host control flow, not a real model hitting its context limit.
+
+DSH's existing range selector retains the newest message even with `retainTokens: 0`. When that newest reply dominates the context, the selected older prefix may be too small to replace usefully. The `unshrinkable-tail` scenario checks that DSH rejects the non-shrinking summary, preserves history and completes the ordinary continuation. The bridge does not alter this host policy or promise that every high-pressure context can be reduced. Repeated compaction is covered synthetically, not by a live long-task benchmark.
+
+## Reproduction
+
+```sh
+pnpm exec vitest run tests/native-compaction.spec.ts tests/native-compaction-lifecycle.spec.ts tests/native-compaction-automatic.spec.ts tests/native-compaction-probes.spec.ts
+pnpm run check
+pnpm run test:browser
+pnpm run check:dsh-matrix
+```
+
+For an already isolated installation:
+
+```sh
+node scripts/check-installed-native-compaction.mjs /absolute/profile/package.json /absolute/host/package.json
+```
+
+The checker never calls the real model backend. Credentials are fixture-only, session directories are disposable, and the fetch stub rejects unrelated endpoints. Nothing here requires changing an active DSH service.
+
+## Separate bounded live provider acceptance — 2026-09-12
+
+Using the user's explicitly authorized existing M15 Codex login, the bridge/codec probe completed exactly three real requests: ordinary `gpt-5.6-luna`, native `compaction_trigger`, and continuation with the returned opaque item. Every returned server model was also `gpt-5.6-luna`; all responses were HTTP 200 with completed terminal status. The native response contained exactly one valid compaction item. The continuation correctly recalled a label generated in the baseline assistant reply, absent from retained user text and from the replay's non-compaction input. Native creation was disabled for replay.
+
+There were zero retries, fallback attempts or fallback dispatches; no Reserve/Sol/Astra calls. The read-only credential file remained byte-identical, and no real opaque state was written to disk. Sanitized [request metrics and outcome](native-compaction-luna-smoke-m15-2026-09-12.json) record the exact source digest, three dispatches and 552 backend-reported total tokens. All reported cached-token counts were zero.
+
+This is **one short same-account/same-model provider acceptance test**, separate from the synthetic durable lifecycle above. It does not combine a real backend with AgentLoop/JSONL/restart/fork, establish encrypted-token pricing, or demonstrate savings, cache benefit or long-task quality. Those three dispatches are historical evidence, not a reusable execution budget.
+
+## Separate real-provider persistence probe — not yet accepted
+
+`scripts/native-compaction-durable-smoke.mjs` has an offline rehearsal that uses the real adapter, AgentLoop, manual compaction transaction, JSONL persistence and two separate Node processes. It removes the original test label from visible replay input, restores an identical checkpoint with creation disabled, and tests native-rejection termination without a fallback dispatch. Its explicit live mode is Luna-only and bounded to three dispatches; the ordinary test suite exercises synthetic mode and argument rejection only.
+
+The user authorized expanded acceptance, but the subsequent live invocation was reported blocked and no verifiable live result for this durable probe has been recovered. The exact blocker remains undetermined. Delivery continues without retrying that operation or changing execution channels. Do not count offline success or the earlier bridge-only live smoke as real-provider JSONL/restart acceptance. Ports 3080/3081 and production-like DSH remain outside scope.
+
+## Interpretation and remaining work
+
+- The verified fork path is the public **Agent factory** seeded-creation boundary (`ctx.agents.create`), not the Web UI's completed-turn selector/controller. The fixture verifies a completed source prefix rather than reimplementing the UI's anchor-selection policy. Web end-to-end fork behavior is a separate acceptance item.
+- Manual `compactNow`, automatic pressure/overflow triggering (`compactIfNeeded`) and repeated pressure compaction now have synthetic control-flow coverage. Real-provider automatic triggering and repeated compaction, sudden process termination during writes, deliberate disk failures, images and cross-provider/account changes remain separate cases.
+- Model and effort are checked on resumed requests, and tool schemas on the native request. This does not establish compatibility with the adaptive `configuration_update` policy in PR #167.
+- Reported checkpoint/shadowed token counts are DSH heuristics over synthetic text. Provider usage is fabricated by the offline fixture. Neither proves real token savings, correct pricing of encrypted compaction content, cache benefits or long-task quality.
+- The conservative retained projection is capped at **64,000 serialized UTF-8 bytes**, not 64 KiB and not a claim of exact Codex token-policy equivalence.
+- A synthetic encrypted string proves transport/storage preservation, not real provider interpretation. The separate bounded Luna test above now supplies minimal live acceptance evidence; full live lifecycle and long-task comparison remain under #65.
+- Passing this gate permits a focused review of the mechanism; it does not authorize merging, releasing, promoting `latest`, or enabling the feature for users.
+
+## 中文说明
+
+这一关验证的是“存档后能继续”，而不是“压缩请求返回成功”：使用 DSH 的真实压缩事务和文件存储，随后在独立进程里恢复父会话、创建分支、恢复子会话，并继续调用工具。测试还检查取消和异常不会把无效原生 checkpoint 写入历史。
+
+持久化 lifecycle 与自动触发测试的模型响应、账户仍均为合成数据。自动压力、溢出恢复、重复压缩和无收益时保留历史已纳入离线验收；安装矩阵要求每宿主 10 个独立进程。另一次经用户授权的 M15 普通 Luna 三请求测试，已验证真实服务端接受原生压缩并能在后续请求中使用 opaque state。真实 provider 与 JSONL／进程重启结合的验收仍未完成，不能用上述两组独立证据代替；网页分支、故障注入与长任务效果也尚未验收。现有发布版与正在运行的环境不受影响。

