dsh-github-copilot 0.4.0-alpha.29 → 0.4.0-alpha.31

package/AGENTS.md

@@ -131,6 +131,7 @@ These pins document compatibility evidence. They do not authorize creating anoth
 
 - Models UI: `0.1.2-rc.1`, `0.1.3-alpha.1`, `0.1.5-alpha.1`, `0.1.5-alpha.2`, `0.1.5-rc.1`, `0.1.5-rc.2`, `0.1.6-alpha.1` and `0.1.6-alpha.2` expose `settings.models.provider-card`, keyed by settings namespace `llm-pi-ai`, to embed login/status/Refresh/Manage in a mounted configured canonical `github-copilot` row and suppress the separate footer controller. With no such row mounted, retain footer fallback; rc.2 uses a dedicated `settings.section`. Preserve the shared account-state owner across transfer only while another eligible surface remains mounted. Unmounting the last surface or replacing declarations without overlapping mounts stops polling; a later controller reads status and separately non-forcing ensures missing/idle/stale/error/loading signed-in metadata, without replaying the old forced-login action. Manual Refresh models lives inside Manage; errors expose Retry. Opening Models is no longer guaranteed network-free, but status/details themselves remain pure. This additive slot cannot replace Core Edit/Delete: retain the native editor, while normal plugin discovery needs no manual model definitions. UI integration must not merge/remove actual canonical and `github-copilot-preview` routes or rewrite credentials, configuration, history or selection.
 - Authorization flow key: `llm-pi-ai/github-copilot`.
+- Authorization verification links recognize the public `window.dshDesktop.protocolVersion === 1` marker and use `_self` so Desktop's existing `will-navigate` handler opens the system browser without popup creation. Other hosts retain `_blank`; display a selectable manual URL in both cases. This does not confirm browser launch or OAuth success. Manage omits the compatibility disclosure but retains actionable legacy diagnostics and explicit repair; migration documentation and backend ownership are unchanged.
 - Authorization service: rc.1 Core provides it; the rc.2 web/headless profiles rely on this package's runtime dependency and conditional bootstrap.
 - Credentials: use record description/read/modify/delete APIs on the Host. Never read records in the browser.
 - Copilot grant schema: `type: oauth`, non-empty `refresh`/`access`, finite `expires`, optional non-empty `enterpriseUrl`, and optional deduplicated non-empty-string `availableModelIds`.

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.4.0-alpha.31 (prepared)
+
+- Retire the exact current managed-route token proof after an observed model HTTP 401, preserving the native failure without replay, logout or model switching (#152).
+- Let the next independent caller renew a rejected token through native `Models.getAuth()` and the serialized canonical credential store, even if its stored expiry is still in the future. Never persist a projected expiration or replace a newer sign-in.
+- Bound recovery per account using the existing cooldown setting (five minutes by default, one-second floor); reject identical-token renewal and ignore late generations, 403, cancellation and error strings without an observed HTTP response.
+- Cover sign-out/sign-in with retained conversation history, native HTTP transports, concurrent renewal, credential races and cooldown. Synthetic evidence does not prove the original endpoint rejection cause, live OAuth/model acceptance, WebSocket recovery, publication or Desktop activation.
+
+## 0.4.0-alpha.30 (prepared)
+
+- Route verification links on recognized Desktop v1 hosts through the existing same-window external-navigation handoff instead of popup creation; retain new tabs on web hosts (#150).
+- Display a selectable verification address for manual browser handoff without claiming that the system browser opened or authorization succeeded.
+- Remove the Compatibility and existing configurations disclosure from Manage. Preserve legacy configuration diagnostics, explicit repair, migration documentation, credentials and session behavior.
+- Cover Desktop/web targets, manual URL handoff and expanded Manage across account states. Synthetic Client evidence does not establish live Desktop activation or OAuth success.
+
 ## 0.4.0-alpha.29 (prepared)
 
 - Fix search settings drafts and pending saves being reset by parent renders: capture stable traced Settings/routing Remote faces once per registration (#148).

package/README.md

@@ -61,7 +61,7 @@ Source markers, local rc.1-backed focused tests and fifteen scoped exact-source
 
 ## Install and sign in
 
-The commands below target the package version `0.4.0-alpha.29`. Versioned URLs describe the intended release artifacts, not proof that publication or local activation has completed; use them only once that Release and its checksums are available. Install into the profile you use (replace `web` when targeting another profile):
+The commands below target the package version `0.4.0-alpha.31`. Versioned URLs describe the intended release artifacts, not proof that publication or local activation has completed; use them only once that Release and its checksums are available. Install into the profile you use (replace `web` when targeting another profile):
 
 Before installing/updating, unpack the **checksum-verified** archive into a temporary directory and run its read-only composition preflight (replace all paths with absolute paths for the intended profile):
 
@@ -74,7 +74,7 @@ Include any launcher patch files with repeated `--patch /absolute/file` argument
 For approved online installation, the supported CLI command is:
 
 ```sh
-dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.29/dsh-github-copilot-0.4.0-alpha.29.tgz
+dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.31/dsh-github-copilot-0.4.0-alpha.31.tgz
 ```
 
