cdx-manager 0.25.1 → 0.25.2

package/src/commands/runs.py

@@ -5,7 +5,6 @@ Split out of cli_commands.py. Moved verbatim; re-exported by cli_commands.
 
 import importlib.util
 import os
-import shutil
 import subprocess
 import sys
 import time
@@ -58,7 +57,7 @@ from ..run_failover import (
     looks_model_at_capacity,
 )
 from ..run_registry import RunRegistry, build_code_review_report, final_message
-from ..run_usage import empty_usage, estimate_cost, extract_run_conversation_id, extract_run_observation, token_prices
+from ..run_usage import cost_fields, empty_usage, estimate_cost, extract_run_conversation_id, extract_run_observation, token_prices
 from ..session_ranking import FACTOR_DESCRIPTIONS, rank_sessions, selection_policy
 from ..status_view import _now_timestamp, _priority_reset_timestamp
 
@@ -204,6 +203,7 @@ def _detached_child_argv(parsed, prompt_path, session_name, cwd):
     # from the package root, so a relative "--cwd ." would resolve there.
     argv = ["run", session_name, "--cwd", cwd, "--prompt-file", prompt_path]
     for flag, key in (
+        ("--project", "project"),
         ("--budget", "budget"),
         ("--continue-run", "continue_run"),
         ("--model", "model"),
@@ -423,6 +423,8 @@ def _reconcile_background_runs(ctx):
                 "run_id": run["run_id"],
                 "attempt": 1,
                 "cwd": run.get("cwd"),
+                "project": run.get("project"),
+                "project_source": run.get("project_source", "unknown"),
                 "usage": outcome["usage"],
                 "usage_model": outcome["usage_model"],
             })
@@ -544,9 +546,19 @@ def _env_max_runs(ctx):
 
 
 def _observe_headless_usage(session, run_info, baseline=None):
-    usage, model = extract_run_observation(session.get("provider"), run_info.get("stdout_path"), session.get("authHome"))
-    observation = {"usage": usage, "usage_model": model}
-    if baseline is not None:
+    isolated = (session.get("launch") or {}).get("isolate_workspace")
+    evidence = run_info.get("usage_evidence")
+    observed_models = []
+    usage, model = extract_run_observation(session.get("provider"), run_info.get("stdout_path"),
+                                          None if isolated else session.get("authHome"), evidence=evidence, models_out=observed_models)
+    raw_measured = usage.get("total_tokens") is not None
+    observation = {"usage": usage, "usage_model": model, "usage_models": observed_models}
+    if evidence is not None:
+        observation["usage_evidence"] = evidence
+    if baseline is not None and isolated:
+        observation.update(usage=empty_usage(), usage_model=None, usage_attribution="continuation_usage_unavailable",
+                           measurement_unavailable=raw_measured)
+    elif baseline is not None:
         cumulative, path, match, transcript_model = extract_interactive_usage(
             session["provider"], session.get("authHome"), conversation_id=(session.get("conversation") or {}).get("id"))
         before, before_path, _before_match, _before_model = baseline
@@ -559,13 +571,18 @@ def _observe_headless_usage(session, run_info, baseline=None):
         # establish this run's share; stdout cannot replace a missing boundary.
         observation.update(usage=delta if delta is not None else empty_usage(), usage_cumulative=cumulative,
                            usage_attribution="launch_boundary" if delta is not None else "continuation_usage_unavailable",
+                           measurement_unavailable=delta is None and bool(raw_measured or (cumulative and cumulative.get("total_tokens") is not None)),
                            provider_transcript_path=path, provider_transcript_match=match,
-                           usage_model=model or transcript_model)
+                           usage_model=model if session.get("provider") == "codex" else model or transcript_model)
+    observation.update(cost_fields(observation["usage"], observation["usage_model"],
+                                   models=observed_models, attribution=observation.get("usage_attribution")))
     return observation
 
 
 def _budget_observation(session, paths, baseline):
     observation = _observe_headless_usage(session, paths, baseline if session["provider"] == "codex" else None)
+    if (session.get("launch") or {}).get("isolate_workspace"):
+        return observation
     identifier = (extract_run_conversation_id(session["provider"], paths.get("stdout_path"))
                   or ((session.get("conversation") or {}).get("id")
                       if session["provider"] == "claude" or session.get("continue_run") else None))
@@ -580,8 +597,14 @@ def _budget_observation(session, paths, baseline):
         comparable = (before and path == before_path
                       and all((usage.get(key) is None) == (before.get(key) is None) for key in MEASURED_KEYS))
         usage = usage_delta(usage, before, provider=session["provider"]) if comparable else None
+    if usage is not None and session["provider"] == "codex":
+        from ..run_usage import _codex_run_models
+        models = _codex_run_models([{"type": "thread.started", "thread_id": identifier}], session.get("authHome"))
+        model = next(iter(models)) if len(models) == 1 else None
     if usage is not None:
-        return {**observation, "usage": usage, "usage_model": model, "provider_transcript_path": path,
+        observed_models = sorted(models) if session["provider"] == "codex" else [model] if model else []
+        return {**observation, "usage": usage, "usage_model": model, "usage_models": observed_models,
+                **cost_fields(usage, model, models=observed_models), "provider_transcript_path": path,
                 "provider_transcript_match": match}
     return observation
 
@@ -629,6 +652,12 @@ def _continue_run_session(parsed, ctx):
             if arg.split("=", 1)[0] in pinned_options or arg.startswith(("-r", "-c")):
                 raise CdxError("--continue-run cannot use Claude extra_args that override model, effort, or conversation.",
                                code="continue_run_settings_mismatch")
+    from ..project_identity import recorded_project
+
+    project = recorded_project(previous)
+    if parsed.get("project") and parsed["project"] != project:
+        raise CdxError("--continue-run requires the previous run's recorded project.")
+    parsed["continued_project"] = {"project": project, "project_source": previous.get("project_source", "unknown")}
     parsed.update(name=name, model=model, reasoning_effort=effort, power=effort)
     launch = {**(session.get("launch") or {}), "model": model, "reasoning_effort": effort, "power": effort}
     # A provider fallback would break the model pin even though cdx stayed on this profile.
@@ -684,6 +713,14 @@ def handle_run(rest, ctx):
         cwd = os.path.abspath(parsed["cwd"])
         if not os.path.isdir(cwd):
             raise CdxError(f"Invalid cwd: {parsed['cwd']}", code="invalid_cwd")
+        from ..project_identity import resolve_project
+
+        project = parsed.get("continued_project") or resolve_project(cwd, parsed.get("project"))
+        if detached_run_id:
+            previous = _run_registry(ctx).get(detached_run_id)
+            if previous:
+                project = {"project": previous.get("project"), "project_source": previous.get("project_source", "unknown")}
+        parsed.update(project)
         prompt = read_run_prompt(parsed, stdin=ctx.get("prompt_stdin"))
         _consume_detached_prompt_file(parsed, detached_run_id)
         launch_updates = {key: parsed.get(key, False) for key in ("network_access", "isolate_workspace")}
@@ -743,6 +780,7 @@ def handle_run(rest, ctx):
             provider=run_session.get("provider"),
             model=parsed.get("model") or ((run_session.get("launch") or {}).get("model")),
             cwd=cwd,
+            **project,
             artifacts={
                 "transcript_path": artifacts.get("transcript_path"),
                 "stdout_path": artifacts.get("stdout_path"),
@@ -797,23 +835,35 @@ def handle_run(rest, ctx):
         failover_error_code = None
         recovery_events = []
         attempt = 0
+        attempt_observations = []
         spent_usd = 0.0
         models = capacity_models(run_session)
         model_index = 0
         capacity_retries = 0
         while True:
             attempt += 1
-            baseline = extract_interactive_usage(
-                run_session["provider"], run_session.get("authHome"),
-                conversation_id=(run_session.get("conversation") or {}).get("id"),
-            ) if parsed.get("continue_run") and (run_session["provider"] == "codex" or parsed.get("budget")) else None
+            registry.record_attempt(run_id, _headless_artifact_paths(run_session, run_id=run_id, attempt=attempt))
+            baseline = None
+            if parsed.get("continue_run") and (run_session["provider"] == "codex" or parsed.get("budget")):
+                if (run_session.get("launch") or {}).get("isolate_workspace"):
+                    baseline = (None, None, None, None)
+                else:
+                    baseline = extract_interactive_usage(
+                        run_session["provider"], run_session.get("authHome"),
+                        conversation_id=(run_session.get("conversation") or {}).get("id"))
             attempt_cost = None
             budget_observation = None
+            budget_unverifiable = False
 
             def check_budget(paths, session=run_session, before=baseline, already_spent=spent_usd):
-                nonlocal attempt_cost, budget_observation
+                nonlocal attempt_cost, budget_observation, budget_unverifiable
                 observation = _budget_observation(session, paths, before)
                 cost = estimate_cost(observation["usage"], observation["usage_model"], budget_prices)
+                measured = observation["usage"].get("total_tokens") is not None or observation.get("measurement_unavailable", False)
+                if cost is None and measured:
+                    budget_unverifiable = True
+                    budget_observation = observation
+                    return True
                 if cost is not None:
                     if attempt_cost is None or cost >= attempt_cost:
                         attempt_cost = cost
@@ -828,6 +878,7 @@ def handle_run(rest, ctx):
                 timeout_seconds=parsed.get("timeout_seconds"),
                 spawn=ctx.get("spawn_headless") or ctx.get("spawn"),
                 run_id=run_id,
+                attempt=attempt,
                 **({"budget_check": check_budget} if parsed.get("budget") is not None else {}),
             )
             observation = _observe_headless_usage(run_session, run_info, baseline if run_session["provider"] == "codex" else None)
@@ -843,8 +894,20 @@ def handle_run(rest, ctx):
                         "recovery_events": recovery_events}
             cost = estimate_cost(observation["usage"], observation["usage_model"], budget_prices)
             spent_usd += max(attempt_cost or 0.0, cost or 0.0)
-            if parsed.get("budget") is not None and (run_info.get("budget_exceeded") or spent_usd >= parsed["budget"]):
+            if parsed.get("budget") is not None and (budget_unverifiable or (
+                    cost is None and (observation["usage"].get("total_tokens") is not None or observation.get("measurement_unavailable")))):
+                run_info.update(budget_unverifiable=True, budget_exceeded=False, returncode=125,
+                                cost_usd=None, cost_status="unknown", budget_status="unverifiable")
+            elif parsed.get("budget") is not None and (run_info.get("budget_exceeded") or spent_usd >= parsed["budget"]):
                 run_info.update(budget_exceeded=True, returncode=125, cost_usd=spent_usd)
+            attempt_observations.append({
+                "attempt": attempt, "attempt_id": run_info.get("attempt_id"),
+                "session": run_session["name"], "provider": run_session["provider"],
+                **{key: run_info.get(key) for key in ("usage", "usage_model", "usage_models", "usage_evidence")},
+                **cost_fields(observation["usage"], observation["usage_model"], budget_prices,
+                              models=observation.get("usage_models", []), attribution=observation.get("usage_attribution")),
+            })
+            run_info["attempts"] = list(attempt_observations)
             ctx["service"]["record_launch_history"](run_session["name"], {
                 "status": "success" if run_info.get("returncode") == 0 else "failed",
                 "action": "run",
@@ -853,8 +916,9 @@ def handle_run(rest, ctx):
                 "cwd": cwd,
                 "exit_code": run_info.get("returncode"),
                 **run_info,
+                **project,
             })
-            if run_info.get("budget_exceeded") or parsed.get("continue_run"):
+            if run_info.get("budget_exceeded") or run_info.get("budget_unverifiable") or parsed.get("continue_run"):
                 break
             if looks_model_at_capacity(run_session.get("provider"), run_info):
                 event = {"reason": "model_at_capacity", "attempt": attempt,
@@ -979,7 +1043,10 @@ def handle_run(rest, ctx):
             )
             _write_json(ctx, final_payload)
             return 0
-        if run_info.get("budget_exceeded"):
+        if run_info.get("budget_unverifiable"):
+            failover_error_code = "budget_unverifiable"
+            message = "Measured usage cannot be priced; USD budget enforcement is unavailable. Check cost_reason and observed model evidence."
+        elif run_info.get("budget_exceeded"):
             failover_error_code = "budget_exceeded"
             message = "Run exceeded its estimated USD budget."
         elif failover_error_code == "capacity_recovery_exhausted":
@@ -1000,7 +1067,7 @@ def handle_run(rest, ctx):
             run_session,
             run_info=run_info,
             error=error,
-            error_source="cdx" if run_info.get("budget_exceeded") else "provider",
+            error_source="cdx" if run_info.get("budget_exceeded") or run_info.get("budget_unverifiable") else "provider",
             # Running out of accounts is a different outcome from the task
             # failing, and a caller has to be able to branch on which happened.
             error_code=failover_error_code or (
@@ -1038,6 +1105,7 @@ def handle_run(rest, ctx):
                 "cwd": cwd,
                 "exit_code": error.exit_code,
                 **run_info,
+                **project,
             })
         final_payload = run_result_payload(
             API_SCHEMA_VERSION,
@@ -1065,14 +1133,10 @@ def handle_run(rest, ctx):
         return error.exit_code
 
 def _record_capacity_recovery(ctx, registry, run_id, event, run_info, events):
-    # Subsequent attempts reuse the run's paths; retain the failed output first.
-    artifacts = {}
-    for key in ("stdout_path", "stderr_path", "transcript_path"):
-        path = run_info.get(key)
-        if path and os.path.isfile(path):
-            archived = f"{path}.attempt-{event['attempt']}"
-            shutil.copyfile(path, archived)
-            artifacts[key] = archived
+    # Attempt paths are immutable; recovery events reference the same evidence
+    # as the history row instead of copying output that a retry will overwrite.
+    artifacts = {key: run_info[key] for key in ("stdout_path", "stderr_path", "transcript_path")
+                 if run_info.get(key) and os.path.isfile(run_info[key])}
     event["artifacts"] = artifacts
     events.append(event)
     registry.record_recovery(run_id, event)

package/src/commands/status.py

@@ -55,6 +55,7 @@ from ..rtk_savings import rtk_saved
 from ..run_usage import (
     TOKEN_USAGE_KEYS,
     cache_hit_ratio,
+    cost_fields,
     estimate_cost,
     format_cache_ratio,
     is_vouched,
@@ -287,6 +288,7 @@ def _summarize_stats(entries):
             "unweighted_runs": 0,
             "priced_runs": 0,
             "unpriced_models": set(),
+            "unpriced_reasons": {},
             "unvouched_runs": 0,
             "input_tokens": 0,
             "cached_input_tokens": 0,
@@ -342,7 +344,10 @@ def _summarize_stats(entries):
             if cost is not None:
                 row["cost_usd"] += cost
                 row["priced_runs"] += 1
-            elif entry.get("usage_model"):
+            else:
+                reason = cost_fields(usage, entry.get("usage_model"), models=entry.get("usage_models", (entry.get("usage_evidence") or {}).get("models", [])), attribution=entry.get("usage_attribution"))["cost_reason"]
+                row["unpriced_reasons"][reason] = row["unpriced_reasons"].get(reason, 0) + 1
+            if cost is None and entry.get("usage_model"):
                 # Named the model but could not price it. Recording which one
                 # turns an unexplained "-" into something actionable: that
                 # string is exactly what CDX_TOKEN_PRICES needs a key for.
@@ -524,9 +529,11 @@ def _format_rtk_saved(rtk):
 
 
 def _stats_group(entry, by):
-    """The project (launch folder) or the model a run is counted under."""
+    """The recorded source repository or serving model a run is counted under."""
     if by == "project":
-        return str(entry.get("cwd") or "").rstrip("/\\") or "-"
+        from ..project_identity import recorded_project
+
+        return recorded_project(entry) or "-"
     model = entry.get("usage_model") or "-"
     return model.removesuffix("[1m]") if model.startswith("claude-") else model
 
