cdx-manager 0.24.0 → 0.24.2

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.24.0-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.24.2-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **The right AI coding account, when you need it.** CDX Manager keeps your Codex and Claude accounts in separate profiles, shows which ones have quota, and helps you pick the next usable session from your terminal.
 

package/VERSION

@@ -1 +1 @@
-0.24.0
+0.24.2

package/changelogs/CHANGELOGS_0_24_1.md

@@ -0,0 +1,7 @@
+# CDX Manager 0.24.1
+
+This patch makes resumed sessions report their state like launched ones.
+
+## Sessions
+
+- `cdx resume <name>` (and `cdx <name> --resume`) now gives the provider the same agent and notify environment as a launch: a resumed Claude session sets `CDX_SESSION_NAME` for its hooks and appears in `cdx agents`, and it also gets the shared tool cache and scrub-env settings.

package/changelogs/CHANGELOGS_0_24_2.md

@@ -0,0 +1,14 @@
+# CDX Manager 0.24.2
+
+Release date: 2026-10-29
+
+This patch makes busy-session handling explicit and surfaces headless permission denials without marking successful runs as failures.
+
+## Sessions
+
+- Add `--on-busy fail|ask` to session launches and resumes. Use `fail` to refuse a profile with a live session immediately with a non-zero exit and `session_busy` error. The default `ask` keeps interactive confirmation; without a terminal or with `--json`, it refuses the duplicate launch. The policy also works with task, directory, and prompt options. (#55)
+
+## Runs
+
+- Report nonempty Claude `permission_denials` result records as structured run warnings, including the provider and denied tools. A provider exit code of 0 still reports success (`ok: true`), since another tool may have completed the work. Empty or absent denials produce no warning. (#54)
+- Clarify that Claude's `--scrub-env on` forces its default permission mode: unattended runs must explicitly allow tools that need approval, using `--allowedTools` through `--extra-args`. (#54)

package/checksums/release-archives.json

@@ -573,6 +573,28 @@
         "x86_64-pc-windows-msvc": "bf35f8d25bbc34730533807df0d9c0e3f7ea2a271f268856759ae87bc9e116fe",
         "x86_64-unknown-linux-musl": "60400fd7d10b0563503afc5bd741f7fefff4276d077fc6e4927f087390d46ccd"
       }
+    },
+    "v0.24.0": {
+      "github_tarball_sha256": "6206df477d34ad2360144bbf57d3aedf7bf88891502cf6dcee96c77e131e4a97",
+      "github_zip_sha256": "db4be4051a18bf0f857cbc31615972eff592f60a38c03c161707c02268302e1f",
+      "tray_assets": {
+        "aarch64-apple-darwin": "208a7c36641d17b221250b0791e956dad769477d694dd68a153f3046460d562a",
+        "aarch64-unknown-linux-musl": "704ccea4fc8426a8f84107e44de83d00344b22c5665a4f04a73c6d7f0ed2accd",
+        "x86_64-apple-darwin": "8745cc6572dbdfba68ca181fb631ced91d9bb1bc1cee9bb0e67026c88b7dc5cc",
+        "x86_64-pc-windows-msvc": "90772ff35a25db86ebfbe4187c39f0705001a9f10b6a7fe0c04a431b13ccbcb8",
+        "x86_64-unknown-linux-musl": "f7be523211fc4dba33724c2759f267f35669b8aff14136fc7ec97d398ebb1f87"
+      }
+    },
+    "v0.24.1": {
+      "github_tarball_sha256": "5ea0ba5fe38590f5bc8e4ae6d299ebce1dc2ef960501914d5520a2f2901888f5",
+      "github_zip_sha256": "d48ebf567fe85ff36a516cd84e9cc34a4af2eb1145185e3f3d3ea30ef5eaf71c",
+      "tray_assets": {
+        "aarch64-apple-darwin": "bf231ab3618ea189333b74a1a9cc71622dc79b00c7e2549967d1da5ddb22dc3e",
+        "aarch64-unknown-linux-musl": "009a4e2d4b54ac67f3991d879d5875c82dddf6161b0649986240ebc57285a9e8",
+        "x86_64-apple-darwin": "256cb6644394ab7140f6353480aedf000f47f930d2b2aa3f905b6a57bf86714f",
+        "x86_64-pc-windows-msvc": "89a7e43654ea5f0d4efc20a14c1398377a1d48485f1b9867b199e85aa9c25daf",
+        "x86_64-unknown-linux-musl": "a36a3589a3766d67e44a0466b11a18bda4297963416eec7b5b9d23a5c9f363a4"
+      }
     }
   }
 }

package/docs/agent-notes.md

@@ -0,0 +1,13 @@
+# Agent notes
+
+Pitfalls and operator rules for any agent working in this repo (tracked here because AGENTS.md is local and ignored).
+
+## Operator machine and test hosts (moved here from agent memory, 2026-10-28)
+- Never run `pip` against cdx-manager on the operator's machines (install, update, uninstall, even a throwaway venv to test a published artifact): the operator manages the install. The README's `pip install -e` is for a dev checkout only. To verify a release, ask how it should be checked.
+- Cross-platform checks run on Tower (`aagos@kdesktop`, Windows) and its WSL guest (`wsl.exe -d Ubuntu -u aagos -- ...`); an agent runs the scriptable part itself and only asks the operator to look at what appears on screen (notifications, windows). On Windows Tower the full pytest stops around 21% in `test_commands_runs_py` (`cdx run --detach` tests spawning real children): an environment quirk, not a regression; run single files or `-k` subsets synchronously and read GitHub CI for whole-suite Windows evidence. In cmd.exe `&` is a separator, Python buffers redirected stdout (use `-u`), and a killed SSH session leaves a truncated output that reads like a hang.
+- In Tower's WSL the `codex` on PATH was the Windows npm install through interop (Windows-only native package); a Linux build lives at `~/.npm-global/bin/codex` (`npm i -g --prefix ~/.npm-global @openai/codex`): export that path first.
+
+## Releases and Tower installs (moved here from Codex memory, 2026-10-28)
+- A pushed `main` or a source-checkout deploy is not a release. Call a release ready only once the CI and CodeQL runs for the exact pushed SHA are green, the tag's assets and `release-archives.json` checksums are published, npm and PyPI both serve the version, and `logics-manager release validate <version>` passes. Delete a stale `dist/` before building: old artifacts make `twine check` pass on the wrong files.
+- Python tests live in `test/` (not `tests/`).
+- On Tower, `make install` can fail with `EACCES` on `/usr/local/lib/node_modules`: install the tagged release with the checksum-verified user-scoped `install.sh` instead. On a source-linked install, `cdx update --yes --version <tag>` only switches the checkout. Tower's daily `auto-update` job (`cdx update all --yes --json`) can finish without every provider converging: check the installed versions afterwards.

package/docs/cli.md

@@ -7,7 +7,8 @@
 | `cdx` | List all sessions with last-updated timestamps |
 | `cdx --json` | List all sessions as a machine-readable JSON payload |
 | `cdx <name>` | Launch a session (checks auth first) |
-| `cdx <name> [--json]` | Launch a session; `--json` returns a structured success payload after the interactive run ends |
+| `cdx <name> [--on-busy fail\|ask] [--json]` | Launch a session; `--json` returns a structured success payload after the interactive run ends |
+| `cdx <name> --on-busy fail` | Refuse a profile with a live session immediately, even with a terminal: non-zero exit and `session_busy` (`error.code` with `--json`). Works with `--task`, `--dir`, prompts and resume; `--on-busy=fail` is also accepted. The default `ask` keeps the confirmation prompt for terminal users; without a terminal or with `--json`, it fails instead of launching a duplicate. Handoff launches and `cdx last` use `ask` too. |
 | `cdx <name> --prompt TEXT` / `cdx <name> --prompt-file PATH` | Launch a session that starts on this first message (not with `--resume` or Ollama sessions; `--prompt-file -` is refused because the session needs standard input; a relative `--prompt-file` path is read from the current directory, not `--dir`) |
 | `cdx <name> --dir PATH --task TEXT [--end-state TEXT]` | Start a session on a task. `--end-state` names what your go-ahead covers ("CI green on a PR, merged"): the session takes every step it needs, commits, pushes and PRs included, and stops only for a decision outside it. Without `--end-state` it stops and shows the result before any commit, push or PR. Replaces `--prompt`; the first message also tells it to read the repository's instructions and use its skills. |
 | `cdx <name> -r` / `cdx <name> --resume` | Resume the provider-native conversation for a session when supported |
@@ -422,3 +423,5 @@ It returns accepted values for `permission` (with its aliases and canonical form
 ```
 
 Codex ties network access to its sandbox, so any permission below `full` leaves the run unable to resolve DNS — `gh`, `curl`, and package installs fail inside an otherwise successful run. Show these warnings to whoever reads your output rather than discarding them; a run that succeeds while quietly doing less is the case they exist for.
+
+Claude result records with nonempty `permission_denials` produce a warning with code `permission_denials`, the `provider`, and the structured `permission_denials` list. Exit code 0 still means `ok: true`: a denied tool may have been replaced successfully. Empty or absent denials add no warning. With `--scrub-env on`, Claude forces its default permission mode; allow tools needed by unattended runs explicitly using `--allowedTools` via `--extra-args` (see [operations](operations.md)).

package/docs/operations.md

@@ -230,7 +230,7 @@ credential sync.
 
 - **`cdx <name>` fails with "not authenticated"** — run `cdx login <name>` first. `cdx doctor` uses the same Codex app-server probe as `cdx auth refresh`, so a local auth file alone is never reported as live authentication; a rejected refresh token is reported as `login_required` with the matching login command.
 - **A Claude session has no claude.ai connectors (Microsoft 365, ...) in `/mcp`** — `cdx login <name>` stores a setup-token for Claude profiles, and Claude Code can only make model requests with it: it never loads claude.ai connectors. `cdx status` shows each Claude profile's auth type (`setup-token` or `full-login`; `auth_type` in `--json`). To switch, start the session and run `/login` inside it. Once the profile holds its own claude.ai login (its `.claude/.credentials.json`, or its profile-specific `Claude Code-credentials-<hash>` keychain entry on macOS), cdx stops passing the setup-token on later launches. If that login later expires, run `/login` again, or go back to a setup-token with `cdx login <name>`, which removes the profile's `/login`.
-- **Keep credentials away from what a Claude agent runs** — by default Claude Code passes its credentials, including the setup-token cdx injects, to the Bash commands, hooks and stdio MCP servers it starts. `cdx set <name> --scrub-env on` launches that session with `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1`, which strips credential-looking variables from those subprocesses (GitHub tokens and proxy settings stay). It is off by default: it also removes other secrets an agent may need (`NPM_TOKEN`, a `DATABASE_URL` with a password), and on Linux it isolates Bash from host processes, so `ps` and `kill` no longer see them. Worth turning on for unattended sessions that read untrusted content.
+- **Keep credentials away from what a Claude agent runs** — by default Claude Code passes its credentials, including the setup-token cdx injects, to the Bash commands, hooks and stdio MCP servers it starts. `cdx set <name> --scrub-env on` launches that session with `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1`, which strips credential-looking variables from those subprocesses (GitHub tokens and proxy settings stay). It is off by default: it also removes other secrets an agent may need (`NPM_TOKEN`, a `DATABASE_URL` with a password), and on Linux it isolates Bash from host processes, so `ps` and `kill` no longer see them. For unattended sessions that read untrusted content, enable it only with explicit tool permissions: Claude forces its default permission mode when scrubbing is enabled, even if cdx requests `--permission full`. In headless runs, tools that require approval are denied unless explicitly allowed. For example, `cdx set <name> --scrub-env on --extra-args '--allowedTools "Read" "Bash(pwd)"'` allows those tools; adapt the allowlist to the task. cdx keeps scrubbing enabled and reports structured `permission_denials` as a run warning, without turning a successful provider exit into a failure: a denied tool can be replaced successfully.
 - **Share Claude's memory across accounts** — Claude Code keeps its auto-memory (`.claude/projects/<project>/memory`) in the profile home, so each account starts without what the others learned. `cdx set <name> --shared-memory on` links that folder, for the project being launched, to `~/.cdx/shared-memory/<project>`, shared by every profile with the setting on. Existing memory is copied in and the old folder kept as `memory.pre-cdx-<time>`; `MEMORY.md` indexes are merged line by line. A file with the same name and different content on two accounts is a conflict: cdx leaves that profile alone and names the files to merge by hand. macOS and Linux only (symlinks).
 - **One of two Codex accounts keeps asking for login** — run `cdx doctor --json` and inspect each Codex session's `codex_auth_file`, `codex_live_auth`, and `codex_stale_auth_logs` checks. If recent logs mention expired auth, repair only that isolated profile with `cdx login <name>`. Codex Business profiles can share the same `tokens.account_id`; `cdx doctor` reports `codex_shared_account_id` as a workspace-level clue, not proof that two profiles use the same user. Newly created sessions seed from the current global `~/.codex/auth.json` when one exists. For two separate Codex accounts, create or repair each session by running `cdx login <name>` for that session; `cdx login` does not log out first, so use `cdx logout <name>` explicitly only when you want to clear that isolated profile.
 - **`cdx` says no compatible Python 3 interpreter was found** — install Python 3 and make `py -3`, `python`, or `python3` available on PATH.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.24.0",
+  "version": "0.24.2",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.24.0"
+version = "0.24.2"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/cli.py

@@ -295,7 +295,8 @@ def _print_help(use_color=False):
         _style("Notifications:", "1", use_color),
         f"  {_style('cdx set <name> --notify on', '36', use_color)}  # agent finishes or needs attention",
         f"  {_style('cdx ready', '36', use_color)}  # next session to become ready",
-        f"  {_style('cdx <name> [--json]', '36', use_color)}",
+        f"  {_style('cdx <name> [--on-busy fail|ask] [--json]', '36', use_color)}",
+        "    --on-busy: fail immediately if already running; ask (default) prompts only with a terminal and without --json",
         f"  {_style('cdx <name> --prompt TEXT|--prompt-file PATH', '36', use_color)}  # start with a first message",
         f"  {_style('cdx <name> --dir PATH --task TEXT --end-state TEXT', '36', use_color)}  # start on a task, with what the go-ahead covers",
         f"  {_style('cdx --help', '36', use_color)}",
@@ -637,7 +638,7 @@ def main(argv, options=None):
         return handler(rest, ctx)
 
     from .commands.launch import _parse_launch_args, _read_launch_prompt
-    directory, launch_args, prompt = _parse_launch_args(rest)
+    directory, launch_args, prompt, on_busy = _parse_launch_args(rest)
     if all(arg in ("--json", "-r", "--resume") for arg in launch_args):
         resume = "-r" in launch_args or "--resume" in launch_args
         has_prompt = prompt["prompt"] is not None or prompt["prompt_file"] is not None
@@ -647,7 +648,7 @@ def main(argv, options=None):
         if has_prompt and (ctx["service"]["get_session"](command) or {}).get("provider") == PROVIDER_OLLAMA:
             raise CdxError("cdx <name>: --prompt and --prompt-file are not supported for Ollama sessions.")
         return handle_launch(command, ctx, initial_prompt=_read_launch_prompt(prompt), resume=resume,
-                             directory=directory)
+                             directory=directory, on_busy=on_busy)
 
     raise CdxError(f"Unknown command: {command}. Use cdx --help.")
 

package/src/cli_args.py

@@ -42,7 +42,7 @@ HISTORY_USAGE = "Usage: cdx history [name] [--limit N] [--summary] [--since 7d|t
 STATS_USAGE = "Usage: cdx stats [name] [--since 7d|today|DATE] [--from DATE] [--to DATE] [--by session|project|model] [--json]"
 STATS_GROUPS = ("session", "project", "model")
 LAST_USAGE = "Usage: cdx last [--json]"
-RESUME_USAGE = "Usage: cdx resume <name> [--conversation <id>] [--json]"
+RESUME_USAGE = "Usage: cdx resume <name> [--conversation <id>] [--on-busy fail|ask] [--json]"
 CAN_RESUME_USAGE = "Usage: cdx can-resume <name> [--conversation <id>] [--json]"
 SESSIONS_USAGE = "Usage: cdx sessions [--all] --json"
 SELECT_USAGE = "Usage: cdx select --provider PROVIDER [--min-reasoning-effort minimal|low|medium|high|xhigh] [--min-power minimal|low|medium|high|xhigh] [--require-ready] [--refresh] --json"

package/src/cli_helpers.py

@@ -386,22 +386,22 @@ def _resume_capability_for_session(session, ctx):
         "command_preview": capability.get("command_preview") or [],
     }
 
-def _warn_if_session_already_running(name, ctx):
-    # ponytail: concurrent sessions on one profile share its single OAuth
-    # .credentials.json; both refresh near token expiry and the rotated refresh
-    # token invalidates the other session -> surprise logout. Warn before adding
-    # a second live session on the same profile.
+def _warn_if_session_already_running(name, ctx, *, on_busy="ask", json_flag=False):
     active = ctx["service"].get("active_session_runtime")
     runtime = active(name) if active else None
     if not runtime:
         return
+    if on_busy == "fail" or not ctx["stdin_is_tty"] or json_flag:
+        raise CdxError(f"session_busy: Session {name} is already running.", code="session_busy")
     pid = runtime.get("pid")
     ctx["out"](f"{_warn(f'A session named {name} is already running (pid {pid}).', ctx['use_color'])}\n")
     ctx["out"](
         f"{_dim('Two sessions on one profile share its login and can log each other out. Use a different profile instead.', ctx['use_color'])}\n"
     )
-    if not ctx["stdin_is_tty"]:
-        return
-    answer = input(f"Launch a second {name} session anyway? [y/N] ")
+    ask = ctx["options"].get("input") or input
+    try:
+        answer = ask(f"Launch a second {name} session anyway? [y/N] ")
+    except EOFError:
+        raise CdxError(f"session_busy: Session {name} is already running.", code="session_busy") from None
     if answer.strip().lower() not in ("y", "yes"):
         raise CdxError("Launch cancelled.")

package/src/commands/launch.py

@@ -36,7 +36,7 @@ from ..provider_runtime import (
 from ..run_command import PROMPT_STDIN, read_run_prompt
 from ..run_usage import estimate_cost
 
-LAUNCH_USAGE = "Usage: cdx <name> [--dir PATH] [--prompt TEXT|--prompt-file PATH|--task TEXT [--end-state TEXT]] [--resume] [--json]"
+LAUNCH_USAGE = "Usage: cdx <name> [--dir PATH] [--prompt TEXT|--prompt-file PATH|--task TEXT [--end-state TEXT]] [--resume] [--on-busy fail|ask] [--json]"
 
 #: The first message of a session started with --task. The end state is what the
 #: user's go-ahead covers: a bare "show me first" made sessions stop after a commit
@@ -52,8 +52,8 @@ NO_END_STATE = """No end state was given: stop and show the result before any co
 
 
 def _parse_launch_args(args):
-    """Return the per-launch directory, initial prompt source and ordinary launch flags."""
-    values = {"--dir": None, "--prompt": None, "--prompt-file": None, "--task": None, "--end-state": None}
+    """Return the directory, remaining flags, prompt source and busy policy."""
+    values = {"--dir": None, "--prompt": None, "--prompt-file": None, "--task": None, "--end-state": None, "--on-busy": None}
     cleaned = []
     index = 0
     while index < len(args):
@@ -72,6 +72,9 @@ def _parse_launch_args(args):
         if values[flag] is not None or not value:
             raise CdxError(LAUNCH_USAGE)
         values[flag] = value
+    on_busy = values["--on-busy"] or "ask"
+    if on_busy not in ("fail", "ask"):
+        raise CdxError("cdx <name>: --on-busy must be fail or ask.")
     if values["--prompt"] is not None and values["--prompt-file"] is not None:
         raise CdxError("cdx <name>: --prompt and --prompt-file are mutually exclusive.")
     if values["--end-state"] is not None and values["--task"] is None:
@@ -84,7 +87,7 @@ def _parse_launch_args(args):
     if values["--prompt-file"] == PROMPT_STDIN:
         raise CdxError("cdx <name>: --prompt-file - is not supported; the interactive session needs standard input.")
     prompt = {"prompt": values["--prompt"], "prompt_file": values["--prompt-file"]}
-    return values["--dir"], cleaned, prompt
+    return values["--dir"], cleaned, prompt, on_busy
 
 
 def _read_launch_prompt(prompt):
@@ -204,14 +207,14 @@ def handle_can_resume(rest, ctx):
 
 def handle_resume(rest, ctx):
     conversation_id, rest = _pop_value_flag(rest, "--conversation", RESUME_USAGE)
-    directory, rest, prompt = _parse_launch_args(rest)
+    directory, rest, prompt, on_busy = _parse_launch_args(rest)
     if prompt["prompt"] is not None or prompt["prompt_file"] is not None:
         raise CdxError("cdx resume: --prompt and --prompt-file are not supported when resuming.")
     json_flag, args = _parse_json_flag(rest)
     if len(args) != 1:
         raise CdxError(RESUME_USAGE)
     return handle_launch(args[0], ctx, resume=True, force_json=json_flag, directory=directory,
-                         conversation_id=conversation_id)
+                         conversation_id=conversation_id, on_busy=on_busy)
 
 
 def _notification_provisioning_enabled(session, ctx, json_flag):
@@ -255,14 +258,14 @@ def _link_shared_memory(session, ctx, cwd, json_flag):
 
 
 def handle_launch(command, ctx, initial_prompt=None, resume=False, force_json=None, directory=None,
-                  conversation_id=None):
+                  conversation_id=None, on_busy="ask"):
     json_flag = "--json" in ctx.get("raw_args", ctx["options"].get("raw_args", []))
     if force_json is not None:
         json_flag = force_json
     warnings = _update_notice_warnings(ctx)
     active_runtime = ctx["service"].get("active_session_runtime")
     overlap_at_start = bool(active_runtime and active_runtime(command))
-    _warn_if_session_already_running(command, ctx)
+    _warn_if_session_already_running(command, ctx, on_busy=on_busy, json_flag=json_flag)
     session = ctx["service"]["get_session"](command)
     if not session:
         raise CdxError(f"Unknown session: {command}")
@@ -595,4 +598,4 @@ def handle_handoff(rest, ctx):
         ))
         return 0
     ctx["out"](f"Handoff ready ({entry['mode']}): {path}\n")
-    return handle_launch(target['name'], ctx, initial_prompt=prompt, directory=workspace)
+    return handle_launch(target['name'], ctx, initial_prompt=prompt, directory=workspace, on_busy="ask")

