cdx-manager 0.24.2 → 0.24.4

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.24.2-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.24.4-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **The right AI coding account, when you need it.** CDX Manager keeps your Codex and Claude accounts in separate profiles, shows which ones have quota, and helps you pick the next usable session from your terminal.
 

package/VERSION

@@ -1 +1 @@
-0.24.2
+0.24.4

package/changelogs/CHANGELOGS_0_24_3.md

@@ -0,0 +1,13 @@
+# CDX Manager 0.24.3
+
+Release date: 2026-10-29
+
+This patch preserves observed serving models in run history and reports for more reliable usage attribution and pricing. (#57)
+
+## Runs and statistics
+
+- Expose `usage_model` separately from the requested `model` in completed run JSON and registry reports, and retain observed model evidence in interactive history even when token usage is unavailable.
+- Recover Codex model evidence from the exact rollout identified by `thread.started.thread_id`, while keeping token totals from the run's own output. Configured defaults alone do not establish the serving model; missing or mixed model evidence stays unpriced.
+- Group Claude's `[1m]` context variants with their base model in `cdx stats --by model`, preserving the original model string and per-run pricing.
+
+These changes apply to newly recorded runs; existing history is not rewritten.

package/changelogs/CHANGELOGS_0_24_4.md

@@ -0,0 +1,16 @@
+# CDX Manager 0.24.4
+
+Release date: 2026-10-29
+
+This patch adds explicit recovery of missing serving models in existing run history, using evidence tied to each run. (#59)
+
+## History and statistics
+
+- Add `cdx history backfill-models`, with a read-only preview by default and `--dry-run`, `--apply`, and `--json` options. Recover models from preserved run output, matching run reports, or exact Codex and Claude conversation transcripts. (#59)
+- Keep missing or ambiguous evidence unknown rather than guessing from configured models or the latest conversation. Preserve existing models and token counts; report recovery counts, unknown reasons, and samples. (#59)
+- With `--apply`, back up the original history and replace it atomically under the history lock. Repeated runs leave recovered rows alone. Subsequent statistics can price recovered models when the local price table recognizes them. (#59)
+
+## Maintenance
+
+- Record tray companion checksums for v0.24.3. (`bae6f34b733c91ef44070d25bb86015fa31f71ca`)
+- Record release archive checksums for v0.24.3. (`8a1d4938a11f83cbe2eb8abc324a55b909f72837`)

package/checksums/release-archives.json

@@ -595,6 +595,28 @@
         "x86_64-pc-windows-msvc": "89a7e43654ea5f0d4efc20a14c1398377a1d48485f1b9867b199e85aa9c25daf",
         "x86_64-unknown-linux-musl": "a36a3589a3766d67e44a0466b11a18bda4297963416eec7b5b9d23a5c9f363a4"
       }
+    },
+    "v0.24.2": {
+      "github_tarball_sha256": "90ea3d050c278500b975bbc8bfe1b185f90fc35dfcf6b07d84eb59439bb24e58",
+      "github_zip_sha256": "3c53f0f0550416ebe3d7281e9c823a682a2c3560130df6fafec48d35278f4f8a",
+      "tray_assets": {
+        "aarch64-apple-darwin": "8fc48c8772b5ea50700933f0836e153104ef328b395de059749bd5a5aa864076",
+        "aarch64-unknown-linux-musl": "ce7708f4196cfdf7b7226ba3199e772e767c2d470c37d19589cb41bfc35de7af",
+        "x86_64-apple-darwin": "2d1d6e84ee08d9dea5a707332a39509edbe68b05e3d062bdae93e9c6704db543",
+        "x86_64-pc-windows-msvc": "eecc8f8c46d2ce50e6cf6ec6c48c10a10e165ec7ec0058cfb55c8aa486d17d7b",
+        "x86_64-unknown-linux-musl": "4cf3289c5d9d7a540a032a11d27e93093d69ec507e1796a726f429c0670f7bc5"
+      }
+    },
+    "v0.24.3": {
+      "github_tarball_sha256": "4dfcc2c6a8f500fca04436ea9a22525827924a8193f79f3f285dfc3025762c42",
+      "github_zip_sha256": "66950a74e2bf8a9a349818a612a50217e10a70b92621bfa414d2d19df00aff61",
+      "tray_assets": {
+        "aarch64-apple-darwin": "3aaf5564a4ec896bd1e2a8400e653661ecdb216dfd87970ee3af69ddf7d088b0",
+        "aarch64-unknown-linux-musl": "2ff0d2272fb5d2d21631df986c050f8196a687fb6381453216d07748ed1b873f",
+        "x86_64-apple-darwin": "db6b646575195365879c7b25d406c0734bdbef7154f25e7f38342cafbf88d74a",
+        "x86_64-pc-windows-msvc": "6da838217c01251b809bac1e188217dcfbb00c2102b901cfda43cf2fc0696aa2",
+        "x86_64-unknown-linux-musl": "c6651dd909d486c2b0bb209e0d813ab044dc7b5ffb1a07078c8ec7a69126e028"
+      }
     }
   }
 }

