cdx-manager 0.10.0 → 0.11.1

package/src/cli_commands.py

@@ -37,6 +37,7 @@ from .cli_args import (
     _parse_history_args,
     _parse_import_args,
     _parse_json_flag,
+    _parse_label_args,
     _parse_launch_setting_alias_args,
     _parse_next_args,
     _parse_remove_args,
@@ -56,6 +57,7 @@ from .cli_args import (
 from .cli_helpers import (
     API_SCHEMA_VERSION,
     _build_handoff_context,
+    _format_bytes,
     _format_export_report,
     _handoff_launch_prompt,
     _json_failure,
@@ -96,10 +98,12 @@ from .notify import (
     wait_for_notification_event,
 )
 from .provider_runtime import (
+    AUTH_PROBE_AUTHENTICATED,
+    AUTH_PROBE_DEGRADED,
     _ensure_session_authentication,
     _headless_artifact_paths,
     _list_launch_transcript_paths,
-    _probe_provider_auth,
+    _probe_provider_auth_status,
     _run_headless_provider_command,
     _run_interactive_provider_command,
     get_resume_capability,
@@ -171,14 +175,6 @@ def _resolve_confirmation(confirm_fn, name):
     return confirmed
 
 
-def _format_bytes(value):
-    size = float(value)
-    for unit in ("B", "KB", "MB", "GB", "TB"):
-        if size < 1024 or unit == "TB":
-            return f"{int(size)} {unit}" if unit == "B" or size.is_integer() else f"{size:.1f} {unit}"
-        size /= 1024
-
-
 def _directory_size_bytes(path, runner=None):
     if not os.path.exists(path):
         raise CdxError(f"CDX home does not exist: {path}")
@@ -468,6 +464,13 @@ def _handle_clean_profiles(args, ctx, json_flag):
             raise CdxError(usage)
         old_logs = _parse_days(args[index + 1], usage)
         args = [arg for i, arg in enumerate(args) if i not in (index, index + 1)]
+    else:
+        old_log_equals = [arg for arg in args if arg.startswith("--old-logs=")]
+        if old_log_equals:
+            if len(old_log_equals) > 1:
+                raise CdxError(usage)
+            old_logs = _parse_days(old_log_equals[0].split("=", 1)[1], usage)
+            args = [arg for arg in args if arg != old_log_equals[0]]
     args = [arg for arg in args if arg != "--tmp"]
     if args or clean_tmp == (old_logs is not None):
         raise CdxError(usage)
@@ -527,6 +530,8 @@ def handle_disk(rest, ctx):
         "--json": {"key": "json", "type": "bool", "default": False},
     }, DISK_USAGE, positionals_key="targets", max_positionals=1)
     target = parsed["targets"][0] if parsed["targets"] else "home"
+    if parsed["candidates"] and target != "profiles":
+        raise CdxError(DISK_USAGE)
     if target == "home":
         path = ctx["service"]["base_dir"]
     elif target == "profiles":
@@ -558,8 +563,6 @@ def handle_disk(rest, ctx):
     if target == "profiles":
         payload["children"] = _directory_child_sizes(path, runner=ctx["options"].get("diskUsageRunner"), progress=progress)
     if parsed["candidates"]:
-        if target != "profiles":
-            raise CdxError(DISK_USAGE)
         candidates = _collect_profile_cleanup_candidates(
             ctx["service"]["base_dir"],
             runner=ctx["options"].get("diskUsageRunner"),
@@ -730,6 +733,21 @@ def handle_rename(rest, ctx):
     return 0
 
 
+def handle_label(rest, ctx):
+    parsed = _parse_label_args(rest)
+    if parsed["clear"]:
+        session = ctx["service"]["clear_session_label"](parsed["name"])
+        message = f"Cleared label for {parsed['name']}"
+    else:
+        session = ctx["service"]["set_session_label"](parsed["name"], parsed["label"])
+        message = f"Set label for {parsed['name']}: {session['label']}"
+    if parsed["json"]:
+        _write_json(ctx, _json_success("label", message, session=session, label=session.get("label")))
+        return 0
+    ctx["out"](f"{_success(message, ctx['use_color'])}\n")
+    return 0
+
+
 def handle_remove(rest, ctx):
     json_flag, args = _parse_json_flag(rest)
     parsed = _parse_remove_args(args)
@@ -1735,8 +1753,12 @@ def handle_last(rest, ctx):
 
