cdx-manager 0.24.3 → 0.24.5

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.24.3-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.24.5-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **The right AI coding account, when you need it.** CDX Manager keeps your Codex and Claude accounts in separate profiles, shows which ones have quota, and helps you pick the next usable session from your terminal.
 

package/VERSION

@@ -1 +1 @@
-0.24.3
+0.24.5

package/changelogs/CHANGELOGS_0_24_4.md

@@ -0,0 +1,16 @@
+# CDX Manager 0.24.4
+
+Release date: 2026-10-29
+
+This patch adds explicit recovery of missing serving models in existing run history, using evidence tied to each run. (#59)
+
+## History and statistics
+
+- Add `cdx history backfill-models`, with a read-only preview by default and `--dry-run`, `--apply`, and `--json` options. Recover models from preserved run output, matching run reports, or exact Codex and Claude conversation transcripts. (#59)
+- Keep missing or ambiguous evidence unknown rather than guessing from configured models or the latest conversation. Preserve existing models and token counts; report recovery counts, unknown reasons, and samples. (#59)
+- With `--apply`, back up the original history and replace it atomically under the history lock. Repeated runs leave recovered rows alone. Subsequent statistics can price recovered models when the local price table recognizes them. (#59)
+
+## Maintenance
+
+- Record tray companion checksums for v0.24.3. (`bae6f34b733c91ef44070d25bb86015fa31f71ca`)
+- Record release archive checksums for v0.24.3. (`8a1d4938a11f83cbe2eb8abc324a55b909f72837`)

package/changelogs/CHANGELOGS_0_24_5.md

@@ -0,0 +1,16 @@
+# CDX Manager 0.24.5
+
+Release date: 2026-10-29
+
+This patch adds isolated workspace runs with opt-in network access. (#61)
+
+## Workspace runs
+
+- Add `cdx run --isolate-workspace` for Linux workspace confinement through bubblewrap, exposing the checkout, permitted toolchains, shared caches, and provider authentication while keeping the operator's home and host processes outside the boundary. (#61)
+- Add `--network-access` to enable Codex's workspace-write network setting while retaining its workspace sandbox. (#61)
+- Preserve both options across detached runs and failover, and advertise `workspace_isolation` and `workspace_network` capabilities in `cdx schema`. (#61)
+
+## Maintenance
+
+- Record tray companion checksums for v0.24.4. (`7465b2e8244e90032d1ab8b7ad7af6a26ffe805c`)
+- Record release archive checksums for v0.24.4. (`a0afa21ccc816769fb0aac5883912efd90bf1028`)

package/checksums/release-archives.json

@@ -606,6 +606,28 @@
         "x86_64-pc-windows-msvc": "eecc8f8c46d2ce50e6cf6ec6c48c10a10e165ec7ec0058cfb55c8aa486d17d7b",
         "x86_64-unknown-linux-musl": "4cf3289c5d9d7a540a032a11d27e93093d69ec507e1796a726f429c0670f7bc5"
       }
+    },
+    "v0.24.3": {
+      "github_tarball_sha256": "4dfcc2c6a8f500fca04436ea9a22525827924a8193f79f3f285dfc3025762c42",
+      "github_zip_sha256": "66950a74e2bf8a9a349818a612a50217e10a70b92621bfa414d2d19df00aff61",
+      "tray_assets": {
+        "aarch64-apple-darwin": "3aaf5564a4ec896bd1e2a8400e653661ecdb216dfd87970ee3af69ddf7d088b0",
+        "aarch64-unknown-linux-musl": "2ff0d2272fb5d2d21631df986c050f8196a687fb6381453216d07748ed1b873f",
+        "x86_64-apple-darwin": "db6b646575195365879c7b25d406c0734bdbef7154f25e7f38342cafbf88d74a",
+        "x86_64-pc-windows-msvc": "6da838217c01251b809bac1e188217dcfbb00c2102b901cfda43cf2fc0696aa2",
+        "x86_64-unknown-linux-musl": "c6651dd909d486c2b0bb209e0d813ab044dc7b5ffb1a07078c8ec7a69126e028"
+      }
+    },
+    "v0.24.4": {
+      "github_tarball_sha256": "279d60a1073f56ac1ccc361248c14668e9e018d81dd56e4eb177cb3f4bac4cf6",
+      "github_zip_sha256": "05dd935dc0e8e686a1dce96c0543b91757995a5f49ae2aed1155ddf97916e55d",
+      "tray_assets": {
+        "aarch64-apple-darwin": "9fdcddf98e9723f2af2007f0c0a183644b2200e599c33d354c097e2510a3901b",
+        "aarch64-unknown-linux-musl": "eef61a80c0d1107de9dfb980fb5914d85ec3b0a5d640ff559bf8e7faa4e857bd",
+        "x86_64-apple-darwin": "3296ee96b17442d8a2d8eaee6ceeba90dc498c74168973a6932793fa509afc66",
+        "x86_64-pc-windows-msvc": "1fd621d4ba7175c868c4e598850c5f5ccd914c91aaef3d79024376082e8fe81d",
+        "x86_64-unknown-linux-musl": "f4c3a6e7c2af75cd8214609971fe2cbef6f34e818796d70b661d9a9f7e9327af"
+      }
     }
   }
 }