@@ -640,6 +647,26 @@ def handle_configs(rest, ctx):
     return 0
 
 def handle_history(rest, ctx):
+    if rest and rest[0] == "backfill-projects":
+        usage = "Usage: cdx history backfill-projects [--mapping FILE] [--dry-run | --apply] [--json]"
+        parsed = _parse_flag_args(rest[1:], {
+            "--mapping": {"key": "mapping", "type": "str", "default": None},
+            "--dry-run": {"key": "dry_run", "type": "bool", "default": False},
+            "--apply": {"key": "apply", "type": "bool", "default": False},
+            "--json": {"key": "json", "type": "bool", "default": False},
+        }, usage)
+        if parsed["apply"] and parsed["dry_run"]:
+            raise CdxError(usage)
+        result = ctx["service"]["backfill_history_projects"](mapping_path=parsed["mapping"], dry_run=not parsed["apply"])
+        if parsed["json"]:
+            payload = (_json_failure("history", "project_attribution_conflict", "Conflicting project evidence; no changes applied.", **result)
+                       if result["conflicting"] else _json_success("history", "Backfilled history projects", **result))
+            _write_json(ctx, payload)
+        else:
+            mode = "Dry run" if result["dry_run"] else "Not applied (conflicts)" if result["conflicting"] else "Applied"
+            ctx["out"](f"{mode}: {result['recovered']} recovered; {result['unchanged']} unchanged; "
+                       f"{result['unresolved']} unresolved; {result['conflicting']} conflicting.\n")
+        return 1 if result["conflicting"] else 0
     if rest and rest[0] == "backfill-models":
         usage = "Usage: cdx history backfill-models [--dry-run | --apply] [--json]"
         parsed = _parse_flag_args(rest[1:], {
@@ -672,7 +699,8 @@ def handle_history(rest, ctx):
     entries = ctx["service"]["get_launch_history"](parsed["name"], limit=limit)
     entries = _filter_history_period(entries, parsed["period"])
     entries = [{**entry, "parent_run_id": entry.get("parent_run_id"),
-                "cost_usd": estimate_cost(entry.get("usage"), entry.get("usage_model")) if is_vouched(entry.get("usage")) else None,
+                **cost_fields(entry.get("usage") if is_vouched(entry.get("usage")) else None, entry.get("usage_model"),
+                              models=entry.get("usage_models", (entry.get("usage_evidence") or {}).get("models", [])), attribution=entry.get("usage_attribution")),
                 "usage": {**entry["usage"], "cache_hit_ratio": cache_hit_ratio(entry["usage"], provider=entry.get("provider")) if is_vouched(entry["usage"]) else None}
                 if isinstance(entry.get("usage"), dict) else entry.get("usage")} for entry in entries]
     if has_period and not parsed["summary"]:

package/src/history_models.py

@@ -7,7 +7,7 @@ import time
 from .interactive_usage import MAX_TRANSCRIPT_BYTES, MAX_TRANSCRIPT_SCAN_SECONDS
 from .run_registry import registry_path
 