 def handle_clean(rest, ctx):
     json_flag, args = _parse_json_flag(rest)
-    if args[:1] == ["profiles"] and any(arg in ("--tmp", "--old-logs") for arg in args[1:]):
-        return _handle_clean_profiles(args[1:], ctx, json_flag)
+    profile_flags = ("--tmp", "--old-logs")
+    has_profile_flag = any(arg in profile_flags or arg.startswith("--old-logs=") for arg in args)
+    if args[:1] == ["profiles"] or has_profile_flag:
+        if args[:1] == ["profiles"]:
+            return _handle_clean_profiles(args[1:], ctx, json_flag)
+        return _handle_clean_profiles(args, ctx, json_flag)
     yes = "--yes" in args
     args = [arg for arg in args if arg != "--yes"]
     service = ctx["service"]
@@ -2190,17 +2212,23 @@ def _refresh_claude_auth_states(service, target_names=None, spawn_sync=None, env
         if (session.get("auth") or {}).get("status") not in ("authenticated", "logged_out"):
             continue
         try:
-            authenticated = _probe_provider_auth(
+            auth_status = _probe_provider_auth_status(
                 session,
                 spawn_sync=spawn_sync,
                 env_override=env_override,
             )
+            if auth_status == AUTH_PROBE_DEGRADED:
+                errors.append({
+                    "session": session["name"],
+                    "error": "Auth probe timed out; authentication status is degraded.",
+                })
+                continue
             now = _local_now_iso()
-            service["update_auth_state"](session["name"], lambda auth, authenticated=authenticated, now=now: {
+            service["update_auth_state"](session["name"], lambda auth, auth_status=auth_status, now=now: {
                 **auth,
-                "status": "authenticated" if authenticated else "logged_out",
+                "status": "authenticated" if auth_status == AUTH_PROBE_AUTHENTICATED else "logged_out",
                 "lastCheckedAt": now,
-                **({"lastAuthenticatedAt": now} if authenticated else {}),
+                **({"lastAuthenticatedAt": now} if auth_status == AUTH_PROBE_AUTHENTICATED else {}),
             })
             updated.append(session["name"])
         except Exception as error:
@@ -2326,6 +2354,7 @@ def handle_import(rest, ctx):
         session_names=parsed["session_names"],
         force=parsed["force"],
         merge=parsed["merge"],
+        allow_authless_force=parsed["allow_authless_force"],
     )
     session_count = len(result["session_names"])
     auth_suffix = " with auth" if result["include_auth"] else ""

package/src/cli_helpers.py

@@ -57,14 +57,6 @@ def _write_json(ctx, payload):
     ctx["out"](f"{json.dumps(payload, indent=2)}\n")
 
 
-def _update_notice_warning(ctx):
-    notices = ctx.get("update_notices") or []
-    if not notices:
-        return None
-    warnings = _update_notice_warnings(ctx)
-    return warnings[0] if warnings else None
-
-
 def _update_notice_warnings(ctx):
     warnings = []
     for notice in ctx.get("update_notices") or []:
@@ -118,7 +110,7 @@ def _format_bytes(value):
         amount /= 1024
     if unit == "B":
         return f"{int(amount)} B"
-    return f"{amount:.1f} {unit}"
+    return f"{int(amount)} {unit}" if amount.is_integer() else f"{amount:.1f} {unit}"
 
 
 def _format_export_report(result):
@@ -157,39 +149,16 @@ def _make_export_progress(ctx):
     return progress
 
 
-def _make_status_progress(ctx):
+def _make_session_progress(ctx, start_event, start_message):
     progress_state = {"checked": 0, "total": 0}
 
