cdx-manager 0.9.13 → 0.9.15

package/src/provider_runtime.py

@@ -695,6 +695,45 @@ def _redact_sensitive_args(spec):
     return [REDACTED_PROMPT_ARG if arg in sensitive else arg for arg in args]
 
 
+def _signal_child_group(child, sig):
+    # Providers spawn helpers of their own; signal the whole group so
+    # grandchildren die with the child. Falls back to False when the child
+    # shares our group (test doubles spawned without start_new_session).
+    pid = getattr(child, "pid", None)
+    if not pid or not hasattr(os, "getpgid"):
+        return False
+    try:
+        pgid = os.getpgid(pid)
+        if pgid == os.getpgid(0):
+            return False
+        os.killpg(pgid, sig)
+        return True
+    except (OSError, TypeError):
+        return False
+
+
+def _terminate_child_tree(child):
+    if not _signal_child_group(child, signal.SIGTERM):
+        try:
+            child.terminate()
+        except Exception:
+            pass
+    try:
+        child.wait(timeout=5)
+        return
+    except Exception:
+        pass
+    if not _signal_child_group(child, signal.SIGKILL):
+        try:
+            child.kill()
+        except Exception:
+            pass
+    try:
+        child.wait()
+    except Exception:
+        pass
+
+
 def _run_headless_provider_command(session, cwd=None, env_override=None, initial_prompt=None,
                                    timeout_seconds=None, spawn=None, run_id=None):
     spawn = spawn or subprocess.Popen
@@ -714,12 +753,16 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
     timed_out = False
     with open(paths["stdout_path"], "w", encoding="utf-8", errors="replace") as stdout_file, \
             open(paths["stderr_path"], "w", encoding="utf-8", errors="replace") as stderr_file:
+        options = {k: v for k, v in spec.get("options", {}).items() if k not in ("stdio", "stdout", "stderr")}
+        if spawn is subprocess.Popen:
+            # Own process group so a timeout can kill grandchildren too.
+            options["start_new_session"] = True
         try:
             child = spawn(
                 [command] + spec["args"],
                 stdout=stdout_file,
                 stderr=stderr_file,
-                **{k: v for k, v in spec.get("options", {}).items() if k not in ("stdio", "stdout", "stderr")},
+                **options,
             )
         except FileNotFoundError as error:
             _combine_headless_transcript(paths)
@@ -740,18 +783,7 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
             child.wait()
         except subprocess.TimeoutExpired:
             timed_out = True
-            try:
-                child.terminate()
-                child.wait(timeout=5)
-            except Exception:
-                try:
-                    child.kill()
-                except Exception:
-                    pass
-                try:
-                    child.wait()
-                except Exception:
-                    pass
+            _terminate_child_tree(child)
 
     _combine_headless_transcript(paths)
     end_time = datetime.now(timezone.utc)

package/src/run_registry.py

@@ -1,6 +1,8 @@
 import json
 import os
+import sys
 import tempfile
+from contextlib import contextmanager
 from datetime import datetime, timezone
 
 
@@ -12,6 +14,28 @@ def registry_path(base_dir):
     return os.path.join(base_dir, "runs.json")
 
 
+@contextmanager
+def _registry_lock(path):
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    with open(path + ".lock", "a") as handle:
+        if sys.platform == "win32":
+            import msvcrt
+            handle.seek(0)
+            msvcrt.locking(handle.fileno(), msvcrt.LK_LOCK, 1)
+            try:
+                yield
+            finally:
+                handle.seek(0)
+                msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+        else:
+            import fcntl
+            fcntl.flock(handle, fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(handle, fcntl.LOCK_UN)
+
+
 def _read_registry(path):
     try:
         with open(path, encoding="utf-8") as handle:
@@ -76,7 +100,9 @@ def _base_record(run_id, *, kind, session, provider, model, cwd, artifacts=None)
         "provider": provider,
         "model": model,
         "cwd": os.path.abspath(cwd),
-        "pid": None,
+        # The manager process drives the run synchronously, so its own pid is
+        # the liveness proxy until finish() records the provider child's pid.
+        "pid": os.getpid(),
         "started_at": utc_now_iso(),
         "ended_at": None,
         "duration_seconds": None,
@@ -94,14 +120,19 @@ class RunRegistry:
         self.path = registry_path(base_dir)
 
     def start(self, run_id, *, kind, session, provider, model, cwd, artifacts=None):
-        data = _read_registry(self.path)
-        data["runs"] = [run for run in data["runs"] if run.get("run_id") != run_id]
-        record = _base_record(run_id, kind=kind, session=session, provider=provider, model=model, cwd=cwd, artifacts=artifacts)
-        data["runs"].insert(0, record)
-        _write_registry(self.path, data)
+        with _registry_lock(self.path):
+            data = _read_registry(self.path)
+            data["runs"] = [run for run in data["runs"] if run.get("run_id") != run_id]
+            record = _base_record(run_id, kind=kind, session=session, provider=provider, model=model, cwd=cwd, artifacts=artifacts)
+            data["runs"].insert(0, record)
+            _write_registry(self.path, data)
         return record
 
     def finish(self, run_id, *, status, final_payload=None, run_info=None, error=None, task_report=None):
+        with _registry_lock(self.path):
+            return self._finish_locked(run_id, status=status, final_payload=final_payload, run_info=run_info, error=error, task_report=task_report)
+
+    def _finish_locked(self, run_id, *, status, final_payload=None, run_info=None, error=None, task_report=None):
         data = _read_registry(self.path)
         now = utc_now_iso()
         for run in data["runs"]:
@@ -137,17 +168,19 @@ class RunRegistry:
         return None
 
     def list(self, limit=20):
-        data = _read_registry(self.path)
-        changed = _refresh_stale_runs(data)
-        if changed:
-            _write_registry(self.path, data)
+        with _registry_lock(self.path):
+            data = _read_registry(self.path)
+            changed = _refresh_stale_runs(data)
+            if changed:
+                _write_registry(self.path, data)
         return data["runs"][: max(0, int(limit or 20))]
 
     def get(self, run_id):
-        data = _read_registry(self.path)
-        changed = _refresh_stale_runs(data)
-        if changed:
-            _write_registry(self.path, data)
+        with _registry_lock(self.path):
+            data = _read_registry(self.path)
+            changed = _refresh_stale_runs(data)
+            if changed:
+                _write_registry(self.path, data)
         for run in data["runs"]:
             if run.get("run_id") == run_id:
                 return run

package/src/run_usage.py

@@ -46,7 +46,9 @@ def _parse_json_records(text):
         try:
             records.append(json.loads(line))
         except json.JSONDecodeError:
-            return []
+            # A single truncated/noisy line must not discard the usage
+            # carried by every other valid JSONL record in the stream.
+            continue
     return records
 
 

package/src/session_service.py

@@ -14,7 +14,7 @@ from .claude_usage import _decode_jwt_claims
 from .codex_usage import fetch_codex_rate_limits
 from .config import PROVIDER_ANTIGRAVITY, PROVIDER_CLAUDE, PROVIDER_CODEX, PROVIDERS, get_cdx_home
 from .errors import CdxError
-from .fs_utils import remove_tree
+from .fs_utils import atomic_write, remove_tree
 from .session_store import create_session_store
 from .status_source import find_latest_status_artifact
 
@@ -266,6 +266,7 @@ def _normalize_status_payload(payload=None):
         "updated_at": _to_local_iso(payload.get("updated_at") or payload.get("captured_at") or now),
         "raw_status_text": payload.get("raw_status_text"),
         "source_ref": payload.get("source_ref"),
+        "structured": bool(payload.get("structured")),
     }
 
 
@@ -366,6 +367,12 @@ def _merge_status_payload(current, candidate):
         if merged.get(field) is None and candidate.get(field) is not None:
             merged[field] = candidate[field]
 
+    # The structured marker qualifies the source_ref; keep them in sync when
+    # the merge adopts the candidate's ref, else a structured rollout ref
+    # would read as low-confidence scraped text.
+    if merged.get("source_ref") is not None and merged["source_ref"] == candidate.get("source_ref"):
+        merged["structured"] = bool(candidate.get("structured"))
+
     merged["updated_at"] = candidate.get("updated_at") or current.get("updated_at")
     return merged
 
@@ -386,6 +393,10 @@ def _compute_available_pct(status):
 def _is_low_confidence_status_source(status):
     if not status:
         return False
+    if status.get("structured"):
+        # Exact rate_limits API data: trustworthy even when it comes from a
+        # sessions/rollout path, which otherwise flags scraped-text noise.
+        return False
     source_ref = str(status.get("source_ref") or "").replace(os.sep, "/")
     return "/sessions/" in source_ref and "/rollout" in source_ref
 