package/docs/cli.md

@@ -28,6 +28,7 @@
 | `cdx set <name>\|--sessions all\|a,b\|--provider PROVIDER [--power minimal\|low\|medium\|high\|xhigh] [--permission review\|default\|auto\|full] [--fast on\|off] [--rtk on\|off] [--logics on\|off] [--notify on\|off] [--agent-state on\|off] [--notify-preview on\|off] [--scrub-env on\|off] [--shared-memory on\|off] [--retro on\|off] [--policy use\|ask-first\|never] [--model MODEL] [--fallback-model MODEL[,MODEL...]] [--budget USD] [--extra-args 'ARGS'] [--priority 0..100] [--json]` | Persist launch settings for one or more sessions |
 | `cdx unset <name>\|--sessions all\|a,b\|--provider PROVIDER (--power\|--reasoning-effort\|--permission\|--fast\|--rtk\|--logics\|--notify\|--agent-state\|--notify-preview\|--scrub-env\|--shared-memory\|--retro\|--policy\|--model\|--fallback-model\|--budget\|--extra-args\|--priority\|--all) [--json]` | Remove persisted launch settings and fall back to provider defaults |
 | `cdx history [name] [--limit N] [--summary] [--since 7d\|today\|DATE] [--from DATE] [--to DATE] [--json]` | Show recent launch history or aggregate total launch time per assistant, optionally filtered by period |
+| `cdx history backfill-models [--dry-run \| --apply] [--json]` | Recover missing historical usage models from evidence tied to each run; defaults to a read-only preview |
 | `cdx last [--json]` | Launch the most recent existing session from launch history |
 | `cdx resume <name> [--conversation <id>] [--json]` | Resume the provider-native conversation for a session using the named command form; `--conversation` reopens that exact conversation and refuses with `conversation_not_found` if the profile has no such transcript |
 | `cdx can-resume <name> [--conversation <id>] [--json]` | Check whether a session supports native resume without launching the provider; `--conversation` checks that exact conversation and reports `resumable: false` with `conversation_not_found` instead of falling back to the most recent one |
@@ -269,7 +270,19 @@ The figure uses standard public list prices, excluding Fast/priority, Batch/Flex
 
 `cdx stats` counts completed history attempts. A headless failover has one logical run in `cdx runs` but one history row per attempted session, including failed attempts that reported usage. Period filtering includes the entire run in every period it overlaps, so adjacent daily results can both include a run crossing midnight; adding daily totals may exceed a combined period. JSON `accounting` names this policy and the current price-table source. `usage_runs` and `priced_runs` show how much of the token total has a dollar estimate. Live runs are absent until their history row is written, and unknown usage is different from measured zero.
 
-Completed run JSON and registry reports expose `usage_model` separately from the requested `model`. Pricing uses the observed model from provider output; Codex can also supply it through the exact rollout identified by `thread.started.thread_id`. Configured defaults alone never establish serving-model identity, and missing or mixed model evidence stays unpriced. `--by model` groups Claude's `[1m]` context variant with its base model while preserving the original model string and per-run pricing. These changes apply to newly recorded runs; existing history is not rewritten.
+Completed run JSON and registry reports expose `usage_model` separately from the requested `model`. Pricing uses the observed model from provider output; Codex can also supply it through the exact rollout identified by `thread.started.thread_id`. Configured defaults alone never establish serving-model identity, and missing or mixed model evidence stays unpriced. `--by model` groups Claude's `[1m]` context variant with its base model while preserving the original model string and per-run pricing. New runs record this evidence automatically. To recover missing models in existing history, run:
+
+```bash
+cdx history backfill-models                  # Preview only (the default)
+cdx history backfill-models --dry-run --json # Machine-readable preview
+cdx history backfill-models --apply          # Save proven models with a backup
+```
+
+The command considers only history rows with usage and an empty or placeholder `usage_model`. Evidence is checked in order: the row's preserved JSON/JSONL stdout, a preserved run-registry report with the same run id, profile, provider and stdout path, then the exact Codex thread rollout or Claude session transcript. Thread/session ids must come from the row or its stdout, or from a preserved transcript path recorded as an exact conversation-id match. The current profile is used only to locate an exact transcript under its auth home; its configured model and latest conversation/transcript never establish a historical model. The requested `model` in a report is also ignored.
+
+Only one serving model is accepted. Claude `[1m]` variants count as the same model for this check and for stats grouping; the observed spelling is preserved. Mixed models, incomplete turn models, malformed or oversized evidence, conflicting identities and missing exact transcripts stay unknown. For resumed conversations, the conservative rule is that all recorded turns in the exact transcript must agree: this command does not infer historical turn boundaries. Ambiguous higher-priority evidence stops recovery rather than being overridden by a lower-priority source. Missing files may fall through to the next source.
+
+Text and JSON output include counts by evidence kind, counts of unknown reasons and up to 20 samples. Dry-run leaves history and run reports unchanged. `--apply` changes only missing models and their evidence annotation, preserving token counts and unrelated history bytes. It holds the history lock, saves the original bytes to a unique `state/launch_history.jsonl.models-<id>.bak` file, then atomically replaces history. The backup path is printed; a repeated apply leaves already recovered rows alone. `--apply` and `--dry-run` cannot be combined. Subsequent `cdx stats` calls price recovered models when the local price table knows them; unknown models remain unpriced.
 
