@timo972/cc-router 0.12.0 → 0.12.1-rc.1

package/CHANGELOG.md

@@ -8,22 +8,58 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
----
+### Added
+
+- Dashboard `Ctrl+R` confirms redemption of one banked usage-limit reset for
+  the focused ChatGPT account, with duplicate-submission protection and stable
+  retry IDs for uncertain outcomes. No custom Meta key mapping is needed.
+  Account usage is refreshed after redemption.
+
+- Dashboard `[R]` reloads account usage and due tokens without restarting the
+  router or dropping active requests and sticky sessions. It also refreshes
+  Grok snapshots, CLI routing state, and an already-loaded model list, with
+  progress and partial-failure summaries.
+- `POST /cc-router/refresh` runs a shared Claude/OpenAI refresh pass, sweeps
+  expired cooldowns, and returns per-provider results. Concurrent reloads
+  join the same pass instead of starting duplicate work.
+- OpenAI transport diagnostics include correlation IDs and refresh, response
+  header, and first-byte timings. Failure logs use bounded diagnostic fields
+  rather than raw upstream error messages.
+
+### Changed
 
-## [0.12.0-rc.1] — 2026-08-30
+- The configured proxy request timeout now bounds Codex response headers and
+  upstream stream inactivity on both `/v1/responses` and OpenAI-routed
+  `/v1/messages`, including failover attempts. Progressing streams can outlive
+  that interval; time spent waiting for a slow client does not count as
+  upstream inactivity.
+- Permanently rejected OpenAI refresh credentials are quarantined from
+  inference routing without changing the account's saved `enabled` setting.
+  Health reports expose the authentication state and failure category.
+  Successful refresh or credential replacement restores eligibility;
+  quarantine is runtime-only and does not survive a router restart.
 
 ### Fixed
 
-- OpenAI Responses function calls and their outputs remain top-level input
-  items across the Anthropic Messages bridge. JSON and SSE responses now
-  preserve call IDs, streamed or atomic arguments, refusal text, and
-  `tool_use` stop reasons. Invalid metadata, malformed arguments, and tool
-  streams that end before completion fail closed instead of fabricating a
-  successful assistant turn.
+- OpenAI OAuth refresh sends the required public `client_id` and has a
+  15-second deadline covering response headers and JSON body parsing, so a
+  stalled refresh cannot retain its lock indefinitely.
+- Refresh deduplication is scoped to the account object, preventing a deleted
+  and re-added account from sharing an old account's in-flight refresh.
+- OpenAI usage authentication failures remain advisory rather than disabling
+  an account or overriding permanent credential quarantine. Background and
+  manual token refreshes continue to check quarantined accounts for recovery.
+- OpenAI response relays honor downstream backpressure and cancel upstream
+  reads when the client disconnects. Failed partial streams close the
+  connection instead of appearing complete, and router-side stream failures
+  are no longer misclassified as client cancellations.
+- Codex header timeouts return a safe HTTP 504 response, including after
+  account failover, while preserving the existing retry budget and shared
+  request correlation.
 
 ---
 
-## [0.12.0-rc.0] — 2026-08-30
+## [0.12.0] — 2026-09-11
 
 ### Added
 
@@ -48,11 +84,19 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Codex configuration rewrites now use TOML-aware parsing and validation rather
   than line-oriented edits, including safe CLI start/stop toggles for the
   managed block.
-- The status dashboard uses compact provider groups, keeps account headers
-  visible in short terminals, and exposes the fleet-wide weekly-full count.
+- The status dashboard has been redesigned with a more compact layout,
+  allowing even more accounts to be displayed at once. Compact provider
+  groups keep account headers visible in short terminals, and the dashboard
+  exposes the fleet-wide weekly-full count.
 
