mixdog 0.9.85 → 0.9.87

package/src/standalone/channel-daemon-transport.mjs

@@ -31,11 +31,9 @@ function isPidAlive(pid) {
   catch (error) { return error?.code === 'EPERM'; }
 }
 
-// Tool names whose successful call re-points the routing pointer at the caller.
-// These are the Lead-only "I am now the bound TUI" signals (bridge claim on
-// start, Lead-pushed transcript repoint). Per the routing ruling the pointer is
-// NOT a lease: last-bind-wins, pid-verified at delivery, no heartbeat expiry.
-const POINTER_TOOLS = new Set(['activate_channel_bridge', 'rebind_current_transcript']);
+const ACTIVATE_TOOL = 'activate_channel_bridge';
+const REBIND_TOOL = 'rebind_current_transcript';
+const BINDING_TOOLS = new Set([ACTIVATE_TOOL, REBIND_TOOL]);
 
 export function createChannelDaemonTransport({
   handleCall,
@@ -46,7 +44,7 @@ export function createChannelDaemonTransport({
   sweepMs = 5_000,
   onClientsEmpty = null,
   getStatus = () => ({}),
-  dispatchBind = null,
+  dispatchControl = null,
   registrationReplayTtlMs = 60_000,
   remoteStatePath = null,
 } = {}) {
@@ -56,10 +54,8 @@ export function createChannelDaemonTransport({
     || (discoveryPath ? join(dirname(discoveryPath), 'channel-remote-state.json') : null);
   // token -> { token, leadPid, cwd, sse, lastSeen, registeredAt }
   const clients = new Map();
-  // leadPid of the last client to claim the bridge / repoint the transcript.
-  // Under a single-owner bridge there is exactly one bound transcript at a
-  // time, so the pointer client IS the transcript owner — this unifies notify
-  // targeting for both inbound-message notifies and proactive injects.
+  // The routing pointer is set ONLY by an explicit manual Remote ON. Client
+  // registration, transcript rebind, and owner death never select a successor.
   let pointerToken = null;
   let boundPort = null;
   // Sticky replay cache for the bridge remote-state notify. The daemon emits
@@ -93,7 +89,7 @@ export function createChannelDaemonTransport({
   function nowMs() { return Date.now(); }
 
   function remoteSessionIdFromBinding(name, args) {
-    if (!POINTER_TOOLS.has(name) || !args || typeof args !== 'object') return null;
+    if (!BINDING_TOOLS.has(name) || !args || typeof args !== 'object') return null;
     const explicit = String(args.sessionId || '').trim();
     if (/^[A-Za-z0-9_-]+$/.test(explicit)) return explicit;
     const transcriptPath = String(args.transcriptPath || '').trim();
@@ -153,15 +149,30 @@ export function createChannelDaemonTransport({
     const c = clients.get(token);
     if (!c) return;
     const wasPointer = pointerToken === token;
+    const shouldDeactivate = wasPointer && remoteAcquired;
     removeClientRecord(token);
     if (pointerToken === token) pointerToken = null;
     log(`client ${token} (lead=${c.leadPid}) removed: ${reason}`);
-    // Pointer client death → hand the seat to a survivor (last-wins among the
-    // living), replay its badge, and rebind the output forwarder to it. Skipped
-    // during stop()/close (grace shutdown owns teardown) and when no live client
-    // remains (grace shutdown path).
-    if (wasPointer && !closed) failoverPointer(reason);
+    // Owner removal always means Remote OFF. Never auto-select or rebind a
+    // survivor; explicitly deactivate the shared backend if the owner vanished
+    // without first sending its normal active:false command.
+    if (wasPointer) {
+      remoteAcquired = false;
+      stickyRemoteFrame = null;
+    }
     publishRemoteOwnerState();
+    if (shouldDeactivate && !closed && typeof dispatchControl === 'function') {
+      try {
+        Promise.resolve()
+          .then(() => dispatchControl(ACTIVATE_TOOL, {
+            active: false,
+            sessionId: c.remoteSessionId || null,
+          }, { clientToken: c.token, leadPid: c.leadPid, cwd: c.cwd }))
+          .catch((err) => log(`owner deactivate failed for lead=${c.leadPid}: ${err?.message || err}`));
+      } catch (err) {
+        log(`owner deactivate failed for lead=${c.leadPid}: ${err?.message || err}`);
+      }
+    }
     maybeArmGrace('client removed');
   }
 
@@ -221,51 +232,6 @@ export function createChannelDaemonTransport({
     return 'cancelled';
   }
 
-  // Pointer failover on owner death. Move the pointer to the most-recently-seen
-  // LIVE client (reason 'failover'), deliver the sticky 'acquired' badge to it
-  // (pending-buffered if it has no SSE yet), and re-dispatch ITS stored bind
-  // intent so the output forwarder rebinds to the survivor's transcript. A
-  // survivor with no stored bind still gets the pointer + badge (no rebind).
-  function failoverPointer(reason) {
-    let best = null;
-    for (const [, c] of liveClients()) {
-      if (!best || c.lastSeen > best.lastSeen) best = c;
-    }
-    if (!best) return; // no live clients — let grace shutdown run
-    remoteAcquired = true;
-    movePointer(best.token, 'failover');
-    // Persist the acquired badge as the sticky frame so a later attachSse (or a
-    // reconnect that follows the pointer) can replay it — matters when the
-    // runtime never emitted 'acquired' since daemon boot (sticky still null).
-    stickyRemoteFrame = JSON.stringify({ type: 'notify', method: REMOTE_STATE_METHOD, params: { state: 'acquired' } });
-    writeRemoteStateTo(best, 'acquired');
-    if (best.lastBind && typeof dispatchBind === 'function') {
-      const { name, args } = best.lastBind;
-      log(`failover rebind -> token=${best.token} lead=${best.leadPid} bind=${name} (${reason})`);
-      try {
-        Promise.resolve()
-          .then(() => dispatchBind(name, args || {}, { clientToken: best.token, leadPid: best.leadPid, cwd: best.cwd }))
-          .catch((err) => log(`failover rebind dispatch failed for lead=${best.leadPid}: ${err?.message || err}`));
-      } catch (err) { log(`failover rebind dispatch failed for lead=${best.leadPid}: ${err?.message || err}`); }
-    }
-  }
-
-  // Re-dispatch a client's stored bind intent so the output forwarder rebinds to
-  // ITS transcript — the same mechanism failoverPointer uses on owner death,
-  // applied when a client GAINS the pointer while already holding a bind (e.g.
-  // migrated by pointer-follows-reconnect). Guarded, logged, non-throwing; does
-  // not touch last-wins ownership or sticky replay.
-  function redispatchPointerBind(client, reason) {
-    if (!client?.lastBind || typeof dispatchBind !== 'function') return;
-    const { name, args } = client.lastBind;
-    log(`pointer rebind -> token=${client.token} lead=${client.leadPid} bind=${name} (${reason})`);
-    try {
-      Promise.resolve()
-        .then(() => dispatchBind(name, args || {}, { clientToken: client.token, leadPid: client.leadPid, cwd: client.cwd }))
-        .catch((err) => log(`pointer rebind dispatch failed for lead=${client.leadPid}: ${err?.message || err}`));
-    } catch (err) { log(`pointer rebind dispatch failed for lead=${client.leadPid}: ${err?.message || err}`); }
-  }
-
   function cancelGrace() {
     if (graceTimer) { try { clearTimeout(graceTimer); } catch {} graceTimer = null; }
   }
@@ -293,32 +259,16 @@ export function createChannelDaemonTransport({
     sweepTimer.unref?.();
   }
 
-  // Resolve the ONE client that should receive a notify. Pointer client first
-  // (pid-verified at delivery), then most-recently-seen live client, else drop.
-  // Never broadcasts — a broadcast would inject one inbound Discord message into
-  // every attached TUI's Lead session.
+  // Resolve the ONE manually enabled client. With no explicit owner, drop the
+  // notify; registration and liveness never invent a routing destination.
   function resolveTarget() {
     if (pointerToken) {
       const c = clients.get(pointerToken);
       if (c && isPidAlive(c.leadPid)) return c;
-      // Dead pointer discovered at notify time (i.e. BEFORE the sweep prunes
-      // it): route removal through dropClient so failoverPointer runs — the
-      // survivor gets the pointer, sticky 'acquired' badge, and its bind
-      // intent re-dispatched. Silently nulling the token here bypassed all of
-      // that (pointer stayed null; survivor never got badge/rebind).
       if (c) dropClient(pointerToken, 'pid dead (notify-time)');
       else pointerToken = null;
-      // failoverPointer (via dropClient) may have installed a new pointer.
-      if (pointerToken) {
-        const p = clients.get(pointerToken);
-        if (p && isPidAlive(p.leadPid)) return p;
-      }
     }
-    let best = null;
-    for (const [, c] of liveClients()) {
-      if (!best || c.lastSeen > best.lastSeen) best = c;
-    }
-    return best;
+    return null;
   }
 
   // Write a targeted remote-state frame to ONE client's SSE. If that client has
@@ -333,39 +283,28 @@ export function createChannelDaemonTransport({
     catch (err) { log(`remote-state '${state}' write failed for lead=${client.leadPid}: ${err?.message || err}`); return false; }
   }
 
-  // Unified last-wins ownership move. The pointer client owns ALL THREE of
-  // inbound notify routing, outbound transcript binding, and the remote badge.
-  // Every move (new TUI register OR a bind-intent /call) hands the seat to the
-  // newcomer AND tells the DISPLACED owner it lost via a targeted 'superseded'
-  // frame — so the old TUI drops its badge and stops pushing rebinds. Skip the
-  // superseded when the old/new client share a leadPid (same TUI reconnecting /
-  // re-binding to itself — it never "lost").
-  function movePointer(newToken, reason) {
+  // Manual ON is the only ownership transition. It may temporarily point at
+  // the claimant before backend activation so a synchronous acquired notify is
+  // routed correctly; the displaced owner is notified only after activation
+  // succeeds.
+  function movePointer(newToken, reason, { notifyDisplaced = true } = {}) {
     const oldToken = pointerToken;
     if (oldToken === newToken) {
       pointerToken = newToken;
       publishRemoteOwnerState();
-      return;
+      return oldToken;
     }
     pointerToken = newToken;
     const oldClient = oldToken ? clients.get(oldToken) : null;
     const newClient = clients.get(newToken);
     log(`routing pointer -> token=${newToken} lead=${newClient?.leadPid ?? '?'} via ${reason}`);
     publishRemoteOwnerState();
-    if (!oldClient || oldClient === newClient) return;
-    if (newClient && oldClient.leadPid === newClient.leadPid) return; // same TUI
-    if (isPidAlive(oldClient.leadPid)) {
+    if (notifyDisplaced && oldClient && oldClient !== newClient && isPidAlive(oldClient.leadPid)) {
       if (writeRemoteStateTo(oldClient, 'superseded')) {
         log(`superseded -> displaced pointer token=${oldToken} lead=${oldClient.leadPid}`);
       }
     }
-    // Newcomer gaining the seat with a stored bind must rebind the output
-    // forwarder to ITS transcript, mirroring failoverPointer. Only for moves
-    // that carry NO fresh bind of their own: a POINTER_TOOLS /call already
-    // dispatches the new bind right after this returns (redispatching the stale
-    // lastBind first would fire an out-of-date rebind), and 'failover'
-    // self-dispatches best.lastBind. Last-wins ordering above is untouched.
-    if (reason !== 'failover' && !POINTER_TOOLS.has(reason)) redispatchPointerBind(newClient, reason);
+    return oldToken;
   }
 
   function notify(method, params) {
@@ -377,11 +316,18 @@ export function createChannelDaemonTransport({
         // a late attach that IS the pointer can replay it. Under last-wins the
         // owner is exactly the pointer client, so deliver ONLY there — a
         // broadcast would light the badge on displaced/non-owner TUIs.
+        const target = resolveTarget();
+        if (!target) {
+          remoteAcquired = false;
+          stickyRemoteFrame = null;
+          publishRemoteOwnerState();
+          log('remote-state acquired ignored (no manual owner)');
+          return false;
+        }
         remoteAcquired = true;
         stickyRemoteFrame = frame;
         publishRemoteOwnerState();
-        const target = resolveTarget();
-        if (!target?.sse) { log('remote-state acquired not delivered (no live pointer SSE); sticky set'); return false; }
+        if (!target.sse) { log('remote-state acquired not delivered (manual owner has no SSE); sticky set'); return false; }
         try { target.sse.write(`data: ${frame}\n\n`); return true; }
         catch (err) { log(`remote-state acquired write failed for lead=${target.leadPid}: ${err?.message || err}`); return false; }
       }
@@ -474,51 +420,13 @@ export function createChannelDaemonTransport({
       // Token-scoped state belongs to the logical client, not only the owner.
       // A non-owner can hold a buffered superseded frame or stored bind intent.
       if (replaced.pending?.length) fresh.pending.push(...replaced.pending.splice(0));
-      if (replaced.lastBind) fresh.lastBind = replaced.lastBind;
       if (replaced.remoteSessionId) fresh.remoteSessionId = replaced.remoteSessionId;
       if (replacedWasPointer) pointerToken = token;
       removeClientRecord(replaced.token);
       log(`client reconnect replaced token=${replaced.token} -> ${token} lead=${pid}`);
-      if (replacedWasPointer) redispatchPointerBind(fresh, 'reconnect');
       return rememberReplacement(token);
     }
-    // Pointer-follows-pid: if the current pointer client shares this leadPid AND
-    // has no live SSE, it is the SAME terminal re-registering after its stream
-    // dropped. That old entry is a dead-stream blackhole — pid-prune never reaps
-    // it (pid still alive) and sse-close never drops entries, so resolveTarget
-    // would write to a dead stream forever. Transfer the seat to the fresh
-    // token, migrate its buffered pending frames + last bind intent, and remove
-    // the old entry WITHOUT a failover or a self-'superseded'. A live-stream
-    // pointer that happens to share the pid (e.g. co-located clients) is left
-    // alone — a genuine fresh attach remains an observer until it binds.
-    if (pointerToken && pointerToken !== token) {
-      const old = clients.get(pointerToken);
-      if (old && old.leadPid === pid && !old.sse) {
-        const fresh = clients.get(token);
-        if (old.pending?.length) fresh.pending.push(...old.pending.splice(0));
-        if (old.lastBind) fresh.lastBind = old.lastBind;
-        if (old.remoteSessionId) fresh.remoteSessionId = old.remoteSessionId;
-        removeClientRecord(pointerToken);
-        pointerToken = token;
-        log(`pointer follows reconnect -> token=${token} lead=${pid} (old entry dropped)`);
-        // The fresh token inherited the old entry's bind intent but never went
-        // through movePointer — re-dispatch it so the forwarder rebinds to this
-        // reconnected terminal's transcript (guarded/no-op when no lastBind).
-        redispatchPointerBind(fresh, 'reconnect');
-        return rememberReplacement(token);
-      }
-    }
-    // Registration establishes transport connectivity only. Desktop engine
-    // prewarm, automation, and remote auto-start may all attach to an existing
-    // daemon without claiming its active terminal's relay seat. Only an
-    // explicit pointer tool (/remote claim or transcript bind) may move an
-    // occupied pointer and supersede its owner. Adopt a vacant pointer so the
-    // first client still receives daemon notifications without a blackhole.
-    if (!pointerToken) {
-      pointerToken = token;
-      publishRemoteOwnerState();
-      log(`routing pointer initialized -> token=${token} lead=${pid}`);
-    }
+    // Registration is transport-only, including same-pid fresh attaches.
     return rememberReplacement(token);
   }
 
@@ -621,30 +529,6 @@ export function createChannelDaemonTransport({
         }
         c.lastSeen = nowMs();
         const name = String(body.name || '');
-        const pointerCall = Boolean(c && POINTER_TOOLS.has(name));
-        const pointerOwner = pointerToken ? clients.get(pointerToken) : null;
-        const claimIfVacant = name === 'activate_channel_bridge'
-          && body.args?.active === true
-          && body.args?.claimIfVacant === true;
-        const claimBlocked = claimIfVacant
-          && pointerToken !== clientToken
-          && remoteAcquired === true
-          && Boolean(pointerOwner?.remoteSessionId);
-        const pointerMove = pointerCall && !claimBlocked;
-        const previousRemoteSessionId = c?.remoteSessionId || null;
-        const previousRemoteAcquired = remoteAcquired;
-        // Bind-intent calls re-point routing at the caller BEFORE dispatch, so a
-        // notify emitted synchronously during the call already targets it.
-        if (pointerMove) {
-          const bindingSessionId = remoteSessionIdFromBinding(name, body.args);
-          if (bindingSessionId) c.remoteSessionId = bindingSessionId;
-          if (name === 'activate_channel_bridge' && body.args?.active === false) {
-            remoteAcquired = false;
-          }
-          // Explicit bind claims are last-wins. Auto claims reach here only
-          // when no live bound remote owner occupies the pointer.
-          movePointer(clientToken, name);
-        }
         const callId = body.callId ? String(body.callId) : null;
         let dispatch;
         if (callId && callCache.has(callId)) {
@@ -652,16 +536,83 @@ export function createChannelDaemonTransport({
           // side-effect) instead of dispatching handleCall a second time.
           dispatch = callCache.get(callId).promise;
         } else {
-          dispatch = claimBlocked
-            ? Promise.resolve({
-              content: [{ type: 'text', text: 'channel bridge claim skipped: live remote owner' }],
-              claimSkipped: true,
-            })
-            : Promise.resolve().then(() => handleCall(name, body.args || {}, {
-              clientToken,
-              leadPid: c?.leadPid ?? null,
-              cwd: c?.cwd ?? null,
-            }));
+          dispatch = Promise.resolve().then(async () => {
+            const args = body.args || {};
+            const activationCall = name === ACTIVATE_TOOL;
+            const activating = activationCall && args.active === true;
+            const deactivating = activationCall && args.active === false;
+            const rebindCall = name === REBIND_TOOL;
+            const bindingSessionId = remoteSessionIdFromBinding(name, args);
+            // Auto/implicit activation is retired. A valid manual ON always
+            // carries its target session and explicitly overrides the old one.
+            if (activating && (args.claimIfVacant === true || !bindingSessionId)) {
+              return {
+                content: [{ type: 'text', text: 'channel bridge claim skipped: manual ON required' }],
+                claimSkipped: true,
+              };
+            }
+            // A stale displaced session can never turn the new manual owner off.
+            if (deactivating && (pointerToken !== clientToken || !bindingSessionId
+                || c.remoteSessionId !== bindingSessionId)) {
+              return {
+                content: [{ type: 'text', text: 'channel bridge release skipped: not current owner' }],
+                releaseSkipped: true,
+              };
+            }
+            // Transcript refresh is owner-only and session-matched. It may
+            // update forwarding but can never acquire or move the owner.
+            if (rebindCall && (pointerToken !== clientToken || !remoteAcquired
+                || !bindingSessionId || c.remoteSessionId !== bindingSessionId)) {
+              return {
+                content: [{ type: 'text', text: 'transcript rebind skipped: not current owner' }],
+                rebindSkipped: true,
+              };
+            }
+
+            const previousPointerToken = pointerToken;
+            const previousRemoteSessionId = c.remoteSessionId || null;
+            const previousRemoteAcquired = remoteAcquired;
+            const previousStickyRemoteFrame = stickyRemoteFrame;
+            if (activating) {
+              c.remoteSessionId = bindingSessionId;
+              movePointer(clientToken, 'manual remote ON', { notifyDisplaced: false });
+            }
+            try {
+              const result = await handleCall(name, args, {
+                clientToken,
+                leadPid: c?.leadPid ?? null,
+                cwd: c?.cwd ?? null,
+              });
+              if (activating && previousPointerToken && previousPointerToken !== clientToken) {
+                const displaced = clients.get(previousPointerToken);
+                if (displaced && isPidAlive(displaced.leadPid)
+                    && writeRemoteStateTo(displaced, 'superseded')) {
+                  log(`superseded -> displaced manual owner token=${previousPointerToken} lead=${displaced.leadPid}`);
+                }
+              }
+              if (deactivating && pointerToken === clientToken
+                  && c.remoteSessionId === bindingSessionId) {
+                pointerToken = null;
+                c.remoteSessionId = null;
+                remoteAcquired = false;
+                stickyRemoteFrame = null;
+              }
+              publishRemoteOwnerState();
+              return result;
+            } catch (err) {
+              if (activating && pointerToken === clientToken
+                  && c.remoteSessionId === bindingSessionId) {
+                pointerToken = previousPointerToken && clients.has(previousPointerToken)
+                  ? previousPointerToken
+                  : null;
+                c.remoteSessionId = previousRemoteSessionId;
+                remoteAcquired = previousRemoteAcquired;
+                stickyRemoteFrame = previousStickyRemoteFrame;
+                publishRemoteOwnerState();
+              }
+              throw err;
+            }
+          });
           if (callId) {
             callCache.set(callId, { promise: dispatch, at: nowMs() });
             // Start the TTL only once the call SETTLES: an in-flight call can
@@ -676,19 +627,8 @@ export function createChannelDaemonTransport({
         }
         try {
           const result = await dispatch;
-          // Record the caller's last bind intent so a failover can rebind the
-          // output forwarder to THIS client's transcript when it becomes owner.
-          if (pointerMove) {
-            c.lastBind = { name, args: body.args || {} };
-            publishRemoteOwnerState();
-          }
           sendJson(res, { result });
         } catch (err) {
-          if (pointerMove) {
-            c.remoteSessionId = previousRemoteSessionId;
-            remoteAcquired = previousRemoteAcquired;
-            publishRemoteOwnerState();
-          }
           sendJson(res, { error: err?.message || String(err) }, 200);
         }
         return;
@@ -760,5 +700,6 @@ export function createChannelDaemonTransport({
     _clientsForTest: clients,
     _registrationReplaysForTest: registrationReplays,
     _resolveTargetForTest: resolveTarget,
+    get _pointerTokenForTest() { return pointerToken; },
   };
 }

package/src/standalone/channel-daemon.mjs

@@ -136,9 +136,8 @@ async function main() {
   // skips runWorkerIpc; this triggers its boot side effects (config/backend).
   channels = await import('../runtime/channels/index.mjs');
 
-  // Pointer-move tools re-point active-instance owner/cwd at the binding TUI
-  // (mirrors the transport's routing pointer) so external readers see the
-  // pointer TUI, not the daemon's spawner.
+  // Accepted owner controls refresh active-instance context. The transport
+  // admits rebind only for the current manual owner.
   const POINTER_TOOLS = new Set(['activate_channel_bridge', 'rebind_current_transcript']);
   const handleCall = (name, args, ctx) => {
     if (ctx && POINTER_TOOLS.has(name)) {
@@ -148,10 +147,9 @@ async function main() {
   };
   transport = createChannelDaemonTransport({
     handleCall,
-    // Failover re-dispatch of the survivor's stored bind intent goes through the
-    // SAME handleCall + setOwnerContext path a POINTER_TOOLS /call uses, so the
-    // output forwarder rebinds to the survivor's transcript on pointer death.
-    dispatchBind: (name, args, ctx) => handleCall(name, args, ctx),
+    // If a manual owner disappears without sending OFF, deactivate the backend.
+    // No survivor is selected or rebound.
+    dispatchControl: (name, args, ctx) => handleCall(name, args, ctx),
     discoveryPath: DISCOVERY_PATH,
     log,
     // Self-shutdown when the last attached TUI leaves (reuses the SSE/client
@@ -188,11 +186,12 @@ async function main() {
   }
   log(`ready port=${port} pid=${process.pid} in ${(performance.now() - startedAt).toFixed(0)}ms`);
 
-  // Boot messaging only for an explicit/auto remote request. Automation may
+  // Boot messaging only for an explicit manual remote request. Automation may
   // spawn the shared daemon with no remote intent; keep schedules/webhooks live
-  // without connecting the channel backend until a Remote claim arrives.
+  // without connecting the channel backend until a manual Remote ON arrives.
+  // Legacy `auto` intent is deliberately ignored.
   const remoteIntent = String(process.env.MIXDOG_REMOTE_INTENT || '');
-  const messaging = remoteIntent === 'explicit' || remoteIntent === 'auto';
+  const messaging = remoteIntent === 'explicit';
   void Promise.resolve().then(() => channels.start({ messaging }))
     .catch((e) => log(`channels.start failed (non-fatal): ${e?.message || e}`));
 

package/src/standalone/usage-dashboard.mjs

@@ -82,6 +82,19 @@ function normaliseWindows(value, source = 'config') {
   }).filter(Boolean);
 }
 
+function normaliseResetCredits(value) {
+  if (!value || typeof value !== 'object') return null;
+  const availableCount = num(value.availableCount ?? value.available_count, null);
+  const offerRevision = clean(value.offerRevision ?? value.offer_revision);
+  if (availableCount === null || !offerRevision) return null;
+  const nextExpiresAt = num(value.nextExpiresAt ?? value.next_expires_at, null);
+  return {
+    availableCount: Math.max(0, Math.floor(availableCount)),
+    offerRevision,
+    ...(nextExpiresAt && nextExpiresAt > 0 ? { nextExpiresAt } : {}),
+  };
+}
+
 function localBudget(providerCfg = {}) {
   const limitUsd = num(
     providerCfg.limitUsd ?? providerCfg.limit_usd ?? providerCfg.budgetUsd ?? providerCfg.budget_usd
@@ -224,7 +237,14 @@ async function oauthSnapshot(providerId, { refresh, getProvider, log }) {
   if (typeof getProvider === 'function') {
     try {
       const providerObj = getProvider(providerId);
-      if (providerObj) return await fetchOAuthUsageSnapshot({ provider: providerId, model: '' }, providerObj, log);
+      if (providerObj) {
+        return await fetchOAuthUsageSnapshot(
+          { provider: providerId, model: '' },
+          providerObj,
+          log,
+          { force: refresh === true },
+        );
+      }
     } catch {
       return null;
     }
@@ -544,7 +564,9 @@ export async function createUsageDashboard(config = {}, options = {}) {
         const snapshot = await oauthSnapshot(item.id, options);
         const known = snapshotRemaining(snapshot);
         const windows = normaliseWindows(snapshot?.quotaWindows, clean(snapshot?.source) || 'provider-api');
+        const resetCredits = normaliseResetCredits(snapshot?.resetCredits);
         row.windows = windows;
+        if (resetCredits) row.resetCredits = resetCredits;
         row.updatedAt = num(snapshot?.cachedAt, null);
         if (known) {
           applyKnownRemaining(row, known, { estimated: false });