cdx-manager 0.24.1 → 0.24.3

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.24.1-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.24.3-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **The right AI coding account, when you need it.** CDX Manager keeps your Codex and Claude accounts in separate profiles, shows which ones have quota, and helps you pick the next usable session from your terminal.
 

package/VERSION

@@ -1 +1 @@
-0.24.1
+0.24.3

package/changelogs/CHANGELOGS_0_24_2.md

@@ -0,0 +1,14 @@
+# CDX Manager 0.24.2
+
+Release date: 2026-10-29
+
+This patch makes busy-session handling explicit and surfaces headless permission denials without marking successful runs as failures.
+
+## Sessions
+
+- Add `--on-busy fail|ask` to session launches and resumes. Use `fail` to refuse a profile with a live session immediately with a non-zero exit and `session_busy` error. The default `ask` keeps interactive confirmation; without a terminal or with `--json`, it refuses the duplicate launch. The policy also works with task, directory, and prompt options. (#55)
+
+## Runs
+
+- Report nonempty Claude `permission_denials` result records as structured run warnings, including the provider and denied tools. A provider exit code of 0 still reports success (`ok: true`), since another tool may have completed the work. Empty or absent denials produce no warning. (#54)
+- Clarify that Claude's `--scrub-env on` forces its default permission mode: unattended runs must explicitly allow tools that need approval, using `--allowedTools` through `--extra-args`. (#54)

package/changelogs/CHANGELOGS_0_24_3.md

@@ -0,0 +1,13 @@
+# CDX Manager 0.24.3
+
+Release date: 2026-10-29
+
+This patch preserves observed serving models in run history and reports for more reliable usage attribution and pricing. (#57)
+
+## Runs and statistics
+
+- Expose `usage_model` separately from the requested `model` in completed run JSON and registry reports, and retain observed model evidence in interactive history even when token usage is unavailable.
+- Recover Codex model evidence from the exact rollout identified by `thread.started.thread_id`, while keeping token totals from the run's own output. Configured defaults alone do not establish the serving model; missing or mixed model evidence stays unpriced.
+- Group Claude's `[1m]` context variants with their base model in `cdx stats --by model`, preserving the original model string and per-run pricing.
+
+These changes apply to newly recorded runs; existing history is not rewritten.

package/checksums/release-archives.json

@@ -584,6 +584,28 @@
         "x86_64-pc-windows-msvc": "90772ff35a25db86ebfbe4187c39f0705001a9f10b6a7fe0c04a431b13ccbcb8",
         "x86_64-unknown-linux-musl": "f7be523211fc4dba33724c2759f267f35669b8aff14136fc7ec97d398ebb1f87"
       }
+    },
+    "v0.24.1": {
+      "github_tarball_sha256": "5ea0ba5fe38590f5bc8e4ae6d299ebce1dc2ef960501914d5520a2f2901888f5",
+      "github_zip_sha256": "d48ebf567fe85ff36a516cd84e9cc34a4af2eb1145185e3f3d3ea30ef5eaf71c",
+      "tray_assets": {
+        "aarch64-apple-darwin": "bf231ab3618ea189333b74a1a9cc71622dc79b00c7e2549967d1da5ddb22dc3e",
+        "aarch64-unknown-linux-musl": "009a4e2d4b54ac67f3991d879d5875c82dddf6161b0649986240ebc57285a9e8",
+        "x86_64-apple-darwin": "256cb6644394ab7140f6353480aedf000f47f930d2b2aa3f905b6a57bf86714f",
+        "x86_64-pc-windows-msvc": "89a7e43654ea5f0d4efc20a14c1398377a1d48485f1b9867b199e85aa9c25daf",
+        "x86_64-unknown-linux-musl": "a36a3589a3766d67e44a0466b11a18bda4297963416eec7b5b9d23a5c9f363a4"
+      }
+    },
+    "v0.24.2": {
+      "github_tarball_sha256": "90ea3d050c278500b975bbc8bfe1b185f90fc35dfcf6b07d84eb59439bb24e58",
+      "github_zip_sha256": "3c53f0f0550416ebe3d7281e9c823a682a2c3560130df6fafec48d35278f4f8a",
