cdx-manager 0.25.7 → 0.25.8

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.25.7-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.25.8-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **The right AI coding account, when you need it.** CDX Manager keeps your Codex and Claude accounts in separate profiles, shows which ones have quota, and helps you pick the next usable session from your terminal.
 

package/VERSION

@@ -1 +1 @@
-0.25.7
+0.25.8

package/changelogs/CHANGELOGS_0_25_8.md

@@ -0,0 +1,15 @@
+# CDX Manager 0.25.8
+
+Release date: 2026-11-02
+
+This patch release restores Git history and RTK access in isolated workspaces.
+
+## Fixes
+
+- Restore read-only Git history access in isolated local and remote workspaces, including linked worktrees with packed objects and refs. Keep Git metadata read-only and exclude host configuration, hooks, remotes, and credentials. (#91)
+- Expose the installed RTK binary in isolated launches and persist its savings history in a dedicated shared cache, separate from the operator's normal RTK history. (#91)
+
+## Maintenance
+
+- Record tray companion checksums for v0.25.7. (`31b7ecfb8f8189f29b01aaa88f9acf866acccd19`)
+- Record release archive checksums for v0.25.7. (`03d339b9e93e2d7d917df6e614132390ce4436fe`)

package/changelogs/CHANGELOGS_UNRELEASED.md

@@ -1,5 +1,11 @@
 # Unreleased
 
+## Isolated mission Git and RTK
+
+- Give local and remote isolated linked worktrees a read-only Git view with their own HEAD/index and shared objects/refs, without traversing private host parents or exposing repository/global configuration, hooks, SSH keys or Git push credentials. Preserve supervisor-owned commits and pushes.
+- Add the mounted operator `~/.local/bin` to sandbox PATH and persist RTK savings in the execution host's shared cache at `/cache/rtk/history.db`, overriding inaccessible host history paths for isolated launches only.
+- Cover real Git commands against selected metadata, local and shipped worker launch environments, and an opt-in required bubblewrap acceptance check for Git, RTK history writes, review mode and an unreadable synthetic SSH key. Document the namespace requirement and sandbox history location.
+
 ## Truthful workstation updates
 
 - Stop querying the editor release feed for the Antigravity CLI: its versions do not match `agy`. Keep `latest_version: null` and `status: unknown`, while still running the native `agy update` with `--yes` or confirmation. No read-only latest-version check is documented by `agy update --help`.

package/checksums/release-archives.json

@@ -760,6 +760,17 @@
         "x86_64-pc-windows-msvc": "5c3c4be1dcf6801ed0ed73bef8840deb379e2724d9728f983498d0fe5a99c542",
         "x86_64-unknown-linux-musl": "ba91c1378b78e529da3af35c7e649ed2063ba27963ef91949f1aabe9e3fe2a0f"
       }
+    },
+    "v0.25.7": {
+      "github_tarball_sha256": "e9a943ca212e0706f5a3ad29d9be99b8bf5293836d4f082dddd797e122475310",
+      "github_zip_sha256": "19eb0266ed35aae2386fd9d90079a7be5dbc44a3b44249615c244fc7c4f7d85f",
+      "tray_assets": {
+        "aarch64-apple-darwin": "9fa198f0133ac40747fb00f4353af174b45b550ebef4662398b84aa9459e2388",
+        "aarch64-unknown-linux-musl": "c4ccba259e7f910bd5a2ce8abfa2045ba4ad9b975da7dea2c8dfc0ba1bd5bbfc",
+        "x86_64-apple-darwin": "1341e59d8da3489368e22c85c9ea3d974254c810d3b68077b2e1b02d2c9aee5a",
+        "x86_64-pc-windows-msvc": "be2e6ff8607351019447c6fbf0622254c2f8d8db81581007af71b74932e37f50",
+        "x86_64-unknown-linux-musl": "32de07569929ade136cf75ed8f0716e0f3b96a9c53c6632c628e13782d223518"
+      }
     }
   }
 }

package/docs/operations.md

@@ -242,6 +242,45 @@ credential sync.
 - **On Windows, `doctor` warns that `script` is missing** — this is expected on many setups. Codex still launches, but transcript capture stays disabled unless you point `CDX_SCRIPT_BIN` to a compatible wrapper.
 
 
+### Git and RTK in isolated workspaces
+
+Local and remote `cdx run --isolate-workspace` use the same sandbox implementation.
+For a linked Git worktree, CDX builds a read-only Git view at `/home/agent/.git`:
+the mission's HEAD and index, plus the common objects, refs, packed refs, shallow
+boundary and split-index files. `GIT_DIR`, `GIT_COMMON_DIR` and `GIT_WORK_TREE`
+select that view without traversing the operator's private home directories.
+`git log`, `show`, `diff`, `status`, `blame`, `branch` and `rev-parse` can read
+the mission history, including packed objects and refs. Review runs also keep
+checkout files read-only. Git metadata stays read-only in writable missions,
+as before: committing and pushing remain the supervising mission flow's job.
+
+Host repository configuration, hooks, other worktrees, global Git configuration,
+SSH keys, credential helpers and token environment variables are not added.
+The view has no configured remotes. Existing provider authentication rules are
+unchanged; this does not grant Git push credentials.
+
+The sandbox appends the mounted operator `~/.local/bin` to PATH, including for
+noninteractive remote launches whose PATH omits it. An installed `rtk` is thus
+available without installing a second copy. Isolated launches override
+`RTK_DB_PATH` with `/cache/rtk/history.db`, backed by
+`~/.cdx/shared-cache/rtk/history.db` on the execution host. Savings persist
+across isolated attempts; the operator's normal RTK history is not mounted.
+Inspect them with `RTK_DB_PATH="$HOME/.cdx/shared-cache/rtk/history.db" rtk gain`
+on that host. Non-isolated launches keep their normal history selection.
+
+Run the real confinement acceptance check on a Linux host with bubblewrap and
+RTK installed (it uses disposable fixtures and synthetic secrets):
+
+```bash
+CDX_REQUIRE_SANDBOX_TESTS=1 python3 -m pytest -q test/test_workspace_sandbox_tools_py.py
+```
+
+It exercises the local and shipped worker implementations, writable and review
+checkouts, Git history commands, RTK database writes, and denial of a synthetic
+SSH key outside the checkout. The required mode fails rather than skipping
+when nested namespaces or RTK are unavailable. Default test runs skip only
+those unavailable integration cases; copied-metadata Git checks still run.
+
 ### Playwright in isolated workspaces
 
 Isolated preparation and provider environments force `PLAYWRIGHT_SKIP_BROWSER_GC=1`.

package/docs/sessions-and-notifications.md

@@ -154,7 +154,7 @@ cdx power all default
 cdx model provider:ollama default
 ```
 
-`--model` maps to Codex `--model`, Claude `--model`, and Ollama `ollama run <model>`. `--power` maps to Codex `model_reasoning_effort` and Claude `--effort`; supported values are `minimal`, `low`, `medium`, `high`, and `xhigh`. `--permission` maps to provider-native permission flags. Codex Fast mode is separate from reasoning effort: `--fast on` opts a Codex session into the Codex Fast service tier, while new sessions, `--fast off`, and default launches force the non-Fast `flex` tier. Use `--power low` when you want low reasoning effort without enabling Codex Fast credits. Existing legacy sessions that stored `fast=on` before this split continue to behave as low effort unless the user explicitly sets `--fast on` again. `--priority` is a 0..100 selector preference used as a tie-breaker after readiness and availability. `--policy use|ask-first|never` (default `use`) says whether cdx may pick an account on your behalf: `cdx next`, `cdx select`, `cdx run --provider` and run failover only ever choose `use` accounts; `ask-first` accounts are offered by `cdx rescue` with a confirmation, `never` accounts are not offered at all. Naming an account explicitly (`cdx <name>`, `cdx run <name>`) is always allowed. `--rtk on` adds standing guidance that encourages assistants to use RTK (`rtk <command>`) for noisy terminal commands when RTK is available, while keeping raw commands for exact output. Logics guidance is auto-enabled when `logics-manager` is available; use `--logics off` to disable that guidance for a session, or `--logics on` to pin it explicitly. This guidance is passed as instructions, never as a first message: Claude receives it through `--append-system-prompt` and Codex through `-c developer_instructions=...`, appended after any `developer_instructions` already set in the profile's `config.toml` (on Python older than 3.11 without `tomli`, a profile that sets its own is left untouched and gets no cdx guidance). Launching or resuming a session therefore never submits a turn on your behalf. Antigravity and Ollama have no instruction channel and receive no guidance. Whatever the `--rtk` setting, every launch, resume and `cdx run` sets `RTK_DB_PATH` to the rtk history of your real home (`~/Library/Application Support/rtk/history.db` on macOS, `~/.local/share/rtk/history.db` on Linux, `%LOCALAPPDATA%\rtk\history.db` on Windows), so `rtk gain` in your own shell counts what every account saved instead of each profile keeping its own; an `RTK_DB_PATH` you set yourself is kept. If you also pass `--append-system-prompt` through `--extra-args`, Claude receives the option twice; prefer putting your own text in the profile's `CLAUDE.md`.
+`--model` maps to Codex `--model`, Claude `--model`, and Ollama `ollama run <model>`. `--power` maps to Codex `model_reasoning_effort` and Claude `--effort`; supported values are `minimal`, `low`, `medium`, `high`, and `xhigh`. `--permission` maps to provider-native permission flags. Codex Fast mode is separate from reasoning effort: `--fast on` opts a Codex session into the Codex Fast service tier, while new sessions, `--fast off`, and default launches force the non-Fast `flex` tier. Use `--power low` when you want low reasoning effort without enabling Codex Fast credits. Existing legacy sessions that stored `fast=on` before this split continue to behave as low effort unless the user explicitly sets `--fast on` again. `--priority` is a 0..100 selector preference used as a tie-breaker after readiness and availability. `--policy use|ask-first|never` (default `use`) says whether cdx may pick an account on your behalf: `cdx next`, `cdx select`, `cdx run --provider` and run failover only ever choose `use` accounts; `ask-first` accounts are offered by `cdx rescue` with a confirmation, `never` accounts are not offered at all. Naming an account explicitly (`cdx <name>`, `cdx run <name>`) is always allowed. `--rtk on` adds standing guidance that encourages assistants to use RTK (`rtk <command>`) for noisy terminal commands when RTK is available, while keeping raw commands for exact output. Logics guidance is auto-enabled when `logics-manager` is available; use `--logics off` to disable that guidance for a session, or `--logics on` to pin it explicitly. This guidance is passed as instructions, never as a first message: Claude receives it through `--append-system-prompt` and Codex through `-c developer_instructions=...`, appended after any `developer_instructions` already set in the profile's `config.toml` (on Python older than 3.11 without `tomli`, a profile that sets its own is left untouched and gets no cdx guidance). Launching or resuming a session therefore never submits a turn on your behalf. Antigravity and Ollama have no instruction channel and receive no guidance. Whatever the `--rtk` setting, every launch, resume and `cdx run` sets `RTK_DB_PATH` to the rtk history of your real home (`~/Library/Application Support/rtk/history.db` on macOS, `~/.local/share/rtk/history.db` on Linux, `%LOCALAPPDATA%\rtk\history.db` on Windows), so `rtk gain` in your own shell counts what every account saved instead of each profile keeping its own; an `RTK_DB_PATH` you set yourself is kept. Isolated workspace runs instead use the execution host's shared-cache RTK database at `/cache/rtk/history.db`; see [Git and RTK in isolated workspaces](operations.md#git-and-rtk-in-isolated-workspaces). If you also pass `--append-system-prompt` through `--extra-args`, Claude receives the option twice; prefer putting your own text in the profile's `CLAUDE.md`.
 
 ## Terminal Titles
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.25.7",
+  "version": "0.25.8",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.25.7"
+version = "0.25.8"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9.2"

package/src/workspace_sandbox.py

@@ -71,12 +71,14 @@ def private_auth_home(auth):
 def clean_env(source: dict) -> dict:
     allowed = ("PATH", "LANG", "LC_ALL", "TERM", "TZ")
     env = {key: source[key] for key in allowed if key in source}
+    env["PATH"] = source.get("PATH", os.defpath) + os.pathsep + str(Path.home() / ".local/bin")
     env.update(HOME="/home/agent", XDG_CONFIG_HOME="/home/agent/.config",
                XDG_CACHE_HOME="/cache", GIT_CONFIG_NOSYSTEM="1",
                GIT_CONFIG_GLOBAL="/dev/null", GIT_TERMINAL_PROMPT="0", GIT_OPTIONAL_LOCKS="0",
                GIT_CONFIG_COUNT="1", GIT_CONFIG_KEY_0="credential.helper", GIT_CONFIG_VALUE_0="",
                GH_CONFIG_DIR="/home/agent/.config/gh", NPM_CONFIG_CACHE="/cache/npm",
                PIP_CACHE_DIR="/cache/pip", UV_CACHE_DIR="/cache/uv",
+               RTK_DB_PATH="/cache/rtk/history.db",
                # Cache users have different mount paths; their GC cannot identify each other's browsers.
                PLAYWRIGHT_BROWSERS_PATH="/cache/playwright", PLAYWRIGHT_SKIP_BROWSER_GC="1", CI="1")
     return env
@@ -85,7 +87,8 @@ def clean_env(source: dict) -> dict:
 def sandbox_command(command: list[str], tree: Path, *, network: bool, writable: bool = True,
                     source: dict | None = None, auth_home: str = "", provider: str = "", observation_home: str = "") -> tuple[list[str], dict]:
     source = os.environ if source is None else source
-    binary = shutil.which(command[0], path=source.get("PATH"))
+    env = clean_env(source)
+    binary = shutil.which(command[0], path=env["PATH"])
     bwrap = shutil.which("bwrap", path=source.get("PATH"))
     if not binary or not bwrap:
         raise RuntimeError("Workspace isolation requires bubblewrap and " + command[0])
@@ -93,6 +96,7 @@ def sandbox_command(command: list[str], tree: Path, *, network: bool, writable:
         raise RuntimeError("Workspace must be a directory")
     tree = tree.resolve()
     CACHE.mkdir(parents=True, exist_ok=True)
+    (CACHE / "rtk").mkdir(exist_ok=True)
     # Provider transport uses the same restricted egress, even for read-only tools.
     online = bool(network or provider)
     if online:
@@ -137,15 +141,24 @@ def sandbox_command(command: list[str], tree: Path, *, network: bool, writable:
                 or common.is_relative_to(tree) or common.is_relative_to(CACHE.resolve())
                 or Path((gitdir / "gitdir").read_text().strip()).resolve() != marker):
             raise RuntimeError("Invalid external worktree Git directory")
-        args += ["--ro-bind", str(marker), str(marker), "--ro-bind", str(common), str(common),
-                 "--tmpfs", str(common / "worktrees"), "--ro-bind", str(gitdir), str(gitdir),
-                 "--ro-bind", "/dev/null", str(common / "config"),
-                 "--tmpfs", str(common / "hooks")]
-        if (gitdir / "config.worktree").exists():
-            args += ["--ro-bind", "/dev/null", str(gitdir / "config.worktree")]
+        # Use sandbox-owned parents rather than traversing private host homes.
+        # Do not expose repository config (remote URLs/helpers/includes), hooks,
+        # other worktrees, or the source checkout. Git remains read-only.
+        private_git = Path("/home/agent/.git")
+        args += ["--ro-bind", str(marker), str(marker), "--dir", str(private_git)]
+        # Combine this worktree's HEAD/index with shared history, without any
+        # commondir/gitdir pointers back into the host filesystem.
+        for origin, names in (
+            (gitdir, ["HEAD", "index", *[p.name for p in gitdir.glob("sharedindex.*")]]),
+            (common, ["objects", "refs", "packed-refs", "shallow", *[p.name for p in common.glob("sharedindex.*")]]),
+        ):
+            for name in names:
+                if (origin / name).exists():
+                    args += ["--ro-bind", str(origin / name), str(private_git / name)]
+        env.update(GIT_DIR=str(private_git), GIT_COMMON_DIR=str(private_git),
+                   GIT_WORK_TREE=str(tree))
     elif marker.exists():
         raise RuntimeError("Expected an isolated git worktree")
-    env = clean_env(source)
     if provider == "codex":
         auth_path = Path(auth_home) / "auth.json"
         if json.loads(auth_path.read_text()).get('tokens', {}).get('refresh_token') != '':