 If registry access is blocked or unavailable, do not retry it through another network. Desktop-managed profiles may instead use the [controlled offline CLI procedure](./docs/npm-distribution.md#controlled-offline-cli-maintenance), with an approved, checksum-verified local Release and existing dependency cache (`--offline --ignore-scripts`). All preflight and approval requirements still apply.
@@ -84,10 +84,10 @@ Then open the Models UI listed above, find **GitHub Copilot**, select **Sign in*
 ### User authorization flow
 
 1. Open **Settings → Models** and find **GitHub Copilot**. Account controls appear in an existing configured canonical `github-copilot` card, suppressing the separate footer controller; otherwise the footer fallback (or old-Core **Settings → GitHub Copilot**) remains usable. An already-signed-in account automatically ensures missing/idle/stale/error/loading metadata once on opening; fresh ready metadata makes no discovery request. No native provider or manual refresh is needed for the normal discovery flow.
-2. Select **Sign in with GitHub**. The authorization area expands automatically with a prominent one-time code, **Open GitHub verification page**, **Copy code**, and **Cancel sign-in**. No extra **Manage** click is needed.
+2. Select **Sign in with GitHub**. The authorization area expands automatically with a prominent one-time code, **Open GitHub verification page**, **Copy code**, and **Cancel sign-in**. No extra **Manage** click is needed. Recognized Desktop v1 hosts use their existing same-window external-navigation handoff to the system browser instead of a popup; web hosts retain a new tab. If nothing opens, select and copy the displayed verification address into your browser. The plugin cannot confirm that the system browser opened.
 3. Copy the code, open the verification link, and complete authorization in your own GitHub browser session. Copy success/failure is announced accessibly; manual copying remains available. Never paste a GitHub token into DSH.
 4. DSH polls only while authorization is in flight. Successful explicit **Start sign-in** (the **Sign in with GitHub** button), including a UI account switch, forces exactly one bounded discovery after immediate or polled success. The code and verification link clear, the automatic authorization area closes, and the account shows **Signed in** and **Manage**. Manually opened details stay open; cancellation clears the old code and errors remain visible.
-5. Choose an accepted model under **GitHub Copilot** (stable route ID `github-copilot-preview`). Normal opening/use maintains metadata without requiring **Refresh models**. **Manage** contains the optional manual refresh, model details, sign-out and compatibility guidance. Errors remain visible with **Retry**, including when details are collapsed; neither discovery nor retry changes your current/default model or replays messages.
+5. Choose an accepted model under **GitHub Copilot** (stable route ID `github-copilot-preview`). Normal opening/use maintains metadata without requiring **Refresh models**. **Manage** contains the optional manual refresh, model details and sign-out. The compatibility disclosure is removed; legacy configuration diagnostics and explicit repair remain available when needed, and the [migration guide](./docs/single-route-migration.md) remains in the documentation. Errors remain visible with **Retry**, including when details are collapsed; neither discovery nor retry changes your current/default model or replays messages.
 
 One shared account-state owner survives transfer while another eligible surface remains mounted. Last-surface unmount or nonoverlapping declaration replacement stops polling; a later mount reads status and separately ensures metadata if needed. Status reads and details toggles themselves remain network-free, but opening Models can discover missing/stale signed-in metadata. Background credential/reset notifications clear Client state and read status rather than forcing discovery on every token event; the next open/use ensures metadata.
 
@@ -139,7 +139,7 @@ Agents should treat the browser authorization as a human handoff, not as a token
 5. Confirm **Signed in** and inspect the automatic discovery result before asking the user to choose a model. Already-signed-in Models opening ensures missing/stale metadata automatically; fresh ready cache makes no request. Use visible **Retry** for errors or **Manage → Refresh models** for an intentional forced update, not routine setup. Status alone does not discover, and login, metadata and successful model calls remain separate evidence.
 6. Use **Sign out** only when the user explicitly asks to disconnect the account. It deletes the Copilot credential record but preserves route settings.
 
-GitHub Releases and npm are the default distribution channels for each new version, using the same verified tarball. Pin the version and verify the evidence for the channel used: Release `SHA256SUMS`, and npm `dist.integrity` when installing from npm. The native Desktop package manager is preferred when permitted registry access is available; after npm publication is verified it accepts `dsh-github-copilot@0.4.0-alpha.29`, not a URL or file. Desktop-managed profiles also support explicitly approved [controlled offline CLI maintenance](./docs/npm-distribution.md#controlled-offline-cli-maintenance) with a verified local Release and `--offline --ignore-scripts`. Follow the mandatory search-composition preflight, backup, single-writer and post-install checks; do not bypass a corporate registry ban, disable TLS verification or restart without separate approval. Offline installation is not proof that npm networking/publication was repaired. See [distribution and publication requirements](./docs/npm-distribution.md).
+GitHub Releases and npm are the default distribution channels for each new version, using the same verified tarball. Pin the version and verify the evidence for the channel used: Release `SHA256SUMS`, and npm `dist.integrity` when installing from npm. The native Desktop package manager is preferred when permitted registry access is available; after npm publication is verified it accepts `dsh-github-copilot@0.4.0-alpha.31`, not a URL or file. Desktop-managed profiles also support explicitly approved [controlled offline CLI maintenance](./docs/npm-distribution.md#controlled-offline-cli-maintenance) with a verified local Release and `--offline --ignore-scripts`. Follow the mandatory search-composition preflight, backup, single-writer and post-install checks; do not bypass a corporate registry ban, disable TLS verification or restart without separate approval. Offline installation is not proof that npm networking/publication was repaired. See [distribution and publication requirements](./docs/npm-distribution.md).
 
