cdx-manager 0.11.1 → 0.12.0

package/README.md

@@ -1,6 +1,6 @@
 # CDX Manager
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.11.1-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.12.0-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Run multiple Codex, Claude, Antigravity, and Ollama sessions from one terminal. Switch between accounts instantly.**
 
@@ -361,7 +361,8 @@ cdx history --summary --from 2026-05-01 --to 2026-05-28
 | `cdx last [--json]` | Launch the most recent existing session from launch history |
 | `cdx resume <name> [--json]` | Resume the provider-native conversation for a session using the named command form |
 | `cdx can-resume <name> [--json]` | Check whether a session supports native resume without launching the provider |
-| `cdx context show\|path\|init\|edit\|clear\|set [text...] [--json]` | Manage the shared Markdown context for the current workspace |
+| `cdx context show\|path\|init\|edit\|clear\|set\|append [text...] [--json]` | Manage the shared Markdown context for the current workspace |
+| `cdx memory [--global\|--project NAME_OR_PATH] [show\|view\|path\|init\|edit\|clear\|set\|append\|list] [text...] [--json]` | Manage explicit user-controlled memory for the current workspace, global scope, or a named/path project |
 | `cdx handoff <name> [--json]` | Install the current workspace context into a target session and launch it unless `--json` is used |
 | `cdx handoff <source> <target> [--json]` | Build shared context from the source session's latest launch transcript, install it into the target session, and launch the target unless `--json` is used; supports cross-provider handoff |
 | `cdx rmv <name> [--force] [--json]` | Remove a session and its auth data (prompts for confirmation unless `--force`) |
@@ -371,7 +372,7 @@ cdx history --summary --from 2026-05-01 --to 2026-05-28
 | `cdx reset <name> [--yes] [--json]` | Explicitly consume one available banked Codex rate-limit reset; confirmation is required unless `--yes` is supplied |
 | `cdx export <file> [--include-auth] [--sessions a,b] [--passphrase-env VAR\|--passphrase-stdin] [--force] [--json]` | Export sessions to a portable bundle; `--include-auth` encrypts auth data with a passphrase |
 | `cdx import <file> [--sessions a,b] [--passphrase-env VAR\|--passphrase-stdin] [--force] [--json]` | Import sessions from a bundle into the current `CDX_HOME` |
-| `cdx doctor [--json]` | Inspect CLI dependencies, CDX_HOME permissions, missing state, orphan profiles, and pending quarantines |
+| `cdx doctor [--json]` | Inspect CLI dependencies, provider CLI versions/capability hints, CDX_HOME permissions, missing state, orphan profiles, and pending quarantines |
 | `cdx repair [--dry-run] [--force] [--json]` | Plan or apply safe repairs for missing state files, quarantines, and orphan profiles |
 | `cdx view [--json] [--lan] [--lan-rw] [--focus <ref>] [--read] [--port <port>] [--host <host>] [--refresh-interval <s>] [--tls] [--tls-cert <path>] [--tls-key <path>] [--open] [--no-open]` | Open the Logics browser/focus viewer by delegating to `logics-manager view`; all viewer flags are forwarded; JSON mode reports diagnostics without launching it |
 | `cdx update [--check] [--yes] [--json] [--version TAG]` | Update cdx-manager using the installer that matches how it was installed |
@@ -414,6 +415,7 @@ Commands with machine-readable output:
 - `cdx disable ... --json`
 - `cdx enable ... --json`
 - `cdx context ... --json`
+- `cdx memory ... --json`
 - `cdx handoff ... --json`
 - `cdx history ... --json`
 - `cdx stats ... --json`
@@ -558,6 +560,7 @@ Notes:
   - if a compatible `script` command is available and exposed via `CDX_SCRIPT_BIN`, `cdx` uses it
   - otherwise Codex launches without transcript capture and the session still works normally
 - `cdx doctor` reports the transcript-capture fallback explicitly so missing `script` on Windows is visible without being treated as a hard failure.
+- `cdx doctor --json` includes detected `codex --version` and `claude --version` output when available, plus conservative capability hints for recent provider memory, model, and headless diagnostic surfaces. These hints are informational; `cdx` does not edit provider-private memory stores.
 
 ---
 
@@ -605,6 +608,10 @@ All session data lives under `CDX_HOME` (default: `~/.cdx/`):
   state/
     <encoded-name>.json     # Per-session rehydration state
     launch_history.jsonl    # Append-only launch history
+  contexts/
+    <workspace-hash>/context.md     # Current-workspace shared context / memory
+    global/context.md               # Global cdx memory
+    projects/<encoded-name>/context.md  # Named project memory from cdx memory --project NAME
   profiles/
     <encoded-name>/         # Codex session: CODEX_HOME points here
       log/
@@ -617,6 +624,10 @@ All session data lives under `CDX_HOME` (default: `~/.cdx/`):
 
 Session names are URL-encoded when used as directory or file names. CLI command names such as `add`, `disk`, `status`, and `login` are reserved and cannot be used as new session names.
 
+`cdx memory` is the user-facing interface for explicit memory. `--project NAME` uses a stable free-form project name; `--project /path/to/repo` resolves to the same workspace-hash memory that repo would use as the current workspace. `append` adds the text as-is with a clean newline boundary; it does not add dates or headings. `list` reports global memory, named project memories, and the current workspace memory when present; it does not scan your filesystem for repos.
+
+Provider-private memory files, such as Codex SQLite memory databases or Claude Code project memory files, are not edited by `cdx memory`.
+
 ### Disk maintenance
 
 Use `cdx disk` for a total `CDX_HOME` measurement, and `cdx disk profiles` for the `profiles/` total plus a per-profile breakdown.
@@ -683,7 +694,7 @@ Without `--yes`, an interactive confirmation is required. `cdx` sends an idempot
 ## Troubleshooting
 
 - **`cdx <name>` fails with "not authenticated"** — run `cdx login <name>` first.
-- **One of two Codex accounts keeps asking for login** — run `cdx doctor --json` and inspect each Codex session's `codex_auth_file` and `codex_live_auth` checks. Codex sessions use isolated `CODEX_HOME` directories, but newly created sessions seed from the current global `~/.codex/auth.json` when one exists. For two separate Codex accounts, create or repair each session by running `cdx login <name>` for that session; `cdx login` does not log out first, so use `cdx logout <name>` explicitly only when you want to clear that isolated profile.
+- **One of two Codex accounts keeps asking for login** — run `cdx doctor --json` and inspect each Codex session's `codex_auth_file`, `codex_live_auth`, and `codex_stale_auth_logs` checks. If recent logs mention expired auth, repair only that isolated profile with `cdx login <name>`. Codex Business profiles can share the same `tokens.account_id`; `cdx doctor` reports `codex_shared_account_id` as a workspace-level clue, not proof that two profiles use the same user. Newly created sessions seed from the current global `~/.codex/auth.json` when one exists. For two separate Codex accounts, create or repair each session by running `cdx login <name>` for that session; `cdx login` does not log out first, so use `cdx logout <name>` explicitly only when you want to clear that isolated profile.
 - **`cdx` says no compatible Python 3 interpreter was found** — install Python 3 and make `py -3`, `python`, or `python3` available on PATH.
 - **`cdx add` succeeds but the session does not appear** — check that `CDX_HOME` is consistent between calls; a mismatch creates two separate registries.
 - **Status shows `n/a` for all fields** — the Codex app-server rate-limit probe may be unavailable, the session may not be authenticated, and no legacy transcript/history status has been captured yet.

package/changelogs/CHANGELOGS_0_11_2.md

@@ -0,0 +1,27 @@
+# CDX Manager 0.11.2
+
+## Highlights
+
+- Improved Codex Business auth diagnostics without changing login or launch behavior.
+- Added stale-auth log warnings to help repair the affected profile only.
+- Documented the Business `account_id` ambiguity and the `cdx login <name>` repair path.
+
+## Changes
+
+### Codex Business auth diagnostics
+
+`cdx doctor` now reports shared Codex `tokens.account_id` values as workspace-level evidence on Business plans, not proof that two profiles are using the same user account. When recent `/status` transcript output exposes different observed users for profiles that share the same account id, doctor marks that as expected instead of a duplicate-user warning.
+
+Codex auth diagnostics now include a masked `account_id` and an observed account from recent logs when available. Raw tokens remain excluded from JSON output.
+
+### Stale auth hints
+
+`cdx doctor` scans recent Codex profile logs for common expired-auth markers such as `401`, `token_expired`, and `authentication token is expired`. When found, it emits `codex_stale_auth_logs` with a direct `cdx login <name>` recommendation for the affected isolated profile.
+
+## Validation
+
+- `npm run lint`
+- `npm test`
+- `logics-manager health`
+- `logics-manager lint --require-status`
+- `logics-manager audit --group-by-doc`

package/changelogs/CHANGELOGS_0_12_0.md

@@ -0,0 +1,42 @@
+# CDX Manager 0.12.0
+
+## Highlights
+
+- Added explicit `cdx memory` management for current workspace, global, and project-scoped memory.
+- Added append/list workflows for user-controlled Markdown memory without touching provider-private memory stores.
+- Improved `cdx doctor` provider visibility with Codex and Claude CLI versions plus conservative capability hints.
+
+## Changes
+
+### Scoped memory
+
+`cdx memory` now manages explicit local memory using the existing shared context store:
+
+- `cdx memory append <text>` appends to the current workspace memory.
+- `cdx memory --global append <text>` appends to a global operator memory.
+- `cdx memory --project <name> append <text>` appends to a stable named project memory.
+- `cdx memory --project <path> ...` resolves to the same workspace-hash memory used by that repo path.
+- `cdx memory list [--json]` lists global memory, named project memories, and the current workspace memory when present.
+
+Append is intentionally plain text with a clean newline boundary; it does not add dates or headings automatically.
+
+### Context compatibility
+
+`cdx context append <text>` was added for the existing workspace context command. Existing `cdx context` and `cdx handoff` behavior remains compatible.
+
+### Doctor provider versions
+
+`cdx doctor` now records provider CLI versions when available:
+
+- `codex --version`
+- `claude --version`
+
+JSON output includes conservative capability hints for recent provider memory and diagnostic surfaces. These hints are informational; `cdx` still does not read or write Codex SQLite memory, Claude Code project memory, `CLAUDE.md`, or provider plugin files.
+
+## Validation
+
+- `PYTHONPATH=src python3 -m pytest -q`
+- `python3 -m ruff check src test`
+- `logics-manager flow validate req_013_add_a_small_workspace_memory_command_to_cdx`
+- `logics-manager lint --require-status`
+- `logics-manager audit --group-by-doc`

package/checksums/release-archives.json

@@ -140,6 +140,14 @@
     "v0.11.0": {
       "github_tarball_sha256": "bc42f83f20ba1c6ff81f824c382801457f93cf8cb166acbe952c12d009560a70",
       "github_zip_sha256": "1c03b4f03f53c46d0a5ba580fc8ade7b26fa3cb1bb5f029f703681f136b9ac1f"
+    },
+    "v0.11.1": {
+      "github_tarball_sha256": "33ee5a76cd217007468ea620fa725644dfd62179585551b5703129c00a5094d5",
+      "github_zip_sha256": "8b53832ad2af109c22a898782bd36e1408356fc2bd0c3f99ca2ffb1262e2325b"
+    },
+    "v0.11.2": {
+      "github_tarball_sha256": "513d7c586a662da5ac5daf792fc76f746e924bbd95157a9d0cbbeba34f2991e0",
+      "github_zip_sha256": "d6d633efcbdc28818f68bd87efe3f246fe2983a9f4aa24d03868c978645c593e"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.11.1"
+version = "0.12.0"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/cli.py

@@ -32,6 +32,7 @@ from .cli_commands import (
     handle_launch_setting_alias,
     handle_login,
     handle_logout,
+    handle_memory,
     handle_next,
     handle_notify,
     handle_remove,
@@ -77,7 +78,7 @@ from .status_view import (
 )
 from .update_check import check_for_update, check_logics_manager_for_update
 
-VERSION = "0.11.1"
+VERSION = "0.12.0"
 
 # Public surface: this module is a facade. Names below are imported above
 # purely to be re-exported (consumed by tests and external callers); listing
@@ -117,6 +118,7 @@ _COMMAND_HANDLERS = {
     "last": handle_last,
     "login": handle_login,
     "logout": handle_logout,
+    "memory": handle_memory,
     "next": handle_next,
     "notify": handle_notify,
     "repair": handle_repair,
@@ -185,7 +187,8 @@ def _print_help(use_color=False):
         f"  {_style('cdx runs [--limit N] --json', '36', use_color)}",
         f"  {_style('cdx run-status <run_id> --json', '36', use_color)}",
         f"  {_style('cdx run-report <run_id> --json', '36', use_color)}",
-        f"  {_style('cdx context show|path|init|edit|clear|set [text...] [--json]', '36', use_color)}",
+        f"  {_style('cdx context show|path|init|edit|clear|set|append [text...] [--json]', '36', use_color)}",
+        f"  {_style('cdx memory [--global|--project NAME_OR_PATH] [show|view|path|init|edit|clear|set|append|list] [text...] [--json]', '36', use_color)}",
         f"  {_style('cdx disk [profiles] [--candidates] [--json]', '36', use_color)}",
         f"  {_style('cdx config <name> [--json]', '36', use_color)}",
         f"  {_style('cdx configs [--json]', '36', use_color)}",

