@timo972/cc-router 0.9.0 → 0.10.0-rc.0

package/dist/providers/openai/token-pool.js

@@ -0,0 +1,401 @@
+import { EmptyPoolError, NoEligibleAccountError, } from "../../proxy/account-pool.js";
+import { bucketForModel, bucketIdForModel, sweepCodexRateLimits } from "./account-state.js";
+import { DEFAULT_CODEX_LIMIT_ID } from "./usage.js";
+const MAX_TRUSTED_RATE_LIMIT_RESET_MS = 8 * 24 * 60 * 60 * 1_000;
+/** Matches the bucket-snapshot cap in account-state.ts: a real account has the
+ *  default bucket plus a handful of metered ones, never dozens. */
+const MAX_BUCKET_COOLDOWN_ENTRIES = 16;
+export class OpenAITokenPool {
+    accounts;
+    inFlight = new Map();
+    cooldowns = new Map();
+    now;
+    currentIndex = 0;
+    onCapBypass;
+    onCooldownExpired;
+    constructor(accounts, options = {}) {
+        this.accounts = accounts;
+        this.now = options.now ?? Date.now;
+    }
+    acquireBest(activeSessions, context) {
+        if (this.accounts.length === 0) {
+            throw new EmptyPoolError("OpenAI token pool is empty — add an account first");
+        }
+        this.sweepExpiredCooldowns();
+        const hardBlocks = new Map();
+        const hardEligible = this.accounts.filter(account => {
+            const block = this.hardBlock(account, context);
+            if (block)
+                hardBlocks.set(account, block);
+            return block === null;
+        });
+        const withinUserCaps = hardEligible.filter(account => !this.overUserCap(account));
+        if (withinUserCaps.length > 0) {
+            const account = this.selectEligible(withinUserCaps, activeSessions, context);
+            this.advanceCursor(account);
+            return this.createLease(account, false);
+        }
+        if (hardEligible.length > 0) {
+            const account = this.selectEligible(hardEligible, activeSessions, context);
+            this.advanceCursor(account);
+            this.onCapBypass?.(account);
+            return this.createLease(account, true);
+        }
+        const rateLimited = [...hardBlocks.values()].filter(block => block.reason === "rate_limited");
+        const retryTimes = rateLimited
+            .map(block => block.retryAtMs)
+            .filter((retryAtMs) => retryAtMs !== undefined);
+        throw new NoEligibleAccountError(rateLimited.length > 0 ? "rate_limited" : "unavailable", this.accounts.length, retryTimes.length > 0 ? Math.min(...retryTimes) : undefined);
+    }
+    tryAcquire(accountId, context) {
+        const account = this.findById(accountId);
+        if (!account)
+            return null;
+        const now = this.now();
+        sweepCodexRateLimits(account, now, { isRetained: limitId => this.isBucketCoolingDown(account, limitId, now) });
+        this.clearExpiredCooldownState(account);
+        if (this.hardBlock(account, context) || this.overUserCap(account))
+            return null;
+        return this.createLease(account, false);
+    }
+    getInFlight(accountId) {
+        return this.inFlight.get(accountId) ?? 0;
+    }
+    setGlobalCooldownForAccount(account, durationMs, cause) {
+        const expiry = this.proposedExpiry(account, durationMs);
+        if (expiry === undefined)
+            return;
+        const state = this.cooldownsFor(account);
+        // Each cause extends its own horizon, so neither can misrepresent the
+        // other's duration in either direction.
+        state.globalUntil = Math.max(state.globalUntil, expiry);
+        if (cause === "rate_limit")
+            state.rateLimitedUntil = Math.max(state.rateLimitedUntil, expiry);
+    }
+    setBucketCooldownForAccount(account, limitId, durationMs) {
+        const expiry = this.proposedExpiry(account, durationMs);
+        if (expiry === undefined)
+            return;
+        const state = this.cooldownsFor(account);
+        if (!state.bucketUntil.has(limitId))
+            this.makeRoomForBucketCooldown(state);
+        state.bucketUntil.set(limitId, Math.max(state.bucketUntil.get(limitId) ?? 0, expiry));
+    }
+    /**
+     * Keep `bucketUntil` bounded before a new limit id is added. Every distinct
+     * `x-codex-active-limit` value an upstream 429 reports creates an entry that
+     * can live for up to the trust horizon, so without a cap a buggy (or
+     * hostile) upstream cycling fresh ids would grow this map with request
+     * volume — the bucket snapshots and model mappings are already capped, this
+     * was the one unbounded piece of per-account state.