 No `copilot2api` process, external gateway, placeholder API key, pasted GitHub token, or separate `dsh-web-search-provider` installation is required.
 
@@ -158,7 +158,7 @@ DSH Core continues to own model selection, sandboxing, tools, attachments, and o
 
 Under **Settings → Models → Model roles**, enable dedicated dual-model sessions, select two available account models, and save the profile-global settings. No workspace is needed to save. **Create session with this configuration** uses the application's current workspace, shown read-only; open a workspace first if none is current. There is no separate workspace dropdown and no first/recent-workspace fallback. The planner handles planning and acceptance; `copilot_execute` delegates implementation to a native continuable child with a fixed execution model. Configuration is off by default and affects only sessions created through this entry. It does not change the global default, existing sessions, credentials or the ordinary Subagent model-selection setting.
 
-Unavailable models are not substituted. Uncertain creation retries keep the same request identity. The feature requires public role/session/subagent capabilities and is visibly unavailable when they are absent; historical package compatibility is not blanket certification of this optional flow. See [setup, lifecycle, limitations and evidence](./docs/dual-model.md). The feature is included in the `0.4.0-alpha.29` candidate; source and fixture tests are not proof of publication or Desktop activation.
+Unavailable models are not substituted. Uncertain creation retries keep the same request identity. The feature requires public role/session/subagent capabilities and is visibly unavailable when they are absent; historical package compatibility is not blanket certification of this optional flow. See [setup, lifecycle, limitations and evidence](./docs/dual-model.md). The feature is included in the `0.4.0-alpha.31` candidate; source and fixture tests are not proof of publication or Desktop activation.
 
 If the card says **Could not load model roles**, do not change model defaults to work around it: this is a failed settings load, distinct from unsupported capabilities or unavailable models. In particular, a `githubCopilotDualModel/view` HTTP 404 indicates missing Host Remote exposure, not that the feature is off. See [troubleshooting and verification](./docs/dual-model.md#loading-and-remote-troubleshooting).
 
@@ -333,6 +333,7 @@ Existing installations must follow the [single-route migration guide](./docs/sin
 - **No sign-in control:** confirm the package is loaded in the active profile and use the baseline-specific UI above. Do not add a native provider just to reveal login.
 - **Two Copilot groups after upgrade:** a legacy canonical profile is still configured; it is preserved deliberately. After explicit migration/removal, both composer and `/model` list only the managed group. There is no display-only alias masking a second route.
 - **Signed in but a new model is missing:** opening Models ensures missing/stale metadata automatically; inspect accepted/rejected models for `github-copilot-preview`. Use **Retry** after errors or **Manage → Refresh models** to intentionally refresh before the TTL expires. Unsupported endpoints or incomplete metadata produce diagnostics, not static-catalog fallback. Do not repeat login or disable validation.
+- **`AUTH` / “API key is invalid” after signing in again:** this label does not prove the conversation cached an old key. On the managed route, an observed model HTTP 401 retires only the exact current token proof. The failed request stays failed: no automatic message replay, logout or model switch. Your next request (or model discovery) can perform one native OAuth renewal even before stored expiry, then validate account metadata. Repeated rejection is bounded per account by `accountModelFailureCooldownMs` (five minutes by default, at least one second); even forced discovery cannot bypass this recovery cooldown. If the renewed token is still rejected, wait for the cooldown and inspect account/permission status rather than repeatedly signing out. A new sign-in is not overwritten by a late old response. HTTP 403, network errors and strings mentioning 401 do not trigger this recovery. It observes native HTTP transport only; WebSocket recovery and live endpoint acceptance are not claimed.
 - **Canonical route says `not-configured`:** with configured login this is normal managed-only mode; inspect account discovery separately rather than creating a native profile.
 - **Delete dialog stays on “Deleting…”:** this update does not prove that hang fixed. Do not repeatedly delete; after an authorized Host stop, inspect persisted settings and follow the migration guide before deciding whether any removal is still needed.
 - **No Think text:** the provider may omit public summaries, but nonempty summaries must survive the Responses parser. Check selected effort and named errors. Empty disclosures are hidden only after completion; encrypted replay is never displayed. Reasoning/replay-bearing histories use native Core transport.
@@ -399,8 +400,8 @@ Report the published Release URL, version, tag/commit and verified asset SHA-256
 `package.json` declares public npm distribution. A release tag must equal `v${package.json.version}`. Versions use standard SemVer prerelease labels (`alpha`, `beta`, or `rc`), each with its matching npm dist-tag; only stable versions use `latest`. The Release workflow performs the frozen install and complete verification gate, packs once (or recovers the original archive on retry), verifies `SHA256SUMS`, publishes the immutable GitHub Release and then publishes those same bytes to npm through OIDC. Either channel failing means delivery is incomplete. First package creation needs an authorized maintainer; staging requires an existing package and is not a first-package bootstrap. Historical releases are not republished.
 
 ```sh
-curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.29/dsh-github-copilot-0.4.0-alpha.29.tgz
-curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.29/SHA256SUMS
+curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.31/dsh-github-copilot-0.4.0-alpha.31.tgz
+curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.31/SHA256SUMS
 sha256sum --check SHA256SUMS
 ```
 
