dsh-github-copilot 0.4.0-alpha.30 → 0.4.0-alpha.32

package/AGENTS.md

@@ -31,7 +31,7 @@ Use native DSH tools for goals, background jobs and scoped subagents. Use local
 
 `dsh-github-copilot` is a companion targeting official DSH `0.1.6-alpha.2`, with retained baselines for DSH `0.1.6-alpha.1`, DSH `0.1.5-rc.2`, DSH `0.1.5-rc.1`, DSH `0.1.5-alpha.2`, DSH `0.1.5-alpha.1`, DSH `0.1.3-alpha.1`, DSH `0.1.2-rc.1`, and the controlled DSH Desktop `0.1.1-rc.2` Core baseline. It does not own a general Copilot chat adapter. DSH's built-in `llm-pi-ai` mount owns the GitHub Copilot provider, catalog, OAuth method and grant format, token exchange, refresh, and normal model transport.
 
-This repository owns ten narrow surfaces:
+This repository owns eleven narrow surfaces:
 
 1. A conditional authorization-service bootstrap plus Host controller that joins DSH authorization, credentials, and settings.
 2. A Client Models provider-card contribution with one shared account-state owner and Client-safe Remote descriptors; embed in an existing configured canonical row, suppress its separate footer controller, and retain footer/old-Core section fallback when no such row is mounted.
@@ -43,6 +43,7 @@ This repository owns ten narrow surfaces:
 8. Optional, provider-scoped Chat presentation for completed empty reasoning disclosures; durable content and encrypted replay metadata remain Core-owned.
 9. Opt-in model-role settings and dedicated new planner/executor sessions, using public Agent/Session/subagent APIs without changing existing sessions, global defaults or native Subagent model-selection settings.
 10. Managed-route estimated input/output admission, optional exact-request pressure signalling through official compaction recovery, and supported low summary effort only when no effort is already resolved. See [compaction budgets](./docs/copilot-compaction.md). Preserve truthful capacities, requested output caps, native errors/replay and transaction ownership; no hidden history trimming, chunking, new retry loop, competing compaction service or automatic model switch. Preventive guards do not claim recovery of an already oversized manual summary.
+11. Optional account quota reads and a session-scoped composer usage control through public credentials, strict Remotes and additive slots. Keep account billing-cycle credits separate from context tokens and session cost. Missing, pooled, legacy and stale data must retain their real semantics; never infer credits from token estimates or account deltas. See [quota boundaries](./docs/copilot-usage.md).
 
 ## Dedicated model-role boundary (#127)
 
@@ -59,6 +60,7 @@ Alpha.25 admits native `subagent/descriptor` v3, already v3 in the retained rc.1
 - `src/web-search-routing-config.ts`, `src/web-search-routing-card.ts`: plugin-owned cross-provider live routing settings and the Models-page control surface.
 - `src/reasoning-presentation.ts`: guarded native Chat delegation and historical Copilot provenance; filters temporary view props only, never messages, signatures, replay indexes or usage.
 - `src/remote.ts`: Typert Remote contribution. Never add credential payloads here.
+- `src/copilot-usage-host.ts`, `src/copilot-usage-remote.ts`, `src/copilot-usage-card.ts`, `src/copilot-usage-ui.ts`: bounded Host quota snapshots, an independent strict namespace and reversible composer presentation. No real account fetches in tests, private Client store/DOM injection, new credential owner or general model wire.
 - `src/current-provider.ts`: selected DSH route plus installed pi-ai catalog facts.
 - `src/temporary-models.ts`: exact, account-gated corrections with semantic protocol/capability retirement.
 - `src/model-protocol.ts`: explicit Core capability detection and conservative legacy fallback.

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.4.0-alpha.32 (prepared)
+
+- Add an optional, Copilot-session-scoped composer usage control without replacing the native Context meter or changing other providers (#153).
+- Read bounded account quota snapshots through the canonical Host-owned OAuth grant and a separate strict usage Remote namespace; preserve the existing authorization contracts.
+- Distinguish AI credits, legacy premium requests, individual budgets, shared pools, unavailable data and last-known snapshots. Never invent remaining credits from missing metadata, token estimates or another session.
+- Keep per-session credits explicitly unavailable until a supported public native accounting seam exposes complete provider-reported usage; no second model transport, Core patch, live-profile installation or restart is included.
+
+## 0.4.0-alpha.31 (prepared)
+
+- Retire the exact current managed-route token proof after an observed model HTTP 401, preserving the native failure without replay, logout or model switching (#152).
+- Let the next independent caller renew a rejected token through native `Models.getAuth()` and the serialized canonical credential store, even if its stored expiry is still in the future. Never persist a projected expiration or replace a newer sign-in.
+- Bound recovery per account using the existing cooldown setting (five minutes by default, one-second floor); reject identical-token renewal and ignore late generations, 403, cancellation and error strings without an observed HTTP response.
+- Cover sign-out/sign-in with retained conversation history, native HTTP transports, concurrent renewal, credential races and cooldown. Synthetic evidence does not prove the original endpoint rejection cause, live OAuth/model acceptance, WebSocket recovery, publication or Desktop activation.
+
 ## 0.4.0-alpha.30 (prepared)
 
 - Route verification links on recognized Desktop v1 hosts through the existing same-window external-navigation handoff instead of popup creation; retain new tabs on web hosts (#150).

package/README.md

@@ -59,9 +59,17 @@ The candidate appends the ninth exact target, `dsh-v0.1.6-alpha.2` at `ddefc45fb
 
