tibodog 0.1.1 → 0.1.3

package/app/Sources/TiboDog/App.swift

@@ -70,9 +70,14 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
     private var panel: NotchPanel?
     private var geometry: NotchGeometry?
     private var observers: [Any] = []
+    private var signalSources: [DispatchSourceSignal] = []
 
     func applicationDidFinishLaunching(_ notification: Notification) {
         NSApp.setActivationPolicy(.accessory)
+        quitOnSignals()
+        // Writing to a helper that just exited (codex, perl) must be an error we handle, not a SIGPIPE
+        // that kills the app.
+        signal(SIGPIPE, SIG_IGN)
         let store = UsageStore.shared
         store.start()
         rebuildPanel()
@@ -139,14 +144,25 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
         return out
     }
 
+    /// `pkill`, Ctrl-C or a logout quit like the menu's Quit, so the Now Playing helper stops with us.
+    private func quitOnSignals() {
+        for sig in [SIGTERM, SIGINT, SIGHUP] {
+            signal(sig, SIG_IGN)
+            let source = DispatchSource.makeSignalSource(signal: sig, queue: .main)
+            source.setEventHandler { NSApp.terminate(nil) }
+            source.resume()
+            signalSources.append(source)
+        }
+    }
+
     func applicationWillTerminate(_ notification: Notification) {
         NowPlayingMonitor.shared.stop()
     }
 
     private func rebuildPanel() {
         let store = UsageStore.shared
-        let geo = NotchGeometry.detect()
-        guard store.showNotch else {
+        // No notch wanted, or no screen right now: hide it; the next screen change brings it back.
+        guard store.showNotch, let geo = NotchGeometry.detect() else {
             panel?.orderOut(nil); panel = nil; geometry = nil
             return
         }

package/app/Sources/TiboDog/CodexUsageAPI.swift

@@ -58,8 +58,11 @@ enum CodexUsageAPI {
         try process.run()
         let pid = process.processIdentifier
         defer {
+            // codex may start helpers of its own (MCP servers): they go when it does.
+            let helpers = children(of: pid)
             try? input.fileHandleForWriting.close()
             if process.isRunning { process.terminate() }
+            for child in helpers { kill(child, SIGTERM) }
             // Do not let a hung child accumulate across refreshes.
             let deadline = Date().addingTimeInterval(1)
             while process.isRunning && Date() < deadline { Thread.sleep(forTimeInterval: 0.01) }
@@ -87,8 +90,9 @@ enum CodexUsageAPI {
             while let newline = buffer.firstIndex(of: 10) {
                 let line = buffer.prefix(upTo: newline)
                 buffer.removeSubrange(...newline)
-                guard let message = try JSONSerialization.jsonObject(with: line) as? [String: Any] else { continue }
-                guard let id = message["id"] as? Int else { continue }
+                // Skip anything that isn't a reply to us: log lines, blank lines, codex's own requests.
+                guard let message = (try? JSONSerialization.jsonObject(with: line)) as? [String: Any],
+                      message["method"] == nil, let id = message["id"] as? Int else { continue }
                 guard message["error"] == nil else { throw Failure.unavailable }
                 if id == 1 {
                     try send(["method": "initialized"])
@@ -104,6 +108,12 @@ enum CodexUsageAPI {
         throw Failure.timeout
     }
 
+    private static func children(of pid: pid_t) -> [pid_t] {
+        var buffer = [pid_t](repeating: 0, count: 64)
+        let count = proc_listchildpids(pid, &buffer, Int32(MemoryLayout<pid_t>.size * buffer.count))
+        return count > 0 ? Array(buffer.prefix(Int(count))) : []
+    }
+
     static func decode(_ result: [String: Any]) throws -> (usage: Usage, plan: String?, resetCredits: Int?) {
         let buckets = result["rateLimitsByLimitId"] as? [String: Any]
         // Never substitute an unrelated model bucket for the Codex quota.

package/app/Sources/TiboDog/Credentials.swift

@@ -64,7 +64,7 @@ struct Credentials {
 
 enum CredentialSource: CustomStringConvertible {
     case keychain              // direct SecItem access (may prompt for permission)
-    case securityCLI(String)   // /usr/bin/security (account name), no per-app prompt
+    case securityCLI(String?)  // /usr/bin/security (account name, if it could be read), no per-app prompt
     case file(URL)
 
     var description: String {
@@ -80,6 +80,7 @@ enum CredentialError: LocalizedError {
     case notFound
     case signedOut
     case malformed
+    case unknownAccount
     case keychain(OSStatus)
 
     var errorDescription: String? {
@@ -87,6 +88,7 @@ enum CredentialError: LocalizedError {
         case .notFound: return "Claude Code credentials not found. Run `claude` and sign in first."
         case .signedOut: return "Claude Code is signed out. Run `claude` in Terminal and /login."
         case .malformed: return "Credentials found but not in the expected format."
+        case .unknownAccount: return "Couldn't tell which Keychain account holds the Claude login, so it wasn't updated."
         case .keychain(let s):
             let msg = SecCopyErrorMessageString(s, nil) as String? ?? "OSStatus \(s)"
             return "Keychain error: \(msg)"
@@ -122,7 +124,31 @@ enum CredentialStore {
         }
     }
 
+    // A refreshed login that couldn't be written back yet. The refresh token rotates on refresh, so
+    // dropping it would sign Claude Code out; it's used (and saved again) until the store catches up.
+    private static let pendingLock = NSLock()
+    nonisolated(unsafe) private static var pending: (replaces: String?, fresh: Credentials, source: CredentialSource)?
+
+    static func holdUnsaved(_ fresh: Credentials, replacing old: Credentials, source: CredentialSource) {
+        pendingLock.lock(); defer { pendingLock.unlock() }
+        pending = (old.refreshToken, fresh, source)
+    }
+
     static func load() throws -> (Credentials, CredentialSource) {
+        let (stored, source) = try loadStored()
+        pendingLock.lock(); defer { pendingLock.unlock() }
+        guard let p = pending else { return (stored, source) }
+        // The store still has the login we refreshed from: ours is newer, try writing it again.
+        if stored.refreshToken == p.replaces {
+            if (try? save(p.fresh, to: p.source)) != nil { pending = nil; Log.info("refreshed token written back") }
+            return (p.fresh, p.source)
+        }
+        // Someone else (Claude Code, a new /login) changed it since: theirs wins.
+        pending = nil
+        return (stored, source)
+    }
+
+    private static func loadStored() throws -> (Credentials, CredentialSource) {
         // 1) /usr/bin/security: an Apple-signed tool already trusted for this item on most
         //    machines, so it reads the token without raising a per-app Keychain prompt.
         if let (data, account) = readViaSecurityCLI() {
@@ -159,12 +185,16 @@ enum CredentialStore {
     /// Runs `security` with stdout captured through a temp file. Using a file (not a Pipe)
     /// means we never have to drain a pipe while blocking a thread, so this is safe to call
     /// synchronously from the main actor without risking a pipe-buffer deadlock.
-    private static func runSecurity(_ args: [String]) -> (Int32, Data) {
+    /// `input` goes to its stdin; nothing secret ever goes in `args` (other users can see argv in `ps`).
+    /// Gives up after 10s: a Keychain dialog nobody answers must not stall refreshes forever.
+    private static func runSecurity(_ args: [String], input: Data? = nil) -> (Int32, Data) {
         let proc = Process()
         proc.executableURL = URL(fileURLWithPath: "/usr/bin/security")
         proc.arguments = args
+        let stdin = Pipe()
+        proc.standardInput = input == nil ? FileHandle.nullDevice : stdin
         let tmp = URL(fileURLWithPath: NSTemporaryDirectory())
-            .appendingPathComponent("islet-sec-\(UUID().uuidString)")
+            .appendingPathComponent("tibodog-sec-\(UUID().uuidString)")
         FileManager.default.createFile(atPath: tmp.path, contents: nil)
         guard let handle = try? FileHandle(forWritingTo: tmp) else { return (-1, Data()) }
         defer { try? FileManager.default.removeItem(at: tmp) }
@@ -175,14 +205,23 @@ enum CredentialStore {
         let done = DispatchSemaphore(value: 0)
         proc.terminationHandler = { _ in done.signal() }
         do { try proc.run() } catch { try? handle.close(); return (-1, Data()) }
-        done.wait()
+        if let input {
+            try? stdin.fileHandleForWriting.write(contentsOf: input)
+            try? stdin.fileHandleForWriting.close()
+        }
+        if done.wait(timeout: .now() + 10) == .timedOut {
+            proc.terminate()
+            _ = done.wait(timeout: .now() + 2)
+            try? handle.close()
+            return (-1, Data())
+        }
         try? handle.close()
         let data = (try? Data(contentsOf: tmp)) ?? Data()
         return (proc.terminationStatus, data)
     }
 