+     *
+     * Expired entries go first since they no longer block anything. If that is
+     * not enough, the soonest-to-expire entry is dropped: it is the one with the
+     * least protection left to lose.
+     */
+    makeRoomForBucketCooldown(state) {
+        if (state.bucketUntil.size < MAX_BUCKET_COOLDOWN_ENTRIES)
+            return;
+        const now = this.now();
+        for (const [limitId, until] of state.bucketUntil) {
+            if (until <= now)
+                state.bucketUntil.delete(limitId);
+        }
+        if (state.bucketUntil.size < MAX_BUCKET_COOLDOWN_ENTRIES)
+            return;
+        let soonestId;
+        let soonestUntil = Number.POSITIVE_INFINITY;
+        for (const [limitId, until] of state.bucketUntil) {
+            if (until < soonestUntil) {
+                soonestId = limitId;
+                soonestUntil = until;
+            }
+        }
+        if (soonestId !== undefined)
+            state.bucketUntil.delete(soonestId);
+    }
+    getCooldownView(accountId) {
+        const account = this.findById(accountId);
+        if (!account)
+            return { globalUntilMs: 0, bucketCooldowns: [] };
+        this.clearExpiredCooldownState(account);
+        const state = this.cooldowns.get(account);
+        if (!state)
+            return { globalUntilMs: 0, bucketCooldowns: [] };
+        return {
+            globalUntilMs: state.globalUntil,
+            bucketCooldowns: [...state.bucketUntil]
+                .sort(([left], [right]) => left.localeCompare(right))
+                .slice(0, 12)
+                .map(([limitId, untilMs]) => ({ limitId, untilMs })),
+        };
+    }
+    /**
+     * The account-wide (global-scope) cooldown expiry only — never a
+     * bucket-scoped one. A niche model bucket's cooldown must not make the
+     * whole account appear busy, and a long global cooldown must not be
+     * reported as "recovering soon" just because some unrelated bucket
+     * cooldown happens to expire sooner. Per-bucket cooldowns remain visible
+     * individually via `getCooldownView`.
+     */
+    getGlobalCooldownUntil(accountId) {
+        return this.getCooldownView(accountId).globalUntilMs;
+    }
+    isCoolingDown(accountId) {
+        return this.getGlobalCooldownUntil(accountId) > 0;
+    }
+    sweepExpiredCooldowns() {
+        const now = this.now();
+        for (const account of this.accounts) {
+            // Read cooldown retention before clearExpiredCooldownState (below)
+            // deletes any bucketUntil entry that just expired — a bucket must stay
+            // retained through this exact sweep for as long as its cooldown is
+            // still live at `now`, not react to the expiry the same call is about
+            // to perform.
+            const windowRecovered = sweepCodexRateLimits(account, now, {
+                isRetained: limitId => this.isBucketCoolingDown(account, limitId, now),
+            });
+            const cooldownRecovered = this.clearExpiredCooldownState(account);
+            // Read the account's global cooldown directly: the account object is
+            // already in hand here, so going through isCoolingDown() would re-scan
+            // the pool by id and rebuild the sorted public cooldown view once per
+            // account, making this sweep quadratic for no gain.
+            const globalUntil = this.cooldowns.get(account)?.globalUntil ?? 0;
+            if (account.rateLimits.status === "rate_limited" && globalUntil <= 0) {
+                const defaultBucket = account.rateLimits.buckets.get(DEFAULT_CODEX_LIMIT_ID);
+                const exhausted = [defaultBucket?.primary, defaultBucket?.secondary]
+                    .some(window => window !== undefined && window.utilization >= 1);
+                if (!exhausted)
+                    account.rateLimits.status = "ok";
+            }
+            if (windowRecovered || cooldownRecovered)
+                this.onCooldownExpired?.(account);
+        }
+    }
+    findById(id) {
+        return this.accounts.find(account => account.id === id) ?? null;
+    }
+    /**
+     * Drop every piece of per-account routing state after the account has been
+     * removed from the shared `accounts` array. The array splice itself is owned
+     * by the deletion transaction (it persists a prospective state first), so
+     * this only clears what the pool holds on the side.
+     *
+     * Without this, `createLease`'s release guard (`findById(id) !== account`)
+     * means an in-flight request on a deleted account never decrements its
+     * counter, and re-adding the same id inherits a phantom in-flight count that
+     * permanently deprioritizes it in `selectEligible`. Mirrors the cleanup in
+     * the Anthropic `TokenPool.removeAccount`.