 ### Fixed
 
+- OpenAI Responses function calls and their outputs remain top-level input
+  items across the Anthropic Messages bridge. JSON and SSE responses now
+  preserve call IDs, streamed or atomic arguments, refusal text, and
+  `tool_use` stop reasons. Invalid metadata, malformed arguments, and tool
+  streams that end before completion fail closed instead of fabricating a
+  successful assistant turn.
 - `/v1/models` reports real context windows and includes bare `gpt-*` slugs used
   by the Codex CLI.
 - Codex routing accepts both dashed session-header spellings, logs route
@@ -670,8 +714,7 @@ cache-aware session routing and a round of security hardening.
 - `http-proxy-middleware` 3.0.5 → 3.0.7 for GHSA-gcq2-9pq2-cxqm (high). The
   affected APIs are not used here.
 
-[0.12.0-rc.1]: https://github.com/Timo972/cc-router/releases/tag/v0.12.0-rc.1
-[0.12.0-rc.0]: https://github.com/Timo972/cc-router/releases/tag/v0.12.0-rc.0
+[0.12.0]: https://github.com/Timo972/cc-router/releases/tag/v0.12.0
 [0.11.0]: https://github.com/Timo972/cc-router/releases/tag/v0.11.0
 [0.9.0]: https://github.com/Timo972/cc-router/releases/tag/v0.9.0
 [0.8.3]: https://github.com/Timo972/cc-router/releases/tag/v0.8.3

package/README.md

@@ -588,11 +588,30 @@ The dashboard is also a control surface. In local mode it controls the local pro
 | `e` | Enable/disable selected Claude account |
 | `w` / `s` | Change selected Claude account weekly/session cap |
 | `d` | Delete selected Claude account |
+| `Ctrl+R` | Confirm redeeming one banked usage-limit reset for the focused ChatGPT account |
+| `R` | Reload account usage and due credentials without restarting the router |
 | `m` / `r` | Load or refresh discovered provider models |
 | `c` | Toggle Claude Code routing (or set Claude model default when MODELS is focused) |
 | `x` | Toggle Codex CLI routing (proxy stays up) |
 | `o` | Set selected `openai/*` model as OpenAI default |
 