package/docs/experiments/native-compaction-luna-smoke-m15-2026-09-12.json

@@ -0,0 +1,89 @@
+{
+  "schema_version": 1,
+  "status": "invocation_completed",
+  "started_at": "2026-09-12T00:24:27.850Z",
+  "finished_at": "2026-09-12T00:24:35.570Z",
+  "runner": "M15",
+  "command_exit_code": 0,
+  "command_signal": null,
+  "credential_file_unchanged": true,
+  "stderr_bytes": 0,
+  "result": {
+    "schema_version": 1,
+    "mode": "live",
+    "request_model": "gpt-5.6-luna",
+    "node": "v22.22.3",
+    "source_sha256": "f4909020c17a1ecb3003d349bc9009a555903146c7a1b6d51d53e12943edc392",
+    "transport": "sse",
+    "max_retries": 0,
+    "maximum_dispatches": 3,
+    "credential_refresh": false,
+    "credential_source": "codex-login",
+    "full_dsh_lifecycle": false,
+    "bridge_and_codec": true,
+    "persistent_session_write": false,
+    "scenario": "live",
+    "metrics": [
+      {
+        "stage": "baseline",
+        "dispatch": 1,
+        "request_model": "gpt-5.6-luna",
+        "server_model": "gpt-5.6-luna",
+        "http_status": 200,
+        "reasoning_effort": "low",
+        "terminal_status": "completed",
+        "input_tokens": 57,
+        "output_tokens": 87,
+        "total_tokens": 144,
+        "cached_tokens": 0,
+        "reasoning_tokens": 70,
+        "compaction_items": 0,
+        "latency_ms": 3655,
+        "error_code": null
+      },
+      {
+        "stage": "native",
+        "dispatch": 2,
+        "request_model": "gpt-5.6-luna",
+        "server_model": "gpt-5.6-luna",
+        "http_status": 200,
+        "reasoning_effort": "low",
+        "terminal_status": "completed",
+        "input_tokens": 164,
+        "output_tokens": 72,
+        "total_tokens": 236,
+        "cached_tokens": 0,
+        "reasoning_tokens": 0,
+        "compaction_items": 1,
+        "latency_ms": 2489,
+        "error_code": null
+      },
+      {
+        "stage": "replay",
+        "dispatch": 3,
+        "request_model": "gpt-5.6-luna",
+        "server_model": "gpt-5.6-luna",
+        "http_status": 200,
+        "reasoning_effort": "low",
+        "terminal_status": "completed",
+        "input_tokens": 157,
+        "output_tokens": 15,
+        "total_tokens": 172,
+        "cached_tokens": 0,
+        "reasoning_tokens": 0,
+        "compaction_items": 0,
+        "latency_ms": 1324,
+        "error_code": null
+      }
+    ],
+    "native_checkpoint_accepted": true,
+    "replay_accepted": true,
+    "label_recalled": true,
+    "stop_reason": "COMPLETED",
+    "dispatch_count": 3,
+    "real_provider_dispatches": 3,
+    "blocked_dispatch_attempts": 0,
+    "fallback_attempted": false,
+    "fallback_dispatched": false
+  }
+}