     /// Reads the raw JSON blob and the account name it is stored under, if the tool succeeds.
-    private static func readViaSecurityCLI() -> (Data, String)? {
+    private static func readViaSecurityCLI() -> (Data, String?)? {
         let (code, data) = runSecurity(["find-generic-password", "-s", service, "-w"])
         guard code == 0 else { return nil }
         var blob = data
@@ -190,7 +229,7 @@ enum CredentialStore {
         guard !blob.isEmpty else { return nil }
         // The account is needed to update the same item in place later.
         let (mcode, meta) = runSecurity(["find-generic-password", "-s", service, "-g"])
-        var account = NSUserName()
+        var account: String?
         if mcode == 0, let text = String(data: meta, encoding: .utf8),
            let range = text.range(of: "\"acct\"<blob>=\"") {
             let rest = text[range.upperBound...]
@@ -199,10 +238,17 @@ enum CredentialStore {
         return (blob, account)
     }
 
-    private static func writeViaSecurityCLI(_ data: Data, account: String) throws {
-        // -U updates the existing item in place, preserving its access control.
-        guard let json = String(data: data, encoding: .utf8) else { throw CredentialError.malformed }
-        let (code, _) = runSecurity(["add-generic-password", "-U", "-s", service, "-a", account, "-w", json])
+    private static func writeViaSecurityCLI(_ data: Data, account: String?) throws {
+        // Guessing the account would add a second item beside Claude Code's instead of updating it.
+        guard let account else { throw CredentialError.unknownAccount }
+        guard let json = String(data: data, encoding: .utf8), !json.contains("\n") else { throw CredentialError.malformed }
+        // -U updates the existing item in place, preserving its access control. The command goes in
+        // through `security -i` on stdin, so the token never shows up in a process list.
+        func quoted(_ s: String) -> String {
+            "\"" + s.replacingOccurrences(of: "\\", with: "\\\\").replacingOccurrences(of: "\"", with: "\\\"") + "\""
+        }
+        let command = "add-generic-password -U -s \(quoted(service)) -a \(quoted(account)) -w \(quoted(json))\n"
+        let (code, _) = runSecurity(["-i"], input: Data(command.utf8))
         guard code == 0 else { throw CredentialError.keychain(errSecAuthFailed) }
     }
 

package/app/Sources/TiboDog/DogMonitor.swift

@@ -22,53 +22,83 @@ func L(_ ko: String, _ en: String) -> String {
     Locale.preferredLanguages.first?.hasPrefix("ko") == true ? ko : en
 }
 
+/// Only a post on x.com/twitter.com over https: the link comes from a feed, which must not be able to
+/// open a file, an app or another app's URL scheme.
+func isPostURL(_ url: URL) -> Bool {
+    guard url.scheme == "https", let host = url.host?.lowercased() else { return false }
+    let hosts = ["x.com", "twitter.com", "www.x.com", "www.twitter.com", "mobile.twitter.com", "mobile.x.com"]
+    return hosts.contains(host) && url.path.contains("/status/")
+}
+
 /// The dog widget: from the moment tibodog sees Tibo reset the limits, a dog barks beside the notch until
-/// the person opens the island and reads the post. Read every two seconds from tibodog's folder; once read,
-/// the post's id goes to alert-seen there so the dog stays quiet after a restart.
+/// the person opens the island and reads the post. Read every two seconds from tibodog's folder: the CLI
+/// writes alert.json, the widget writes credit.json when a reset credit comes in. Read ids go to
+/// alert-seen there (one per line) so the dog stays quiet after a restart.
 @MainActor
 final class DogMonitor: ObservableObject {
     static let shared = DogMonitor()
 
-    /// The reset not read yet, or nil.
+    /// The reset not read yet, or nil (a post on X first, then a reset credit).
     @Published private(set) var alert: DogAlert?
+    /// Whether the dog is moving right now: all the time for the first minute, then a short bark every
+    /// ten seconds, so an alert left unread for days doesn't redraw the notch 30 times a second.
+    @Published private(set) var barking = false
 
     private var timer: Timer?
+    private var shownAt = Date()
     private let dir = ProcessInfo.processInfo.environment["TIBODOG_HOME"]
         ?? (NSHomeDirectory() as NSString).appendingPathComponent(".tibodog")
-    private var alertPath: String { (dir as NSString).appendingPathComponent("alert.json") }
-    private var seenPath: String { (dir as NSString).appendingPathComponent("alert-seen") }
+    private func path(_ name: String) -> String { (dir as NSString).appendingPathComponent(name) }
 
     private init() {
-        timer = Timer.scheduledTimer(withTimeInterval: 2, repeats: true) { [weak self] _ in
-            Task { @MainActor in self?.poll() }
+        timer = Timer.scheduledTimer(withTimeInterval: 0.5, repeats: true) { [weak self] _ in
+            Task { @MainActor in self?.tick() }
         }
         poll()
     }
 
-    func poll() {
+    private var ticks = 0
+    private func tick() {
+        ticks += 1
+        if ticks % 4 == 0 { poll() }
+        let since = Date().timeIntervalSince(shownAt)
+        let now = alert != nil && (since < 60 || since.truncatingRemainder(dividingBy: 10) < 2)
+        if now != barking { barking = now }
+    }
+
+    private func read(_ name: String) -> DogAlert? {
         let decoder = JSONDecoder()
         decoder.dateDecodingStrategy = .secondsSince1970
-        guard let data = FileManager.default.contents(atPath: alertPath),
-              let a = try? decoder.decode(DogAlert.self, from: data) else {
-            if alert != nil { alert = nil }
-            return
-        }
-        let seen = (try? String(contentsOfFile: seenPath, encoding: .utf8))?.trimmingCharacters(in: .whitespacesAndNewlines)
-        let unread = seen == a.id ? nil : a
+        guard let data = FileManager.default.contents(atPath: path(name)) else { return nil }
+        return try? decoder.decode(DogAlert.self, from: data)
+    }
+
+    private var seen: Set<String> {
+        let text = (try? String(contentsOfFile: path("alert-seen"), encoding: .utf8)) ?? ""
+        return Set(text.split(whereSeparator: \.isNewline).map(String.init))
+    }
+
+    func poll() {
+        let seen = seen
+        let unread = [read("alert.json"), read("credit.json")].compactMap { $0 }.first { !seen.contains($0.id) }
         if unread != alert {
+            if unread?.id != alert?.id { shownAt = Date() }
             alert = unread
             // A new reset: check right away whether it reached this Codex account.
-            if unread != nil, !unread!.isCredit { ResetTracker.shared.check() }
+            if let a = unread, !a.isCredit { ResetTracker.shared.check() }
         }
     }
 