@@ -408,7 +409,7 @@ PowerShell can verify the same two downloaded files with:
 
 ```powershell
 $expected = (Get-Content .\SHA256SUMS).Split()[0]
-$actual = (Get-FileHash .\dsh-github-copilot-0.4.0-alpha.29.tgz -Algorithm SHA256).Hash.ToLowerInvariant()
+$actual = (Get-FileHash .\dsh-github-copilot-0.4.0-alpha.31.tgz -Algorithm SHA256).Hash.ToLowerInvariant()
 if ($actual -cne $expected) { throw 'Release checksum mismatch' }
 ```
 

package/README.zh.md

@@ -9,7 +9,7 @@
 
 一个聚焦 GitHub Copilot 登录、通用账号模型发现、Copilot 专用 Tool 兼容与供应方托管搜索的 DSH companion。插件根据供应方返回的端点和能力元数据组装模型，复用公开的 `@deepseek-ai/dsh-llm-pi-ai` adapter 与 pi-ai SDK，不另写一套通用传输／序列化器，也不维护需要逐个添加新模型 ID 的静态目录。
 
-> 下文自动维护账号模型元数据与 provider 集成控件描述目标版本 `0.4.0-alpha.29`；这不代表已有的两条真实路由被合并或移除。版本化 URL 不表示 Release 已发布或本机已加载；仅在该 Release 与校验和可用后使用安装命令。源码、发布制品、已安装版本和实际加载运行时需分别确认，本地升级和中断会话的重启仍需用户批准。
+> 下文自动维护账号模型元数据与 provider 集成控件描述目标版本 `0.4.0-alpha.31`；这不代表已有的两条真实路由被合并或移除。版本化 URL 不表示 Release 已发布或本机已加载；仅在该 Release 与校验和可用后使用安装命令。源码、发布制品、已安装版本和实际加载运行时需分别确认，本地升级和中断会话的重启仍需用户批准。
 
 Alpha.24 修复 Web search 卡片缺少精确 Remote 依赖声明的问题。卡片仍位于 **Settings → Models**（`settings.models.footer`，list/root），旧 Core 回退到独立 Web search section，而非 General。搜索子 Fiber 独立等待 routing namespace，不影响账号控件和既有搜索安全检查；实际打包 Desktop 验收仍是独立关卡。
 
@@ -76,7 +76,7 @@ node package/scripts/check-search-composition.mjs --profile-dir /absolute/profil
 获准且网络可用时，可通过受支持的 CLI 命令安装：
 
 ```sh
-dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.29/dsh-github-copilot-0.4.0-alpha.29.tgz
+dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.31/dsh-github-copilot-0.4.0-alpha.31.tgz
 ```
 
 若 registry 被公司封禁或不可用，不要更换网络绕行。Desktop 管理的 profile 可以改用[受控离线 CLI 流程](./docs/npm-distribution.md#controlled-offline-cli-maintenance)：使用来源获准、校验通过的本地 Release 和已有依赖缓存（`--offline --ignore-scripts`）。预检、备份和授权要求仍然适用。
@@ -86,10 +86,10 @@ dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/release
 ### 用户授权流程
 
 1. 打开 **设置 → 模型**，找到 **GitHub Copilot**。账号控件嵌入已有配置的 canonical `github-copilot` 卡片，不另显示页脚控制器；没有此类卡片时仍可用页脚 fallback（旧 Core 使用 **Settings → GitHub Copilot**）。已登录时，页面打开会自动确保缺失／idle／过期／error／loading的模型元数据就绪；新鲜 ready 缓存不发发现请求。正常流程无需添加原生 provider 或手动刷新。
-2. 点击 **Sign in with GitHub** 后，验证码区域自动展开，提供醒目的一次性验证码、**Open GitHub verification page**、**Copy code** 和 **Cancel sign-in**。不需要再点一次 **Manage**。
+2. 点击 **Sign in with GitHub** 后，验证码区域自动展开，提供醒目的一次性验证码、**Open GitHub verification page**、**Copy code** 和 **Cancel sign-in**。不需要再点一次 **Manage**。识别到 Desktop v1 宿主时，通过现有的同窗口外部导航处理交给系统浏览器，不依赖弹出窗口；网页版仍打开新标签页。如果没有打开，可选中并复制界面显示的验证网址到浏览器。插件无法确认系统浏览器是否已打开。
 3. 复制验证码，打开验证链接，在自己的 GitHub 浏览器会话中完成授权。复制成功／失败均有可访问的反馈；手工复制仍可用。不要把 GitHub token 粘贴到 DSH。
 4. DSH 只在授权进行中轮询。显式 **Start sign-in**（**Sign in with GitHub** 按钮，包括界面切换账号）成功后，无论立即返回还是轮询观察到成功，都只强制执行一次有界发现。验证码和验证链接清除，自动授权区域收起，账号显示 **Signed in、Manage**。手动打开的详情保持展开；取消清除旧验证码，错误仍明确显示。
-5. 在 **GitHub Copilot** 分组选择接受的模型（稳定路由 ID 为 `github-copilot-preview`）。正常打开／使用会自动维护元数据，无需手动 **Refresh models**。**Manage** 内保留可选的手动刷新、模型明细、退出登录与兼容说明。错误即使在详情折叠时也会显示并提供 **Retry**；发现或重试均不切换当前／默认模型，也不重放消息。
+5. 在 **GitHub Copilot** 分组选择接受的模型（稳定路由 ID 为 `github-copilot-preview`）。正常打开／使用会自动维护元数据，无需手动 **Refresh models**。**Manage** 内保留可选的手动刷新、模型明细与退出登录，移除兼容说明折叠区；需要时仍显示旧配置诊断和显式修复操作，[迁移指南](./docs/single-route-migration.md)继续保留在文档中。错误即使在详情折叠时也会显示并提供 **Retry**；发现或重试均不切换当前／默认模型，也不重放消息。
 