package/src/cli_args.py

@@ -18,7 +18,8 @@ REPAIR_USAGE = "Usage: cdx repair [--dry-run] [--force] [--json]"
 UPDATE_USAGE = "Usage: cdx update [--check] [--yes] [--json] [--version TAG]"
 EXPORT_USAGE = "Usage: cdx export <file> [--include-auth] [--force] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
 IMPORT_USAGE = "Usage: cdx import <file> [--force|--merge] [--allow-authless-force] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
-CONTEXT_USAGE = "Usage: cdx context show|path|init|edit|clear|set [text...] [--json]"
+CONTEXT_USAGE = "Usage: cdx context show|path|init|edit|clear|set|append [text...] [--json]"
+MEMORY_USAGE = "Usage: cdx memory [--global|--project NAME_OR_PATH] [show|view|path|init|edit|clear|set|append|list] [text...] [--json]"
 HANDOFF_USAGE = "Usage: cdx handoff <name> [--json] | cdx handoff <source> <target> [--json]"
 LABEL_USAGE = "Usage: cdx label <name> <label> [--json] | cdx label <name> --clear [--json]"
 SET_USAGE = "Usage: cdx set <name>|--sessions all|a,b|--provider PROVIDER [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full] [--fast on|off] [--rtk on|off] [--logics on|off] [--model MODEL] [--priority 0..100] [--json]"

package/src/cli_commands.py

@@ -20,6 +20,7 @@ from .cli_args import (
     DOCTOR_USAGE,
     HANDOFF_USAGE,
     LAST_USAGE,
+    MEMORY_USAGE,
     REPAIR_USAGE,
     RESUME_USAGE,
     RUN_REPORT_USAGE,
@@ -77,13 +78,23 @@ from .cli_view import handle_view as handle_view  # re-export for cli.py / tests
 from .codex_usage import consume_codex_rate_limit_reset_credit
 from .config import PROVIDER_ANTIGRAVITY, PROVIDER_CLAUDE, PROVIDER_CODEX, PROVIDER_OLLAMA
 from .context_store import (
+    append_context,
+    append_context_path,
     clear_context,
+    clear_context_path,
     edit_context,
+    edit_context_path,
     get_context_path,
+    get_global_context_path,
+    get_named_project_context_path,
     init_context,
+    init_context_path,
     install_context_for_session,
+    list_named_project_contexts,
     read_context,
+    read_context_path,
     write_context,
+    write_context_path,
 )
 from .errors import CdxError
 from .fs_utils import atomic_write
@@ -2038,9 +2049,228 @@ def handle_context(rest, ctx):
         ctx["out"](f"{_success(text, ctx['use_color'])}\n")
         return 0
 
+    if action == "append":
+        note = " ".join(args[1:])
+        if not note.strip():
+            raise CdxError("Usage: cdx context append <text> [--json]")
+        result = append_context(base_dir, note, cwd)
+        if json_flag:
+            _write_json(ctx, _json_success("context.append", "Appended shared context", context=result))
+            return 0
+        text = f"Appended shared context: {result['path']}"
+        ctx["out"](f"{_success(text, ctx['use_color'])}\n")
+        return 0
+
     raise CdxError(CONTEXT_USAGE)
 