@@ -425,9 +436,7 @@ def _ensure_claude_attribution_disabled(auth_home):
         settings = {}
     settings["includeCoAuthoredBy"] = False
     try:
-        with open(settings_path, "w", encoding="utf-8") as handle:
-            json.dump(settings, handle, indent=2, sort_keys=True)
-            handle.write("\n")
+        atomic_write(settings_path, json.dumps(settings, indent=2, sort_keys=True) + "\n", mode=0o644)
     except OSError:
         return False
     return True
@@ -478,23 +487,29 @@ def create_session_service(options=None):
         )
 
     def _session_runtime(name):
-        state = store["read_session_state"](name)
-        if not state:
+        found = {}
+
+        def updater(state):
+            if not state:
+                return None
+            runtime = state.get("runtime")
+            if _runtime_is_active(runtime):
+                found["runtime"] = runtime
+                return None
+            if isinstance(runtime, dict) and runtime.get("status") == "running":
+                return {
+                    **state,
+                    "status": "ready",
+                    "runtime": {
+                        **runtime,
+                        "status": "stale",
+                        "endedAt": _local_now_iso(),
+                    },
+                }
             return None
-        runtime = state.get("runtime")
-        if _runtime_is_active(runtime):
-            return runtime
-        if isinstance(runtime, dict) and runtime.get("status") == "running":
-            store["write_session_state"](name, {
-                **state,
-                "status": "ready",
-                "runtime": {
-                    **runtime,
-                    "status": "stale",
-                    "endedAt": _local_now_iso(),
-                },
-            })
-        return None
+
+        store["update_session_state"](name, updater)
+        return found.get("runtime")
 
     def _validate_new_session_name(name):
         if not name:
@@ -755,11 +770,14 @@ def create_session_service(options=None):
             raise CdxError(f"Unknown session: {name}")
         if session.get("enabled", True) is False:
             raise CdxError(f"Session is disabled: {name}")
-        state = store["read_session_state"](name)
-        if not state:
-            raise CdxError(f"Session state missing for {name}. Reconnect required.")
         now = _local_now_iso()
-        store["write_session_state"](name, {**state, "rehydratedAt": now})
+
+        def state_updater(state):
+            if not state:
+                raise CdxError(f"Session state missing for {name}. Reconnect required.")
+            return {**state, "rehydratedAt": now}
+
+        store["update_session_state"](name, state_updater)
         return store["update_session"](name, lambda s: {
             **s, "updatedAt": now, "lastLaunchedAt": now
         })
@@ -768,9 +786,6 @@ def create_session_service(options=None):
         session = store["get_session"](name)
         if not session:
             raise CdxError(f"Unknown session: {name}")
-        state = store["read_session_state"](name)
-        if not state:
-            raise CdxError(f"Session state missing for {name}. Reconnect required.")
         payload = dict(payload or {})
         now = _local_now_iso()
         runtime = {
@@ -782,52 +797,70 @@ def create_session_service(options=None):
             "label": payload.get("label"),
             "transcriptPath": payload.get("transcript_path") or payload.get("transcriptPath"),
         }
-        store["write_session_state"](name, {
-            **state,
-            "status": "running",
-            "runtime": runtime,
-        })
+
+        def updater(state):
+            if not state:
+                raise CdxError(f"Session state missing for {name}. Reconnect required.")
+            return {
+                **state,
+                "status": "running",
+                "runtime": runtime,
+            }
+
+        store["update_session_state"](name, updater)
         return runtime
 
     def finish_session_runtime(name, run_id=None, payload=None):
         session = store["get_session"](name)
         if not session:
             raise CdxError(f"Unknown session: {name}")
-        state = store["read_session_state"](name)
-        if not state:
-            return None
-        runtime = state.get("runtime") or {}
-        if run_id and runtime.get("runId") != run_id:
-            return runtime
         payload = dict(payload or {})
-        updated_runtime = {
-            **runtime,
-            "status": payload.get("status") or "stopped",
-            "endedAt": payload.get("endedAt") or _local_now_iso(),
-        }
-        if "returncode" in payload:
-            updated_runtime["returncode"] = payload["returncode"]
-        store["write_session_state"](name, {
-            **state,
-            "status": "ready",
-            "runtime": updated_runtime,
-        })
-        return updated_runtime
+        outcome = {}
+
+        def updater(state):
+            if not state:
+                return None
+            runtime = state.get("runtime") or {}
+            if run_id and runtime.get("runId") != run_id:
+                outcome["runtime"] = runtime
+                return None
+            updated_runtime = {
+                **runtime,
+                "status": payload.get("status") or "stopped",
+                "endedAt": payload.get("endedAt") or _local_now_iso(),
+            }
+            if "returncode" in payload:
+                updated_runtime["returncode"] = payload["returncode"]
+            outcome["runtime"] = updated_runtime
+            return {
+                **state,
+                "status": "ready",
+                "runtime": updated_runtime,
+            }
+
+        store["update_session_state"](name, updater)
+        return outcome.get("runtime")
 