 只有另一个符合条件的表面仍挂载时，切换才保留共享账号状态 owner。最后一个表面卸载或声明替换没有挂载重叠时停止轮询；以后挂载会先读状态，再按需另行确保元数据。状态读取和详情切换本身仍不访问网络，但打开 Models 可以发现缺失／过期的已登录账号元数据。后台凭据／reset 通知清除 Client 状态并只读查询，不在每次 token 事件强制发现；下次打开／使用时再确保元数据。
 
@@ -141,7 +141,7 @@ Agent 应把浏览器授权视为需要用户完成的 handoff，而不是自行
 5. 确认 **Signed in** 并检查自动发现结果，再请用户选择模型。已登录时打开 Models 会自动确保缺失／过期元数据，新鲜 ready 缓存不发请求。错误可使用 **Retry**，有意强制更新时使用 **Manage → Refresh models**，不作为常规设置步骤。状态读取本身不发现；登录、元数据与真实调用成功是独立证据。
 6. 只有用户明确要求断开账号时才使用 **Sign out**；它会删除 Copilot credential record，但保留 route settings。
 
-每个新版本默认同时分发到 GitHub Releases 和 npm，两个渠道使用同一份已验证 tarball。应固定版本并核对所用渠道的证据：Release 的 `SHA256SUMS`；从 npm 安装时另核对 `dist.integrity`。在获准且可用的 registry 网络环境中，优先使用原生 Desktop 包管理器；确认 npm 发布后，它接受 `dsh-github-copilot@0.4.0-alpha.29`，不是 URL 或本地文件。Desktop 管理的 profile 也允许经明确授权的[受控离线 CLI 维护](./docs/npm-distribution.md#controlled-offline-cli-maintenance)：使用已验证的本地 Release 和 `--offline --ignore-scripts`，执行必需的组合预检、私密元数据备份、单写入者控制及安装后差异核验。缓存不足或出现权限拒绝时停止，不绕过公司 registry 封禁，不关闭 TLS 校验；重启仍需单独授权。离线安装成功不表示 npm 联网或发布问题已修好。[双渠道发布与 OIDC 要求](./docs/npm-distribution.md)保持不变。
+每个新版本默认同时分发到 GitHub Releases 和 npm，两个渠道使用同一份已验证 tarball。应固定版本并核对所用渠道的证据：Release 的 `SHA256SUMS`；从 npm 安装时另核对 `dist.integrity`。在获准且可用的 registry 网络环境中，优先使用原生 Desktop 包管理器；确认 npm 发布后，它接受 `dsh-github-copilot@0.4.0-alpha.31`，不是 URL 或本地文件。Desktop 管理的 profile 也允许经明确授权的[受控离线 CLI 维护](./docs/npm-distribution.md#controlled-offline-cli-maintenance)：使用已验证的本地 Release 和 `--offline --ignore-scripts`，执行必需的组合预检、私密元数据备份、单写入者控制及安装后差异核验。缓存不足或出现权限拒绝时停止，不绕过公司 registry 封禁，不关闭 TLS 校验；重启仍需单独授权。离线安装成功不表示 npm 联网或发布问题已修好。[双渠道发布与 OIDC 要求](./docs/npm-distribution.md)保持不变。
 
 不需要运行 `copilot2api`，不需要外部 gateway、placeholder API key、原始 GitHub token 或单独安装 `dsh-web-search-provider`。
 
@@ -162,7 +162,7 @@ DSH Core 继续负责模型选择、sandbox、工具、附件与其它 provider
 
 在 **设置 → 模型 → 模型分工** 中启用双模型会话，选择账号下可用的主模型和执行模型，保存全局设置（同一配置档案内通用，不按工作区保存）。保存不需要工作区；**用此配置新建会话** 使用应用当前工作区，并只读显示目标。没有当前工作区时须先打开工作区，不再提供独立下拉框，也不会默认选择第一个或最近的工作区。主模型负责规划与验收；`copilot_execute` 创建原生可继续执行的子代理，并固定其执行模型。默认关闭，仅专用入口创建的新会话采用此策略；不修改全局默认、已有会话、登录凭据或原生 Subagent 授权开关。
 