 The built-in price table ships with **cdx-manager**. Run `cdx update` to receive new model prices; updating Codex or Claude alone does not refresh it. Then check `cdx --version` and `cdx stats --json`. Existing runs with a recorded model are recalculated using the new table when stats are read. `CDX_TOKEN_PRICES` overrides still take precedence. Maintainers: follow [the model and pricing update runbook](https://github.com/AlexAgo83/cdx-manager/blob/main/logics/runbook/run_005_maintaining_the_token_price_table.md) for source checks, tests, release preparation and installed-version verification.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.24.3",
+  "version": "0.24.5",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.24.3"
+version = "0.24.5"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/cli_args.py

@@ -47,7 +47,7 @@ CAN_RESUME_USAGE = "Usage: cdx can-resume <name> [--conversation <id>] [--json]"
 SESSIONS_USAGE = "Usage: cdx sessions [--all] --json"
 SELECT_USAGE = "Usage: cdx select --provider PROVIDER [--min-reasoning-effort minimal|low|medium|high|xhigh] [--min-power minimal|low|medium|high|xhigh] [--require-ready] [--refresh] --json"
 NEXT_USAGE = "Usage: cdx next [--json] [--refresh]"
-RUN_USAGE = "Usage: cdx run [session] (--cwd|--dir) PATH (--prompt-file PATH|--prompt TEXT|--prompt-file -) [--provider PROVIDER] [--model MODEL] [--kind assistant|code-review|retro] [--reasoning-effort minimal|low|medium|high|xhigh] [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full|workspace-write|read-only|danger-full-access] [--timeout-seconds N] [--label TEXT] [--max-parallel N] [--detach] [--failover] [--refresh] --json"
+RUN_USAGE = "Usage: cdx run [session] (--cwd|--dir) PATH (--prompt-file PATH|--prompt TEXT|--prompt-file -) [--provider PROVIDER] [--model MODEL] [--kind assistant|code-review|retro] [--reasoning-effort minimal|low|medium|high|xhigh] [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full|workspace-write|read-only|danger-full-access] [--network-access] [--isolate-workspace] [--timeout-seconds N] [--label TEXT] [--max-parallel N] [--detach] [--failover] [--refresh] --json"
 RUN_JSON_REQUIRED = "cdx run: --json is required."
 RUN_TARGET_REQUIRED = "cdx run: specify a session name or --provider PROVIDER."
 RUN_SESSION_PROVIDER_CONFLICT = "cdx run: cannot specify both a session name and --provider."
@@ -475,6 +475,7 @@ def cdx_schema():
     # No `schema_version` here: the JSON envelope already carries it, and two
     # keys of that name in one payload would be one too many.
     return {
+        "capabilities": {"workspace_isolation": 1, "workspace_network": 1},
         "enums": {
             "permission": {
                 "accepted": list(RUN_PERMISSION_VALUES),
@@ -665,6 +666,8 @@ def _parse_run_args(args):
         "--permission": {"key": "permission", "type": "str", "default": None, "transform": _normalize_run_permission},
         "--timeout-seconds": {"key": "timeout_seconds", "type": "str", "default": None, "transform": _parse_run_timeout_seconds},
         "--detach": {"key": "detach", "type": "bool", "default": False},
+        "--network-access": {"key": "network_access", "type": "bool", "default": False},
+        "--isolate-workspace": {"key": "isolate_workspace", "type": "bool", "default": False},
         "--failover": {"key": "failover", "type": "bool", "default": False},
         "--refresh": {"key": "refresh", "type": "bool", "default": False},
         "--label": {"key": "label", "type": "str", "default": None},
@@ -716,6 +719,8 @@ def _parse_run_args(args):
         "permission": parsed["permission"],
         "timeout_seconds": parsed["timeout_seconds"],
         "detach": parsed["detach"],
+        "network_access": parsed["network_access"],
+        "isolate_workspace": parsed["isolate_workspace"],
         "failover": parsed["failover"],
         "label": parsed["label"],
         "max_parallel": parsed["max_parallel"],

package/src/commands/runs.py

@@ -206,8 +206,9 @@ def _detached_child_argv(parsed, prompt_path, session_name, cwd):
         argv += ["--timeout-seconds", str(parsed["timeout_seconds"])]
     # The child is the supervisor: it watches the run like any blocking one, so
     # it applies the failover rule and records each move in the registry.
-    if parsed.get("failover"):
-        argv.append("--failover")
+    for key in ("network_access", "isolate_workspace", "failover"):
+        if parsed.get(key):
+            argv.append("--" + key.replace("_", "-"))
     argv.append("--json")
     return argv
 
@@ -572,7 +573,7 @@ def handle_run(rest, ctx):
             raise CdxError(f"Invalid cwd: {parsed['cwd']}", code="invalid_cwd")
         prompt = read_run_prompt(parsed, stdin=ctx.get("prompt_stdin"))
         _consume_detached_prompt_file(parsed, detached_run_id)
-        launch_updates = {}
+        launch_updates = {key: parsed.get(key, False) for key in ("network_access", "isolate_workspace")}
         if parsed.get("model"):
             launch_updates["model"] = parsed["model"]
         if parsed.get("permission"):
@@ -643,7 +644,7 @@ def handle_run(rest, ctx):
             launch = None
             # A provider's own background agent has no cdx process watching it,
             # so nothing could fail it over; --failover keeps the in-house child.
-            if not parsed.get("failover") and supports_native_background(
+            if not parsed.get("isolate_workspace") and not parsed.get("network_access") and not parsed.get("failover") and supports_native_background(
                 run_session.get("provider"),
                 env=ctx.get("env"),
                 spawn_sync=ctx.get("spawn_text"),

package/src/commands/status.py

@@ -602,6 +602,30 @@ def handle_configs(rest, ctx):
     return 0
 
 def handle_history(rest, ctx):
+    if rest and rest[0] == "backfill-models":
+        usage = "Usage: cdx history backfill-models [--dry-run | --apply] [--json]"
+        parsed = _parse_flag_args(rest[1:], {
+            "--dry-run": {"key": "dry_run", "type": "bool", "default": False},
+            "--apply": {"key": "apply", "type": "bool", "default": False},
+            "--json": {"key": "json", "type": "bool", "default": False},
+        }, usage)
+        if parsed["apply"] and parsed["dry_run"]:
+            raise CdxError(usage)
+        result = ctx["service"]["backfill_history_models"](dry_run=not parsed["apply"])
+        if parsed["json"]:
+            _write_json(ctx, _json_success("history", "Backfilled history models", **result))
+        else:
+            mode = "Dry run" if result["dry_run"] else "Applied"
+            ctx["out"](f"{mode}: {result['candidates']} missing models; {result['still_unknown']} still unknown; {result['backfilled']} written.\n")
+            for kind, count in result["recoverable"].items():
+                ctx["out"](f"Recoverable from {kind}: {count}\n")
+            for reason, count in result["unknown_reasons"].items():
+                ctx["out"](f"Unknown ({reason}): {count}\n")
+            for sample in result["samples"]:
+                ctx["out"](f"  {sample['session_name']} {sample['run_id'] or sample['started_at']}: {sample['model'] or sample['reason']} ({sample['evidence'] or 'no evidence'})\n")
+            if result["backup_path"]:
+                ctx["out"](f"Backup: {result['backup_path']}\n")
+        return 0
     now_fn = ctx["options"].get("now") or time.time
     now = datetime.fromtimestamp(now_fn()).astimezone()
     parsed = _parse_history_args(rest, now=now)

