feat: OpenCode Go usage, model refresh, and macOS panel layout

[tmhise]

What changed

• Show OpenCode Go's account-wide rolling, weekly, and monthly usage in the macOS panel and dashboard. Show locally observed completed requests and measured tokens by model, with in-flight work and partial measurements labeled separately. If the Go usage endpoint is unavailable, retain the local observation fallback without presenting it as provider quota.
• Refresh native and routed model discovery during Commander startup and through the CLI, macOS panel, and dashboard Models page. The dashboard distinguishes models published to the Codex picker from Commander-only models; the panel reports when running Codex workers still hold an older roster. OpenCode Go live discovery is restricted to trusted registry IDs, so a newly introduced ID still requires a registry update.
• Simplify the macOS panel: quotas precede live requests in one scrolling area, proxy status sits in a compact footer, Dashboard and More actions sit in the header, and Refresh Models is in More actions. Logs and manual update checks remain available there; an available or pending update appears in the header. Launch at Login keeps its explanation in a tooltip except when guidance needs to remain visible.

Refresh Models publishes the saved catalog without interrupting ChatGPT. A running Codex worker can continue using its previously loaded roster; the panel then explains the restart step. The dashboard's guarded worker restart remains an advanced option.

Security considerations

The OpenCode Go quota probe sends the configured Go API key as a Bearer token only to the fixed canonical Go usage endpoint. Redirects are rejected, the request has a timeout, and the token and response body are not logged. The live probe falls back to local observations on an invalid or unavailable response. Independent security review under MAINTAINERS.md verified these credential-destination, redirect, timeout, and fallback boundaries. Regression tests assert zero network requests for custom destinations and OAuth mode, and safe local fallback for rejected or invalid usage responses. First-party endpoint behavior was checked against OpenCode’s usage.ts and subscription.ts; model IDs and transports were checked against https://opencode.ai/v2/docs/console/go and https://models.opencode.ai/api.json (verified 2026-10-01).

Review fixes and release version

• Preserve the last successful provider model list and routing IDs when an explicit refresh fails; refresh expires freshness without deleting fallback data or discovery provenance.
• Carry token measurement coverage into Go usage tables, display missing measurements as unreported, and label partial measurements.
• Show truthful macOS feedback for skipped or failed model syncs, including upstream warnings.
• Clamp Go Grok 4.6/4.7 reasoning to their documented ceiling and use their documented 500k context. The provider note and guide disclose the Muse Spark Contributor training terms.
• Prepare package version 0.1.20 for the next immutable macOS preview archive.

Verification

• bun run typecheck — passed.
• bun run test:parallel — all 631 test files passed on the revised tree.
• bun run test:macos — 90 passed.
• cd gui && bun run test — 888 passed on the revised tree; GUI lint, i18n lint, and build passed.
• cd docs-site && bun install --frozen-lockfile && bun run build — passed.
• bun run privacy:scan, bun run build:macos, and git diff --check — passed.
• Manual macOS Refresh Models completed, updated the saved catalog, and showed the stale-worker restart guidance when appropriate.

macOS panel screenshots

Rendered from safe UI test data; no account identifiers or keys are included.

The revised backend and UI fixes received independent review. All local checks above passed; aggregate CI on the revised head must pass before merge. The 0.1.20 release will additionally require the signed-asset and installed-app update qualifications described in structure/06_docs-and-release.md.