-模型不可用时明确报错，不自动替换。创建结果不明时重试同一个请求，不为绕过未知结果另建会话。功能依赖公开的会话、策略和子代理能力；缺少接口时显示不可用，不把历史版本的包兼容范围当成此功能的全面验收。详见[配置、生命周期、限制与验证范围](./docs/dual-model.md)。本功能包含在 `0.4.0-alpha.29` candidate 中，源码和合成测试不代表已发布或当前 Desktop 已生效。
+模型不可用时明确报错，不自动替换。创建结果不明时重试同一个请求，不为绕过未知结果另建会话。功能依赖公开的会话、策略和子代理能力；缺少接口时显示不可用，不把历史版本的包兼容范围当成此功能的全面验收。详见[配置、生命周期、限制与验证范围](./docs/dual-model.md)。本功能包含在 `0.4.0-alpha.31` candidate 中，源码和合成测试不代表已发布或当前 Desktop 已生效。
 
 若卡片显示 **Could not load model roles（无法加载模型分工）**，不要通过修改默认模型绕过：这是设置加载失败，与能力不支持或模型不可用不同。尤其 `githubCopilotDualModel/view` 返回 HTTP 404，表示 Host Remote 未暴露，并非功能开关处于关闭状态。详见[加载故障排查与验证](./docs/dual-model.md#loading-and-remote-troubleshooting)。
 
@@ -344,6 +344,7 @@ Copilot Session 如需更宽的文件或命令权限，必须在调用前选择
 - **看不到登录控件：**确认新版 package 实际加载在活动 profile，并使用上表对应的 UI；不要为了显示登录卡片而添加原生 provider。
 - **升级后仍有两个 Copilot 分组：**已有 canonical profile 被有意保留。显式迁移并真正移除后，composer 与 `/model` 才都会只列出托管分组；不是靠显示别名隐藏第二条路由。
 - **已登录但新模型缺失：**打开 Models 会自动确保缺失／过期元数据，查看 `github-copilot-preview` 的接受／拒绝结果。错误可点 **Retry**；希望在 TTL 到期前有意强制更新时，使用 **Manage → Refresh models**。接口不支持或元数据不完整时显示诊断，不退回静态目录，也不要反复登录或关闭校验。
+- **重新登录后出现 `AUTH`／“API key is invalid”：**这个标签并不证明旧会话缓存了旧 Key。托管路由实际收到模型 HTTP 401 后，只撤销与当前请求精确匹配的 Token 证明；该次请求仍然失败，不自动重发消息、退出登录或切换模型。下一次请求（或模型发现）可通过原生 OAuth 进行一次续期，即使记录的有效期尚未到期，随后重新校验账号模型元数据。连续拒绝受账号级 `accountModelFailureCooldownMs` 限制（默认五分钟，至少一秒），强制发现也不能绕过该恢复冷却。续期后仍被拒绝时，请等待冷却并检查账号／权限状态，不要反复退出登录。迟到的旧响应不能覆盖新登录；403、网络错误和仅含 401 字样的错误不触发恢复。这里只观察原生 HTTP 传输，不声称覆盖 WebSocket，也不代表真实端点验收通过。
 - **Canonical 状态为 `not-configured`：**已登录时属于正常单托管路由模式；账号发现就绪与否另行检查，不需要创建原生 profile。
 - **删除对话框一直显示 “Deleting…”：**本次改动不证明该卡住问题已修复。不要重复删除；取得许可停止 Host 后检查持久化设置，按迁移指南判断是否仍需移除。
 - **没有 Think 文字：**供应方可能不返回公开摘要，但非空摘要应被完整保留。检查思考强度与命名错误。UI 只在完成后隐藏空条目，不显示加密回放；包含 reasoning／replay 的历史走 Core 原生 transport。
@@ -410,8 +411,8 @@ node scripts/agent.mjs attribution "DeepSeek Harness (DSH)"
 `package.json` 声明公开 npm 分发。Release tag 必须严格等于 `v${package.json.version}`。预发布使用 `alpha`、`beta` 或 `rc` 及对应 npm dist-tag，只有稳定版使用 `latest`。Release workflow 执行 frozen install 和完整门禁，只打包一次（重试恢复原始归档），验证 `SHA256SUMS`，发布不可变 GitHub Release，再通过 OIDC 将同一份字节发布到 npm。任一渠道失败都表示交付未完成。首次建包须由获准环境中的维护者完成；staging 要求包已存在，不能代替首次建包。不会批量补发历史版本。
 
 ```sh
-curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.29/dsh-github-copilot-0.4.0-alpha.29.tgz
-curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.29/SHA256SUMS
+curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.31/dsh-github-copilot-0.4.0-alpha.31.tgz
+curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.31/SHA256SUMS
 sha256sum --check SHA256SUMS
 ```
 
