cdx-manager 0.25.8 → 0.26.0

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.25.8-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.26.0-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **The right AI coding account, when you need it.** CDX Manager keeps your Codex and Claude accounts in separate profiles, shows which ones have quota, and helps you pick the next usable session from your terminal.
 
@@ -42,6 +42,27 @@ cdx work
 
 CDX checks authentication before interactive launches. Handoff keeps the source transcript in place and asks the receiving agent to verify the conversation and workspace before acting. No account switch or prompt submission happens just because you run `cdx next`.
 
+## Automatic mission concurrency per profile
+
+```bash
+cdx set work --max-parallel 2
+cdx show work
+cdx unset work --max-parallel
+```
+
+`--max-parallel` accepts an integer from 0 to 5 and stores `launch.max_parallel`
+next to `priority` and `policy`. Zero excludes the profile from automatic
+missions. An absent value adds no profile-specific ceiling: the scheduling
+client applies its own rule. Existing configurations need no migration.
+`cdx unset work --all` also removes the limit.
+
+The scheduling client is responsible for enforcing this metadata. It is
+separate from the existing per-command `cdx run --max-parallel` limit.
+`cdx --json` (also `cdx ls --json`) includes the optional field in each
+session's `launch` object; `cdx status --json` exposes `max_parallel` on each
+row (`null` when absent). `cdx show` is an alias for `cdx config` and displays
+`Max parallel` as `default` when unset.
+
 ## Cache efficiency and fix rounds
 
 `cdx history --json` records uncached input, cache reads, cache writes, output tokens, and `usage.cache_hit_ratio` beside the existing token totals. The ratio is cache reads divided by all input tokens, excluding output. Missing provider splits stay `null`, and text views show `cache n/d` instead of claiming a zero hit rate.
@@ -89,7 +110,7 @@ Recovery does not require `--failover`, which still controls account quota exhau
 
 Contributions are welcome; see [CONTRIBUTING.md](CONTRIBUTING.md). CDX Manager is [MIT licensed](LICENSE).
 
-### Run Codex on an SSH worker
+### Run Codex or Ollama on an SSH worker
 
 ```sh
 cdx run work --remote agent@worker --cwd /srv/project --prompt 'Run the checks' --json
@@ -106,12 +127,12 @@ not synchronized. Use `--project` to explicitly attribute a remote checkout to a
 project. Remote runs do not retry or fail over automatically, including when
 `--failover` is supplied.
 
-Requirements: a POSIX controller with `ssh` and Codex on PATH, and a Linux worker
+For Codex: a POSIX controller with `ssh` and Codex on PATH, and a Linux worker
 with Python 3, memory-backed `/dev/shm`, and exactly the same `codex --version`.
 Configure SSH keys, host trust and aliases in advance; the connection uses batch
 mode and bounded connection/keepalive timeouts. Provider refusal, unreachable
-workers and version mismatches fail before sending credentials. Only Codex OAuth
-profiles are supported. Remote continuation is refused because the temporary home
+workers and version mismatches fail before sending credentials. Codex requires an OAuth
+profile. Remote continuation is refused because the temporary home
 does not preserve conversation rollouts. Codex's native permission sandbox still
 applies to ordinary remote runs.
 
@@ -123,7 +144,32 @@ Only a short, double-quoted Python bootstrap is sent in the SSH command line;
 the worker and shared sandbox source are framed on stdin before the payload.
 Neither source size nor prompt size consumes cmd.exe's 8191-character command limit.
 
-`--remote` supports `--isolate-workspace` using the same local isolation mechanism:
+Remote Ollama profiles also support headless text generation:
+
+```bash
+cdx run local --remote worker --cwd /srv/project --model qwen3:8b --prompt-file question.txt --isolate-workspace --json
+```
+
+Here `local` is an existing Ollama profile. The named model must already be
+installed on the worker's unauthenticated `127.0.0.1:11434` Ollama API; CDX
+never downloads a missing model and rejects cloud-backed models. The prompt
+file is read on the launching host and sent as content over SSH. This path
+uses `/api/show` and `/api/chat` with `stream: false`, without an Ollama CLI or
+Codex installation. Results identify `execution_mode: "text_generation"` and
+include generated text in `result`, plus `prompt_eval_count` / `eval_count`
+and normalized input/output token counts in `usage`.
+
+Ollama is not an autonomous coding agent and does not edit the repository.