 Source markers, local rc.1-backed focused tests and fifteen scoped exact-source runtime tests passed (alpha.2 contracts 8, Remote 1 and Session-context 6). Full local `pnpm verify` passed: 1373 Vitest tests with 2 expected skips, 176 tooling tests, typechecks, build and package smoke; pack/tarball verification also passed. The scoped run used a supplemental resolver with official TypeScript `6.0.3`, declared `mime-types@3.0.2` and `ws@8.21.0`, and shared Zod `^4.4.3`, without source/dependency patches; it is not full official-root-helper qualification. Broad frozen dependency installation remains blocked by the configured mirror returning HTTP 404 for `node-addon-require-builtin@0.1.6`. **CI qualification has not executed.** No published-artifact compatibility, live Desktop activation, OAuth or real model-call success is claimed. The [official-first matrix](./docs/official-first-016-alpha2.md) records exact official sources, support scope, retained gaps and retirement triggers rather than assuming missing parity from feature names.
 
+## Copilot usage beside the composer
+
+For a Session using `github-copilot` or `github-copilot-preview`, an optional **Credits** control shows the signed-in account's reported billing-cycle usage and remaining allocation. It uses the public composer dock, leaves the native Context meter unchanged, and disappears for other providers. Open it for budget, reset time, freshness and refresh details. Unsupported Client slots disable only this optional control.
+
+Numbers are not token estimates: legacy accounts show **Premium requests**, a shared organization pool may provide used credits without any individual remaining balance, and absent data is **Unavailable**, never zero or unlimited. Failed refreshes may retain explicitly **last-known** same-account values; authentication/account invalidation removes them. **This session** remains unavailable because the supported native adapter does not expose complete provider-reported credit accounting through the public plugin contract. It is not inferred from account deltas.
+
+The Host reads GitHub's internal quota endpoint using the existing canonical OAuth grant, with bounded requests and cache lifetimes; no new sign-in, credential store, model transport, settings write or model switch is added. This internal endpoint can change or deny access; enterprise custom endpoints are not guessed. The public enterprise/organization metrics reports are not used as a live personal balance service. See [data semantics, lifecycle and evidence limits](./docs/copilot-usage.md). Synthetic tests do not establish real account access, billing freshness or installed Desktop activation.
+
 ## Install and sign in
 
-The commands below target the package version `0.4.0-alpha.30`. Versioned URLs describe the intended release artifacts, not proof that publication or local activation has completed; use them only once that Release and its checksums are available. Install into the profile you use (replace `web` when targeting another profile):
+The commands below target the package version `0.4.0-alpha.32`. Versioned URLs describe the intended release artifacts, not proof that publication or local activation has completed; use them only once that Release and its checksums are available. Install into the profile you use (replace `web` when targeting another profile):
 
 Before installing/updating, unpack the **checksum-verified** archive into a temporary directory and run its read-only composition preflight (replace all paths with absolute paths for the intended profile):
 
@@ -74,7 +82,7 @@ Include any launcher patch files with repeated `--patch /absolute/file` argument
 For approved online installation, the supported CLI command is:
 
 ```sh
-dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.30/dsh-github-copilot-0.4.0-alpha.30.tgz
+dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.32/dsh-github-copilot-0.4.0-alpha.32.tgz
 ```
 
 If registry access is blocked or unavailable, do not retry it through another network. Desktop-managed profiles may instead use the [controlled offline CLI procedure](./docs/npm-distribution.md#controlled-offline-cli-maintenance), with an approved, checksum-verified local Release and existing dependency cache (`--offline --ignore-scripts`). All preflight and approval requirements still apply.
@@ -139,7 +147,7 @@ Agents should treat the browser authorization as a human handoff, not as a token
 5. Confirm **Signed in** and inspect the automatic discovery result before asking the user to choose a model. Already-signed-in Models opening ensures missing/stale metadata automatically; fresh ready cache makes no request. Use visible **Retry** for errors or **Manage → Refresh models** for an intentional forced update, not routine setup. Status alone does not discover, and login, metadata and successful model calls remain separate evidence.
 6. Use **Sign out** only when the user explicitly asks to disconnect the account. It deletes the Copilot credential record but preserves route settings.
 
-GitHub Releases and npm are the default distribution channels for each new version, using the same verified tarball. Pin the version and verify the evidence for the channel used: Release `SHA256SUMS`, and npm `dist.integrity` when installing from npm. The native Desktop package manager is preferred when permitted registry access is available; after npm publication is verified it accepts `dsh-github-copilot@0.4.0-alpha.30`, not a URL or file. Desktop-managed profiles also support explicitly approved [controlled offline CLI maintenance](./docs/npm-distribution.md#controlled-offline-cli-maintenance) with a verified local Release and `--offline --ignore-scripts`. Follow the mandatory search-composition preflight, backup, single-writer and post-install checks; do not bypass a corporate registry ban, disable TLS verification or restart without separate approval. Offline installation is not proof that npm networking/publication was repaired. See [distribution and publication requirements](./docs/npm-distribution.md).
+GitHub Releases and npm are the default distribution channels for each new version, using the same verified tarball. Pin the version and verify the evidence for the channel used: Release `SHA256SUMS`, and npm `dist.integrity` when installing from npm. The native Desktop package manager is preferred when permitted registry access is available; after npm publication is verified it accepts `dsh-github-copilot@0.4.0-alpha.32`, not a URL or file. Desktop-managed profiles also support explicitly approved [controlled offline CLI maintenance](./docs/npm-distribution.md#controlled-offline-cli-maintenance) with a verified local Release and `--offline --ignore-scripts`. Follow the mandatory search-composition preflight, backup, single-writer and post-install checks; do not bypass a corporate registry ban, disable TLS verification or restart without separate approval. Offline installation is not proof that npm networking/publication was repaired. See [distribution and publication requirements](./docs/npm-distribution.md).
 
 No `copilot2api` process, external gateway, placeholder API key, pasted GitHub token, or separate `dsh-web-search-provider` installation is required.
 
@@ -158,7 +166,7 @@ DSH Core continues to own model selection, sandboxing, tools, attachments, and o
 
 Under **Settings → Models → Model roles**, enable dedicated dual-model sessions, select two available account models, and save the profile-global settings. No workspace is needed to save. **Create session with this configuration** uses the application's current workspace, shown read-only; open a workspace first if none is current. There is no separate workspace dropdown and no first/recent-workspace fallback. The planner handles planning and acceptance; `copilot_execute` delegates implementation to a native continuable child with a fixed execution model. Configuration is off by default and affects only sessions created through this entry. It does not change the global default, existing sessions, credentials or the ordinary Subagent model-selection setting.
 
-Unavailable models are not substituted. Uncertain creation retries keep the same request identity. The feature requires public role/session/subagent capabilities and is visibly unavailable when they are absent; historical package compatibility is not blanket certification of this optional flow. See [setup, lifecycle, limitations and evidence](./docs/dual-model.md). The feature is included in the `0.4.0-alpha.30` candidate; source and fixture tests are not proof of publication or Desktop activation.
+Unavailable models are not substituted. Uncertain creation retries keep the same request identity. The feature requires public role/session/subagent capabilities and is visibly unavailable when they are absent; historical package compatibility is not blanket certification of this optional flow. See [setup, lifecycle, limitations and evidence](./docs/dual-model.md). The feature is included in the `0.4.0-alpha.32` candidate; source and fixture tests are not proof of publication or Desktop activation.
 
 If the card says **Could not load model roles**, do not change model defaults to work around it: this is a failed settings load, distinct from unsupported capabilities or unavailable models. In particular, a `githubCopilotDualModel/view` HTTP 404 indicates missing Host Remote exposure, not that the feature is off. See [troubleshooting and verification](./docs/dual-model.md#loading-and-remote-troubleshooting).
 
@@ -333,6 +341,7 @@ Existing installations must follow the [single-route migration guide](./docs/sin
 - **No sign-in control:** confirm the package is loaded in the active profile and use the baseline-specific UI above. Do not add a native provider just to reveal login.
 - **Two Copilot groups after upgrade:** a legacy canonical profile is still configured; it is preserved deliberately. After explicit migration/removal, both composer and `/model` list only the managed group. There is no display-only alias masking a second route.
 - **Signed in but a new model is missing:** opening Models ensures missing/stale metadata automatically; inspect accepted/rejected models for `github-copilot-preview`. Use **Retry** after errors or **Manage → Refresh models** to intentionally refresh before the TTL expires. Unsupported endpoints or incomplete metadata produce diagnostics, not static-catalog fallback. Do not repeat login or disable validation.
+- **`AUTH` / “API key is invalid” after signing in again:** this label does not prove the conversation cached an old key. On the managed route, an observed model HTTP 401 retires only the exact current token proof. The failed request stays failed: no automatic message replay, logout or model switch. Your next request (or model discovery) can perform one native OAuth renewal even before stored expiry, then validate account metadata. Repeated rejection is bounded per account by `accountModelFailureCooldownMs` (five minutes by default, at least one second); even forced discovery cannot bypass this recovery cooldown. If the renewed token is still rejected, wait for the cooldown and inspect account/permission status rather than repeatedly signing out. A new sign-in is not overwritten by a late old response. HTTP 403, network errors and strings mentioning 401 do not trigger this recovery. It observes native HTTP transport only; WebSocket recovery and live endpoint acceptance are not claimed.
 - **Canonical route says `not-configured`:** with configured login this is normal managed-only mode; inspect account discovery separately rather than creating a native profile.
 - **Delete dialog stays on “Deleting…”:** this update does not prove that hang fixed. Do not repeatedly delete; after an authorized Host stop, inspect persisted settings and follow the migration guide before deciding whether any removal is still needed.
 - **No Think text:** the provider may omit public summaries, but nonempty summaries must survive the Responses parser. Check selected effort and named errors. Empty disclosures are hidden only after completion; encrypted replay is never displayed. Reasoning/replay-bearing histories use native Core transport.
@@ -399,8 +408,8 @@ Report the published Release URL, version, tag/commit and verified asset SHA-256
 `package.json` declares public npm distribution. A release tag must equal `v${package.json.version}`. Versions use standard SemVer prerelease labels (`alpha`, `beta`, or `rc`), each with its matching npm dist-tag; only stable versions use `latest`. The Release workflow performs the frozen install and complete verification gate, packs once (or recovers the original archive on retry), verifies `SHA256SUMS`, publishes the immutable GitHub Release and then publishes those same bytes to npm through OIDC. Either channel failing means delivery is incomplete. First package creation needs an authorized maintainer; staging requires an existing package and is not a first-package bootstrap. Historical releases are not republished.
 
 ```sh
-curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.30/dsh-github-copilot-0.4.0-alpha.30.tgz
-curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.30/SHA256SUMS
+curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.32/dsh-github-copilot-0.4.0-alpha.32.tgz
+curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.32/SHA256SUMS
 sha256sum --check SHA256SUMS
 ```
 
@@ -408,7 +417,7 @@ PowerShell can verify the same two downloaded files with:
 
 ```powershell
 $expected = (Get-Content .\SHA256SUMS).Split()[0]
-$actual = (Get-FileHash .\dsh-github-copilot-0.4.0-alpha.30.tgz -Algorithm SHA256).Hash.ToLowerInvariant()
+$actual = (Get-FileHash .\dsh-github-copilot-0.4.0-alpha.32.tgz -Algorithm SHA256).Hash.ToLowerInvariant()
 if ($actual -cne $expected) { throw 'Release checksum mismatch' }
 ```
 

package/README.zh.md

@@ -9,7 +9,7 @@
 
 一个聚焦 GitHub Copilot 登录、通用账号模型发现、Copilot 专用 Tool 兼容与供应方托管搜索的 DSH companion。插件根据供应方返回的端点和能力元数据组装模型，复用公开的 `@deepseek-ai/dsh-llm-pi-ai` adapter 与 pi-ai SDK，不另写一套通用传输／序列化器，也不维护需要逐个添加新模型 ID 的静态目录。
 
-> 下文自动维护账号模型元数据与 provider 集成控件描述目标版本 `0.4.0-alpha.30`；这不代表已有的两条真实路由被合并或移除。版本化 URL 不表示 Release 已发布或本机已加载；仅在该 Release 与校验和可用后使用安装命令。源码、发布制品、已安装版本和实际加载运行时需分别确认，本地升级和中断会话的重启仍需用户批准。
+> 下文自动维护账号模型元数据与 provider 集成控件描述目标版本 `0.4.0-alpha.32`；这不代表已有的两条真实路由被合并或移除。版本化 URL 不表示 Release 已发布或本机已加载；仅在该 Release 与校验和可用后使用安装命令。源码、发布制品、已安装版本和实际加载运行时需分别确认，本地升级和中断会话的重启仍需用户批准。
 
 Alpha.24 修复 Web search 卡片缺少精确 Remote 依赖声明的问题。卡片仍位于 **Settings → Models**（`settings.models.footer`，list/root），旧 Core 回退到独立 Web search section，而非 General。搜索子 Fiber 独立等待 routing namespace，不影响账号控件和既有搜索安全检查；实际打包 Desktop 验收仍是独立关卡。
 
@@ -61,6 +61,14 @@ Candidate 追加第九个精确目标：`dsh-v0.1.6-alpha.2`，commit `ddefc45fb
 
 源码 marker、本地基于 rc.1 的定向测试，以及十五个限定范围精确源码运行时测试（alpha.2 contracts 8、Remote 1、Session-context 6）已通过。完整本地 `pnpm verify` 通过：1373 个 Vitest 测试、2 个预期跳过、176 个 tooling 测试，以及类型检查、构建和 package smoke；pack/tarball 验证也通过。限定范围运行使用补充 resolver、官方 TypeScript `6.0.3`、声明的 `mime-types@3.0.2` 与 `ws@8.21.0` 和共享 Zod `^4.4.3`，不修改源码或依赖制品，不等于完整 official-root-helper 验收。完整 frozen 依赖安装仍被配置 mirror 对 `node-addon-require-builtin@0.1.6` 返回 HTTP 404 阻塞。**CI 验收尚未执行**；不宣称已发布制品兼容、真实 Desktop 激活、OAuth 或模型调用成功。[官方优先矩阵](./docs/official-first-016-alpha2.md) 记录精确官方源码、支持范围、保留差距与移除条件，不因未验证同等能力就断言官方没有该功能。
 
+## 输入框附近的 Copilot 用量
+
+当前会话使用 `github-copilot` 或 `github-copilot-preview` 时，可选的 **Credits / 额度** 控件显示已登录账号本计费周期的已用量及服务端明确提供的剩余额度。控件通过公开 composer dock 增补，不修改原生 Context meter；切换其他 provider 后隐藏。展开可查看预算、重置时间、数据新鲜度并刷新。旧 Client 缺少公开插槽时只停用这一可选功能。
+
+数字不是 token 费用估算：旧计费账号显示 **Premium requests / 高级请求**；企业共享池可能只有已用 credits，没有个人剩余量。缺失数据显示不可用，不伪装成零或无限。刷新失败可保留明确标注的同账号历史快照；认证失效或账号变化会清除快照。**当前会话**消耗暂时显示不可用，因为受支持的原生 adapter 没有通过公开插件契约提供完整的 credit 计量；不会用账号余额差值推算。
+
+Host 使用现有 canonical OAuth grant 有界读取 GitHub 内部额度端点，不增加登录流程、凭据存储、模型传输、设置写入或模型切换。内部接口可能变化或拒绝访问；自定义企业端点不会被猜测。公开企业／组织报表也不被当作个人实时余额接口。详见[数据语义、生命周期与证据边界](./docs/copilot-usage.md)。合成测试不代表真实账号接口可用、账单实时或当前 Desktop 已生效。
+
 ## 安装与登录
 
 将当前 release 安装到你实际使用的 profile（其它 profile 请替换 `web`）：
@@ -76,7 +84,7 @@ node package/scripts/check-search-composition.mjs --profile-dir /absolute/profil
 获准且网络可用时，可通过受支持的 CLI 命令安装：
 
 ```sh
-dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.30/dsh-github-copilot-0.4.0-alpha.30.tgz
+dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.32/dsh-github-copilot-0.4.0-alpha.32.tgz
 ```
 