+To redeem a ChatGPT reset, press `Tab` to focus accounts, select the account
+with the arrow keys, then press `Ctrl+R` and confirm with `y` (`n` or `Esc`
+cancels). The `rst` column shows banked reset credits. Accounts with zero or
+unknown credits cannot start a new redemption. This spends a real reset credit;
+it is not the same as refreshing usage with uppercase `R`.
+
+Press **Control + R** (not Command + R or Shift + R). This uses the standard
+terminal Ctrl+R sequence and does not require a custom Meta/Option key mapping.
+
+Redemption targets only that account and refreshes its usage afterward. If the
+network outcome is unknown, keep the dashboard open and retry the shortcut: it
+reuses the same redemption ID instead of spending another credit. Those retry
+IDs are held for the current dashboard session only; after restarting it,
+inspect usage before requesting another reset. A successful redemption with a
+failed usage refresh is reported separately. Confirmed resets plus fresh usage clear only superseded quota cooldowns.
+Overload holds, unreported/exhausted limits, and newer quota signals are preserved.
+
 List and change models without waiting for a package update:
 
 ```bash

package/dist/providers/openai/account-state.js

@@ -53,6 +53,7 @@ export function createOpenAIAccount(record) {
         lastRefresh: 0,
         rateLimits,
         modelBuckets: new Map(),
+        authState: "ok",
     };
 }
 /**

package/dist/providers/openai/codex-transport.js

@@ -1,18 +1,33 @@
+import { createHeaderDeadline, withStreamIdleTimeout } from "../../proxy/transport-timing.js";
 const CODEX_RESPONSES_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
 const DEFAULT_CODEX_INSTRUCTIONS = "You are a concise coding assistant.";
 export async function forwardOpenAICodexResponse(opts) {
     const body = toCodexBackendRequest(opts.body);
-    const upstream = await fetch(CODEX_RESPONSES_ENDPOINT, {
-        method: "POST",
-        headers: {
-            authorization: `Bearer ${opts.account.accessToken}`,
-            "content-type": "application/json",
-            accept: "text/event-stream",
-        },
-        body: JSON.stringify(body),
-        ...(opts.signal ? { signal: opts.signal } : {}),
-    });
-    return ensureEventStreamContentType(upstream);
+    const deadline = createHeaderDeadline(opts.timeoutMs, opts.signal);
+    let upstream;
+    try {
+        upstream = await fetch(CODEX_RESPONSES_ENDPOINT, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${opts.account.accessToken}`,
+                "content-type": "application/json",
+                accept: "text/event-stream",
+            },
+            body: JSON.stringify(body),
+            ...(deadline.signal ? { signal: deadline.signal } : {}),
+        });
+    }
+    finally {
+        // The header deadline must not become an absolute generation deadline.
+        // Body progress and cancellation are owned by the stream wrapper below.
+        deadline.dispose();
+    }
+    const timedBody = withStreamIdleTimeout(upstream.body, opts.timeoutMs, opts.signal);
+    return ensureEventStreamContentType(new Response(timedBody, {
+        status: upstream.status,
+        statusText: upstream.statusText,
+        headers: upstream.headers,
+    }));
 }
 export function toCodexBackendRequest(body) {
     const { max_output_tokens: _maxOutputTokens, ...rest } = body;

package/dist/providers/openai/device-oauth.js

@@ -1,6 +1,6 @@
 import { createOpenAIAccountRecord } from "./account-record.js";
 const DEFAULT_ISSUER = "https://auth.openai.com";
-const DEFAULT_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export const DEFAULT_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const DEFAULT_SCOPE = "openid profile email offline_access";
 const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
 function issuerOf(opts) {

package/dist/providers/openai/token-pool.js

@@ -69,8 +69,13 @@ export class OpenAITokenPool {
         // Each cause extends its own horizon, so neither can misrepresent the
         // other's duration in either direction.
         state.globalUntil = Math.max(state.globalUntil, expiry);
-        if (cause === "rate_limit")
+        if (cause === "rate_limit") {
             state.rateLimitedUntil = Math.max(state.rateLimitedUntil, expiry);
+            state.quotaRevision++;
+        }
+        else {
+            state.unavailableUntil = Math.max(state.unavailableUntil, expiry);
+        }
     }
     setBucketCooldownForAccount(account, limitId, durationMs) {
         const expiry = this.proposedExpiry(account, durationMs);
@@ -80,6 +85,7 @@ export class OpenAITokenPool {
         if (!state.bucketUntil.has(limitId))
             this.makeRoomForBucketCooldown(state);