package/src/commands/status.py

@@ -693,7 +693,7 @@ def handle_last(rest, ctx):
     if not json_flag:
         message = f"Launching last session: {session['name']}"
         ctx["out"](f"{_info(message, ctx['use_color'])}\n")
-    return handle_launch(session["name"], ctx)
+    return handle_launch(session["name"], ctx, on_busy="ask")
 
 def handle_status(rest, ctx):
     parsed = _parse_flag_args(rest, {

package/src/provider_runtime.py

@@ -26,6 +26,7 @@ from .config import (
     split_extra_args,
 )
 from .errors import CdxError
+from .run_usage import _parse_json_records
 
 TERMINAL_TITLE_SEPARATOR = " — "
 # Providers redraw their own title while their TUI runs, so a single write at
@@ -907,7 +908,13 @@ def _build_resume_spec(session, cwd=None, env_override=None, capture_transcript=
     cwd = cwd or os.getcwd()
     env_override = env_override or {}
     env = {**os.environ, **env_override}
+    for key, value in _shared_tool_cache_overrides(env).items():
+        env.setdefault(key, value)
     _shared_rtk_history(env)
+    # Same as a launch: without CDX_SESSION_NAME the hooks of a resumed session
+    # cannot say whose agent state they record, so `cdx agents` never lists it.
+    env.update(launch_notify_env(session, notifications_enabled(session) or agent_state_enabled(session)))
+    env.update(_scrub_env(session))
     capability = get_resume_capability(session, cwd=cwd)
     if not capability["resumable"]:
         raise CdxError(f"Provider {session.get('provider')} does not support native resume through cdx.")
@@ -1178,6 +1185,22 @@ def _terminate_child_tree(child):
         pass
 
 
+def _read_permission_denials(stdout_path):
+    denials = []
+    try:
+        with open(stdout_path, encoding="utf-8", errors="replace") as handle:
+            records = _parse_json_records(handle.read())
+    except OSError:
+        return denials
+    for record in records:
+        if not isinstance(record, dict) or record.get("type") != "result":
+            continue
+        reported = record.get("permission_denials")
+        if isinstance(reported, list):
+            denials.extend(item for item in reported if isinstance(item, dict))
+    return denials
+
+
 def _run_headless_provider_command(session, cwd=None, env_override=None, initial_prompt=None,
                                    timeout_seconds=None, spawn=None, run_id=None):
     spawn = spawn or subprocess.Popen
@@ -1271,6 +1294,10 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
         "pid": getattr(child, "pid", None),
         "returncode": returncode,
         "timed_out": timed_out,
+        "permission_denials": (
+            _read_permission_denials(paths["stdout_path"])
+            if session.get("provider") == PROVIDER_CLAUDE else []
+        ),
     }
 
 

package/src/run_command.py

@@ -192,6 +192,17 @@ def run_result_payload(api_schema_version, ok, parsed, session, run_info=None,
         if error_source == "provider"
         else (str(error) if error else "Run failed.")
     )
+    warnings = run_warnings(parsed, session, selection_row)
+    if run_info.get("permission_denials"):
+        warnings.append({
+            "code": "permission_denials",
+            "message": (
+                "The provider reported denied tool calls. A denied tool may have been "
+                "replaced successfully; check the denials and transcript for impact."
+            ),
+            "provider": session.get("provider") if session else parsed.get("provider"),
+            "permission_denials": run_info["permission_denials"],
+        })
     return {
         "schema_version": api_schema_version,
         "ok": bool(ok),
@@ -210,7 +221,7 @@ def run_result_payload(api_schema_version, ok, parsed, session, run_info=None,
         "stdout_path": run_info.get("stdout_path"),
         "stderr_path": run_info.get("stderr_path"),
         "usage": usage,
-        "warnings": run_warnings(parsed, session, selection_row),
+        "warnings": warnings,
         "error": None if ok else {
             "source": error_source or "cdx",
             "code": error_code or "cdx_error",