@monotykamary/pi-better-openai 0.2.2 → 0.2.3

package/README.md

@@ -51,9 +51,9 @@ Usage display, image generation, and live voice require pi's `openai-codex` OAut
 
 ## Banked resets
 
-Unused banked Codex resets **auto-redeem by default, 5 minutes before expiry**, while an interactive pi session is running and Codex credentials are available. Starting pi within that final five-minute window also triggers the check; expired credits are skipped. This runs independently of the usage display and current model. The reset picker shows the auto-redemption note beside each eligible expiry. Disable **Auto-redeem banked resets** in `/openai-settings` or set `usage.autoRedeemBankedResets` to `false` to opt out.
+Unused banked Codex resets **auto-redeem by default, 5 minutes before expiry**, while an interactive pi session is running and Codex credentials are available. Starting pi within that final five-minute window also triggers the check; expired credits are skipped. This runs independently of the usage display and current model. The reset picker and confirmation show each credit's actual local auto-redemption date and time (expiry minus five minutes) beside its expiry. Disable **Auto-redeem banked resets** in `/openai-settings` or set `usage.autoRedeemBankedResets` to `false` to opt out.
 
-For safety, each attempt targets one explicit, freshly checked credit ID, with no fallback to another credit and no automatic retry after a consume request (including errors or `nothing_to_reset`). A persistent per-account guard permits at most one redemption attempt in five minutes across pi sessions sharing the same agent directory; manual redemption uses the same guard. Simultaneously expiring credits are not drained. Reservations live under `$PI_CODING_AGENT_DIR/pi-better-openai/reset-redemptions` (default `~/.pi/agent/pi-better-openai/reset-redemptions`); unreadable state or an orphaned lock blocks redemption rather than risking a duplicate. Separate machines/agent directories cannot coordinate this local guard.
+For safety, each attempt targets one explicit, freshly checked credit ID, with no fallback to another credit and no automatic retry after a consume request (including errors or `nothing_to_reset`). A persistent per-account guard permits at most one redemption attempt in five minutes across pi sessions sharing the same agent directory; manual redemption uses the same guard. Automatic reservations recheck the five-minute eligibility window while holding an exclusive filesystem lock, and attempted credit IDs remain blocked even after later redemptions or restarts. Simultaneously expiring credits are not drained, and later credits wait for their own final five-minute window. Reservations live under `$PI_CODING_AGENT_DIR/pi-better-openai/reset-redemptions` (default `~/.pi/agent/pi-better-openai/reset-redemptions`); unreadable state or an orphaned lock blocks redemption rather than risking a duplicate. Update/restart all pi instances to use the current guard. Separate machines/agent directories cannot coordinate this local guard; instances using the same account should share an agent directory.
 
 Pi must remain running and awake; this is not an OS-level scheduled task. No eligible usage window or unavailable credentials can prevent redemption.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monotykamary/pi-better-openai",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Improve OpenAI in pi with fast mode, usage stats, realtime voice, image generation, and footer polish.",
   "keywords": [
     "fast",

package/src/reset-controller.ts

@@ -218,7 +218,16 @@ export class ResetController {
         credit.expiresAtMs - Date.now() > BANKED_RESET_AUTO_REDEEM_LEAD_MS
       )
         return;
-      if (!reserveBankedResetRedemption(credentials.accountId, credit.id)) return;
+      if (
+        !reserveBankedResetRedemption(credentials.accountId, credit.id, {
+          expiresAtMs: credit.expiresAtMs,
+        })
+      )
+        return;
+      // Filesystem contention or a clock adjustment must not turn a valid
+      // reservation into a POST for an expired or not-yet-due credit.
+      const remainingMs = credit.expiresAtMs - Date.now();
+      if (remainingMs <= 0 || remainingMs > BANKED_RESET_AUTO_REDEEM_LEAD_MS) return;
       const result = await consumeBankedReset(
         ctx,
         credit.id,

package/src/reset-guard.ts

@@ -4,6 +4,12 @@ import { join } from "node:path";
 import { piAgentDir } from "./paths.ts";
 import { BANKED_RESET_AUTO_REDEEM_LEAD_MS } from "./resets.ts";
 