     def progress(event):
         kind = event.get("event")
-        if kind == "status_started":
-            progress_state["checked"] = 0
-            progress_state["total"] = event.get("check_count", event.get("session_count", 0)) or 0
-            message = f"Resolving status for {event.get('session_count', 0)} session(s)..."
-            ctx["out"](f"{_info(message, ctx['use_color'])}\n")
-        elif kind == "session_started":
-            provider = event.get("provider") or "session"
-            message = f"Checking {event.get('session_name')} ({provider})..."
-            ctx["out"](f"{_dim(message, ctx['use_color'])}\n")
-        elif kind == "session_finished" and not event.get("cache_hit"):
-            progress_state["checked"] += 1
-            total = progress_state["total"] or progress_state["checked"]
-            message = f"Checked {event.get('session_name')} ({progress_state['checked']}/{total})."
-            ctx["out"](f"{_dim(message, ctx['use_color'])}\n")
-        elif kind == "status_finished":
-            message = f"Resolved {event.get('row_count', 0)} status row(s)."
-            ctx["out"](f"{_dim(message, ctx['use_color'])}\n")
-    return progress
-
-
-def _make_notify_progress(ctx):
-    progress_state = {"checked": 0, "total": 0}
-
-    def progress(event):
-        kind = event.get("event")
-        if kind == "notify_check_started":
-            target = event.get("session_name") or "next ready session"
-            ctx["out"](f"{_info(f'Checking notification target: {target}...', ctx['use_color'])}\n")
+        if kind == start_event:
+            if kind == "status_started":
+                progress_state["checked"] = 0
+                progress_state["total"] = event.get("check_count", event.get("session_count", 0)) or 0
+            ctx["out"](f"{_info(start_message(event), ctx['use_color'])}\n")
         elif kind == "status_started":
             progress_state["checked"] = 0
             progress_state["total"] = event.get("check_count", event.get("session_count", 0)) or 0
@@ -204,12 +173,31 @@ def _make_notify_progress(ctx):
             total = progress_state["total"] or progress_state["checked"]
             message = f"Checked {event.get('session_name')} ({progress_state['checked']}/{total})."
             ctx["out"](f"{_dim(message, ctx['use_color'])}\n")
+        elif kind == "status_finished":
+            message = f"Resolved {event.get('row_count', 0)} status row(s)."
+            ctx["out"](f"{_dim(message, ctx['use_color'])}\n")
         elif kind == "notify_waiting":
             message = f"{event.get('message')}; checking again in {event.get('poll')}s..."
             ctx["out"](f"{_dim(message, ctx['use_color'])}\n")
     return progress
 
 
+def _make_status_progress(ctx):
+    return _make_session_progress(
+        ctx,
+        "status_started",
+        lambda event: f"Resolving status for {event.get('session_count', 0)} session(s)...",
+    )
+
+
+def _make_notify_progress(ctx):
+    return _make_session_progress(
+        ctx,
+        "notify_check_started",
+        lambda event: f"Checking notification target: {event.get('session_name') or 'next ready session'}...",
+    )
+
+
 def _latest_launch_transcript_path(session):
     paths = _list_launch_transcript_paths(session)
     if not paths:

package/src/cli_render.py

@@ -123,10 +123,13 @@ def format_error(error, env=None, stderr=None):
 def _format_sessions(service, use_color=False):
     rows = service["format_list_rows"]()
     has_provider = any(r.get("provider") for r in rows)
+    has_label = any(r.get("label") for r in rows)
     has_launch = any(r.get("launch") for r in rows)
     headers = ["SESSION"]
     if has_provider:
         headers.append("PROVIDER")
+    if has_label:
+        headers.append("LABEL")
     headers.append("STATUS")
     if has_launch:
         headers.append("LAUNCH")
@@ -138,6 +141,8 @@ def _format_sessions(service, use_color=False):
         parts = [name]
         if has_provider:
             parts.append(r.get("provider") or "n/a")
+        if has_label:
+            parts.append(r.get("label") or "-")
         status = r.get("enabled_status") or ("enabled" if r.get("enabled", True) else "disabled")
         parts.append(_style(status, "2" if status == "disabled" else "32", use_color))
         if has_launch:

package/src/cli_view.py

@@ -1,4 +1,4 @@
-from .cli_helpers import _json_success, _write_json
+from .cli_helpers import _json_failure, _json_success, _update_notice_warnings, _write_json
 from .cli_render import _warn
 from .errors import CdxError
 from .logics_view import (
@@ -13,31 +13,6 @@ from .update_check import check_logics_manager_for_update
 VIEW_USAGE = "Usage: cdx view [--json] [--lan] [--lan-rw] [--focus <ref>] [--read] [--port <port>] [--host <host>] [--refresh-interval <s>] [--tls] [--open] [--no-open]"
 
 
-def _update_notice_warnings(notices):
-    warnings = []
-    for notice in notices or []:
-        if not notice:
-            continue
-        tool = notice.get("tool") or "logics-manager"
-        current = notice.get("current_version")
-        command = notice.get("update_command")
-        message = f"Update available: {tool} {notice['latest_version']}"
-        if current:
-            message = f"{message} (current {current})"
-        if command:
-            message = f"{message}. Run: {command}"
-        warnings.append({
-            "code": f"{tool.replace('-', '_')}_update_available",
-            "message": message,
-            "tool": tool,
-            "latest_version": notice["latest_version"],
-            "current_version": current,
-            "update_command": command,
-            "url": notice.get("url"),
-        })
-    return warnings
-
-
 def _logics_manager_update_notice(ctx, env):
     checker = ctx["options"].get("checkLogicsManagerForUpdate") or check_logics_manager_for_update
     return checker(
@@ -86,9 +61,12 @@ def handle_view(rest, ctx):
     update_notice = _logics_manager_update_notice(ctx, env) if executable else None
     failure = None if executable else missing_logics_manager_failure()
     diagnostics = build_viewer_diagnostics(executable, cwd, update_notice=update_notice, failure=failure, extra_args=viewer_args)
-    warnings = _update_notice_warnings([update_notice])
+    warnings = _update_notice_warnings({"update_notices": [update_notice] if update_notice else []})
 
     if json_flag:
+        if failure:
+            _write_json(ctx, _json_failure("view", "viewer_unavailable", failure["message"], warnings=warnings, viewer=diagnostics))
+            return 1
         _write_json(ctx, _json_success("view", "Collected Logics viewer diagnostics", warnings=warnings, viewer=diagnostics))
         return 0
 

package/src/codex_usage.py

@@ -4,6 +4,7 @@ import os
 import queue
 import subprocess
 import threading
+import time
 from datetime import datetime, timezone
 
 from .status_source import _is_zero_credit_balance
@@ -17,7 +18,7 @@ CODEX_AUTH_LOCK_NAME = ".cdx-auth.lock"
 
 
 @contextlib.contextmanager
-def codex_auth_lock(auth_home, blocking=False):
+def codex_auth_lock(auth_home, blocking=False, timeout_seconds=None, retry_interval_seconds=0.05):
     """Serialize codex token refreshes per CODEX_HOME.
 
     Codex rotates its OAuth refresh_token on refresh and invalidates the old
@@ -36,13 +37,18 @@ def codex_auth_lock(auth_home, blocking=False):
     except OSError:
         yield True
         return
-    flags = fcntl.LOCK_EX if blocking else fcntl.LOCK_EX | fcntl.LOCK_NB
-    try:
-        fcntl.flock(handle, flags)
-    except OSError:
-        handle.close()
-        yield False
-        return
+    deadline = None if timeout_seconds is None else time.monotonic() + timeout_seconds
+    while True:
+        flags = fcntl.LOCK_EX if blocking and timeout_seconds is None else fcntl.LOCK_EX | fcntl.LOCK_NB
+        try:
+            fcntl.flock(handle, flags)
+            break
+        except OSError:
+            if not blocking or (deadline is not None and time.monotonic() >= deadline):
+                handle.close()
+                yield False
+                return
+            time.sleep(retry_interval_seconds)
     try:
         yield True
     finally:

package/src/notify.py

@@ -1,6 +1,7 @@
 import json
 import os
 import shlex
+import shutil
 import subprocess
 import time
 from datetime import datetime, timedelta
@@ -165,14 +166,14 @@ def send_desktop_notification(title, message, spawn_sync=None, env=None):
     env = env or os.environ
     if sys.platform == "win32":
         _send_windows_notification(title, message, spawn_sync, env)
-    elif shutil_which("osascript", env):
+    elif shutil.which("osascript", path=env.get("PATH")):
         script = f'display notification "{_escape_applescript(message)}" with title "{_escape_applescript(title)}"'
         _run_notification_command(
             ["osascript", "-e", script],
             spawn_sync,
             env,
         )
-    elif shutil_which("notify-send", env):
+    elif shutil.which("notify-send", path=env.get("PATH")):
         _run_notification_command(
             ["notify-send", str(title), str(message)],
             spawn_sync,
@@ -209,11 +210,6 @@ def _escape_powershell(value):
     return str(value).replace("'", "''")
 
 
-def shutil_which(command, env):
-    import shutil
-    return shutil.which(command, path=env.get("PATH"))
-
-
 def _escape_applescript(value):
     return str(value).replace("\\", "\\\\").replace('"', '\\"')
 
@@ -247,7 +243,7 @@ def schedule_notification_event(base_dir, parsed, event, spawn_sync=None, env=No
 
 
 def _scheduled_notify_argv(parsed, env):
-    executable = env.get("CDX_BIN") or shutil_which("cdx", env) or "cdx"
+    executable = env.get("CDX_BIN") or shutil.which("cdx", path=env.get("PATH")) or "cdx"
     argv = [executable, "notify"]
     if parsed["mode"] == "at-reset":
         argv.append(parsed["name"])
@@ -331,7 +327,7 @@ def _launchd_plist(label, script_path, target):
 def _schedule_linux(parsed, event, argv, spawn_sync, env):
     unit = _schedule_id("cdx-manager-notify", parsed, event)
     target = _round_up_to_next_minute(datetime.fromtimestamp(event["target_timestamp"]).astimezone())
-    if shutil_which("systemd-run", env):
+    if shutil.which("systemd-run", path=env.get("PATH")):
         calendar = target.strftime("%Y-%m-%d %H:%M:%S")
         result = _run_scheduler_command(
             ["systemd-run", "--user", f"--unit={unit}", f"--on-calendar={calendar}", *argv],
@@ -343,7 +339,7 @@ def _schedule_linux(parsed, event, argv, spawn_sync, env):
         if _scheduler_error_means_exists(result["error"]):
             return {"scheduled": True, "existing": True, "backend": "systemd", "id": unit}
         raise CdxError(f"Failed to schedule notification with systemd-run: {result['error']}")
-    if shutil_which("at", env):
+    if shutil.which("at", path=env.get("PATH")):
         at_time = target.strftime("%Y%m%d%H%M.%S")
         command = " ".join(shlex.quote(str(part)) for part in argv)
         result = _run_scheduler_command(["at", "-t", at_time], spawn_sync, env, input_text=f"{command}\n")

package/src/provider_runtime.py

@@ -16,6 +16,11 @@ from .config import PROVIDER_ANTIGRAVITY, PROVIDER_CLAUDE, PROVIDER_CODEX, PROVI
 from .errors import CdxError
 
 LOG_ROTATE_BYTES = 10 * 1024 * 1024  # 10 MB
+AUTH_PROBE_TIMEOUT_SECONDS = 15
+CODEX_INTERACTIVE_AUTH_LOCK_TIMEOUT_SECONDS = 10
+AUTH_PROBE_AUTHENTICATED = "authenticated"
+AUTH_PROBE_LOGGED_OUT = "logged_out"
+AUTH_PROBE_DEGRADED = "degraded"
 REASONING_EFFORT_VALUES = {"minimal", "low", "medium", "high", "xhigh"}
 RTK_PROMPT = (
     "When running noisy shell commands, prefer RTK wrappers (`rtk <command>`) if `rtk` is available. "
@@ -173,12 +178,15 @@ def codex_auth_diagnostic(session, spawn_sync=None, env_override=None):
         "live_error": None,
     }
     try:
-        result["live_status"] = "authenticated" if _probe_provider_auth(
+        status = _probe_provider_auth_status(
             session,
             spawn_sync=spawn_sync,
             env_override=env_override,
             trust_local_credentials=False,
-        ) else "logged_out"
+        )
+        result["live_status"] = status
+        if status == AUTH_PROBE_DEGRADED:
+            result["live_error"] = _auth_probe_degraded_message(session)
     except CdxError as error:
         result["live_status"] = "error"
         result["live_error"] = str(error)
@@ -899,14 +907,21 @@ def _resolve_command(command, env=None):
     return shutil.which(command, path=env.get("PATH")) or command
 
 
-def _probe_provider_auth(session, spawn_sync=None, env_override=None, trust_local_credentials=True):
+def _auth_probe_degraded_message(session):
+    return (
+        f"Auth probe timed out after {AUTH_PROBE_TIMEOUT_SECONDS}s for session {session.get('name') or 'unknown'}; "
+        "authentication status is degraded."
+    )
+
+
+def _probe_provider_auth_status(session, spawn_sync=None, env_override=None, trust_local_credentials=True):
     spawn_sync = spawn_sync or subprocess.run
     spec = _build_login_status_spec(session, env_override)
     if trust_local_credentials:
         if session.get("provider") == PROVIDER_CLAUDE and _has_local_claude_auth(_get_auth_home(session)):
-            return True
+            return AUTH_PROBE_AUTHENTICATED
         if session.get("provider") == PROVIDER_CODEX and _has_local_codex_auth(_get_auth_home(session)):
-            return True
+            return AUTH_PROBE_AUTHENTICATED
     try:
         if spawn_sync is subprocess.run:
             command = _resolve_command(spec["command"], spec["env"])
@@ -914,19 +929,33 @@ def _probe_provider_auth(session, spawn_sync=None, env_override=None, trust_loca
                 [command] + spec["args"],
                 env=spec["env"],
                 capture_output=True, text=True,
+                timeout=AUTH_PROBE_TIMEOUT_SECONDS,
             )
             output = (result.stdout or "") + (result.stderr or "")
         else:
             result = spawn_sync(spec["command"], spec["args"], spec)
             error = result.get("error") if isinstance(result, dict) else getattr(result, "error", None)
             if error:
+                if isinstance(error, subprocess.TimeoutExpired):
+                    raise error
                 raise _format_probe_failure(session, spec, error)
             stdout = result.get("stdout") if isinstance(result, dict) else getattr(result, "stdout", "")
             stderr = result.get("stderr") if isinstance(result, dict) else getattr(result, "stderr", "")
             output = (stdout or "") + (stderr or "")
+    except subprocess.TimeoutExpired:
+        return AUTH_PROBE_DEGRADED
     except OSError as error:
         raise _format_probe_failure(session, spec, error) from error
-    return spec["parser"](output)
+    return AUTH_PROBE_AUTHENTICATED if spec["parser"](output) else AUTH_PROBE_LOGGED_OUT
+
+
+def _probe_provider_auth(session, spawn_sync=None, env_override=None, trust_local_credentials=True):
+    return _probe_provider_auth_status(
+        session,
+        spawn_sync=spawn_sync,
+        env_override=env_override,
+        trust_local_credentials=trust_local_credentials,
+    ) == AUTH_PROBE_AUTHENTICATED
 
 
 def _signal_exit_code(sig):
@@ -953,10 +982,15 @@ def _run_interactive_provider_command(session, action, spawn=None, cwd=None,
                   lifecycle_callback=lifecycle_callback)
     if session.get("provider") != PROVIDER_CODEX:
         return _run_interactive_provider_command_impl(session, action, **kwargs)
-    # Hold the per-CODEX_HOME lock for the whole session so a concurrent status
-    # probe backs off instead of rotating the refresh_token mid-run (which logs
-    # the session out). ponytail: non-blocking, so launch never waits on a probe.
-    with codex_auth_lock(_get_auth_home(session)):
+    # Hold the per-CODEX_HOME lock for the whole session so concurrent Codex
+    # processes cannot rotate the refresh_token under each other.
+    with codex_auth_lock(
+        _get_auth_home(session),
+        blocking=True,
+        timeout_seconds=CODEX_INTERACTIVE_AUTH_LOCK_TIMEOUT_SECONDS,
+    ) as acquired:
+        if not acquired:
+            raise CdxError(f"Timed out waiting for Codex auth lock for session {session['name']}.")
         return _run_interactive_provider_command_impl(session, action, **kwargs)
 
 
@@ -1114,16 +1148,26 @@ def _ensure_session_authentication(session, service, spawn=None, spawn_sync=None
         raise CdxError(
             f"Session {session['name']} is not authenticated. Run: cdx login {session['name']}"
         )
-    is_authenticated = _probe_provider_auth(
+    auth_status = _probe_provider_auth_status(
         session,
         spawn_sync=spawn_sync,
         env_override=env_override,
         trust_local_credentials=trust_local_credentials,
     )
-    if is_authenticated:
-        return {"authenticated": True, "checked": True}
+    if auth_status == AUTH_PROBE_AUTHENTICATED:
+        return {"authenticated": True, "checked": True, "status": auth_status}
+    if auth_status == AUTH_PROBE_DEGRADED:
+        result = {
+            "authenticated": False,
+            "checked": True,
+            "status": auth_status,
+            "error": _auth_probe_degraded_message(session),
+        }
+        if behavior == "probe-only":
+            return result
+        raise CdxError(f"{result['error']} Retry, or run: cdx login {session['name']}")
     if behavior == "probe-only":
-        return {"authenticated": False, "checked": True}
+        return {"authenticated": False, "checked": True, "status": auth_status}
     if behavior == "launch":
         raise CdxError(
             f"Session {session['name']} is not authenticated. Run: cdx login {session['name']}"