 若 registry 被公司封禁或不可用，不要更换网络绕行。Desktop 管理的 profile 可以改用[受控离线 CLI 流程](./docs/npm-distribution.md#controlled-offline-cli-maintenance)：使用来源获准、校验通过的本地 Release 和已有依赖缓存（`--offline --ignore-scripts`）。预检、备份和授权要求仍然适用。
@@ -141,7 +149,7 @@ Agent 应把浏览器授权视为需要用户完成的 handoff，而不是自行
 5. 确认 **Signed in** 并检查自动发现结果，再请用户选择模型。已登录时打开 Models 会自动确保缺失／过期元数据，新鲜 ready 缓存不发请求。错误可使用 **Retry**，有意强制更新时使用 **Manage → Refresh models**，不作为常规设置步骤。状态读取本身不发现；登录、元数据与真实调用成功是独立证据。
 6. 只有用户明确要求断开账号时才使用 **Sign out**；它会删除 Copilot credential record，但保留 route settings。
 
-每个新版本默认同时分发到 GitHub Releases 和 npm，两个渠道使用同一份已验证 tarball。应固定版本并核对所用渠道的证据：Release 的 `SHA256SUMS`；从 npm 安装时另核对 `dist.integrity`。在获准且可用的 registry 网络环境中，优先使用原生 Desktop 包管理器；确认 npm 发布后，它接受 `dsh-github-copilot@0.4.0-alpha.30`，不是 URL 或本地文件。Desktop 管理的 profile 也允许经明确授权的[受控离线 CLI 维护](./docs/npm-distribution.md#controlled-offline-cli-maintenance)：使用已验证的本地 Release 和 `--offline --ignore-scripts`，执行必需的组合预检、私密元数据备份、单写入者控制及安装后差异核验。缓存不足或出现权限拒绝时停止，不绕过公司 registry 封禁，不关闭 TLS 校验；重启仍需单独授权。离线安装成功不表示 npm 联网或发布问题已修好。[双渠道发布与 OIDC 要求](./docs/npm-distribution.md)保持不变。
+每个新版本默认同时分发到 GitHub Releases 和 npm，两个渠道使用同一份已验证 tarball。应固定版本并核对所用渠道的证据：Release 的 `SHA256SUMS`；从 npm 安装时另核对 `dist.integrity`。在获准且可用的 registry 网络环境中，优先使用原生 Desktop 包管理器；确认 npm 发布后，它接受 `dsh-github-copilot@0.4.0-alpha.32`，不是 URL 或本地文件。Desktop 管理的 profile 也允许经明确授权的[受控离线 CLI 维护](./docs/npm-distribution.md#controlled-offline-cli-maintenance)：使用已验证的本地 Release 和 `--offline --ignore-scripts`，执行必需的组合预检、私密元数据备份、单写入者控制及安装后差异核验。缓存不足或出现权限拒绝时停止，不绕过公司 registry 封禁，不关闭 TLS 校验；重启仍需单独授权。离线安装成功不表示 npm 联网或发布问题已修好。[双渠道发布与 OIDC 要求](./docs/npm-distribution.md)保持不变。
 
 不需要运行 `copilot2api`，不需要外部 gateway、placeholder API key、原始 GitHub token 或单独安装 `dsh-web-search-provider`。
 
@@ -162,7 +170,7 @@ DSH Core 继续负责模型选择、sandbox、工具、附件与其它 provider
 
 在 **设置 → 模型 → 模型分工** 中启用双模型会话，选择账号下可用的主模型和执行模型，保存全局设置（同一配置档案内通用，不按工作区保存）。保存不需要工作区；**用此配置新建会话** 使用应用当前工作区，并只读显示目标。没有当前工作区时须先打开工作区，不再提供独立下拉框，也不会默认选择第一个或最近的工作区。主模型负责规划与验收；`copilot_execute` 创建原生可继续执行的子代理，并固定其执行模型。默认关闭，仅专用入口创建的新会话采用此策略；不修改全局默认、已有会话、登录凭据或原生 Subagent 授权开关。
 
-模型不可用时明确报错，不自动替换。创建结果不明时重试同一个请求，不为绕过未知结果另建会话。功能依赖公开的会话、策略和子代理能力；缺少接口时显示不可用，不把历史版本的包兼容范围当成此功能的全面验收。详见[配置、生命周期、限制与验证范围](./docs/dual-model.md)。本功能包含在 `0.4.0-alpha.30` candidate 中，源码和合成测试不代表已发布或当前 Desktop 已生效。
+模型不可用时明确报错，不自动替换。创建结果不明时重试同一个请求，不为绕过未知结果另建会话。功能依赖公开的会话、策略和子代理能力；缺少接口时显示不可用，不把历史版本的包兼容范围当成此功能的全面验收。详见[配置、生命周期、限制与验证范围](./docs/dual-model.md)。本功能包含在 `0.4.0-alpha.32` candidate 中，源码和合成测试不代表已发布或当前 Desktop 已生效。
 
 若卡片显示 **Could not load model roles（无法加载模型分工）**，不要通过修改默认模型绕过：这是设置加载失败，与能力不支持或模型不可用不同。尤其 `githubCopilotDualModel/view` 返回 HTTP 404，表示 Host Remote 未暴露，并非功能开关处于关闭状态。详见[加载故障排查与验证](./docs/dual-model.md#loading-and-remote-troubleshooting)。
 