@@ -419,7 +420,7 @@ PowerShell 可以对已下载的同一组文件执行：
 
 ```powershell
 $expected = (Get-Content .\SHA256SUMS).Split()[0]
-$actual = (Get-FileHash .\dsh-github-copilot-0.4.0-alpha.29.tgz -Algorithm SHA256).Hash.ToLowerInvariant()
+$actual = (Get-FileHash .\dsh-github-copilot-0.4.0-alpha.31.tgz -Algorithm SHA256).Hash.ToLowerInvariant()
 if ($actual -cne $expected) { throw 'Release checksum mismatch' }
 ```
 

package/deployment-baseline.json

@@ -8,7 +8,7 @@
   },
   "package": {
     "name": "dsh-github-copilot",
-    "version": "0.4.0-alpha.29"
+    "version": "0.4.0-alpha.31"
   },
   "evidence": {
     "kind": "source-and-synthetic-test-inventory",
@@ -453,6 +453,26 @@
         {"file": "tests/preview-route.spec.ts", "name": "withdraws only its own route and refuses an already-prepared call after disposal"}
       ]
     },
+    {
+      "id": "managed-http-auth-rejection-recovery",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/preview-provider.ts", "marker": "response.status === 401"},
+        {"file": "src/preview-route.ts", "marker": "COPILOT_PREVIEW_AUTH_RECOVERY_COOLDOWN"},
+        {"file": "src/account-model-auth.ts", "marker": "renewRejectedCredential"},
+        {"file": "src/account-model-auth.ts", "marker": "COPILOT_ACCOUNT_TOKEN_REJECTED"}
+      ],
+      "tests": [
+        {"file": "tests/preview-route.spec.ts", "name": "uses fresh OAuth after sign-out and %s sign-in with the same conversation history"},
+        {"file": "tests/preview-route.spec.ts", "name": "handles actual HTTP %i without replay and renews only a rejected token on the next request"},
+        {"file": "tests/preview-route.spec.ts", "name": "shares rejected-token renewal across concurrent new callers without replaying failed wires"},
+        {"file": "tests/preview-route.spec.ts", "name": "bounds repeated 401 recovery after a %s native renewal"},
+        {"file": "tests/preview-route.spec.ts", "name": "ignores a late HTTP 401 after the current %s changes"},
+        {"file": "tests/preview-route.spec.ts", "name": "ignores an old HTTP 401 after source publication but before the owner adopts the new snapshot"},
+        {"file": "tests/account-model-auth.spec.ts", "name": "does not persist a projected expiration when rejected-token renewal fails"},
+        {"file": "tests/account-model-auth.spec.ts", "name": "does not expire or refresh a newer same-account token observed under the record lock"}
+      ]
+    },
     {
       "id": "account-discovery-native-oauth",
       "required": true,
@@ -559,11 +579,17 @@
         {"file": "src/client.ts", "marker": "settings.models.provider-card"},
         {"file": "src/client.ts", "marker": "copyAuthorizationCode"},
         {"file": "src/client.ts", "marker": "data-dsh-github-copilot-device-code"},
+        {"file": "src/client.ts", "marker": "verificationLinkTarget"},
+        {"file": "src/client.ts", "marker": "data-dsh-github-copilot-verification-url"},
         {"file": "src/authorization-controller.ts", "marker": "GitHubCopilotAuthorizationController"}
       ],
       "tests": [
         {"file": "tests/client.spec.ts", "name": "exposes a device code only while authorization is in flight"},
         {"file": "tests/client.spec.ts", "name": "renders the device code prominently with an explicit copy action"},
+        {"file": "tests/client.spec.ts", "name": "selects the supported desktop navigation handoff without opening during render: %j"},
+        {"file": "tests/client-bundle.spec.ts", "name": "renders the built verification handoff and clears expired URLs (desktop: %s)"},
+        {"file": "tests/compact-account.spec.ts", "name": "omits compatibility guidance even with Manage open: $phase"},
+        {"file": "tests/compact-account.spec.ts", "name": "retains explicit legacy repair without the removed compatibility disclosure"},
         {"file": "tests/client.spec.ts", "name": "announces successful and failed copy outcomes accessibly"},
         {"file": "tests/client.spec.ts", "name": "copies the exact one-time code through the supplied clipboard writer"},
         {"file": "tests/client.spec.ts", "name": "mounts its Remote contribution and registers the rc.1 provider-card seat"},