package/docs/reference.i18n.yaml

@@ -1,4 +1,4 @@
 # Bilingual-pair consistency record for the operational reference. Re-record with:
 #   git hash-object docs/reference.md docs/reference.zh.md
-docs/reference.md: d3e3af704f0a40f35f8f99b422cb2606877b3861
-docs/reference.zh.md: 9b976d9b005c36a561d7a7fca74bb5250d518fb5
+docs/reference.md: b4a7480a0bd95cc5cfee5f713a10a7820ee61342
+docs/reference.zh.md: cffb2fd685a2f0189d75c4ae3cbf6716697e063c

package/docs/reference.md

@@ -10,7 +10,7 @@ OAuth credentials are stored on the DSH host and used there to authenticate and
 
 Choose an `openai-codex` model in the normal Harness model picker. Model names remain canonical in every UI language. **More settings → Models** controls which models appear in discovery; hiding a model does not disable routing by its exact id.
 
-The Codex catalog comes from the installed `@earendil-works/pi-ai` package, not a live query of the account's available models. DSH `0.1.2-rc.1` uses pi-ai `^0.84.2`, which lacks `gpt-6-astra`; Codex Connect supplies that definition. Alpha 4.33 is also verified with DSH `0.1.5-alpha.1` and pi-ai `0.85.1`. Mixed host package versions and other DSH/pi-ai combinations remain unverified. With a native Astra entry, the plugin preserves its metadata and retains Low, Medium, High, Xhigh, and Max reasoning choices without modifying the installed catalog. Users do not need to upgrade pi-ai separately to select Astra. The exact verified pairs and acceptance limits are recorded in the release notes; dependency declarations alone do not establish verification. Neither catalog source proves account access.
+The Codex catalog comes from the installed `@earendil-works/pi-ai` package, not a live query of the account's available models. DSH `0.1.2-rc.1` uses pi-ai `^0.84.2`, which lacks `gpt-6-astra`; Codex Connect supplies that definition. Published Alpha 4.35 is also verified with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` pairing using pi-ai `0.85.1`. Mixed host package versions and other DSH/pi-ai combinations remain unverified. With a native Astra entry, the plugin preserves its metadata and retains Low, Medium, High, Xhigh, and Max reasoning choices without modifying the installed catalog. Users do not need to upgrade pi-ai separately to select Astra. The exact verified pairs and acceptance limits are recorded in the release notes; dependency declarations alone do not establish verification. Neither catalog source proves account access.
 
 - Adding an account leaves the current account usable while authorization is pending.
 - Cancelling or timing out a new authorization preserves every existing account and closes accepted callback connections, including incomplete HTTP requests. After cancellation, the browser reads account labels and quota together before updating the view. Pending authorization expires after 10 minutes by default; `oauthTimeoutMs` accepts 1,000–1,800,000 milliseconds and is applied when the plugin loads.
@@ -43,6 +43,7 @@ Fresh installations register the model provider and leave every additional capab
   config:
     enableProxy: false
     enableSearch: false
+    enableReserveFallback: false
     enableImageTool: false
     enableImageGeneration: false
     enableAutoReview: false
@@ -56,6 +57,26 @@ Disabling the proxy or unloading the plugin gives active proxy operations one se
 
 Direct connection is the default. An enabled credential-free HTTP(S) proxy applies only to this plugin's model, OAuth, refresh, quota, search, image, and Auto-review traffic. Detection checks standard proxy environment variables and documented loopback candidates without making a model call, consuming quota, or saving settings. A failed proxy request never silently retries through a direct connection. Loading Codex Connect does not replace Node's environment-proxy dispatcher, so unrelated Harness requests continue using the process's existing proxy policy.
 