+With `--isolate-workspace`, the checkout is read-only and the client has its
+own network namespace without network access, including when `--network-access`
+is supplied. A private Unix socket connects it to a supervisor-owned relay
+with the fixed loopback destination and only the selected model's capability
+and non-streaming inference calls allowed. Pull, delete, push, arbitrary URLs,
+proxying and redirects are refused. No `~/.ollama` directory or model files
+are mounted. The relay is removed on completion or cancellation. Remote
+continuation remains unsupported; an explicit model or profile model is required.
+
+Codex `--remote` supports `--isolate-workspace` using the same local isolation mechanism:
 bubblewrap, pasta (passt), nftables, Python, the checkout/toolchain allowlist,
 and an actual namespace/network setup using a dummy credential. Missing dependencies,
 namespace denial or invalid checkouts fail before sending real credentials, without
@@ -193,3 +239,51 @@ The empty-refresh-token behavior was measured with Codex CLI 0.166.0. Real-host
 acceptance should verify that the installed matching CLI does not attempt a
 refresh with the temporary home, that the controller token chain stays unchanged
 for a fresh credential, and that cleanup works after disconnect and SIGTERM.
+
+### Read an interactive conversation
+
+`cdx conversation <name> [--conversation ID] [--cursor CURSOR] [--limit N] --json`
+returns a read-only JSON page for the profile's current conversation. An explicit
+conversation ID uses an exact transcript lookup; a profile without a recorded ID
+uses the existing latest-transcript resolver. This fallback is best effort.
+
+The normal cdx JSON envelope includes `status`, `reason`, `provider`, `session`,
+`entries`, `next_cursor`, and `has_more`. Each entry has exactly `role`
+(`user`, `assistant`, or `tool`), `text`, `tool_name`, `tool_summary`, `at`, and
+`id`. Missing values are `null`; tool text is empty. Entries follow file and
+content-block order, with stable IDs for the same file position. Timestamps are
+provider timestamps when valid. Tool calls/results have a name and a short
+summary; arguments, results, attachments, and reasoning blocks are omitted.
+Result names are recovered from up to 100 recent calls, otherwise `tool`.
+Common credential patterns and secret assignments in text are redacted without
+opening credential stores. Review conversation text before sharing: arbitrary
+unlabelled sensitive prose cannot be identified automatically.
+
+Pass `next_cursor` unchanged as `--cursor` to fetch the next page or poll for new
+entries. `--limit` bounds entries (default 100, range 1–1000). Reading seeks to
+the saved byte position rather than replaying history, and scans at most 8 MiB
+per call. A page may be empty while still returning a usable cursor. Poll on a
+timer: `has_more` means unread bytes, which can include an incomplete final line
+that will only become readable after the provider appends its newline.
+
+Codex response items and Claude-compatible JSONL transcripts (Claude and
+Antigravity) are supported through the existing transcript resolver. Missing or
+unreadable files return `status: "unavailable"` with a reason. Ollama's terminal
+capture does not reliably identify message roles and returns
+`status: "unsupported"`, including when no capture exists. A transcript record
+larger than 1 MiB returns `unavailable`. A replaced/truncated file or invalid
+cursor returns `reset_required`; discard the cursor and reload the conversation.
+Cursors are opaque, versioned, and bound to a provider and file. Treat transcripts
+as append-only; reset the client if a provider rewrites earlier history.
+
+Python callers can use the same page contract:
+
+```python
+from cdx_manager.conversation import read_conversation
+
+page = read_conversation("claude", "/path/to/profile/home", conversation_id="session-id", limit=100)
+next_page = read_conversation(
+    "claude", "/path/to/profile/home", conversation_id="session-id",
+    cursor=page["next_cursor"], limit=100,
+)
+```

package/VERSION

@@ -1 +1 @@
-0.25.8
+0.26.0

package/changelogs/CHANGELOGS_0_25_9.md

@@ -0,0 +1,22 @@
+# CDX Manager 0.25.9
+
+Release date: 2026-11-03
+
+This release expands isolated remote provider support and improves Antigravity
+quota, usage reporting, and update feedback.