+     */
+    forgetAccount(account) {
+        this.cooldowns.delete(account);
+        this.inFlight.delete(account.id);
+        this.currentIndex = this.accounts.length === 0
+            ? 0
+            : this.currentIndex % this.accounts.length;
+    }
+    getAll() {
+        return this.accounts;
+    }
+    hardBlock(account, context) {
+        if (!account.enabled || !account.healthy)
+            return { reason: "unavailable" };
+        const nowMs = this.now();
+        const timedBlockers = [];
+        let hasIndefiniteBlocker = false;
+        // Two separate questions. `blocked` decides whether this account can take
+        // the request at all; `rateLimited` decides what a caller is told when no
+        // account can. Every blocker answers the first — only a spent quota
+        // answers the second, because only that is something the caller can wait
+        // out, and only that carries a `Retry-After` worth honouring.
+        let blocked = false;
+        let rateLimited = false;
+        const state = this.cooldowns.get(account);
+        if (state !== undefined && state.globalUntil > nowMs) {
+            blocked = true;
+            // A 401, a 503/529 overload, or a local refresh failure blocks just as
+            // hard, but answering 429 for quota the caller never spent sends it
+            // looking in entirely the wrong place. The retry hint follows the quota
+            // horizon rather than the whole block: it is only ever emitted with a
+            // rate-limit answer, and it should say when the quota frees up.
+            if (state.rateLimitedUntil > nowMs) {
+                rateLimited = true;
+                timedBlockers.push(state.rateLimitedUntil);
+            }
+        }
+        const blockingWindows = [];
+        const defaultBucket = account.rateLimits.buckets.get(DEFAULT_CODEX_LIMIT_ID);
+        for (const window of [defaultBucket?.primary, defaultBucket?.secondary]) {
+            if (window !== undefined && window.utilization >= 1)
+                blockingWindows.push(window);
+        }
+        // A bucket cooldown can be learned from a header-only 429 that carried no
+        // rate-limit snapshot for that bucket (`setBucketCooldownForAccount` was
+        // called, but `account.rateLimits.buckets` has no entry for it yet).
+        // Resolve the model's mapped limitId independently of whether a bucket
+        // snapshot exists so that cooldown is still enforced; the window-based
+        // exhaustion check below still only applies when a snapshot is present.
+        const modelLimitId = bucketIdForModel(account, context?.requestedModel);
+        if (modelLimitId !== undefined) {
+            const bucketCooldown = state?.bucketUntil.get(modelLimitId) ?? 0;
+            if (bucketCooldown > nowMs) {
+                // Bucket cooldowns come only from a 429 naming an active limit.
+                blocked = true;
+                rateLimited = true;
+                timedBlockers.push(bucketCooldown);
+            }
+        }
+        const modelBucket = this.modelBucket(account, context);
+        if (modelBucket !== undefined) {
+            for (const window of [modelBucket.primary, modelBucket.secondary]) {
+                if (window !== undefined && window.utilization >= 1)
+                    blockingWindows.push(window);
+            }
+        }
+        for (const window of blockingWindows) {
+            // An exhausted usage window is a spent quota by definition.
+            blocked = true;
+            rateLimited = true;
+            const resetMs = trustworthyResetMs(window.resetAt, nowMs);
+            if (resetMs !== undefined)
+                timedBlockers.push(resetMs);
+            else
+                hasIndefiniteBlocker = true;
+        }
+        if (!blocked)
+            return null;
+        if (!rateLimited)
+            return { reason: "unavailable" };
+        const retryAtMs = !hasIndefiniteBlocker && timedBlockers.length > 0
+            ? Math.max(...timedBlockers)
+            : undefined;
+        return retryAtMs === undefined
+            ? { reason: "rate_limited" }
+            : { reason: "rate_limited", retryAtMs };
+    }
+    modelBucket(account, context) {
+        return bucketForModel(account, context?.requestedModel);
+    }
+    /** True while `limitId` has an active bucket-scoped cooldown on `account`. */
+    isBucketCoolingDown(account, limitId, nowMs) {
+        return (this.cooldowns.get(account)?.bucketUntil.get(limitId) ?? 0) > nowMs;
+    }
+    overUserCap(account) {
+        const defaultBucket = account.rateLimits.buckets.get(DEFAULT_CODEX_LIMIT_ID);
+        const primaryUtil = defaultBucket?.primary?.utilization ?? 0;
+        const secondaryUtil = defaultBucket?.secondary?.utilization ?? 0;
+        return (account.sessionLimitPercent < 100 && primaryUtil * 100 >= account.sessionLimitPercent) ||
+            (account.weeklyLimitPercent < 100 && secondaryUtil * 100 >= account.weeklyLimitPercent);
+    }
+    headroomScore(account, context) {
+        const defaultBucket = account.rateLimits.buckets.get(DEFAULT_CODEX_LIMIT_ID);
+        const modelBucket = this.modelBucket(account, context);
+        return Math.max(capNormalizedUtilization(defaultBucket?.primary?.utilization ?? 0, account.sessionLimitPercent), capNormalizedUtilization(defaultBucket?.secondary?.utilization ?? 0, account.weeklyLimitPercent), modelBucket?.primary?.utilization ?? 0, modelBucket?.secondary?.utilization ?? 0);
+    }
+    selectEligible(candidates, activeSessions, context) {
+        return candidates.reduce((best, account) => {
+            const comparison = compareTuple([
+                this.getInFlight(account.id),
+                activeSessions.get(account.id) ?? 0,
+                this.headroomScore(account, context),
+                this.circularDistance(account),
+            ], [
+                this.getInFlight(best.id),
+                activeSessions.get(best.id) ?? 0,
+                this.headroomScore(best, context),
+                this.circularDistance(best),
+            ]);
+            return comparison < 0 ? account : best;
+        });
+    }
+    circularDistance(account) {
+        const index = this.accounts.indexOf(account);
+        return (index - this.currentIndex + this.accounts.length) % this.accounts.length;
+    }
+    advanceCursor(account) {
+        const index = this.accounts.indexOf(account);
+        this.currentIndex = (index + 1) % this.accounts.length;
+    }
+    proposedExpiry(account, durationMs) {
+        if (this.findById(account.id) !== account)
+            return undefined;
+        if (!Number.isFinite(durationMs) || durationMs <= 0)
+            return undefined;
+        const expiry = this.now() + durationMs;
+        return Number.isFinite(expiry) ? expiry : undefined;
+    }
+    cooldownsFor(account) {
+        let state = this.cooldowns.get(account);
+        if (!state) {
+            state = { globalUntil: 0, rateLimitedUntil: 0, bucketUntil: new Map() };
+            this.cooldowns.set(account, state);
+        }
+        return state;
+    }
+    /** Returns true when an active cooldown scope just expired. */
+    clearExpiredCooldownState(account) {
+        const state = this.cooldowns.get(account);
+        if (!state)
+            return false;
+        const now = this.now();
+        let recovered = false;
+        if (state.rateLimitedUntil > 0 && state.rateLimitedUntil <= now)
+            state.rateLimitedUntil = 0;
+        if (state.globalUntil > 0 && state.globalUntil <= now) {
+            state.globalUntil = 0;
+            recovered = true;
+        }
+        for (const [limitId, until] of state.bucketUntil) {
+            if (until <= now) {
+                state.bucketUntil.delete(limitId);
+                recovered = true;
+            }
+        }
+        if (state.globalUntil === 0 && state.bucketUntil.size === 0)
+            this.cooldowns.delete(account);
+        return recovered;
+    }
+    createLease(account, fallback) {
+        this.inFlight.set(account.id, this.getInFlight(account.id) + 1);
+        account.requestCount++;
+        account.lastUsed = this.now();
+        let released = false;
+        return {
+            account,
+            fallback,
+            release: () => {
+                if (released)
+                    return;
+                released = true;
+                if (this.findById(account.id) !== account)
+                    return;
+                const remaining = Math.max(0, this.getInFlight(account.id) - 1);
+                if (remaining === 0)
+                    this.inFlight.delete(account.id);
+                else
+                    this.inFlight.set(account.id, remaining);
+            },
+        };
+    }
+}
+function trustworthyResetMs(resetAtSeconds, nowMs) {
+    if (!Number.isFinite(resetAtSeconds) || resetAtSeconds <= 0)
+        return undefined;
+    const resetAtMs = Math.floor(resetAtSeconds) * 1_000;
+    if (resetAtMs <= nowMs)
+        return undefined;
+    return resetAtMs - nowMs <= MAX_TRUSTED_RATE_LIMIT_RESET_MS ? resetAtMs : undefined;
+}
+function capNormalizedUtilization(utilization, capPercent) {
+    const cap = Number.isFinite(capPercent) ? Math.max(0, capPercent / 100) : 1;
+    return cap === 0 ? Number.POSITIVE_INFINITY : utilization / cap;
+}
+function compareTuple(left, right) {
+    for (let i = 0; i < left.length; i++) {
+        const a = left[i] ?? 0;
+        const b = right[i] ?? 0;
+        if (a !== b)
+            return a - b;
+    }
+    return 0;
+}

package/dist/providers/openai/token-refresher.js

@@ -1,7 +1,64 @@
+import { decodeOpenAIPlan } from "./usage.js";
 const TOKEN_ENDPOINT = "https://auth.openai.com/oauth/token";
 const REFRESH_BUFFER_MS = 10 * 60 * 1000;
 const CHECK_INTERVAL_MS = 5 * 60 * 1000;
 const refreshLocks = new Map();
+/**
+ * Accounts whose most recently rotated credentials have NOT been confirmed
+ * on disk. Identity-keyed (by object reference, not `account.id`) so a
+ * deleted-then-re-added account can never inherit another object's dirty
+ * state just because it reused the same id, and a `WeakSet` so an account
+ * that's later removed from the pool can't leak here.
+ */
+const pendingCredentialWrites = new WeakSet();
+/** True when `account` has a rotated credential that has not yet been durably persisted. */
+export function hasPendingCredentialWrite(account) {
+    return pendingCredentialWrites.has(account);
+}
+/**
+ * Record that every account in `accounts` has reached disk.
+ *
+ * A whole-pool write makes all of them durable, not just whichever account
+ * prompted it — and those writes do not all come from a refresh. Adding,
+ * patching, or deleting an account rewrites the same file from the same live
+ * array, so a rotation that failed to persist earlier is on disk once any of
+ * those succeed. Without this, health keeps reporting `credentialsPendingWrite`
+ * for an account whose credentials are already saved, and later requests keep
+ * retrying a write that has already landed.
+ *
+ * Call it only after the write has actually returned.
+ */
+export function markOpenAICredentialsPersisted(accounts) {
+    for (const account of accounts)
+        pendingCredentialWrites.delete(account);
+}
+/**
+ * Centralizes every write of the account pool to disk so every caller shares
+ * the same durability bookkeeping: on success, clears the account's pending
+ * flag; on a throw (e.g. disk full, a bad custom `--accounts` path), (re)sets
+ * it and logs, but never propagates — the caller's fresh in-memory token
+ * remains usable even though it isn't on disk yet.
+ *
+ * Residual risk: if the process crashes before any retry of a dirty account
+ * succeeds, the rotated refresh token is lost from disk — and since OpenAI
+ * already invalidated the old one, that forces re-authentication. The retry
+ * cadence (the very next request via `prepareOpenAIAccountForRequest`, or at
+ * worst the refresh loop's next ≤5-minute tick) bounds how long that window
+ * stays open, but does not close it.
+ */
+function persistCredentials(account, allAccounts, saveAccounts) {
+    try {
+        saveAccounts(allAccounts);
+        markOpenAICredentialsPersisted(allAccounts);
+        pendingCredentialWrites.delete(account);
+        return true;
+    }
+    catch (error) {
+        pendingCredentialWrites.add(account);
+        console.error(error);
+        return false;
+    }
+}
 export function needsOpenAIRefresh(account) {
     return account.expiresAt - Date.now() < REFRESH_BUFFER_MS;
 }
@@ -19,17 +76,45 @@ export async function refreshOpenAISubscriptionToken(account) {
     }
 }
 export async function prepareOpenAIAccountForRequest(account, allAccounts, saveAccounts) {
-    if (!needsOpenAIRefresh(account))
+    if (!needsOpenAIRefresh(account)) {
+        // No refresh due, but a previous rotation from this account never made it
+        // to disk (e.g. a transient disk-full). This is the retry path: piggyback
+        // on this otherwise-idle request to flush the still-current in-memory
+        // token, without blocking or failing the request either way.
+        if (hasPendingCredentialWrite(account))
+            persistCredentials(account, allAccounts, saveAccounts);
         return true;
+    }
+    // The refreshed token is already live in memory, so a persistence failure
+    // must not fail this request — it only means the new token isn't on disk
+    // yet. `persistCredentials` marks the account dirty so the write is retried
+    // (here, or by the refresh loop) instead of silently losing the rotation.