package/src/history_models.py

@@ -0,0 +1,201 @@
+"""Recover serving models using only evidence attached to a history row."""
+
+import json
+import os
+import time
+
+from .interactive_usage import MAX_TRANSCRIPT_BYTES, MAX_TRANSCRIPT_SCAN_SECONDS
+from .run_registry import registry_path
+
+EVIDENCE_KINDS = ("stdout", "run_report", "codex_rollout", "claude_transcript")
+
+
+def missing_model(value):
+    return not value or (isinstance(value, str) and value.startswith("<"))
+
+
+def _read_records(path):
+    if not path:
+        return [], None
+    if not isinstance(path, (str, os.PathLike)):
+        return [], "invalid_evidence_path"
+    try:
+        with open(path, "rb") as handle:
+            raw = handle.read(MAX_TRANSCRIPT_BYTES + 1)
+        if len(raw) > MAX_TRANSCRIPT_BYTES:
+            return [], "evidence_too_large"
+        text = raw.decode("utf-8")
+        try:
+            records = [json.loads(text)]
+        except ValueError:
+            records = [json.loads(line) for line in text.splitlines() if line.strip()]
+        if not all(isinstance(record, dict) for record in records):
+            return [], "invalid_evidence"
+        return records, None
+    except FileNotFoundError:
+        return [], None
+    except (OSError, UnicodeError, ValueError):
+        return [], "unreadable_evidence"
+
+
+def _single_model(models):
+    if any(not isinstance(model, str) or missing_model(model) for model in models):
+        return None, "incomplete_model_evidence"
+    # Context size variants already share a model group in stats.
+    groups = {model.removesuffix("[1m]") if model.startswith("claude-") else model for model in models}
+    if len(groups) > 1:
+        return None, "ambiguous_models"
+    return (models[0], None) if models else (None, None)
+
+
+def _stdout_models(records):
+    models = []
+    for record in records:
+        if record.get("launcher") == "cdx" or record.get("action") == "run":
+            if not missing_model(record.get("usage_model")):
+                models.append(record["usage_model"])
+            continue
+        message = record.get("message")
+        if isinstance(message, dict) and message.get("model") == "<synthetic>":
+            continue
+        if isinstance(message, dict) and (message.get("role") == "assistant" or record.get("type") == "assistant"):
+            models.append(message.get("model"))
+        elif "model" in record and ("usage" in record or record.get("type") == "result"):
+            models.append(record["model"])
+        model_usage = record.get("modelUsage")
+        if isinstance(model_usage, dict):
+            models.extend(model_usage)
+    return models
+
+
+def _exact_id(entry, records, provider):
+    key = "thread_id" if provider == "codex" else "session_id"
+    identifiers = {record[key] for record in records if isinstance(record.get(key), str) and record[key]}
+    for identifier in (entry.get(key), entry.get("conversation_id")):
+        if identifier:
+            if not isinstance(identifier, str):
+                return None, "invalid_conversation_id"
+            identifiers.add(identifier)
+    if len(identifiers) > 1:
+        return None, "ambiguous_conversation_ids"
+    return next(iter(identifiers), None), None
+
+
+def _matches_transcript(provider, name, identifier):
+    if provider == "codex":
+        return name.startswith("rollout-") and name.endswith(f"-{identifier}.jsonl")
+    return name == f"{identifier}.jsonl"
+
+
+def _exact_transcript(provider, auth_home, identifier):
+    if not auth_home:
+        return None, None
+    root = os.path.join(auth_home, "sessions") if provider == "codex" else os.path.join(auth_home, ".claude", "projects")
+    paths = []
+    deadline = time.monotonic() + MAX_TRANSCRIPT_SCAN_SECONDS
+    for directory, subdirs, names in os.walk(root):
+        if time.monotonic() > deadline:
+            return None, "transcript_scan_limit"
+        subdirs[:] = [name for name in subdirs if name != "subagents"]
+        for name in names:
+            if _matches_transcript(provider, name, identifier):
+                paths.append(os.path.join(directory, name))
+                if len(paths) > 1:
+                    return None, "multiple_exact_transcripts"
+    return next(iter(paths), None), None
+
+
+def recover_model(entry, session=None, reports=()):
+    """Return (model, evidence kind, reason); never consult live model settings."""
+    provider = entry.get("provider")
+    records, error = _read_records(entry.get("stdout_path"))
+    if error:
+        return None, None, error
+    for record in records:
+        if record.get("launcher") == "cdx" or record.get("action") == "run":
+            if (not entry.get("run_id") or record.get("run_id") != entry["run_id"]
+                    or record.get("session") != entry.get("session_name") or record.get("provider") != provider):
+                return None, None, "report_identity_mismatch"
+    model, error = _single_model(_stdout_models(records))
+    if model or error:
+        return model, "stdout", error
+
+    # A logical run may fail over across profiles. Its final report does not
+    # prove the model used by an earlier attempt with the same run id.
+    report_models = []
+    for report in reports:
+        if not entry.get("run_id") or report.get("run_id") != entry["run_id"]:
+            continue
+        if report.get("session") != entry.get("session_name") or report.get("provider") != provider:
+            continue
+        artifacts = report.get("artifacts") or {}
+        if not isinstance(artifacts, dict):
+            continue
+        if not entry.get("stdout_path") or artifacts.get("stdout_path") != entry["stdout_path"]:
+            continue
+        model = report.get("usage_model")
+        if isinstance(model, str) and not missing_model(model):
+            report_models.append(model)
+    model, error = _single_model(report_models)
+    if model or error:
+        return model, "run_report", error
+
+    if provider not in ("codex", "claude"):
+        return None, None, "no_run_model_evidence"
+    identifier, error = _exact_id(entry, records, provider)
+    if error:
+        return None, None, error
+    path = entry.get("provider_transcript_path")
+    # A preserved path resolved by recency is not proof of conversation identity.
+    if path and not isinstance(path, (str, os.PathLike)):
+        return None, None, "invalid_evidence_path"
+    if not identifier and path and entry.get("provider_transcript_match") == "conversation_id":
+        identifier = os.path.basename(path).removesuffix(".jsonl")
+        if provider == "codex":
+            identifier = identifier[-36:]
+    if not identifier:
+        return None, None, "no_run_conversation_id"
+    if not path:
+        path, error = _exact_transcript(provider, (session or {}).get("authHome"), identifier)
+        if error:
+            return None, None, error
+    elif not _matches_transcript(provider, os.path.basename(path), identifier):
+        return None, None, "transcript_identity_mismatch"
+    transcript, error = _read_records(path)
+    if error:
+        return None, None, error
+    if not transcript:
+        return None, None, "exact_transcript_missing"
+    models = []
+    for record in transcript:
+        recorded_id = record.get("sessionId") if provider == "claude" else None
+        if provider == "codex" and record.get("type") == "session_meta":
+            payload = record.get("payload")
+            if not isinstance(payload, dict):
+                return None, None, "invalid_evidence"
+            recorded_id = payload.get("id")
+        if recorded_id and recorded_id != identifier:
+            return None, None, "transcript_identity_mismatch"
+        if provider == "codex" and record.get("type") == "turn_context":
+            payload = record.get("payload")
+            if not isinstance(payload, dict):
+                return None, None, "invalid_evidence"
+            models.append(payload.get("model"))
+        elif provider == "claude" and record.get("type") == "assistant":
+            message = record.get("message")
+            if not isinstance(message, dict):
+                return None, None, "invalid_evidence"
+            model = message.get("model")
+            if model != "<synthetic>":
+                models.append(model)
+    # Requiring the whole exact conversation to agree is conservative for
+    # resumed runs: mixed conversations stay unknown without turn boundaries.
+    model, error = _single_model(models)
+    return model, "codex_rollout" if provider == "codex" else "claude_transcript", error or (None if model else "no_turn_models")
+
+
+def read_run_reports(base_dir):
+    """Read the preserved registry without refreshing or changing run state."""
+    records, _error = _read_records(registry_path(base_dir))
+    runs = records[0].get("runs", []) if records else []
+    return [run for run in runs if isinstance(run, dict)] if isinstance(runs, list) else []