package/docs/cli.md

@@ -28,6 +28,7 @@
 | `cdx set <name>\|--sessions all\|a,b\|--provider PROVIDER [--power minimal\|low\|medium\|high\|xhigh] [--permission review\|default\|auto\|full] [--fast on\|off] [--rtk on\|off] [--logics on\|off] [--notify on\|off] [--agent-state on\|off] [--notify-preview on\|off] [--scrub-env on\|off] [--shared-memory on\|off] [--retro on\|off] [--policy use\|ask-first\|never] [--model MODEL] [--fallback-model MODEL[,MODEL...]] [--budget USD] [--extra-args 'ARGS'] [--priority 0..100] [--json]` | Persist launch settings for one or more sessions |
 | `cdx unset <name>\|--sessions all\|a,b\|--provider PROVIDER (--power\|--reasoning-effort\|--permission\|--fast\|--rtk\|--logics\|--notify\|--agent-state\|--notify-preview\|--scrub-env\|--shared-memory\|--retro\|--policy\|--model\|--fallback-model\|--budget\|--extra-args\|--priority\|--all) [--json]` | Remove persisted launch settings and fall back to provider defaults |
 | `cdx history [name] [--limit N] [--summary] [--since 7d\|today\|DATE] [--from DATE] [--to DATE] [--json]` | Show recent launch history or aggregate total launch time per assistant, optionally filtered by period |
+| `cdx history backfill-models [--dry-run \| --apply] [--json]` | Recover missing historical usage models from evidence tied to each run; defaults to a read-only preview |
 | `cdx last [--json]` | Launch the most recent existing session from launch history |
 | `cdx resume <name> [--conversation <id>] [--json]` | Resume the provider-native conversation for a session using the named command form; `--conversation` reopens that exact conversation and refuses with `conversation_not_found` if the profile has no such transcript |
 | `cdx can-resume <name> [--conversation <id>] [--json]` | Check whether a session supports native resume without launching the provider; `--conversation` checks that exact conversation and reports `resumable: false` with `conversation_not_found` instead of falling back to the most recent one |
@@ -269,6 +270,20 @@ The figure uses standard public list prices, excluding Fast/priority, Batch/Flex
 
 `cdx stats` counts completed history attempts. A headless failover has one logical run in `cdx runs` but one history row per attempted session, including failed attempts that reported usage. Period filtering includes the entire run in every period it overlaps, so adjacent daily results can both include a run crossing midnight; adding daily totals may exceed a combined period. JSON `accounting` names this policy and the current price-table source. `usage_runs` and `priced_runs` show how much of the token total has a dollar estimate. Live runs are absent until their history row is written, and unknown usage is different from measured zero.
 
+Completed run JSON and registry reports expose `usage_model` separately from the requested `model`. Pricing uses the observed model from provider output; Codex can also supply it through the exact rollout identified by `thread.started.thread_id`. Configured defaults alone never establish serving-model identity, and missing or mixed model evidence stays unpriced. `--by model` groups Claude's `[1m]` context variant with its base model while preserving the original model string and per-run pricing. New runs record this evidence automatically. To recover missing models in existing history, run:
+
+```bash
+cdx history backfill-models                  # Preview only (the default)
+cdx history backfill-models --dry-run --json # Machine-readable preview
+cdx history backfill-models --apply          # Save proven models with a backup
+```
+
+The command considers only history rows with usage and an empty or placeholder `usage_model`. Evidence is checked in order: the row's preserved JSON/JSONL stdout, a preserved run-registry report with the same run id, profile, provider and stdout path, then the exact Codex thread rollout or Claude session transcript. Thread/session ids must come from the row or its stdout, or from a preserved transcript path recorded as an exact conversation-id match. The current profile is used only to locate an exact transcript under its auth home; its configured model and latest conversation/transcript never establish a historical model. The requested `model` in a report is also ignored.
+
+Only one serving model is accepted. Claude `[1m]` variants count as the same model for this check and for stats grouping; the observed spelling is preserved. Mixed models, incomplete turn models, malformed or oversized evidence, conflicting identities and missing exact transcripts stay unknown. For resumed conversations, the conservative rule is that all recorded turns in the exact transcript must agree: this command does not infer historical turn boundaries. Ambiguous higher-priority evidence stops recovery rather than being overridden by a lower-priority source. Missing files may fall through to the next source.
+
+Text and JSON output include counts by evidence kind, counts of unknown reasons and up to 20 samples. Dry-run leaves history and run reports unchanged. `--apply` changes only missing models and their evidence annotation, preserving token counts and unrelated history bytes. It holds the history lock, saves the original bytes to a unique `state/launch_history.jsonl.models-<id>.bak` file, then atomically replaces history. The backup path is printed; a repeated apply leaves already recovered rows alone. `--apply` and `--dry-run` cannot be combined. Subsequent `cdx stats` calls price recovered models when the local price table knows them; unknown models remain unpriced.
+
 The built-in price table ships with **cdx-manager**. Run `cdx update` to receive new model prices; updating Codex or Claude alone does not refresh it. Then check `cdx --version` and `cdx stats --json`. Existing runs with a recorded model are recalculated using the new table when stats are read. `CDX_TOKEN_PRICES` overrides still take precedence. Maintainers: follow [the model and pricing update runbook](https://github.com/AlexAgo83/cdx-manager/blob/main/logics/runbook/run_005_maintaining_the_token_price_table.md) for source checks, tests, release preparation and installed-version verification.
 
 A model absent from the table stays unpriced rather than being charged a default tier, and the totals line names it — which is exactly the key `CDX_TOKEN_PRICES` wants:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.24.2",
+  "version": "0.24.4",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.24.2"
+version = "0.24.4"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/commands/launch.py

@@ -458,16 +458,16 @@ def _attach_interactive_usage(session, run_info, history=None, baseline=None, un
         # way as an id match would let a wrong attribution read as a
         # measurement, which is the failure this replaced.
         run_info["provider_transcript_match"] = match
-    if not cumulative:
-        return run_info
-
-    run_info["usage_cumulative"] = cumulative
     if model:
         # Which model actually served the run, read from the transcript rather
         # than inferred from the session's configured launch settings -- where
         # `model` is optional and usually unset, because the session takes the
         # provider's default.
         run_info["usage_model"] = model
+    if not cumulative:
+        return run_info
+
+    run_info["usage_cumulative"] = cumulative
     if uncertain_reason:
         run_info["usage_attribution"] = uncertain_reason
         return run_info

package/src/commands/runs.py

@@ -687,6 +687,7 @@ def handle_run(rest, ctx):
             )
             usage, usage_model = extract_run_observation(
                 run_session.get("provider"), run_info.get("stdout_path"),
+                run_session.get("authHome"),
             )
             run_info = {**run_info, "usage": usage, "usage_model": usage_model}
             ctx["service"]["record_launch_history"](run_session["name"], {
@@ -807,6 +808,7 @@ def handle_run(rest, ctx):
         if run_info and run_id:
             usage, usage_model = extract_run_observation(
                 run_session.get("provider"), run_info.get("stdout_path"),
+                run_session.get("authHome"),
             )
             run_info = {**run_info, "usage": usage, "usage_model": usage_model}
             ctx["service"]["record_launch_history"](run_session["name"], {

package/src/commands/status.py

@@ -491,7 +491,8 @@ def _stats_group(entry, by):
     """The project (launch folder) or the model a run is counted under."""
     if by == "project":
         return str(entry.get("cwd") or "").rstrip("/\\") or "-"
-    return entry.get("usage_model") or "-"
+    model = entry.get("usage_model") or "-"
+    return model.removesuffix("[1m]") if model.startswith("claude-") else model
 
 
 def _project_labels(paths):
@@ -601,6 +602,30 @@ def handle_configs(rest, ctx):
     return 0
 
 def handle_history(rest, ctx):
+    if rest and rest[0] == "backfill-models":
+        usage = "Usage: cdx history backfill-models [--dry-run | --apply] [--json]"
+        parsed = _parse_flag_args(rest[1:], {
+            "--dry-run": {"key": "dry_run", "type": "bool", "default": False},
+            "--apply": {"key": "apply", "type": "bool", "default": False},
+            "--json": {"key": "json", "type": "bool", "default": False},
+        }, usage)
+        if parsed["apply"] and parsed["dry_run"]:
+            raise CdxError(usage)
+        result = ctx["service"]["backfill_history_models"](dry_run=not parsed["apply"])
+        if parsed["json"]:
+            _write_json(ctx, _json_success("history", "Backfilled history models", **result))
+        else:
+            mode = "Dry run" if result["dry_run"] else "Applied"
+            ctx["out"](f"{mode}: {result['candidates']} missing models; {result['still_unknown']} still unknown; {result['backfilled']} written.\n")
+            for kind, count in result["recoverable"].items():
+                ctx["out"](f"Recoverable from {kind}: {count}\n")
+            for reason, count in result["unknown_reasons"].items():
+                ctx["out"](f"Unknown ({reason}): {count}\n")
+            for sample in result["samples"]:
+                ctx["out"](f"  {sample['session_name']} {sample['run_id'] or sample['started_at']}: {sample['model'] or sample['reason']} ({sample['evidence'] or 'no evidence'})\n")
+            if result["backup_path"]:
+                ctx["out"](f"Backup: {result['backup_path']}\n")
+        return 0
     now_fn = ctx["options"].get("now") or time.time
     now = datetime.fromtimestamp(now_fn()).astimezone()
     parsed = _parse_history_args(rest, now=now)

