osdy-pi 1.11.11 → 1.11.13

package/extensions/osdy-pi/codex-reset-store.test.ts

@@ -0,0 +1,236 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { chmod, mkdtemp, open, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
+import type { FileHandle } from "node:fs/promises";
+import { registerHooks } from "node:module";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+registerHooks({
+	resolve(specifier, context, nextResolve) {
+		if (specifier.startsWith(".") && specifier.endsWith(".js") && context.parentURL?.endsWith(".ts")) {
+			const url = new URL(`${specifier.slice(0, -3)}.ts`, context.parentURL);
+			if (existsSync(fileURLToPath(url))) return { shortCircuit: true, url: url.href };
+		}
+		return nextResolve(specifier, context);
+	},
+});
+
+const { createCodexResetStore } = await import("./codex-reset-store.js");
+const accountId = "synthetic-account/../not-a-path";
+const pending = {
+	version: 1 as const, accountId, creditId: "synthetic-credit",
+	requestId: "11111111-1111-4111-8111-111111111111", expiresAt: 2_000, status: "pending" as const,
+};
+const basename = createHash("sha256").update(accountId).digest("hex");
+
+async function fixture(t: test.TestContext) {
+	const directory = await mkdtemp(join(tmpdir(), "osdy-reset-test-"));
+	t.after(() => rm(directory, { recursive: true, force: true })); // Only this synthetic fixture.
+	const root = join(directory, "journal");
+	return { root, store: createCodexResetStore(root) };
+}
+
+void test("private hashed journals round-trip and resolved attempts permit a new request", async (t) => {
+	const { root, store } = await fixture(t);
+	const lease = await store.acquire(accountId);
+	assert.equal(await lease.read(), undefined);
+	await lease.write(pending);
+	assert.deepEqual(await lease.read(), pending);
+	assert.equal((await stat(root)).mode & 0o777, 0o700);
+	for (const name of await readdir(root)) {
+		assert.match(name, /^[a-f0-9]{64}\.(json|lock)$/);
+		assert.equal((await stat(join(root, name))).mode & 0o777, 0o600);
+	}
+	assert.equal((await readFile(join(root, `${basename}.json`), "utf8")).includes("accessToken"), false);
+	await lease.write({ ...pending, status: "resolved", confirmedCode: "reset" });
+	await lease.write({ ...pending, requestId: "22222222-2222-4222-8222-222222222222" });
+	await lease.release();
+	const restored = await store.acquire(accountId);
+	assert.equal((await restored.read())?.requestId, "22222222-2222-4222-8222-222222222222");
+	await restored.release();
+	assert.deepEqual(await readdir(root), [`${basename}.json`]);
+});
+
+void test("account leases are exclusive, isolate accounts, and never reclaim existing stale locks", async (t) => {
+	const { root, store } = await fixture(t);
+	const lease = await store.acquire(accountId);
+	await assert.rejects(store.acquire(accountId), /^Error: Codex reset journal is unavailable$/);
+	const other = await store.acquire("synthetic-other");
+	assert.equal(await other.read(), undefined);
+	await lease.write(pending);
+	assert.equal(await other.read(), undefined);
+	await other.release();
+	await lease.release();
+	await writeFile(join(root, `${basename}.lock`), "", { mode: 0o600 });
+	await assert.rejects(store.acquire(accountId), /^Error: Codex reset journal is unavailable$/);
+	assert.equal(await readFile(join(root, `${basename}.lock`), "utf8"), "");
+});
+
+for (const content of [
+	"{broken", "x".repeat(8_193), JSON.stringify({ ...pending, version: 2 }),
+	JSON.stringify({ ...pending, accountId: "wrong-account" }), JSON.stringify({ ...pending, requestId: "bad" }),
+	JSON.stringify({ ...pending, expiresAt: -1 }), JSON.stringify({ ...pending, accessToken: "forbidden" }),
+	JSON.stringify({ ...pending, status: "resolved", confirmedCode: "invented" }),
+	JSON.stringify({ ...pending, status: "pending", confirmedCode: "reset" }),
+]) {
+	void test(`rejects corrupt or unbounded journal fixture ${content.length}:${content.slice(0, 12)}`, async (t) => {
+		const { root, store } = await fixture(t);