+### Luna Reserve fallback
+
+Published Alpha 4.35 includes this default-off experiment; Alpha 4.34 does not include it. Real-account Reserve entry and recovery remain unverified. See the [publication and installation evidence](../.github/ALPHA_435_RELEASE_READINESS.md).
+
+`enableReserveFallback: true` opts agent requests into backend-authorized Luna Reserve fallback. The account UI and routing share an in-memory account/user-bound quota snapshot; concurrent reads coalesce and fresh reads do not issue another quota `GET`. A cold or stale read waits for refresh. After a successful fetch, background refresh runs at 60/30/15/5 seconds for usage below 75%, at least 75%, at least 90%, and at least 99%, using the highest consumption across ordinary and relevant model windows. Future reset times shorten the next refresh to reset plus one second; they never establish recovery. Cache reads do not postpone that deadline. Failed fetches discard cached decisions and retry after five seconds. Account mutations, settings changes, and plugin disposal invalidate the state; UI receives only the public quota projection.
+
+A valid shared decision issues a private one-shot permit for the next `gpt-reserve` dispatch in that session/account. This local dispatch guard is not a server-side per-call authorization requirement. Cancellation, replacement, an agent error, turn stopping, quota invalidation, snapshot refresh, or cache eviction revokes an unused permit. Return-target I/O rechecks that authority before restoring an ordinary model. Direct and auxiliary Reserve calls fail before a model request. With fallback disabled, ordinary agent steps do not query quota, account UI reads remain passive, and there is no background quota poller. An already-Reserve session requires an explicitly selected ordinary model.
+
+The access token must contain non-empty `chatgpt_account_id` and `chatgpt_user_id` (or `user_id`) claims under `https://api.openai.com/auth`, and `chatgpt_account_is_fedramp` must be absent or `false`. Missing, partial, FedRAMP, changed, or response-mismatched identity disables fallback for that step. The plugin does not guess identity from an email address or subscription plan.
+
+The plugin routes to the hidden model only when the quota response matches both the captured account and user and supplies a valid Luna Reserve authorization banner for the applicable model. A generic HTTP `429`, a rounded quota percentage, a reset time, or a Reserve model name is not authorization and is never retried as Reserve. This version accepts only the known `gpt-5.6-luna` Reserve metadata; other metadata is not inferred. The server decides eligibility and whether `5h`, weekly, or another backend limit causes Reserve authorization.
+
+Before entering Reserve, the plugin atomically saves the session's ordinary model request controls in a private `codex-connect-reserve/<SHA-256 of session id>.json` file beside the Codex credential file. The record contains a hash of the account/user pair and the ordinary model, reasoning effort, temperature, output limit, and stop sequences; it does not contain a bearer token or raw account and user ids. The Reserve request omits those ordinary controls and uses Luna's own defaults. A later identity-matched quota response must explicitly allow ordinary usage before the complete saved request configuration is restored. A missing, corrupt, oversized, wrong-account, or fork-without-its-own return record is never guessed or inherited: select an ordinary model explicitly to continue.
+
+Reserve is not exposed in model discovery and does not modify profile-wide defaults. Its allowance is separate from ordinary usage, not unlimited. When both are explicitly exhausted, routing stops with a usage-exhausted message. If a model request reports Harness's typed account-quota failure, the plugin invalidates cached state and allows at most one fresh, authorized entry or recovery retry per turn. Generic rate-limit failures never trigger this path.
+
+Reserve uses Luna's 272,000-token catalog context window, not the previous model's larger window. This release does not authorize automatic or manual compaction calls through Reserve. Switching a long conversation can therefore exceed Luna's context limit; compact before ordinary usage runs out or configure a separate, available summarization model. The plugin does not claim a cross-host exact token preflight or automatic long-context recovery.
+
+Automated coverage uses synthetic tokens and quota responses. It verifies local routing and restoration rules without contacting a real account, and therefore does not establish live account eligibility, available quota, or current server policy.
+
 ### Search and image tools
 