package/src/history_models.py

@@ -0,0 +1,201 @@
+"""Recover serving models using only evidence attached to a history row."""
+
+import json
+import os
+import time
+
+from .interactive_usage import MAX_TRANSCRIPT_BYTES, MAX_TRANSCRIPT_SCAN_SECONDS
+from .run_registry import registry_path
+
+EVIDENCE_KINDS = ("stdout", "run_report", "codex_rollout", "claude_transcript")
+
+
+def missing_model(value):
+    return not value or (isinstance(value, str) and value.startswith("<"))
+
+
+def _read_records(path):
+    if not path:
+        return [], None
+    if not isinstance(path, (str, os.PathLike)):
+        return [], "invalid_evidence_path"
+    try:
+        with open(path, "rb") as handle:
+            raw = handle.read(MAX_TRANSCRIPT_BYTES + 1)
+        if len(raw) > MAX_TRANSCRIPT_BYTES:
+            return [], "evidence_too_large"
+        text = raw.decode("utf-8")
+        try:
+            records = [json.loads(text)]
+        except ValueError:
+            records = [json.loads(line) for line in text.splitlines() if line.strip()]
+        if not all(isinstance(record, dict) for record in records):
+            return [], "invalid_evidence"
+        return records, None
+    except FileNotFoundError:
+        return [], None
+    except (OSError, UnicodeError, ValueError):
+        return [], "unreadable_evidence"
+
+
+def _single_model(models):
+    if any(not isinstance(model, str) or missing_model(model) for model in models):
+        return None, "incomplete_model_evidence"
+    # Context size variants already share a model group in stats.
+    groups = {model.removesuffix("[1m]") if model.startswith("claude-") else model for model in models}
+    if len(groups) > 1:
+        return None, "ambiguous_models"
+    return (models[0], None) if models else (None, None)
+
+
+def _stdout_models(records):
+    models = []
+    for record in records:
+        if record.get("launcher") == "cdx" or record.get("action") == "run":
+            if not missing_model(record.get("usage_model")):
+                models.append(record["usage_model"])
+            continue
+        message = record.get("message")
+        if isinstance(message, dict) and message.get("model") == "<synthetic>":
+            continue
+        if isinstance(message, dict) and (message.get("role") == "assistant" or record.get("type") == "assistant"):
+            models.append(message.get("model"))
+        elif "model" in record and ("usage" in record or record.get("type") == "result"):
+            models.append(record["model"])
+        model_usage = record.get("modelUsage")
+        if isinstance(model_usage, dict):
+            models.extend(model_usage)
+    return models
+
+
+def _exact_id(entry, records, provider):
+    key = "thread_id" if provider == "codex" else "session_id"
+    identifiers = {record[key] for record in records if isinstance(record.get(key), str) and record[key]}
+    for identifier in (entry.get(key), entry.get("conversation_id")):
+        if identifier:
+            if not isinstance(identifier, str):
+                return None, "invalid_conversation_id"
+            identifiers.add(identifier)
+    if len(identifiers) > 1:
+        return None, "ambiguous_conversation_ids"
+    return next(iter(identifiers), None), None
+
+
+def _matches_transcript(provider, name, identifier):
+    if provider == "codex":
+        return name.startswith("rollout-") and name.endswith(f"-{identifier}.jsonl")
+    return name == f"{identifier}.jsonl"
+
+
+def _exact_transcript(provider, auth_home, identifier):
+    if not auth_home:
+        return None, None
+    root = os.path.join(auth_home, "sessions") if provider == "codex" else os.path.join(auth_home, ".claude", "projects")
+    paths = []
+    deadline = time.monotonic() + MAX_TRANSCRIPT_SCAN_SECONDS
+    for directory, subdirs, names in os.walk(root):
+        if time.monotonic() > deadline:
+            return None, "transcript_scan_limit"
+        subdirs[:] = [name for name in subdirs if name != "subagents"]
+        for name in names:
+            if _matches_transcript(provider, name, identifier):
+                paths.append(os.path.join(directory, name))
+                if len(paths) > 1:
+                    return None, "multiple_exact_transcripts"
+    return next(iter(paths), None), None
+
+
+def recover_model(entry, session=None, reports=()):
+    """Return (model, evidence kind, reason); never consult live model settings."""
+    provider = entry.get("provider")
+    records, error = _read_records(entry.get("stdout_path"))