+type RedemptionReservation = {
+  blockedUntilMs: number;
+  creditHash: string;
+  attemptedCreditHashes?: string[];
+};
+
 // Reserve before sending a POST, not after receiving its outcome. A timeout may
 // already have spent the credit. Shared by manual/automatic redemption and all
 // pi processes using this agent directory. Corrupt state or an orphaned lock
@@ -11,8 +17,9 @@ import { BANKED_RESET_AUTO_REDEEM_LEAD_MS } from "./resets.ts";
 export function reserveBankedResetRedemption(
   accountId: string,
   creditId: string,
-  now = Date.now(),
+  options: { expiresAtMs?: number } = {},
 ): boolean {
+  if (!accountId.trim() || !creditId.trim()) return false;
   const digest = (value: string) => createHash("sha256").update(value).digest("hex");
   const dir = join(piAgentDir(), "pi-better-openai", "reset-redemptions");
   mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -26,33 +33,52 @@ export function reserveBankedResetRedemption(
     throw new Error("Banked reset safety reservation unavailable.");
   }
   try {
-    let previous: { blockedUntilMs?: unknown; creditHash?: unknown } | undefined;
+    let previous: RedemptionReservation | undefined;
     try {
       previous = JSON.parse(readFileSync(path, "utf8"));
       if (
         !previous ||
         typeof previous.blockedUntilMs !== "number" ||
         !Number.isFinite(previous.blockedUntilMs) ||
-        typeof previous.creditHash !== "string"
+        typeof previous.creditHash !== "string" ||
+        !/^[0-9a-f]{64}$/.test(previous.creditHash) ||
+        (previous.attemptedCreditHashes !== undefined &&
+          (!Array.isArray(previous.attemptedCreditHashes) ||
+            !previous.attemptedCreditHashes.every(
+              (hash) => typeof hash === "string" && /^[0-9a-f]{64}$/.test(hash),
+            ) ||
+            !previous.attemptedCreditHashes.includes(previous.creditHash)))
       )
         throw new Error("Invalid reservation");
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== "ENOENT")
         throw new Error("Banked reset safety reservation unavailable.");
     }
-    const creditHash = digest(creditId);
+    // Check the actual clock under the account lock, not a cached timer's time.
+    // Manual, explicitly confirmed redemptions do not supply an expiry limit.
+    const now = Date.now();
     if (
-      previous &&
-      ((previous.blockedUntilMs as number) > now || previous.creditHash === creditHash)
+      options.expiresAtMs !== undefined &&
+      (!Number.isFinite(options.expiresAtMs) ||
+        options.expiresAtMs <= now ||
+        options.expiresAtMs - now > BANKED_RESET_AUTO_REDEEM_LEAD_MS)
     )
       return false;
+    const creditHash = digest(creditId);
+    // Migrate old single-credit state. Never forget an uncertain attempt just
+    // because another credit was subsequently redeemed.
+    const attemptedCreditHashes =
+      previous?.attemptedCreditHashes ?? (previous ? [previous.creditHash] : []);
+    if ((previous && previous.blockedUntilMs > now) || attemptedCreditHashes.includes(creditHash))
+      return false;
     writeFileSync(
       path,
       JSON.stringify({
         blockedUntilMs: now + BANKED_RESET_AUTO_REDEEM_LEAD_MS,
         creditHash,
+        attemptedCreditHashes: [...attemptedCreditHashes, creditHash],
       }),
-      { mode: 0o600 },
+      { mode: 0o600, flush: true },
     );
     return true;
   } finally {

package/src/resets.ts

@@ -156,6 +156,12 @@ function formatResetTimestamp(ms: number | null): string {
   });
 }
 
+function formatAutoRedeemNote(credit: BankedResetCredit | undefined, enabled = false): string {
+  if (!enabled || !credit || !selectAutoRedeemCredit([credit]) || credit.expiresAtMs === null)
+    return "";
+  return ` · auto-redeems ${formatResetTimestamp(credit.expiresAtMs - BANKED_RESET_AUTO_REDEEM_LEAD_MS)}`;
+}
+
 export function formatBankedResetChoice(
   credit: BankedResetCredit,
   index: number,
@@ -166,8 +172,7 @@ export function formatBankedResetChoice(
     credit.expiresAtMs === null
       ? "no expiry"
       : `expires ${formatResetTimestamp(credit.expiresAtMs)}`;
-  const note =
-    autoRedeem && selectAutoRedeemCredit([credit]) ? " · auto-redeems 5 min before expiry" : "";
+  const note = formatAutoRedeemNote(credit, autoRedeem);
   return `${index + 1}. ${title} · ${expires}${note}`;
 }
 
@@ -205,10 +210,7 @@ export function buildBankedResetConfirmation(options: {
   lines.push("");
   if (credit?.grantedAtMs != null)
     lines.push(`Granted: ${formatResetTimestamp(credit.grantedAtMs)}`);
-  const autoNote =
-    options.autoRedeem && credit && selectAutoRedeemCredit([credit])
-      ? " · auto-redeems 5 min before expiry"
-      : "";
+  const autoNote = formatAutoRedeemNote(credit, options.autoRedeem);
   lines.push(`Expires: ${formatResetTimestamp(credit?.expiresAtMs ?? null)}${autoNote}`);
   lines.push(`Available: ${options.availableCount}`);
   const windows: string[] = [];
@@ -252,6 +254,7 @@ export async function consumeBankedReset(
   signal?: AbortSignal,
   pinnedCredentials?: CodexCredentials,
 ): Promise<ConsumeBankedResetResult> {
+  if (!creditId?.trim()) throw new Error("An explicit banked reset credit is required.");
   const credentials = pinnedCredentials ?? (await getCodexCredentials(ctx, signal));
   signal?.throwIfAborted();
   if (!credentials)
@@ -264,11 +267,7 @@ export async function consumeBankedReset(
       "chatgpt-account-id": credentials.accountId,
       "content-type": "application/json",
     },
-    body: JSON.stringify(
-      creditId
-        ? { credit_id: creditId, redeem_request_id: redeemRequestId }
-        : { redeem_request_id: redeemRequestId },
-    ),
+    body: JSON.stringify({ credit_id: creditId, redeem_request_id: redeemRequestId }),
     signal,
   });
   if (!response.ok) throw new Error(`Codex reset consume request failed (${response.status})`);