+
+## Remote runs
+
+- Integrate worker-owned Antigravity headless runs with mandatory isolation, a volatile home, restricted inference networking, and redacted output. Keep worker credentials on the worker and preserve local profile authentication. Live worker acceptance measurements remain required before claiming production support. (#98)
+- Enable isolated remote Claude runs with a dedicated OAuth setup token stored on the controller and transported through stdin. Use a fresh memory-backed home per attempt, restrict inference traffic by default, and retain usage reporting and output redaction. (#95)
+- Add remote Ollama text generation with an explicitly selected installed worker model through a restricted local relay. Limit requests to model inspection and non-streaming chat; keep the checkout read-only and report generated text and token usage. This mode does not edit repositories or act as an autonomous coding agent. (#94)
+
+## Antigravity status and updates
+
+- Show Antigravity quota, reset times, and reading age from a local statusLine integration that preserves existing commands. Record native headless token counters, and identify stale or expired quota readings. (#96)
+- Keep successful `agy update` commands successful when no newer version can be verified. Report an `update_unverified` warning while retaining unknown latest-version status; non-zero updater exits still fail. (#93)
+
+## Maintenance
+
+- Record tray companion checksums for v0.25.8. (`d0c8d33b671234cf648da2b21b7bb0bfb0ce302e`)
+- Record release archive checksums for v0.25.8. (`20fb80c7d115500c8da5be433526e195063258d9`)

package/changelogs/CHANGELOGS_0_26_0.md

@@ -0,0 +1,31 @@
+# CDX Manager 0.26.0
+
+Release date: 2026-11-03
+
+This release adds optional profile concurrency settings for automatic missions
+and incremental JSON access to interactive conversations.
+
+## Automatic mission concurrency
+
+- Add an optional per-profile `launch.max_parallel` setting through `cdx set
+  <name> --max-parallel N`, accepting integers from 0 to 5. Zero excludes a
+  profile from automatic missions; an unset value leaves the scheduling client's
+  default in effect. Expose the setting in list JSON, status JSON, and profile
+  settings, and clear it with `cdx unset <name> --max-parallel`. Scheduling
+  clients enforce this setting; the existing `cdx run --max-parallel` limit
+  remains separate. (#101)
+
+## Interactive conversation reading
+
+- Add `cdx conversation <name> --json` and the reusable `read_conversation`
+  Python function to read Codex, Claude, and Antigravity transcripts
+  incrementally with bounded reads and opaque pagination cursors. Return
+  normalized messages and tool activity summaries while omitting tool bodies,
+  attachments, metadata, and reasoning, and redacting recognized credentials.
+  Report missing transcripts as unavailable and Ollama terminal captures as
+  unsupported; require a cursor reset after rotation or truncation. (#100)
+
+## Maintenance
+
+- Record tray companion checksums for v0.25.9. (`6d0a825b9649da9aead3379e6411e3959cd30a77`)
+- Record release archive checksums for v0.25.9. (`e3682ad8aed14d75c3c686a0c6027f53cfe81cd3`)

package/changelogs/CHANGELOGS_UNRELEASED.md

@@ -1,5 +1,24 @@
 # Unreleased
 
+## Antigravity quota and run usage
+
+- Install a local Antigravity statusLine command in new profiles and on interactive launch, merging settings and relaying the original stdin to any existing command so its output is preserved. Store only the reading time, plan tier and allowlisted quota fields in an atomic mode-600 profile file; never access Google internal endpoints or antigravity-oauth-token.
+- Show Gemini 5-hour and weekly remaining quota, reset times and reading age in status. Include all bucket names, including third-party buckets, in JSON. Mark readings older than 24 hours stale and suppress availability after a bucket's reset has passed.
+- Launch headless Antigravity with `agy -p --output-format json` and record its input, output, thinking, cache-read and reported total counters. Preserve the native total without assuming an undocumented cache or thinking subset relationship. Interactive quota is not per-run token usage.
+- Cover synthetic native payloads, missing/unknown buckets, stale and expired readings, settings merges, existing command output, private file permissions and headless observation.
+
+## Worker-owned Antigravity headless runs
+
+- Allow Antigravity profiles in remote runs with mandatory bubblewrap, explicit `agy -p --output-format json`, an owner-only worker token mounted read-only, and a volatile HOME. Never transport worker credentials to the controller; redact worker output before SSH forwarding. Hold a worker token lock across each attempt and disable automatic CLI updates.
+- Restrict inference to a conservative Google endpoint allowlist plus public DNS, including when tool network access is requested; retain private-range denial. The candidate list and read-only token policy require the live measurements documented in the mission fragment before claiming production acceptance.
+- Fail on absent/unsafe worker login, expired sessions, missing/non-success JSON status and refused actions. Normalize JSON usage through `run_usage` and preserve existing run artifacts/history. Cover fake worker success, refusal, expiry, secret redaction, locking, cleanup, local profile authentication and mount/network construction.
