cdx-manager 0.25.8 → 0.25.9

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.25.8-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.25.9-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **The right AI coding account, when you need it.** CDX Manager keeps your Codex and Claude accounts in separate profiles, shows which ones have quota, and helps you pick the next usable session from your terminal.
 
@@ -89,7 +89,7 @@ Recovery does not require `--failover`, which still controls account quota exhau
 
 Contributions are welcome; see [CONTRIBUTING.md](CONTRIBUTING.md). CDX Manager is [MIT licensed](LICENSE).
 
-### Run Codex on an SSH worker
+### Run Codex or Ollama on an SSH worker
 
 ```sh
 cdx run work --remote agent@worker --cwd /srv/project --prompt 'Run the checks' --json
@@ -106,12 +106,12 @@ not synchronized. Use `--project` to explicitly attribute a remote checkout to a
 project. Remote runs do not retry or fail over automatically, including when
 `--failover` is supplied.
 
-Requirements: a POSIX controller with `ssh` and Codex on PATH, and a Linux worker
+For Codex: a POSIX controller with `ssh` and Codex on PATH, and a Linux worker
 with Python 3, memory-backed `/dev/shm`, and exactly the same `codex --version`.
 Configure SSH keys, host trust and aliases in advance; the connection uses batch
 mode and bounded connection/keepalive timeouts. Provider refusal, unreachable
-workers and version mismatches fail before sending credentials. Only Codex OAuth
-profiles are supported. Remote continuation is refused because the temporary home
+workers and version mismatches fail before sending credentials. Codex requires an OAuth
+profile. Remote continuation is refused because the temporary home
 does not preserve conversation rollouts. Codex's native permission sandbox still
 applies to ordinary remote runs.
 
@@ -123,7 +123,32 @@ Only a short, double-quoted Python bootstrap is sent in the SSH command line;
 the worker and shared sandbox source are framed on stdin before the payload.
 Neither source size nor prompt size consumes cmd.exe's 8191-character command limit.
 
-`--remote` supports `--isolate-workspace` using the same local isolation mechanism:
+Remote Ollama profiles also support headless text generation:
+
+```bash
+cdx run local --remote worker --cwd /srv/project --model qwen3:8b --prompt-file question.txt --isolate-workspace --json
+```
+
+Here `local` is an existing Ollama profile. The named model must already be
+installed on the worker's unauthenticated `127.0.0.1:11434` Ollama API; CDX
+never downloads a missing model and rejects cloud-backed models. The prompt
+file is read on the launching host and sent as content over SSH. This path
+uses `/api/show` and `/api/chat` with `stream: false`, without an Ollama CLI or
+Codex installation. Results identify `execution_mode: "text_generation"` and
+include generated text in `result`, plus `prompt_eval_count` / `eval_count`
+and normalized input/output token counts in `usage`.
+
+Ollama is not an autonomous coding agent and does not edit the repository.
+With `--isolate-workspace`, the checkout is read-only and the client has its
+own network namespace without network access, including when `--network-access`
+is supplied. A private Unix socket connects it to a supervisor-owned relay
+with the fixed loopback destination and only the selected model's capability
+and non-streaming inference calls allowed. Pull, delete, push, arbitrary URLs,
+proxying and redirects are refused. No `~/.ollama` directory or model files
+are mounted. The relay is removed on completion or cancellation. Remote
+continuation remains unsupported; an explicit model or profile model is required.
+
+Codex `--remote` supports `--isolate-workspace` using the same local isolation mechanism:
 bubblewrap, pasta (passt), nftables, Python, the checkout/toolchain allowlist,
 and an actual namespace/network setup using a dummy credential. Missing dependencies,
 namespace denial or invalid checkouts fail before sending real credentials, without

package/VERSION

@@ -1 +1 @@
-0.25.8
+0.25.9

package/changelogs/CHANGELOGS_0_25_9.md

@@ -0,0 +1,22 @@
+# CDX Manager 0.25.9
+
+Release date: 2026-11-03
+
+This release expands isolated remote provider support and improves Antigravity
+quota, usage reporting, and update feedback.
+
+## Remote runs
+
+- Integrate worker-owned Antigravity headless runs with mandatory isolation, a volatile home, restricted inference networking, and redacted output. Keep worker credentials on the worker and preserve local profile authentication. Live worker acceptance measurements remain required before claiming production support. (#98)
+- Enable isolated remote Claude runs with a dedicated OAuth setup token stored on the controller and transported through stdin. Use a fresh memory-backed home per attempt, restrict inference traffic by default, and retain usage reporting and output redaction. (#95)
+- Add remote Ollama text generation with an explicitly selected installed worker model through a restricted local relay. Limit requests to model inspection and non-streaming chat; keep the checkout read-only and report generated text and token usage. This mode does not edit repositories or act as an autonomous coding agent. (#94)
+
+## Antigravity status and updates
+
+- Show Antigravity quota, reset times, and reading age from a local statusLine integration that preserves existing commands. Record native headless token counters, and identify stale or expired quota readings. (#96)
+- Keep successful `agy update` commands successful when no newer version can be verified. Report an `update_unverified` warning while retaining unknown latest-version status; non-zero updater exits still fail. (#93)
+
+## Maintenance
+
+- Record tray companion checksums for v0.25.8. (`d0c8d33b671234cf648da2b21b7bb0bfb0ce302e`)
+- Record release archive checksums for v0.25.8. (`20fb80c7d115500c8da5be433526e195063258d9`)

package/changelogs/CHANGELOGS_UNRELEASED.md

@@ -1,5 +1,24 @@
 # Unreleased
 
+## Antigravity quota and run usage
+
+- Install a local Antigravity statusLine command in new profiles and on interactive launch, merging settings and relaying the original stdin to any existing command so its output is preserved. Store only the reading time, plan tier and allowlisted quota fields in an atomic mode-600 profile file; never access Google internal endpoints or antigravity-oauth-token.
+- Show Gemini 5-hour and weekly remaining quota, reset times and reading age in status. Include all bucket names, including third-party buckets, in JSON. Mark readings older than 24 hours stale and suppress availability after a bucket's reset has passed.
+- Launch headless Antigravity with `agy -p --output-format json` and record its input, output, thinking, cache-read and reported total counters. Preserve the native total without assuming an undocumented cache or thinking subset relationship. Interactive quota is not per-run token usage.
+- Cover synthetic native payloads, missing/unknown buckets, stale and expired readings, settings merges, existing command output, private file permissions and headless observation.
+
+## Worker-owned Antigravity headless runs
+
+- Allow Antigravity profiles in remote runs with mandatory bubblewrap, explicit `agy -p --output-format json`, an owner-only worker token mounted read-only, and a volatile HOME. Never transport worker credentials to the controller; redact worker output before SSH forwarding. Hold a worker token lock across each attempt and disable automatic CLI updates.
+- Restrict inference to a conservative Google endpoint allowlist plus public DNS, including when tool network access is requested; retain private-range denial. The candidate list and read-only token policy require the live measurements documented in the mission fragment before claiming production acceptance.
+- Fail on absent/unsafe worker login, expired sessions, missing/non-success JSON status and refused actions. Normalize JSON usage through `run_usage` and preserve existing run artifacts/history. Cover fake worker success, refusal, expiry, secret redaction, locking, cleanup, local profile authentication and mount/network construction.
+
+## Remote Claude headless runs
+
+- Add `cdx auth claude-token <profile>` to store a dedicated `claude setup-token` value from stdin in a controller-only mode-600 profile file. Missing or unsafe tokens stop remote runs with this command as the remedy; worker login is unnecessary.
+- Allow remote Claude JSON headless execution with mandatory bubblewrap isolation, a fresh memory-backed HOME per attempt and no local profile mounts. Carry the token through SSH stdin and a sandbox stdin exec shim, exposing it only in Claude's environment, never worker credential files, argv or persisted output. Keep subprocess environment scrubbing, remove competing authentication/cloud/proxy sources, disable non-essential traffic and refuse `--bare`.
+- Allow inference HTTPS to resolved `api.anthropic.com` addresses and DNS by default; retain public tool-network access only when requested. Cover fake-worker usage parsing, output redaction, absent/unsafe token files, stdin storage, isolation construction and volatile cleanup after success, failure and timeout.
+
 ## Isolated mission Git and RTK
 
 - Give local and remote isolated linked worktrees a read-only Git view with their own HEAD/index and shared objects/refs, without traversing private host parents or exposing repository/global configuration, hooks, SSH keys or Git push credentials. Preserve supervisor-owned commits and pushes.
@@ -8,10 +27,11 @@
 
 ## Truthful workstation updates
 
+- Keep a zero-exit `agy update` successful when no expected newer CLI version is known, even if its installed version does not advance and its output cannot confirm currency. Preserve `status: unknown` and `latest_version: null`, expose an `update_unverified` warning in JSON and text, and continue failing non-zero updater exits. No additional version source is assumed.
 - Stop querying the editor release feed for the Antigravity CLI: its versions do not match `agy`. Keep `latest_version: null` and `status: unknown`, while still running the native `agy update` with `--yes` or confirmation. No read-only latest-version check is documented by `agy update --help`.
 - Accept a successful native updater's `You are already on the latest version.` message when the installed version is unchanged, or verify a version increase against the published version when known. Preserve updater failures and unknown inventory status. Cover the real Antigravity output line, version increases, failures, and JSON/text uncertainty.
 
-- Detect advertised native updater subcommands in both stdout and stderr; use Antigravity's known `agy update` command directly. Verify the installed CLI version after updating, fail unverified updates unless an unchanged version is explicitly confirmed current by the updater, and expose before/after versions without hiding major upgrades.
+- Detect advertised native updater subcommands in both stdout and stderr; use Antigravity's known `agy update` command directly. Verify the installed CLI version after updating, retain strict verification for providers with a known expected release, and expose before/after versions without hiding major upgrades.
 - Fall back from empty or failed Ollama vendor responses (including Linux HTTP 204) to the latest stable `ollama/ollama` GitHub release. Keep Linux updates manual with `update_available`, a null command, and a service-safety reason; never replace a potentially active binary or restart models automatically.
 
 - Verify latest versions from npm, RTK GitHub releases, and Ollama vendor update endpoints with short read-only probes. Report `unknown` on unavailable evidence; reserve `up_to_date` for identical known versions, including Ponytail revisions.
@@ -57,3 +77,9 @@
 - Keep snapshots independent of controller refresh during long missions, prohibit authentication writeback, enforce their original expiry, and remove temporary storage after success, failure and stop. Non-isolated local authentication remains unchanged.
 - Reject rotating credentials at the sandbox boundary. Test snapshot contents, permissions, cleanup, refresh lock ownership, concurrent controller refresh, remote isolation through fake SSH and missing dependency refusal.
 - The separately maintained remote-ops `scripts/workspace_sandbox.py` requires the same credential guard and run-private lifecycle integration; it is not shipped by this repository.
+
+## Remote Ollama text generation
+
+- Allow Ollama profiles in `cdx run --remote` with an explicitly selected, already installed local worker model and no authentication or Ollama/Codex CLI requirement. Read prompts on the launching host and use the HTTP capability/chat APIs with `stream: false`; retain generated text and prompt/evaluation token counters in run results and usage.
+- Add a worker-supervised private Unix socket relay restricted to the fixed `127.0.0.1:11434` destination, selected model, `/api/show` and non-streaming `/api/chat`. Refuse model management, alternate destinations and cloud-backed models. Isolated clients have no network access and mount neither Ollama profiles nor model files; their checkout is read-only.
+- State in CLI help and results that this is text generation, not an autonomous coding agent, with no repository edits. Cover success, usage, controller prompt content, missing models, forbidden relay calls, unreachable servers and sandbox relay construction with a fake HTTP API.

package/checksums/release-archives.json

@@ -771,6 +771,17 @@
         "x86_64-pc-windows-msvc": "be2e6ff8607351019447c6fbf0622254c2f8d8db81581007af71b74932e37f50",
         "x86_64-unknown-linux-musl": "32de07569929ade136cf75ed8f0716e0f3b96a9c53c6632c628e13782d223518"
       }
+    },
+    "v0.25.8": {
+      "github_tarball_sha256": "4a3e3eeb654a4590ea033e6d99337a57b9f255161ee2b9c9347e8def0d257868",
+      "github_zip_sha256": "ad2c7e8d1528f36f4be66320970522385ba3c0a473ab893475b174609ec05630",
+      "tray_assets": {
+        "aarch64-apple-darwin": "46e4e9ce2ce54d974dd3b77364fc97595b4d4388787c2e7486245374d342ff87",
+        "aarch64-unknown-linux-musl": "74afc63053dc3f6ca3fae010d8afc64c917cd37e71cc005dd8b9d3e9383b99e6",
+        "x86_64-apple-darwin": "990b305bf32d24e0126cb6f3fe42cd9858a6cd5dc460f41d0fb4419516324a40",
+        "x86_64-pc-windows-msvc": "9577f9dff7d457094276376f262904dad8c9aff95ed2ca87b834c9c900fb5493",
+        "x86_64-unknown-linux-musl": "db7e322037041c2a898043f0c7a691c22cab6a794aab5b2439a06ac91e92fa39"
+      }
     }
   }
 }

package/docs/cli.md

@@ -19,6 +19,7 @@
 | `cdx label <name> --clear [--json]` | Clear a session label |
 | `cdx login <name> [--json]` | Re-authenticate a session (logout + login) |
 | `cdx logout <name> [--json]` | Log out of a session |
+| `cdx auth claude-token <profile> [--json]` | Store a dedicated remote Claude setup token from stdin in a private controller profile file |
 | `cdx auth refresh <name\|all> [--json]` | Make a locked, non-generation Codex auth probe; reports `login_required` when interactive login is needed |
 | `cdx disable <name> [--json]` | Disable a session without deleting it; disabled sessions stay visible and cannot launch |
 | `cdx enable <name> [--json]` | Re-enable a disabled session |
@@ -240,6 +241,74 @@ cdx run \
 
 The result includes `launcher: "cdx"`, `run_id`, selected `session`, `provider`, `exit_code`, `duration_seconds`, absolute `transcript_path`, `stdout_path`, `stderr_path`, and normalized usage token fields. Codex headless runs use `codex exec --json`; Claude headless runs use `claude --print --output-format json`. Token counts are `null` when the provider does not expose a supported JSON or JSONL usage shape.
 
+Remote Claude profiles require a dedicated long-lived token produced by `claude setup-token`
+on the launching host. Supply only that token on standard input to
+`cdx auth claude-token <profile>` (never put it in command arguments). This stores
+`.cdx-remote-claude-token` with mode `0600` in the controller profile; ordinary
+interactive Claude credentials and ambient API keys are not a fallback. A missing
+or unsafe file stops before SSH and names this command.
+
+Run `cdx run <profile> --remote worker --cwd /srv/project --prompt-file task.md --json`.
+Claude always uses bubblewrap isolation, even without `--isolate-workspace`, and
+requires matching Claude CLI versions on the controller and Linux worker, Python 3,
+bubblewrap, pasta, nftables, working namespaces and memory-backed `/dev/shm`.
+No worker login or profile mount is needed. Each attempt sends the token over SSH
+stdin, then a private pipe through the sandbox to an exec shim that sets it only
+in Claude's environment. It is never a worker credential file or command argument;
+provider output is redacted before persistence. Fresh volatile HOME storage holds
+`.claude`, `.claude.json`, caches and traces and is removed on exit, failure or stop.
+`CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1` and
+`CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1` remain set; API keys, proxy tokens,
+proxy URLs and cloud-provider variables are excluded from the sandbox environment.
+`--bare` is refused because it ignores OAuth. The outer sandbox owns tool permissions,
+including a read-only checkout for `--permission review`.
+
+Without `--network-access`, the trusted setup resolves `api.anthropic.com` and allows
+HTTPS to those addresses plus public DNS, with other external destinations dropped.
+`--network-access` retains the existing public tool-network policy. Address resolution
+is fixed for the attempt; restart a run if the inference service changes addresses.
+Usage and observed models come from Claude's JSON result. Fresh runs are required;
+remote `--continue-run` remains unsupported.
+
+Remote Antigravity profiles use the worker's existing login, created once by the
+operator in that worker user's normal HOME. Run
+`cdx run agy-profile --remote worker --cwd /srv/project --prompt-file task.md --json`.
+Matching `agy` versions are required on both hosts. Bubblewrap is mandatory;
+each attempt has a memory-backed HOME and mounts only the worker's mode-600
+`.gemini/antigravity-cli/antigravity-oauth-token` authentication file, read-only.
+The installation is read-only. No token is copied into the volatile HOME or sent
+to the controller. A worker token lock excludes concurrent cdx attempts;
+independent native agy launches must be kept out of the same worker account slot.
+`AGY_CLI_DISABLE_AUTO_UPDATE=true` is set. Runs use `-p --output-format json`,
+with closed stdin, and require JSON status `SUCCESS` without refused actions.
+Missing login and expired-session errors require operator login on the worker;
+cdx does not launch an authentication command. Usage is read from the JSON result.
+
+The conservative HTTPS candidate list is `oauth2.googleapis.com`,
+`cloudcode-pa.googleapis.com` and `daily-cloudcode-pa.googleapis.com`, resolved
+on the worker before isolation, plus DNS to `1.1.1.1`/`9.9.9.9`. Other public
+traffic is dropped even with `--network-access`; private ranges remain denied.
+This list has **not** been accepted against live inference in the mission sandbox.
+The token remains read-only pending a measured receipt showing whether refresh
+writes it in place. See
+`logics/runbook/fragments/2026-11-03-antigravity-44674fc58c.md` for evidence and
+the host measurement command. Local Antigravity headless runs retain their profile HOME
+and credentials; the worker login, token lock and volatile HOME policy apply only
+to remote runs.
+
+Remote Ollama profiles use the worker's unauthenticated HTTP API at
+`127.0.0.1:11434`, with `/api/show` followed by `/api/chat` (`stream: false`).
+Use `cdx run local --remote worker --cwd /srv/project --model qwen3:8b --prompt-file question.txt --isolate-workspace --json`.
+The prompt file is read on the launching host; the model must already exist on
+the worker. This is text generation only, not an autonomous coding agent, and
+it does not edit the repository. The result includes `execution_mode`, an
+`execution_note`, generated text in `result`, and `prompt_eval_count` / `eval_count`
+alongside normalized `usage` counters. Missing models and unreachable APIs fail
+without pulling models or authenticating. Isolated clients use a private Unix
+socket relay restricted to capability and non-streaming inference calls for the
+selected model, with a read-only checkout and no network or model-file mounts.
+`--network-access` does not enable networking for this text-only client.
+
 Known headless and completed interactive token usage is persisted in launch history and can be aggregated later. Interactive records are best-effort local data: Codex reads its latest cumulative rollout snapshot, Claude reads its assistant usage records, and Ollama — which writes no transcript of its own — is launched with `--verbose` so its per-response token counts land in the terminal capture cdx already takes. Antigravity reports no usage: its history is schema-less binary protobuf and its logs carry no usage line, so those sessions show no tokens by nature rather than by omission.