 
+def _parse_memory_args(rest):
+    json_flag, args = _parse_json_flag(rest)
+    scope = "current"
+    project = None
+    cleaned = []
+    index = 0
+    while index < len(args):
+        arg = args[index]
+        if arg == "--global":
+            if scope != "current":
+                raise CdxError(MEMORY_USAGE)
+            scope = "global"
+            index += 1
+            continue
+        if arg == "--project":
+            if scope != "current" or index + 1 >= len(args) or not args[index + 1].strip():
+                raise CdxError(MEMORY_USAGE)
+            scope = "project"
+            project = args[index + 1].strip()
+            index += 2
+            continue
+        if arg.startswith("--project="):
+            if scope != "current":
+                raise CdxError(MEMORY_USAGE)
+            project = arg.split("=", 1)[1].strip()
+            if not project:
+                raise CdxError(MEMORY_USAGE)
+            scope = "project"
+            index += 1
+            continue
+        cleaned.append(arg)
+        index += 1
+    if not cleaned:
+        cleaned = ["show"]
+    if cleaned[0] == "view":
+        cleaned[0] = "show"
+    return json_flag, scope, project, cleaned
+
+
+def _memory_target(base_dir, cwd, scope, project):
+    if scope == "global":
+        return {"scope": "global", "path": get_global_context_path(base_dir)}
+    if scope == "project":
+        if os.path.exists(project):
+            return {
+                "scope": "project",
+                "project": project,
+                "project_kind": "path",
+                "path": get_context_path(base_dir, project),
+            }
+        return {
+            "scope": "project",
+            "project": project,
+            "project_kind": "name",
+            "path": get_named_project_context_path(base_dir, project),
+        }
+    return {"scope": "current", "path": get_context_path(base_dir, cwd)}
+
+
+def _memory_payload(target, content=None):
+    payload = {
+        "scope": target["scope"],
+        "path": target["path"],
+        "exists": os.path.isfile(target["path"]),
+    }
+    if target.get("project") is not None:
+        payload["project"] = target["project"]
+        payload["project_kind"] = target.get("project_kind")
+    if payload["exists"]:
+        payload["bytes"] = os.path.getsize(target["path"])
+    if content is not None:
+        payload["content"] = content
+    return payload
+
+
+def _list_memory_entries(base_dir, cwd):
+    entries = []
+    global_path = get_global_context_path(base_dir)
+    if os.path.isfile(global_path):
+        entries.append({"scope": "global", "path": global_path, "bytes": os.path.getsize(global_path)})
+    entries.extend(list_named_project_contexts(base_dir))
+    current_path = get_context_path(base_dir, cwd)
+    if os.path.isfile(current_path):
+        entries.append({"scope": "current", "path": current_path, "bytes": os.path.getsize(current_path)})
+    return entries
+
+
+def handle_memory(rest, ctx):
+    json_flag, scope, project, args = _parse_memory_args(rest)
+    action = args[0]
+    base_dir = ctx["service"]["base_dir"]
+    cwd = ctx.get("cwd")
+
+    if action == "list":
+        if len(args) != 1 or scope != "current":
+            raise CdxError(MEMORY_USAGE)
+        entries = _list_memory_entries(base_dir, cwd)
+        if json_flag:
+            _write_json(ctx, _json_success("memory.list", "Listed memory scopes", memories=entries))
+            return 0
+        if not entries:
+            ctx["out"](f"{_dim('No cdx memory files found.', ctx['use_color'])}\n")
+            return 0
+        rows = [["SCOPE", "PROJECT", "SIZE", "PATH"]]
+        for entry in entries:
+            rows.append([
+                entry["scope"],
+                entry.get("project") or "-",
+                _format_bytes(entry.get("bytes") or 0),
+                entry["path"],
+            ])
+        ctx["out"](_pad_table(rows) + "\n")
+        return 0
+
+    target = _memory_target(base_dir, cwd, scope, project)
+    path = target["path"]
+
+    if action == "show":
+        if len(args) != 1:
+            raise CdxError(MEMORY_USAGE)
+        content = read_context_path(path)
+        payload = _memory_payload(target, content=content)
+        if json_flag:
+            _write_json(ctx, _json_success("memory.show", "Loaded memory", memory=payload))
+            return 0
+        if content.strip():
+            ctx["out"](content if content.endswith("\n") else f"{content}\n")
+        else:
+            ctx["out"](f"{_dim('No memory for this scope. Run: cdx memory append <text>', ctx['use_color'])}\n")
+        return 0
+
+    if action == "path":
+        if len(args) != 1:
+            raise CdxError(MEMORY_USAGE)
+        if json_flag:
+            _write_json(ctx, _json_success("memory.path", "Resolved memory path", memory=_memory_payload(target)))
+            return 0
+        ctx["out"](f"{path}\n")
+        return 0
+
+    if action == "init":
+        if len(args) != 1:
+            raise CdxError(MEMORY_USAGE)
+        result = init_context_path(path)
+        result = {**result, **{key: value for key, value in target.items() if key != "path"}}
+        message = "Created memory" if result.get("created") else "Memory already exists"
+        if json_flag:
+            _write_json(ctx, _json_success("memory.init", message, memory=result))
+            return 0
+        ctx["out"](f"{_success(f'{message}: {path}', ctx['use_color'])}\n")
+        return 0
+
+    if action == "edit":
+        if len(args) != 1:
+            raise CdxError(MEMORY_USAGE)
+        result = edit_context_path(path, env=ctx.get("env"), spawn_sync=ctx.get("spawn_sync"))
+        result = {**result, **{key: value for key, value in target.items() if key != "path"}}
+        if json_flag:
+            _write_json(ctx, _json_success("memory.edit", "Edited memory", memory=result))
+            return 0
+        ctx["out"](f"{_success(f'Edited memory: {path}', ctx['use_color'])}\n")
+        return 0
+
+    if action == "clear":
+        if len(args) != 1:
+            raise CdxError(MEMORY_USAGE)
+        result = clear_context_path(path)
+        result = {**result, **{key: value for key, value in target.items() if key != "path"}}
+        message = "Cleared memory" if result["removed"] else "No memory to clear"
+        if json_flag:
+            _write_json(ctx, _json_success("memory.clear", message, memory=result))
+            return 0
+        ctx["out"](f"{_success(message, ctx['use_color'])}\n")
+        return 0
+
+    if action == "set":
+        content_args = args[1:]
+        if content_args:
+            content = " ".join(content_args)
+        else:
+            stdin = ctx["options"].get("stdin_data")
+            if stdin is None and not ctx.get("stdin_is_tty"):
+                stdin = sys.stdin.read()
+            if stdin is None:
+                raise CdxError("Usage: cdx memory set <text> [--json]")
+            content = stdin
+        result = write_context_path(path, content)
+        result = {**result, **{key: value for key, value in target.items() if key != "path"}}
+        if json_flag:
+            _write_json(ctx, _json_success("memory.set", "Saved memory", memory=result))
+            return 0
+        ctx["out"](f"{_success(f'Saved memory: {path}', ctx['use_color'])}\n")
+        return 0
+
+    if action == "append":
+        note = " ".join(args[1:])
+        result = append_context_path(path, note)
+        result = {**result, **{key: value for key, value in target.items() if key != "path"}}
+        if json_flag:
+            _write_json(ctx, _json_success("memory.append", "Appended memory", memory=result))
+            return 0
+        ctx["out"](f"{_success(f'Appended memory: {path}', ctx['use_color'])}\n")
+        return 0
+
+    raise CdxError(MEMORY_USAGE)
+
+
 def handle_status(rest, ctx):
     parsed = _parse_flag_args(rest, {
         "--json": {"key": "json", "type": "bool", "default": False},