package/src/provider_runtime.py

@@ -1210,6 +1210,33 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
         env_override=env_override,
         initial_prompt=initial_prompt,
     )
+    launch = session.get("launch") or {}
+    if launch.get("network_access"):
+        if session.get("provider") == PROVIDER_CODEX:
+            # Keep the workspace sandbox; append overrides before the prompt separator.
+            index = spec["args"].index("--") if "--" in spec["args"] else len(spec["args"])
+            spec["args"][index:index] = ["-c", 'sandbox_workspace_write.network_access=true', '-c', 'sandbox_workspace_write.writable_roots=["/cache", "/home/agent"]']
+        elif session.get("provider") != PROVIDER_CLAUDE:
+            raise CdxError("Network override is unsupported for this provider")
+    if launch.get("isolate_workspace"):
+        from pathlib import Path
+
+        from .workspace_sandbox import sandbox_command
+        if session.get("provider") == PROVIDER_CLAUDE:
+            # The outer OS sandbox is the permission boundary for unattended Bash.
+            index = spec["args"].index("--") if "--" in spec["args"] else len(spec["args"])
+            spec["args"][index:index] = ["--permission-mode", "bypassPermissions"]
+        try:
+            argv, child_env = sandbox_command(
+                [spec["command"], *spec["args"]], Path(cwd),
+                network=launch.get("network_access", False),
+                writable=launch.get("permission") != "review",
+                source=spec["options"]["env"], auth_home=_get_auth_home(session),
+                provider=session.get("provider"))
+        except (OSError, RuntimeError) as error:
+            raise CdxError(str(error)) from error
+        spec.update(command=argv[0], args=argv[1:])
+        spec["options"]["env"] = child_env
     paths = _headless_artifact_paths(session, run_id=run_id)
     start_time = datetime.now(timezone.utc)
     command = spec["command"]

package/src/run_command.py

@@ -133,7 +133,7 @@ def run_warnings(parsed, session, selection_row=None):
         })
     provider = session.get("provider") if session else parsed.get("provider")
     permission = run_effective_permission(parsed, session)
-    if headless_permission_disables_network(provider, permission):
+    if not parsed.get("network_access") and headless_permission_disables_network(provider, permission):
         described = repr(permission) if permission else "its default (none set)"
         warnings.append({
             "code": "network_disabled_by_permission",

package/src/session_service.py

@@ -765,6 +765,18 @@ def backfill_interactive_usage(store, name=None, dry_run=True):
     return store["backfill_launch_usage"](updates, dry_run=dry_run)
 
