Reject unsafe Muse reset timestamps

Author: audreyt

Sources/CodexBarCore/Providers/Muse/MuseUsageFetcher.swift

@@ -211,7 +211,7 @@ public enum MuseUsageFetcher {
     }
 
     private static func date(fromUnixSeconds value: Double?) -> Date? {
-        guard let value, value > 0, value.isFinite else { return nil }
+        guard let value, value > 0, value <= Date.distantFuture.timeIntervalSince1970 else { return nil }
         return Date(timeIntervalSince1970: value)
     }
 

Tests/CodexBarTests/MuseUsageFetcherTests.swift

@@ -181,6 +181,27 @@ struct MuseUsageFetcherTests {
         }
     }
 
+    @Test(arguments: ["window", "weekly"])
+    func `oversized reset timestamps preserve usage without unsafe countdowns`(_ windowName: String) throws {
+        var payload = try #require(JSONSerialization.jsonObject(with: Self.liveMintData) as? [String: Any])
+        var windows = try #require(payload["subs_usage"] as? [String: Any])
+        var window = try #require(windows[windowName] as? [String: Any])
+        window["resets_at"] = 1e30
+        windows[windowName] = window
+        payload["subs_usage"] = windows
+        let data = try JSONSerialization.data(withJSONObject: payload)
+        let now = Date(timeIntervalSince1970: 1_788_580_000)
+        let usage = try MuseUsageFetcher._parseMintResponseForTesting(data, now: now).toUsageSnapshot()
+        let affected = try #require(windowName == "window" ? usage.primary : usage.secondary)
+        let unaffected = try #require(windowName == "window" ? usage.secondary : usage.primary)
+
+        #expect(affected.usedPercent == 96)
+        try #require(affected.resetsAt == nil)
+        #expect(UsageFormatter.resetLine(for: affected, style: .countdown, now: now) == nil)
+        #expect(unaffected.resetsAt != nil)
+        #expect(UsageFormatter.resetLine(for: unaffected, style: .countdown, now: now) != nil)
+    }
+
     @Test
     func `descriptor reports oauth login without api key support`() throws {
         let descriptor = ProviderDescriptorRegistry.descriptor(for: .muse)

docs/muse.md

@@ -27,6 +27,8 @@ Credential precedence: when `providers.meta.access_token` is present inline in t
 - 5-hour window percent, duration, and `resets_at`.
 - Weekly window percent and `resets_at`.
 
+Reset timestamps outside the supported date range are omitted without discarding the window's usage percentage.
+
 Pay-as-you-go accounts without `is_subs_active` are reported as having no subscription rather than a fake 0% bar. Accounts that still need a payment method are reported as billing-incomplete.
 
 ## Privacy