 - `enableSearch: true` registers Codex as an available search provider and selects it for profile-wide searches. Disabling it unregisters the provider and restores the route that was active before Codex Search was enabled.
@@ -101,6 +122,7 @@ The main plugin options are:
 | `proxyUrl` | `http://127.0.0.1:7890` | Credential-free HTTP(S) proxy origin; inactive until enabled |
 | `contextWindowOverrides` | none | Per-model client context-budget overrides |
 | `enableSearch` | `false` | Register Codex search and select it when the setting is saved |
+| `enableReserveFallback` | `false` | Follow identity-matched, backend-authorized Luna Reserve transitions for agent requests |
 | `enableImageTool` | `false` | Register `view_image` |
 | `enableImageGeneration` | `false` | Register GPT Image generation |
 | `imageModelHint` | empty | Optional unverified image route hint; empty keeps the default request |

package/docs/reference.zh.md

@@ -10,7 +10,7 @@ OAuth 凭据保存在运行 DSH 的主机上，由该主机用于向 OpenAI 认
 
 在 Harness 的常规模型选择器中选择一个 `openai-codex` 模型。所有界面语言均保留模型的规范名称。**更多设置 → 模型** 控制发现列表中显示哪些模型；隐藏模型不会禁用按精确 ID 路由。
 
-Codex 目录来自已安装的 `@earendil-works/pi-ai` 包，不是实时查询账户可用模型的结果。DSH `0.1.2-rc.1` 使用 pi-ai `^0.84.2`，其中尚无 `gpt-6-astra`，因此由 Codex Connect 补充定义。Alpha 4.33 也已验证 DSH `0.1.5-alpha.1` 与 pi-ai `0.85.1` 的组合；混装的宿主包以及其他 DSH/pi-ai 组合仍属未验证。遇到原生 Astra 条目时，插件保留其元数据，并维持 Low、Medium、High、Xhigh 和 Max 推理选择，不修改已安装的目录。用户无需单独升级 pi-ai 即可选择 Astra。发布说明记录了准确的已验证组合和验收限制；依赖声明本身不代表已验证。两种来源的目录条目都不能证明账户具有调用权限。
+Codex 目录来自已安装的 `@earendil-works/pi-ai` 包，不是实时查询账户可用模型的结果。DSH `0.1.2-rc.1` 使用 pi-ai `^0.84.2`，其中尚无 `gpt-6-astra`，因此由 Codex Connect 补充定义。已发布的 Alpha 4.35 也已分别验证精确版本 DSH `0.1.5-alpha.1`、`0.1.5-rc.1`、`0.1.5-rc.2` 与 pi-ai `0.85.1` 的组合；混装的宿主包以及其他 DSH/pi-ai 组合仍属未验证。遇到原生 Astra 条目时，插件保留其元数据，并维持 Low、Medium、High、Xhigh 和 Max 推理选择，不修改已安装的目录。用户无需单独升级 pi-ai 即可选择 Astra。发布说明记录了准确的已验证组合和验收限制；依赖声明本身不代表已验证。两种来源的目录条目都不能证明账户具有调用权限。
 
 - 添加账户期间，当前账户仍可继续使用。
 - 取消新的授权或等待超时，不会删除任何已有账户，并会关闭已接受的回调连接，包括未完成的 HTTP 请求。取消后，浏览器会一起读取账户标签与额度，再更新显示。待处理授权默认 10 分钟后过期；`oauthTimeoutMs` 接受 1,000–1,800,000 毫秒，并在插件加载时应用。
@@ -43,6 +43,7 @@ GPT Codex 对话的 Composer 会显示 Fast Mode 与额度：
   config:
     enableProxy: false
     enableSearch: false
+    enableReserveFallback: false
     enableImageTool: false
     enableImageGeneration: false
     enableAutoReview: false
@@ -56,6 +57,26 @@ GPT Codex 对话的 Composer 会显示 Fast Mode 与额度：
 
 默认使用直连。启用后，不带凭据的 HTTP(S) proxy 只应用于本插件的模型、OAuth、刷新、额度、搜索、图片和自动审查流量。检测只检查标准代理环境变量和文档列出的 loopback 候选地址，不调用模型、不消耗额度，也不保存设置。代理请求失败时，绝不会静默改走直连。加载 Codex Connect 不会替换 Node 的环境代理 dispatcher，因此其他 Harness 请求会继续使用进程已有的代理策略。
 
+### Luna Reserve 回退
+
+已发布的 Alpha 4.35 包含这项默认关闭的实验功能；Alpha 4.34 不包含该功能。真实账户进入 Reserve 及恢复普通模型的过程仍未完成验证。详见[发布与安装验证记录](../.github/ALPHA_435_RELEASE_READINESS.md)。
+
+`enableReserveFallback: true` 为 agent 请求启用由后端授权的 Luna Reserve 回退。账户 UI 和路由共用绑定账户与用户的内存额度快照；并发读取合并，有效状态不再发起额度 `GET`。首次或过期读取等待刷新。查询成功后，根据普通额度和相关模型窗口中的最高消耗，低于 75%、达到 75%、达到 90%、达到 99% 时，分别每 60/30/15/5 秒后台刷新。未来重置时间可将下次刷新提前到重置后一秒，但不证明额度恢复。缓存读取不会推迟刷新期限。查询失败会清除缓存决策，五秒后重试。账户修改、设置变更和插件卸载会使状态失效；UI 只接收公开额度投影。
+
+有效的共享决策为该会话和账户的下一次 `gpt-reserve` 调用签发私有一次性许可。这是本地调用保护，不代表服务端要求每次调用单独认证额度。取消、替换请求、agent 出错、回合停止、额度状态失效、快照刷新或缓存淘汰都会撤销未使用的许可。恢复普通模型前，返回记录的读取也会重新检查该授权是否有效。直接和辅助 Reserve 调用会在发送前失败。关闭回退时，普通 agent 步骤不查询额度，账户 UI 保持被动读取，也不创建后台额度轮询；已处于 Reserve 的会话需要显式选择普通模型。
+
+Access token 的 `https://api.openai.com/auth` 中必须包含非空的 `chatgpt_account_id` 和 `chatgpt_user_id`（或 `user_id`），且 `chatgpt_account_is_fedramp` 必须缺省或为 `false`。身份缺失、不完整、属于 FedRAMP、发生变化或与额度响应不匹配时，该步骤不会启用回退。插件不会从邮箱地址或订阅套餐推测身份。
+
+只有额度响应同时匹配固定的账户与用户，并包含适用于当前模型的有效 Luna Reserve 授权 banner，插件才会路由到隐藏模型。普通 HTTP `429`、四舍五入后的额度百分比、重置时间或 Reserve 模型名称都不是授权，也不会触发 Reserve 重试。当前版本只接受已知的 `gpt-5.6-luna` Reserve 元数据，不推测其他模型。能否使用 Reserve，以及触发授权的是 `5h`、周额度还是其他后端限制，都由服务端决定。
+
+进入 Reserve 前，插件会将会话的普通模型请求参数原子保存到 Codex 凭据文件旁的私有 `codex-connect-reserve/<会话 id 的 SHA-256>.json` 文件中。记录包含账户与用户组合的哈希，以及普通模型、推理强度、温度、输出上限和停止序列，不包含 bearer token 或原始账户与用户 id。Reserve 请求不继承这些普通模型参数，而是使用 Luna 自身的默认值。后续身份匹配的额度响应必须明确允许普通额度，插件才会恢复完整的已保存请求配置。返回记录缺失、损坏、过大、属于其他账户，或 fork 没有自己的记录时，插件都不会猜测或继承目标；请显式选择普通模型后继续。
+
+Reserve 不出现在模型发现列表，也不修改整个 profile 的默认模型。它有独立于普通额度的限额，并非无限可用。两者明确耗尽时，路由停止并提示额度用尽。如果模型请求报告宿主明确分类的账户额度耗尽，插件使缓存失效，每回合至多按新授权进行一次进入或恢复重试；普通请求限流不触发此路径。
+
+Reserve 使用 Luna 目录中的 272,000 token 上下文窗口，不沿用原模型更大的窗口。当前版本不授权通过 Reserve 进行自动或手动上下文压缩。因此，长会话切换后可能超过 Luna 的上下文限制；请在普通额度耗尽前压缩，或配置另一个仍可用的摘要模型。插件不保证跨宿主的精确 token 预检或自动长上下文恢复。
+
+自动化覆盖使用合成 token 和额度响应，验证本地路由与恢复规则，不连接真实账户，因此不能证明实际账户资格、可用额度或当前服务端策略。
+
 ### 搜索与图片工具
 