         state.bucketUntil.set(limitId, Math.max(state.bucketUntil.get(limitId) ?? 0, expiry));
+        state.quotaRevision++;
     }
     /**
      * Keep `bucketUntil` bounded before a new limit id is added. Every distinct
@@ -114,6 +120,31 @@ export class OpenAITokenPool {
         if (soonestId !== undefined)
             state.bucketUntil.delete(soonestId);
     }
+    /** Capture before a redemption. Apply only after confirmed redemption and a
+     * fresh post-redemption usage fetch. New quota evidence conservatively fences
+     * the whole reconciliation; unrelated overload holds retain their own expiry. */
+    captureUsageReset(account) {
+        const state = this.cooldowns.get(account);
+        const revision = state?.quotaRevision;
+        return update => {
+            if (!state || this.findById(account.id) !== account
+                || this.cooldowns.get(account) !== state || state.quotaRevision !== revision)
+                return;
+            for (const bucket of update.buckets) {
+                const windows = [bucket.primary, bucket.secondary].filter(window => window !== undefined);
+                // An omitted bucket/window is not evidence of recovery. Exhaustion in
+                // retained windows is still independently enforced by hardBlock().
+                if (windows.length === 0 || windows.some(window => window.utilization >= 1))
+                    continue;
+                if (bucket.limitId === DEFAULT_CODEX_LIMIT_ID) {
+                    state.rateLimitedUntil = 0;
+                    state.globalUntil = state.unavailableUntil;
+                }
+                state.bucketUntil.delete(bucket.limitId);
+            }
+            this.sweepExpiredCooldowns();
+        };
+    }
     getCooldownView(accountId) {
         const account = this.findById(accountId);
         if (!account)
@@ -220,6 +251,8 @@ export class OpenAITokenPool {
         return this.accounts;
     }
     hardBlock(account, context) {
+        if (account.authState === "quarantined")
+            return { reason: "unavailable" };
         if (!account.enabled || !account.healthy)
             return { reason: "unavailable" };
         const nowMs = this.now();
@@ -349,7 +382,7 @@ export class OpenAITokenPool {
     cooldownsFor(account) {
         let state = this.cooldowns.get(account);
         if (!state) {
-            state = { globalUntil: 0, rateLimitedUntil: 0, bucketUntil: new Map() };
+            state = { globalUntil: 0, rateLimitedUntil: 0, unavailableUntil: 0, quotaRevision: 0, bucketUntil: new Map() };
             this.cooldowns.set(account, state);
         }
         return state;
@@ -361,6 +394,8 @@ export class OpenAITokenPool {
             return false;
         const now = this.now();
         let recovered = false;
+        if (state.unavailableUntil > 0 && state.unavailableUntil <= now)
+            state.unavailableUntil = 0;
         if (state.rateLimitedUntil > 0 && state.rateLimitedUntil <= now)
             state.rateLimitedUntil = 0;
         if (state.globalUntil > 0 && state.globalUntil <= now) {

package/dist/providers/openai/token-refresher.js

@@ -1,8 +1,13 @@
 import { decodeOpenAIPlan } from "./usage.js";
+import { createHeaderDeadline } from "../../proxy/transport-timing.js";
+import { logError } from "../../proxy/logger.js";
+import { createCorrelationId, formatTransportDiagnostic, safeCauseCode, } from "../../proxy/transport-diagnostics.js";
+import { DEFAULT_CLIENT_ID } from "./device-oauth.js";
 const TOKEN_ENDPOINT = "https://auth.openai.com/oauth/token";
 const REFRESH_BUFFER_MS = 10 * 60 * 1000;
 const CHECK_INTERVAL_MS = 5 * 60 * 1000;
-const refreshLocks = new Map();
+export const OPENAI_REFRESH_TIMEOUT_MS = 15_000;
+const refreshLocks = new WeakMap();
 /**
  * Accounts whose most recently rotated credentials have NOT been confirmed
  * on disk. Identity-keyed (by object reference, not `account.id`) so a
@@ -63,20 +68,22 @@ export function needsOpenAIRefresh(account) {
     return account.expiresAt - Date.now() < REFRESH_BUFFER_MS;
 }
 export async function refreshOpenAISubscriptionToken(account) {
-    const existing = refreshLocks.get(account.id);
+    const existing = refreshLocks.get(account);
     if (existing)
         return existing;
     const promise = doRefresh(account);
-    refreshLocks.set(account.id, promise);
+    refreshLocks.set(account, promise);
     try {
         return await promise;
     }
     finally {
-        refreshLocks.delete(account.id);
+        refreshLocks.delete(account);
     }
 }
 export async function prepareOpenAIAccountForRequest(account, allAccounts, saveAccounts) {
-    if (!needsOpenAIRefresh(account)) {
+    const runtime = account;
