[hejie905205173]

Scope

Add TokenRhythm account authorization to the desktop client, including OAuth login, local credential storage, account balance, account-backed model/media requests, explicit account/manual credential selection, and logout/recovery/lifecycle handling.

The personal menu now follows the supplied design: original default avatar, avatar/name and amount hierarchy, outlined recharge action, remote wallet balance, local Gateway today-token summary, and a link to the local Usage page filtered to today. Collapsing the sidebar hides the account entry. Loading, stale/error states, keyboard navigation, and six locales are covered.

The branch also includes an opt-in local account development host, Windows UAT/production-origin test installer tooling, and associated regression coverage. Standard production WebUI does not automatically gain the development host's login capability. The personal-menu addition does not change model/provider selection rules.

Branch

Base branch: main

Target exception: N/A

Issue

Linked issue: None

Reason: account feature implementation and the maintainer-confirmed personal-menu design follow-up.

Release Note

Add desktop TokenRhythm sign-in and a personal menu showing remote balance and local daily token usage, with recharge, usage, settings, and logout actions.

Tests

Current-head acceptance: CI run 41211143572 completed successfully on 4e6614021ce6512f392db58ec9ba02af32483cfc. All scheduled checks, including the aggregate CI result, Windows high-risk, all Desktop recovery E2E, Linux offline tests, and Windows packaged installation/upgrade acceptance, passed. The real two-process receipt restart case ran in the Windows serial phase and passed in 7.82 seconds with its original per-process 30-second guard and identity assertions. Merge-queue validation remains the final integration gate.

Production integration was validated on 04010e2f7, which merges main at a1a255de1 after PR #2027. Current head 4e6614021 includes the follow-ups below. Historical integration/build results remain labeled by their original source state; the new head's CI is required:

• Python account/setup/video/billing/persistence/recommendation/configuration regression: 562 passed across 13 complete files, following a 54-test preflight.
• Previously failing concurrent-grant migration case: passed; the complete worker and Electron dependency-security files also passed (22 tests). These local results do not replace the new head's Windows CI.
• WebUI account/menu/usage/setup/recommendation regression: 818 passed across 23 files. After adding two integration cases, the entire modified privacy file passed all 356 tests; both new cases passed again after the final await-only adjustment.
• Desktop build-glob/account/environment/secrets/quit/update/cleanup/migration regression: 102 passed.
• Full WebUI production build, type checks, architecture/i18n/theme/artifact gates: passed.
• Desktop TypeScript build with main's updated dependency lockfile and packaging compatibility preparation: passed.
• Complete contract generation determinism and checked-in output verification: passed.
• ruff check src tests and staged git diff --check: passed.

Added integration regressions for explicit remote router/ensemble recommendation application while account credentials are selected: persisted manual Key and endpoint, primary provider, selected credential source, and unsaved frontend drafts remain intact. Account leases are never persisted into manual configuration. Main's dependency updates address the previous audit/wheelhouse findings. GitHub CI run 41202046193 passed on integration head 04010e2f7, including the full Linux offline matrix, Windows high-risk tests, dependency audits, cross-platform desktop checks, and Windows packaged installation/upgrade acceptance. Two timing-sensitive Windows tests failed on the first attempt and passed in the failed-job rerun; no production code, assertions, or timeouts were changed for that rerun.

Queue follow-up (9fd5c0392): make Store-reference compaction tests offline and independent of optional tokenizer data. Preserve the full 87KB fixture and all reference/raw-content assertions; explicitly prove that the complete unprojected final request fits before asserting no-pressure behavior. The prior fixture's 32k window could not fit the conservative fallback estimate. The corrected file passed all 5 cases; 47 related compaction tests passed with real conservative estimates, including unchanged pressure-recovery coverage. Ruff and diff checks passed. Production code, timeout limits, and merge gates are unchanged, so prior production build evidence remains applicable. The corrected reference tests passed in subsequent CI.

The queue also encountered a 200ms telemetry-shutdown watchdog timeout. Its complete related file passed locally (14 tests), the same code passed on the preceding PR CI, and controlled event-loop delay reproduced the timeout. No telemetry code, timeout, or assertion was changed; the new head's CI must verify it again.

Desktop cleanup follow-up (87f51b3c8): preserve the existing idle/graceful exit assertions and timeouts while capturing the verified Python owner PID/start identity, loopback listener state, ownership-record relationship, and bounded allowlisted Gateway shutdown events on failure. A failed full run and a passing isolated retry did not establish the underlying shutdown cause; the subsequent full rerun reproduced it, so the added evidence is diagnostic, not a claimed production fix. No raw logs, credentials, or ownership nonces are printed. The existing CI telemetry/helper unit script, JavaScript syntax checks, and diff checks passed. Windows CI must verify the new head before merging. Partial profile-matrix retries cannot satisfy the existing same-attempt coverage proof; preserve that gate and use complete evidence cohorts.

Shutdown follow-up (6495a2a6e, diagnostics/fixture follow-up 3ddd449e4): denied or disabled launch telemetry and its pending-retry check now return before scheduling state I/O. A deterministic occupied-executor reproduction showed the previous no-op could delay cancellation of the launch task before Gateway cleanup started. All three new regressions fail against the original production code; 111 focused growth/shutdown/CLI cases pass after the fix, including authorized-write cancellation durability. Full ruff check src tests passes. Consent enforcement, authorized transactions, process budgets, and graceful-exit assertions are unchanged. This confirmed mechanism is fixed; whether it caused the observed Windows E2E timeout is still subject to the new Windows run, not inferred from local tests.

The failed Windows diagnostic run confirmed the Python owner was gone and its port closed after the 10-second forced cleanup, but the lifecycle parser missed the actual prefixed-JSON log format. The parser now covers that producer format; this isolated fixture also enables the existing bounded stall sampler and prints only allowlisted frame basenames/function/line metadata. Helper tests, producer-format controls, syntax checks and independent review pass. Separately, the macOS healthy-resume fixture now waits for the current renderer's handshake and first successful RPC, including same-generation recovery, before measuring connection preservation. The failed run had resumed an unready connection, which production intentionally replaces. All original assertions/timeouts remain. The local native E2E attempt did not execute because its Electron binary was unavailable and downloading stalled; it is not counted as passing evidence.

Windows receipt-test follow-up (4e6614021): the only failing executable check on 3ddd449e4 was the restart test's first child exceeding its unchanged 30-second guard; CI result reflected that same failure. The same test previously passed on Windows in 45.76 seconds across its two children, so the evidence does not establish a product persistence failure. This current-schema test now uses the repository's existing migrated database fixture and runs its real-process case in the existing ci_serial phase. Both real child processes, SessionStorage.connect/close, receipt SQLite, credential derivation, all identity assertions and each 30-second guard remain intact. The serial phase is executed and merged into the required JUnit/exit result. The complete modified file passes all 6 cases; phase selection executes 1 serial and 5 parallel cases. A control reintroducing the old account-authority restoration error fails as expected. Full Ruff and independent review pass. The new head's Windows CI is required before merging. On 3ddd449e4, Windows cleanup, macOS resume, all Linux offline tests, and Windows packaged install/upgrade acceptance passed; those results are historical evidence, not a claim that the new head's full CI is already green.

The new billing regression fails against immutable pre-fix production modules and passes after the fix. The receipt regression likewise fails before the fix and passes afterward, using two independent processes and real SQLite. Coverage includes changed leases, reopened storage, wrong account/origin rejection, manual-key controls, no duplicate generation, and preservation of the original billing owner. All upstream responses and credentials are synthetic.

The full Python suite and real Windows/Linux desktop installers were not run in this local checkout. The Python identity/persistence changes and personal-menu code are platform-neutral. Shutdown behavior was tested through production functions with Darwin/Linux/Windows boundaries; real cross-platform installer acceptance remains separate.

Maintainer Live Check

Maintainer live check: yes

Surface: browser / local gateway / account authorization

The maintainer reported successful testing against the real local account host and Gateway before authorizing the menu commit. No paid model generation or recharge transaction was performed as part of this review.

Review Fixes

• Correct the offline Store-reference test fixture's no-pressure assumption without changing production compaction limits or weakening raw-content/reference assertions.
• Integrate PR feat(models): add explicit remote recommendation updates #2027 after its merge to main. Resolve the two generated-contract conflicts through the canonical generator and add account/manual-credential recommendation integration coverage.
• Associate account video billing with the authenticated service origin/account identity, rather than a process-local lease. A new lease for the same account can settle the original ledger event; different accounts, environments, and manual keys stay isolated. Manual-key fingerprinting remains unchanged.
• Persist account_authority in video receipts and restore its tuple representation after JSON round trips. Reject malformed bindings and retain legacy manual-key compatibility.
• Merge current main and resolve desktop shutdown conflicts while retaining both main's bounded ordinary-quit behavior and the account-write persistence gate. Add coverage for pending/failed account writes, failed/hung Gateway cleanup, synchronous errors, and empty account sets.
• Fix the OSS regression-test Ruff line-length error.

No new network request or startup phase is added for billing identity. Legacy records whose binding metadata was never saved are not guessed or reassigned to the currently signed-in account, and no video generation is replayed to repair billing.

Safety

No real credentials, account runtime data, private prompts/transcripts, local preview servers, test logs, or machine-specific paths are committed. Regression tests use synthetic data. The menu reads usage/balance and opens the existing recharge link; it does not initiate payments.

Third-Party Origin

Third-party origin: maintainer-supplied design asset.

The 240 × 240 default avatar PNG was supplied by the maintainer and imported unchanged into opensquilla-webui/src/assets/account/default-avatar.png; it is not a screenshot recreation. No new third-party dependency was added by the personal-menu change. Existing Office font provenance and notices remain in place.

Documentation Changes

• Repository paths reference existing files.
• Examples avoid real secrets, local private paths, and private transcripts.

[github-actions]

Merge queue CI: failure — run 41204549162, attempt 1.
Tested queue candidate: e0a962169bc6a81fc7c49039e9ea270f4d4c991c. This result belongs to that combined tree, not necessarily the PR's current head.

• Full offline tests (ubuntu-latest, gateway-sqlite-6): failure
• Full offline tests (ubuntu-latest, core-3): failure
• Windows high-risk (core-3): failure
• CI result: failure

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.

[github-actions]

Merge queue CI: success — run 41212439161, attempt 1.
Tested queue candidate: 02aca7c5b5653c0d0792aab27ece1d16aa9f8163. This result belongs to that combined tree, not necessarily the PR's current head.

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.