 - `enableSearch: true` 将 Codex 注册为可用搜索提供方，并用于整个 profile 的搜索。关闭时会注销该提供方，并恢复启用 Codex 搜索之前的路由。
@@ -101,6 +122,7 @@ GPT Codex 对话的 Composer 会显示 Fast Mode 与额度：
 | `proxyUrl` | `http://127.0.0.1:7890` | 不带凭据的 HTTP(S) proxy origin；启用前不生效 |
 | `contextWindowOverrides` | 无 | 按模型设置客户端上下文预算 |
 | `enableSearch` | `false` | 注册 Codex 搜索，并在保存时将它选为搜索提供方 |
+| `enableReserveFallback` | `false` | 为 agent 请求执行身份匹配、后端授权的 Luna Reserve 切换 |
 | `enableImageTool` | `false` | 注册 `view_image` |
 | `enableImageGeneration` | `false` | 注册 GPT Image 图片生成 |
 | `imageModelHint` | 空字符串 | 可选的未验证图片路由提示；留空保持默认请求 |

package/lib/bin.d.ts

@@ -1,6 +1,5 @@
 //#region src/bin.d.ts
 /** Standalone credential CLI for the optional OpenAI Codex bundle. */
 /** Execute one boot-free credential command. */
-declare function run(argv: readonly string[]): Promise<number>;
-//#endregion
-export { run };
+export declare function run(argv: readonly string[]): Promise<number>;
+//#endregion

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as readInstalledPackageVersion, At as normalizeTrustedOrigin, Ft as loginOpenAICodex, Gt as openAICodexAuthPath, H as DSH_PLUGIN_API_PACKAGES, It as logoutOpenAICodex, Lt as openAICodexAuthStatus, N as CODEX_CONNECT_VERSION, Pt as openAICodexModelCatalog, Q as isSupportedDshPluginApiVersion, Rt as publicAuthError, Ut as OPENAI_CODEX_PROVIDER, Wt as OpenAICodexCredentialStore, Z as evaluateCompatibility, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, j as diagnoseOpenAICodex, kt as OpenAICodexTrustedOriginsStore, l as CODEX_AUTO_REVIEW_MODEL, u as probeCodexAutoReview, xt as normalizeOpenAICodexProxyUrl } from "./src-rxlwLWWN.js";
+import { A as DSH_PLUGIN_API_PACKAGES, B as isSupportedDshPluginApiVersion, Ft as loginOpenAICodex, Gt as openAICodexAuthPath, It as logoutOpenAICodex, Lt as openAICodexAuthStatus, Pt as openAICodexModelCatalog, Rt as publicAuthError, Ut as OPENAI_CODEX_PROVIDER, V as readInstalledPackageVersion, Wt as OpenAICodexCredentialStore, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, jt as normalizeOpenAICodexProxyUrl, l as CODEX_AUTO_REVIEW_MODEL, nt as OpenAICodexTrustedOriginsStore, rt as normalizeTrustedOrigin, u as probeCodexAutoReview, x as CODEX_CONNECT_VERSION, y as diagnoseOpenAICodex, z as evaluateCompatibility } from "./src-HfJnOVCK.js";
 import { i as fetch, r as ProxyAgent, t as Agent } from "./undici-runtime-H2uktiw6.js";
 import { createHash } from "node:crypto";
 import { realpathSync } from "node:fs";