     def ensure_session_state(name):
         session = store["get_session"](name)
         if not session:
             raise CdxError(f"Unknown session: {name}")
-        state = store["read_session_state"](name)
-        if state:
-            return state
-        repaired = {
-            "provider": session["provider"],
-            "status": "ready",
-            "rehydratedAt": None,
-        }
-        store["write_session_state"](name, repaired)
-        return repaired
+        result = {}
+
+        def updater(state):
+            if state:
+                result["state"] = state
+                return None
+            repaired = {
+                "provider": session["provider"],
+                "status": "ready",
+                "rehydratedAt": None,
+            }
+            result["state"] = repaired
+            return repaired
+
+        store["update_session_state"](name, updater)
+        return result["state"]
 
     def list_sessions():
         return store["list_sessions"]()
@@ -853,22 +886,28 @@ def create_session_service(options=None):
         updates = _normalize_launch_settings(settings)
         if not updates:
             raise CdxError("At least one launch setting is required.")
-        current = _normalize_launch_settings(session.get("launch") or {}, mark_fast_service_tier=False)
-        launch = {**current, **updates}
-        explicit_power = "power" in updates or "reasoning_effort" in updates
-        if explicit_power and "fast" not in updates and launch.get("fastMode") != "service_tier":
-            launch["fast"] = False
-            launch.pop("fastMode", None)
-        if updates.get("fast") is False:
-            launch.pop("fastMode", None)
-            if not any(key in launch for key in ("power", "reasoning_effort", "reasoningEffort")):
-                launch["power"] = DEFAULT_LAUNCH_SETTINGS["power"]
         now = _local_now_iso()
-        return store["update_session"](name, lambda s: {
-            **s,
-            "launch": launch,
-            "updatedAt": now,
-        })
+
+        def updater(s):
+            # Build the new launch dict from the fresh record inside the store
+            # lock; a pre-lock snapshot loses a concurrent setting change.
+            current = _normalize_launch_settings(s.get("launch") or {}, mark_fast_service_tier=False)
+            launch = {**current, **updates}
+            explicit_power = "power" in updates or "reasoning_effort" in updates
+            if explicit_power and "fast" not in updates and launch.get("fastMode") != "service_tier":
+                launch["fast"] = False
+                launch.pop("fastMode", None)
+            if updates.get("fast") is False:
+                launch.pop("fastMode", None)
+                if not any(key in launch for key in ("power", "reasoning_effort", "reasoningEffort")):
+                    launch["power"] = DEFAULT_LAUNCH_SETTINGS["power"]
+            return {
+                **s,
+                "launch": launch,
+                "updatedAt": now,
+            }
+
+        return store["update_session"](name, updater)
 
     def unset_launch_settings(name, keys):
         session = store["get_session"](name)
@@ -880,12 +919,12 @@ def create_session_service(options=None):
         unknown = [key for key in keys if key not in allowed]
         if unknown:
             raise CdxError(f"Unsupported launch setting: {', '.join(unknown)}")
-        current = dict(session.get("launch") or {})
-        for key in keys:
-            current.pop(key, None)
         now = _local_now_iso()
 