package/lib/client.js

@@ -5627,9 +5627,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				...contribution$1.descriptors
 			]
 		};
-		//#endregion
-		//#region lib/types/copilot-identity.js
-		const GITHUB_COPILOT_PROVIDER_ID = "github-copilot";
 		const GITHUB_COPILOT_PREVIEW_PROVIDER_ID = "github-copilot-preview";
 		//#endregion
 		//#region lib/types/reasoning-presentation.js
@@ -7108,6 +7105,13 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			if (writer === void 0) throw new Error("Clipboard access is unavailable");
 			await writer.writeText(code);
 		}
+		function verificationLinkTarget() {
+			if (typeof window !== "undefined" && "dshDesktop" in window) {
+				const desktop = window.dshDesktop;
+				if (typeof desktop === "object" && desktop !== null && "protocolVersion" in desktop && desktop.protocolVersion === 1) return "_self";
+			}
+			return "_blank";
+		}
 		/** Pure presentation for the in-flight GitHub device-code handoff. */
 		function GitHubCopilotAuthorizationNotice(props) {
 			const feedback = props.copyState === "copying" ? "Copying code…" : props.copyState === "copied" ? "Code copied to clipboard." : props.copyState === "failed" ? "Copy failed. Select the code and copy it manually." : "";
@@ -7116,9 +7120,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				style: noticePanelStyle
 			}, (0, react.createElement)("div", null, props.message), props.url === void 0 ? null : (0, react.createElement)("a", {
 				href: props.url,
-				target: "_blank",
+				target: verificationLinkTarget(),
 				rel: "noreferrer"
-			}, "Open GitHub verification page"), props.code === void 0 ? null : (0, react.createElement)("div", null, (0, react.createElement)("div", { style: {
+			}, "Open GitHub verification page"), props.url === void 0 ? null : (0, react.createElement)("div", null, "If the browser does not open, copy this address into your browser:", (0, react.createElement)("code", {
+				"data-dsh-github-copilot-verification-url": true,
+				style: {
+					display: "block",
+					userSelect: "all",
+					overflowWrap: "anywhere"
+				}
+			}, props.url)), props.code === void 0 ? null : (0, react.createElement)("div", null, (0, react.createElement)("div", { style: {
 				marginBottom: "0.4rem",
 				fontWeight: 600
 			} }, "Your one-time code"), (0, react.createElement)("div", { style: codeRowStyle }, (0, react.createElement)("code", {
@@ -7632,22 +7643,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			}, (0, react.createElement)("p", { style: {
 				margin: "0 0 10px",
 				fontSize: "13px"
-			} }, "Signing in here fetches your account models once. Opening this view refreshes missing or stale metadata when needed. No manual model definitions are needed. Refresh models updates account metadata; it does not verify a model call or change your selected model."), signedIn ? actionButton(refreshing ? "Refreshing models…" : "Refresh models", account.refreshModels, pendingAction, { "data-dsh-github-copilot-refresh-models": true }) : null, models === void 0 ? (0, react.createElement)("p", { style: { fontSize: "13px" } }, "Account model metadata is not available yet.") : (0, react.createElement)(GitHubCopilotAccountModelsSummary, { snapshot: models }), routeStatusMessage(view) === void 0 ? null : (0, react.createElement)("p", { role: "status" }, routeStatusMessage(view)), view?.route?.state === "needs-repair" && signedIn ? actionButton("Repair model configuration", account.reconcile, pendingAction) : null, signedIn ? actionButton(state.operation === "signOut" ? "Signing out…" : "Sign out", account.signOut, pendingAction || view?.writable === false) : null, view?.writable === false ? (0, react.createElement)("p", { style: { fontSize: "13px" } }, "Credentials are read-only in this profile.") : null, compatibilityDetails()) : null);
+			} }, "Signing in here fetches your account models once. Opening this view refreshes missing or stale metadata when needed. No manual model definitions are needed. Refresh models updates account metadata; it does not verify a model call or change your selected model."), signedIn ? actionButton(refreshing ? "Refreshing models…" : "Refresh models", account.refreshModels, pendingAction, { "data-dsh-github-copilot-refresh-models": true }) : null, models === void 0 ? (0, react.createElement)("p", { style: { fontSize: "13px" } }, "Account model metadata is not available yet.") : (0, react.createElement)(GitHubCopilotAccountModelsSummary, { snapshot: models }), routeStatusMessage(view) === void 0 ? null : (0, react.createElement)("p", { role: "status" }, routeStatusMessage(view)), view?.route?.state === "needs-repair" && signedIn ? actionButton("Repair model configuration", account.reconcile, pendingAction) : null, signedIn ? actionButton(state.operation === "signOut" ? "Signing out…" : "Sign out", account.signOut, pendingAction || view?.writable === false) : null, view?.writable === false ? (0, react.createElement)("p", { style: { fontSize: "13px" } }, "Credentials are read-only in this profile.") : null) : null);
 		}
 		/** Standalone footer presentation; registered Models seats use the shared surface coordinator. */
 		function GitHubCopilotPreviewFooter(props) {
 			return (0, react.createElement)("div", { "data-dsh-github-copilot-preview-footer": true }, (0, react.createElement)(GitHubCopilotCompactAccount, { remote: props.remote }));
 		}
-		function compatibilityDetails() {
-			return (0, react.createElement)("details", { "data-dsh-github-copilot-compatibility": true }, (0, react.createElement)("summary", null, "Compatibility and existing configurations"), (0, react.createElement)("p", null, `GitHub Copilot uses account-discovered models. The internal route ID ${GITHUB_COPILOT_PREVIEW_PROVIDER_ID} is retained for existing sessions and explicit /model selections.`), (0, react.createElement)("p", null, `An existing ${GITHUB_COPILOT_PROVIDER_ID} profile is a legacy configuration, not a second account. It is kept until explicit migration. Sign out disconnects the shared GitHub authorization; it does not remove saved profiles.`), migrationLink());
-		}
-		function migrationLink() {
-			return (0, react.createElement)("a", {
-				href: "https://github.com/cloga/dsh-github-copilot/blob/main/docs/single-route-migration.md",
-				target: "_blank",
-				rel: "noreferrer"
-			}, "Review the single-route migration guide");
-		}
 		/** Only the mounted canonical row owns embedded controls. Credential presence is not row presence. */
 		function isGitHubCopilotAccountRow(props) {
 			return props.configured && props.provider.provider === "github-copilot" && props.provider.settingsNs === "llm-pi-ai";