+		const lease = await store.acquire(accountId);
+		await writeFile(join(root, `${basename}.json`), content, { mode: 0o600 });
+		await assert.rejects(lease.read(), /^Error: Codex reset journal is unavailable$/);
+		await lease.release();
+	});
+}
+
+void test("refuses final-file symlinks on both read and atomic write, preserving the target", async (t) => {
+	const { root, store } = await fixture(t);
+	const lease = await store.acquire(accountId);
+	const target = join(root, "synthetic-target");
+	await writeFile(target, "untouched", { mode: 0o600 });
+	await symlink(target, join(root, `${basename}.json`));
+	await assert.rejects(lease.read());
+	await assert.rejects(lease.write(pending));
+	assert.equal(await readFile(target, "utf8"), "untouched");
+	await lease.release();
+	assert.equal((await readdir(root)).some((name) => name.endsWith(".tmp")), false);
+});
+
+void test("refuses symlink roots and non-private journal files or directories", async (t) => {
+	const { root, store } = await fixture(t);
+	const lease = await store.acquire(accountId);
+	await lease.write(pending);
+	await chmod(join(root, `${basename}.json`), 0o644);
+	await assert.rejects(lease.read());
+	await lease.release();
+	await chmod(root, 0o755);
+	await assert.rejects(store.acquire(accountId));
+	const link = `${root}-link`;
+	await symlink(root, link);
+	await assert.rejects(createCodexResetStore(link).acquire(accountId));
+});
+
+void test("validation/write failure cannot replace pending; terminal outcomes must match the logical attempt", async (t) => {
+	const { root, store } = await fixture(t);
+	const lease = await store.acquire(accountId);
+	await lease.write(pending);
+	await assert.rejects(lease.write({ ...pending, creditId: "different" }));
+	await assert.rejects(lease.write({ ...pending, status: "resolved", requestId: "22222222-2222-4222-8222-222222222222" }));
+	await assert.rejects(lease.write({ ...pending, creditId: "x".repeat(8_193) }));
+	assert.deepEqual(await lease.read(), pending);
+	assert.equal((await readdir(root)).some((name) => name.endsWith(".tmp")), false);
+	await lease.write({ ...pending, status: "resolved" }); // Definitely not sent.
+	await lease.release();
+});
+
+void test("invalid UTF-8 must not silently change an opaque stored credit ID", async (t) => {
+	const { root, store } = await fixture(t);
+	const lease = await store.acquire(accountId);
+	const content = Buffer.from(JSON.stringify(pending));
+	content[content.indexOf("synthetic-credit")] = 0xff;
+	await writeFile(join(root, `${basename}.json`), content, { mode: 0o600 });
+	await assert.rejects(lease.read());
+	await lease.release();
+});
+
+void test("resolved request IDs cannot be reused for a new logical attempt", async (t) => {
+	const { store } = await fixture(t);
+	const lease = await store.acquire(accountId);
+	await lease.write(pending);
+	await lease.write({ ...pending, status: "resolved", confirmedCode: "reset" });
+	await assert.rejects(lease.write(pending));
+	await lease.release();
+});
+
+async function fileHandlePrototype(root: string): Promise<FileHandle> {
+	const probe = await open(join(root, "synthetic-probe"), "wx", 0o600);
+	const prototype = Object.getPrototypeOf(probe) as FileHandle;
+	await probe.close();
+	return prototype;
+}
+
+void test("failed temporary write leaves pending intact and cleans only its own temporary file", async (t) => {
+	const { root, store } = await fixture(t);
+	const lease = await store.acquire(accountId);
+	await lease.write(pending);
+	const prototype = await fileHandlePrototype(root);
+	const fault = t.mock.method(prototype, "writeFile", () => Promise.reject(new Error("synthetic write fault")));
+	await assert.rejects(lease.write({ ...pending, status: "resolved", confirmedCode: "reset" }));
+	fault.mock.restore();
+	assert.deepEqual(await lease.read(), pending);
+	assert.equal((await readdir(root)).some((name) => name.endsWith(".tmp")), false);
+	await lease.release();
+});
+
+for (const restoreFails of [false, true]) {
+	void test(`post-rename terminal fsync failure restores pending or retains lock (${restoreFails})`, async (t) => {
+		const { root, store } = await fixture(t);
+		const lease = await store.acquire(accountId);
+		await lease.write(pending);
+		const prototype = await fileHandlePrototype(root);
+		const original = Reflect.get(prototype, "sync");
+		let directorySyncs = 0;
+		const fault = t.mock.method(prototype, "sync", async function (this: FileHandle) {
+			if ((await this.stat()).isDirectory() && (++directorySyncs === 1 || restoreFails)) throw new Error("synthetic fsync fault");
+			await original.call(this);
+		});
+		await assert.rejects(lease.write({ ...pending, status: "resolved", confirmedCode: "reset" }));
+		fault.mock.restore();
+		assert.deepEqual(JSON.parse(await readFile(join(root, `${basename}.json`), "utf8")) as unknown, pending);
+		if (restoreFails) {
+			await assert.rejects(lease.release());
+			await assert.rejects(store.acquire(accountId));
+		} else {
+			await lease.release();
+			const next = await store.acquire(accountId);
+			assert.deepEqual(await next.read(), pending);
+			await next.release();
+		}
+		assert.equal((await readdir(root)).some((name) => name.endsWith(".tmp")), false);
+	});
+}
+
+void test("accepts the byte limit but never reads beyond it", async (t) => {
+	const { root, store } = await fixture(t);
+	const lease = await store.acquire(accountId);
+	const serialized = JSON.stringify(pending);
+	await writeFile(join(root, `${basename}.json`), serialized.padEnd(8_192, " "), { mode: 0o600 });
+	assert.deepEqual(await lease.read(), pending);
+	await writeFile(join(root, `${basename}.json`), serialized.padEnd(8_193, " "), { mode: 0o600 });
+	await assert.rejects(lease.read());
+	await lease.release();
+});
+
+void test("no terminal record without pending, no operations after lease release", async (t) => {
+	const { store } = await fixture(t);
+	const lease = await store.acquire(accountId);
+	await assert.rejects(lease.write({ ...pending, status: "resolved", confirmedCode: "reset" }));
+	assert.equal(await lease.read(), undefined);
+	await lease.release();
+	await assert.rejects(lease.read());
+	await assert.rejects(lease.write(pending));
+});
+
+void test("write snapshots validated fields before asynchronous IO and cannot serialize inherited credentials", async (t) => {
+	const { root, store } = await fixture(t);
+	const lease = await store.acquire(accountId);
+	const input = { ...pending };
+	Object.setPrototypeOf(input, { toJSON: () => ({ ...pending, accessToken: "synthetic-forbidden" }) });
+	const saving = lease.write(input);
+	Object.assign(input, { creditId: "x".repeat(8_193), accessToken: "synthetic-forbidden" });
+	await saving;
+	assert.deepEqual(await lease.read(), pending);
+	assert.equal((await readFile(join(root, `${basename}.json`), "utf8")).includes("synthetic-forbidden"), false);
+	await lease.release();
+});
+
+void test("lock release failure is generic and refuses a subsequent lease", async (t) => {
+	const { root, store } = await fixture(t);
+	const lease = await store.acquire(accountId);
+	await chmod(join(root, `${basename}.lock`), 0o644);
+	await assert.rejects(lease.release(), /^Error: Codex reset journal is unavailable$/);
+	await assert.rejects(store.acquire(accountId));
+});

package/extensions/osdy-pi/codex-reset-store.ts

@@ -0,0 +1,174 @@
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+import type { FileHandle } from "node:fs/promises";
+import { join } from "node:path";
+import type { ConsumeCodexResetCode } from "./codex-usage.js";
+
+/** Resolved without confirmedCode means definitely not sent, never inferred from GET. */
+export type CodexResetRecord = {
+	version: 1;
+	accountId: string;
+	creditId: string;
+	requestId: string;
+	expiresAt?: number;
+} & ({ status: "pending" } | { status: "resolved"; confirmedCode?: ConsumeCodexResetCode });
+
+export type CodexResetLease = {
+	read(): Promise<CodexResetRecord | undefined>;