+
+## Remote Claude headless runs
+
+- Add `cdx auth claude-token <profile>` to store a dedicated `claude setup-token` value from stdin in a controller-only mode-600 profile file. Missing or unsafe tokens stop remote runs with this command as the remedy; worker login is unnecessary.
+- Allow remote Claude JSON headless execution with mandatory bubblewrap isolation, a fresh memory-backed HOME per attempt and no local profile mounts. Carry the token through SSH stdin and a sandbox stdin exec shim, exposing it only in Claude's environment, never worker credential files, argv or persisted output. Keep subprocess environment scrubbing, remove competing authentication/cloud/proxy sources, disable non-essential traffic and refuse `--bare`.
+- Allow inference HTTPS to resolved `api.anthropic.com` addresses and DNS by default; retain public tool-network access only when requested. Cover fake-worker usage parsing, output redaction, absent/unsafe token files, stdin storage, isolation construction and volatile cleanup after success, failure and timeout.
+
 ## Isolated mission Git and RTK
 
 - Give local and remote isolated linked worktrees a read-only Git view with their own HEAD/index and shared objects/refs, without traversing private host parents or exposing repository/global configuration, hooks, SSH keys or Git push credentials. Preserve supervisor-owned commits and pushes.
@@ -8,10 +27,11 @@
 
 ## Truthful workstation updates
 
+- Keep a zero-exit `agy update` successful when no expected newer CLI version is known, even if its installed version does not advance and its output cannot confirm currency. Preserve `status: unknown` and `latest_version: null`, expose an `update_unverified` warning in JSON and text, and continue failing non-zero updater exits. No additional version source is assumed.
 - Stop querying the editor release feed for the Antigravity CLI: its versions do not match `agy`. Keep `latest_version: null` and `status: unknown`, while still running the native `agy update` with `--yes` or confirmation. No read-only latest-version check is documented by `agy update --help`.
 - Accept a successful native updater's `You are already on the latest version.` message when the installed version is unchanged, or verify a version increase against the published version when known. Preserve updater failures and unknown inventory status. Cover the real Antigravity output line, version increases, failures, and JSON/text uncertainty.
 
-- Detect advertised native updater subcommands in both stdout and stderr; use Antigravity's known `agy update` command directly. Verify the installed CLI version after updating, fail unverified updates unless an unchanged version is explicitly confirmed current by the updater, and expose before/after versions without hiding major upgrades.
+- Detect advertised native updater subcommands in both stdout and stderr; use Antigravity's known `agy update` command directly. Verify the installed CLI version after updating, retain strict verification for providers with a known expected release, and expose before/after versions without hiding major upgrades.
 - Fall back from empty or failed Ollama vendor responses (including Linux HTTP 204) to the latest stable `ollama/ollama` GitHub release. Keep Linux updates manual with `update_available`, a null command, and a service-safety reason; never replace a potentially active binary or restart models automatically.
 
 - Verify latest versions from npm, RTK GitHub releases, and Ollama vendor update endpoints with short read-only probes. Report `unknown` on unavailable evidence; reserve `up_to_date` for identical known versions, including Ponytail revisions.
@@ -57,3 +77,9 @@
 - Keep snapshots independent of controller refresh during long missions, prohibit authentication writeback, enforce their original expiry, and remove temporary storage after success, failure and stop. Non-isolated local authentication remains unchanged.
 - Reject rotating credentials at the sandbox boundary. Test snapshot contents, permissions, cleanup, refresh lock ownership, concurrent controller refresh, remote isolation through fake SSH and missing dependency refusal.
 - The separately maintained remote-ops `scripts/workspace_sandbox.py` requires the same credential guard and run-private lifecycle integration; it is not shipped by this repository.
+
+## Remote Ollama text generation
+
+- Allow Ollama profiles in `cdx run --remote` with an explicitly selected, already installed local worker model and no authentication or Ollama/Codex CLI requirement. Read prompts on the launching host and use the HTTP capability/chat APIs with `stream: false`; retain generated text and prompt/evaluation token counters in run results and usage.
+- Add a worker-supervised private Unix socket relay restricted to the fixed `127.0.0.1:11434` destination, selected model, `/api/show` and non-streaming `/api/chat`. Refuse model management, alternate destinations and cloud-backed models. Isolated clients have no network access and mount neither Ollama profiles nor model files; their checkout is read-only.
+- State in CLI help and results that this is text generation, not an autonomous coding agent, with no repository edits. Cover success, usage, controller prompt content, missing models, forbidden relay calls, unreachable servers and sandbox relay construction with a fake HTTP API.