+    if error:
+        return None, None, error
+    for record in records:
+        if record.get("launcher") == "cdx" or record.get("action") == "run":
+            if (not entry.get("run_id") or record.get("run_id") != entry["run_id"]
+                    or record.get("session") != entry.get("session_name") or record.get("provider") != provider):
+                return None, None, "report_identity_mismatch"
+    model, error = _single_model(_stdout_models(records))
+    if model or error:
+        return model, "stdout", error
+
+    # A logical run may fail over across profiles. Its final report does not
+    # prove the model used by an earlier attempt with the same run id.
+    report_models = []
+    for report in reports:
+        if not entry.get("run_id") or report.get("run_id") != entry["run_id"]:
+            continue
+        if report.get("session") != entry.get("session_name") or report.get("provider") != provider:
+            continue
+        artifacts = report.get("artifacts") or {}
+        if not isinstance(artifacts, dict):
+            continue
+        if not entry.get("stdout_path") or artifacts.get("stdout_path") != entry["stdout_path"]:
+            continue
+        model = report.get("usage_model")
+        if isinstance(model, str) and not missing_model(model):
+            report_models.append(model)
+    model, error = _single_model(report_models)
+    if model or error:
+        return model, "run_report", error
+
+    if provider not in ("codex", "claude"):
+        return None, None, "no_run_model_evidence"
+    identifier, error = _exact_id(entry, records, provider)
+    if error:
+        return None, None, error
+    path = entry.get("provider_transcript_path")
+    # A preserved path resolved by recency is not proof of conversation identity.
+    if path and not isinstance(path, (str, os.PathLike)):
+        return None, None, "invalid_evidence_path"
+    if not identifier and path and entry.get("provider_transcript_match") == "conversation_id":
+        identifier = os.path.basename(path).removesuffix(".jsonl")
+        if provider == "codex":
+            identifier = identifier[-36:]
+    if not identifier:
+        return None, None, "no_run_conversation_id"
+    if not path:
+        path, error = _exact_transcript(provider, (session or {}).get("authHome"), identifier)
+        if error:
+            return None, None, error
+    elif not _matches_transcript(provider, os.path.basename(path), identifier):
+        return None, None, "transcript_identity_mismatch"
+    transcript, error = _read_records(path)
+    if error:
+        return None, None, error
+    if not transcript:
+        return None, None, "exact_transcript_missing"
+    models = []
+    for record in transcript:
+        recorded_id = record.get("sessionId") if provider == "claude" else None
+        if provider == "codex" and record.get("type") == "session_meta":
+            payload = record.get("payload")
+            if not isinstance(payload, dict):
+                return None, None, "invalid_evidence"
+            recorded_id = payload.get("id")
+        if recorded_id and recorded_id != identifier:
+            return None, None, "transcript_identity_mismatch"
+        if provider == "codex" and record.get("type") == "turn_context":
+            payload = record.get("payload")
+            if not isinstance(payload, dict):
+                return None, None, "invalid_evidence"
+            models.append(payload.get("model"))
+        elif provider == "claude" and record.get("type") == "assistant":
+            message = record.get("message")
+            if not isinstance(message, dict):
+                return None, None, "invalid_evidence"
+            model = message.get("model")
+            if model != "<synthetic>":
+                models.append(model)
+    # Requiring the whole exact conversation to agree is conservative for
+    # resumed runs: mixed conversations stay unknown without turn boundaries.
+    model, error = _single_model(models)
+    return model, "codex_rollout" if provider == "codex" else "claude_transcript", error or (None if model else "no_turn_models")
+
+
+def read_run_reports(base_dir):
+    """Read the preserved registry without refreshing or changing run state."""
+    records, _error = _read_records(registry_path(base_dir))
+    runs = records[0].get("runs", []) if records else []
+    return [run for run in runs if isinstance(run, dict)] if isinstance(runs, list) else []

package/src/run_command.py

@@ -4,7 +4,7 @@ import sys
 from .cli_args import ARG_CODE_INVALID_VALUE
 from .errors import CdxArgumentError, CdxError
 from .provider_runtime import headless_permission_disables_network
-from .run_usage import empty_usage, extract_run_usage
+from .run_usage import empty_usage, extract_run_observation
 
 PROMPT_STDIN = "-"
 
@@ -182,11 +182,11 @@ def run_launch_payload(api_schema_version, parsed, session, artifacts, cwd=None,
 def run_result_payload(api_schema_version, ok, parsed, session, run_info=None,
                        error=None, error_source=None, error_code=None, selection_row=None):
     run_info = run_info or {}
-    usage = run_info.get("usage") if isinstance(run_info.get("usage"), dict) else (
-        extract_run_usage(session.get("provider"), run_info.get("stdout_path"))
-        if session else
-        empty_usage()
-    )
+    usage, usage_model = run_info.get("usage"), run_info.get("usage_model")
+    if not isinstance(usage, dict):
+        usage, usage_model = extract_run_observation(
+            session.get("provider"), run_info.get("stdout_path"), session.get("authHome"),
+        ) if session else (empty_usage(), None)
     message = None if ok else (
         _provider_failure_message(error, run_info, error_code)
         if error_source == "provider"
@@ -221,6 +221,7 @@ def run_result_payload(api_schema_version, ok, parsed, session, run_info=None,
         "stdout_path": run_info.get("stdout_path"),
         "stderr_path": run_info.get("stderr_path"),
         "usage": usage,
+        "usage_model": usage_model,
         "warnings": warnings,
         "error": None if ok else {
             "source": error_source or "cdx",

package/src/run_registry.py

@@ -358,6 +358,7 @@ class RunRegistry:
                 # what `cdx run-status` and `cdx run-report` publish, and it
                 # used to store whichever shape the producing reader emitted.
                 run["usage"] = coerce_usage(final_payload.get("usage"))
+                run["usage_model"] = final_payload.get("usage_model")
                 run["final_payload"] = final_payload
             if error:
                 run["error"] = error

package/src/run_usage.py

@@ -413,7 +413,7 @@ def extract_run_usage(provider, stdout_path):
     return extract_run_observation(provider, stdout_path)[0]
 
 
-def extract_run_observation(provider, stdout_path):
+def extract_run_observation(provider, stdout_path, auth_home=None):
     if not stdout_path or not provider:
         return empty_usage(), None
     if provider not in SUPPORTED_PROVIDERS:
@@ -444,9 +444,46 @@ def extract_run_observation(provider, stdout_path):
         model_usage = record.get("modelUsage")
         if isinstance(model_usage, dict):
             models.update(model_usage)
+    if provider == "codex" and auth_home:
+        models.update(_codex_run_models(records, auth_home))
     return usage, next(iter(models)) if len(models) == 1 else None
 
 
+def _codex_run_models(records, auth_home):
+    # Exec's token totals belong to this run; a rollout's totals may include
+    # earlier turns. Read only model evidence from the exact thread's rollout.
+    from .interactive_usage import MAX_TRANSCRIPT_BYTES, conversation_transcript
+
+    thread_ids = {record.get("thread_id") for record in records
+                  if isinstance(record, dict) and record.get("type") == "thread.started"
+                  and isinstance(record.get("thread_id"), str) and record["thread_id"]}
+    if len(thread_ids) != 1:
+        return set()
+    path = conversation_transcript("codex", auth_home, next(iter(thread_ids)))
+    if not path:
+        return set()
+    models = set()
+    try:
+        with open(path, encoding="utf-8", errors="replace") as handle:
+            text = handle.read(MAX_TRANSCRIPT_BYTES + 1)
+            if len(text) > MAX_TRANSCRIPT_BYTES:
+                return set()
+            for line in text.splitlines():
+                try:
+                    record = json.loads(line)
+                except ValueError:
+                    continue
+                if not isinstance(record, dict) or record.get("type") != "turn_context":
+                    continue
+                payload = record.get("payload")
+                model = payload.get("model") if isinstance(payload, dict) else None
+                if isinstance(model, str) and model:
+                    models.add(model)
+    except OSError:
+        return set()
+    return models
+
+
 def _parse_json_records(text):
     stripped = text.strip()
     try:

package/src/session_service.py

@@ -765,6 +765,18 @@ def backfill_interactive_usage(store, name=None, dry_run=True):
     return store["backfill_launch_usage"](updates, dry_run=dry_run)
 
 
+def backfill_history_models(store, base_dir, dry_run=True):
+    """Recover historical models from evidence belonging to each history row."""
+    from .history_models import read_run_reports, recover_model
+
+    sessions = {session["name"]: session for session in store["list_sessions"]()}
+    reports = read_run_reports(base_dir)
+    return store["backfill_launch_models"](
+        lambda entry: recover_model(entry, sessions.get(entry.get("session_name")), reports),
+        dry_run=dry_run,
+    )
+
+
 def refresh_interactive_usage_models(store, dry_run=True):
     """Replace a placeholder model with the exact transcript's real model."""
     from .interactive_usage import MATCH_CONVERSATION_ID, extract_interactive_usage
@@ -997,6 +1009,7 @@ def create_session_service(options=None):
         "drop_unvouched_usage": store["drop_unvouched_usage"],
         "backfill_interactive_usage": partial(backfill_interactive_usage, store),
         "refresh_interactive_usage_models": partial(refresh_interactive_usage_models, store),
+        "backfill_history_models": partial(backfill_history_models, store, base_dir),
         "update_auth_state": partial(update_auth_state, store),
         "get_status_row": partial(get_status_row, store, base_dir, env, fetch_codex_status),
         "get_status_rows": partial(get_status_rows, store, base_dir, env, fetch_codex_status),

package/src/session_store.py

@@ -343,6 +343,58 @@ def create_session_store(base_dir):
                 _fsync_directory(state_dir)
             return {"scanned": scanned, "backfilled": backfilled, "dry_run": dry_run}
 
+    def backfill_launch_models(resolve, dry_run=True):
+        """Correct only missing models, under the history lock, with a backup."""
+        import uuid
+
+        from .history_models import EVIDENCE_KINDS, missing_model
+
+        result = {"dry_run": dry_run, "scanned": 0, "candidates": 0,
+                  "recoverable": dict.fromkeys(EVIDENCE_KINDS, 0), "still_unknown": 0,
+                  "backfilled": 0, "backup_path": None, "unknown_reasons": {}, "samples": []}
+        with _file_lock(lock_file):
+            try:
+                with open(launch_history_file, "rb") as handle:
+                    original = handle.read()
+            except FileNotFoundError:
+                return result
+            rewritten = []
+            for line in original.splitlines(keepends=True):
+                try:
+                    entry = json.loads(line)
+                except (ValueError, UnicodeError):
+                    rewritten.append(line)
+                    continue
+                if not isinstance(entry, dict):
+                    rewritten.append(line)
+                    continue
+                result["scanned"] += 1
+                if entry.get("usage") and missing_model(entry.get("usage_model")):
+                    result["candidates"] += 1
+                    model, kind, reason = resolve(entry)
+                    if model:
+                        result["recoverable"][kind] += 1
+                        entry["usage_model"] = model
+                        entry["usage_model_backfilled_reason"] = kind
+                        line = (json.dumps(entry, separators=(",", ":")) + "\n").encode("utf-8")
+                    else:
+                        result["still_unknown"] += 1
+                        reasons = result["unknown_reasons"]
+                        reasons[reason] = reasons.get(reason, 0) + 1
+                    if len(result["samples"]) < 20:
+                        result["samples"].append({"session_name": entry.get("session_name"),
+                                                  "run_id": entry.get("run_id"), "started_at": entry.get("started_at"),
+                                                  "model": model, "evidence": kind, "reason": reason})
+                rewritten.append(line)
+            recovered = sum(result["recoverable"].values())
+            if not dry_run and recovered:
+                backup = f"{launch_history_file}.models-{uuid.uuid4().hex}.bak"
+                atomic_write(backup, original)
+                atomic_write(launch_history_file, b"".join(rewritten))
+                result["backup_path"] = backup
+                result["backfilled"] = recovered
+            return result
+
     def list_launch_history(session_name=None, limit=20):
         with _file_lock(lock_file):
             try:
@@ -380,5 +432,6 @@ def create_session_store(base_dir):
         "append_launch_history": append_launch_history,
         "drop_unvouched_usage": drop_unvouched_usage,
         "backfill_launch_usage": backfill_launch_usage,
+        "backfill_launch_models": backfill_launch_models,
         "list_launch_history": list_launch_history,
     }