+	write(record: CodexResetRecord): Promise<void>;
+	release(): Promise<void>;
+};
+
+export type CodexResetStore = { acquire(accountId: string): Promise<CodexResetLease> };
+
+const MAX_BYTES = 8_192;
+const UUID = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+const CODES = new Set(["reset", "nothing_to_reset", "no_credit", "already_redeemed"]);
+const unavailable = () => new Error("Codex reset journal is unavailable");
+const isMissing = (error: unknown) => !!error && typeof error === "object" && "code" in error && error.code === "ENOENT";
+const validId = (value: unknown): value is string => typeof value === "string" && value.length <= 512 && !!value.trim() &&
+	!Array.from(value).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
+
+function validateRecord(value: unknown, accountId: string): CodexResetRecord {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw unavailable();
+	// Capture own values once; never serialize caller prototypes, toJSON hooks, or later mutations.
+	const record = { ...value } as Record<string, unknown>;
+	const keys = ["version", "accountId", "creditId", "requestId", "expiresAt", "status", "confirmedCode"];
+	if (Object.getOwnPropertyNames(value).some((key) => !keys.includes(key)) || record.version !== 1 || record.accountId !== accountId ||
+		!validId(record.creditId) || typeof record.requestId !== "string" || !UUID.test(record.requestId) ||
+		(record.expiresAt !== undefined && (typeof record.expiresAt !== "number" || !Number.isSafeInteger(record.expiresAt) || record.expiresAt < 0)) ||
+		(record.status !== "pending" && record.status !== "resolved") ||
+		(record.confirmedCode !== undefined && (record.status !== "resolved" || typeof record.confirmedCode !== "string" || !CODES.has(record.confirmedCode))))
+		throw unavailable();
+	return record as CodexResetRecord;
+}
+
+function sameAttempt(left: CodexResetRecord, right: CodexResetRecord): boolean {
+	return left.accountId === right.accountId && left.creditId === right.creditId &&
+		left.requestId === right.requestId && left.expiresAt === right.expiresAt;
+}
+
+/** The injected root must have trusted parents. No auth material enters this edge. */
+export function createCodexResetStore(rootDirectory: string): CodexResetStore {
+	return {
+		async acquire(accountId) {
+			let lock: FileHandle | undefined;
+			try {
+				if (!validId(accountId)) throw unavailable();
+				await mkdir(rootDirectory, { recursive: true, mode: 0o700 });
+				const root = await lstat(rootDirectory);
+				if (!root.isDirectory() || root.isSymbolicLink() || (root.mode & 0o777) !== 0o700) throw unavailable();
+				const hash = createHash("sha256").update(accountId).digest("hex");
+				const journalPath = join(rootDirectory, `${hash}.json`);
+				const lockPath = join(rootDirectory, `${hash}.lock`);
+				// Existing locks (including empty, stale, or symlink locks) are never reclaimed.
+				lock = await open(lockPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+				const heldLock = lock;
+				const lockStat = await heldLock.stat();
+				let released = false;
+				let poisoned = false;
+
+				async function checkRoot() {
+					if (released || poisoned) throw unavailable();
+					const current = await lstat(rootDirectory);
+					if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== root.dev || current.ino !== root.ino ||
+						(current.mode & 0o777) !== 0o700) throw unavailable();
+				}
+
+				async function read(): Promise<CodexResetRecord | undefined> {
+					let file: FileHandle | undefined;
+					try {
+						await checkRoot();
+						try { file = await open(journalPath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); }
+						catch (error) { if (isMissing(error)) return undefined; throw error; }
+						const info = await file.stat();
+						if (!info.isFile() || (info.mode & 0o777) !== 0o600 || info.size > MAX_BYTES) throw unavailable();
+						// A fixed buffer bounds reads even if another writer grows the file after stat.