package/checksums/release-archives.json

@@ -771,6 +771,28 @@
         "x86_64-pc-windows-msvc": "be2e6ff8607351019447c6fbf0622254c2f8d8db81581007af71b74932e37f50",
         "x86_64-unknown-linux-musl": "32de07569929ade136cf75ed8f0716e0f3b96a9c53c6632c628e13782d223518"
       }
+    },
+    "v0.25.8": {
+      "github_tarball_sha256": "4a3e3eeb654a4590ea033e6d99337a57b9f255161ee2b9c9347e8def0d257868",
+      "github_zip_sha256": "ad2c7e8d1528f36f4be66320970522385ba3c0a473ab893475b174609ec05630",
+      "tray_assets": {
+        "aarch64-apple-darwin": "46e4e9ce2ce54d974dd3b77364fc97595b4d4388787c2e7486245374d342ff87",
+        "aarch64-unknown-linux-musl": "74afc63053dc3f6ca3fae010d8afc64c917cd37e71cc005dd8b9d3e9383b99e6",
+        "x86_64-apple-darwin": "990b305bf32d24e0126cb6f3fe42cd9858a6cd5dc460f41d0fb4419516324a40",
+        "x86_64-pc-windows-msvc": "9577f9dff7d457094276376f262904dad8c9aff95ed2ca87b834c9c900fb5493",
+        "x86_64-unknown-linux-musl": "db7e322037041c2a898043f0c7a691c22cab6a794aab5b2439a06ac91e92fa39"
+      }
+    },
+    "v0.25.9": {
+      "github_tarball_sha256": "cd6d881144cefbd82b0929f375f471ed076e2f23be60744895aee54de5aead12",
+      "github_zip_sha256": "ccd28db3f526a081ed75cefc016f54d7eadf0adcaab401c8aed77d477cf917d3",
+      "tray_assets": {
+        "aarch64-apple-darwin": "4f90576e9e8db1ec08ed856a91a02f4049c7f7186e6dccac1908ba43c72df6fd",
+        "aarch64-unknown-linux-musl": "dcdf50751982f78805492eca059d83238f5d2190b97455b2d96d91283b764cdc",
+        "x86_64-apple-darwin": "289818bd5d692a6ba5035f10886318179bb2baa98e22a05e7abd751ea64d19ed",
+        "x86_64-pc-windows-msvc": "32889713859cf23d4d82647638d909d62075b92d8e6571e32118ebfa208d81b2",
+        "x86_64-unknown-linux-musl": "9e94b799fe4b01d95aeb172c1eba28dc011be69cc2b39b5743f0d81986eaa80f"
+      }
     }
   }
 }

package/docs/cli.md

@@ -19,6 +19,7 @@
 | `cdx label <name> --clear [--json]` | Clear a session label |
 | `cdx login <name> [--json]` | Re-authenticate a session (logout + login) |
 | `cdx logout <name> [--json]` | Log out of a session |
+| `cdx auth claude-token <profile> [--json]` | Store a dedicated remote Claude setup token from stdin in a private controller profile file |
 | `cdx auth refresh <name\|all> [--json]` | Make a locked, non-generation Codex auth probe; reports `login_required` when interactive login is needed |
 | `cdx disable <name> [--json]` | Disable a session without deleting it; disabled sessions stay visible and cannot launch |
 | `cdx enable <name> [--json]` | Re-enable a disabled session |
@@ -240,6 +241,74 @@ cdx run \
 
 The result includes `launcher: "cdx"`, `run_id`, selected `session`, `provider`, `exit_code`, `duration_seconds`, absolute `transcript_path`, `stdout_path`, `stderr_path`, and normalized usage token fields. Codex headless runs use `codex exec --json`; Claude headless runs use `claude --print --output-format json`. Token counts are `null` when the provider does not expose a supported JSON or JSONL usage shape.
 
+Remote Claude profiles require a dedicated long-lived token produced by `claude setup-token`
+on the launching host. Supply only that token on standard input to
+`cdx auth claude-token <profile>` (never put it in command arguments). This stores
+`.cdx-remote-claude-token` with mode `0600` in the controller profile; ordinary
+interactive Claude credentials and ambient API keys are not a fallback. A missing
+or unsafe file stops before SSH and names this command.
+
+Run `cdx run <profile> --remote worker --cwd /srv/project --prompt-file task.md --json`.
+Claude always uses bubblewrap isolation, even without `--isolate-workspace`, and
+requires matching Claude CLI versions on the controller and Linux worker, Python 3,
+bubblewrap, pasta, nftables, working namespaces and memory-backed `/dev/shm`.
+No worker login or profile mount is needed. Each attempt sends the token over SSH
+stdin, then a private pipe through the sandbox to an exec shim that sets it only
+in Claude's environment. It is never a worker credential file or command argument;
+provider output is redacted before persistence. Fresh volatile HOME storage holds
+`.claude`, `.claude.json`, caches and traces and is removed on exit, failure or stop.
+`CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1` and
+`CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1` remain set; API keys, proxy tokens,
+proxy URLs and cloud-provider variables are excluded from the sandbox environment.
+`--bare` is refused because it ignores OAuth. The outer sandbox owns tool permissions,
+including a read-only checkout for `--permission review`.
+
+Without `--network-access`, the trusted setup resolves `api.anthropic.com` and allows
+HTTPS to those addresses plus public DNS, with other external destinations dropped.
+`--network-access` retains the existing public tool-network policy. Address resolution
+is fixed for the attempt; restart a run if the inference service changes addresses.
+Usage and observed models come from Claude's JSON result. Fresh runs are required;
+remote `--continue-run` remains unsupported.
+
+Remote Antigravity profiles use the worker's existing login, created once by the
+operator in that worker user's normal HOME. Run
+`cdx run agy-profile --remote worker --cwd /srv/project --prompt-file task.md --json`.
+Matching `agy` versions are required on both hosts. Bubblewrap is mandatory;
+each attempt has a memory-backed HOME and mounts only the worker's mode-600
+`.gemini/antigravity-cli/antigravity-oauth-token` authentication file, read-only.
+The installation is read-only. No token is copied into the volatile HOME or sent
+to the controller. A worker token lock excludes concurrent cdx attempts;
+independent native agy launches must be kept out of the same worker account slot.
+`AGY_CLI_DISABLE_AUTO_UPDATE=true` is set. Runs use `-p --output-format json`,
+with closed stdin, and require JSON status `SUCCESS` without refused actions.
+Missing login and expired-session errors require operator login on the worker;
+cdx does not launch an authentication command. Usage is read from the JSON result.
+
+The conservative HTTPS candidate list is `oauth2.googleapis.com`,
+`cloudcode-pa.googleapis.com` and `daily-cloudcode-pa.googleapis.com`, resolved
+on the worker before isolation, plus DNS to `1.1.1.1`/`9.9.9.9`. Other public
+traffic is dropped even with `--network-access`; private ranges remain denied.
+This list has **not** been accepted against live inference in the mission sandbox.
+The token remains read-only pending a measured receipt showing whether refresh
+writes it in place. See
+`logics/runbook/fragments/2026-11-03-antigravity-44674fc58c.md` for evidence and
+the host measurement command. Local Antigravity headless runs retain their profile HOME
+and credentials; the worker login, token lock and volatile HOME policy apply only
+to remote runs.
+
+Remote Ollama profiles use the worker's unauthenticated HTTP API at
+`127.0.0.1:11434`, with `/api/show` followed by `/api/chat` (`stream: false`).
+Use `cdx run local --remote worker --cwd /srv/project --model qwen3:8b --prompt-file question.txt --isolate-workspace --json`.
+The prompt file is read on the launching host; the model must already exist on
+the worker. This is text generation only, not an autonomous coding agent, and
+it does not edit the repository. The result includes `execution_mode`, an
+`execution_note`, generated text in `result`, and `prompt_eval_count` / `eval_count`
+alongside normalized `usage` counters. Missing models and unreachable APIs fail
+without pulling models or authenticating. Isolated clients use a private Unix
+socket relay restricted to capability and non-streaming inference calls for the
+selected model, with a read-only checkout and no network or model-file mounts.
+`--network-access` does not enable networking for this text-only client.
+
 Known headless and completed interactive token usage is persisted in launch history and can be aggregated later. Interactive records are best-effort local data: Codex reads its latest cumulative rollout snapshot, Claude reads its assistant usage records, and Ollama — which writes no transcript of its own — is launched with `--verbose` so its per-response token counts land in the terminal capture cdx already takes. Antigravity reports no usage: its history is schema-less binary protobuf and its logs carry no usage line, so those sessions show no tokens by nature rather than by omission.
