[salmonumbrella]

What changed

• Usage & Spend → By machine runs the identified-request collector that landed with [Cross-machine spend 2/6] Support multiple SSH hosts for identified Codex usage #4834 (including the [Cross-machine spend 1/6] Price deduplicated Codex identified-request subtotals #4836 pricing) only when you open it, press its Refresh, or change the period while it's open. This detail doesn't start SSH in the background or collect at launch.
• You choose which SSH aliases get queried, using the shared Agent Sessions host list. Changing the selection cancels any running collection and clears the result. If you remove an alias and add it back, you have to select it again before it's queried.
• This Mac plus each selected host gets a row. Total counts shared request identities once. Unavailable machines, partial coverage and unpriced subtotals each get a label, so a missing source never shows up as $0. A failed source also shows the collector's own recovery message under its row.
• The host editor now saves on submit, focus loss or close, not on every keystroke. It also works with monitoring off and shows the existing validator message for a bad alias.
• Shared collection code moved out of the CLI into CodexBarCore. The collector's local limits are unchanged. Production diff over current main, where [Cross-machine spend 2/6] Support multiple SSH hosts for identified Codex usage #4834 has landed: +451/−107 in Sources/, including localization.

Why

#4833 needs per-machine Codex spend without double counting requests that show up on more than one machine. A background SSH lifecycle and persisted auto-collection made the earlier version much bigger than the feature needs. This version only collects when you're looking at the detail, and shows missing coverage as missing.

Usage

Add SSH aliases under Settings → Menu → Additional SSH hosts. Then open Settings → Usage & Spend → By machine, tick the hosts you want, and press Refresh. The CLI equivalent:

CodexBarCLI cost --provider codex --identified-only --format json --days 7 \
  --remote <ssh-alias-a> --remote <ssh-alias-b>

Recording

Historical, from the retired 9540b18 head.

on-demand-walkthrough.mp4

Screenshots

Historical 9540b18 captures, kept for reference:

	Before	After
Host editor, monitoring off
Host editor, invalid alias

By machine (new)	Dark
One host selected
Both hosts
Local unavailable, partial
Unknown model, unpriced

Current 9b7a0ed captures, using generated fixtures:

By machine (9b7a0ed)	Dark
Remote source failed, recovery message
Recovered after Refresh
Local unavailable, partial
Unknown model, unpriced

Previous 2ffd6ec captures, from before the rebase onto main and the recovery-message fix:

By machine (2ffd6ec)	Dark
One host selected
Both hosts
Local unavailable, partial
Unknown model, unpriced

Proof

Current head 9b7a0ed, on fully generated accounting data only. The packaged Mac CLI and app talked over real SSH to an exact-head Linux CLI built separately on the OrbStack Linux VM. Same command shape as below.

• Normal: sources 2/2/2 → 4 unique, 44,000 tokens, $0.16. Exit 0, not partial.
• Unknown model locally: sources 1/2/2 → 4 unique, 44,000 tokens, null cost with 1 unpriced. Exit 0, not partial.
• Local missing: sources 0/2/2 → 3 unique, 33,000 tokens, $0.12. Exit 1, partial.
• These are tiny behavior fixtures. The timings say nothing about speed on a full history.
• In the app, a generated peer that only speaks schema 1 makes Machine 1 Unavailable, with the message to check SSH and update its CLI for schema 2 --identified-only. Total shows 3 / 33K / $0.12, Partial data. After I restored the current peer and pressed Refresh, Total showed 4 / 44K / $0.16 and the message was gone. Local-missing still shows This Mac Unavailable with its caption and a partial Total. Unknown model shows This Mac 1 / 11K / Unpriced, each host 2 / 22K / $0.08, Total 4 / 44K / Unpriced. App startup stayed collapsed with no SSH before opening the detail.

Previous proof on 2ffd6ec, not rerun on 9b7a0ed. The fix only passes the failed source's message into the existing row and doesn't change the collection lifecycle. Same generated-data setup.

• Normal: sources 2/2/2 → 4 unique requests, 44,000 tokens, $0.16. Exit 0, not partial.
• Unknown model locally: sources 1/2/2 → 4 unique, 44,000 tokens, null cost with 1 unpriced. Exit 0, not partial.
• Local missing: sources 0/2/2 → 3 unique, 33,000 tokens, $0.12. Exit 1, partial.
• These tiny fixtures ran in under half a second. That only shows the behavior is right, it says nothing about speed on a full history.
• In the app (receipts A/B): collapsed startup stayed at 3/3. Opening with only A selected went to 4/3 and showed This Mac 2, Machine 1 2, Total 3 / 33K / $0.12. Selecting B cleared the result with no SSH (still 4/3). Refresh went to 5/4 and showed Total 4 / 44K / $0.16. With an artificial 15s delay on A's transport, I refreshed both, then deselected B while A was blocked. The result cleared and B never launched (6/4). After a restart the detail stayed collapsed with no SSH for 31s (6/4), and opening it kept A on, B off, 3 / 33K / $0.12.
• Unknown-model UI: This Mac 1 / 11K / Unpriced, each host 2 / 22K / $0.08, Total 4 / 44K / Unpriced. Missing-local UI: This Mac Unavailable, each host 2 / 22K / $0.08, Total 3 / 33K / $0.12, Partial data.

Historical proof from the retired head, run on 9540b18 with the packaged CLI on a Mac mini and two dedicated SSH profiles using distinct accounting extracts on the same OrbStack Linux VM:

CodexBar.app/Contents/Helpers/CodexBarCLI cost --provider codex --identified-only --format json --days 7 --identified-end <pinned-ms> --remote <ssh-a> --remote <ssh-b>

• Accounting extracts: exit 0 in 2.16s. Sources 50/50/37 → 75 unique requests, 10,976,921 tokens, $1.30140522. 0 unpriced, 0 conflicts, not partial.
• Full default mini history (908 files, ~5.3 GB): exit 1 after ~99s. Local was unavailable, so the result covers only the two SSH profiles (50/37 → 75 unique, $1.30) and is marked partial. I'm not claiming the full local history contributes, or that this scan is fast.
• In the app: no SSH at launch while collapsed. Opening with one host selected ran exactly one SSH call. Selecting the second host only cleared the result. Refresh ran one SSH call per host. Deselecting a host during collection cancelled it with no later SSH launches observed, and after a restart the remaining selection persisted and the detail was collapsed.

Redacted app child-process observations and remote CLI receipts:

head=9540b181f
fresh-start-closed-detail: observed_ssh=0, seconds=30.042, children=[]
expand-A-selected-B-unselected: observed_ssh=1, seconds=15.049, children=[Machine 1:82304]
manual-refresh-both-selected: observed_ssh=2, seconds=15.01, children=[Machine 1:82701, Machine 2:82706]
revoke-B-during-default-mini-scan: observed_ssh=0, seconds=120.049, children=[]
restart-retains-B-revocation-no-auto-collection: observed_ssh=0, seconds=30.05, children=[]
manual-default-mini-partial-both-selected: observed_ssh=2, seconds=150.047, children=[Machine 1:89891, Machine 2:89899]
remote CLI receipt counts (Machine 1 / Machine 2):
baseline: 10 / 7
A-only: 11 / 7
selection-only: 11 / 7
both-refresh: 12 / 8
revocation: 12 / 8

Tests at 9b7a0ed: 86 tests in 5 suites pass. That's MachineSpendTests (4) and ProviderArchitectureGatekeeperTests (48) natively, plus the portable CodexRequestSubtotalTests (31) and 3 documented/strict CLI invocation tests. make check is clean (SwiftLint, 0 violations across 3163 files). Codex review was unavailable due to its usage quota.

Earlier, at 2ffd6ec: MachineSpendTests (3) and the portable CodexRequestSubtotalTests (30) pass on macOS, and the portable 30 also pass on Linux aarch64 with Swift 6.3.3. Before the test-only cleanup (+72/−222 in two test files, no production change after), the broader 6 suites / 78 tests passed, including PreferencesPaneSmokeTests, Fast pricing, Codex session tier and coverage compatibility.

Refs #4833, slice 5 (on-demand machine detail)

Follow-up: #4876 adds CLI setup for these SSH hosts and their spend selection.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-31T09:22:18.944291Z We couldn’t complete this review. Comment @codex review to try again.	9b7a0ed	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

Adds opt-in cross-machine Codex spend to Usage & Spend, including shared-request deduplication, collector-side pricing and partial-source reporting.

Example: The supplied synthetic fixture includes local requests, an SSH source, copied requests and an unavailable machine.

• Before: Usage & Spend has no cross-machine subtotal.
• After: The panel shows $1.44 for 660,000 tokens and 3 requests, counts shared requests once and marks coverage partial.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	Useful accounting and clear visual states, with no definite introduced defect found; app integration evidence and an owner decision remain outstanding.
Proof confidence	🦪 silver shellfish (2/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Feature · Worth it: Needs a maintainer decision · Fix scope: Partial
User problem: Users with Codex histories on several machines cannot view a deduplicated combined dollar estimate in Usage & Spend.
Reason: The feature has a concrete use case, but introduces a saved setting, a wire-schema transition and presentation beyond the previously approved first stage.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep open for a maintainer scope decision: this PR adds useful cross-machine accounting, but expands the deliberately token-only contract into pricing, persisted host consent and app presentation.

Priority: P2
Reviewed head: db29f30a99e60739ee199675459295737a419d79
Owner decision: Required. See Decision needed.

Decision needed

• Question: Should this app stage adopt schema-2 pricing and independently persisted SSH cost consent, including rejection of schema-1 peers and resuming consent when a removed host is re-added?
• Recommendation: Settle the prerequisite contracts first: Keep this PR open while the pricing and multi-host stages receive owner decisions, then review the app stage against those accepted contracts.
• Why: The earlier maintainer decision authorized token-only CLI accounting and deferred pricing and UI; the prerequisite PRs remain open without recorded approval for this expanded contract.

Before merge

• Add real behavior proof - Authority-chain proof required: show an allowed selected host reaching the production SSH fetcher, a configured-but-unselected host never reaching SSH launch, and unchecking a queued host during local scanning preventing its later launch, including after restart; the inspected screenshots prove panel rendering and the linked CLI captures prove underlying collection, but neither exercises app consent through its final effect. Supply a recording or redacted launch logs, removing IPs, keys, account details and non-public endpoints. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Resolve security review attention item - Existing SSH hardening is preserved, while the new persisted consent boundary needs final-effect verification.
• Resolve merge risk - The contributor must verify at SSH process launch that configured-but-unselected hosts remain untouched and revoking consent prevents queued collection from contacting that host.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

None.

Provenance

• Existing dashboard refresh and presentation: original intent not found (unknown: Path history identifies shared refresh and account-detail preservation work, but git blame and git show for older dashboard contents failed on missing promisor blob 12c15972cbbbd88555a6711ccb492d68e97a9d63.)

Tests

• Missing end-to-end proof: Missing evidence connects Settings host selection to the production app collector, automatic refresh and consent revocation before SSH launch; the supplied app screenshots use injected loaders.

Agent review details

How this fits together

Selected SSH hosts and configured local Codex histories feed the shared native parser and identity union, which produce priced totals and machine groups for Usage & Spend.

flowchart LR
Settings[Saved host selections] --> Controller[Spend dashboard controller]
Controller --> Local[Local native histories]
Controller --> SSH[Existing SSH cost transport]
Local --> Union[Validated identity union]
SSH --> Union
Union --> Pricing[Collector pricing snapshot]
Pricing --> Panel[Machine spend panel]

Loading

Technical review

Best possible solution:

Agree and land the prerequisite accounting contracts, then deliver the opt-in app panel through the existing parser, SSH transport and refresh owners.

Do we have a high-confidence way to reproduce the issue?

This is a capability extension rather than a reproduced bug: pinned main intentionally provides token-only identified subtotals and has no cross-machine spend panel.

Is this the best way to solve the issue?

Deduplicating before pricing and reusing the existing parser and SSH transport are sound; the expanded accounting and consent contracts need owner direction before this becomes the accepted implementation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 5f93dc3068b3.

Merge-risk options

Maintainer options:

1. Verify consent at the SSH boundary (recommended)
   The contributor supplies production-path evidence that selected hosts are contacted, unselected hosts are not, and revocation during an active collection prevents subsequent SSH launch.
2. Defer automatic app collection
   Maintainers retain the CLI stages and postpone persisted app-driven SSH collection until its consent boundary is demonstrated.

Provenance checked

• Identified-request accounting and pricing changes intended behavior with a stated reason (Add Codex identified-request subtotals over SSH #4447: Provide strong-identity token subtotals over SSH while explicitly deferring combined prices and UI.)
• Partial-source retention and collector extraction keeps the original intent (fa2b14e: Keep successful sources when file metadata disappears or aggregate arithmetic overflows, and exclude foreign legacy usage from Codex coverage.)
• Codex home and SQLite scope keeps the original intent (Fix Claude vendor pricing after #3002 #3012: Keep selected session histories and databases scoped together instead of borrowing ambient account state; the new resolver separates session and configured SQLite locations.)
• Native tier parsing and persisted buffered lines keeps the original intent (6ace82b: Retain Priority settings across cache upgrades; the patch preserves the stored Boolean representation while adding transient unknown-tier evidence.)

Testing

Proof path: shipped entry point.

Security

Needs attention: Existing SSH hardening is preserved, while the new persisted consent boundary needs final-effect verification.

Evidence

What I checked:

• Pinned change and current-main boundary: The introduced diff adds the app panel and includes pricing and multi-host CLI work absent from the pinned main; current main exports schema 1 and deliberately leaves combined cost unavailable. (Sources/CodexBarCore/Providers/Codex/CodexRequestLedger.swift:62, db29f30a99e6)
• Recorded maintainer direction: steipete approved a bounded Codex identity-first CLI stage while explicitly deferring combined pricing, UI and localization in Propose opt-in deduplicated SSH usage ledger for Codex and Claude #4427 (comment), then confirmed unavailable combined pricing when Add Codex identified-request subtotals over SSH #4447 merged.
• Open prerequisite work: [Cross-machine spend 1/6] Price deduplicated Codex identified-request subtotals #4836 owns the schema-2 pricing extension and [Cross-machine spend 2/6] Support multiple SSH hosts for identified Codex usage #4834 owns repeated SSH hosts; both remain open, and neither inspected discussion records maintainer approval for this app stage.
• Persisted consent reaches automatic SSH execution: Saved selections are intersected with the shared configured list, captured in machine requests and passed through the existing SSH fetcher; source changes cancel the prior task and reject stale results. (Sources/CodexBar/SpendDashboard/SpendDashboardMachineSpend.swift:70, db29f30a99e6)
• Inspected visual proof and its boundary: All four downloaded screenshots show the production panel's partial or unknown-price rendering in light and dark appearances; the native proof host replaces local loading and remote fetching with synthetic ledgers, so these images do not establish Settings-to-SSH integration. (Tests/CodexBarTests/SpendDashboardNativeProofTests.swift:66, db29f30a99e6)
• Credited CLI and upgrade evidence: The committed pricing proof records actual local-plus-SSH output and a v0.82.0 CLI upgrade fixture with unchanged history and config fingerprints; [Cross-machine spend 2/6] Support multiple SSH hosts for identified Codex usage #4834 also supplies multi-host fault and cancellation output, but these exercise CLI paths rather than app consent. (.github/pr-proof/identified-request-pricing.md:81, db29f30a99e6)

Likely related people:

• Peter Steinberger: Raw commit fa2b14e adds Sources/CodexBarCore/Providers/Codex/CodexRequestLedger.swift:48 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: fa2b14e5e405; files: Sources/CodexBarCore/Providers/Codex/CodexRequestLedger.swift)
• jkobject: Raw commit d3724b2 adds Sources/CodexBarCore/Providers/Codex/CodexRequestLedger.swift:51 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: d3724b213a66; files: Sources/CodexBarCore/Providers/Codex/CodexRequestLedger.swift)

Labels

Label changes:

• add P2: This is a useful optional accounting improvement with a limited cross-machine user surface.
• add merge-risk: 🚨 compatibility: The new identified-request schema rejects existing schema-1 peers until their CLI is updated.
• add merge-risk: 🚨 security-boundary: Persisted host selections now authorize background SSH execution independently of Agent Sessions, requiring final-effect consent verification.
• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: This is a useful optional accounting improvement with a limited cross-machine user surface.
• merge-risk: 🚨 compatibility: The new identified-request schema rejects existing schema-1 peers until their CLI is updated.
• merge-risk: 🚨 security-boundary: Persisted host selections now authorize background SSH execution independently of Agent Sessions, requiring final-effect consent verification.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add final-effect proof for an unselected SSH host and prove revoking saved consent prevents queued SSH execution before I/O.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 29, 2026, 7:56 AM ET / 11:56 UTC.

[steipete]

Thanks @salmonumbrella. Here's the product direction for the app side: start with an on-demand "by machine" detail in Usage & Spend that runs the accepted collector (#4836/#4834) when you open or refresh it, with no separate background refresh lifecycle, no persisted automatic SSH collection, and no enlarged local admission path. Counting shared requests once and showing unknown prices honestly are the right pieces to keep.

On consent: removing a host from the shared list should clear its cost consent, so re-adding the same alias needs a fresh selection (today costUsageHosts survives remove/re-add). As it stands this PR adds about 1.4k production lines over the pricing head; a trimmed manual detail should land well under that. Deferring past the current release; happy to review a slimmed version on top of the merged CLI slices.

[salmonumbrella]

I cut this down to on-demand By machine detail: open it, press its Refresh, or change the period while it's open. It has no background SSH lifecycle and keeps the collector's local limits. Removing a host clears its consent, with a regression test. Production is now +473/−111 over the pricing head. The body has current-head CLI and app proof, including the full-history mini run with local unavailable and the result labelled partial.

[salmonumbrella]

@codex review

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

An unknown error occurred

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[salmonumbrella]

@codex review

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

An unknown error occurred

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[salmonumbrella]

@codex review

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

An unknown error occurred

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[salmonumbrella]

@codex review

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

An unknown error occurred

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[salmonumbrella]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.