-    func markRead() {
-        guard let a = alert else { return }
-        try? a.id.write(toFile: seenPath, atomically: true, encoding: .utf8)
-        alert = nil
+    /// Marks that alert read (only the one that was actually on screen, not whatever came in since).
+    func markRead(_ id: String) {
+        let kept = (try? String(contentsOfFile: path("alert-seen"), encoding: .utf8))?
+            .split(whereSeparator: \.isNewline).map(String.init).suffix(50) ?? []
+        let lines = (Array(kept) + [id]).joined(separator: "\n") + "\n"
+        try? lines.write(toFile: path("alert-seen"), atomically: true, encoding: .utf8)
+        poll()
     }
 
-    /// A reset credit came in: the dog barks about that too.
+    /// A reset credit came in: the dog barks about that too (beside, not over, an unread post).
     func creditArrived(from before: Int, to now: Int) {
         let card: [String: Any] = [
             "id": "credit-\(now)-\(Int(Date().timeIntervalSince1970))",
@@ -81,14 +111,14 @@ final class DogMonitor: ObservableObject {
         ]
         guard let data = try? JSONSerialization.data(withJSONObject: card) else { return }
         try? FileManager.default.createDirectory(atPath: dir, withIntermediateDirectories: true)
-        try? data.write(to: URL(fileURLWithPath: alertPath), options: .atomic)
+        try? data.write(to: URL(fileURLWithPath: path("credit.json")), options: .atomic)
         poll()
     }
 
     /// The post on X; opening it counts as reading it.
     func openPost() {
-        guard let s = alert?.url, let url = URL(string: s) else { return }
-        NSWorkspace.shared.open(url)
-        markRead()
+        guard let a = alert else { return }
+        if let s = a.url, let url = URL(string: s), isPostURL(url) { NSWorkspace.shared.open(url) }
+        markRead(a.id)
     }
 }

package/app/Sources/TiboDog/Models.swift

@@ -20,8 +20,8 @@ struct UsageWindow: Equatable {
         return "\(m)M"
     }
 
-    var fraction: Double { min(max(utilization / 100, 0), 1) }
-    var percentText: String { "\(Int(utilization.rounded()))%" }
+    var fraction: Double { utilization.isFinite ? min(max(utilization / 100, 0), 1) : 0 }
+    var percentText: String { utilization.isFinite ? "\(Int(min(max(utilization, -999), 9999).rounded()))%" : "–" }
 }
 
 /// Snapshot of every window the endpoint returned.

package/app/Sources/TiboDog/NotchGeometry.swift

@@ -7,9 +7,12 @@ struct NotchGeometry: Equatable {
     let notchWidth: CGFloat
     let notchHeight: CGFloat
 
-    static func detect() -> NotchGeometry {
+    /// nil while there's no screen at all (lid closed with nothing attached, mid-reconfiguration).
+    static func detect() -> NotchGeometry? {
         let screens = NSScreen.screens
-        let screen = screens.first { $0.safeAreaInsets.top > 0 } ?? NSScreen.main ?? screens[0]
+        guard let screen = screens.first(where: { $0.safeAreaInsets.top > 0 }) ?? NSScreen.main ?? screens.first else {
+            return nil
+        }
         let inset = screen.safeAreaInsets.top
         if inset > 0, let l = screen.auxiliaryTopLeftArea, let r = screen.auxiliaryTopRightArea {
             let w = screen.frame.width - l.width - r.width

package/app/Sources/TiboDog/NotchView.swift

@@ -11,8 +11,9 @@ struct NotchView: View {
 
     @State private var hovering = ProcessInfo.processInfo.environment["TIBODOG_EXPANDED"] == "1"
     @State private var collapseTask: Task<Void, Never>?
-    /// When the island opened: open long enough, the dog's post counts as read when it closes.
-    @State private var openedAt: Date?
+    /// The alert on screen while the island is open, and since when: shown long enough, it counts as read
+    /// when the island closes (one that came in at the last moment doesn't).
+    @State private var shown: (id: String, since: Date)?
 