+						const buffer = Buffer.alloc(MAX_BYTES + 1);
+						let size = 0;
+						while (size < buffer.length) {
+							const { bytesRead } = await file.read(buffer, size, buffer.length - size, size);
+							if (bytesRead === 0) break;
+							size += bytesRead;
+						}
+						if (size > MAX_BYTES) throw unavailable();
+						const text = new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, size));
+						return validateRecord(JSON.parse(text) as unknown, accountId);
+					} catch { throw unavailable(); }
+					finally { await file?.close().catch(() => { throw unavailable(); }); }
+				}
+
+				async function syncDirectory() {
+					const directory = await open(rootDirectory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+					try { await directory.sync(); }
+					finally { await directory.close(); }
+				}
+
+				async function write(record: CodexResetRecord): Promise<void> {
+					let previous: CodexResetRecord | undefined;
+					let published = false;
+					async function atomicSave(next: CodexResetRecord) {
+						const tempPath = join(rootDirectory, `${hash}.${randomUUID()}.tmp`);
+						let temp: FileHandle | undefined;
+						let created = false;
+						try {
+							await checkRoot();
+							temp = await open(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+							created = true;
+							await temp.writeFile(JSON.stringify(next), "utf8");
+							await temp.sync();
+							await temp.close();
+							temp = undefined;
+							await checkRoot();
+							try {
+								const final = await lstat(journalPath);
+								if (!final.isFile() || final.isSymbolicLink() || (final.mode & 0o777) !== 0o600) throw unavailable();
+							} catch (error) { if (!isMissing(error)) throw error; }
+							await rename(tempPath, journalPath);
+							created = false;
+							published = true;
+							await syncDirectory();
+						} finally {
+							try { await temp?.close(); }
+							finally { if (created) await unlink(tempPath); }
+						}
+					}
+					try {
+						record = validateRecord(record, accountId);
+						if (Buffer.byteLength(JSON.stringify(record)) > MAX_BYTES) throw unavailable();
+						previous = await read();
+						if ((previous?.status === "pending" && !sameAttempt(previous, record)) ||
+							(previous?.status === "resolved" && record.status === "pending" && previous.requestId === record.requestId) ||
+							(record.status === "resolved" && (previous?.status !== "pending" || !sameAttempt(previous, record)))) throw unavailable();
+						await atomicSave(record);
+					} catch {
+						// A post-rename fsync failure must not expose a resolved gate. Restore pending;
+						// if even that fails, retain the lock rather than permit another attempt.
+						if (published && record.status === "resolved" && previous?.status === "pending") {
+							try { await atomicSave(previous); }
+							catch { poisoned = true; }
+						}
+						throw unavailable();
+					}
+				}
+
+				async function release(): Promise<void> {
+					try {
+						await checkRoot();
+						const current = await lstat(lockPath);
+						if (!current.isFile() || (current.mode & 0o777) !== 0o600 || current.dev !== lockStat.dev || current.ino !== lockStat.ino)
+							throw unavailable();
+						await heldLock.close();
+						await unlink(lockPath);
+					} catch { throw unavailable(); }
+					finally { released = true; await heldLock.close().catch(() => {}); }
+				}
+				return { read, write, release };
+			} catch {
+				await lock?.close().catch(() => {}); // Never remove an uncertain or pre-existing lock.