package/src/context_store.py

@@ -3,6 +3,7 @@ import os
 import shlex
 import subprocess
 from datetime import datetime
+from urllib.parse import quote, unquote
 
 from .errors import CdxError
 from .fs_utils import atomic_write
@@ -42,12 +43,43 @@ def get_context_path(base_dir, cwd=None):
     return os.path.join(_context_dir(base_dir, cwd), "context.md")
 
 
+def get_global_context_path(base_dir):
+    return os.path.join(base_dir, "contexts", "global", "context.md")
+
+
+def get_named_project_context_path(base_dir, project):
+    return os.path.join(base_dir, "contexts", "projects", quote(project, safe=""), "context.md")
+
+
+def list_named_project_contexts(base_dir):
+    root = os.path.join(base_dir, "contexts", "projects")
+    try:
+        names = sorted(os.listdir(root))
+    except FileNotFoundError:
+        return []
+    rows = []
+    for name in names:
+        path = os.path.join(root, name, "context.md")
+        if not os.path.isfile(path):
+            continue
+        rows.append({
+            "scope": "project",
+            "project": unquote(name),
+            "path": path,
+            "bytes": os.path.getsize(path),
+        })
+    return rows
+
+
 def get_context_meta_path(base_dir, cwd=None):
     return os.path.join(_context_dir(base_dir, cwd), "meta.json")
 
 
 def read_context(base_dir, cwd=None):
-    path = get_context_path(base_dir, cwd)
+    return read_context_path(get_context_path(base_dir, cwd))
+
+
+def read_context_path(path):
     try:
         with open(path, encoding="utf-8") as handle:
             return handle.read()
@@ -56,7 +88,10 @@ def read_context(base_dir, cwd=None):
 
 
 def write_context(base_dir, content, cwd=None):
-    path = get_context_path(base_dir, cwd)
+    return write_context_path(get_context_path(base_dir, cwd), content)
+
+
+def write_context_path(path, content):
     _ensure_dir(os.path.dirname(path))
     atomic_write(path, content.rstrip() + "\n", mode=0o644)
     return {
@@ -66,20 +101,40 @@ def write_context(base_dir, content, cwd=None):
     }
 
 
+def append_context(base_dir, note, cwd=None):
+    return append_context_path(get_context_path(base_dir, cwd), note)
+
+
+def append_context_path(path, note):
+    note = str(note or "").strip()
+    if not note:
+        raise CdxError("Memory append requires text.")
+    current = read_context_path(path).rstrip()
+    content = f"{current}\n{note}" if current else note
+    return write_context_path(path, content)
+
+
 def init_context(base_dir, cwd=None):
-    current = read_context(base_dir, cwd)
+    return init_context_path(get_context_path(base_dir, cwd))
+
+
+def init_context_path(path):
+    current = read_context_path(path)
     if current.strip():
         return {
-            "path": get_context_path(base_dir, cwd),
+            "path": path,
             "created": False,
             "bytes": len(current.encode("utf-8")),
         }
-    result = write_context(base_dir, DEFAULT_CONTEXT_TEMPLATE, cwd)
+    result = write_context_path(path, DEFAULT_CONTEXT_TEMPLATE)
     return {**result, "created": True}
 
 
 def clear_context(base_dir, cwd=None):
-    path = get_context_path(base_dir, cwd)
+    return clear_context_path(get_context_path(base_dir, cwd))
+
+
+def clear_context_path(path):
     try:
         os.remove(path)
         removed = True
@@ -89,7 +144,11 @@ def clear_context(base_dir, cwd=None):
 