@@ -344,6 +352,7 @@ Copilot Session 如需更宽的文件或命令权限，必须在调用前选择
 - **看不到登录控件：**确认新版 package 实际加载在活动 profile，并使用上表对应的 UI；不要为了显示登录卡片而添加原生 provider。
 - **升级后仍有两个 Copilot 分组：**已有 canonical profile 被有意保留。显式迁移并真正移除后，composer 与 `/model` 才都会只列出托管分组；不是靠显示别名隐藏第二条路由。
 - **已登录但新模型缺失：**打开 Models 会自动确保缺失／过期元数据，查看 `github-copilot-preview` 的接受／拒绝结果。错误可点 **Retry**；希望在 TTL 到期前有意强制更新时，使用 **Manage → Refresh models**。接口不支持或元数据不完整时显示诊断，不退回静态目录，也不要反复登录或关闭校验。
+- **重新登录后出现 `AUTH`／“API key is invalid”：**这个标签并不证明旧会话缓存了旧 Key。托管路由实际收到模型 HTTP 401 后，只撤销与当前请求精确匹配的 Token 证明；该次请求仍然失败，不自动重发消息、退出登录或切换模型。下一次请求（或模型发现）可通过原生 OAuth 进行一次续期，即使记录的有效期尚未到期，随后重新校验账号模型元数据。连续拒绝受账号级 `accountModelFailureCooldownMs` 限制（默认五分钟，至少一秒），强制发现也不能绕过该恢复冷却。续期后仍被拒绝时，请等待冷却并检查账号／权限状态，不要反复退出登录。迟到的旧响应不能覆盖新登录；403、网络错误和仅含 401 字样的错误不触发恢复。这里只观察原生 HTTP 传输，不声称覆盖 WebSocket，也不代表真实端点验收通过。
 - **Canonical 状态为 `not-configured`：**已登录时属于正常单托管路由模式；账号发现就绪与否另行检查，不需要创建原生 profile。
 - **删除对话框一直显示 “Deleting…”：**本次改动不证明该卡住问题已修复。不要重复删除；取得许可停止 Host 后检查持久化设置，按迁移指南判断是否仍需移除。
 - **没有 Think 文字：**供应方可能不返回公开摘要，但非空摘要应被完整保留。检查思考强度与命名错误。UI 只在完成后隐藏空条目，不显示加密回放；包含 reasoning／replay 的历史走 Core 原生 transport。
@@ -410,8 +419,8 @@ node scripts/agent.mjs attribution "DeepSeek Harness (DSH)"
 `package.json` 声明公开 npm 分发。Release tag 必须严格等于 `v${package.json.version}`。预发布使用 `alpha`、`beta` 或 `rc` 及对应 npm dist-tag，只有稳定版使用 `latest`。Release workflow 执行 frozen install 和完整门禁，只打包一次（重试恢复原始归档），验证 `SHA256SUMS`，发布不可变 GitHub Release，再通过 OIDC 将同一份字节发布到 npm。任一渠道失败都表示交付未完成。首次建包须由获准环境中的维护者完成；staging 要求包已存在，不能代替首次建包。不会批量补发历史版本。
 
 ```sh
-curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.30/dsh-github-copilot-0.4.0-alpha.30.tgz
-curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.30/SHA256SUMS
+curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.32/dsh-github-copilot-0.4.0-alpha.32.tgz
+curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.32/SHA256SUMS
 sha256sum --check SHA256SUMS
 ```
 
@@ -419,7 +428,7 @@ PowerShell 可以对已下载的同一组文件执行：
 
 ```powershell
 $expected = (Get-Content .\SHA256SUMS).Split()[0]
-$actual = (Get-FileHash .\dsh-github-copilot-0.4.0-alpha.30.tgz -Algorithm SHA256).Hash.ToLowerInvariant()
+$actual = (Get-FileHash .\dsh-github-copilot-0.4.0-alpha.32.tgz -Algorithm SHA256).Hash.ToLowerInvariant()
 if ($actual -cne $expected) { throw 'Release checksum mismatch' }
 ```
 