+      "tray_assets": {
+        "aarch64-apple-darwin": "8fc48c8772b5ea50700933f0836e153104ef328b395de059749bd5a5aa864076",
+        "aarch64-unknown-linux-musl": "ce7708f4196cfdf7b7226ba3199e772e767c2d470c37d19589cb41bfc35de7af",
+        "x86_64-apple-darwin": "2d1d6e84ee08d9dea5a707332a39509edbe68b05e3d062bdae93e9c6704db543",
+        "x86_64-pc-windows-msvc": "eecc8f8c46d2ce50e6cf6ec6c48c10a10e165ec7ec0058cfb55c8aa486d17d7b",
+        "x86_64-unknown-linux-musl": "4cf3289c5d9d7a540a032a11d27e93093d69ec507e1796a726f429c0670f7bc5"
+      }
     }
   }
 }

package/docs/cli.md

@@ -7,7 +7,8 @@
 | `cdx` | List all sessions with last-updated timestamps |
 | `cdx --json` | List all sessions as a machine-readable JSON payload |
 | `cdx <name>` | Launch a session (checks auth first) |
-| `cdx <name> [--json]` | Launch a session; `--json` returns a structured success payload after the interactive run ends |
+| `cdx <name> [--on-busy fail\|ask] [--json]` | Launch a session; `--json` returns a structured success payload after the interactive run ends |
+| `cdx <name> --on-busy fail` | Refuse a profile with a live session immediately, even with a terminal: non-zero exit and `session_busy` (`error.code` with `--json`). Works with `--task`, `--dir`, prompts and resume; `--on-busy=fail` is also accepted. The default `ask` keeps the confirmation prompt for terminal users; without a terminal or with `--json`, it fails instead of launching a duplicate. Handoff launches and `cdx last` use `ask` too. |
 | `cdx <name> --prompt TEXT` / `cdx <name> --prompt-file PATH` | Launch a session that starts on this first message (not with `--resume` or Ollama sessions; `--prompt-file -` is refused because the session needs standard input; a relative `--prompt-file` path is read from the current directory, not `--dir`) |
 | `cdx <name> --dir PATH --task TEXT [--end-state TEXT]` | Start a session on a task. `--end-state` names what your go-ahead covers ("CI green on a PR, merged"): the session takes every step it needs, commits, pushes and PRs included, and stops only for a decision outside it. Without `--end-state` it stops and shows the result before any commit, push or PR. Replaces `--prompt`; the first message also tells it to read the repository's instructions and use its skills. |
 | `cdx <name> -r` / `cdx <name> --resume` | Resume the provider-native conversation for a session when supported |
@@ -268,6 +269,8 @@ The figure uses standard public list prices, excluding Fast/priority, Batch/Flex
 
 `cdx stats` counts completed history attempts. A headless failover has one logical run in `cdx runs` but one history row per attempted session, including failed attempts that reported usage. Period filtering includes the entire run in every period it overlaps, so adjacent daily results can both include a run crossing midnight; adding daily totals may exceed a combined period. JSON `accounting` names this policy and the current price-table source. `usage_runs` and `priced_runs` show how much of the token total has a dollar estimate. Live runs are absent until their history row is written, and unknown usage is different from measured zero.
 
+Completed run JSON and registry reports expose `usage_model` separately from the requested `model`. Pricing uses the observed model from provider output; Codex can also supply it through the exact rollout identified by `thread.started.thread_id`. Configured defaults alone never establish serving-model identity, and missing or mixed model evidence stays unpriced. `--by model` groups Claude's `[1m]` context variant with its base model while preserving the original model string and per-run pricing. These changes apply to newly recorded runs; existing history is not rewritten.
+
 The built-in price table ships with **cdx-manager**. Run `cdx update` to receive new model prices; updating Codex or Claude alone does not refresh it. Then check `cdx --version` and `cdx stats --json`. Existing runs with a recorded model are recalculated using the new table when stats are read. `CDX_TOKEN_PRICES` overrides still take precedence. Maintainers: follow [the model and pricing update runbook](https://github.com/AlexAgo83/cdx-manager/blob/main/logics/runbook/run_005_maintaining_the_token_price_table.md) for source checks, tests, release preparation and installed-version verification.
 
 A model absent from the table stays unpriced rather than being charged a default tier, and the totals line names it — which is exactly the key `CDX_TOKEN_PRICES` wants:
@@ -422,3 +425,5 @@ It returns accepted values for `permission` (with its aliases and canonical form
 ```
 
 Codex ties network access to its sandbox, so any permission below `full` leaves the run unable to resolve DNS — `gh`, `curl`, and package installs fail inside an otherwise successful run. Show these warnings to whoever reads your output rather than discarding them; a run that succeeds while quietly doing less is the case they exist for.
+
+Claude result records with nonempty `permission_denials` produce a warning with code `permission_denials`, the `provider`, and the structured `permission_denials` list. Exit code 0 still means `ok: true`: a denied tool may have been replaced successfully. Empty or absent denials add no warning. With `--scrub-env on`, Claude forces its default permission mode; allow tools needed by unattended runs explicitly using `--allowedTools` via `--extra-args` (see [operations](operations.md)).

package/docs/operations.md

@@ -230,7 +230,7 @@ credential sync.
 
 - **`cdx <name>` fails with "not authenticated"** — run `cdx login <name>` first. `cdx doctor` uses the same Codex app-server probe as `cdx auth refresh`, so a local auth file alone is never reported as live authentication; a rejected refresh token is reported as `login_required` with the matching login command.
 - **A Claude session has no claude.ai connectors (Microsoft 365, ...) in `/mcp`** — `cdx login <name>` stores a setup-token for Claude profiles, and Claude Code can only make model requests with it: it never loads claude.ai connectors. `cdx status` shows each Claude profile's auth type (`setup-token` or `full-login`; `auth_type` in `--json`). To switch, start the session and run `/login` inside it. Once the profile holds its own claude.ai login (its `.claude/.credentials.json`, or its profile-specific `Claude Code-credentials-<hash>` keychain entry on macOS), cdx stops passing the setup-token on later launches. If that login later expires, run `/login` again, or go back to a setup-token with `cdx login <name>`, which removes the profile's `/login`.
-- **Keep credentials away from what a Claude agent runs** — by default Claude Code passes its credentials, including the setup-token cdx injects, to the Bash commands, hooks and stdio MCP servers it starts. `cdx set <name> --scrub-env on` launches that session with `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1`, which strips credential-looking variables from those subprocesses (GitHub tokens and proxy settings stay). It is off by default: it also removes other secrets an agent may need (`NPM_TOKEN`, a `DATABASE_URL` with a password), and on Linux it isolates Bash from host processes, so `ps` and `kill` no longer see them. Worth turning on for unattended sessions that read untrusted content.
+- **Keep credentials away from what a Claude agent runs** — by default Claude Code passes its credentials, including the setup-token cdx injects, to the Bash commands, hooks and stdio MCP servers it starts. `cdx set <name> --scrub-env on` launches that session with `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1`, which strips credential-looking variables from those subprocesses (GitHub tokens and proxy settings stay). It is off by default: it also removes other secrets an agent may need (`NPM_TOKEN`, a `DATABASE_URL` with a password), and on Linux it isolates Bash from host processes, so `ps` and `kill` no longer see them. For unattended sessions that read untrusted content, enable it only with explicit tool permissions: Claude forces its default permission mode when scrubbing is enabled, even if cdx requests `--permission full`. In headless runs, tools that require approval are denied unless explicitly allowed. For example, `cdx set <name> --scrub-env on --extra-args '--allowedTools "Read" "Bash(pwd)"'` allows those tools; adapt the allowlist to the task. cdx keeps scrubbing enabled and reports structured `permission_denials` as a run warning, without turning a successful provider exit into a failure: a denied tool can be replaced successfully.
 - **Share Claude's memory across accounts** — Claude Code keeps its auto-memory (`.claude/projects/<project>/memory`) in the profile home, so each account starts without what the others learned. `cdx set <name> --shared-memory on` links that folder, for the project being launched, to `~/.cdx/shared-memory/<project>`, shared by every profile with the setting on. Existing memory is copied in and the old folder kept as `memory.pre-cdx-<time>`; `MEMORY.md` indexes are merged line by line. A file with the same name and different content on two accounts is a conflict: cdx leaves that profile alone and names the files to merge by hand. macOS and Linux only (symlinks).
 - **One of two Codex accounts keeps asking for login** — run `cdx doctor --json` and inspect each Codex session's `codex_auth_file`, `codex_live_auth`, and `codex_stale_auth_logs` checks. If recent logs mention expired auth, repair only that isolated profile with `cdx login <name>`. Codex Business profiles can share the same `tokens.account_id`; `cdx doctor` reports `codex_shared_account_id` as a workspace-level clue, not proof that two profiles use the same user. Newly created sessions seed from the current global `~/.codex/auth.json` when one exists. For two separate Codex accounts, create or repair each session by running `cdx login <name>` for that session; `cdx login` does not log out first, so use `cdx logout <name>` explicitly only when you want to clear that isolated profile.
 - **`cdx` says no compatible Python 3 interpreter was found** — install Python 3 and make `py -3`, `python`, or `python3` available on PATH.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.24.1",
+  "version": "0.24.3",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.24.1"
+version = "0.24.3"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/cli.py

@@ -295,7 +295,8 @@ def _print_help(use_color=False):
         _style("Notifications:", "1", use_color),
         f"  {_style('cdx set <name> --notify on', '36', use_color)}  # agent finishes or needs attention",
         f"  {_style('cdx ready', '36', use_color)}  # next session to become ready",
-        f"  {_style('cdx <name> [--json]', '36', use_color)}",
+        f"  {_style('cdx <name> [--on-busy fail|ask] [--json]', '36', use_color)}",
+        "    --on-busy: fail immediately if already running; ask (default) prompts only with a terminal and without --json",
         f"  {_style('cdx <name> --prompt TEXT|--prompt-file PATH', '36', use_color)}  # start with a first message",
         f"  {_style('cdx <name> --dir PATH --task TEXT --end-state TEXT', '36', use_color)}  # start on a task, with what the go-ahead covers",
         f"  {_style('cdx --help', '36', use_color)}",
@@ -637,7 +638,7 @@ def main(argv, options=None):
         return handler(rest, ctx)
 
     from .commands.launch import _parse_launch_args, _read_launch_prompt
-    directory, launch_args, prompt = _parse_launch_args(rest)
+    directory, launch_args, prompt, on_busy = _parse_launch_args(rest)
     if all(arg in ("--json", "-r", "--resume") for arg in launch_args):
         resume = "-r" in launch_args or "--resume" in launch_args
         has_prompt = prompt["prompt"] is not None or prompt["prompt_file"] is not None
@@ -647,7 +648,7 @@ def main(argv, options=None):
         if has_prompt and (ctx["service"]["get_session"](command) or {}).get("provider") == PROVIDER_OLLAMA:
             raise CdxError("cdx <name>: --prompt and --prompt-file are not supported for Ollama sessions.")
         return handle_launch(command, ctx, initial_prompt=_read_launch_prompt(prompt), resume=resume,
-                             directory=directory)
+                             directory=directory, on_busy=on_busy)
 
     raise CdxError(f"Unknown command: {command}. Use cdx --help.")