 
 def edit_context(base_dir, cwd=None, editor=None, env=None, spawn_sync=None):
-    result = init_context(base_dir, cwd)
+    return edit_context_path(get_context_path(base_dir, cwd), editor=editor, env=env, spawn_sync=spawn_sync)
+
+
+def edit_context_path(path, editor=None, env=None, spawn_sync=None):
+    result = init_context_path(path)
     path = result["path"]
     env = env or os.environ
     editor = editor or env.get("VISUAL") or env.get("EDITOR")

package/src/health.py

@@ -1,13 +1,17 @@
 import json
 import os
+import re
 import shutil
+import subprocess
 import sys
 import tempfile
+from datetime import datetime, timezone
 from urllib.parse import quote, unquote
 
 from .cli_render import _pad_table, _style
 from .config import PROVIDER_CODEX
 from .provider_runtime import codex_auth_diagnostic
+from .status_source import _extract_account_identity
 
 
 def _encode(name):
@@ -40,6 +44,8 @@ def collect_health_report(service, base_dir, env=None, spawn_sync=None):
         path = shutil.which(command, path=env.get("PATH"))
         status = "OK" if path else "WARN"
         issues.append(_issue(status, f"{command}_cli", f"{command} CLI {'found' if path else 'not found'}", path))
+        if path:
+            issues.append(_provider_cli_version_issue(command, path, env, spawn_sync))
 
     rtk_path = shutil.which("rtk", path=env.get("PATH"))
     issues.append(_issue(
@@ -73,6 +79,7 @@ def collect_health_report(service, base_dir, env=None, spawn_sync=None):
     issues.append(_check_cdx_home(base_dir))
     sessions = service["list_sessions"]()
     session_names = {session["name"] for session in sessions}
+    codex_diagnostics = []
     for session in sessions:
         name = session["name"]
         root = session.get("sessionRoot") or service["get_session_root"](name)
@@ -82,16 +89,79 @@ def collect_health_report(service, base_dir, env=None, spawn_sync=None):
         if not os.path.isfile(state_path):
             issues.append(_issue("FAIL", "missing_state", f"session {name} state file is missing", state_path, True))
         if session.get("provider") == PROVIDER_CODEX:
-            issues.extend(_codex_auth_issues(session, spawn_sync=spawn_sync, env=env))
+            diag = codex_auth_diagnostic(session, spawn_sync=spawn_sync, env_override=env)
+            diag["observed_account"] = _recent_codex_observed_account(diag.get("auth_home"))
+            codex_diagnostics.append((session, diag))
+            issues.extend(_codex_auth_issues(session, diag))
 
+    issues.extend(_codex_shared_account_id_issues(codex_diagnostics))
     issues.extend(_collect_profile_issues(base_dir, session_names))
     return {"base_dir": base_dir, "issues": issues, "summary": summarize_health(issues)}
 