     private let expandedWidth: CGFloat = 440
     // Beside the notch, each side is the gauge and what's next to it (the barking dog, the album art, the
@@ -54,22 +55,27 @@ struct NotchView: View {
         )
         .contentShape(Rectangle())
         .contextMenu { TiboDogMenu() }
+        .onChange(of: dog.alert?.id) { _, id in
+            if hovering { shown = id.map { ($0, Date()) } }
+        }
         .onHover { over in
             collapseTask?.cancel()
             if over {
-                if !hovering { openedAt = Date() }
+                if !hovering { shown = dog.alert.map { ($0.id, Date()) } }
                 withAnimation(.spring(response: 0.36, dampingFraction: 0.82)) { hovering = true }
             } else {
                 collapseTask = Task {
                     try? await Task.sleep(for: .milliseconds(180))
                     guard !Task.isCancelled else { return }
                     // A quick brush doesn't count: the dog keeps barking until the post was open for a moment.
-                    let read = openedAt.map { Date().timeIntervalSince($0) >= 1 } ?? false
+                    let read = shown.flatMap { s in
+                        s.id == dog.alert?.id && Date().timeIntervalSince(s.since) >= 1 ? s.id : nil
+                    }
                     withAnimation(.spring(response: 0.32, dampingFraction: 0.86)) {
                         hovering = false
-                        if read { dog.markRead() }
+                        if let id = read { dog.markRead(id) }
                     }
-                    openedAt = nil
+                    shown = nil
                 }
             }
         }
@@ -322,7 +328,7 @@ struct NowPlayingRow: View {
     }
 
     private func mmss(_ s: Double) -> String {
-        let v = max(0, Int(s))
+        let v = s.isFinite ? Int(min(max(s, 0), 360_000)) : 0
         return String(format: "%d:%02d", v / 60, v % 60)
     }
 }
@@ -394,10 +400,11 @@ func barkStrength(_ t: TimeInterval) -> Double {
 struct BarkingDog: View {
     static let width: CGFloat = 30
     var size: CGFloat = 18
+    @ObservedObject private var dog = DogMonitor.shared
 
     var body: some View {
-        TimelineView(.animation(minimumInterval: 1.0 / 30.0)) { ctx in
-            let bark = barkStrength(ctx.date.timeIntervalSinceReferenceDate)
+        TimelineView(.animation(minimumInterval: 1.0 / 30.0, paused: !dog.barking)) { ctx in
+            let bark = dog.barking ? barkStrength(ctx.date.timeIntervalSinceReferenceDate) : 0
             HStack(spacing: 0) {
                 Text("🐕")
                     .font(.system(size: size))
@@ -425,10 +432,11 @@ struct BarkingDog: View {
 struct Woof: View {
     static let width: CGFloat = 24
     let text: String
+    @ObservedObject private var dog = DogMonitor.shared
 
     var body: some View {
-        TimelineView(.animation(minimumInterval: 1.0 / 30.0)) { ctx in
-            let bark = barkStrength(ctx.date.timeIntervalSinceReferenceDate)
+        TimelineView(.animation(minimumInterval: 1.0 / 30.0, paused: !dog.barking)) { ctx in
+            let bark = dog.barking ? barkStrength(ctx.date.timeIntervalSinceReferenceDate) : 0
             Text(text)
                 .font(.system(size: 11, weight: .heavy, design: .rounded))
                 .foregroundStyle(.yellow)
@@ -488,6 +496,9 @@ struct ResetCheck: View {
             case .windowRestarted(let start):
                 return (L("✅ 우리 계정에도 들어왔어요 · 주간 사용량이 \(clockText(start))에 새로 시작",
                           "✅ It reached your account · weekly usage started over at \(clockText(start))"), usageColor(0))
+            case .windowRestartedLikely(let start):
+                return (L("✅ 들어온 것 같아요 · 주간 사용량이 \(clockText(start))에 새로 시작 (그 전 기록이 없어 추정)",
+                          "✅ Looks like it reached you · weekly usage started over at \(clockText(start)) (no earlier record to compare)"), usageColor(0))
             case .creditAdded(let from, let to):
                 return (L("🎟️ 리셋권으로 들어왔어요 · \(from)개 → \(to)개", "🎟️ It came as a reset credit · \(from) → \(to)"), usageColor(0))
             case .pending:

package/app/Sources/TiboDog/NowPlayingMonitor.swift

@@ -77,6 +77,22 @@ final class NowPlayingMonitor: ObservableObject {
         return nil
     }
 
+    /// Runs the adapter (same pid, via exec) with a tiny watcher beside it that ends the adapter once
+    /// TiboDog is gone, so a crash or `kill -9` never leaves a perl process streaming to nobody.
+    static let watchdog = #"""
+    my $app = getppid(); my $adapter = $$;
+    if (fork() == 0) {
+        open STDOUT, '>', '/dev/null'; open STDIN, '<', '/dev/null';
+        while (1) {
+            sleep 1;
+            # The adapter is our parent: once it's gone we're reparented, and its pid may be reused.
+            exit 0 if getppid() != $adapter;
+            if (!kill 0, $app) { kill 'TERM', $adapter; exit 0 }
+        }
+    }
+    exec '/usr/bin/perl', @ARGV or die "exec: $!";
+    """#
+
     // MARK: Lifecycle
 
     func start() {
@@ -100,7 +116,7 @@ final class NowPlayingMonitor: ObservableObject {
         }
         let proc = Process()
         proc.executableURL = URL(fileURLWithPath: "/usr/bin/perl")
-        proc.arguments = [paths.script.path, paths.framework.path, "stream", "--debounce=150"]
+        proc.arguments = ["-e", Self.watchdog, paths.script.path, paths.framework.path, "stream", "--debounce=150"]
         let p = Pipe()
         proc.standardOutput = p
         proc.standardError = FileHandle.nullDevice
@@ -109,8 +125,8 @@ final class NowPlayingMonitor: ObservableObject {
             guard !data.isEmpty else { return }
             Task { @MainActor in self?.ingest(data) }
         }
-        proc.terminationHandler = { [weak self] _ in
-            Task { @MainActor in self?.processDied() }
+        proc.terminationHandler = { [weak self] dead in
+            Task { @MainActor in self?.processDied(dead) }
         }
         do {
             try proc.run()
@@ -134,7 +150,9 @@ final class NowPlayingMonitor: ObservableObject {
         lastArtworkB64 = nil
     }
 
-    private func processDied() {
+    private func processDied(_ dead: Process) {
+        // A late notice about an adapter we already replaced: not the one running now.
+        guard dead === process else { return }
         let wasRunning = process != nil
         tearDown()
         guard enabled, wasRunning else { return }

package/app/Sources/TiboDog/ResetTracker.swift

@@ -2,8 +2,11 @@ import Foundation
 
 /// Whether a reset Tibo announced actually reached this Codex account.
 enum ResetVerdict: Equatable {
-    /// The weekly window started over after the post.
+    /// The weekly window started over after the post, while the old one still had time left.
     case windowRestarted(Date)
+    /// It started over after the post, but there's no record from before it to rule out the old window
+    /// simply running out.
+    case windowRestartedLikely(Date)
     /// A reset credit came in after the post.
     case creditAdded(from: Int, to: Int)
     /// Nothing yet; Codex is checked every few minutes.
@@ -24,6 +27,7 @@ final class ResetTracker: ObservableObject {
         var credits: Int?
         var weeklyStart: Date?
         var weeklyUsed: Double?
+        var weeklyMinutes: Int?
     }
 
     @Published private(set) var credits: Int?
@@ -32,6 +36,8 @@ final class ResetTracker: ObservableObject {
     /// Spending a reset credit right now, and what Codex said last time.
     @Published private(set) var redeeming = false
     @Published private(set) var lastOutcome: String?
+    /// When a credit was spent from here: that restart is ours, not Tibo's.
+    private var spentAt: Date?
 