 
 `--continue-run RUN_ID` resumes the exact provider conversation from a finished Claude or Codex run, inferring its profile and pinning its recorded model and effort. Existing targets and settings may be supplied only if they match. The parent transcript must still exist. `parent_run_id` links the new run to its parent in run results, the registry, and history; `conversation_id` identifies the provider conversation. Detached continuations preserve these settings through the cdx supervisor. Codex continuation usage is measured between exact transcript snapshots before and after the run, since exec resume can report conversation totals. If either boundary is unavailable, per-run usage stays unknown with `usage_attribution: "continuation_usage_unavailable"` in history instead of counting earlier turns again. Continuation does not use automatic capacity recovery or model fallback, and cannot be combined with `--failover` or `--isolate-workspace`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.25.8",
+  "version": "0.26.0",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.25.8"
+version = "0.26.0"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9.2"

package/src/antigravity_status.py

@@ -0,0 +1,161 @@
+"""Local Antigravity statusLine capture; no credential or network access."""
+
+import argparse
+import base64
+import json
+import math
+import os
+import shlex
+import subprocess
+import sys
+import tempfile
+from datetime import datetime, timezone
+
+STATE_NAME = "cdx-quota.json"
+MARKER = "--cdx-antigravity-status"
+
+
+def _directory(home):
+    return os.path.join(home, ".gemini", "antigravity-cli")
+
+
+def _date(value):
+    try:
+        parsed = datetime.fromisoformat(str(value).replace("Z", "+00:00"))
+        return parsed if parsed.tzinfo is not None else None
+    except (ValueError, TypeError):
+        return None
+
+
+def _quota(value):
+    result = {}
+    if not isinstance(value, dict):
+        return result
+    for name, bucket in value.items():
+        if not isinstance(bucket, dict):
+            continue
+        clean = {}
+        fraction = bucket.get("remaining_fraction")
+        if isinstance(fraction, (int, float)) and not isinstance(fraction, bool) and math.isfinite(fraction) and 0 <= fraction <= 1:
+            clean["remaining_fraction"] = fraction
+        reset = _date(bucket.get("reset_time"))
+        if reset:
+            clean["reset_time"] = reset.isoformat()
+        seconds = bucket.get("reset_in_seconds")
+        if isinstance(seconds, (int, float)) and not isinstance(seconds, bool) and math.isfinite(seconds) and seconds >= 0:
+            clean["reset_in_seconds"] = seconds
+        result[name] = clean
+    return result
+
+
+def capture(payload, state_path, now=None):
+    """Persist only an allowlist, atomically with private permissions."""
+    if not isinstance(payload, dict):
+        return
+    now = now or datetime.now(timezone.utc)
+    state = {"time": now.isoformat(),
+             "plan_tier": payload.get("plan_tier") if isinstance(payload.get("plan_tier"), str) else None,
+             "quota": _quota(payload.get("quota"))}
+    directory = os.path.dirname(state_path)
+    os.makedirs(directory, exist_ok=True)
+    fd, temporary = tempfile.mkstemp(prefix=".cdx-quota-", dir=directory)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            json.dump(state, handle)
+            handle.write("\n")
+        os.replace(temporary, state_path)
+    finally:
+        if os.path.exists(temporary):
+            os.unlink(temporary)
+
+
+def install(home):
+    """Merge the hook without replacing unrelated settings or user output."""
+    from .agent_notify import _read_json, _write_json
+
+    path = os.path.join(_directory(home), "settings.json")
+    settings = _read_json(path)
+    if settings is None:
+        return False
+    status = settings.get("statusLine") or {}
+    if not isinstance(status, dict) or (status and status.get("type") != "command"):
+        return False
+    previous = status.get("command") or ""
+    if not isinstance(previous, str):
+        return False
+    try:
+        parts = shlex.split(previous, posix=os.name != "nt")
+    except ValueError:
+        parts = []
+    own_command = (len(parts) >= 3 and os.path.basename(parts[1].strip('"')) == "antigravity_status.py"
+                   and parts[2] == MARKER)
+    if own_command:
+        index = parts.index("--previous") + 1 if "--previous" in parts else len(parts)
+        encoded = parts[index] if index < len(parts) else ""
+    else:
+        encoded = base64.urlsafe_b64encode(previous.encode()).decode()
+    args = [sys.executable, os.path.abspath(__file__), MARKER,
+            "--state", os.path.join(_directory(home), STATE_NAME)]
+    if encoded:
+        args += ["--previous", encoded]
+    command = subprocess.list2cmdline(args) if os.name == "nt" else shlex.join(args)
+    merged = {**status, "type": "command", "command": command}
+    if settings.get("statusLine") == merged:
+        return True
+    return _write_json(path, {**settings, "statusLine": merged})
+
+
+def read_status(home, now=None):
+    """Expose every bucket; use only fresh Gemini windows for availability."""