package/deployment-baseline.json

@@ -8,7 +8,7 @@
   },
   "package": {
     "name": "dsh-github-copilot",
-    "version": "0.4.0-alpha.30"
+    "version": "0.4.0-alpha.32"
   },
   "evidence": {
     "kind": "source-and-synthetic-test-inventory",
@@ -220,6 +220,24 @@
     ]
   },
   "capabilities": [
+    {
+      "id": "account-quota-composer-usage",
+      "required": true,
+      "evidenceScope": "synthetic-quota-and-public-remote-ui-contracts-not-live-account-access",
+      "sourceMarkers": [
+        {"file": "src/index.ts", "marker": "ctx.plugin(GitHubCopilotUsageController)"},
+        {"file": "src/client.ts", "marker": "registerCopilotUsageUi"},
+        {"file": "src/remote.ts", "marker": "...copilotUsageRemote.descriptors"},
+        {"file": "docs/copilot-usage.md", "marker": "Percentage-only data must not create falsely precise absolute amounts"}
+      ],
+      "tests": [
+        {"file": "tests/copilot-usage-normalize.spec.ts", "name": "never invents precise amounts from a rounded percentage"},
+        {"file": "tests/copilot-usage-ui.spec.ts", "name": "uses real Cordis Remote tracing and reversible public SlotRegistry registration"},
+        {"file": "tests/scripts/copilot-usage-gateway.test.mjs", "name": "quota Remote reaches the actual Host gateway without startup or signed-out network requests"},
+        {"file": "tests/client-bundle.spec.ts", "name": "mounts strict Host result codecs through the published rc.1 client carrier"},
+        {"file": "tests/fixtures/remote-core.fixture.ts", "name": "mounts authorization, role and search-catalog Remotes on the exact target Client gateway"}
+      ]
+    },
     {
       "id": "desktop-shared-package-ownership",
       "required": true,
@@ -453,6 +471,26 @@
         {"file": "tests/preview-route.spec.ts", "name": "withdraws only its own route and refuses an already-prepared call after disposal"}
       ]
     },
+    {
+      "id": "managed-http-auth-rejection-recovery",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/preview-provider.ts", "marker": "response.status === 401"},
+        {"file": "src/preview-route.ts", "marker": "COPILOT_PREVIEW_AUTH_RECOVERY_COOLDOWN"},
+        {"file": "src/account-model-auth.ts", "marker": "renewRejectedCredential"},
+        {"file": "src/account-model-auth.ts", "marker": "COPILOT_ACCOUNT_TOKEN_REJECTED"}
+      ],
+      "tests": [
+        {"file": "tests/preview-route.spec.ts", "name": "uses fresh OAuth after sign-out and %s sign-in with the same conversation history"},
+        {"file": "tests/preview-route.spec.ts", "name": "handles actual HTTP %i without replay and renews only a rejected token on the next request"},
+        {"file": "tests/preview-route.spec.ts", "name": "shares rejected-token renewal across concurrent new callers without replaying failed wires"},
+        {"file": "tests/preview-route.spec.ts", "name": "bounds repeated 401 recovery after a %s native renewal"},
+        {"file": "tests/preview-route.spec.ts", "name": "ignores a late HTTP 401 after the current %s changes"},
+        {"file": "tests/preview-route.spec.ts", "name": "ignores an old HTTP 401 after source publication but before the owner adopts the new snapshot"},
+        {"file": "tests/account-model-auth.spec.ts", "name": "does not persist a projected expiration when rejected-token renewal fails"},
+        {"file": "tests/account-model-auth.spec.ts", "name": "does not expire or refresh a newer same-account token observed under the record lock"}
+      ]
+    },
     {
       "id": "account-discovery-native-oauth",
       "required": true,
@@ -559,7 +597,7 @@
         {"file": "src/client.ts", "marker": "settings.models.provider-card"},
         {"file": "src/client.ts", "marker": "copyAuthorizationCode"},
         {"file": "src/client.ts", "marker": "data-dsh-github-copilot-device-code"},
-        {"file": "src/client.ts", "marker": "verificationLinkTarget"},
+        {"file": "src/external-link.ts", "marker": "externalLinkTarget"},
         {"file": "src/client.ts", "marker": "data-dsh-github-copilot-verification-url"},
         {"file": "src/authorization-controller.ts", "marker": "GitHubCopilotAuthorizationController"}
       ],

package/docs/copilot-usage.md

@@ -0,0 +1,47 @@
+# Copilot account usage
+
+The optional composer control separates three quantities:
+
+| Quantity | Scope | Rule |
+| --- | --- | --- |
+| Context occupancy | Current native request/context window | Remains owned by DSH's native meter. |
+| Account usage and remaining allocation | GitHub account billing cycle, across Copilot applications | Display only validated provider quota data; identify stale snapshots explicitly. |
+| Session credits | Complete provider-reported usage attributable to this DSH Session | Unavailable in this version. Do not infer it from tokens, cost estimates or account balance changes. |
+
+## Presentation
+
+The control is an additive `conversation.composer.dock` contribution for the current Copilot Session. It does not replace the composer, move native DOM nodes, modify global defaults, switch a model or enroll other Sessions. Native context occupancy and the new account budget are not interchangeable.
+
+The compact control shows reported usage and remaining allocation where available. Its details explain the unit, budget, reset timestamp, freshness and unavailable data. Legacy premium requests must never be relabeled AI credits. A pooled organization account can have absolute credits used without a personal denominator; it does not imply unlimited use or expose a knowable organization balance. Percentage-only data must not create falsely precise absolute amounts.
+
+Detailed amounts are rounded to two decimal places for display; a positive amount below 0.01 is shown as `<0.01`, not zero. GitHub billing remains authoritative. Known individual budgets at 90% used show a low-budget warning, not a spending restriction. The plan link uses the supported Desktop browser handoff with a selectable URL fallback. Details use the browser's native popover top layer when available and a fixed-position fallback otherwise; no additional ReactDOM copy or private Core DOM access is introduced.
+
+Provider or Session changes, unmounting and missing supported runtime seams revoke the presentation's ownership. Optional capability failure must not disable sign-in, Models, search or ordinary chat. The installed/loaded Client determines the exact dock placement; the standalone design mockup is not proof of native placement.
+
+## Account data boundary
+
+The Host uses the existing `llm-pi-ai/github-copilot` OAuth grant through public credential APIs. GitHub's `copilot_internal/user` endpoint uses the GitHub grant, not a second sign-in or a newly pasted token. Access-token renewal remains owned by pi-ai; quota inspection must not introduce a refresh implementation or credential persistence.
+
+Quota requests are lazy, single-flight and bounded by timeout, response size and cache/failure policy. Account continuity is checked around asynchronous work and before releasing cached data. Authentication denial, sign-out, account invalidation or disposal must not release a previous account's snapshot. A same-account transient failure may expose a timestamped last-known snapshot, never a current balance. Responses and diagnostics exclude tokens, raw provider bodies and account identifiers. Requests do not follow redirects with the credential; custom enterprise hosts are not guessed.
+
+The Client receives only the separate strict `githubCopilotUsage` namespace (`get` and `refresh`). Existing authorization and migration methods retain their schemas. Refresh does not change settings, budget, plan, model selection or billing policy. This meter is informational and does not authorize spending or implement a budget enforcement loop.
+
+## Source contracts and limitations
+
+GitHub's internal client endpoint is not a stable public third-party REST contract. The existing grant may not be permitted to read it, and its schema may change. Failure must remain visible rather than falling back to an administrator token, another account, a browser token or fabricated numbers.
+
+Verified reference sources:
+
+- [Official VS Code account snapshot types](https://github.com/microsoft/vscode/blob/44825207bf4389c3bd17c92d3ec28cf784c324cc/src/vs/base/common/defaultAccount.ts).
+- [Official quota normalization and pooled-account semantics](https://github.com/microsoft/vscode/blob/44825207bf4389c3bd17c92d3ec28cf784c324cc/src/vs/workbench/services/chat/common/chatEntitlementService.ts).
+- [Official quota fetch and per-turn credit accounting](https://github.com/microsoft/vscode/blob/44825207bf4389c3bd17c92d3ec28cf784c324cc/extensions/copilot/src/platform/chat/common/chatQuotaServiceImpl.ts).
+- [GitHub's public organization/enterprise usage reporting API](https://docs.github.com/en/rest/copilot/copilot-usage-metrics) and [report fields](https://docs.github.com/en/copilot/reference/copilot-usage-metrics/copilot-usage-metrics). Daily administrator reports are not a live personal balance API.
+- [GitHub's explanation of used credits with no individual budget](https://github.blog/changelog/2026-07-20-copilot-users-can-now-see-ai-credits-used-per-billing-cycle/).
+
+The internal client observes per-turn `copilot_usage.total_nano_aiu`, but existence in another client's wire response is not evidence that the supported DSH/pi adapter exposes complete session accounting to plugins. On the exact alpha.2 source, [`mapUsage`](https://github.com/deepseek-ai/deepseek-harness/blob/ddefc45fbc7f8e46dd73185e68295696d1297887/packages/llm/llm-pi-ai/src/stream.ts) maps only token counts and cache counts into the public [`StreamChunk` usage contract](https://github.com/deepseek-ai/deepseek-harness/blob/ddefc45fbc7f8e46dd73185e68295696d1297887/packages/llm/llm/src/types.ts). Opaque replay state is not an accounting escape hatch. Until an unchanged public seam provides attributable, deduplicated receipts for ordinary calls, retries and background activity, **This session** remains unavailable.
+
+Synthetic tests cover parsing, lifecycle, failure states, strict transport and UI. They do not establish production quota permissions, billing latency, live OAuth/model transport, installed Desktop bytes or loaded plugin state. No real account calls are made merely to generate test evidence.
+
+## Official-first retirement
+
+Retain this bounded companion feature only while native DSH lacks equivalent public account-usage presentation for the required scope. Migrate to native functionality once equivalent data semantics, account invalidation, session attribution, accessible presentation and supported-version acceptance are verified. Do not require a Core patch or add a parallel model transport to complete this integration.

package/docs/official-first-016-alpha2.md

@@ -24,6 +24,12 @@ Official alpha.2 support is **partial**: [combined model context and adapter pur
 
 **Retain** a metadata-driven estimated budget guard, optional exact-request pressure signalling through stock recovery, and capability-supported low summary effort only when no effort has been resolved. Preserve real catalog capacity, caller output cap, history, cancellation and native transport. No second compaction service, private mutation, automatic model switching or Core patch is added. Retire each companion component when official behavior covers its constraints and passes equivalent exact-runtime regression and migration qualification. [Detailed scope and recovery limitations](./copilot-compaction.md) distinguish prevention from already-oversized-history rescue; the historical alpha.25 evidence below is not qualification of this follow-up.
 
+## Account quota follow-up (#153)
+
+Official alpha.2 provides a public additive [`conversation.composer.dock`](https://github.com/deepseek-ai/deepseek-harness/blob/ddefc45fbc7f8e46dd73185e68295696d1297887/packages/client/ui-conversation/src/client/contract/slots.ts), while its [`ContextMeter`](https://github.com/deepseek-ai/deepseek-harness/blob/ddefc45fbc7f8e46dd73185e68295696d1297887/packages/client/ui-conversation/src/client/skeleton/ContextMeter.tsx) owns token occupancy, not account billing. This is **partial** support for the requested account-credit presentation, not justification to replace the composer or native meter.
+
+**Retain** a bounded Host account-quota source and an optional additive control with a separate strict Remote namespace. Existing [`mapUsage`](https://github.com/deepseek-ai/deepseek-harness/blob/ddefc45fbc7f8e46dd73185e68295696d1297887/packages/llm/llm-pi-ai/src/stream.ts) exposes token counts, not complete Copilot per-request credit receipts; show session credits as unavailable rather than reading opaque replay state or creating a second wire. Retire the companion control when an official account-usage surface provides equivalent budget units, pooled/missing/stale semantics, account isolation and Client lifecycle. Per-session accounting additionally requires attributable, deduplicated native receipts and tested retry/background-work coverage. [Quota scope and evidence limits](./copilot-usage.md) remain distinct from live account permissions and installed Desktop acceptance.
+
 ## Descriptor correction is not a history conversion
 
 Native `subagent/descriptor` was already **v3 in the retained rc.1 baseline**; the plugin's v1 expectation was a plugin/test bug. Alpha.25 admits the native continuable `spawn` descriptor with explicit `agentProvider`/`agentModel`, and validates its declared native fields. Native descriptor v3, plugin role-policy version, plugin projection cache version and whole-Session storage-format versions are separate concepts.