cdx-manager 0.20.14 → 0.21.1

package/src/provider_background.py

@@ -219,13 +219,14 @@ def read_transcript_outcome(path):
     records the same facts here. Usage is summed across assistant messages
     because a session can hold several turns.
     """
-    outcome = {"result": None, "usage": None}
+    outcome = {"result": None, "usage": None, "usage_model": None}
     if not path:
         return outcome
     totals = {"input_tokens": 0, "cache_creation_tokens": 0, "cache_read_tokens": 0, "output_tokens": 0}
     # This path had no de-duplication at all, so a transcript that records the
     # same billed response more than once inflated the total outright.
     counted = set()
+    models = set()
     seen = False
     try:
         with open(path, encoding="utf-8", errors="replace") as handle:
@@ -261,6 +262,8 @@ def read_transcript_outcome(path):
                     # interactive one filled the same column under opposite
                     # definitions.
                     seen = True
+                    if isinstance(message.get("model"), str) and message["model"]:
+                        models.add(message["model"])
                     totals["input_tokens"] += usage.get("input_tokens") or 0
                     totals["cache_creation_tokens"] += usage.get("cache_creation_input_tokens") or 0
                     totals["cache_read_tokens"] += usage.get("cache_read_input_tokens") or 0
@@ -269,4 +272,6 @@ def read_transcript_outcome(path):
         return outcome
     if seen:
         outcome["usage"] = normalize_usage(**totals)
+        if len(models) == 1:
+            outcome["usage_model"] = next(iter(models))
     return outcome

package/src/provider_runtime.py

@@ -515,7 +515,7 @@ def _list_launch_transcript_paths(session, glob_fn=None):
     log_dir = _get_launch_transcript_dir(session)
     if not os.path.isdir(log_dir):
         return []
-    paths = set(glob_fn(os.path.join(log_dir, "cdx-session*.log")))
+    paths = set(glob_fn(os.path.join(glob.escape(log_dir), "cdx-session*.log")))
     legacy = _get_launch_transcript_path(session)
     if os.path.exists(legacy):
         paths.add(legacy)

package/src/run_registry.py

@@ -28,7 +28,7 @@ REGISTRY_LOCK_TIMEOUT_SECONDS = 120
 _LOCK_RETRY_SECONDS = 0.05
 
 
-def _acquire_windows_lock(handle, timeout_seconds):
+def _acquire_windows_lock(handle, timeout_seconds, label="run registry"):
     """Block until the byte is locked, or give up with a nameable error.
 
     Uses the non-blocking form and does the waiting here, so the wait is
@@ -47,14 +47,14 @@ def _acquire_windows_lock(handle, timeout_seconds):
         except OSError:
             if time.monotonic() >= deadline:
                 raise CdxError(
-                    "Timed out waiting for the run registry lock after "
+                    f"Timed out waiting for the {label} lock after "
                     f"{timeout_seconds}s. Another cdx process may be stuck holding it.",
                     75,
                 ) from None
             time.sleep(_LOCK_RETRY_SECONDS)
 
 
-def _acquire_posix_lock(handle, timeout_seconds):
+def _acquire_posix_lock(handle, timeout_seconds, label="run registry"):
     """Acquire a POSIX advisory lock within the same bounded wait as Windows."""
     import fcntl
 
@@ -66,7 +66,7 @@ def _acquire_posix_lock(handle, timeout_seconds):
         except OSError:
             if time.monotonic() >= deadline:
                 raise CdxError(
-                    "Timed out waiting for the run registry lock after "
+                    f"Timed out waiting for the {label} lock after "
                     f"{timeout_seconds}s. Another cdx process may be stuck holding it.",
                     75,
                 ) from None
@@ -74,12 +74,12 @@ def _acquire_posix_lock(handle, timeout_seconds):
 
 
 @contextmanager
-def _registry_lock(path, timeout_seconds=REGISTRY_LOCK_TIMEOUT_SECONDS):
+def _registry_lock(path, timeout_seconds=REGISTRY_LOCK_TIMEOUT_SECONDS, label="run registry"):
     os.makedirs(os.path.dirname(path), exist_ok=True)
     with open(path + ".lock", "a") as handle:
         if sys.platform == "win32":
             import msvcrt
-            _acquire_windows_lock(handle, timeout_seconds)
+            _acquire_windows_lock(handle, timeout_seconds, label)
             try:
                 yield
             finally:
@@ -87,7 +87,7 @@ def _registry_lock(path, timeout_seconds=REGISTRY_LOCK_TIMEOUT_SECONDS):
                 msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
         else:
             import fcntl
-            _acquire_posix_lock(handle, timeout_seconds)
+            _acquire_posix_lock(handle, timeout_seconds, label)
             try:
                 yield
             finally:

package/src/run_usage.py

@@ -40,6 +40,9 @@ caller can invent a fourth arithmetic.
 """
 
 import json
+import math
+
+from .errors import CdxError
 
 #: Order matters only for readability; every consumer addresses these by name.
 USAGE_KEYS = (
@@ -109,15 +112,19 @@ def output_multiplier(model, prices=None):
     entry = (prices if prices is not None else token_prices()[0]).get(model or "")
     if not entry:
         return DEFAULT_OUTPUT_MULTIPLIER
-    return entry["output"] / entry["input"]
+    return entry["output"] / entry["input"] if entry["input"] else None
 
 
 def cache_read_multiplier(model, prices=None):
     """This model's cache-read/input ratio, with the legacy fallback."""
     entry = (prices if prices is not None else token_prices()[0]).get(model or "")
-    if not entry or "cache_read" not in entry:
+    if not entry:
         return CACHE_READ_MULTIPLIER
-    return entry["cache_read"] / entry["input"]
+    if not entry["input"]:
+        return None
+    if "cache_read" not in entry:
+        return CACHE_READ_MULTIPLIER
+    return entry["cache_read"] / entry["input"] if entry["input"] else None
 
 
 def weighted_usage(usage, model=None, prices=None):
@@ -142,11 +149,13 @@ def weighted_usage(usage, model=None, prices=None):
         "cache_read_tokens": cache_read_multiplier(model, prices),
         "output_tokens": output_multiplier(model, prices),
     }
-    present = [
-        weight * usage[key]
-        for key, weight in weights.items()
-        if usage.get(key) is not None
-    ]
+    present = []
+    for key, weight in weights.items():
+        value = usage.get(key)
+        if value is not None:
+            if weight is None and value:
+                return None
+            present.append((weight or 0) * value)
     if not present:
         return None
     return int(round(sum(present)))
@@ -224,17 +233,26 @@ def token_prices(env=None):
     if raw:
         try:
             overrides = json.loads(raw)
-        except ValueError:
-            return dict(DEFAULT_TOKEN_PRICES), f"built-in, reviewed {TOKEN_PRICES_REVIEWED} ({TOKEN_PRICES_ENV} ignored: not JSON)"
-        if isinstance(overrides, dict):
-            merged = {**DEFAULT_TOKEN_PRICES}
-            for name, entry in overrides.items():
-                if isinstance(entry, dict) and "input" in entry and "output" in entry:
-                    merged[str(name)] = {
-                        "input": float(entry["input"]), "output": float(entry["output"])}
-                    if "cache_read" in entry:
-                        merged[str(name)]["cache_read"] = float(entry["cache_read"])
-            return merged, TOKEN_PRICES_ENV
+        except ValueError as error:
+            raise CdxError(f"{TOKEN_PRICES_ENV} must be a JSON object of model rates.") from error
+        if not isinstance(overrides, dict):
+            raise CdxError(f"{TOKEN_PRICES_ENV} must be a JSON object of model rates.")
+        merged = {**DEFAULT_TOKEN_PRICES}
+        for name, entry in overrides.items():
+            if not isinstance(entry, dict) or not {"input", "output"} <= entry.keys():
+                raise CdxError(f"{TOKEN_PRICES_ENV}: {name} requires input and output rates.")
+            rates = {}
+            for key in ("input", "output", "cache_read"):
+                if key not in entry:
+                    continue
+                value = entry[key]
+                if isinstance(value, bool) or not isinstance(value, (int, float)):
+                    value = float("nan")
+                if not math.isfinite(value) or value < 0:
+                    raise CdxError(f"{TOKEN_PRICES_ENV}: {name}.{key} must be a finite nonnegative rate.")
+                rates[key] = value
+            merged[str(name)] = rates
+        return merged, TOKEN_PRICES_ENV
     return dict(DEFAULT_TOKEN_PRICES), f"built-in, reviewed {TOKEN_PRICES_REVIEWED}"
 
 
@@ -245,10 +263,8 @@ def estimate_cost(usage, model, prices=None):
     figure. That shortcut was only correct while every model shared one
     output-to-input ratio, and they do not.
 
-    ponytail: a run is priced at one model -- the one serving its most recent
-    record -- rather than split per model. A session that switches models
-    mid-run is priced at the newer one. Upgrade path if that matters: have the
-    readers return a per-model breakdown and difference each model separately.
+    A run with mixed observed models and no measured per-model breakdown has
+    no usage_model, so its usage remains visible but unpriced.
 
     An unknown or absent model yields None. Pricing it at a default tier would
     turn "cdx does not know" into a number someone might believe.
@@ -357,26 +373,41 @@ def _sum_present(*values):
 
 
 def extract_run_usage(provider, stdout_path):
+    return extract_run_observation(provider, stdout_path)[0]
+
+
+def extract_run_observation(provider, stdout_path):
     if not stdout_path or not provider:
-        return empty_usage()
+        return empty_usage(), None
     if provider not in SUPPORTED_PROVIDERS:
-        return empty_usage()
+        return empty_usage(), None
     try:
         with open(stdout_path, encoding="utf-8", errors="replace") as handle:
             text = handle.read()
     except OSError:
-        return empty_usage()
+        return empty_usage(), None
     if not text.strip():
-        return empty_usage()
+        return empty_usage(), None
 
     records = _parse_json_records(text)
     if not records:
-        return empty_usage()
+        return empty_usage(), None
 
     usage = _extract_usage_from_records(records)
     if not _has_usage(usage):
-        return empty_usage()
-    return usage
+        return empty_usage(), None
+    models = set()
+    for record in records:
+        if not isinstance(record, dict):
+            continue
+        message = record.get("message")
+        model = record.get("model") or (message.get("model") if isinstance(message, dict) else None)
+        if isinstance(model, str) and model and _has_usage(_find_usage(record)):
+            models.add(model)
+        model_usage = record.get("modelUsage")
+        if isinstance(model_usage, dict):
+            models.update(model_usage)
+    return usage, next(iter(models)) if len(models) == 1 else None
 
 
 def _parse_json_records(text):

package/src/session_backup.py

@@ -306,12 +306,20 @@ def import_bundle(base_dir, store, file_path,
         old_record = None
         old_state = None
         preserved_profile_paths = []
+        # Read the live credential before moving its profile: a denied keychain
+        # read must leave the registered session untouched.
+        local_credential = None
         if is_existing and (force or merge):
             old_record = store["get_session"](name)
             old_state = store["read_session_state"](name)
             if merge:
                 provider = old_record["provider"]
                 auth_home = old_record["authHome"]
+            bundle_carries_credential = provider == PROVIDER_CLAUDE and any(
+                item["path"] == CLAUDE_CREDENTIALS_BUNDLE_PATH for item in decoded_profiles.get(name, [])
+            )
+            if bundle_carries_credential:
+                local_credential = read_keychain_credentials(old_record["authHome"])
             recovery_dir = tempfile.mkdtemp(prefix=f".{_encode(name)}.import.", dir=os.path.dirname(session_root))
             backup_root = os.path.join(recovery_dir, "profile")
             try:
@@ -335,13 +343,6 @@ def import_bundle(base_dir, store, file_path,
         # bundle credential exists at the credential-backend level and has to be
         # resolved there. Read it strictly: refusing an unreadable keychain is
         # better than importing over a credential we could not preserve.
-        bundle_carries_credential = provider == PROVIDER_CLAUDE and any(
-            item["path"] == CLAUDE_CREDENTIALS_BUNDLE_PATH for item in decoded_profiles.get(name, [])
-        )
-        local_credential = None
-        if bundle_carries_credential and old_record is not None:
-            local_credential = read_keychain_credentials(auth_home)
-
         existing_state_before = None
         try:
             _ensure_private_dir(session_root)

package/src/update_check.py

@@ -78,7 +78,7 @@ def _fetch_latest_release(env=None):
         LATEST_RELEASE_URL,
         headers=headers,
     )
-    with urllib.request.urlopen(request, timeout=5) as response:
+    with urllib.request.urlopen(request, timeout=2) as response:
         payload = json.loads(response.read().decode("utf-8"))
     return {
         "latest_version": str(payload.get("tag_name") or "").lstrip("v"),
@@ -185,6 +185,12 @@ def check_for_update(base_dir, current_version, env=None, now_fn=None):
 
     latest = fetch_latest_release(env=env)
     if not latest:
+        # A failure is cached like a success, keeping the last known version:
+        # otherwise a slow network makes every cdx command wait on GitHub again.
+        try:
+            _write_cache(path, {**cached, "checked_at": now_ts})
+        except OSError:
+            pass
         return None
 
     payload = {