+    now = now or datetime.now(timezone.utc)
+    try:
+        with open(os.path.join(_directory(home), STATE_NAME), encoding="utf-8") as handle:
+            state = json.load(handle)
+    except (OSError, ValueError):
+        state = {}
+    if not isinstance(state, dict):
+        state = {}
+    at = _date(state.get("time"))
+    age = max(0, (now - at).total_seconds()) if at else None
+    stale = age is not None and age > 24 * 60 * 60
+    quota = _quota(state.get("quota"))
+    for bucket in quota.values():
+        reset = _date(bucket.get("reset_time"))
+        valid = at is not None and not stale and reset is not None and reset > now
+        bucket["status"] = "stale" if stale else "current" if valid else "unknown"
+        if not valid:
+            bucket["remaining_fraction"] = None
+    result = {"updated_at": at.isoformat() if at else None, "reading_age_seconds": age,
+              "quota_stale": stale, "quota_status": "stale" if stale else "current" if at else "unknown",
+              "plan_tier": state.get("plan_tier"), "quota": quota}
+    for window, name in (("5h", "gemini-5h"), ("week", "gemini-weekly")):
+        bucket = quota.get(name, {})
+        reset = _date(bucket.get("reset_time"))
+        valid = at is not None and not stale and reset is not None and reset > now
+        fraction = bucket.get("remaining_fraction") if valid else None
+        result[f"remaining_{window}_pct"] = fraction * 100 if fraction is not None else None
+        result[f"reset_{window}_at"] = reset.astimezone().strftime("%b %d %H:%M") if valid else None
+        result[f"reset_{window}_at_iso"] = reset.isoformat() if valid else None
+    return result
+
+
+def main(stdin=None):
+    parser = argparse.ArgumentParser()
+    parser.add_argument(MARKER, action="store_true")
+    parser.add_argument("--state", required=True)
+    parser.add_argument("--previous", default="")
+    args = parser.parse_args()
+    raw = (stdin or sys.stdin).read()
+    try:
+        capture(json.loads(raw), args.state)
+    except (ValueError, OSError, TypeError):
+        # A failed capture must not suppress the user's existing status line.
+        pass
+    if args.previous:
+        command = base64.urlsafe_b64decode(args.previous).decode()
+        return subprocess.run(command, shell=True, input=raw, text=True, check=False).returncode
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/src/claude_remote_token.py

@@ -0,0 +1,45 @@
+"""Dedicated controller-side Claude setup token, never a worker profile."""
+
+import os
+import re
+import stat
+import tempfile
+from pathlib import Path
+
+from .errors import CdxError
+
+TOKEN_FILE = '.cdx-remote-claude-token'
+
+
+def store_token(session, token):
+    token = token.strip()
+    if not re.fullmatch(r'[A-Za-z0-9._-]{1,16384}', token):
+        raise CdxError('Provide one Claude setup token on standard input.')
+    home = Path(session['authHome'])
+    home.mkdir(parents=True, exist_ok=True)
+    descriptor, temporary = tempfile.mkstemp(prefix='.claude-token-', dir=home)
+    try:
+        with os.fdopen(descriptor, 'w') as handle:
+            handle.write(token)
+        os.replace(temporary, home / TOKEN_FILE)
+    finally:
+        if os.path.exists(temporary):
+            os.unlink(temporary)
+
+
+def read_token(session):
+    try:
+        path = Path(session['authHome']) / TOKEN_FILE
+        with open(path, opener=lambda name, flags: os.open(name, flags | getattr(os, "O_NOFOLLOW", 0))) as handle:
+            info = os.fstat(handle.fileno())
+            if not stat.S_ISREG(info.st_mode) or stat.S_IMODE(info.st_mode) != 0o600 or (hasattr(os, "getuid") and info.st_uid != os.getuid()):
+                raise ValueError('Unsafe token file')
+            token = handle.read(16385).strip()
+        if not re.fullmatch(r'[A-Za-z0-9._-]{1,16384}', token):
+            raise ValueError('Invalid token')
+        return token
+    except (OSError, ValueError) as error:
+        raise CdxError(
+            f"Remote Claude requires a dedicated setup token; run cdx auth claude-token {session['name']} "
+            "with the token from claude setup-token on standard input.", code='remote_claude_token_missing',
+        ) from error