cdx-manager 0.11.1 → 0.11.2

package/README.md

@@ -1,6 +1,6 @@
 # CDX Manager
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.11.1-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.11.2-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Run multiple Codex, Claude, Antigravity, and Ollama sessions from one terminal. Switch between accounts instantly.**
 
@@ -683,7 +683,7 @@ Without `--yes`, an interactive confirmation is required. `cdx` sends an idempot
 ## Troubleshooting
 
 - **`cdx <name>` fails with "not authenticated"** — run `cdx login <name>` first.
-- **One of two Codex accounts keeps asking for login** — run `cdx doctor --json` and inspect each Codex session's `codex_auth_file` and `codex_live_auth` checks. Codex sessions use isolated `CODEX_HOME` directories, but newly created sessions seed from the current global `~/.codex/auth.json` when one exists. For two separate Codex accounts, create or repair each session by running `cdx login <name>` for that session; `cdx login` does not log out first, so use `cdx logout <name>` explicitly only when you want to clear that isolated profile.
+- **One of two Codex accounts keeps asking for login** — run `cdx doctor --json` and inspect each Codex session's `codex_auth_file`, `codex_live_auth`, and `codex_stale_auth_logs` checks. If recent logs mention expired auth, repair only that isolated profile with `cdx login <name>`. Codex Business profiles can share the same `tokens.account_id`; `cdx doctor` reports `codex_shared_account_id` as a workspace-level clue, not proof that two profiles use the same user. Newly created sessions seed from the current global `~/.codex/auth.json` when one exists. For two separate Codex accounts, create or repair each session by running `cdx login <name>` for that session; `cdx login` does not log out first, so use `cdx logout <name>` explicitly only when you want to clear that isolated profile.
 - **`cdx` says no compatible Python 3 interpreter was found** — install Python 3 and make `py -3`, `python`, or `python3` available on PATH.
 - **`cdx add` succeeds but the session does not appear** — check that `CDX_HOME` is consistent between calls; a mismatch creates two separate registries.
 - **Status shows `n/a` for all fields** — the Codex app-server rate-limit probe may be unavailable, the session may not be authenticated, and no legacy transcript/history status has been captured yet.

package/changelogs/CHANGELOGS_0_11_2.md

@@ -0,0 +1,27 @@
+# CDX Manager 0.11.2
+
+## Highlights
+
+- Improved Codex Business auth diagnostics without changing login or launch behavior.
+- Added stale-auth log warnings to help repair the affected profile only.
+- Documented the Business `account_id` ambiguity and the `cdx login <name>` repair path.
+
+## Changes
+
+### Codex Business auth diagnostics
+
+`cdx doctor` now reports shared Codex `tokens.account_id` values as workspace-level evidence on Business plans, not proof that two profiles are using the same user account. When recent `/status` transcript output exposes different observed users for profiles that share the same account id, doctor marks that as expected instead of a duplicate-user warning.
+
+Codex auth diagnostics now include a masked `account_id` and an observed account from recent logs when available. Raw tokens remain excluded from JSON output.
+
+### Stale auth hints
+
+`cdx doctor` scans recent Codex profile logs for common expired-auth markers such as `401`, `token_expired`, and `authentication token is expired`. When found, it emits `codex_stale_auth_logs` with a direct `cdx login <name>` recommendation for the affected isolated profile.
+
+## Validation
+
+- `npm run lint`
+- `npm test`
+- `logics-manager health`
+- `logics-manager lint --require-status`
+- `logics-manager audit --group-by-doc`

package/checksums/release-archives.json

@@ -140,6 +140,10 @@
     "v0.11.0": {
       "github_tarball_sha256": "bc42f83f20ba1c6ff81f824c382801457f93cf8cb166acbe952c12d009560a70",
       "github_zip_sha256": "1c03b4f03f53c46d0a5ba580fc8ade7b26fa3cb1bb5f029f703681f136b9ac1f"
+    },
+    "v0.11.1": {
+      "github_tarball_sha256": "33ee5a76cd217007468ea620fa725644dfd62179585551b5703129c00a5094d5",
+      "github_zip_sha256": "8b53832ad2af109c22a898782bd36e1408356fc2bd0c3f99ca2ffb1262e2325b"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.11.1"
+version = "0.11.2"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/cli.py

@@ -77,7 +77,7 @@ from .status_view import (
 )
 from .update_check import check_for_update, check_logics_manager_for_update
 
-VERSION = "0.11.1"
+VERSION = "0.11.2"
 
 # Public surface: this module is a facade. Names below are imported above
 # purely to be re-exported (consumed by tests and external callers); listing

package/src/health.py

@@ -3,11 +3,13 @@ import os
 import shutil
 import sys
 import tempfile
+from datetime import datetime, timezone
 from urllib.parse import quote, unquote
 
 from .cli_render import _pad_table, _style
 from .config import PROVIDER_CODEX
 from .provider_runtime import codex_auth_diagnostic
+from .status_source import _extract_account_identity
 
 
 def _encode(name):
@@ -73,6 +75,7 @@ def collect_health_report(service, base_dir, env=None, spawn_sync=None):
     issues.append(_check_cdx_home(base_dir))
     sessions = service["list_sessions"]()
     session_names = {session["name"] for session in sessions}
+    codex_diagnostics = []
     for session in sessions:
         name = session["name"]
         root = session.get("sessionRoot") or service["get_session_root"](name)
@@ -82,16 +85,19 @@ def collect_health_report(service, base_dir, env=None, spawn_sync=None):
         if not os.path.isfile(state_path):
             issues.append(_issue("FAIL", "missing_state", f"session {name} state file is missing", state_path, True))
         if session.get("provider") == PROVIDER_CODEX:
-            issues.extend(_codex_auth_issues(session, spawn_sync=spawn_sync, env=env))
+            diag = codex_auth_diagnostic(session, spawn_sync=spawn_sync, env_override=env)
+            diag["observed_account"] = _recent_codex_observed_account(diag.get("auth_home"))
+            codex_diagnostics.append((session, diag))
+            issues.extend(_codex_auth_issues(session, diag))
 
+    issues.extend(_codex_shared_account_id_issues(codex_diagnostics))
     issues.extend(_collect_profile_issues(base_dir, session_names))
     return {"base_dir": base_dir, "issues": issues, "summary": summarize_health(issues)}
 
 
-def _codex_auth_issues(session, spawn_sync=None, env=None):
+def _codex_auth_issues(session, diag):
     name = session["name"]
-    diag = codex_auth_diagnostic(session, spawn_sync=spawn_sync, env_override=env)
-    identity = diag.get("account_email") or "unknown account"
+    identity = diag.get("account_email") or diag.get("observed_account") or "unknown account"
     issues = [
         _issue(
             "OK" if diag.get("auth_json_exists") else "WARN",
@@ -103,6 +109,8 @@ def _codex_auth_issues(session, spawn_sync=None, env=None):
                 "auth_json_exists": diag.get("auth_json_exists"),
                 "local_tokens_present": diag.get("local_tokens_present"),
                 "account_email": diag.get("account_email"),
+                "observed_account": diag.get("observed_account"),
+                "account_id": _mask_identifier(diag.get("account_id")),
             },
         )
     ]
@@ -120,9 +128,126 @@ def _codex_auth_issues(session, spawn_sync=None, env=None):
             "live_error": diag.get("live_error"),
         },
     ))
+    stale_auth = _recent_codex_auth_error(diag.get("auth_home"))
+    if stale_auth:
+        issues.append(_issue(
+            "WARN",
+            "codex_stale_auth_logs",
+            f"session {name} recent Codex logs mention expired auth; run cdx login {name} if disconnects continue",
+            {
+                "session": name,
+                "auth_home": diag.get("auth_home"),
+                "source": stale_auth["source"],
+                "mtime": stale_auth["mtime"],
+                "markers": stale_auth["markers"],
+            },
+        ))
     return issues
 
 
+def _codex_shared_account_id_issues(codex_diagnostics):
+    by_account_id = {}
+    for session, diag in codex_diagnostics:
+        account_id = diag.get("account_id")
+        if account_id:
+            by_account_id.setdefault(account_id, []).append((session, diag))
+
+    issues = []
+    for account_id, rows in sorted(by_account_id.items()):
+        if len(rows) < 2:
+            continue
+        identities = sorted({
+            _identity_user_part(diag.get("account_email") or diag.get("observed_account"))
+            for _session, diag in rows
+            if _identity_user_part(diag.get("account_email") or diag.get("observed_account"))
+        })
+        sessions = [session["name"] for session, _diag in rows]
+        status = "OK" if len(identities) > 1 else "WARN"
+        message = (
+            "Codex profiles share a Business account_id but observed different users; account_id is not a user identity"
+            if status == "OK"
+            else "Codex profiles share account_id; on Business plans this may be a workspace id, not proof of duplicate user auth"
+        )
+        issues.append(_issue(
+            status,
+            "codex_shared_account_id",
+            message,
+            {
+                "sessions": sessions,
+                "account_id": _mask_identifier(account_id),
+                "observed_identities": identities,
+            },
+        ))
+    return issues
+
+
+def _identity_user_part(value):
+    if not value:
+        return None
+    return str(value).strip().lower().split()[0].split("(", 1)[0]
+
+
+def _mask_identifier(value):
+    if not value:
+        return None
+    text = str(value)
+    return text if len(text) <= 8 else f"{text[:6]}...{text[-4:]}"
+
+
+def _recent_codex_observed_account(auth_home):
+    for path in _recent_codex_log_paths(auth_home):
+        text = _read_tail(path)
+        account = _extract_account_identity(text)
+        if account:
+            return account
+    return None
+
+
+def _recent_codex_auth_error(auth_home):
+    markers = ("token_expired", "authentication token is expired", "http 401")
+    for path in _recent_codex_log_paths(auth_home):
+        text = _read_tail(path).lower()
+        found = [marker for marker in markers if marker in text]
+        if found:
+            try:
+                mtime = datetime.fromtimestamp(os.path.getmtime(path), timezone.utc).isoformat().replace("+00:00", "Z")
+            except OSError:
+                mtime = None
+            return {"source": path, "mtime": mtime, "markers": found}
+    return None
+
+
+def _recent_codex_log_paths(auth_home):
+    if not auth_home:
+        return []
+    candidates = []
+    for root in (os.path.join(auth_home, "log"), os.path.join(auth_home, "sessions")):
+        if not os.path.isdir(root):
+            continue
+        for dirpath, dirnames, filenames in os.walk(root):
+            dirnames[:] = [name for name in dirnames if name not in {"cache", "plugins", "skills", "sqlite"}]
+            for filename in filenames:
+                if filename.endswith((".log", ".jsonl")):
+                    path = os.path.join(dirpath, filename)
+                    try:
+                        stat = os.stat(path)
+                    except OSError:
+                        continue
+                    candidates.append((stat.st_mtime, path))
+    return [path for _mtime, path in sorted(candidates, reverse=True)[:16]]
+
+
+def _read_tail(path, max_bytes=128 * 1024):
+    try:
+        with open(path, "rb") as handle:
+            handle.seek(0, os.SEEK_END)
+            size = handle.tell()
+            handle.seek(max(0, size - max_bytes))
+            return handle.read().decode("utf-8", errors="replace")
+    except OSError:
+        return ""
+
+
 def _check_cdx_home(base_dir):
     try:
         os.makedirs(base_dir, exist_ok=True)

package/src/provider_runtime.py

@@ -166,6 +166,19 @@ def _read_codex_account_email(auth_home):
     return None
 
 
+def _read_codex_account_id(auth_home):
+    try:
+        with open(os.path.join(auth_home, "auth.json"), encoding="utf-8") as handle:
+            auth = json.load(handle)
+    except (FileNotFoundError, OSError, json.JSONDecodeError):
+        return None
+    tokens = auth.get("tokens") if isinstance(auth, dict) else {}
+    account_id = tokens.get("account_id") if isinstance(tokens, dict) else None
+    if not account_id:
+        return None
+    return str(account_id).strip() or None
+
+
 def codex_auth_diagnostic(session, spawn_sync=None, env_override=None):
     auth_home = _get_auth_home(session)
     auth_path = os.path.join(auth_home, "auth.json")
@@ -174,6 +187,7 @@ def codex_auth_diagnostic(session, spawn_sync=None, env_override=None):
         "auth_json_exists": os.path.isfile(auth_path),
         "local_tokens_present": _has_local_codex_auth(auth_home),
         "account_email": _read_codex_account_email(auth_home),
+        "account_id": _read_codex_account_id(auth_home),
         "live_status": "unknown",
         "live_error": None,
     }