 
+def backfill_history_models(store, base_dir, dry_run=True):
+    """Recover historical models from evidence belonging to each history row."""
+    from .history_models import read_run_reports, recover_model
+
+    sessions = {session["name"]: session for session in store["list_sessions"]()}
+    reports = read_run_reports(base_dir)
+    return store["backfill_launch_models"](
+        lambda entry: recover_model(entry, sessions.get(entry.get("session_name")), reports),
+        dry_run=dry_run,
+    )
+
+
 def refresh_interactive_usage_models(store, dry_run=True):
     """Replace a placeholder model with the exact transcript's real model."""
     from .interactive_usage import MATCH_CONVERSATION_ID, extract_interactive_usage
@@ -997,6 +1009,7 @@ def create_session_service(options=None):
         "drop_unvouched_usage": store["drop_unvouched_usage"],
         "backfill_interactive_usage": partial(backfill_interactive_usage, store),
         "refresh_interactive_usage_models": partial(refresh_interactive_usage_models, store),
+        "backfill_history_models": partial(backfill_history_models, store, base_dir),
         "update_auth_state": partial(update_auth_state, store),
         "get_status_row": partial(get_status_row, store, base_dir, env, fetch_codex_status),
         "get_status_rows": partial(get_status_rows, store, base_dir, env, fetch_codex_status),

package/src/session_store.py

@@ -343,6 +343,58 @@ def create_session_store(base_dir):
                 _fsync_directory(state_dir)
             return {"scanned": scanned, "backfilled": backfilled, "dry_run": dry_run}
 
+    def backfill_launch_models(resolve, dry_run=True):
+        """Correct only missing models, under the history lock, with a backup."""
+        import uuid
+
+        from .history_models import EVIDENCE_KINDS, missing_model
+
+        result = {"dry_run": dry_run, "scanned": 0, "candidates": 0,
+                  "recoverable": dict.fromkeys(EVIDENCE_KINDS, 0), "still_unknown": 0,
+                  "backfilled": 0, "backup_path": None, "unknown_reasons": {}, "samples": []}
+        with _file_lock(lock_file):
+            try:
+                with open(launch_history_file, "rb") as handle:
+                    original = handle.read()
+            except FileNotFoundError:
+                return result
+            rewritten = []
+            for line in original.splitlines(keepends=True):
+                try:
+                    entry = json.loads(line)
+                except (ValueError, UnicodeError):
+                    rewritten.append(line)
+                    continue
+                if not isinstance(entry, dict):
+                    rewritten.append(line)
+                    continue
+                result["scanned"] += 1
+                if entry.get("usage") and missing_model(entry.get("usage_model")):
+                    result["candidates"] += 1
+                    model, kind, reason = resolve(entry)
+                    if model:
+                        result["recoverable"][kind] += 1
+                        entry["usage_model"] = model
+                        entry["usage_model_backfilled_reason"] = kind
+                        line = (json.dumps(entry, separators=(",", ":")) + "\n").encode("utf-8")
+                    else:
+                        result["still_unknown"] += 1
+                        reasons = result["unknown_reasons"]
+                        reasons[reason] = reasons.get(reason, 0) + 1
+                    if len(result["samples"]) < 20:
+                        result["samples"].append({"session_name": entry.get("session_name"),
+                                                  "run_id": entry.get("run_id"), "started_at": entry.get("started_at"),
+                                                  "model": model, "evidence": kind, "reason": reason})
+                rewritten.append(line)
+            recovered = sum(result["recoverable"].values())
+            if not dry_run and recovered:
+                backup = f"{launch_history_file}.models-{uuid.uuid4().hex}.bak"
+                atomic_write(backup, original)
+                atomic_write(launch_history_file, b"".join(rewritten))
+                result["backup_path"] = backup
+                result["backfilled"] = recovered
+            return result
+
     def list_launch_history(session_name=None, limit=20):
         with _file_lock(lock_file):
             try:
@@ -380,5 +432,6 @@ def create_session_store(base_dir):
         "append_launch_history": append_launch_history,
         "drop_unvouched_usage": drop_unvouched_usage,
         "backfill_launch_usage": backfill_launch_usage,
+        "backfill_launch_models": backfill_launch_models,
         "list_launch_history": list_launch_history,
     }

