When Reset

A small SwiftUI iOS monitor for AI coding usage limits and reset times.

Features

• Multiple accounts with a provider-ready account model
• Codex-compatible ChatGPT device linking
• Claude Code-compatible PKCE OAuth linking with refresh-token rotation
• Grok Build device linking with weekly or monthly coding-credit resets
• Kimi Code device linking with 5-hour and weekly limits
• GitHub Copilot device linking with chat and premium-request quotas
• Z.AI GLM Coding Plan quota monitoring with 5-hour, weekly, and monthly limits
• MiniMax Token Plan quota monitoring with 5-hour and weekly limits
• Synthetic rolling 5-hour and weekly quota monitoring
• Ollama Cloud session and weekly quota monitoring from an on-device browser session
• Warp monthly request-credit monitoring
• OpenRouter per-key credit-limit and reset-period monitoring
• Fireworks AI account quota and monthly spend-limit monitoring
• DeepSeek API balance monitoring in the provider-reported currency
• Poe API point-balance monitoring
• OpenAI and Anthropic organization API spend, with optional monthly balance budgets
• New API-compatible key allowance, usage, remaining balance, and expiry
• Experimental Antigravity OAuth quota monitoring for Gemini, Claude, and GPT pools
• A generic on-device HTTPS usage adapter, including Sub2API-style /v1/usage responses
• Provider marks in the app, widgets, and Live Activity
• Duration-classified 5-hour and weekly usage windows with live countdowns
• Nearest banked reset expiry with a day-aware countdown and exact local time
• Home Screen widgets in selectable Market chart, Quota ring, Quota board, Gauge, and Heatmap styles, with automatic family-aware layouts
• Small, medium, and large Home Screen widgets on iOS and macOS, plus Lock Screen, Dynamic Island, and Live Activity views
• Accounts and tokens synchronized through iCloud Keychain; sanitized snapshots in an App Group
• Optional encrypted server-side quota monitoring and hourly silent refresh hints through Cloudflare Workers or your own Linux server
• Optional WebAuthn passkey access to the private dashboard, including iCloud Keychain-backed passkeys on Apple devices
• Per-quota usage charts for the last 24 hours, 7 days, or 30 days

Build

1. Run xcodegen generate.
2. Open WhenReset.xcodeproj.
3. Select your development team for the app and widget targets.
4. The app uses ad.neko.when, its widget extension, and the group.ad.neko.when App Group.
5. Enable Push Notifications for the app identifier and regenerate the development and App Store provisioning profiles.
6. Build on an iOS 17+ device or simulator.

Keep code signing enabled when testing account linking in Simulator. An unsigned build (CODE_SIGNING_ALLOWED=NO) cannot access Keychain and fails with OSStatus -34018 after OAuth succeeds.

Continuous integration and App Store uploads

GitHub Actions replaces Xcode Cloud for this repository:

• CI tests the iOS app, builds unsigned iOS and universal macOS release configurations, and checks the Cloudflare Worker on every push and pull request targeting master.
• App Store Release uploads iOS daily when the current commit has no successful release tag, and supports manual iOS/macOS uploads. It uses Xcode cloud signing, so signing certificates and provisioning profiles are created or downloaded by Xcode on the ephemeral runner.

Release preparation checks App Store Connect before archiving. It treats the checked-in marketing version as a minimum: if Apple has approved that version on a selected platform, the upload uses the next patch version after the latest approved release. Build numbers increase across all app versions and platforms, including paginated build history. Xcode's specific unreadable cloud-signing response is retried up to three times before upload; version-validation failures and potentially completed uploads are not retried. App Store review submission remains an explicit manual option, separate from TestFlight uploads.

The release workflow reads these encrypted GitHub Actions repository secrets:

• APP_STORE_CONNECT_KEY_ID
• APP_STORE_CONNECT_ISSUER_ID
• APP_STORE_CONNECT_PRIVATE_KEY

The private key exists only in the runner’s temporary directory for the duration of the job. Trigger App Store Release from the Actions tab and select both, ios, or macos. Pushing a testflight-* tag uploads iOS only. After Apple finishes processing the iOS build, the workflow adds it to the Internal Testers group.

Raw Xcode export diagnostics stay out of public logs. To investigate an export failure, an operator can temporarily set the RELEASE_DIAGNOSTICS_PUBLIC_KEY repository variable to an RSA public key of at least 3072 bits, keeping its private key locally. Failed exports then produce an artifact encrypted with AES-256-GCM and RSA-OAEP-SHA256, retained for one day. Only that private key can decrypt the diagnostic file. Remove the variable after investigating; never put the private key in the variable or repository.