-EVIDENCE_KINDS = ("stdout", "run_report", "codex_rollout", "claude_transcript")
+EVIDENCE_KINDS = ("isolated_observation", "stdout", "run_report", "codex_rollout", "claude_transcript")
 
 
 def missing_model(value):
@@ -108,6 +108,15 @@ def _exact_transcript(provider, auth_home, identifier):
 def recover_model(entry, session=None, reports=()):
     """Return (model, evidence kind, reason); never consult live model settings."""
     provider = entry.get("provider")
+    evidence = entry.get("usage_evidence")
+    if isinstance(evidence, dict):
+        if (evidence.get("stdout_path") != entry.get("stdout_path")
+                or evidence.get("attempt_id") != entry.get("attempt_id")
+                or evidence.get("run_id") != entry.get("run_id")
+                or (evidence.get("measurement_usage") or evidence.get("usage")) != entry.get("usage")):
+            return None, "isolated_observation", "observation_attempt_mismatch"
+        model, reason = _single_model(evidence.get("models") or [])
+        return model, "isolated_observation", reason or (None if model else "no_turn_models")
     records, error = _read_records(entry.get("stdout_path"))
     if error:
         return None, None, error

package/src/project_identity.py

@@ -0,0 +1,71 @@
+"""Repository attribution captured by the trusted launcher, separate from cwd."""
+
+import json
+import ntpath
+import os
+import posixpath
+import subprocess
+from pathlib import PureWindowsPath
+
+from .errors import CdxError
+from .tray_logics import _repository_root
+
+PROJECT_SOURCES = {"git", "operator", "operator_mapping", "run_report"}
+
+
+def canonical_project(value):
+    """Validate recorded identities without consulting a possibly deleted checkout."""
+    return (isinstance(value, str) and bool(value.strip()) and "\x00" not in value
+            and ((posixpath.isabs(value) and posixpath.normpath(value) == value)
+                 or (PureWindowsPath(value).is_absolute() and ntpath.normpath(value) == value)))
+
+
+def recorded_project(entry):
+    value = entry.get("project")
+    source = entry.get("project_source")
+    return value if canonical_project(value) and isinstance(source, str) and source in PROJECT_SOURCES else None
+
+
+def resolve_project(cwd, explicit=None):
+    """Resolve before isolation. Never infer clone provenance from remote URLs."""
+    if explicit is not None:
+        if not canonical_project(explicit):
+            raise CdxError("--project must be an absolute canonical source repository path.")
+        return {"project": explicit, "project_source": "operator"}
+    root = _repository_root(cwd)
+    if root:
+        if os.path.isdir(os.path.join(root, ".git")):
+            return {"project": root, "project_source": "git"}
+        try:
+            # Ignore ambient Git overrides: this lookup belongs to the launch cwd.
+            env = {key: value for key, value in os.environ.items() if not key.startswith("GIT_")}
+            common = subprocess.run(["git", "-C", root, "rev-parse", "--git-common-dir"],
+                                    env=env, capture_output=True, text=True, timeout=5, check=True).stdout.strip()
+            common = os.path.realpath(os.path.join(root, common))
+            if os.path.isdir(common):
+                return {"project": os.path.dirname(common) if os.path.basename(common) == ".git" else common,
+                        "project_source": "git"}
+        except (OSError, subprocess.SubprocessError):
+            pass
+    return {"project": None, "project_source": "unknown"}
+
+
+def load_mapping(path):
+    try:
+        with open(path, encoding="utf-8") as handle:
+            data = json.load(handle)
+    except (OSError, ValueError) as error:
+        raise CdxError(f"Cannot read project mapping: {error}") from error
+    if (not isinstance(data, dict) or set(data) != {"version", "projects"}
+            or type(data["version"]) is not int or data["version"] != 1 or not isinstance(data["projects"], list)):
+        raise CdxError("Invalid project mapping: expected version 1 and a projects array.")
+    projects = {}
+    for item in data["projects"]:
+        if (not isinstance(item, dict) or set(item) != {"run_id", "project"}
+                or not isinstance(item["run_id"], str) or not item["run_id"].strip()
+                or not canonical_project(item["project"])):
+            raise CdxError("Invalid project mapping: each entry needs an exact run_id and absolute canonical project path.")
+        if item["run_id"] in projects and projects[item["run_id"]] != item["project"]:
+            raise CdxError(f"Conflicting project mappings for run {item['run_id']}.")
+        projects[item["run_id"]] = item["project"]
+    return projects

package/src/provider_runtime.py

@@ -1068,13 +1068,15 @@ def _build_headless_launch_spec(session, cwd=None, env_override=None, initial_pr
     )
 
 
-def _headless_artifact_paths(session, run_id=None):
+def _headless_artifact_paths(session, run_id=None, attempt=1):
     run_id = run_id or uuid.uuid4().hex
     log_dir = _get_launch_transcript_dir(session)
     os.makedirs(log_dir, exist_ok=True)
-    prefix = os.path.join(log_dir, f"cdx-run-{run_id}")
+    attempt_id = f"{run_id}:{attempt}"
+    prefix = os.path.join(log_dir, f"cdx-run-{run_id}-attempt-{attempt}")
     return {
         "run_id": run_id,
+        "attempt_id": attempt_id,
         "transcript_path": os.path.abspath(f"{prefix}.log"),
         "stdout_path": os.path.abspath(f"{prefix}.stdout.log"),
         "stderr_path": os.path.abspath(f"{prefix}.stderr.log"),
@@ -1205,7 +1207,23 @@ def _read_permission_denials(stdout_path):
 
 
 def _run_headless_provider_command(session, cwd=None, env_override=None, initial_prompt=None,
-                                   timeout_seconds=None, spawn=None, run_id=None, budget_check=None):
+                                   timeout_seconds=None, spawn=None, run_id=None, budget_check=None, attempt=1):
+    import tempfile
+
+    isolated_codex = session.get("provider") == PROVIDER_CODEX and (session.get("launch") or {}).get("isolate_workspace")
+    if isolated_codex:
+        # Volatile storage only: raw rollouts must not survive closeout, including
+        # cancellation/start failures. Only this attempt's sessions are mounted.
+        with tempfile.TemporaryDirectory(prefix="cdx-observation-", dir="/dev/shm" if sys.platform.startswith("linux") else None) as directory:
+            os.mkdir(os.path.join(directory, "sessions"), mode=0o700)
+            return _run_headless_provider_attempt(session, cwd, env_override, initial_prompt,
+                                                  timeout_seconds, spawn, run_id, budget_check, directory, attempt)
+    return _run_headless_provider_attempt(session, cwd, env_override, initial_prompt,
+                                          timeout_seconds, spawn, run_id, budget_check, attempt=attempt)
+
+
+def _run_headless_provider_attempt(session, cwd=None, env_override=None, initial_prompt=None,
+                                   timeout_seconds=None, spawn=None, run_id=None, budget_check=None, observation_home=None, attempt=1):
     spawn = spawn or subprocess.Popen
     spec = _build_headless_launch_spec(
         session,
@@ -1249,13 +1267,22 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
                 network=launch.get("network_access", False),
                 writable=launch.get("permission") != "review",
                 source=spec["options"]["env"], auth_home=_get_auth_home(session),
-                provider=session.get("provider"))
+                provider=session.get("provider"),
+                **({"observation_home": os.path.join(observation_home, "sessions")} if observation_home else {}))
         except (OSError, RuntimeError) as error:
             raise CdxError(str(error)) from error
         spec.update(command=argv[0], args=argv[1:])
         spec["options"]["env"] = child_env
-    paths = _headless_artifact_paths(session, run_id=run_id)
+    paths = _headless_artifact_paths(session, run_id=run_id, attempt=attempt)
     start_time = datetime.now(timezone.utc)
+
+    def snapshot():
+        if observation_home:
+            from .run_observation import codex_attempt_evidence
+            paths["usage_evidence"] = codex_attempt_evidence(
+                observation_home, paths["stdout_path"], start_time.isoformat())
+            paths["usage_evidence"].update(run_id=paths["run_id"], attempt_id=paths.get("attempt_id"))
+
     command = spec["command"]
     if spawn is subprocess.Popen:
         command = _resolve_command(command, spec.get("options", {}).get("env"))
@@ -1295,6 +1322,7 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
             if budget_check is not None:
                 deadline = time.monotonic() + timeout_seconds if timeout_seconds is not None else None
                 while True:
+                    snapshot()
                     if budget_check(paths):
                         budget_exceeded = True
                         _terminate_child_tree(child)
@@ -1304,6 +1332,7 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
                         raise subprocess.TimeoutExpired(command, timeout_seconds)
                     try:
                         child.wait(timeout=min(0.25, remaining) if remaining is not None else 0.25)
+                        snapshot()
                         budget_exceeded = budget_check(paths)
                         break
                     except subprocess.TimeoutExpired:
@@ -1325,6 +1354,7 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
             cancelled = True
             _terminate_child_tree(child)
         finally:
+            snapshot()
             _restore_signal_handlers(previous_handlers)
 
     if cancelled:

package/src/run_command.py

@@ -4,7 +4,7 @@ import sys
 from .cli_args import ARG_CODE_INVALID_VALUE
 from .errors import CdxArgumentError, CdxError
 from .provider_runtime import headless_permission_disables_network
-from .run_usage import empty_usage, estimate_cost, extract_run_observation
+from .run_usage import cost_fields, empty_usage, estimate_cost, extract_run_observation
 
 PROMPT_STDIN = "-"
 
@@ -169,6 +169,8 @@ def run_launch_payload(api_schema_version, parsed, session, artifacts, cwd=None,
         "ok": True,
         "action": "run",
         "launcher": "cdx",
+        "project": parsed.get("project"),
+        "project_source": parsed.get("project_source", "unknown"),
         "parent_run_id": parsed.get("continue_run"),
         "conversation_id": conversation_id or run_conversation_id(session),
         "detached": True,
@@ -219,6 +221,8 @@ def run_result_payload(api_schema_version, ok, parsed, session, run_info=None,
         "ok": bool(ok),
         "action": "run",
         "launcher": "cdx",
+        "project": parsed.get("project"),
+        "project_source": parsed.get("project_source", "unknown"),
         "parent_run_id": parsed.get("continue_run"),
         "conversation_id": run_conversation_id(session, run_info),
         "session": session.get("name") if session else None,
@@ -229,6 +233,8 @@ def run_result_payload(api_schema_version, ok, parsed, session, run_info=None,
         "power": parsed.get("power") or ((session.get("launch") or {}).get("power") if session else None),
         "cwd": os.path.abspath(parsed.get("cwd") or os.getcwd()),
         "run_id": run_info.get("run_id"),
+        "attempt_id": run_info.get("attempt_id"),
+        "attempts": run_info.get("attempts", []),
         "exit_code": run_info.get("returncode"),
         "duration_seconds": (run_info.get("duration_ms") / 1000.0) if run_info.get("duration_ms") is not None else None,
         "transcript_path": run_info.get("transcript_path"),
@@ -236,7 +242,14 @@ def run_result_payload(api_schema_version, ok, parsed, session, run_info=None,
         "stderr_path": run_info.get("stderr_path"),
         "usage": usage,
         "usage_model": usage_model,
+        "usage_models": run_info.get("usage_models", [usage_model] if usage_model else []),
+        **cost_fields(usage, usage_model, models=run_info.get("usage_models", (run_info.get("usage_evidence") or {}).get("models", [])), attribution=run_info.get("usage_attribution")),
         "cost_usd": run_info.get("cost_usd", estimate_cost(usage, usage_model)),
+        "usage_evidence": run_info.get("usage_evidence"),
+        "usage_attribution": run_info.get("usage_attribution"),
+        "budget_status": run_info.get("budget_status", "exceeded" if run_info.get("budget_exceeded") else
+                                      "usage_not_measured" if parsed.get("budget") is not None and usage.get("total_tokens") is None else
+                                      "estimated" if parsed.get("budget") is not None else "not_requested"),
         "budget_usd": parsed.get("budget"),
         "warnings": warnings,
         "error": None if ok else {