 

package/src/cli_args.py

@@ -42,7 +42,7 @@ HISTORY_USAGE = "Usage: cdx history [name] [--limit N] [--summary] [--since 7d|t
 STATS_USAGE = "Usage: cdx stats [name] [--since 7d|today|DATE] [--from DATE] [--to DATE] [--by session|project|model] [--json]"
 STATS_GROUPS = ("session", "project", "model")
 LAST_USAGE = "Usage: cdx last [--json]"
-RESUME_USAGE = "Usage: cdx resume <name> [--conversation <id>] [--json]"
+RESUME_USAGE = "Usage: cdx resume <name> [--conversation <id>] [--on-busy fail|ask] [--json]"
 CAN_RESUME_USAGE = "Usage: cdx can-resume <name> [--conversation <id>] [--json]"
 SESSIONS_USAGE = "Usage: cdx sessions [--all] --json"
 SELECT_USAGE = "Usage: cdx select --provider PROVIDER [--min-reasoning-effort minimal|low|medium|high|xhigh] [--min-power minimal|low|medium|high|xhigh] [--require-ready] [--refresh] --json"

package/src/cli_helpers.py

@@ -386,22 +386,22 @@ def _resume_capability_for_session(session, ctx):
         "command_preview": capability.get("command_preview") or [],
     }
 
-def _warn_if_session_already_running(name, ctx):
-    # ponytail: concurrent sessions on one profile share its single OAuth
-    # .credentials.json; both refresh near token expiry and the rotated refresh
-    # token invalidates the other session -> surprise logout. Warn before adding
-    # a second live session on the same profile.
+def _warn_if_session_already_running(name, ctx, *, on_busy="ask", json_flag=False):
     active = ctx["service"].get("active_session_runtime")
     runtime = active(name) if active else None
     if not runtime:
         return
+    if on_busy == "fail" or not ctx["stdin_is_tty"] or json_flag:
+        raise CdxError(f"session_busy: Session {name} is already running.", code="session_busy")
     pid = runtime.get("pid")
     ctx["out"](f"{_warn(f'A session named {name} is already running (pid {pid}).', ctx['use_color'])}\n")
     ctx["out"](
         f"{_dim('Two sessions on one profile share its login and can log each other out. Use a different profile instead.', ctx['use_color'])}\n"
     )
-    if not ctx["stdin_is_tty"]:
-        return
-    answer = input(f"Launch a second {name} session anyway? [y/N] ")
+    ask = ctx["options"].get("input") or input
+    try:
+        answer = ask(f"Launch a second {name} session anyway? [y/N] ")
+    except EOFError:
+        raise CdxError(f"session_busy: Session {name} is already running.", code="session_busy") from None
     if answer.strip().lower() not in ("y", "yes"):
         raise CdxError("Launch cancelled.")

package/src/commands/launch.py

@@ -36,7 +36,7 @@ from ..provider_runtime import (
 from ..run_command import PROMPT_STDIN, read_run_prompt
 from ..run_usage import estimate_cost
 
-LAUNCH_USAGE = "Usage: cdx <name> [--dir PATH] [--prompt TEXT|--prompt-file PATH|--task TEXT [--end-state TEXT]] [--resume] [--json]"
+LAUNCH_USAGE = "Usage: cdx <name> [--dir PATH] [--prompt TEXT|--prompt-file PATH|--task TEXT [--end-state TEXT]] [--resume] [--on-busy fail|ask] [--json]"
 
 #: The first message of a session started with --task. The end state is what the
 #: user's go-ahead covers: a bare "show me first" made sessions stop after a commit
@@ -52,8 +52,8 @@ NO_END_STATE = """No end state was given: stop and show the result before any co
 
 
 def _parse_launch_args(args):
-    """Return the per-launch directory, initial prompt source and ordinary launch flags."""
-    values = {"--dir": None, "--prompt": None, "--prompt-file": None, "--task": None, "--end-state": None}
+    """Return the directory, remaining flags, prompt source and busy policy."""
+    values = {"--dir": None, "--prompt": None, "--prompt-file": None, "--task": None, "--end-state": None, "--on-busy": None}
     cleaned = []
     index = 0
     while index < len(args):
@@ -72,6 +72,9 @@ def _parse_launch_args(args):
         if values[flag] is not None or not value:
             raise CdxError(LAUNCH_USAGE)
         values[flag] = value
+    on_busy = values["--on-busy"] or "ask"
+    if on_busy not in ("fail", "ask"):
+        raise CdxError("cdx <name>: --on-busy must be fail or ask.")
     if values["--prompt"] is not None and values["--prompt-file"] is not None:
         raise CdxError("cdx <name>: --prompt and --prompt-file are mutually exclusive.")
     if values["--end-state"] is not None and values["--task"] is None:
@@ -84,7 +87,7 @@ def _parse_launch_args(args):
     if values["--prompt-file"] == PROMPT_STDIN:
         raise CdxError("cdx <name>: --prompt-file - is not supported; the interactive session needs standard input.")
     prompt = {"prompt": values["--prompt"], "prompt_file": values["--prompt-file"]}
-    return values["--dir"], cleaned, prompt
+    return values["--dir"], cleaned, prompt, on_busy
 
 
 def _read_launch_prompt(prompt):
@@ -204,14 +207,14 @@ def handle_can_resume(rest, ctx):
 
 def handle_resume(rest, ctx):
     conversation_id, rest = _pop_value_flag(rest, "--conversation", RESUME_USAGE)
-    directory, rest, prompt = _parse_launch_args(rest)
+    directory, rest, prompt, on_busy = _parse_launch_args(rest)
     if prompt["prompt"] is not None or prompt["prompt_file"] is not None:
         raise CdxError("cdx resume: --prompt and --prompt-file are not supported when resuming.")
     json_flag, args = _parse_json_flag(rest)
     if len(args) != 1:
         raise CdxError(RESUME_USAGE)
     return handle_launch(args[0], ctx, resume=True, force_json=json_flag, directory=directory,
-                         conversation_id=conversation_id)
+                         conversation_id=conversation_id, on_busy=on_busy)
 
 
 def _notification_provisioning_enabled(session, ctx, json_flag):
@@ -255,14 +258,14 @@ def _link_shared_memory(session, ctx, cwd, json_flag):
 
 
 def handle_launch(command, ctx, initial_prompt=None, resume=False, force_json=None, directory=None,
-                  conversation_id=None):
+                  conversation_id=None, on_busy="ask"):
     json_flag = "--json" in ctx.get("raw_args", ctx["options"].get("raw_args", []))
     if force_json is not None:
         json_flag = force_json
     warnings = _update_notice_warnings(ctx)
     active_runtime = ctx["service"].get("active_session_runtime")
     overlap_at_start = bool(active_runtime and active_runtime(command))
-    _warn_if_session_already_running(command, ctx)
+    _warn_if_session_already_running(command, ctx, on_busy=on_busy, json_flag=json_flag)
     session = ctx["service"]["get_session"](command)
     if not session:
         raise CdxError(f"Unknown session: {command}")
@@ -455,16 +458,16 @@ def _attach_interactive_usage(session, run_info, history=None, baseline=None, un
         # way as an id match would let a wrong attribution read as a
         # measurement, which is the failure this replaced.
         run_info["provider_transcript_match"] = match
-    if not cumulative:
-        return run_info
-
-    run_info["usage_cumulative"] = cumulative
     if model:
         # Which model actually served the run, read from the transcript rather
         # than inferred from the session's configured launch settings -- where
         # `model` is optional and usually unset, because the session takes the
         # provider's default.
         run_info["usage_model"] = model
+    if not cumulative:
+        return run_info
+
+    run_info["usage_cumulative"] = cumulative
     if uncertain_reason:
         run_info["usage_attribution"] = uncertain_reason
         return run_info
@@ -595,4 +598,4 @@ def handle_handoff(rest, ctx):
         ))
         return 0
     ctx["out"](f"Handoff ready ({entry['mode']}): {path}\n")
-    return handle_launch(target['name'], ctx, initial_prompt=prompt, directory=workspace)
+    return handle_launch(target['name'], ctx, initial_prompt=prompt, directory=workspace, on_busy="ask")

package/src/commands/runs.py

@@ -687,6 +687,7 @@ def handle_run(rest, ctx):
             )
             usage, usage_model = extract_run_observation(
                 run_session.get("provider"), run_info.get("stdout_path"),
+                run_session.get("authHome"),
             )
             run_info = {**run_info, "usage": usage, "usage_model": usage_model}
             ctx["service"]["record_launch_history"](run_session["name"], {
@@ -807,6 +808,7 @@ def handle_run(rest, ctx):
         if run_info and run_id:
             usage, usage_model = extract_run_observation(
                 run_session.get("provider"), run_info.get("stdout_path"),
+                run_session.get("authHome"),
             )
             run_info = {**run_info, "usage": usage, "usage_model": usage_model}
             ctx["service"]["record_launch_history"](run_session["name"], {

package/src/commands/status.py

@@ -491,7 +491,8 @@ def _stats_group(entry, by):
     """The project (launch folder) or the model a run is counted under."""
     if by == "project":
         return str(entry.get("cwd") or "").rstrip("/\\") or "-"
-    return entry.get("usage_model") or "-"
+    model = entry.get("usage_model") or "-"
+    return model.removesuffix("[1m]") if model.startswith("claude-") else model
 
 
 def _project_labels(paths):
@@ -693,7 +694,7 @@ def handle_last(rest, ctx):
     if not json_flag:
         message = f"Launching last session: {session['name']}"
         ctx["out"](f"{_info(message, ctx['use_color'])}\n")
-    return handle_launch(session["name"], ctx)
+    return handle_launch(session["name"], ctx, on_busy="ask")
 
 def handle_status(rest, ctx):
     parsed = _parse_flag_args(rest, {

package/src/provider_runtime.py

@@ -26,6 +26,7 @@ from .config import (
     split_extra_args,
 )
 from .errors import CdxError
+from .run_usage import _parse_json_records
 
 TERMINAL_TITLE_SEPARATOR = " — "
 # Providers redraw their own title while their TUI runs, so a single write at
@@ -1184,6 +1185,22 @@ def _terminate_child_tree(child):
         pass
 
 
+def _read_permission_denials(stdout_path):
+    denials = []
+    try:
+        with open(stdout_path, encoding="utf-8", errors="replace") as handle:
+            records = _parse_json_records(handle.read())
+    except OSError:
+        return denials
+    for record in records:
+        if not isinstance(record, dict) or record.get("type") != "result":
+            continue
+        reported = record.get("permission_denials")
+        if isinstance(reported, list):
+            denials.extend(item for item in reported if isinstance(item, dict))
+    return denials
+
+
 def _run_headless_provider_command(session, cwd=None, env_override=None, initial_prompt=None,
                                    timeout_seconds=None, spawn=None, run_id=None):
     spawn = spawn or subprocess.Popen
@@ -1277,6 +1294,10 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
         "pid": getattr(child, "pid", None),
         "returncode": returncode,
         "timed_out": timed_out,
+        "permission_denials": (
+            _read_permission_denials(paths["stdout_path"])
+            if session.get("provider") == PROVIDER_CLAUDE else []
+        ),
     }
 
 

package/src/run_command.py

@@ -4,7 +4,7 @@ import sys
 from .cli_args import ARG_CODE_INVALID_VALUE
 from .errors import CdxArgumentError, CdxError
 from .provider_runtime import headless_permission_disables_network
-from .run_usage import empty_usage, extract_run_usage
+from .run_usage import empty_usage, extract_run_observation
 
 PROMPT_STDIN = "-"
 
@@ -182,16 +182,27 @@ def run_launch_payload(api_schema_version, parsed, session, artifacts, cwd=None,
 def run_result_payload(api_schema_version, ok, parsed, session, run_info=None,
                        error=None, error_source=None, error_code=None, selection_row=None):
     run_info = run_info or {}
-    usage = run_info.get("usage") if isinstance(run_info.get("usage"), dict) else (
-        extract_run_usage(session.get("provider"), run_info.get("stdout_path"))
-        if session else
-        empty_usage()
-    )
+    usage, usage_model = run_info.get("usage"), run_info.get("usage_model")
+    if not isinstance(usage, dict):
+        usage, usage_model = extract_run_observation(
+            session.get("provider"), run_info.get("stdout_path"), session.get("authHome"),
+        ) if session else (empty_usage(), None)
     message = None if ok else (
         _provider_failure_message(error, run_info, error_code)
         if error_source == "provider"
         else (str(error) if error else "Run failed.")
     )
+    warnings = run_warnings(parsed, session, selection_row)
+    if run_info.get("permission_denials"):
+        warnings.append({
+            "code": "permission_denials",
+            "message": (
+                "The provider reported denied tool calls. A denied tool may have been "
+                "replaced successfully; check the denials and transcript for impact."
+            ),
+            "provider": session.get("provider") if session else parsed.get("provider"),
+            "permission_denials": run_info["permission_denials"],
+        })
     return {
         "schema_version": api_schema_version,
         "ok": bool(ok),
@@ -210,7 +221,8 @@ def run_result_payload(api_schema_version, ok, parsed, session, run_info=None,
         "stdout_path": run_info.get("stdout_path"),
         "stderr_path": run_info.get("stderr_path"),
         "usage": usage,
-        "warnings": run_warnings(parsed, session, selection_row),
+        "usage_model": usage_model,
+        "warnings": warnings,
         "error": None if ok else {
             "source": error_source or "cdx",
             "code": error_code or "cdx_error",

package/src/run_registry.py

@@ -358,6 +358,7 @@ class RunRegistry:
                 # what `cdx run-status` and `cdx run-report` publish, and it
                 # used to store whichever shape the producing reader emitted.
                 run["usage"] = coerce_usage(final_payload.get("usage"))
+                run["usage_model"] = final_payload.get("usage_model")
                 run["final_payload"] = final_payload
             if error:
                 run["error"] = error

package/src/run_usage.py

@@ -413,7 +413,7 @@ def extract_run_usage(provider, stdout_path):
     return extract_run_observation(provider, stdout_path)[0]
 
 
-def extract_run_observation(provider, stdout_path):
+def extract_run_observation(provider, stdout_path, auth_home=None):
     if not stdout_path or not provider:
         return empty_usage(), None
     if provider not in SUPPORTED_PROVIDERS:
@@ -444,9 +444,46 @@ def extract_run_observation(provider, stdout_path):
         model_usage = record.get("modelUsage")
         if isinstance(model_usage, dict):
             models.update(model_usage)
+    if provider == "codex" and auth_home:
+        models.update(_codex_run_models(records, auth_home))
     return usage, next(iter(models)) if len(models) == 1 else None
 
 
+def _codex_run_models(records, auth_home):
+    # Exec's token totals belong to this run; a rollout's totals may include
+    # earlier turns. Read only model evidence from the exact thread's rollout.
+    from .interactive_usage import MAX_TRANSCRIPT_BYTES, conversation_transcript
+
+    thread_ids = {record.get("thread_id") for record in records
+                  if isinstance(record, dict) and record.get("type") == "thread.started"
+                  and isinstance(record.get("thread_id"), str) and record["thread_id"]}
+    if len(thread_ids) != 1:
+        return set()
+    path = conversation_transcript("codex", auth_home, next(iter(thread_ids)))
+    if not path:
+        return set()
+    models = set()
+    try:
+        with open(path, encoding="utf-8", errors="replace") as handle:
+            text = handle.read(MAX_TRANSCRIPT_BYTES + 1)
+            if len(text) > MAX_TRANSCRIPT_BYTES:
+                return set()
+            for line in text.splitlines():
+                try:
+                    record = json.loads(line)
+                except ValueError:
+                    continue
+                if not isinstance(record, dict) or record.get("type") != "turn_context":
+                    continue
+                payload = record.get("payload")
+                model = payload.get("model") if isinstance(payload, dict) else None
+                if isinstance(model, str) and model:
+                    models.add(model)
+    except OSError:
+        return set()
+    return models
+
+
 def _parse_json_records(text):
     stripped = text.strip()
     try: