cdx-manager 0.10.0 → 0.11.1

package/README.md

@@ -1,6 +1,6 @@
 # CDX Manager
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.10.0-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.11.1-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Run multiple Codex, Claude, Antigravity, and Ollama sessions from one terminal. Switch between accounts instantly.**
 
@@ -36,6 +36,7 @@ One command to launch any session. Zero auth juggling.
 - **Instant launch.** `cdx work` opens your "work" session. `cdx personal` opens another. No config files to edit mid-flow.
 - **Quick relaunch.** `cdx last` reopens the most recently launched assistant profile.
 - **Auth guardrails.** `cdx` checks authentication before launching. If a session is not logged in, it tells you exactly what to run — no silent failures.
+- **Optional session labels.** `cdx label <name> <label>` adds a short human label; list and full status tables show a `LABEL` column only when at least one session has one.
 - **Usage at a glance.** `cdx status` shows token usage, 5-hour window quota, weekly quota, last-updated timestamps, priority guidance, and the last launched session in one aligned table.
 - **Next-ready notification.** `cdx ready` schedules a native system notification for the next assistant that comes back from cooldown, then returns immediately.
 - **Session control.** Disable a session without deleting it when an account is temporarily out of credits; disabled sessions remain visible and sort last.
@@ -79,8 +80,6 @@ One command to launch any session. Zero auth juggling.
 - Auth probe: synchronous subprocess call to `codex login status` or `claude auth status` before any interactive launch.
 - Signal forwarding: `SIGINT`, `SIGTERM`, and `SIGHUP` are forwarded to the child process and produce clean exit codes.
 - Test stack: `pytest`, `pytest-cov`, and `ruff` via the documented `dev` dependency extra.
-- Python floor decision: `cdx-manager` keeps Python 3.9 support for the 0.9.x line to avoid dropping existing users before a planned compatibility break; classifiers remain aligned with `requires-python = ">=3.9"`.
-
 ---
 
 ## Getting Started
@@ -194,18 +193,18 @@ npm install -g .
 
 Security note:
 
-- The standalone installers try to resolve official release checksums from `checksums/release-archives.json`.
+- The standalone installers resolve official release checksums from the tagged GitHub Release asset `release-archives.json`.
 - You can still override verification explicitly through `CDX_SHA256`.
-- If no checksum is available, standalone installers fail closed unless `CDX_ALLOW_UNVERIFIED=1` is set.
+- If no checksum is available, standalone installers fail closed unless `CDX_ALLOW_UNVERIFIED=1` is set; that override prints a prominent warning before continuing.
 - Prefer `npm`, `pipx`, or `uv` when you want registry-backed install flows.
-- If you use the standalone script, download it first, inspect it, and prefer a release with an official checksum entry.
+- If you use the standalone script, download it first, inspect it, and prefer a release with the official checksum asset attached.
 
 Release maintainer note:
 
 - Before publishing npm or PyPI packages, run `npm run release:validate`.
 - The release tag must match `package.json`, `pyproject.toml`, `src/cli.py`, and `VERSION`.
 - `checksums/release-archives.json` must include the matching `vX.Y.Z` entry with both `github_tarball_sha256` and `github_zip_sha256`.
-- Use `python3 scripts/update_release_checksums.py --tag vX.Y.Z` after the GitHub tag archives exist, commit the checksum update to `main`, then publish the GitHub release only after `npm run release:validate`, `npm run lint`, and `npm test` pass.
+- Use `python3 scripts/update_release_checksums.py --tag vX.Y.Z` after the GitHub tag archives exist, commit the checksum update, attach that file to the tagged GitHub Release as `release-archives.json`, then publish packages only after `npm run release:validate`, `npm run lint`, and `npm test` pass.
 
 ### Environment
 
@@ -347,6 +346,8 @@ cdx history --summary --from 2026-05-01 --to 2026-05-28
 | `cdx add [provider] <name> [--model MODEL] [--json]` | Register a new session (`provider`: `codex`, `claude`, `antigravity`, or `ollama`; Ollama requires `--model`) |
 | `cdx cp <source> <dest> [--json]` | Copy a session into another session name, overwriting the destination if it exists |
 | `cdx ren <source> <dest> [--json]` | Rename a session and move its auth data |
+| `cdx label <name> <label> [--json]` | Attach one short label to a session; tables show `LABEL` only when at least one label exists |
+| `cdx label <name> --clear [--json]` | Clear a session label |
 | `cdx login <name> [--json]` | Re-authenticate a session (logout + login) |
 | `cdx logout <name> [--json]` | Log out of a session |
 | `cdx disable <name> [--json]` | Disable a session without deleting it; disabled sessions stay visible and cannot launch |
@@ -401,6 +402,7 @@ Commands with machine-readable output:
 - `cdx add ... --json`
 - `cdx cp ... --json`
 - `cdx ren ... --json`
+- `cdx label ... --json`
 - `cdx rmv ... --json`
 - `cdx clean ... --json`
 - `cdx disk ... --json`
@@ -523,7 +525,7 @@ Notes:
 - `--include-auth` is encrypted, requires a passphrase, and exports only provider credential files rather than full profile caches or logs.
 - Without `--passphrase-env`, `cdx` prompts in an interactive terminal. Non-interactive callers can pass `--passphrase-stdin` to read the passphrase from stdin (one line) instead of exposing it in the child environment.
 - `--sessions work,perso` exports or imports only a subset.
-- `--force` allows overwriting existing destination sessions during import or replacing an existing bundle file during export.
+- `--force` allows overwriting existing destination sessions during import or replacing an existing bundle file during export. Import refuses to overwrite existing sessions from a bundle without auth payloads unless `--allow-authless-force` is also passed.
 - Auth bundles contain credentials. Treat them like secrets and delete them after transfer.
 
 ---

package/bin/cdx

@@ -3,21 +3,12 @@
 import sys
 from pathlib import Path
 
-
 ROOT = Path(__file__).resolve().parent.parent
 if str(ROOT) not in sys.path:
     sys.path.insert(0, str(ROOT))
 
-from src.cli import format_error, format_json_error, main, wants_json  # noqa: E402
-from src.errors import CdxError  # noqa: E402
+from src.cli import cli_entry  # noqa: E402
 
 
 if __name__ == "__main__":
-    try:
-        raise SystemExit(main(sys.argv[1:]))
-    except CdxError as error:
-        if wants_json(sys.argv[1:]):
-            sys.stderr.write(f"{format_json_error(error)}\n")
-        else:
-            sys.stderr.write(f"{format_error(error)}\n")
-        raise SystemExit(error.exit_code)
+    cli_entry()

package/changelogs/CHANGELOGS_0_11_0.md

@@ -0,0 +1,51 @@
+# CDX Manager 0.11.0
+
+## Highlights
+
+- Fixed Codex structured status parsing so five-hour and weekly reset windows stay mapped to the correct columns.
+- Hardened backup import, provider auth probing, release verification, and Windows launcher generation.
+- Closed the July 2026 review remediation corpus and follow-up Logics workflow with release-ready validation.
+
+## Changes
+
+### Codex status reset windows
+
+Structured Codex status payloads now preserve the distinction between the five-hour and weekly reset timestamps. `cdx status` no longer mirrors the weekly reset into the five-hour reset column, or the reverse, when provider output includes both windows.
+
+### Safer session import and credentials handling
+
+`cdx import --force` refuses to overwrite existing sessions from bundles without auth payloads unless `--allow-authless-force` is explicitly supplied.
+
+Bundle import now validates selected profile paths, base64 payloads, malformed profile collections, and non-object profile entries before touching existing session profiles. Existing profiles are renamed aside during force import and restored if a per-session import fails.
+
+### Provider auth reliability
+
+Provider auth probes are bounded by a 15 second timeout. Timeouts now surface as a degraded authentication state instead of being persisted as `logged_out`.
+
+Codex interactive launches wait on the per-auth-home lock with a bounded retry instead of running unlocked while another process may be rotating OAuth credentials.
+
+Stored `reasoning_effort` and `power` launch settings now clear each other correctly, so setting one cannot leave the other silently shadowing it.
+
+### CLI robustness and release hardening
+
+`cdx history` skips corrupt JSONL lines, `cdx status` tolerates sessions removed during a concurrent scan, `cdx clean profiles` routes profile cleanup flags consistently, `cdx disk --candidates` validates arguments before scanning, and `cdx view --json` now reports a proper failure when the Logics viewer is unavailable.
+
+The npm launcher routes through the same `cli_entry()` path as the Python entrypoint. Standalone installers and publish workflows now use tagged GitHub Release checksum assets rather than main-branch checksum metadata, and `CDX_ALLOW_UNVERIFIED=1` prints a prominent warning before continuing.
+
+The standalone Windows installer now generates `cdx.cmd` with the installed version directory in the launcher path.
+
+### Logics documentation
+
+The July 2026 review remediation corpus and post-review follow-up corpus are closed with implementation reports, validation evidence, and a clean Logics audit.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/changelogs/CHANGELOGS_0_11_1.md

@@ -0,0 +1,34 @@
+# CDX Manager 0.11.1
+
+## Highlights
+
+- Added optional labels for saved sessions.
+- Kept existing list and compact status output clean when no labels are present.
+- Closed the session-label Logics corpus with full validation evidence.
+
+## Changes
+
+### Optional session labels
+
+`cdx label <name> <label>` now attaches one short human-readable label to a saved session. Labels are stored as session metadata outside the `launch` dictionary, so they do not affect provider commands, auth checks, runtime state, ready/next selection, or launch history behavior.
+
+`cdx label <name> --clear` removes the label and returns the session to the same shape as legacy unlabeled records.
+
+The default `cdx` list and full `cdx status` table add a `LABEL` column only when at least one row has a label. Unlabeled rows render as `-`, and `cdx status --small` remains compact.
+
+JSON outputs for `cdx --json`, `cdx status --json`, `cdx status <name> --json`, and `cdx label ... --json` expose label values for automation consumers.
+
+Session copy, rename, export, and import preserve labels.
+
+### Documentation and workflow
+
+README and CLI help now document `cdx label <name> <label>` and `cdx label <name> --clear`.
+
+The optional session-label Logics request, backlog item, product brief, and orchestration task are closed with validation evidence.
+
+## Validation
+
+- `python3 -m unittest discover -s test`
+- `logics-manager flow validate req_012_add_optional_labels_to_cdx_sessions`
+- `logics-manager status`
+- `logics-manager health`

package/checksums/release-archives.json

@@ -132,6 +132,14 @@
     "v0.9.16": {
       "github_tarball_sha256": "0876509c201485824f6e5fe7b4a96ceb41cc68279fbe6dda4891864cf5be93ec",
       "github_zip_sha256": "08072957a0421d257cecfa8bed73cceee80d1c8857c59ac45378ac8ce3e0362d"
+    },
+    "v0.10.0": {
+      "github_tarball_sha256": "20c473f4b17806d565c454ad4aa28758433665d8431251ebb937ab6a909e4adb",
+      "github_zip_sha256": "b6a7be359d8dc2a11d8c77749878875419fabd7cd5a6951502dec09d7791e211"
+    },
+    "v0.11.0": {
+      "github_tarball_sha256": "bc42f83f20ba1c6ff81f824c382801457f93cf8cb166acbe952c12d009560a70",
+      "github_zip_sha256": "1c03b4f03f53c46d0a5ba580fc8ade7b26fa3cb1bb5f029f703681f136b9ac1f"
     }
   }
 }

package/install.ps1

@@ -9,13 +9,7 @@ $ErrorActionPreference = "Stop"
 
 $repo = "AlexAgo83/cdx-manager"
 if (-not $ChecksumsUrl) {
-    $ChecksumsUrl = "https://raw.githubusercontent.com/$repo/main/checksums/release-archives.json"
-}
-$defaultChecksumsUrl = "https://raw.githubusercontent.com/$repo/main/checksums/release-archives.json"
-$checksumsApiUrl = if ($env:CDX_CHECKSUMS_API_URL) {
-    $env:CDX_CHECKSUMS_API_URL
-} else {
-    "https://api.github.com/repos/$repo/contents/checksums/release-archives.json?ref=main"
+    $ChecksumsUrl = $null
 }
 
 function Has-Command {
@@ -45,10 +39,16 @@ if ($Version.StartsWith("v")) {
     $tag = "v$Version"
 }
 
+$defaultChecksumsUrl = "https://github.com/$repo/releases/download/$tag/release-archives.json"
+if (-not $ChecksumsUrl) {
+    $ChecksumsUrl = $defaultChecksumsUrl
+}
+
 $tmpRoot = Join-Path ([System.IO.Path]::GetTempPath()) ("cdx-install-" + [guid]::NewGuid().ToString("N"))
 $archivePath = Join-Path $tmpRoot "cdx-manager.zip"
 $extractRoot = Join-Path $tmpRoot "extract"
-$targetDir = Join-Path $installRoot $tag.TrimStart("v")
+$versionDir = $tag.TrimStart("v")
+$targetDir = Join-Path $installRoot $versionDir
 $archiveUrl = "https://github.com/$repo/archive/refs/tags/$tag.zip"
 
 New-Item -ItemType Directory -Force -Path $tmpRoot, $extractRoot, $binDir, $installRoot | Out-Null
@@ -62,15 +62,6 @@ try {
         } catch {
         }
     }
-    if ((-not $Sha256) -and ($ChecksumsUrl -eq $defaultChecksumsUrl)) {
-        try {
-            $checksumsResponse = Invoke-RestMethod -Uri $checksumsApiUrl
-            $checksumsJson = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($checksumsResponse.content))
-            $checksums = $checksumsJson | ConvertFrom-Json
-            $Sha256 = $checksums.releases.$tag.github_zip_sha256
-        } catch {
-        }
-    }
     if ($Sha256) {
         $actualSha256 = (Get-FileHash -Algorithm SHA256 -Path $archivePath).Hash.ToLowerInvariant()
         if ($actualSha256 -ne $Sha256.ToLowerInvariant()) {
@@ -78,7 +69,9 @@ try {
         }
     } else {
         if ($env:CDX_ALLOW_UNVERIFIED -eq "1") {
-            Write-Warning "No official checksum available for $tag; continuing because CDX_ALLOW_UNVERIFIED=1."
+            Write-Warning "Installing $tag without checksum verification."
+            Write-Warning "CDX_ALLOW_UNVERIFIED=1 disables archive integrity checks."
+            Write-Warning "Continue only if you trust the download source."
         } else {
             throw "cdx install: no official checksum available for $tag. Set CDX_ALLOW_UNVERIFIED=1 to install without checksum verification."
         }
@@ -99,7 +92,7 @@ try {
     $launcherPath = Join-Path $binDir "cdx.cmd"
     $launcher = @"
 @echo off
-set SCRIPT=%~dp0..\versions\${($tag.TrimStart("v"))}\bin\cdx
+set SCRIPT=%~dp0..\versions\$versionDir\bin\cdx
 where py >nul 2>nul
 if %ERRORLEVEL%==0 (
   py -3 "%SCRIPT%" %*

package/install.sh

@@ -6,9 +6,6 @@ VERSION="${CDX_VERSION:-}"
 PREFIX="${PREFIX:-$HOME/.local}"
 BIN_DIR="${BIN_DIR:-$PREFIX/bin}"
 INSTALL_ROOT="${CDX_INSTALL_ROOT:-$PREFIX/share/cdx-manager}"
-DEFAULT_CHECKSUMS_URL="https://raw.githubusercontent.com/$REPO/main/checksums/release-archives.json"
-CHECKSUMS_URL="${CDX_CHECKSUMS_URL:-$DEFAULT_CHECKSUMS_URL}"
-CHECKSUMS_API_URL="${CDX_CHECKSUMS_API_URL:-https://api.github.com/repos/$REPO/contents/checksums/release-archives.json?ref=main}"
 
 need() {
   if ! command -v "$1" >/dev/null 2>&1; then
@@ -53,27 +50,6 @@ if value:
 ' "$1"
 }
 
-resolve_expected_sha256_from_api() {
-  curl -fsSL "$CHECKSUMS_API_URL" |
-    python3 -c '
-import base64
-import json
-import sys
-
-tag = sys.argv[1]
-try:
-    response = json.load(sys.stdin)
-    payload = json.loads(base64.b64decode(response.get("content") or b"").decode("utf-8"))
-except Exception:
-    raise SystemExit(1)
-
-release = (payload.get("releases") or {}).get(tag) or {}
-value = release.get("github_tarball_sha256")
-if value:
-    print(value)
-' "$1"
-}
-
 if [ -z "$VERSION" ]; then
   VERSION="$(
     curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" |
@@ -86,6 +62,9 @@ case "$VERSION" in
   *) TAG="v$VERSION" ;;
 esac
 
+DEFAULT_CHECKSUMS_URL="https://github.com/$REPO/releases/download/$TAG/release-archives.json"
+CHECKSUMS_URL="${CDX_CHECKSUMS_URL:-$DEFAULT_CHECKSUMS_URL}"
+
 TMP_DIR="$(mktemp -d)"
 cleanup() {
   rm -rf "$TMP_DIR"
@@ -99,10 +78,6 @@ EXPECTED_SHA256="${CDX_SHA256:-}"
 if [ -z "$EXPECTED_SHA256" ]; then
   EXPECTED_SHA256="$(resolve_expected_sha256 "$TAG" 2>/dev/null || true)"
 fi
-if [ -z "$EXPECTED_SHA256" ] && [ "$CHECKSUMS_URL" = "$DEFAULT_CHECKSUMS_URL" ]; then
-  EXPECTED_SHA256="$(resolve_expected_sha256_from_api "$TAG" 2>/dev/null || true)"
-fi
-
 if [ -n "$EXPECTED_SHA256" ]; then
   ACTUAL_SHA256="$(sha256_file "$TMP_DIR/cdx-manager.tar.gz")"
   if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
@@ -113,7 +88,9 @@ if [ -n "$EXPECTED_SHA256" ]; then
   fi
 else
   if [ "${CDX_ALLOW_UNVERIFIED:-}" = "1" ]; then
-    echo "cdx install: warning: no official checksum available for $TAG; continuing because CDX_ALLOW_UNVERIFIED=1" >&2
+    echo "cdx install: WARNING: installing $TAG without checksum verification." >&2
+    echo "cdx install: WARNING: CDX_ALLOW_UNVERIFIED=1 disables archive integrity checks." >&2
+    echo "cdx install: WARNING: continue only if you trust the download source." >&2
   else
     echo "cdx install: no official checksum available for $TAG" >&2
     echo "Set CDX_ALLOW_UNVERIFIED=1 to install without checksum verification." >&2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.10.0"
+version = "0.11.1"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/claude_refresh.py

@@ -48,40 +48,24 @@ def _refresh_claude_sessions(service, refresh_fn=None, target_names=None, force=
     errors = []
     results = {}
 
-    if inspect.iscoroutinefunction(refresh_fn):
-        import asyncio
+    threads = []
 
-        async def fetch_all():
-            async def fetch_async(s):
-                try:
-                    usage = await refresh_fn(s)
-                    if usage:
-                        results[s["name"]] = usage
-                except Exception as e:
-                    errors.append({"session": s["name"], "error": e})
-
-            await asyncio.gather(*(fetch_async(s) for s in claude_sessions))
-
-        asyncio.run(fetch_all())
-    else:
-        threads = []
-
-        def fetch(s):
-            try:
-                usage = refresh_fn(s)
-                if inspect.isawaitable(usage):
-                    raise CdxError("Claude refresh function returned an awaitable from a sync callable.")
-                if usage:
-                    results[s["name"]] = usage
-            except Exception as e:
-                errors.append({"session": s["name"], "error": e})
-
-        for s in claude_sessions:
-            t = threading.Thread(target=fetch, args=(s,), daemon=True)
-            threads.append(t)
-            t.start()
-        for t in threads:
-            t.join(timeout=10)
+    def fetch(s):
+        try:
+            usage = refresh_fn(s)
+            if inspect.isawaitable(usage):
+                raise CdxError("Claude refresh function returned an awaitable from a sync callable.")
+            if usage:
+                results[s["name"]] = usage
+        except Exception as e:
+            errors.append({"session": s["name"], "error": e})
+
+    for s in claude_sessions:
+        t = threading.Thread(target=fetch, args=(s,), daemon=True)
+        threads.append(t)
+        t.start()
+    for t in threads:
+        t.join(timeout=10)
 
     # A worker that outlived its join can still insert into results/errors;
     # snapshot both so late writes can't mutate what we iterate.

package/src/cli.py

@@ -26,6 +26,7 @@ from .cli_commands import (
     handle_handoff,
     handle_history,
     handle_import,
+    handle_label,
     handle_last,
     handle_launch,
     handle_launch_setting_alias,
@@ -53,6 +54,7 @@ from .cli_commands import (
 from .cli_commands import (
     _format_bytes as _format_disk_bytes,
 )
+from .cli_helpers import _update_notice_warnings
 from .cli_render import (
     _format_sessions,
     _pad_table,
@@ -75,7 +77,7 @@ from .status_view import (
 )
 from .update_check import check_for_update, check_logics_manager_for_update
 
-VERSION = "0.10.0"
+VERSION = "0.11.1"
 
 # Public surface: this module is a facade. Names below are imported above
 # purely to be re-exported (consumed by tests and external callers); listing
@@ -111,6 +113,7 @@ _COMMAND_HANDLERS = {
     "handoff": handle_handoff,
     "history": handle_history,
     "import": handle_import,
+    "label": handle_label,
     "last": handle_last,
     "login": handle_login,
     "logout": handle_logout,
@@ -178,7 +181,7 @@ def _print_help(use_color=False):
         f"  {_style('cdx next [--json] [--refresh]', '36', use_color)}",
         f"  {_style('cdx reset <name> [--yes] [--json]', '36', use_color)}",
         f"  {_style('cdx select --provider PROVIDER [--min-reasoning-effort minimal|low|medium|high|xhigh] [--min-power minimal|low|medium|high|xhigh] [--require-ready] [--refresh] --json', '36', use_color)}",
-        f"  {_style('cdx run [session] --cwd PATH (--prompt-file PATH|--prompt TEXT) [--provider PROVIDER] [--model MODEL] [--reasoning-effort minimal|low|medium|high|xhigh] [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full|workspace-write|read-only|danger-full-access] [--timeout-seconds N] --json', '36', use_color)}",
+        f"  {_style('cdx run [session] --cwd PATH (--prompt-file PATH|--prompt TEXT) [--provider PROVIDER] [--model MODEL] [--kind assistant|code-review] [--reasoning-effort minimal|low|medium|high|xhigh] [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full|workspace-write|read-only|danger-full-access] [--timeout-seconds N] --json', '36', use_color)}",
         f"  {_style('cdx runs [--limit N] --json', '36', use_color)}",
         f"  {_style('cdx run-status <run_id> --json', '36', use_color)}",
         f"  {_style('cdx run-report <run_id> --json', '36', use_color)}",
@@ -199,6 +202,8 @@ def _print_help(use_color=False):
         f"  {_style('cdx add [provider] <name> [--model MODEL] [--json]', '36', use_color)}",
         f"  {_style('cdx cp <source> <dest> [--json]', '36', use_color)}",
         f"  {_style('cdx ren <source> <dest> [--json]', '36', use_color)}",
+        f"  {_style('cdx label <name> <label> [--json]', '36', use_color)}",
+        f"  {_style('cdx label <name> --clear [--json]', '36', use_color)}",
         f"  {_style('cdx login <name> [--json]', '36', use_color)}",
         f"  {_style('cdx logout <name> [--json]', '36', use_color)}",
         f"  {_style('cdx disable <name> [--json]', '36', use_color)}",
@@ -426,40 +431,8 @@ def _get_disk_cleanup_notice(service, options):
     }
 
 
-def _update_warning_payload(notices):
-    if isinstance(notices, dict):
-        notices = [notices]
-    if not notices:
-        return []
-    warnings = []
-    for notice in notices:
-        if notice.get("code") == "disk_cleanup_available":
-            warnings.append({
-                "code": "disk_cleanup_available",
-                "message": notice["message"],
-                **{key: value for key, value in notice.items() if key not in ("code", "message")},
-            })
-            continue
-        tool = notice.get("tool") or "cdx-manager"
-        current = notice.get("current_version") or VERSION
-        command = notice.get("update_command") or ("cdx update" if tool == "cdx-manager" else None)
-        message = f"Update available: {tool} {notice['latest_version']} (current {current})"
-        if command:
-            message = f"{message}. Run: {command}"
-        warnings.append({
-            "code": "update_available" if tool == "cdx-manager" else f"{tool.replace('-', '_')}_update_available",
-            "message": message,
-            "tool": tool,
-            "latest_version": notice["latest_version"],
-            "current_version": current,
-            "update_command": command,
-            "url": notice.get("url"),
-        })
-    return warnings
-
-
 def _update_warning_text(notices):
-    payloads = _update_warning_payload(notices)
+    payloads = _update_notice_warnings({"update_notices": notices or [], "version": VERSION})
     if not payloads:
         return None
     return "\n".join(payload["message"] for payload in payloads)
@@ -571,7 +544,7 @@ def _list_json_payload(rows, notices=None):
         "ok": True,
         "action": "list",
         "message": "Listed known sessions",
-        "warnings": _update_warning_payload(notices),
+        "warnings": _update_notice_warnings({"update_notices": notices or [], "version": VERSION}),
         "sessions": rows,
     }
 

package/src/cli_args.py

@@ -17,11 +17,12 @@ DISK_USAGE = "Usage: cdx disk [profiles] [--candidates] [--json]"
 REPAIR_USAGE = "Usage: cdx repair [--dry-run] [--force] [--json]"
 UPDATE_USAGE = "Usage: cdx update [--check] [--yes] [--json] [--version TAG]"
 EXPORT_USAGE = "Usage: cdx export <file> [--include-auth] [--force] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
-IMPORT_USAGE = "Usage: cdx import <file> [--force|--merge] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
+IMPORT_USAGE = "Usage: cdx import <file> [--force|--merge] [--allow-authless-force] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
 CONTEXT_USAGE = "Usage: cdx context show|path|init|edit|clear|set [text...] [--json]"
 HANDOFF_USAGE = "Usage: cdx handoff <name> [--json] | cdx handoff <source> <target> [--json]"
+LABEL_USAGE = "Usage: cdx label <name> <label> [--json] | cdx label <name> --clear [--json]"
 SET_USAGE = "Usage: cdx set <name>|--sessions all|a,b|--provider PROVIDER [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full] [--fast on|off] [--rtk on|off] [--logics on|off] [--model MODEL] [--priority 0..100] [--json]"
-UNSET_USAGE = "Usage: cdx unset <name>|--sessions all|a,b|--provider PROVIDER (--power|--permission|--fast|--rtk|--logics|--model|--priority|--all) [--json]"
+UNSET_USAGE = "Usage: cdx unset <name>|--sessions all|a,b|--provider PROVIDER (--power|--reasoning-effort|--permission|--fast|--rtk|--logics|--model|--priority|--all) [--json]"
 SETTING_ALIAS_USAGE = "Usage: cdx power|perm|fast|model <name|all|provider:PROVIDER|a,b> <value|default> [--json]"
 CONFIG_USAGE = "Usage: cdx config <name> [--json]"
 CONFIGS_USAGE = "Usage: cdx configs [--json]"
@@ -107,6 +108,21 @@ def _parse_rename_args(args):
     return {"source": args[0], "dest": args[1]}
 
 
+def _parse_label_args(args):
+    parsed = _parse_flag_args(args, {
+        "--clear": {"key": "clear", "type": "bool", "default": False},
+        "--json": {"key": "json", "type": "bool", "default": False},
+    }, LABEL_USAGE, positionals_key="values", max_positionals=2)
+    values = parsed["values"]
+    if parsed["clear"]:
+        if len(values) != 1:
+            raise CdxError(LABEL_USAGE)
+        return {"name": values[0], "label": None, "clear": True, "json": parsed["json"]}
+    if len(values) != 2:
+        raise CdxError(LABEL_USAGE)
+    return {"name": values[0], "label": values[1], "clear": False, "json": parsed["json"]}
+
+
 def _parse_remove_args(args):
     parsed = _parse_flag_args(args, {
         "--force": {"key": "force", "type": "bool", "default": False},
@@ -186,6 +202,7 @@ def _parse_set_args(args):
 def _parse_unset_args(args):
     parsed = _parse_flag_args(args, {
         "--power": {"key": "power", "type": "bool", "default": False},
+        "--reasoning-effort": {"key": "reasoning_effort", "type": "bool", "default": False},
         "--permission": {"key": "permission", "type": "bool", "default": False},
         "--fast": {"key": "fast", "type": "bool", "default": False},
         "--rtk": {"key": "rtk", "type": "bool", "default": False},
@@ -207,8 +224,8 @@ def _parse_unset_args(args):
         raise CdxError(UNSET_USAGE)
     if not parsed["names"] and not parsed["sessions"] and not parsed["provider"]:
         raise CdxError(UNSET_USAGE)
-    keys = ["power", "permission", "fast", "rtk", "logics", "model", "priority"] if parsed["all"] else [
-        key for key in ("power", "permission", "fast", "rtk", "logics", "model", "priority") if parsed[key]
+    keys = ["power", "reasoning_effort", "permission", "fast", "rtk", "logics", "model", "priority"] if parsed["all"] else [
+        key for key in ("power", "reasoning_effort", "permission", "fast", "rtk", "logics", "model", "priority") if parsed[key]
     ]
     if not keys:
         raise CdxError(UNSET_USAGE)
@@ -405,18 +422,18 @@ def _format_period_datetime(value):
     return value.isoformat(timespec="seconds")
 
 
-def _parse_history_period(parsed, now):
+def _parse_history_period(parsed, now, usage=HISTORY_USAGE):
     since = parsed.get("since")
     from_value = parsed.get("from")
     to_value = parsed.get("to")
     if since and from_value:
-        raise CdxError("Usage: cdx history cannot combine --since and --from.")
-    start = _parse_since_value(since, now, HISTORY_USAGE) if since else None
+        raise CdxError(f"{usage} cannot combine --since and --from.")
+    start = _parse_since_value(since, now, usage) if since else None
     if from_value:
-        start = _parse_datetime_value(from_value, HISTORY_USAGE, end_of_day=False)
-    end = _parse_datetime_value(to_value, HISTORY_USAGE, end_of_day=True) if to_value else None
+        start = _parse_datetime_value(from_value, usage, end_of_day=False)
+    end = _parse_datetime_value(to_value, usage, end_of_day=True) if to_value else None
     if start and end and start.timestamp() > end.timestamp():
-        raise CdxError("Usage: cdx history period start must be before period end.")
+        raise CdxError(f"{usage} period start must be before period end.")
     return {
         "from": _format_period_datetime(start),
         "to": _format_period_datetime(end),
@@ -480,7 +497,7 @@ def _parse_history_args(args, now=None):
         "--to": {"key": "to", "type": "str", "default": None},
         "--json": {"key": "json", "type": "bool", "default": False},
     }, HISTORY_USAGE, positionals_key="names", max_positionals=1)
-    period = _parse_history_period(parsed, now)
+    period = _parse_history_period(parsed, now, HISTORY_USAGE)
     return {
         "name": parsed["names"][0] if parsed["names"] else None,
         "limit": parsed["limit"],
@@ -498,7 +515,7 @@ def _parse_stats_args(args, now=None):
         "--to": {"key": "to", "type": "str", "default": None},
         "--json": {"key": "json", "type": "bool", "default": False},
     }, STATS_USAGE, positionals_key="names", max_positionals=1)
-    period = _parse_history_period(parsed, now)
+    period = _parse_history_period(parsed, now, STATS_USAGE)
     return {
         "name": parsed["names"][0] if parsed["names"] else None,
         "period": period,
@@ -612,6 +629,7 @@ def _parse_import_args(args):
     parsed = _parse_flag_args(args, {
         "--force": {"key": "force", "type": "bool", "default": False},
         "--merge": {"key": "merge", "type": "bool", "default": False},
+        "--allow-authless-force": {"key": "allow_authless_force", "type": "bool", "default": False},
         "--json": {"key": "json", "type": "bool", "default": False},
         "--sessions": {
             "key": "session_names",