Provider notes

• ChatGPT reads private wham usage and banked-reset endpoints.
• Claude uses the Claude Code OAuth client and usage endpoint.
• Grok uses xAI’s official Grok Build device authorization and billing endpoint. When Reset requests identity, offline access, and CLI API access only, rotates refresh tokens, and reads the current coding-credit percentage and period end; it does not use xAI API spend as a coding-plan quota.
• Kimi uses the public client embedded in the official Kimi Code client. Moonshot does not currently publish a third-party client-registration process.
• GitHub Copilot uses GitHub device authorization, but exact remaining quotas come from the undocumented copilot_internal/user endpoint. Its bundled VS Code client ID should be replaced with a separately registered client before distribution.
• Z.AI uses a user-provided GLM Coding Plan key to read the same quota data shown by Usage Statistics. The quota endpoint is not documented as a public API; general-purpose and pay-as-you-go keys are outside this app’s scope.
• MiniMax uses a user-provided Subscription Key and its documented Token Plan remaining-quota endpoint. When Reset tries the global service first, then the mainland-China service for regional keys. Standard pay-as-you-go keys are outside this app’s scope.
• Synthetic and Warp use user-provided API keys with fixed quota endpoints. Both can opt in to self-hosted Worker monitoring.
• OpenRouter reads the authenticated key's official credit-limit response, including its stable creator identity and daily, weekly, or monthly limit period when configured. Fireworks AI resolves the key's official account resource before reading account quotas, including the monthly USD spend limit when present. Both use fixed provider hosts and can opt in to self-hosted Worker monitoring.
• DeepSeek reads its official user-balance response and prefers USD when the service returns both USD and CNY balances. Poe reads the official current point balance. Neither response documents a reset timestamp, so When Reset displays the available balance without inventing a reset date. Both fixed-host integrations can opt in to self-hosted Worker monitoring.
• OpenAI and Anthropic billing use their organization Cost APIs and require Admin API keys; standard inference keys cannot read organization billing. Without an optional monthly budget, When Reset displays month-to-date spend instead of inventing a remaining balance. Their fixed-host integrations can opt in to self-hosted Worker monitoring.
• New API-compatible accounts read /v1/dashboard/billing/subscription and /v1/dashboard/billing/usage from the user-selected HTTPS origin. The custom origin and key remain on-device.
• Ollama Cloud currently exposes quota windows on its signed-in settings page, not through its API-key endpoints. Its session cookie therefore remains on-device.
• Antigravity uses Google OAuth and internal Cloud Code Assist quota endpoints. The mobile callback is completed by pasting the localhost URL, and its tokens remain on-device because the protocol is experimental.
• Compatible API accounts issue only GET requests to the exact user-entered HTTPS endpoint (or loopback HTTP), send a bearer key, cap responses at 1 MiB, and require explicit percentages or counters plus future reset timestamps. Their URL and key remain on-device.

When Reset tracks recurring coding-plan allowances and explicitly linked API billing accounts. The private and first-party-compatible integrations may change without notice. No provider token is written to app snapshots, logs, or user defaults.

The OpenAI Blossom is used only to identify the ChatGPT provider. OpenAI, ChatGPT, and the Blossom are trademarks of OpenAI; this project is not endorsed by or affiliated with OpenAI. The Grok provider mark is adapted from CodexBar’s MIT-licensed provider asset and is used only for identification. Grok and xAI are trademarks of xAI; this project is not endorsed by or affiliated with xAI.

Push refresh server

Linux quick start · Deployment guides · GitHub wiki · Security and secrets

Deploy the optional server on Linux on your own network or Cloudflare Workers. Linux runs the same dashboard and monitoring API with local SQLite storage, persistent jobs and a systemd service. Provider requests use the Linux server's outbound IP; choose a static public IP or stable NAT to keep account checks on a consistent network. An installation script sets it up and preserves configuration and data on updates:

sudo bash server/install.sh --origin https://reset.example.com

Follow the Linux guide to configure HTTPS and link the app. Both deployments require explicit account-by-account monitoring consent.

The optional Cloudflare Worker is self-hosted in the user’s Cloudflare account. It sends hourly silent refresh hints and can, only for accounts individually opted in by the user, encrypt provider credentials in D1 and record quota every 5 minutes or longer. The app merges those server samples into its 24-hour, 7-day, and 30-day usage charts. Opaque, deployment-specific account references attach retained Worker history to the matching local account and collapse differently named copies of the same verified ChatGPT profile. The app shows whether the Worker’s last provider check found an active or expired session; a new sign-in can replace an expired credential directly on the Worker. Credential upload and replacement are strictly write-only: no API route downloads plaintext credentials, encrypted envelopes, or fingerprints. Overlapping client accounts are fetched once per credential scope and cron occurrence. When Reset does not operate an official server.

After unlocking the Worker dashboard with REGISTRATION_ACCESS_KEY, the operator can optionally enroll a WebAuthn passkey for later access. Apple devices can store and synchronize that passkey through iCloud Keychain, but the passkey is scoped to the exact Worker hostname and is separate from the app's synchronized provider credentials. Its private key never leaves the authenticator or password manager. Keep the registration key as the recovery method: changing the hostname requires enrollment on the new hostname, and rotating the registration key invalidates existing dashboard sessions and passkeys. See dashboard passkeys and recovery.

Intentional shared APNs credential

The APNs signing key under server/apns/ is deliberately versioned, not an accidentally committed deployment secret. This follows Bark Server’s implementation, which bundles its APNs signing credential so independent self-hosted servers can send notifications to the official app.

When Reset’s key is production-only and topic-specific to ad.neko.when. It cannot access App Store Connect, another app or topic, or discover device tokens. A sender still needs a valid production device token, so each deployment must protect its device tokens and registration API. See the shared APNs key security model for the exact restrictions and trust boundary.