+				throw unavailable();
+			}
+		},
+	};
+}

package/extensions/osdy-pi/codex-reset-ui.test.ts

@@ -0,0 +1,70 @@
+import assert from "node:assert/strict";
+import { existsSync } from "node:fs";
+import { registerHooks } from "node:module";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import type { CodexResetResult } from "./codex-reset.js";
+registerHooks({ resolve(specifier, context, next) {
+	if (specifier.startsWith(".") && specifier.endsWith(".js") && context.parentURL?.endsWith(".ts")) {
+		const url = new URL(`${specifier.slice(0, -3)}.ts`, context.parentURL);
+		if (existsSync(fileURLToPath(url))) return { shortCircuit: true, url: url.href };
+	}
+	return next(specifier, context);
+} });
+
+void test("choice labels map indexed local expiry to exact IDs, never render opaque identities", async () => {
+	const { createCodexResetInteraction } = await import("./codex-reset-ui.js");
+	const expiry = Date.parse("2030-07-17T12:30:00Z");
+	const choices = [{ creditId: "opaque-first", expiresAt: expiry }, { creditId: "opaque-second", expiresAt: undefined }];
+	let answer: number | string | undefined = 1;
+	const interaction = createCodexResetInteraction({ select: (_title, options) => {
+		assert.deepEqual(options, [`Reset 1 — expires ${new Date(expiry).toLocaleString()} (local time)`, "Reset 2 — Expiry not provided"]);
+		assert.doesNotMatch(options.join(""), /opaque-/);
+		return Promise.resolve(typeof answer === "number" ? options[answer] : answer);
+	} });
+	assert.equal(await interaction.choose(choices), "opaque-second");
+	for (answer of [undefined, "invented", "opaque-first"]) assert.equal(await interaction.choose(choices), undefined);
+});
+
+void test("new and recovery confirmation use Cancel-first select with honest scope/effects/date", async () => {
+	const { createCodexResetInteraction } = await import("./codex-reset-ui.js");
+	for (const kind of ["new", "recovery"] as const) {
+		for (const accept of [false, true, undefined]) {
+			const interaction = createCodexResetInteraction({ select: (title, options) => {
+				assert.match(title, /active Codex account/);
+				assert.match(title, /Expiry not provided/);
+				assert.doesNotMatch(title, /opaque-/);
+				assert.deepEqual(options, ["Cancel", kind === "new" ? "Use reset" : "Check pending attempt"]);
+				if (kind === "new") assert.match(title, /one banked reset/);
+				else assert.match(title, /same previous request.*may finish.*not a new attempt/i);
+				return Promise.resolve(accept === undefined ? undefined : options[accept ? 1 : 0]);
+			} });
+			const base = { scope: "active-account", cancelFirst: true, creditId: "opaque-credit", expiresAt: undefined } as const;
+			const prompt = kind === "recovery" ? { ...base, kind, requestId: "opaque-request" } : { ...base, kind };
+			assert.equal(await interaction.confirm(prompt), accept === true);
+		}
+	}
+});
+
+void test("confirmed codes remain definite and distinguish refresh/journal failures", async () => {
+	const { notifyCodexResetResult } = await import("./codex-reset-ui.js");
+	for (const code of ["reset", "already_redeemed", "no_credit", "nothing_to_reset"] as const) {
+		const notices: string[] = [];
+		notifyCodexResetResult({ notify: text => { notices.push(text); } }, { kind: "confirmed", code, windowsReset: 2, refreshFailed: true, journalFailed: true });
+		assert.match(notices[0] ?? "", code === "reset" ? /consumed.*2.*windows/i : code === "already_redeemed" ? /previous.*succeeded/i : /not consumed/i);
+		assert.match(notices[0] ?? "", /Quota refresh failed/);
+		assert.match(notices[0] ?? "", /Local attempt bookkeeping failed/);
+		assert.doesNotMatch(notices[0] ?? "", /reset failed|Outcome unknown/i);
+	}
+});
+
+void test("unknown and blocked feedback never suggests another reset or automatic lock cleanup", async () => {
+	const { notifyCodexResetResult } = await import("./codex-reset-ui.js");
+	const results: CodexResetResult[] = [{ kind: "unknown", refreshFailed: false, journalFailed: false },