         def updater(s):
+            current = dict(s.get("launch") or {})
+            for key in keys:
+                current.pop(key, None)
             updated = {**s, "updatedAt": now}
             if current:
                 updated["launch"] = current
@@ -972,6 +1011,9 @@ def create_session_service(options=None):
                     global_root,
                     session["provider"],
                     expected_account_email=expected_account_email,
+                    # The shared codex home can hold other accounts' rollouts;
+                    # structured payloads there cannot be attributed to ours.
+                    trust_unattributed_structured=False,
                 )
         if not artifact:
             if _is_low_confidence_status_source(current_status):
@@ -988,6 +1030,7 @@ def create_session_service(options=None):
             "updated_at": artifact.get("updated_at"),
             "raw_status_text": artifact.get("raw_status_text"),
             "source_ref": artifact.get("source_ref"),
+            "structured": artifact.get("structured"),
         })
         if _is_low_confidence_status_source(current_status) and not _is_low_confidence_status_source(resolved):
             record_status(session["name"], resolved)
@@ -1269,14 +1312,10 @@ def create_session_service(options=None):
         bundle_bytes = encode_bundle(payload, include_auth=include_auth, passphrase=passphrase)
         if progress_callback:
             progress_callback({"event": "writing_started", "path": file_path, "bundle_size_bytes": len(bundle_bytes)})
-        os.makedirs(os.path.dirname(os.path.abspath(file_path)) or ".", exist_ok=True)
-        with open(file_path, "wb") as handle:
-            handle.write(bundle_bytes)
-        if sys.platform != "win32":
-            try:
-                os.chmod(file_path, 0o600)
-            except OSError:
-                pass
+        # Atomic + 0o600 from the start: the export path may live in a
+        # world-traversable directory, and a crash must not clobber a
+        # previous good bundle with a truncated one.
+        atomic_write(os.path.abspath(file_path), bundle_bytes, mode=0o600)
         return {
             "path": file_path,
             "include_auth": include_auth,
@@ -1327,8 +1366,12 @@ def create_session_service(options=None):
             _ensure_private_dir(session_root)
             _ensure_private_dir(auth_home)
 
+            existing_state_before = None
             if is_existing and merge:
                 existing_record = store["get_session"](name) or {}
+                # replace_session resets the state file to defaults, so the
+                # local state must be captured before it runs.
+                existing_state_before = store["read_session_state"](name) or {}
                 bundle_record = {
                     **session_payload,
                     "provider": provider,
@@ -1352,13 +1395,12 @@ def create_session_service(options=None):
                 store["replace_session"](name, session_record)
 
             state = (payload.get("states") or {}).get(name)
-            if state is not None:
-                if is_existing and merge:
-                    existing_state = store["read_session_state"](name) or {}
-                    merged_state = {**state, **{k: v for k, v in existing_state.items() if v is not None}}
+            if is_existing and merge:
+                merged_state = {**(state or {}), **{k: v for k, v in (existing_state_before or {}).items() if v is not None}}
+                if merged_state:
                     store["write_session_state"](name, merged_state)
-                else:
-                    store["write_session_state"](name, state)
+            elif state is not None:
+                store["write_session_state"](name, state)
 
             for item in (payload.get("profiles") or {}).get(name, []):
                 rel_path = _safe_relpath(item.get("path"))
@@ -1371,13 +1413,8 @@ def create_session_service(options=None):
                 if is_existing and merge and os.path.exists(dest_path):
                     continue
                 _ensure_private_dir(os.path.dirname(dest_path))
-                with open(dest_path, "wb") as handle:
-                    handle.write(content)
-                if sys.platform != "win32":
-                    try:
-                        os.chmod(dest_path, 0o600)
-                    except OSError:
-                        pass
+                # Decrypted credentials: 0o600 from creation, no umask window.
+                atomic_write(dest_path, content, mode=0o600)
 
         return {
             "path": file_path,

package/src/session_store.py

@@ -260,6 +260,16 @@ def create_session_store(base_dir):
         with _file_lock(lock_file):
             _write_session_state_unlocked(name, state)
 
+    def update_session_state(name, updater):
+        # Read-modify-write under one lock; separate read/write calls let a
+        # concurrent writer's update be clobbered between the two.
+        with _file_lock(lock_file):
+            state = _read_session_state_unlocked(name)
+            updated = updater(state)
+            if updated is not None:
+                _write_session_state_unlocked(name, updated)
+            return updated
+
     def append_launch_history(entry):
         with _file_lock(lock_file):
             _ensure_dir(state_dir)
@@ -303,6 +313,7 @@ def create_session_store(base_dir):
         "replace_session": replace_session,
         "read_session_state": read_session_state,
         "write_session_state": write_session_state,
+        "update_session_state": update_session_state,
         "append_launch_history": append_launch_history,
         "list_launch_history": list_launch_history,
     }