     private var timer: Timer?
     private var checking = false
@@ -59,7 +65,8 @@ final class ResetTracker: ObservableObject {
         // TIBODOG_MOCK=1 reads the history from TIBODOG_HOME and never asks Codex.
         guard !checking, !UsageStore.mock else { return }
         checking = true
-        Task.detached(priority: .utility) {
+        // A plain GCD thread, not the Swift concurrency pool: this blocks for up to 25s.
+        DispatchQueue.global(qos: .utility).async {
             let result = try? CodexUsageAPI.fetch()
             DispatchQueue.main.async {
                 MainActor.assumeIsolated {
@@ -77,8 +84,19 @@ final class ResetTracker: ObservableObject {
         guard !redeeming else { return }
         redeeming = true
         lastOutcome = nil
+        if UsageStore.mock {
+            // Demos and screenshots: look like Codex said "reset", never spend a real credit.
+            DispatchQueue.main.asyncAfter(deadline: .now() + 0.9) {
+                self.redeeming = false
+                self.lastOutcome = "reset"
+                self.credits = max(0, (self.credits ?? 1) - 1)
+                self.spentAt = Date()
+                UsageStore.shared.mockReset()
+            }
+            return
+        }
         let key = UUID().uuidString
-        Task.detached(priority: .userInitiated) {
+        DispatchQueue.global(qos: .userInitiated).async {
             var outcome = (try? CodexUsageAPI.consumeResetCredit(idempotencyKey: key)) ?? "error"
             // A dropped connection may still have gone through: asking again with the same key is safe.
             if outcome == "error" { outcome = (try? CodexUsageAPI.consumeResetCredit(idempotencyKey: key)) ?? "error" }
@@ -87,6 +105,7 @@ final class ResetTracker: ObservableObject {
                     let tracker = ResetTracker.shared
                     tracker.redeeming = false
                     tracker.lastOutcome = outcome
+                    if outcome == "reset" { tracker.spentAt = Date() }
                     tracker.check()
                     UsageStore.shared.refresh(force: true)
                 }
@@ -101,7 +120,8 @@ final class ResetTracker: ObservableObject {
             guard let r = w.resetsAt, let m = w.durationMinutes else { return nil }
             return r.addingTimeInterval(-Double(m) * 60)
         }
-        let snap = Snapshot(at: Date(), credits: newCredits, weeklyStart: start, weeklyUsed: weekly?.utilization)
+        let snap = Snapshot(at: Date(), credits: newCredits, weeklyStart: start, weeklyUsed: weekly?.utilization,
+                            weeklyMinutes: weekly?.durationMinutes)
         let last = history.last
         credits = newCredits
         // Only keep changes: a new credit count or a weekly window that started over.
@@ -119,8 +139,15 @@ final class ResetTracker: ObservableObject {
         guard let latest = history.last else { return reachable ? .pending : .unknown }
         // A global reset starts the weekly window over (Codex's windows start at the reset, or at the
         // first use after it). Allow a little slack for clocks and propagation.
-        if let start = latest.weeklyStart, start >= postedAt.addingTimeInterval(-30 * 60) {
-            return .windowRestarted(start)
+        if let start = latest.weeklyStart, start >= postedAt.addingTimeInterval(-30 * 60),
+           !(spentAt.map { abs($0.timeIntervalSince(start)) < 10 * 60 } ?? false) {
+            // With a record from before the post, a reset is told apart from the old window running out.
+            if let before = history.last(where: { $0.at < postedAt }), let oldStart = before.weeklyStart {
+                let oldEnd = oldStart.addingTimeInterval(Double(before.weeklyMinutes ?? 10_080) * 60)
+                if !sameWindow(oldStart, start), oldEnd > start.addingTimeInterval(60) { return .windowRestarted(start) }
+            } else {
+                return .windowRestartedLikely(start)
+            }
         }
         let before = history.last { $0.at < postedAt }?.credits
         if let b = before, let after = history.filter({ $0.at >= postedAt }).compactMap(\.credits).max(), after > b {