cdx-manager 0.25.3 → 0.25.5

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.25.3-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.25.5-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **The right AI coding account, when you need it.** CDX Manager keeps your Codex and Claude accounts in separate profiles, shows which ones have quota, and helps you pick the next usable session from your terminal.
 
@@ -178,8 +178,15 @@ result. A probe overlapping the short snapshot can still report contention.
 Controller renewal does not extend the worker's copied access token; quota remains
 one controller-side account snapshot, never a worker copy. Multiple independent controllers sharing copied OAuth profiles are not
 supported. Costs and budget checks use measured worker usage and observed rollout
-models; unknown prices and delayed provider reporting retain the usual budget
-limitations. A run that outlives the access credential fails with
+models, using the same exact-thread reader and 128 MiB rollout limit as local
+isolated runs. Content-free evidence travels in supervisor frames separated from
+provider stdout; raw rollouts and credentials are never returned. Live rollout
+counters can stop an over-budget run before `turn.completed`. Unknown prices and
+delayed provider reporting retain the usual budget limitations. With `--budget`,
+measured but unpriceable usage still fails with `budget_unverifiable` (exit 125),
+even after the provider finishes, preserving the documented fail-closed guarantee.
+Provider output remains in the run artifacts; without a budget, a completed run
+keeps its provider status and unknown cost. A run that outlives the access credential fails with
 `remote_credential_expired`, requiring a new controller launch.
 
 The empty-refresh-token behavior was measured with Codex CLI 0.166.0. Real-host

package/VERSION

@@ -1 +1 @@
-0.25.3
+0.25.5

package/changelogs/CHANGELOGS_0_25_4.md

@@ -0,0 +1,14 @@
+# CDX Manager 0.25.4
+
+Release date: 2026-11-01
+
+This patch release measures remote Codex run costs from observed model evidence and applies budgets to those estimates.
+
+## Fixes
+
+- Attribute remote run costs to the model observed in Codex usage evidence rather than the requested model. Preserve that evidence in run tracking, stop runs when measured usage exceeds the budget, and report unverifiable budgets explicitly when reliable model evidence or pricing is unavailable. (#83)
+
+## Maintenance
+
+- Record tray companion checksums for v0.25.3. (`222d5127314bab4200bb13b1b364b3ab5253fb1b`)
+- Record release archive checksums for v0.25.3. (`9bac8bf616345e4348507038dc392a51eb0a360f`)

package/changelogs/CHANGELOGS_0_25_5.md

@@ -0,0 +1,14 @@
+# CDX Manager 0.25.5
+
+Release date: 2026-11-02
+
+This patch release makes `cdx update all` report version status based on verified evidence.
+
+## Fixes
+
+- Compare installed tool versions with official release sources before reporting them as up to date. Report unknown status when version evidence is unavailable or inconsistent, and offer automatic updates only when a supported CLI updater or verified Homebrew installation is available. Preserve existing JSON fields and expose uncertainty with `unknown` and an optional `reason`. (#85)
+
+## Maintenance
+
+- Record tray companion checksums for v0.25.4. (`46ff59ba5fad3bbd7b37429371112f3f6f38a330`)
+- Record release archive checksums for v0.25.4. (`8ae658e2e6f3303f575e95f58b622321cad87a60`)

package/changelogs/CHANGELOGS_UNRELEASED.md

@@ -1,5 +1,10 @@
 # Unreleased
 
+## Truthful workstation updates
+
+- Verify latest versions from npm, RTK GitHub releases, and Antigravity/Ollama vendor update endpoints with short read-only probes. Report `unknown` on unavailable evidence; reserve `up_to_date` for identical known versions, including Ponytail revisions.
+- Preserve the existing JSON fields and `update_available` status, show uncertainty and manual-update reasons in text, and apply only supported native commands or verified Homebrew package upgrades. Cover matching/outdated versions, source failures, missing tools, and command execution with faked sources.
+
 ## Dependency security
 
 - Require cryptography >=50.0.0 for encrypted auth bundles and remove the vulnerable 47.0.0 lock entry. Python 3.9 remains supported from 3.9.2, as cryptography 50 excludes 3.9.0 and 3.9.1.
@@ -12,6 +17,13 @@
 - Add `cdx run --budget USD` to stop on measured estimated spend with exit code 125, `budget_exceeded`, and `error.spent_usd` in the final JSON. Share the budget across recovery attempts and failover; support detached runs and fresh budgets for continued runs without charging earlier turns.
 - Document unknown usage/prices and delayed provider reporting, including possible budget overshoot. Cover pricing, unknown costs, validation, live process termination, Claude transcript accumulation, continuation boundaries, and detached supervision in tests.
 
+## Remote run cost observations
+
+- Use the local exact-thread observation reader, usage normalization and 128 MiB rollout limit on workers; return content-free model/counter evidence before volatile storage cleanup and bind it to controller run/attempt artifacts.
+- Separate supervisor evidence frames from provider stdout, and check live rollout measurements before `turn.completed` so measured remote budget excess still stops the provider. Never price from requested models or controller-side rollouts.
+- Preserve the documented fail-closed budget guarantee: measured but unpriceable remote usage exits 125 with `budget_unverifiable`, including after provider completion. Keep provider output in artifacts; completed runs without a budget retain their actual status and unknown cost. Credential snapshots, redaction, cleanup and workspace isolation remain unchanged.
+- Cover priced remote/isolated runs, Windows transport, rollouts over 16 MiB, live budget stops, missing/inconsistent/mixed model evidence, unknown prices and completion without pricing using the fake transport.
+
 ## Remote Codex runs
 
 - Add `cdx run --remote SSH_TARGET` with controller-owned supervision, registry, history, output, costs, budgets and detached execution.

package/checksums/release-archives.json

@@ -716,6 +716,28 @@
         "x86_64-pc-windows-msvc": "ffcd4deb8b3843771659d2c6b92b003822b288329ddcf3b9a13f0f9820fa3df1",
         "x86_64-unknown-linux-musl": "2cefeea0aad5bb0acfcbc99146ffacc5c5da9386f8338e4a01541e97ccf71e07"
       }
+    },
+    "v0.25.3": {
+      "github_tarball_sha256": "34114563f0edf4d8e13d9410d6a37e4c315571a8410de607b8bc541032561a21",
+      "github_zip_sha256": "58cabe7d9d48c314e568c317893b460ca8c8853434a68ee3397e23999f823ddf",
+      "tray_assets": {
+        "aarch64-apple-darwin": "14da8f42193e78c1bfca5ac046a6a23c7ab52b4155ac9eb213bd9af09cd5e6cc",
+        "aarch64-unknown-linux-musl": "47b6988f5f361403e2c8e0c2ff5951cb758af3cde3fc6bb02f7eb718042c3027",
+        "x86_64-apple-darwin": "aac73ff0abdb76a957ebd7c143ff3ace46d6df7b08f13db922b28e76dcbc82d0",
+        "x86_64-pc-windows-msvc": "c81623ffb94b11ae7b7b28be123b49393240bb0edd31c69969ca07d7eab8dff7",
+        "x86_64-unknown-linux-musl": "6892112587c1d8c6e805a90148ec8deb6c04b5927c7ed0c18f19479d521c0ced"
+      }
+    },
+    "v0.25.4": {
+      "github_tarball_sha256": "94dbd4f9e2d7e34cf3cfaf967565c1fe8dd56a0cd1fe2888c43cf8f44290a2ec",
+      "github_zip_sha256": "13c3bad9b45776fb13a25bf8a363b98d5e8a042b91f848005e7f4adbfb275659",
+      "tray_assets": {
+        "aarch64-apple-darwin": "06b4b649621b53af642b01ba543369e7ce975454f3b70977e5d35c7a5d3bca5d",
+        "aarch64-unknown-linux-musl": "f5ced5b655c525bbcd71eeab002ea557e52507dbe69101ad351fea0bbbf290ff",
+        "x86_64-apple-darwin": "2ee4a2144455fc6eebd395c9c58c3d3fa7e4ed333e5f3959ba78e46a41c55be0",
+        "x86_64-pc-windows-msvc": "8e2c1925f025a7227ef909f27e8b4696c03bb5a86e0c61c989da6a942b5638a6",
+        "x86_64-unknown-linux-musl": "9ae1164abc3ff4b30d25c44696569855138f8ac0e3b6e1c3451c716d20f221fa"
+      }
     }
   }
 }

package/docs/cli.md

@@ -51,7 +51,7 @@
 | `cdx repair [--dry-run] [--force] [--json]` | Plan or apply safe repairs for missing state files, quarantines, and orphan profiles |
 | `cdx view [--json] [--lan] [--lan-rw] [--focus <ref>] [--read] [--port <port>] [--host <host>] [--refresh-interval <s>] [--tls] [--tls-cert <path>] [--tls-key <path>] [--open] [--no-open]` | Open the Logics browser/focus viewer by delegating to `logics-manager view`; all viewer flags are forwarded; JSON mode reports diagnostics without launching it |
 | `cdx update [--check] [--yes] [--json] [--version TAG]` | Update cdx-manager using the installer that matches how it was installed |
-| `cdx update all [--yes] [--json]` | Check installed providers, RTK, and Ponytail across Codex profiles; show the plan and ask once before applying safe native/Homebrew updates and missing RTK/Ponytail setup |
+| `cdx update all [--yes] [--json]` | Check installed providers, RTK, and Ponytail across Codex profiles; show the plan and ask once before applying supported native/Homebrew updates and missing RTK/Ponytail setup |
 | `cdx ready [--refresh] [--json]` | Schedule an OS notification for the next cooling-down assistant that becomes ready, then return immediately |
 | `cdx notify` | Internal provider hook target for agent alerts and agent state; use `cdx set <name> --notify on` or `--agent-state on` to enable it |
 | `cdx agents [--max-age-hours N] [--json]` | Each session's last known agent state (working, waiting, done, failed, limit, ended), waiting first; records older than N hours (default 24) are dropped. See [Agent state](sessions-and-notifications.md#agent-state) |
@@ -254,7 +254,7 @@ At or above the limit, cdx terminates the provider process tree, skips further r
 
 With `--detach`, the launch still exits successfully and includes `budget_usd`; cdx always uses its own child supervisor for budgeted runs, including when native background delegation is enabled. Inspect `cdx run-status RUN_ID --json` or `cdx run-report RUN_ID --json` for the child's final payload and budget error. `--continue-run` starts a fresh budget for the new run, including in detached mode.
 
-Conservative assumption: this is a stop based on observed, priceable usage, not a prepaid billing limit. Provider updates can arrive late or only at completion, and termination can take time, so actual spend can exceed the amount. Before the first measurement, `budget_status` is `usage_not_measured`; absence is not zero spend. Once usage is measured, missing continuation boundaries, mixed/unobserved models, and unknown prices stop further execution/recovery with exit **125**, `error.source: "cdx"`, `error.code: "budget_unverifiable"`, `budget_status: "unverifiable"`, and `cost_usd: null`. This is a measurement failure, not a claim that the dollar limit was exceeded or enforced. Supply a `CDX_TOKEN_PRICES` override for a model missing from the table. Existing profile-level `cdx set --budget` settings remain the provider-native Claude cap and apply independently.
+Conservative assumption: this is a stop based on observed, priceable usage, not a prepaid billing limit. Provider updates can arrive late or only at completion, and termination can take time, so actual spend can exceed the amount. Before the first measurement, `budget_status` is `usage_not_measured`; absence is not zero spend. Once usage is measured, missing continuation boundaries, mixed/unobserved models, and unknown prices stop further execution/recovery with exit **125**, `error.source: "cdx"`, `error.code: "budget_unverifiable"`, `budget_status: "unverifiable"`, and `cost_usd: null`. This is a measurement failure, not a claim that the dollar limit was exceeded or enforced. This fail-closed guarantee also applies to a remote agent that has already completed: the supervisor reports `failed`/125 while retaining its final output and artifacts. Without `--budget`, unknown pricing does not replace the provider's completion status. Supply a `CDX_TOKEN_PRICES` override for a model missing from the table. Existing profile-level `cdx set --budget` settings remain the provider-native Claude cap and apply independently.
 
 Every usage record, whichever path produced it, uses one set of definitions:
 
@@ -292,7 +292,7 @@ The figure uses standard public list prices, excluding Fast/priority, Batch/Flex
 
 Completed results, registry records, and history JSON include `cost_status` (`estimated` or `unknown`) and nullable `cost_reason`: `usage_not_measured`, `model_not_observed`, `model_price_unknown`, `attempt_usage_unavailable`, or `mixed_models_without_counters`. Stats include `unpriced_reasons` counts alongside `priced_runs` and `unpriced_models`. These are list-price estimates, not billing receipts. `budget_status` is `not_requested`, `usage_not_measured`, `estimated`, `exceeded`, or `unverifiable`.
 
-New headless attempts have distinct `attempt_id` values and artifact paths, including retries on the same profile. Final payloads and registry reports expose `attempts` with their individual model evidence, counters, and estimates; top-level usage describes the final attempt, while a budget-exceeded spend includes all attempts. New isolated Codex attempts mount only a fresh sessions directory from volatile `/dev/shm` storage. The supervisor reads the exact `thread.started` rollout while it exists and at closeout, requiring matching session identity, turn timestamps within this attempt, and token counters consistent with stdout. It exports `usage_evidence` containing only the stdout attempt identity, thread id, timestamp bounds, turn ids, observed models, and normalized counters; live rollout counters can establish the first measurement before `turn.completed`. No requested model, agent-authored cost report, current profile setting, prompt, message, or tool output is used as model evidence. The raw temporary sessions are removed at closeout, including cancellation and startup failure; they are never copied into persistent run artifacts. Host profiles are not mounted. Mixed serving models stay unpriced without attributable counters. Isolated continuation without comparable launch boundaries stays unmeasured rather than charging an older conversation to the new attempt.
+New headless attempts have distinct `attempt_id` values and artifact paths, including retries on the same profile. Final payloads and registry reports expose `attempts` with their individual model evidence, counters, and estimates; top-level usage describes the final attempt, while a budget-exceeded spend includes all attempts. New isolated Codex attempts mount only a fresh sessions directory from volatile `/dev/shm` storage. The supervisor reads the exact `thread.started` rollout while it exists and at closeout, requiring matching session identity, turn timestamps within this attempt, and token counters consistent with stdout. It exports `usage_evidence` containing only the stdout attempt identity, thread id, timestamp bounds, turn ids, observed models, and normalized counters; live rollout counters can establish the first measurement before `turn.completed`. No requested model, agent-authored cost report, current profile setting, prompt, message, or tool output is used as model evidence. The raw temporary sessions are removed at closeout, including cancellation and startup failure; they are never copied into persistent run artifacts. Host profiles are not mounted. Remote Codex runs ship the same observation reader and normalization code over the existing stdin bootstrap. The worker validates the exact fresh-home thread, timestamp bounds and matching counters with the local 128 MiB limit, and returns only normalized evidence through supervisor frames, separate from provider stdout. The controller attaches its own stdout path, run id and attempt id before live budget checks and final persistence; it never consults a controller profile rollout for remote usage. Worker stdout capture stays in the existing volatile private home and is deleted with it. Credentials, refresh handling and workspace mounts are unchanged. Live rollout counters can establish remote usage before `turn.completed`. Mixed serving models stay unpriced without attributable counters. Isolated continuation without comparable launch boundaries stays unmeasured rather than charging an older conversation to the new attempt.
 
 Completed run JSON and registry reports expose `usage_model` separately from the requested `model`. Pricing uses the observed model from provider output; Codex can also supply it through the exact rollout identified by `thread.started.thread_id`. Configured defaults alone never establish serving-model identity, and missing or mixed model evidence stays unpriced. `--by model` groups Claude's `[1m]` context variant with its base model while preserving the original model string and per-run pricing. New runs record this evidence automatically. To recover missing models in existing history, run:
 
@@ -545,3 +545,41 @@ backup, and atomically replaces history only when the complete batch has no
 conflict. Unrelated fields, usage, and malformed/unrelated history lines survive.
 Repeating the same mapping is a no-op and creates no additional backup. The
 registry and provider transcripts are never rewritten by backfill.
+
+### Workstation update checks
+
+`cdx update all --json` collects a read-only plan. `--yes` applies its supported
+update and session setup steps. Existing `plan.items` fields remain available:
+`installed`, `version`, `latest_version`, `update_command`, and `status`.
+Versions and commands are explicitly `null` when unavailable.
+
+- `up_to_date`: both versions are known and identical.
+- `update_available`: the published version is newer (the tool is outdated).
+- `unknown`: the source failed, returned invalid data, timed out, or the installed
+  version could not be compared reliably. This never means up to date.
+- `not_installed`: the executable is absent; no installation is guessed.
+
+Checks use the npm registry for Codex and `@anthropic-ai/claude-code`, GitHub's
+`rtk-ai/rtk` latest stable release, the original Antigravity editor's vendor
+`/releases` feed for `agy`, and Ollama's own `/api/update` endpoint with the local
+OS/architecture and baseline version `0.0.0`. Ollama's local `/api/version` reports
+an installed server, not the latest published release, and is not used.
+Antigravity Hub and IDE 2 have separate feeds and are not substituted for `agy`.
+HTTP and read-only CLI probes have a five-second timeout; source failures leave
+`latest_version: null` and `status: unknown`. Ponytail also reports `unknown`
+when its remote revision is unavailable. An empty Ollama response (including
+HTTP 204 without a published version) remains `unknown`; a different platform
+is never substituted to manufacture a match.
+
+For an outdated tool, CDX uses a native update command advertised by its
+`--help` (including Claude and Antigravity when available), Codex's updater,
+or Homebrew only when the resolved executable belongs to a Caskroom/Cellar
+package. An outdated tool without such a path retains `update_available`,
+`update_command: null`, and a human-readable `reason`; it requires the vendor's
+manual update mechanism. Source uncertainty never schedules a guessed install.
+The text table shows `UNKNOWN` and the reason, and an empty action list makes
+no claim that all tools are current. JSON consumers, including external
+remote-ops auto-update scripts, should inspect statuses separately from successful
+command execution: exit code zero means no attempted action failed, not that
+every installed tool was verified current. With `--yes`, the returned plan is the
+pre-update inventory; `results` records attempted actions and their exit codes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.25.3",
+  "version": "0.25.5",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.25.3"
+version = "0.25.5"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9.2"

package/src/commands/maintenance.py

@@ -28,6 +28,7 @@ from ..update_manager import build_update_plan, format_update_failure, run_updat
 def _format_update_all(plan, use_color=False):
     labels = {
         "up_to_date": _success("OK", use_color),
+        "unknown": _warn("UNKNOWN", use_color),
         "update_available": _warn("UPDATE", use_color),
         "not_installed": _warn("MISSING", use_color),
         "check_with_native_updater": _info("CHECK", use_color),
@@ -36,6 +37,7 @@ def _format_update_all(plan, use_color=False):
     for item in plan["items"]:
         rows.append([_info(item["name"], use_color), item.get("version") or _dim("-", use_color), item.get("latest_version") or _dim("-", use_color), labels.get(item["status"], item["status"].replace("_", " "))])
     lines = [_style("Workstation update", "1", use_color), _dim("Inventory only — nothing has changed.", use_color), "", _pad_table(rows)]
+    lines.extend(f"{item['name']}: {item['reason']}" for item in plan["items"] if item.get("reason"))
     missing_rtk = plan["setup"]["rtk_missing_sessions"]
     setup = [f"RTK: enable for {', '.join(missing_rtk)}" if missing_rtk else "RTK: configured for every session"]
     setup.extend(f"Ponytail {plugin['session']}: {labels.get(plugin['status'], plugin['status'].replace('_', ' '))}" for plugin in plan["setup"]["ponytail"])
@@ -43,7 +45,7 @@ def _format_update_all(plan, use_color=False):
     if plan["steps"]:
         lines.extend(["", _warn(f"{len(plan['steps'])} action(s) ready", use_color), _dim("Confirm to update only the tools listed above.", use_color)])
     else:
-        lines.extend(["", _success("Everything managed by CDX is current and configured.", use_color)])
+        lines.extend(["", _dim("No automatic actions available. See tool statuses and reasons above.", use_color)])
     return "\n".join(lines)
 
 def _format_update_all_result(result, use_color=False):
@@ -689,6 +691,9 @@ def handle_update(rest, ctx):
             if input("Apply this plan? [y/N] ").strip().lower() not in ("y", "yes"):
                 ctx["out"](f"{_warn('Cancelled.', ctx['use_color'])}\n")
                 return 0
+        if parsed["yes"] and not parsed["json"]:
+            ctx["out"](f"{_format_update_all(plan, ctx['use_color'])}\n")
+
         def progress(event):
             if parsed["json"]:
                 return

package/src/commands/runs.py

@@ -584,7 +584,7 @@ def _observe_headless_usage(session, run_info, baseline=None):
 
 def _budget_observation(session, paths, baseline):
     observation = _observe_headless_usage(session, paths, baseline if session["provider"] == "codex" else None)
-    if (session.get("launch") or {}).get("isolate_workspace"):
+    if paths.get("remote") or (session.get("launch") or {}).get("isolate_workspace"):
         return observation
     identifier = (extract_run_conversation_id(session["provider"], paths.get("stdout_path"))
                   or ((session.get("conversation") or {}).get("id")

package/src/remote_run.py

@@ -7,6 +7,7 @@ import os
 import pathlib
 import re
 import subprocess
+import threading
 import time
 from contextlib import contextmanager
 from datetime import datetime, timezone
@@ -82,6 +83,11 @@ def worker_input():
     # One JSON line frames the source, leaving the next line for the payload.
     directory = pathlib.Path(__file__).parent
     source = 'SANDBOX_SOURCE = ' + repr((directory / 'workspace_sandbox.py').read_text()) + '\n'
+    from .interactive_usage import MAX_TRANSCRIPT_BYTES, MAX_TRANSCRIPT_SCAN_SECONDS
+    modules = {name: (directory / (name + '.py')).read_text()
+               for name in ('errors', 'run_usage', 'run_observation')}
+    source += 'OBSERVATION_MODULES = ' + repr(modules) + '\n'
+    source += f'OBSERVATION_LIMITS = {MAX_TRANSCRIPT_BYTES, MAX_TRANSCRIPT_SCAN_SECONDS!r}\n'
     source += (directory / 'remote_worker.py').read_text()
     return json.dumps(source).encode() + b'\n'
 
@@ -167,27 +173,57 @@ def run_remote(session, target, version, cwd=None, env_override=None, initial_pr
     paths = _headless_artifact_paths(session, run_id, attempt)
     paths['remote'] = target
     start = datetime.now(timezone.utc)
-    child = None
+    child = receiver = out = err = None
     cancelled = timed_out = budget_exceeded = credential_expired = False
     handlers = _route_termination_to_interrupt()
+    observation_ready = threading.Event()
+    observation_lock = threading.Lock()
+
+    def receive(source, output):
+        for line in source:
+            try:
+                frame = json.loads(line)
+                if frame.get('stream') == 'stdout':
+                    with observation_lock:
+                        observation_ready.clear()
+                        output.write(frame['data'])
+                        output.flush()
+                elif frame.get('stream') == 'observation':
+                    evidence = frame['evidence']
+                    evidence.update(stdout_path=paths['stdout_path'], run_id=paths['run_id'], attempt_id=paths.get('attempt_id'))
+                    with observation_lock:
+                        paths['usage_evidence'] = evidence
+                        observation_ready.set()
+            except (ValueError, TypeError, KeyError, AttributeError):
+                continue
+
     try:
-        with open(paths['stdout_path'], 'w') as out, open(paths['stderr_path'], 'w') as err:
-            child = subprocess.Popen(ssh_command(target, 'run', remote_prefix), env={**os.environ, **(env_override or {})},
-                                     stdin=subprocess.PIPE, stdout=out, stderr=err)
-            child.stdin.write(worker_input() + json.dumps(payload).encode() + b'\n')
-            child.stdin.flush()
-            deadline = time.monotonic() + timeout_seconds if timeout_seconds else None
-            while child.poll() is None:
-                if time.time() >= payload['expires_at']:
-                    credential_expired = True
-                    break
-                if budget_check and budget_check(paths):
-                    budget_exceeded = True
-                    break
-                if deadline and time.monotonic() >= deadline:
-                    timed_out = True
-                    break
-                time.sleep(0.1)
+        out = open(paths['stdout_path'], 'w', encoding='utf-8')
+        err = open(paths['stderr_path'], 'w', encoding='utf-8')
+        child = subprocess.Popen(ssh_command(target, 'run', remote_prefix), env={**os.environ, **(env_override or {})},
+                                 stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=err)
+        receiver = threading.Thread(target=receive, args=(child.stdout, out))
+        receiver.start()
+        child.stdin.write(worker_input() + json.dumps(payload).encode() + b'\n')
+        child.stdin.flush()
+        deadline = time.monotonic() + timeout_seconds if timeout_seconds else None
+        while child.poll() is None:
+            if time.time() >= payload['expires_at']:
+                credential_expired = True
+                break
+            with observation_lock:
+                if budget_check and observation_ready.is_set():
+                    observation_ready.clear()
+                    exceeded = budget_check(paths)
+                else:
+                    exceeded = False
+            if exceeded:
+                budget_exceeded = True
+                break
+            if deadline and time.monotonic() >= deadline:
+                timed_out = True
+                break
+            time.sleep(0.1)
     except KeyboardInterrupt:
         cancelled = True
     except (OSError, ValueError) as error:
@@ -208,6 +244,12 @@ def run_remote(session, target, version, cwd=None, env_override=None, initial_pr
                 except subprocess.TimeoutExpired:
                     child.kill()
                     child.wait()
+        if receiver:
+            receiver.join()
+        if out:
+            out.close()
+        if err:
+            err.close()
         _restore_signal_handlers(handlers)
         _combine_headless_transcript(paths)
     info = {**_headless_run_info(paths, spec, start, child.returncode), 'remote': target,

package/src/remote_worker.py

@@ -12,9 +12,26 @@ import sys
 import tempfile
 import threading
 import time
+import types
+from datetime import datetime, timezone
 
 # Supplied by the controller before this module is executed.
 SANDBOX_SOURCE = globals().get('SANDBOX_SOURCE', '')
+OBSERVATION_MODULES = globals().get('OBSERVATION_MODULES', {})
+OBSERVATION_LIMITS = globals().get('OBSERVATION_LIMITS', (128 * 1024 * 1024, 1))
+
+
+def observation_runtime():
+    # Load only controller-owned readers, with no worker installation required.
+    package = types.ModuleType('cdx_observation')
+    package.__path__ = []
+    sys.modules[package.__name__] = package
+    for name, source in OBSERVATION_MODULES.items():
+        module = types.ModuleType(package.__name__ + '.' + name)
+        module.__package__ = package.__name__
+        sys.modules[module.__name__] = module
+        exec(compile(source, name + '.py', 'exec'), module.__dict__)
+    return sys.modules[package.__name__ + '.run_usage'], sys.modules[package.__name__ + '.run_observation']
 
 
 def version():
@@ -144,6 +161,7 @@ def main():
                 ['codex', *args], pathlib.Path(payload['cwd']), network=payload['network'],
                 writable=payload['writable'], source=env, auth_home=str(home), provider='codex',
                 observation_home=str(home / 'sessions'))
+        started_at = datetime.now(timezone.utc).isoformat()
         child = subprocess.Popen(command, cwd=payload['cwd'], env=env,
                                  stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                                  start_new_session=True)
@@ -153,36 +171,36 @@ def main():
         secrets = [value for value in auth['tokens'].values() if isinstance(value, str) and value]
 
         output_lock = threading.Lock()
-        observed = {}
+        usage_reader, observation_reader = observation_runtime()
+        stdout_path = home / 'stdout.jsonl'
+        stdout_path.touch(mode=0o600)
 
         def snapshot():
-            # Only the fresh per-run home supplies model evidence. No transcript
-            # or authentication content leaves the worker.
+            # Read the same exact-thread evidence as the local supervisor before
+            # volatile storage is removed. Only normalized metadata is exported.
             with output_lock:
-                identifier = observed.get('thread_id')
-                usage = observed.get('usage')
-                if not identifier or not usage:
-                    return
-                for path in (home / 'sessions').rglob('*.jsonl'):
-                    if path.is_symlink() or path.stat().st_size > 16 * 1024 * 1024:
-                        continue
-                    try:
-                        records = [json.loads(line) for line in path.read_text().splitlines()]
-                    except (OSError, ValueError):
-                        continue
-                    if not any(row.get('type') == 'session_meta' and row.get('payload', {}).get('id') == identifier for row in records):
-                        continue
-                    contexts = [row.get('payload', {}) for row in records if row.get('type') == 'turn_context']
-                    models = {row.get('model') for row in contexts}
-                    counts = [row.get('payload', {}).get('info', {}).get('total_token_usage') for row in records
-                              if row.get('type') == 'event_msg' and row.get('payload', {}).get('type') == 'token_count']
-                    if (len(models) == 1 and None not in models and counts and counts[-1]
-                            and all(counts[-1].get(key) == usage.get(key) for key in ('input_tokens', 'output_tokens', 'cached_input_tokens'))):
-                        event = json.dumps({'type': 'cdx.remote.usage', 'usage': usage, 'model': next(iter(models))})
-                        for secret in secrets:
-                            event = event.replace(secret, '[REDACTED]')
-                        print(event, flush=True)
-                    return
+                usage = usage_reader.extract_run_usage('codex', stdout_path)
+                identifier = usage_reader.extract_run_conversation_id('codex', stdout_path)
+                evidence = {'source': 'isolated_codex_rollout', 'thread_id': identifier,
+                            'started_at': started_at, 'usage': usage, 'models': [], 'turns': []}
+                if identifier:
+                    paths = []
+                    deadline = time.monotonic() + OBSERVATION_LIMITS[1]
+                    for directory, subdirs, names in os.walk(home / 'sessions'):
+                        if time.monotonic() > deadline:
+                            paths = []
+                            break
+                        subdirs[:] = [name for name in subdirs if name != 'subagents']
+                        paths.extend(pathlib.Path(directory) / name for name in names
+                                     if name.startswith('rollout-') and name.endswith(f'-{identifier}.jsonl'))
+                        if len(paths) > 1:
+                            break
+                    if len(paths) == 1:
+                        evidence = observation_reader.codex_rollout_evidence(home, paths[0], evidence, OBSERVATION_LIMITS[0])
+                event = json.dumps({'stream': 'observation', 'evidence': evidence})
+                for secret in secrets:
+                    event = event.replace(secret, '[REDACTED]')
+                print(event, flush=True)
 
         def forward(source, target):
             for line in iter(source.readline, b''):
@@ -190,16 +208,13 @@ def main():
                     line = line.replace(secret.encode(), b'[REDACTED]')
                 with output_lock:
                     if target is sys.stdout:
-                        try:
-                            event = json.loads(line)
-                            if event.get('type') == 'thread.started':
-                                observed['thread_id'] = event.get('thread_id')
-                            if event.get('type') == 'turn.completed':
-                                observed['usage'] = event.get('usage')
-                        except (ValueError, AttributeError):
-                            pass
-                    target.buffer.write(line)
-                    target.buffer.flush()
+                        with stdout_path.open('ab') as capture:
+                            capture.write(line)
+                        # Frame provider output so it cannot forge supervisor evidence.
+                        print(json.dumps({'stream': 'stdout', 'data': line.decode('utf-8', errors='replace')}), flush=True)
+                    else:
+                        target.buffer.write(line)
+                        target.buffer.flush()
 
         threads = [threading.Thread(target=forward, args=pair) for pair in
                    ((child.stdout, sys.stdout), (child.stderr, sys.stderr))]

package/src/run_observation.py

@@ -6,8 +6,6 @@ import stat
 from datetime import datetime, timezone
 from pathlib import Path
 
-from .history_models import _exact_transcript
-from .interactive_usage import MAX_TRANSCRIPT_BYTES
 from .run_usage import _usage_from_dict, extract_run_conversation_id, extract_run_usage
 
 
@@ -31,6 +29,9 @@ def codex_attempt_evidence(auth_home, stdout_path, started_at):
     Do not import claimed costs, requested models, messages, or arbitrary files
     from the workspace. The exported object is never writable by the sandbox.
     """
+    from .history_models import _exact_transcript
+    from .interactive_usage import MAX_TRANSCRIPT_BYTES
+
     usage = extract_run_usage("codex", stdout_path)
     identifier = extract_run_conversation_id("codex", stdout_path)
     evidence = {"source": "isolated_codex_rollout", "stdout_path": str(stdout_path),
@@ -41,6 +42,14 @@ def codex_attempt_evidence(auth_home, stdout_path, started_at):
     path, error = _exact_transcript("codex", auth_home, identifier)
     if error or not path:
         return evidence
+    return codex_rollout_evidence(auth_home, path, evidence, MAX_TRANSCRIPT_BYTES)
+
+
+def codex_rollout_evidence(auth_home, path, evidence, max_bytes):
+    """Validate exact-attempt rollout evidence identically on local and remote hosts."""
+    usage = evidence["usage"]
+    identifier = evidence["thread_id"]
+    started_at = evidence["started_at"]
     models = set()
     turns = []
     identity = False
@@ -52,8 +61,8 @@ def codex_attempt_evidence(auth_home, stdout_path, started_at):
         with os.fdopen(descriptor, encoding="utf-8") as handle:
             if not stat.S_ISREG(os.fstat(handle.fileno()).st_mode):
                 return evidence
-            text = handle.read(MAX_TRANSCRIPT_BYTES + 1)
-        if len(text) > MAX_TRANSCRIPT_BYTES:
+            text = handle.read(max_bytes + 1)
+        if len(text) > max_bytes:
             return evidence
         for line in text.splitlines():
             record = json.loads(line)

package/src/update_all.py

@@ -2,19 +2,24 @@
 
 import json
 import os
+import platform
 import re
 import shutil
 import subprocess
+from urllib.parse import urlencode, urlparse
+from urllib.request import Request, urlopen
 
 from .config import PROVIDER_ANTIGRAVITY, PROVIDER_CLAUDE, PROVIDER_CODEX, PROVIDER_OLLAMA
 
 _TOOLS = (
-    (PROVIDER_CODEX, "codex", None, ["codex", "update"]),
-    (PROVIDER_CLAUDE, "claude", "claude", ["brew", "upgrade", "--cask", "claude"]),
-    (PROVIDER_ANTIGRAVITY, "agy", "antigravity", ["brew", "upgrade", "--cask", "antigravity"]),
-    (PROVIDER_OLLAMA, "ollama", "ollama", ["brew", "upgrade", "ollama"]),
-    ("rtk", "rtk", "rtk", ["brew", "upgrade", "rtk"]),
+    (PROVIDER_CODEX, "codex"),
+    (PROVIDER_CLAUDE, "claude"),
+    (PROVIDER_ANTIGRAVITY, "agy"),
+    (PROVIDER_OLLAMA, "ollama"),
+    ("rtk", "rtk"),
 )
+_SOURCE_TIMEOUT = 5
+_ANTIGRAVITY_RELEASES = "https://antigravity-auto-updater-974169037036.us-central1.run.app/releases"
 _PONYTAIL_URL = "https://github.com/DietrichGebert/ponytail.git"
 
 
@@ -41,45 +46,76 @@ def _run(command, env, runner=None, timeout=15):
     return {"returncode": result.returncode, "stdout": result.stdout or "", "stderr": result.stderr or ""}
 
 
+def _parse_version(value):
+    if isinstance(value, str) and re.fullmatch(r"v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?", value):
+        return value.lstrip("v")
+    return None
+
+
 def _version(command, env, runner):
-    result = _run([command, "--version"], env, runner)
+    result = _run([command, "--version"], env, runner, timeout=_SOURCE_TIMEOUT)
+    if result["returncode"]:
+        return None
     text = (result["stdout"] or result["stderr"] or "").strip()
-    match = re.search(r"\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b", text)
-    return match.group(1) if match else None
+    # Ollama can print the server version before the CLI version.
+    client = re.search(r"client version is (\S+)", text)
+    match = client or re.search(r"\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b", text)
+    return _parse_version(match.group(1)) if match else None
 
 
-def _npm_latest(package, env, runner):
-    if not _which("npm", env):
+def _fetch_json(url):
+    request = Request(url, headers={"Accept": "application/json", "User-Agent": "cdx-manager-update-check"})
+    with urlopen(request, timeout=_SOURCE_TIMEOUT) as response:
+        return json.loads(response.read(1024 * 1024))
+
+
+def _latest_version(name):
+    try:
+        if name in (PROVIDER_CODEX, PROVIDER_CLAUDE):
+            package = "@openai/codex" if name == PROVIDER_CODEX else "@anthropic-ai/claude-code"
+            return _parse_version(_fetch_json(f"https://registry.npmjs.org/{package}/latest")["version"])
+        if name == "rtk":
+            release = _fetch_json("https://api.github.com/repos/rtk-ai/rtk/releases/latest")
+            if release.get("draft") or release.get("prerelease"):
+                return None
+            return _parse_version(release["tag_name"])
+        if name == PROVIDER_ANTIGRAVITY:
+            # agy belongs to the original editor, whose feed differs from Hub and IDE 2.
+            return _parse_version(_fetch_json(_ANTIGRAVITY_RELEASES)[0]["version"])
+        if name == PROVIDER_OLLAMA:
+            arch = {"x86_64": "amd64", "aarch64": "arm64"}.get(platform.machine().lower(), platform.machine().lower())
+            query = urlencode({"os": platform.system().lower(), "arch": arch, "version": "0.0.0"})
+            release = _fetch_json(f"https://ollama.com/api/update?{query}")
+            # The vendor updater extracts the release tag from the artifact URL.
+            return _parse_version(os.path.basename(os.path.dirname(urlparse(release["url"]).path)))
+    except Exception:
+        # A failed or changed source is uncertainty, never evidence of currency.
         return None
-    result = _run(["npm", "view", package, "version"], env, runner)
-    value = (result["stdout"] or "").strip()
-    return value if re.fullmatch(r"\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?", value) else None
+    return None
 
 
 def _newer(latest, current):
     def key(value):
-        return tuple(int(part) for part in str(value).split("-", 1)[0].split("+", 1)[0].split("."))
+        return tuple(int(part) for part in value.split("-", 1)[0].split("+", 1)[0].split("."))
     return bool(latest and current and key(latest) > key(current))
 
 
-def _brew_outdated(env, runner):
-    if not _which("brew", env):
-        return {}
-    result = _run(["brew", "outdated", "--json=v2"], env, runner, timeout=30)
-    try:
-        payload = json.loads(result["stdout"])
-    except (TypeError, ValueError):
-        return {}
-    rows = {}
-    for group in ("formulae", "casks"):
-        for item in payload.get(group, []):
-            rows[item.get("name")] = item
-    return rows
-
-
-def _brew_cask_for_path(path):
-    match = re.search(r"/Caskroom/([^/]+)/", os.path.realpath(path or ""))
-    return match.group(1) if match else None
+def _native_update_command(name, command, path, env, runner):
+    real_path = os.path.realpath(path)
+    cask = re.search(r"/Caskroom/([^/]+)/", real_path)
+    formula = re.search(r"/Cellar/([^/]+)/", real_path)
+    if (cask or formula) and _which("brew", env):
+        package = (cask or formula).group(1)
+        return ["brew", "upgrade", *(["--cask"] if cask else []), package]
+    if name == PROVIDER_CODEX:
+        return [command, "update"]
+    help_result = _run([command, "--help"], env, runner, timeout=_SOURCE_TIMEOUT)
+    if help_result["returncode"] == 0:
+        help_text = help_result["stdout"]
+        for subcommand in ("self-update", "update", "--update"):
+            if re.search(r"(?m)^\s*" + re.escape(subcommand) + r"(?:\s|$)", help_text):
+                return [command, subcommand]
+    return None
 
 
 def _ponytail_revision(auth_home, env=None, runner=None):
@@ -99,26 +135,27 @@ def _ponytail_revision(auth_home, env=None, runner=None):
 
 def collect_update_all_plan(service, env=None, runner=None):
     env = dict(env or os.environ)
-    outdated = _brew_outdated(env, runner)
     items, steps = [], []
-    for name, command, brew_name, update_command in _TOOLS:
+    for name, command in _TOOLS:
         path = _which(command, env)
-        item = {"name": name, "command": command, "installed": bool(path), "path": path, "version": _version(command, env, runner) if path else None}
-        cask_name = _brew_cask_for_path(path)
-        brew_target = cask_name or brew_name
-        brew_row = outdated.get(brew_target) if brew_target else None
-        if brew_row:
-            command_to_run = ["brew", "upgrade", "--cask", brew_target] if cask_name else update_command
-            item.update({"status": "update_available", "latest_version": brew_row.get("current_version"), "update_command": command_to_run, "package": brew_target})
-            steps.append({"name": name, "command": command_to_run, "env": {}})
-        elif path and name == PROVIDER_CODEX:
-            # Codex owns its installer; it is the only reliable updater across npm, Homebrew and standalone installs.
-            latest = _npm_latest("@openai/codex", env, runner)
-            item.update({"latest_version": latest, "status": "update_available" if _newer(latest, item["version"]) else "up_to_date" if latest else "check_with_native_updater", "update_command": update_command})
-            if item["status"] != "up_to_date":
-                steps.append({"name": name, "command": update_command, "env": {}})
-        else:
-            item["status"] = "up_to_date" if path else "not_installed"
+        current = _version(command, env, runner) if path else None
+        item = {"name": name, "command": command, "installed": bool(path), "path": path,
+                "version": current, "latest_version": None, "update_command": None, "status": "not_installed"}
+        if path:
+            latest = _latest_version(name)
+            item["latest_version"] = latest
+            if latest and current and latest == current:
+                item["status"] = "up_to_date"
+            elif _newer(latest, current):
+                item["status"] = "update_available"
+                item["update_command"] = _native_update_command(name, command, path, env, runner)
+                if item["update_command"]:
+                    steps.append({"name": name, "command": item["update_command"], "env": {}})
+                else:
+                    item["reason"] = "No supported CLI updater or verified Homebrew installation; use the vendor's updater manually."
+            else:
+                item["status"] = "unknown"
+                item["reason"] = "Latest version unavailable from the official source." if not latest else "Installed version unavailable or does not match the published release."
         items.append(item)
 
     rtk_available = any(item["name"] == "rtk" and item["installed"] for item in items)
@@ -131,13 +168,14 @@ def collect_update_all_plan(service, env=None, runner=None):
     ponytail_head = None
     if any(_ponytail_revision(session.get("authHome") or "", env, runner) for session in codex_sessions):
         remote = _run(["git", "ls-remote", _PONYTAIL_URL, "HEAD"], env, runner)
-        ponytail_head = (remote["stdout"] or "").split("\t", 1)[0].strip() or None
+        candidate = (remote["stdout"] or "").split("\t", 1)[0].strip()
+        ponytail_head = candidate if remote["returncode"] == 0 and re.fullmatch(r"[0-9a-f]{40}", candidate) else None
     for session in codex_sessions:
         revision = _ponytail_revision(session.get("authHome") or "", env, runner)
         row = {"session": session["name"], "installed": bool(revision), "revision": revision}
         if revision:
             row["latest_revision"] = ponytail_head
-            row["status"] = "update_available" if ponytail_head and not ponytail_head.startswith(revision) else "up_to_date"
+            row["status"] = "update_available" if ponytail_head and not ponytail_head.startswith(revision) else "up_to_date" if ponytail_head else "unknown"
             if row["status"] == "update_available":
                 steps.append({"name": f"update Ponytail ({session['name']})", "command": ["codex", "plugin", "marketplace", "upgrade", "ponytail", "--json"], "env": {"CODEX_HOME": session["authHome"]}})
         else: