cdx-manager 0.10.0 → 0.11.0

package/README.md

@@ -1,6 +1,6 @@
 # CDX Manager
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.10.0-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.11.0-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Run multiple Codex, Claude, Antigravity, and Ollama sessions from one terminal. Switch between accounts instantly.**
 
@@ -79,8 +79,6 @@ One command to launch any session. Zero auth juggling.
 - Auth probe: synchronous subprocess call to `codex login status` or `claude auth status` before any interactive launch.
 - Signal forwarding: `SIGINT`, `SIGTERM`, and `SIGHUP` are forwarded to the child process and produce clean exit codes.
 - Test stack: `pytest`, `pytest-cov`, and `ruff` via the documented `dev` dependency extra.
-- Python floor decision: `cdx-manager` keeps Python 3.9 support for the 0.9.x line to avoid dropping existing users before a planned compatibility break; classifiers remain aligned with `requires-python = ">=3.9"`.
-
 ---
 
 ## Getting Started
@@ -194,18 +192,18 @@ npm install -g .
 
 Security note:
 
-- The standalone installers try to resolve official release checksums from `checksums/release-archives.json`.
+- The standalone installers resolve official release checksums from the tagged GitHub Release asset `release-archives.json`.
 - You can still override verification explicitly through `CDX_SHA256`.
-- If no checksum is available, standalone installers fail closed unless `CDX_ALLOW_UNVERIFIED=1` is set.
+- If no checksum is available, standalone installers fail closed unless `CDX_ALLOW_UNVERIFIED=1` is set; that override prints a prominent warning before continuing.
 - Prefer `npm`, `pipx`, or `uv` when you want registry-backed install flows.
-- If you use the standalone script, download it first, inspect it, and prefer a release with an official checksum entry.
+- If you use the standalone script, download it first, inspect it, and prefer a release with the official checksum asset attached.
 
 Release maintainer note:
 
 - Before publishing npm or PyPI packages, run `npm run release:validate`.
 - The release tag must match `package.json`, `pyproject.toml`, `src/cli.py`, and `VERSION`.
 - `checksums/release-archives.json` must include the matching `vX.Y.Z` entry with both `github_tarball_sha256` and `github_zip_sha256`.
-- Use `python3 scripts/update_release_checksums.py --tag vX.Y.Z` after the GitHub tag archives exist, commit the checksum update to `main`, then publish the GitHub release only after `npm run release:validate`, `npm run lint`, and `npm test` pass.
+- Use `python3 scripts/update_release_checksums.py --tag vX.Y.Z` after the GitHub tag archives exist, commit the checksum update, attach that file to the tagged GitHub Release as `release-archives.json`, then publish packages only after `npm run release:validate`, `npm run lint`, and `npm test` pass.
 
 ### Environment
 
@@ -523,7 +521,7 @@ Notes:
 - `--include-auth` is encrypted, requires a passphrase, and exports only provider credential files rather than full profile caches or logs.
 - Without `--passphrase-env`, `cdx` prompts in an interactive terminal. Non-interactive callers can pass `--passphrase-stdin` to read the passphrase from stdin (one line) instead of exposing it in the child environment.
 - `--sessions work,perso` exports or imports only a subset.
-- `--force` allows overwriting existing destination sessions during import or replacing an existing bundle file during export.
+- `--force` allows overwriting existing destination sessions during import or replacing an existing bundle file during export. Import refuses to overwrite existing sessions from a bundle without auth payloads unless `--allow-authless-force` is also passed.
 - Auth bundles contain credentials. Treat them like secrets and delete them after transfer.
 
 ---

package/bin/cdx

@@ -3,21 +3,12 @@
 import sys
 from pathlib import Path
 
-
 ROOT = Path(__file__).resolve().parent.parent
 if str(ROOT) not in sys.path:
     sys.path.insert(0, str(ROOT))
 
-from src.cli import format_error, format_json_error, main, wants_json  # noqa: E402
-from src.errors import CdxError  # noqa: E402
+from src.cli import cli_entry  # noqa: E402
 
 
 if __name__ == "__main__":
-    try:
-        raise SystemExit(main(sys.argv[1:]))
-    except CdxError as error:
-        if wants_json(sys.argv[1:]):
-            sys.stderr.write(f"{format_json_error(error)}\n")
-        else:
-            sys.stderr.write(f"{format_error(error)}\n")
-        raise SystemExit(error.exit_code)
+    cli_entry()

package/changelogs/CHANGELOGS_0_11_0.md

@@ -0,0 +1,51 @@
+# CDX Manager 0.11.0
+
+## Highlights
+
+- Fixed Codex structured status parsing so five-hour and weekly reset windows stay mapped to the correct columns.
+- Hardened backup import, provider auth probing, release verification, and Windows launcher generation.
+- Closed the July 2026 review remediation corpus and follow-up Logics workflow with release-ready validation.
+
+## Changes
+
+### Codex status reset windows
+
+Structured Codex status payloads now preserve the distinction between the five-hour and weekly reset timestamps. `cdx status` no longer mirrors the weekly reset into the five-hour reset column, or the reverse, when provider output includes both windows.
+
+### Safer session import and credentials handling
+
+`cdx import --force` refuses to overwrite existing sessions from bundles without auth payloads unless `--allow-authless-force` is explicitly supplied.
+
+Bundle import now validates selected profile paths, base64 payloads, malformed profile collections, and non-object profile entries before touching existing session profiles. Existing profiles are renamed aside during force import and restored if a per-session import fails.
+
+### Provider auth reliability
+
+Provider auth probes are bounded by a 15 second timeout. Timeouts now surface as a degraded authentication state instead of being persisted as `logged_out`.
+
+Codex interactive launches wait on the per-auth-home lock with a bounded retry instead of running unlocked while another process may be rotating OAuth credentials.
+
+Stored `reasoning_effort` and `power` launch settings now clear each other correctly, so setting one cannot leave the other silently shadowing it.
+
+### CLI robustness and release hardening
+
+`cdx history` skips corrupt JSONL lines, `cdx status` tolerates sessions removed during a concurrent scan, `cdx clean profiles` routes profile cleanup flags consistently, `cdx disk --candidates` validates arguments before scanning, and `cdx view --json` now reports a proper failure when the Logics viewer is unavailable.
+
+The npm launcher routes through the same `cli_entry()` path as the Python entrypoint. Standalone installers and publish workflows now use tagged GitHub Release checksum assets rather than main-branch checksum metadata, and `CDX_ALLOW_UNVERIFIED=1` prints a prominent warning before continuing.
+
+The standalone Windows installer now generates `cdx.cmd` with the installed version directory in the launcher path.
+
+### Logics documentation
+
+The July 2026 review remediation corpus and post-review follow-up corpus are closed with implementation reports, validation evidence, and a clean Logics audit.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/checksums/release-archives.json

@@ -132,6 +132,10 @@
     "v0.9.16": {
       "github_tarball_sha256": "0876509c201485824f6e5fe7b4a96ceb41cc68279fbe6dda4891864cf5be93ec",
       "github_zip_sha256": "08072957a0421d257cecfa8bed73cceee80d1c8857c59ac45378ac8ce3e0362d"
+    },
+    "v0.10.0": {
+      "github_tarball_sha256": "20c473f4b17806d565c454ad4aa28758433665d8431251ebb937ab6a909e4adb",
+      "github_zip_sha256": "b6a7be359d8dc2a11d8c77749878875419fabd7cd5a6951502dec09d7791e211"
     }
   }
 }

package/install.ps1

@@ -9,13 +9,7 @@ $ErrorActionPreference = "Stop"
 
 $repo = "AlexAgo83/cdx-manager"
 if (-not $ChecksumsUrl) {
-    $ChecksumsUrl = "https://raw.githubusercontent.com/$repo/main/checksums/release-archives.json"
-}
-$defaultChecksumsUrl = "https://raw.githubusercontent.com/$repo/main/checksums/release-archives.json"
-$checksumsApiUrl = if ($env:CDX_CHECKSUMS_API_URL) {
-    $env:CDX_CHECKSUMS_API_URL
-} else {
-    "https://api.github.com/repos/$repo/contents/checksums/release-archives.json?ref=main"
+    $ChecksumsUrl = $null
 }
 
 function Has-Command {
@@ -45,10 +39,16 @@ if ($Version.StartsWith("v")) {
     $tag = "v$Version"
 }
 
+$defaultChecksumsUrl = "https://github.com/$repo/releases/download/$tag/release-archives.json"
+if (-not $ChecksumsUrl) {
+    $ChecksumsUrl = $defaultChecksumsUrl
+}
+
 $tmpRoot = Join-Path ([System.IO.Path]::GetTempPath()) ("cdx-install-" + [guid]::NewGuid().ToString("N"))
 $archivePath = Join-Path $tmpRoot "cdx-manager.zip"
 $extractRoot = Join-Path $tmpRoot "extract"
-$targetDir = Join-Path $installRoot $tag.TrimStart("v")
+$versionDir = $tag.TrimStart("v")
+$targetDir = Join-Path $installRoot $versionDir
 $archiveUrl = "https://github.com/$repo/archive/refs/tags/$tag.zip"
 
 New-Item -ItemType Directory -Force -Path $tmpRoot, $extractRoot, $binDir, $installRoot | Out-Null
@@ -62,15 +62,6 @@ try {
         } catch {
         }
     }
-    if ((-not $Sha256) -and ($ChecksumsUrl -eq $defaultChecksumsUrl)) {
-        try {
-            $checksumsResponse = Invoke-RestMethod -Uri $checksumsApiUrl
-            $checksumsJson = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($checksumsResponse.content))
-            $checksums = $checksumsJson | ConvertFrom-Json
-            $Sha256 = $checksums.releases.$tag.github_zip_sha256
-        } catch {
-        }
-    }
     if ($Sha256) {
         $actualSha256 = (Get-FileHash -Algorithm SHA256 -Path $archivePath).Hash.ToLowerInvariant()
         if ($actualSha256 -ne $Sha256.ToLowerInvariant()) {
@@ -78,7 +69,9 @@ try {
         }
     } else {
         if ($env:CDX_ALLOW_UNVERIFIED -eq "1") {
-            Write-Warning "No official checksum available for $tag; continuing because CDX_ALLOW_UNVERIFIED=1."
+            Write-Warning "Installing $tag without checksum verification."
+            Write-Warning "CDX_ALLOW_UNVERIFIED=1 disables archive integrity checks."
+            Write-Warning "Continue only if you trust the download source."
         } else {
             throw "cdx install: no official checksum available for $tag. Set CDX_ALLOW_UNVERIFIED=1 to install without checksum verification."
         }
@@ -99,7 +92,7 @@ try {
     $launcherPath = Join-Path $binDir "cdx.cmd"
     $launcher = @"
 @echo off
-set SCRIPT=%~dp0..\versions\${($tag.TrimStart("v"))}\bin\cdx
+set SCRIPT=%~dp0..\versions\$versionDir\bin\cdx
 where py >nul 2>nul
 if %ERRORLEVEL%==0 (
   py -3 "%SCRIPT%" %*

package/install.sh

@@ -6,9 +6,6 @@ VERSION="${CDX_VERSION:-}"
 PREFIX="${PREFIX:-$HOME/.local}"
 BIN_DIR="${BIN_DIR:-$PREFIX/bin}"
 INSTALL_ROOT="${CDX_INSTALL_ROOT:-$PREFIX/share/cdx-manager}"
-DEFAULT_CHECKSUMS_URL="https://raw.githubusercontent.com/$REPO/main/checksums/release-archives.json"
-CHECKSUMS_URL="${CDX_CHECKSUMS_URL:-$DEFAULT_CHECKSUMS_URL}"
-CHECKSUMS_API_URL="${CDX_CHECKSUMS_API_URL:-https://api.github.com/repos/$REPO/contents/checksums/release-archives.json?ref=main}"
 
 need() {
   if ! command -v "$1" >/dev/null 2>&1; then
@@ -53,27 +50,6 @@ if value:
 ' "$1"
 }
 
-resolve_expected_sha256_from_api() {
-  curl -fsSL "$CHECKSUMS_API_URL" |
-    python3 -c '
-import base64
-import json
-import sys
-
-tag = sys.argv[1]
-try:
-    response = json.load(sys.stdin)
-    payload = json.loads(base64.b64decode(response.get("content") or b"").decode("utf-8"))
-except Exception:
-    raise SystemExit(1)
-
-release = (payload.get("releases") or {}).get(tag) or {}
-value = release.get("github_tarball_sha256")
-if value:
-    print(value)
-' "$1"
-}
-
 if [ -z "$VERSION" ]; then
   VERSION="$(
     curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" |
@@ -86,6 +62,9 @@ case "$VERSION" in
   *) TAG="v$VERSION" ;;
 esac
 
+DEFAULT_CHECKSUMS_URL="https://github.com/$REPO/releases/download/$TAG/release-archives.json"
+CHECKSUMS_URL="${CDX_CHECKSUMS_URL:-$DEFAULT_CHECKSUMS_URL}"
+
 TMP_DIR="$(mktemp -d)"
 cleanup() {
   rm -rf "$TMP_DIR"
@@ -99,10 +78,6 @@ EXPECTED_SHA256="${CDX_SHA256:-}"
 if [ -z "$EXPECTED_SHA256" ]; then
   EXPECTED_SHA256="$(resolve_expected_sha256 "$TAG" 2>/dev/null || true)"
 fi
-if [ -z "$EXPECTED_SHA256" ] && [ "$CHECKSUMS_URL" = "$DEFAULT_CHECKSUMS_URL" ]; then
-  EXPECTED_SHA256="$(resolve_expected_sha256_from_api "$TAG" 2>/dev/null || true)"
-fi
-
 if [ -n "$EXPECTED_SHA256" ]; then
   ACTUAL_SHA256="$(sha256_file "$TMP_DIR/cdx-manager.tar.gz")"
   if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
@@ -113,7 +88,9 @@ if [ -n "$EXPECTED_SHA256" ]; then
   fi
 else
   if [ "${CDX_ALLOW_UNVERIFIED:-}" = "1" ]; then
-    echo "cdx install: warning: no official checksum available for $TAG; continuing because CDX_ALLOW_UNVERIFIED=1" >&2
+    echo "cdx install: WARNING: installing $TAG without checksum verification." >&2
+    echo "cdx install: WARNING: CDX_ALLOW_UNVERIFIED=1 disables archive integrity checks." >&2
+    echo "cdx install: WARNING: continue only if you trust the download source." >&2
   else
     echo "cdx install: no official checksum available for $TAG" >&2
     echo "Set CDX_ALLOW_UNVERIFIED=1 to install without checksum verification." >&2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.10.0"
+version = "0.11.0"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/claude_refresh.py

@@ -48,40 +48,24 @@ def _refresh_claude_sessions(service, refresh_fn=None, target_names=None, force=
     errors = []
     results = {}
 
-    if inspect.iscoroutinefunction(refresh_fn):
-        import asyncio
+    threads = []
 
-        async def fetch_all():
-            async def fetch_async(s):
-                try:
-                    usage = await refresh_fn(s)
-                    if usage:
-                        results[s["name"]] = usage
-                except Exception as e:
-                    errors.append({"session": s["name"], "error": e})
-
-            await asyncio.gather(*(fetch_async(s) for s in claude_sessions))
-
-        asyncio.run(fetch_all())
-    else:
-        threads = []
-
-        def fetch(s):
-            try:
-                usage = refresh_fn(s)
-                if inspect.isawaitable(usage):
-                    raise CdxError("Claude refresh function returned an awaitable from a sync callable.")
-                if usage:
-                    results[s["name"]] = usage
-            except Exception as e:
-                errors.append({"session": s["name"], "error": e})
-
-        for s in claude_sessions:
-            t = threading.Thread(target=fetch, args=(s,), daemon=True)
-            threads.append(t)
-            t.start()
-        for t in threads:
-            t.join(timeout=10)
+    def fetch(s):
+        try:
+            usage = refresh_fn(s)
+            if inspect.isawaitable(usage):
+                raise CdxError("Claude refresh function returned an awaitable from a sync callable.")
+            if usage:
+                results[s["name"]] = usage
+        except Exception as e:
+            errors.append({"session": s["name"], "error": e})
+
+    for s in claude_sessions:
+        t = threading.Thread(target=fetch, args=(s,), daemon=True)
+        threads.append(t)
+        t.start()
+    for t in threads:
+        t.join(timeout=10)
 
     # A worker that outlived its join can still insert into results/errors;
     # snapshot both so late writes can't mutate what we iterate.

package/src/cli.py

@@ -53,6 +53,7 @@ from .cli_commands import (
 from .cli_commands import (
     _format_bytes as _format_disk_bytes,
 )
+from .cli_helpers import _update_notice_warnings
 from .cli_render import (
     _format_sessions,
     _pad_table,
@@ -75,7 +76,7 @@ from .status_view import (
 )
 from .update_check import check_for_update, check_logics_manager_for_update
 
-VERSION = "0.10.0"
+VERSION = "0.11.0"
 
 # Public surface: this module is a facade. Names below are imported above
 # purely to be re-exported (consumed by tests and external callers); listing
@@ -178,7 +179,7 @@ def _print_help(use_color=False):
         f"  {_style('cdx next [--json] [--refresh]', '36', use_color)}",
         f"  {_style('cdx reset <name> [--yes] [--json]', '36', use_color)}",
         f"  {_style('cdx select --provider PROVIDER [--min-reasoning-effort minimal|low|medium|high|xhigh] [--min-power minimal|low|medium|high|xhigh] [--require-ready] [--refresh] --json', '36', use_color)}",
-        f"  {_style('cdx run [session] --cwd PATH (--prompt-file PATH|--prompt TEXT) [--provider PROVIDER] [--model MODEL] [--reasoning-effort minimal|low|medium|high|xhigh] [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full|workspace-write|read-only|danger-full-access] [--timeout-seconds N] --json', '36', use_color)}",
+        f"  {_style('cdx run [session] --cwd PATH (--prompt-file PATH|--prompt TEXT) [--provider PROVIDER] [--model MODEL] [--kind assistant|code-review] [--reasoning-effort minimal|low|medium|high|xhigh] [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full|workspace-write|read-only|danger-full-access] [--timeout-seconds N] --json', '36', use_color)}",
         f"  {_style('cdx runs [--limit N] --json', '36', use_color)}",
         f"  {_style('cdx run-status <run_id> --json', '36', use_color)}",
         f"  {_style('cdx run-report <run_id> --json', '36', use_color)}",
@@ -426,40 +427,8 @@ def _get_disk_cleanup_notice(service, options):
     }
 
 
-def _update_warning_payload(notices):
-    if isinstance(notices, dict):
-        notices = [notices]
-    if not notices:
-        return []
-    warnings = []
-    for notice in notices:
-        if notice.get("code") == "disk_cleanup_available":
-            warnings.append({
-                "code": "disk_cleanup_available",
-                "message": notice["message"],
-                **{key: value for key, value in notice.items() if key not in ("code", "message")},
-            })
-            continue
-        tool = notice.get("tool") or "cdx-manager"
-        current = notice.get("current_version") or VERSION
-        command = notice.get("update_command") or ("cdx update" if tool == "cdx-manager" else None)
-        message = f"Update available: {tool} {notice['latest_version']} (current {current})"
-        if command:
-            message = f"{message}. Run: {command}"
-        warnings.append({
-            "code": "update_available" if tool == "cdx-manager" else f"{tool.replace('-', '_')}_update_available",
-            "message": message,
-            "tool": tool,
-            "latest_version": notice["latest_version"],
-            "current_version": current,
-            "update_command": command,
-            "url": notice.get("url"),
-        })
-    return warnings
-
-
 def _update_warning_text(notices):
-    payloads = _update_warning_payload(notices)
+    payloads = _update_notice_warnings({"update_notices": notices or [], "version": VERSION})
     if not payloads:
         return None
     return "\n".join(payload["message"] for payload in payloads)
@@ -571,7 +540,7 @@ def _list_json_payload(rows, notices=None):
         "ok": True,
         "action": "list",
         "message": "Listed known sessions",
-        "warnings": _update_warning_payload(notices),
+        "warnings": _update_notice_warnings({"update_notices": notices or [], "version": VERSION}),
         "sessions": rows,
     }
 

package/src/cli_args.py

@@ -17,11 +17,11 @@ DISK_USAGE = "Usage: cdx disk [profiles] [--candidates] [--json]"
 REPAIR_USAGE = "Usage: cdx repair [--dry-run] [--force] [--json]"
 UPDATE_USAGE = "Usage: cdx update [--check] [--yes] [--json] [--version TAG]"
 EXPORT_USAGE = "Usage: cdx export <file> [--include-auth] [--force] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
-IMPORT_USAGE = "Usage: cdx import <file> [--force|--merge] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
+IMPORT_USAGE = "Usage: cdx import <file> [--force|--merge] [--allow-authless-force] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
 CONTEXT_USAGE = "Usage: cdx context show|path|init|edit|clear|set [text...] [--json]"
 HANDOFF_USAGE = "Usage: cdx handoff <name> [--json] | cdx handoff <source> <target> [--json]"
 SET_USAGE = "Usage: cdx set <name>|--sessions all|a,b|--provider PROVIDER [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full] [--fast on|off] [--rtk on|off] [--logics on|off] [--model MODEL] [--priority 0..100] [--json]"
-UNSET_USAGE = "Usage: cdx unset <name>|--sessions all|a,b|--provider PROVIDER (--power|--permission|--fast|--rtk|--logics|--model|--priority|--all) [--json]"
+UNSET_USAGE = "Usage: cdx unset <name>|--sessions all|a,b|--provider PROVIDER (--power|--reasoning-effort|--permission|--fast|--rtk|--logics|--model|--priority|--all) [--json]"
 SETTING_ALIAS_USAGE = "Usage: cdx power|perm|fast|model <name|all|provider:PROVIDER|a,b> <value|default> [--json]"
 CONFIG_USAGE = "Usage: cdx config <name> [--json]"
 CONFIGS_USAGE = "Usage: cdx configs [--json]"
@@ -186,6 +186,7 @@ def _parse_set_args(args):
 def _parse_unset_args(args):
     parsed = _parse_flag_args(args, {
         "--power": {"key": "power", "type": "bool", "default": False},
+        "--reasoning-effort": {"key": "reasoning_effort", "type": "bool", "default": False},
         "--permission": {"key": "permission", "type": "bool", "default": False},
         "--fast": {"key": "fast", "type": "bool", "default": False},
         "--rtk": {"key": "rtk", "type": "bool", "default": False},
@@ -207,8 +208,8 @@ def _parse_unset_args(args):
         raise CdxError(UNSET_USAGE)
     if not parsed["names"] and not parsed["sessions"] and not parsed["provider"]:
         raise CdxError(UNSET_USAGE)
-    keys = ["power", "permission", "fast", "rtk", "logics", "model", "priority"] if parsed["all"] else [
-        key for key in ("power", "permission", "fast", "rtk", "logics", "model", "priority") if parsed[key]
+    keys = ["power", "reasoning_effort", "permission", "fast", "rtk", "logics", "model", "priority"] if parsed["all"] else [
+        key for key in ("power", "reasoning_effort", "permission", "fast", "rtk", "logics", "model", "priority") if parsed[key]
     ]
     if not keys:
         raise CdxError(UNSET_USAGE)
@@ -405,18 +406,18 @@ def _format_period_datetime(value):
     return value.isoformat(timespec="seconds")
 
 
-def _parse_history_period(parsed, now):
+def _parse_history_period(parsed, now, usage=HISTORY_USAGE):
     since = parsed.get("since")
     from_value = parsed.get("from")
     to_value = parsed.get("to")
     if since and from_value:
-        raise CdxError("Usage: cdx history cannot combine --since and --from.")
-    start = _parse_since_value(since, now, HISTORY_USAGE) if since else None
+        raise CdxError(f"{usage} cannot combine --since and --from.")
+    start = _parse_since_value(since, now, usage) if since else None
     if from_value:
-        start = _parse_datetime_value(from_value, HISTORY_USAGE, end_of_day=False)
-    end = _parse_datetime_value(to_value, HISTORY_USAGE, end_of_day=True) if to_value else None
+        start = _parse_datetime_value(from_value, usage, end_of_day=False)
+    end = _parse_datetime_value(to_value, usage, end_of_day=True) if to_value else None
     if start and end and start.timestamp() > end.timestamp():
-        raise CdxError("Usage: cdx history period start must be before period end.")
+        raise CdxError(f"{usage} period start must be before period end.")
     return {
         "from": _format_period_datetime(start),
         "to": _format_period_datetime(end),
@@ -480,7 +481,7 @@ def _parse_history_args(args, now=None):
         "--to": {"key": "to", "type": "str", "default": None},
         "--json": {"key": "json", "type": "bool", "default": False},
     }, HISTORY_USAGE, positionals_key="names", max_positionals=1)
-    period = _parse_history_period(parsed, now)
+    period = _parse_history_period(parsed, now, HISTORY_USAGE)
     return {
         "name": parsed["names"][0] if parsed["names"] else None,
         "limit": parsed["limit"],
@@ -498,7 +499,7 @@ def _parse_stats_args(args, now=None):
         "--to": {"key": "to", "type": "str", "default": None},
         "--json": {"key": "json", "type": "bool", "default": False},
     }, STATS_USAGE, positionals_key="names", max_positionals=1)
-    period = _parse_history_period(parsed, now)
+    period = _parse_history_period(parsed, now, STATS_USAGE)
     return {
         "name": parsed["names"][0] if parsed["names"] else None,
         "period": period,
@@ -612,6 +613,7 @@ def _parse_import_args(args):
     parsed = _parse_flag_args(args, {
         "--force": {"key": "force", "type": "bool", "default": False},
         "--merge": {"key": "merge", "type": "bool", "default": False},
+        "--allow-authless-force": {"key": "allow_authless_force", "type": "bool", "default": False},
         "--json": {"key": "json", "type": "bool", "default": False},
         "--sessions": {
             "key": "session_names",

package/src/cli_commands.py

@@ -56,6 +56,7 @@ from .cli_args import (
 from .cli_helpers import (
     API_SCHEMA_VERSION,
     _build_handoff_context,
+    _format_bytes,
     _format_export_report,
     _handoff_launch_prompt,
     _json_failure,
@@ -96,10 +97,12 @@ from .notify import (
     wait_for_notification_event,
 )
 from .provider_runtime import (
+    AUTH_PROBE_AUTHENTICATED,
+    AUTH_PROBE_DEGRADED,
     _ensure_session_authentication,
     _headless_artifact_paths,
     _list_launch_transcript_paths,
-    _probe_provider_auth,
+    _probe_provider_auth_status,
     _run_headless_provider_command,
     _run_interactive_provider_command,
     get_resume_capability,
@@ -171,14 +174,6 @@ def _resolve_confirmation(confirm_fn, name):
     return confirmed
 
 
-def _format_bytes(value):
-    size = float(value)
-    for unit in ("B", "KB", "MB", "GB", "TB"):
-        if size < 1024 or unit == "TB":
-            return f"{int(size)} {unit}" if unit == "B" or size.is_integer() else f"{size:.1f} {unit}"
-        size /= 1024
-
-
 def _directory_size_bytes(path, runner=None):
     if not os.path.exists(path):
         raise CdxError(f"CDX home does not exist: {path}")
@@ -468,6 +463,13 @@ def _handle_clean_profiles(args, ctx, json_flag):
             raise CdxError(usage)
         old_logs = _parse_days(args[index + 1], usage)
         args = [arg for i, arg in enumerate(args) if i not in (index, index + 1)]
+    else:
+        old_log_equals = [arg for arg in args if arg.startswith("--old-logs=")]
+        if old_log_equals:
+            if len(old_log_equals) > 1:
+                raise CdxError(usage)
+            old_logs = _parse_days(old_log_equals[0].split("=", 1)[1], usage)
+            args = [arg for arg in args if arg != old_log_equals[0]]
     args = [arg for arg in args if arg != "--tmp"]
     if args or clean_tmp == (old_logs is not None):
         raise CdxError(usage)
@@ -527,6 +529,8 @@ def handle_disk(rest, ctx):
         "--json": {"key": "json", "type": "bool", "default": False},
     }, DISK_USAGE, positionals_key="targets", max_positionals=1)
     target = parsed["targets"][0] if parsed["targets"] else "home"
+    if parsed["candidates"] and target != "profiles":
+        raise CdxError(DISK_USAGE)
     if target == "home":
         path = ctx["service"]["base_dir"]
     elif target == "profiles":
@@ -558,8 +562,6 @@ def handle_disk(rest, ctx):
     if target == "profiles":
         payload["children"] = _directory_child_sizes(path, runner=ctx["options"].get("diskUsageRunner"), progress=progress)
     if parsed["candidates"]:
-        if target != "profiles":
-            raise CdxError(DISK_USAGE)
         candidates = _collect_profile_cleanup_candidates(
             ctx["service"]["base_dir"],
             runner=ctx["options"].get("diskUsageRunner"),
@@ -1735,8 +1737,12 @@ def handle_last(rest, ctx):
 
 def handle_clean(rest, ctx):
     json_flag, args = _parse_json_flag(rest)
-    if args[:1] == ["profiles"] and any(arg in ("--tmp", "--old-logs") for arg in args[1:]):
-        return _handle_clean_profiles(args[1:], ctx, json_flag)
+    profile_flags = ("--tmp", "--old-logs")
+    has_profile_flag = any(arg in profile_flags or arg.startswith("--old-logs=") for arg in args)
+    if args[:1] == ["profiles"] or has_profile_flag:
+        if args[:1] == ["profiles"]:
+            return _handle_clean_profiles(args[1:], ctx, json_flag)
+        return _handle_clean_profiles(args, ctx, json_flag)
     yes = "--yes" in args
     args = [arg for arg in args if arg != "--yes"]
     service = ctx["service"]
@@ -2190,17 +2196,23 @@ def _refresh_claude_auth_states(service, target_names=None, spawn_sync=None, env
         if (session.get("auth") or {}).get("status") not in ("authenticated", "logged_out"):
             continue
         try:
-            authenticated = _probe_provider_auth(
+            auth_status = _probe_provider_auth_status(
                 session,
                 spawn_sync=spawn_sync,
                 env_override=env_override,
             )
+            if auth_status == AUTH_PROBE_DEGRADED:
+                errors.append({
+                    "session": session["name"],
+                    "error": "Auth probe timed out; authentication status is degraded.",
+                })
+                continue
             now = _local_now_iso()
-            service["update_auth_state"](session["name"], lambda auth, authenticated=authenticated, now=now: {
+            service["update_auth_state"](session["name"], lambda auth, auth_status=auth_status, now=now: {
                 **auth,
-                "status": "authenticated" if authenticated else "logged_out",
+                "status": "authenticated" if auth_status == AUTH_PROBE_AUTHENTICATED else "logged_out",
                 "lastCheckedAt": now,
-                **({"lastAuthenticatedAt": now} if authenticated else {}),
+                **({"lastAuthenticatedAt": now} if auth_status == AUTH_PROBE_AUTHENTICATED else {}),
             })
             updated.append(session["name"])
         except Exception as error:
@@ -2326,6 +2338,7 @@ def handle_import(rest, ctx):
         session_names=parsed["session_names"],
         force=parsed["force"],
         merge=parsed["merge"],
+        allow_authless_force=parsed["allow_authless_force"],
     )
     session_count = len(result["session_names"])
     auth_suffix = " with auth" if result["include_auth"] else ""