+		{ kind: "blocked", journalFailed: true }, { kind: "busy" }, { kind: "unavailable" }, { kind: "cancelled" }];
+	const notices: string[] = [];
+	for (const result of results) notifyCodexResetResult({ notify: text => { notices.push(text); } }, result);
+	assert.equal(notices[0], "Outcome unknown; do not start another reset. Use check to confirm the same pending attempt.");
+	assert.match(notices[1] ?? "", /blocked.*manual verification/i);
+	assert.doesNotMatch(notices.join(""), /opaque|token|\.json|auto.*reclaim/i);
+});

package/extensions/osdy-pi/codex-reset-ui.ts

@@ -0,0 +1,52 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { CodexResetInteraction, CodexResetResult } from "./codex-reset.js";
+
+export type CodexResetAction = () => Promise<boolean>;
+const expiryLabel = (expiresAt: number | undefined): string => expiresAt === undefined
+	? "Expiry not provided" : `expires ${new Date(expiresAt).toLocaleString()} (local time)`;
+
+/** Presentation only. Opaque IDs stay in the indexed mapping, not dialog text. */
+export function createCodexResetInteraction(ui: Pick<ExtensionContext["ui"], "select">): CodexResetInteraction {
+	return {
+		async choose(choices) {
+			const labels = choices.map((choice, index) => `Reset ${index + 1} — ${expiryLabel(choice.expiresAt)}`);
+			const selected = await ui.select("Choose a banked reset for the active Codex account", labels);
+			const index = selected === undefined ? -1 : labels.indexOf(selected);
+			return choices[index]?.creditId;
+		},
+		async confirm(prompt) {
+			const recovery = prompt.kind === "recovery";
+			const effect = recovery
+				? "Check the same previous request; this may finish the previous unconfirmed reset, not a new attempt."
+				: "Use one banked reset; one banked reset will be consumed if rate limits are reset.";
+			const accept = recovery ? "Check pending attempt" : "Use reset";
+			return await ui.select(`For the active Codex account: ${effect}\nReset ${expiryLabel(prompt.expiresAt)}.`, ["Cancel", accept]) === accept;
+		},
+	};
+}
+
+/** Definite server outcomes are never relabelled as failures by later local work. */
+export function notifyCodexResetResult(ui: Pick<ExtensionContext["ui"], "notify">, result: CodexResetResult): void {
+	let message: string;
+	switch (result.kind) {
+		case "busy": message = "A banked reset action is already in progress."; break;
+		case "cancelled": message = "Banked reset action cancelled; no new reset was sent."; break;
+		case "unavailable": message = "No currently available banked reset could be selected. Refresh usage to check availability."; break;
+		case "blocked": message = "Banked reset action blocked. Local attempt storage or its lock is unavailable; manual verification is required. No automatic cleanup or retry."; break;
+		case "unknown": message = "Outcome unknown; do not start another reset. Use check to confirm the same pending attempt."; break;
+		case "confirmed":
+			switch (result.code) {
+				case "reset": message = `Banked reset consumed; ${result.windowsReset} rate-limit windows reset.`; break;
+				case "already_redeemed": message = "The previous reset already succeeded; this check did not consume another reset."; break;
+				case "no_credit": message = "No banked reset was available; a reset was not consumed."; break;
+				case "nothing_to_reset": message = "No rate limits needed resetting; a banked reset was not consumed."; break;
+			}
+	}
+	if (result.kind === "unknown" || result.kind === "confirmed") {
+		if (result.refreshFailed) message += " Quota refresh failed; the consumption outcome above is unchanged.";
+		if (result.journalFailed) message += " Local attempt bookkeeping failed; do not start another reset before manual verification.";
+	}
+	const warning = result.kind === "unknown" || result.kind === "blocked" || result.kind === "busy" || result.kind === "unavailable" ||
+		(result.kind === "confirmed" && (result.refreshFailed || result.journalFailed));
+	ui.notify(message, warning ? "warning" : "info");
+}