+    // A revoked but unexpired access token must not bypass the refresh gate.
+    if (!needsOpenAIRefresh(account) && runtime.authState !== "quarantined") {
         // No refresh due, but a previous rotation from this account never made it
         // to disk (e.g. a transient disk-full). This is the retry path: piggyback
         // on this otherwise-idle request to flush the still-current in-memory
@@ -104,63 +111,151 @@ export async function refreshAndPersistOpenAIAccount(account, allAccounts, saveA
         persistCredentials(account, allAccounts, saveAccounts);
     return ok;
 }
-export function startOpenAIRefreshLoop(accounts, saveAccounts) {
-    const check = async () => {
-        for (const account of accounts) {
-            // One account's refresh throwing must not skip every account after it
-            // in this tick — isolate failures per-account.
-            try {
-                await prepareOpenAIAccountForRequest(account, accounts, saveAccounts);
-            }
-            catch (error) {
-                console.error(error);
-            }
+/**
+ * One scheduled refresh pass over every OpenAI account: due tokens are
+ * refreshed, quarantined ones re-tried. Shared by the background loop and
+ * the manual reload endpoint so both isolate failures per account the same
+ * way. Returns how many accounts did not come out with usable credentials —
+ * an expected refresh rejection counts, not only a thrown error.
+ */
+export async function refreshOpenAIAccountsOnce(accounts, saveAccounts, options = {}) {
+    let failed = 0;
+    for (const account of [...accounts]) {
+        // One account's refresh throwing must not skip every account after it
+        // in this tick — isolate failures per-account.
+        try {
+            if (!await prepareOpenAIAccountForRequest(account, accounts, saveAccounts))
+                failed++;
+        }
+        catch (error) {
+            failed++;
+            (options.onError ?? console.error)(error);
         }
-    };
+    }
+    return { failed };
+}
+export function startOpenAIRefreshLoop(accounts, saveAccounts) {
+    const check = () => refreshOpenAIAccountsOnce(accounts, saveAccounts);
     const timer = setInterval(() => { check().catch(console.error); }, CHECK_INTERVAL_MS);
     queueMicrotask(() => { check().catch(console.error); });
     return () => clearInterval(timer);
 }
+function refreshErrorCode(payload, depth = 0) {
+    if (typeof payload === "string")
+        return payload;
+    if (depth >= 3 || typeof payload !== "object" || payload === null)
+        return undefined;
+    const record = payload;
+    for (const key of ["code", "type", "error"]) {
+        const code = refreshErrorCode(record[key], depth + 1);
+        if (code)
+            return code;
+    }
+    return undefined;
+}
+function rejectIsPermanent(status, payload) {
+    if (status !== 400 && status !== 401)
+        return false;
+    const code = refreshErrorCode(payload);
+    // `token_expired` is the code the real endpoint returns for a refresh token it
+    // can no longer validate; like the OAuth2-standard codes it means re-auth, not
+    // a retriable blip, so it must quarantine rather than cooldown-loop forever.
+    return code === "invalid_grant" || code === "invalid_token" || code === "token_revoked" || code === "token_expired";
+}
+function markRefreshFailure(account, permanent) {
+    const runtime = account;
+    if (permanent) {
+        runtime.authFailure = "permanent";
+        runtime.authState = "quarantined";
+    }
+    else if (runtime.authState !== "quarantined") {
+        runtime.authFailure = "transient";
+    }
+}
+function logRefreshFailure(account, correlationId, status, error) {
+    logError(account.id, status !== undefined && status >= 400 ? status : 0, formatTransportDiagnostic({
+        correlationId,
+        operation: "refresh",
+        ...(status !== undefined ? { status } : {}),
+        causeCode: safeCauseCode(error),
+    }));
+}
 async function doRefresh(account) {
     const body = new URLSearchParams({
         grant_type: "refresh_token",
         refresh_token: account.refreshToken,
+        // The token endpoint validates client_id before the grant; without it the
+        // refresh 400s as `missing_required_parameter` and never reaches token
+        // validation. Same public client the tokens were minted under (device-oauth).
+        client_id: DEFAULT_CLIENT_ID,
     });
     let data;
+    let responseStatus;
+    const correlationId = createCorrelationId();
+    const deadline = createHeaderDeadline(OPENAI_REFRESH_TIMEOUT_MS);
     try {
         const res = await fetch(TOKEN_ENDPOINT, {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: body.toString(),
+            signal: deadline.signal,
         });
-        if (!res.ok)
+        responseStatus = res.status;
+        if (!res.ok) {
+            let payload;
+            try {
+                payload = await res.json();
+            }
+            catch { /* intentionally do not retain response bodies */ }
+            markRefreshFailure(account, rejectIsPermanent(res.status, payload));
+            logRefreshFailure(account, correlationId, res.status);
             return false;
+        }
         data = await res.json();
     }
-    catch {
+    catch (error) {
         // Network failure (or malformed response body) must resolve to `false`,
         // exactly like a non-ok HTTP response — never propagate as a rejection.
+        markRefreshFailure(account, false);
+        logRefreshFailure(account, correlationId, responseStatus, error);
         return false;
     }
+    finally {
+        // OAuth is a small JSON exchange: unlike inference, the deadline covers
+        // both headers and body parsing so a stalled body cannot retain the lock.
+        deadline.dispose();
+    }
     // A 200 with an unusable payload is a failed refresh, not a successful one.
     // Writing it through would leave `expiresAt` as NaN, which then reads as
     // "never needs refreshing" in `needsOpenAIRefresh` and permanently strands
     // the account on a broken token.
-    if (typeof data?.access_token !== "string" || data.access_token.length === 0)
+    if (typeof data?.access_token !== "string" || data.access_token.length === 0) {
+        markRefreshFailure(account, false);
+        logRefreshFailure(account, correlationId, 200);
         return false;
+    }
     // The lifetime has to be positive and has to still name a finite instant
     // once converted. A zero or negative `expires_in` would report success on a
     // token that is already due for another refresh, so every request re-enters
     // the refresh path; a value big enough to overflow the multiplication would
     // set `expiresAt` to Infinity, which `needsOpenAIRefresh` can never reach —
     // the same permanent strand as NaN, from the opposite direction.
-    if (typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in))
+    if (typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in)) {
+        markRefreshFailure(account, false);
+        logRefreshFailure(account, correlationId, 200);
         return false;
-    if (data.expires_in <= 0)
+    }
+    if (data.expires_in <= 0) {
+        markRefreshFailure(account, false);
+        logRefreshFailure(account, correlationId, 200);
         return false;
+    }
     const expiresAt = Date.now() + data.expires_in * 1000;
-    if (!Number.isFinite(expiresAt))
+    if (!Number.isFinite(expiresAt)) {
+        markRefreshFailure(account, false);
+        logRefreshFailure(account, correlationId, 200);
         return false;
+    }
     account.accessToken = data.access_token;
     account.refreshToken = data.refresh_token ?? account.refreshToken;
     account.expiresAt = expiresAt;
@@ -175,6 +270,8 @@ async function doRefresh(account) {
         runtime.consecutiveErrors = 0;
     if (runtime.lastRefresh !== undefined)
         runtime.lastRefresh = Date.now();
+    runtime.authState = "ok";
+    runtime.authFailure = undefined;
     // The rotated access token can carry a different plan than the one decoded
     // at account creation (e.g. a Plus->Pro upgrade). Mirrors createOpenAIAccount's
     // semantics: only overwrite when the new token actually decodes a plan claim —

package/dist/providers/openai/usage-fetch.js

@@ -66,8 +66,21 @@ export class OpenAIUsageRefresher extends UsageRefresher {
             },
             cancelledResult: () => ({ ok: false, reason: "network" }),
             applyResult: (account, result) => {
-                if (result.ok)
+                if (result.ok) {
                     applyCodexRateLimits(account, result.update, now());
+                    // A successful authenticated poll clears only the advisory usage
+                    // trouble state; permanent OAuth quarantine is owned by refresh.
+                    if (account.authFailure === "transient")
+                        account.authFailure = undefined;
+                }
+                else if (result.reason === "auth") {
+                    // A usage endpoint 403 can be entitlement/scope related. Surface it
+                    // as transient diagnostic state but never quarantine on this alone.
+                    // Refresh owns permanent quarantine, so an advisory poll must not
+                    // overwrite that stronger diagnosis.
+                    if (account.authState !== "quarantined")
+                        account.authFailure = "transient";
+                }
             },
             ...(options.now !== undefined ? { now: options.now } : {}),
             ...(options.startupStaggerMs !== undefined ? { startupStaggerMs: options.startupStaggerMs } : {}),

package/dist/providers/openai/usage-reset.js

@@ -0,0 +1,30 @@
+export async function consumeCodexResetCredit(account, redeemRequestId) {
+    // Contract: openai/codex 1715e55076737158ba61d43158ede504de6d4ce1,
+    // codex-rs/backend-client/src/client/rate_limit_resets.rs and types.rs.
+    // Never retry a spend with a fresh ID: a lost response may have consumed it.
+    try {
+        const response = await fetch("https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume", {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${account.accessToken}`,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({ redeem_request_id: redeemRequestId }),
+            signal: AbortSignal.timeout(10_000),
+            redirect: "error",
+        });
+        if (response.ok) {
+            const body = await response.json();
+            if (body && typeof body === "object" && "code" in body) {
+                const code = body.code;
+                if (code === "reset" || code === "nothing_to_reset" || code === "no_credit" || code === "already_redeemed") {
+                    return { code };
+                }
+            }
+        }
+    }
+    catch {
+        // Do not relay upstream bodies, credentials, or network error details.
+    }
+    throw new Error("Reset outcome unknown; retry with the same redemption ID");
+}

package/dist/proxy/account-usage-reset.js

@@ -0,0 +1,64 @@
+export function createUsageResetHandler(options) {
+    const inFlight = new WeakSet();
+    // One retained snapshot per account allows an uncertain retry to reconcile
+    // using the ORIGINAL quota evidence, not quota learned after the first spend.
+    const snapshots = new WeakMap();
+    return async (req, res) => {
+        const id = req.params.id;
+        const requestId = req.body?.redeemRequestId;
+        if (typeof requestId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(requestId)) {
+            res.status(400).json({ error: "redeemRequestId must be a UUID" });
+            return;
+        }
+        const account = options.findAccount(id);
+        if (!account) {
+            res.status(404).json({ error: "ChatGPT account not found" });
+            return;
+        }
+        if (inFlight.has(account)) {
+            res.status(409).json({ error: "Reset already running for this account" });
+            return;
+        }
+        inFlight.add(account);
+        try {
+            if (!await options.prepare(account)) {
+                res.status(503).json({ error: "Account credentials unavailable; reset not submitted" });
+                return;
+            }
+            if (options.findAccount(id) !== account) {
+                res.status(404).json({ error: "ChatGPT account changed; reset not submitted" });
+                return;
+            }
+            const previous = snapshots.get(account);
+            const replay = previous?.id === requestId;
+            const snapshot = replay ? previous : { id: requestId, reconcile: options.captureReset?.(account) };
+            snapshots.set(account, snapshot);
+            const result = await options.consume(account, requestId);
+            if (result.code === "already_redeemed" && !replay) {
+                // This UUID predates our ownership. Repeated historical replays must
+                // never promote its newly captured quota snapshot into trusted evidence.
+                snapshot.reconcile = undefined;
+            }
+            // Refresh even for no_credit/nothing_to_reset: the displayed snapshot may
+            // be stale. Never fabricate windows or decrement credits locally.
+            let usageRefreshed = false;
+            if (options.findAccount(id) === account) {
+                try {
+                    const usage = await options.refresh(account);
+                    usageRefreshed = usage.ok;
+                    if (usage.ok && (result.code === "reset" || (result.code === "already_redeemed" && replay))) {
+                        snapshot.reconcile?.(usage.update);
+                    }
+                }
+                catch { /* retain confirmed redemption */ }
+            }
+            res.json({ reset: { ...result, usageRefreshed } });
+        }
+        catch {
+            res.status(502).json({ error: "Reset outcome unknown; retry with the same redemption ID" });
+        }
+        finally {
+            inFlight.delete(account);
+        }
+    };
+}