 
 `--continue-run RUN_ID` resumes the exact provider conversation from a finished Claude or Codex run, inferring its profile and pinning its recorded model and effort. Existing targets and settings may be supplied only if they match. The parent transcript must still exist. `parent_run_id` links the new run to its parent in run results, the registry, and history; `conversation_id` identifies the provider conversation. Detached continuations preserve these settings through the cdx supervisor. Codex continuation usage is measured between exact transcript snapshots before and after the run, since exec resume can report conversation totals. If either boundary is unavailable, per-run usage stays unknown with `usage_attribution: "continuation_usage_unavailable"` in history instead of counting earlier turns again. Continuation does not use automatic capacity recovery or model fallback, and cannot be combined with `--failover` or `--isolate-workspace`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.25.8",
+  "version": "0.25.9",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.25.8"
+version = "0.25.9"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9.2"

package/src/antigravity_status.py

@@ -0,0 +1,161 @@
+"""Local Antigravity statusLine capture; no credential or network access."""
+
+import argparse
+import base64
+import json
+import math
+import os
+import shlex
+import subprocess
+import sys
+import tempfile
+from datetime import datetime, timezone
+
+STATE_NAME = "cdx-quota.json"
+MARKER = "--cdx-antigravity-status"
+
+
+def _directory(home):
+    return os.path.join(home, ".gemini", "antigravity-cli")
+
+
+def _date(value):
+    try:
+        parsed = datetime.fromisoformat(str(value).replace("Z", "+00:00"))
+        return parsed if parsed.tzinfo is not None else None
+    except (ValueError, TypeError):
+        return None
+
+
+def _quota(value):
+    result = {}
+    if not isinstance(value, dict):
+        return result
+    for name, bucket in value.items():
+        if not isinstance(bucket, dict):
+            continue
+        clean = {}
+        fraction = bucket.get("remaining_fraction")
+        if isinstance(fraction, (int, float)) and not isinstance(fraction, bool) and math.isfinite(fraction) and 0 <= fraction <= 1:
+            clean["remaining_fraction"] = fraction
+        reset = _date(bucket.get("reset_time"))
+        if reset:
+            clean["reset_time"] = reset.isoformat()
+        seconds = bucket.get("reset_in_seconds")
+        if isinstance(seconds, (int, float)) and not isinstance(seconds, bool) and math.isfinite(seconds) and seconds >= 0:
+            clean["reset_in_seconds"] = seconds
+        result[name] = clean
+    return result
+
+
+def capture(payload, state_path, now=None):
+    """Persist only an allowlist, atomically with private permissions."""
+    if not isinstance(payload, dict):
+        return
+    now = now or datetime.now(timezone.utc)
+    state = {"time": now.isoformat(),
+             "plan_tier": payload.get("plan_tier") if isinstance(payload.get("plan_tier"), str) else None,
+             "quota": _quota(payload.get("quota"))}
+    directory = os.path.dirname(state_path)
+    os.makedirs(directory, exist_ok=True)
+    fd, temporary = tempfile.mkstemp(prefix=".cdx-quota-", dir=directory)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            json.dump(state, handle)
+            handle.write("\n")
+        os.replace(temporary, state_path)
+    finally:
+        if os.path.exists(temporary):
+            os.unlink(temporary)
+
+
+def install(home):
+    """Merge the hook without replacing unrelated settings or user output."""
+    from .agent_notify import _read_json, _write_json
+
+    path = os.path.join(_directory(home), "settings.json")
+    settings = _read_json(path)
+    if settings is None:
+        return False
+    status = settings.get("statusLine") or {}
+    if not isinstance(status, dict) or (status and status.get("type") != "command"):
+        return False
+    previous = status.get("command") or ""
+    if not isinstance(previous, str):
+        return False
+    try:
+        parts = shlex.split(previous, posix=os.name != "nt")
+    except ValueError:
+        parts = []
+    own_command = (len(parts) >= 3 and os.path.basename(parts[1].strip('"')) == "antigravity_status.py"
+                   and parts[2] == MARKER)
+    if own_command:
+        index = parts.index("--previous") + 1 if "--previous" in parts else len(parts)
+        encoded = parts[index] if index < len(parts) else ""
+    else:
+        encoded = base64.urlsafe_b64encode(previous.encode()).decode()
+    args = [sys.executable, os.path.abspath(__file__), MARKER,
+            "--state", os.path.join(_directory(home), STATE_NAME)]
+    if encoded:
+        args += ["--previous", encoded]
+    command = subprocess.list2cmdline(args) if os.name == "nt" else shlex.join(args)
+    merged = {**status, "type": "command", "command": command}
+    if settings.get("statusLine") == merged:
+        return True
+    return _write_json(path, {**settings, "statusLine": merged})
+
+
+def read_status(home, now=None):
+    """Expose every bucket; use only fresh Gemini windows for availability."""
+    now = now or datetime.now(timezone.utc)
+    try:
+        with open(os.path.join(_directory(home), STATE_NAME), encoding="utf-8") as handle:
+            state = json.load(handle)
+    except (OSError, ValueError):
+        state = {}
+    if not isinstance(state, dict):
+        state = {}
+    at = _date(state.get("time"))
+    age = max(0, (now - at).total_seconds()) if at else None
+    stale = age is not None and age > 24 * 60 * 60
+    quota = _quota(state.get("quota"))
+    for bucket in quota.values():
+        reset = _date(bucket.get("reset_time"))
+        valid = at is not None and not stale and reset is not None and reset > now
+        bucket["status"] = "stale" if stale else "current" if valid else "unknown"
+        if not valid:
+            bucket["remaining_fraction"] = None
+    result = {"updated_at": at.isoformat() if at else None, "reading_age_seconds": age,
+              "quota_stale": stale, "quota_status": "stale" if stale else "current" if at else "unknown",
+              "plan_tier": state.get("plan_tier"), "quota": quota}
+    for window, name in (("5h", "gemini-5h"), ("week", "gemini-weekly")):
+        bucket = quota.get(name, {})
+        reset = _date(bucket.get("reset_time"))
+        valid = at is not None and not stale and reset is not None and reset > now
+        fraction = bucket.get("remaining_fraction") if valid else None
+        result[f"remaining_{window}_pct"] = fraction * 100 if fraction is not None else None
+        result[f"reset_{window}_at"] = reset.astimezone().strftime("%b %d %H:%M") if valid else None
+        result[f"reset_{window}_at_iso"] = reset.isoformat() if valid else None
+    return result
+
+
+def main(stdin=None):
+    parser = argparse.ArgumentParser()
+    parser.add_argument(MARKER, action="store_true")
+    parser.add_argument("--state", required=True)
+    parser.add_argument("--previous", default="")
+    args = parser.parse_args()
+    raw = (stdin or sys.stdin).read()
+    try:
+        capture(json.loads(raw), args.state)
+    except (ValueError, OSError, TypeError):
+        # A failed capture must not suppress the user's existing status line.
+        pass
+    if args.previous:
+        command = base64.urlsafe_b64decode(args.previous).decode()
+        return subprocess.run(command, shell=True, input=raw, text=True, check=False).returncode
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/src/claude_remote_token.py

@@ -0,0 +1,45 @@
+"""Dedicated controller-side Claude setup token, never a worker profile."""
+
+import os
+import re
+import stat
+import tempfile
+from pathlib import Path
+
+from .errors import CdxError
+
+TOKEN_FILE = '.cdx-remote-claude-token'
+
+
+def store_token(session, token):
+    token = token.strip()
+    if not re.fullmatch(r'[A-Za-z0-9._-]{1,16384}', token):
+        raise CdxError('Provide one Claude setup token on standard input.')
+    home = Path(session['authHome'])
+    home.mkdir(parents=True, exist_ok=True)
+    descriptor, temporary = tempfile.mkstemp(prefix='.claude-token-', dir=home)
+    try:
+        with os.fdopen(descriptor, 'w') as handle:
+            handle.write(token)
+        os.replace(temporary, home / TOKEN_FILE)
+    finally:
+        if os.path.exists(temporary):
+            os.unlink(temporary)
+
+
+def read_token(session):
+    try:
+        path = Path(session['authHome']) / TOKEN_FILE
+        with open(path, opener=lambda name, flags: os.open(name, flags | getattr(os, "O_NOFOLLOW", 0))) as handle:
+            info = os.fstat(handle.fileno())
+            if not stat.S_ISREG(info.st_mode) or stat.S_IMODE(info.st_mode) != 0o600 or (hasattr(os, "getuid") and info.st_uid != os.getuid()):
+                raise ValueError('Unsafe token file')
+            token = handle.read(16385).strip()
+        if not re.fullmatch(r'[A-Za-z0-9._-]{1,16384}', token):
+            raise ValueError('Invalid token')
+        return token
+    except (OSError, ValueError) as error:
+        raise CdxError(
+            f"Remote Claude requires a dedicated setup token; run cdx auth claude-token {session['name']} "
+            "with the token from claude setup-token on standard input.", code='remote_claude_token_missing',
+        ) from error

package/src/cli.py

@@ -243,9 +243,11 @@ def _print_help(use_color=False):
         f"  {_style('cdx next [--json] [--refresh]', '36', use_color)}",
         f"  {_style('cdx agents [--max-age-hours N] [--json]', '36', use_color)}",
         f"  {_style('cdx reset <name> [--yes] [--json]', '36', use_color)}",
+        f"  {_style('cdx auth claude-token <profile> [--json]', '36', use_color)}",
         f"  {_style('cdx auth refresh <name|all> [--json]', '36', use_color)}",
         f"  {_style('cdx select --provider PROVIDER [--min-reasoning-effort minimal|low|medium|high|xhigh] [--min-power minimal|low|medium|high|xhigh] [--require-ready] [--refresh] --json', '36', use_color)}",
         f"  {_style('cdx run [session] [--remote SSH_TARGET] --cwd PATH [--project PATH] (--prompt-file PATH|--prompt TEXT|--prompt-file -) [--provider PROVIDER] [--model MODEL] [--kind assistant|code-review|retro] [--reasoning-effort minimal|low|medium|high|xhigh] [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full|workspace-write|read-only|danger-full-access] [--timeout-seconds N] [--label TEXT] [--max-parallel N] [--continue-run RUN_ID] [--detach] [--failover] [--refresh] --json', '36', use_color)}",
+        "    Remote Ollama: text generation only, not an autonomous coding agent; no repository edits. Requires an installed worker model; no authentication.",
         f"  {_style('cdx runs [--limit N] [--since 7d|today|DATE] [--running] --json', '36', use_color)}",
         f"  {_style('cdx run-status <run_id> --json', '36', use_color)}",
         f"  {_style('cdx run-report <run_id> --json', '36', use_color)}",

package/src/cli_args.py

@@ -49,6 +49,7 @@ SESSIONS_USAGE = "Usage: cdx sessions [--all] --json"
 SELECT_USAGE = "Usage: cdx select --provider PROVIDER [--min-reasoning-effort minimal|low|medium|high|xhigh] [--min-power minimal|low|medium|high|xhigh] [--require-ready] [--refresh] --json"
 NEXT_USAGE = "Usage: cdx next [--json] [--refresh]"
 RUN_USAGE = "Usage: cdx run [session] [--remote SSH_TARGET] [--remote-prefix COMMAND] (--cwd|--dir) PATH [--project PATH] (--prompt-file PATH|--prompt TEXT|--prompt-file -) [--provider PROVIDER] [--model MODEL] [--kind assistant|code-review|retro] [--reasoning-effort minimal|low|medium|high|xhigh] [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full|workspace-write|read-only|danger-full-access] [--network-access] [--isolate-workspace] [--timeout-seconds N] [--budget USD] [--label TEXT] [--max-parallel N] [--continue-run RUN_ID] [--detach] [--failover] [--refresh] --json"
+RUN_USAGE += "\nRemote Ollama generates text only; it is not an autonomous coding agent and does not edit the repository. Requires an installed worker model; no authentication."
 RUN_JSON_REQUIRED = "cdx run: --json is required."
 RUN_TARGET_REQUIRED = "cdx run: specify a session name or --provider PROVIDER."
 RUN_SESSION_PROVIDER_CONFLICT = "cdx run: cannot specify both a session name and --provider."
@@ -593,6 +594,7 @@ def cdx_schema():
             "logics_manager_update_available",
             "update_version_check_failed",
             "update_version_mismatch",
+            "update_unverified",
             "logics_manager_missing",
             "logics_viewer_failed",
             "logics_viewer_root_invalid",

package/src/commands/auth.py

@@ -3,6 +3,7 @@
 Split out of cli_commands.py. Moved verbatim; re-exported by cli_commands.
 """
 
+import sys
 import time
 import uuid
 
@@ -53,6 +54,30 @@ def _refresh_result(session, diagnostic):
 
 
 def handle_auth(rest, ctx):
+    if rest and rest[0] == "claude-token":
+        json_flag, args = _parse_json_flag(rest[1:])
+        if len(args) != 1:
+            raise CdxError("Usage: cdx auth claude-token <profile> [--json]")
+        session = ctx["service"]["get_session"](args[0])
+        if not session or session["provider"] != PROVIDER_CLAUDE:
+            raise CdxError("Select an existing Claude profile for cdx auth claude-token.")
+        if ctx["stdin_is_tty"]:
+            raise CdxError("Read the Claude setup token from standard input, without an interactive terminal.")
+        from ..claude_remote_token import store_token
+        stream = ctx.get("prompt_stdin") or sys.stdin
+        token = stream.read(16385)
+        if isinstance(token, bytes):
+            try:
+                token = token.decode("utf-8")
+            except UnicodeDecodeError as error:
+                raise CdxError("Provide one Claude setup token on standard input.") from error
+        store_token(session, token)
+        message = f"Stored remote Claude setup token for {session['name']}"
+        if json_flag:
+            _write_json(ctx, _json_success("auth.claude-token", message))
+        else:
+            ctx["out"](message + "\n")
+        return 0
     parsed = _parse_auth_args(rest)
     target = parsed["target"]
     if target == "all":

package/src/commands/maintenance.py

@@ -53,6 +53,8 @@ def _format_update_all_result(result, use_color=False):
         return _warn(f"skipped: {result['name']} (blocked by {result['blocked_by']})", use_color)
     if result.get("returncode") == 0:
         versions = f" ({result['version_before']} -> {result['version_after']})" if "version_after" in result else ""
+        if result.get("warning"):
+            return _warn(f"done: {result['name']}{versions}\n  {result['warning']['message']}", use_color)
         return _success(f"done: {result['name']}{versions}", use_color)
     detail = str(result.get("stderr") or result.get("stdout") or "No error output.").strip().replace("\n", " ")
     detail = detail[-500:]
@@ -709,7 +711,8 @@ def handle_update(rest, ctx):
         failed = [row for row in results if row.get("returncode") != 0]
         message = "Applied workstation update plan" if not failed else "Workstation update plan completed with failures"
         if parsed["json"]:
-            _write_json(ctx, _json_success("update.all", message, plan=plan, results=results, failed=len(failed)))
+            warnings = [dict(row["warning"], name=row["name"]) for row in results if row.get("warning")]
+            _write_json(ctx, _json_success("update.all", message, warnings=warnings, plan=plan, results=results, failed=len(failed)))
         else:
             ctx["out"](f"{_success(message, ctx['use_color']) if not failed else _warn(message, ctx['use_color'])}\n")
         return 1 if failed else 0

package/src/commands/runs.py

@@ -713,16 +713,26 @@ def handle_run(rest, ctx):
             session = selected["session"]
             selection_row = selected.get("row") or {}
 
+        if parsed.get("remote") and session["provider"] == "antigravity":
+            parsed["isolate_workspace"] = True
         remote_version = None
         if parsed.get("remote"):
-            if session["provider"] != "codex":
-                raise CdxError("--remote is only available for Codex profiles.", code="remote_provider_unsupported")
+            if session["provider"] not in ("codex", "claude", "ollama", "antigravity"):
+                raise CdxError("--remote is only available for Codex, Claude, Ollama and Antigravity profiles.", code="remote_provider_unsupported")
             if parsed.get("continue_run"):
                 raise CdxError("--remote requires a fresh run without --continue-run.")
+            if session["provider"] == "ollama" and not (parsed.get("model") or (session.get("launch") or {}).get("model")):
+                raise CdxError("Remote Ollama text generation requires --model or a configured local model.")
+            if session["provider"] == "claude":
+                from ..claude_remote_token import read_token
+                read_token(session)
+                parsed["isolate_workspace"] = True
             remote_version = preflight(
                 parsed["remote"], {**os.environ, **(ctx.get("env") or {})},
                 remote_prefix=parsed.get("remote_prefix"), isolate_workspace=parsed.get("isolate_workspace", False),
-                cwd=parsed["cwd"], network=parsed.get("network_access", False), writable=parsed.get("permission") != "review")
+                cwd=parsed["cwd"], network=parsed.get("network_access", False), writable=parsed.get("permission") != "review",
+                **({"provider": "ollama", "model": parsed.get("model") or (session.get("launch") or {}).get("model")}
+                   if session["provider"] == "ollama" else {"provider": session["provider"]}))
         cwd = os.path.abspath(parsed["cwd"])
         if not parsed.get("remote") and not os.path.isdir(cwd):
             raise CdxError(f"Invalid cwd: {parsed['cwd']}", code="invalid_cwd")
@@ -1074,6 +1084,9 @@ def handle_run(rest, ctx):
             message = f"Every eligible session was rate limited: {', '.join(attempted)}."
         elif failover_error_code == "failover_limit_reached":
             message = f"Failover stopped after {MAX_FAILOVER_TRANSITIONS} transitions: {', '.join(attempted)}."
+        elif run_info.get("provider_error"):
+            failover_error_code = run_info["provider_error"]
+            message = run_info["provider_message"]
         elif run_info.get("timed_out"):
             message = "Provider process timed out."
         else:

package/src/interactive_usage.py

@@ -1,17 +1,11 @@
 """Best-effort usage readers for interactive provider sessions.
 
-Three providers report usage and one does not:
-
-- Claude and Codex write their own JSONL transcripts, resolved by the
-  conversation id cdx already holds.
-- Ollama writes nothing. Its counts exist only in `--verbose` terminal output,
-  so they are parsed out of the PTY capture cdx takes for every launch.
-- Antigravity has no retrievable source. Its conversation history is
-  schema-less binary protobuf under `~/.gemini/antigravity-cli/conversations/`
-  with no `.proto` available to decode field numbers into token counts, and its
-  logs are plain glog with no usage-bearing line at any verbosity `agy --help`
-  exposes. This was investigated and is a dead end, not an oversight -- do not
-  spend the afternoon rediscovering it.
+- Claude and Codex expose per-session token counts in JSONL transcripts.
+- Ollama exposes counts in the verbose terminal output captured by cdx.
+- Antigravity exposes quota through interactive statusLine stdin (collected by
+  antigravity_status), and per-run tokens through `agy -p --output-format json`
+  (read by run_usage). Interactive per-run token counts remain unavailable;
+  quota changes are not token measurements.
 """
 
 import json