package/src/workspace_sandbox.py

@@ -0,0 +1,94 @@
+"""Linux workspace confinement shared with the cdx-manager integration patch.
+
+Expose tools, caches and one checkout, never the operator's home or host processes.
+Provider authentication is the only credential deliberately passed to the provider.
+"""
+from __future__ import annotations
+
+import os
+import shutil
+from pathlib import Path
+
+CACHE = Path.home() / ".cdx" / "shared-cache"
+
+
+def clean_env(source: dict) -> dict:
+    allowed = ("PATH", "LANG", "LC_ALL", "TERM", "TZ")
+    env = {key: source[key] for key in allowed if key in source}
+    env.update(HOME="/home/agent", XDG_CONFIG_HOME="/home/agent/.config",
+               XDG_CACHE_HOME="/cache", GIT_CONFIG_NOSYSTEM="1",
+               GIT_CONFIG_GLOBAL="/dev/null", GIT_TERMINAL_PROMPT="0", GIT_OPTIONAL_LOCKS="0",
+               GIT_CONFIG_COUNT="1", GIT_CONFIG_KEY_0="credential.helper", GIT_CONFIG_VALUE_0="",
+               GH_CONFIG_DIR="/home/agent/.config/gh", NPM_CONFIG_CACHE="/cache/npm",
+               PIP_CACHE_DIR="/cache/pip", UV_CACHE_DIR="/cache/uv",
+               PLAYWRIGHT_BROWSERS_PATH="/cache/playwright", CI="1")
+    return env
+
+
+def sandbox_command(command: list[str], tree: Path, *, network: bool, writable: bool = True,
+                    source: dict | None = None, auth_home: str = "", provider: str = "") -> tuple[list[str], dict]:
+    source = os.environ if source is None else source
+    binary = shutil.which(command[0], path=source.get("PATH"))
+    bwrap = shutil.which("bwrap", path=source.get("PATH"))
+    if not binary or not bwrap:
+        raise RuntimeError("Workspace isolation requires bubblewrap and " + command[0])
+    if tree.is_symlink() or not tree.is_dir():
+        raise RuntimeError("Workspace must be a directory")
+    tree = tree.resolve()
+    CACHE.mkdir(parents=True, exist_ok=True)
+    args = [bwrap, "--die-with-parent", "--new-session", "--unshare-all", "--cap-drop", "ALL"]
+    # The provider needs transport even when its own tool sandbox denies network.
+    if network or provider:
+        args += ["--share-net"]
+    args += ["--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp", "--dir", "/home/agent"]
+    # An allowlist avoids overlooking another secret file or a credential symlink.
+    paths = [Path(p) for p in ("/usr", "/bin", "/sbin", "/lib", "/lib64")]
+    home = Path.home()
+    paths += [home / ".nvm", home / ".local/bin", home / ".local/share/claude",
+              home / ".local/share/uv"]
+    for path in paths:
+        if path.exists():
+            args += ["--ro-bind", str(path), str(path)]
+    for path in ("/etc/ssl", "/etc/resolv.conf", "/etc/hosts", "/etc/nsswitch.conf", "/etc/ld.so.cache",
+                 "/etc/fonts", "/etc/passwd", "/etc/group", "/etc/alternatives"):
+        if Path(path).exists():
+            args += ["--ro-bind", path, path]
+    # Fail closed for a provider installed outside the explicitly permitted toolchains.
+    resolved = Path(binary).resolve()
+    if not any(resolved.is_relative_to(p.resolve()) for p in paths if p.exists()):
+        raise RuntimeError("Executable is outside the permitted toolchains: " + str(resolved))
+    args += ["--bind", str(CACHE), "/cache", "--bind" if writable else "--ro-bind", str(tree), str(tree)]
+    marker = tree / ".git"
+    if marker.is_file():
+        text = marker.read_text().strip()
+        if marker.is_symlink() or not text.startswith("gitdir: "):
+            raise RuntimeError("Invalid worktree Git marker")
+        gitdir = (tree / text.removeprefix("gitdir: ")).resolve()
+        common = (gitdir / (gitdir / "commondir").read_text().strip()).resolve()
+        # A writable marker must never turn into an arbitrary host-directory mount.
+        if (common.name != ".git" or gitdir.parent != common / "worktrees"
+                or common.is_relative_to(tree) or common.is_relative_to(CACHE.resolve())
+                or Path((gitdir / "gitdir").read_text().strip()).resolve() != marker):
+            raise RuntimeError("Invalid external worktree Git directory")
+        args += ["--ro-bind", str(marker), str(marker), "--ro-bind", str(common), str(common),
+                 "--tmpfs", str(common / "worktrees"), "--ro-bind", str(gitdir), str(gitdir),
+                 "--ro-bind", "/dev/null", str(common / "config"),
+                 "--tmpfs", str(common / "hooks")]
+        if (gitdir / "config.worktree").exists():
+            args += ["--ro-bind", "/dev/null", str(gitdir / "config.worktree")]
+    elif marker.exists():
+        raise RuntimeError("Expected an isolated git worktree")
+    env = clean_env(source)
+    if provider == "codex":
+        env["CODEX_HOME"] = "/home/agent/.codex"
+        args += ["--ro-bind", str(Path(auth_home) / "auth.json"), "/home/agent/.codex/auth.json"]
+    elif provider == "claude":
+        token = source.get("CLAUDE_CODE_OAUTH_TOKEN")
+        if not token:
+            raise RuntimeError("Isolated Claude runs require a cdx OAuth setup token")
+        env.update(CLAUDE_CODE_OAUTH_TOKEN=token, CLAUDE_CODE_SUBPROCESS_ENV_SCRUB="1",
+                   CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1")
+    elif provider:
+        raise RuntimeError("Unsupported isolated provider: " + provider)
+    args += ["--chdir", str(tree), "--", binary, *command[1:]]
+    return args, env