+    return refreshAndPersistOpenAIAccount(account, allAccounts, saveAccounts);
+}
+/**
+ * Refreshes `account`'s token if needed and persists the pool. Used both by
+ * `prepareOpenAIAccountForRequest`'s refresh-due branch and by callers that
+ * want to force a refresh outside of that gate (e.g. reacting to an upstream
+ * 401). Always returns the refresh outcome — a persistence failure never
+ * turns a successful refresh into a `false` result.
+ */
+export async function refreshAndPersistOpenAIAccount(account, allAccounts, saveAccounts) {
     const ok = await refreshOpenAISubscriptionToken(account);
     if (ok)
-        saveAccounts(allAccounts);
+        persistCredentials(account, allAccounts, saveAccounts);
     return ok;
 }
 export function startOpenAIRefreshLoop(accounts, saveAccounts) {
     const check = async () => {
         for (const account of accounts) {
-            await prepareOpenAIAccountForRequest(account, accounts, saveAccounts);
+            // One account's refresh throwing must not skip every account after it
+            // in this tick — isolate failures per-account.
+            try {
+                await prepareOpenAIAccountForRequest(account, accounts, saveAccounts);
+            }
+            catch (error) {
+                console.error(error);
+            }
         }
     };
     const timer = setInterval(() => { check().catch(console.error); }, CHECK_INTERVAL_MS);
@@ -41,16 +126,64 @@ async function doRefresh(account) {
         grant_type: "refresh_token",
         refresh_token: account.refreshToken,
     });
-    const res = await fetch(TOKEN_ENDPOINT, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: body.toString(),
-    });
-    if (!res.ok)
+    let data;
+    try {
+        const res = await fetch(TOKEN_ENDPOINT, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: body.toString(),
+        });
+        if (!res.ok)
+            return false;
+        data = await res.json();
+    }
+    catch {
+        // Network failure (or malformed response body) must resolve to `false`,
+        // exactly like a non-ok HTTP response — never propagate as a rejection.
+        return false;
+    }
+    // A 200 with an unusable payload is a failed refresh, not a successful one.
+    // Writing it through would leave `expiresAt` as NaN, which then reads as
+    // "never needs refreshing" in `needsOpenAIRefresh` and permanently strands
+    // the account on a broken token.
+    if (typeof data?.access_token !== "string" || data.access_token.length === 0)
+        return false;
+    // The lifetime has to be positive and has to still name a finite instant
+    // once converted. A zero or negative `expires_in` would report success on a
+    // token that is already due for another refresh, so every request re-enters
+    // the refresh path; a value big enough to overflow the multiplication would
+    // set `expiresAt` to Infinity, which `needsOpenAIRefresh` can never reach —
+    // the same permanent strand as NaN, from the opposite direction.
+    if (typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in))
+        return false;
+    if (data.expires_in <= 0)
+        return false;
+    const expiresAt = Date.now() + data.expires_in * 1000;
+    if (!Number.isFinite(expiresAt))
         return false;
-    const data = await res.json();
     account.accessToken = data.access_token;
     account.refreshToken = data.refresh_token ?? account.refreshToken;
-    account.expiresAt = Date.now() + data.expires_in * 1000;
+    account.expiresAt = expiresAt;
+    // A successful refresh recovers an account the pool previously excluded for
+    // being unhealthy (e.g. after a prior failed refresh). Without this, the pool's
+    // hard `!healthy` block means the account never gets acquired again — and thus
+    // never gets another chance to refresh — so it stays excluded until restart.
+    const runtime = account;
+    if (runtime.healthy !== undefined)
+        runtime.healthy = true;
+    if (runtime.consecutiveErrors !== undefined)
+        runtime.consecutiveErrors = 0;
+    if (runtime.lastRefresh !== undefined)
+        runtime.lastRefresh = Date.now();
+    // The rotated access token can carry a different plan than the one decoded
+    // at account creation (e.g. a Plus->Pro upgrade). Mirrors createOpenAIAccount's
+    // semantics: only overwrite when the new token actually decodes a plan claim —
+    // an undecodable token leaves the previously known plan in place rather than
+    // erasing it, since a missing claim means "unknown", not "no plan".
+    if (runtime.rateLimits) {
+        const plan = decodeOpenAIPlan(account.accessToken);
+        if (plan)
+            runtime.rateLimits.plan = plan;
+    }
     return true;
 }