 
-def _codex_auth_issues(session, spawn_sync=None, env=None):
+def _provider_cli_version_issue(command, path, env, spawn_sync=None):
+    result = _run_version_command(command, env, spawn_sync)
+    raw = (result.get("stdout") or result.get("stderr") or "").strip()
+    version = _extract_version(raw)
+    detail = {
+        "command": command,
+        "path": path,
+        "version": version,
+        "raw": raw,
+        "capabilities": _provider_capability_hints(command),
+    }
+    if version:
+        return _issue("OK", f"{command}_cli_version", f"{command} CLI version detected: {version}", detail)
+    return _issue("WARN", f"{command}_cli_version", f"{command} CLI version could not be detected", detail)
+
+
+def _run_version_command(command, env, spawn_sync=None):
+    try:
+        if spawn_sync:
+            result = spawn_sync(command, ["--version"], {"env": env, "timeout": 5})
+            if isinstance(result, dict):
+                return result
+            return {
+                "stdout": getattr(result, "stdout", "") or "",
+                "stderr": getattr(result, "stderr", "") or "",
+            }
+        completed = subprocess.run(
+            [command, "--version"],
+            env=env,
+            capture_output=True,
+            text=True,
+            timeout=5,
+            check=False,
+        )
+        return {"stdout": completed.stdout or "", "stderr": completed.stderr or ""}
+    except (OSError, subprocess.TimeoutExpired):
+        return {"stdout": "", "stderr": ""}
+
+
+def _extract_version(text):
+    match = re.search(r"\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b", text or "")
+    return match.group(1) if match else None
+
+
+def _provider_capability_hints(command):
+    if command == "codex":
+        return [
+            "version_inventory",
+            "provider_memory_import_surfaces_may_exist_in_recent_codex",
+            "provider_memory_is_not_modified_by_cdx_memory",
+        ]
+    if command == "claude":
+        return [
+            "version_inventory",
+            "project_memory_and_stream_json_diagnostics_may_exist_in_recent_claude_code",
+            "provider_memory_is_not_modified_by_cdx_memory",
+        ]
+    return ["version_inventory"]
+
+
+def _codex_auth_issues(session, diag):
     name = session["name"]
-    diag = codex_auth_diagnostic(session, spawn_sync=spawn_sync, env_override=env)
-    identity = diag.get("account_email") or "unknown account"
+    identity = diag.get("account_email") or diag.get("observed_account") or "unknown account"
     issues = [
         _issue(
             "OK" if diag.get("auth_json_exists") else "WARN",
@@ -103,6 +173,8 @@ def _codex_auth_issues(session, spawn_sync=None, env=None):
                 "auth_json_exists": diag.get("auth_json_exists"),
                 "local_tokens_present": diag.get("local_tokens_present"),
                 "account_email": diag.get("account_email"),
+                "observed_account": diag.get("observed_account"),
+                "account_id": _mask_identifier(diag.get("account_id")),
             },
         )
     ]
@@ -120,9 +192,126 @@ def _codex_auth_issues(session, spawn_sync=None, env=None):
             "live_error": diag.get("live_error"),
         },
     ))
+    stale_auth = _recent_codex_auth_error(diag.get("auth_home"))
+    if stale_auth:
+        issues.append(_issue(
+            "WARN",
+            "codex_stale_auth_logs",
+            f"session {name} recent Codex logs mention expired auth; run cdx login {name} if disconnects continue",
+            {
+                "session": name,
+                "auth_home": diag.get("auth_home"),
+                "source": stale_auth["source"],
+                "mtime": stale_auth["mtime"],
+                "markers": stale_auth["markers"],
+            },
+        ))
+    return issues
+
+
+def _codex_shared_account_id_issues(codex_diagnostics):
+    by_account_id = {}
+    for session, diag in codex_diagnostics:
+        account_id = diag.get("account_id")
+        if account_id:
+            by_account_id.setdefault(account_id, []).append((session, diag))
+
+    issues = []
+    for account_id, rows in sorted(by_account_id.items()):
+        if len(rows) < 2:
+            continue
+        identities = sorted({
+            _identity_user_part(diag.get("account_email") or diag.get("observed_account"))
+            for _session, diag in rows
+            if _identity_user_part(diag.get("account_email") or diag.get("observed_account"))
+        })
+        sessions = [session["name"] for session, _diag in rows]
+        status = "OK" if len(identities) > 1 else "WARN"
+        message = (
+            "Codex profiles share a Business account_id but observed different users; account_id is not a user identity"
+            if status == "OK"
+            else "Codex profiles share account_id; on Business plans this may be a workspace id, not proof of duplicate user auth"
+        )
+        issues.append(_issue(
+            status,
+            "codex_shared_account_id",
+            message,
+            {
+                "sessions": sessions,
+                "account_id": _mask_identifier(account_id),
+                "observed_identities": identities,
+            },
+        ))
     return issues
 
 
+def _identity_user_part(value):
+    if not value:
+        return None
+    return str(value).strip().lower().split()[0].split("(", 1)[0]
+
+
+def _mask_identifier(value):
+    if not value:
+        return None
+    text = str(value)
+    return text if len(text) <= 8 else f"{text[:6]}...{text[-4:]}"
+
+
+def _recent_codex_observed_account(auth_home):
+    for path in _recent_codex_log_paths(auth_home):
+        text = _read_tail(path)
+        account = _extract_account_identity(text)
+        if account:
+            return account
+    return None
+
+
+def _recent_codex_auth_error(auth_home):
+    markers = ("token_expired", "authentication token is expired", "http 401")
+    for path in _recent_codex_log_paths(auth_home):
+        text = _read_tail(path).lower()
+        found = [marker for marker in markers if marker in text]
+        if found:
+            try:
+                mtime = datetime.fromtimestamp(os.path.getmtime(path), timezone.utc).isoformat().replace("+00:00", "Z")
+            except OSError:
+                mtime = None
+            return {"source": path, "mtime": mtime, "markers": found}
+    return None
+
+
+def _recent_codex_log_paths(auth_home):
+    if not auth_home:
+        return []
+    candidates = []
+    for root in (os.path.join(auth_home, "log"), os.path.join(auth_home, "sessions")):
+        if not os.path.isdir(root):
+            continue
+        for dirpath, dirnames, filenames in os.walk(root):
+            dirnames[:] = [name for name in dirnames if name not in {"cache", "plugins", "skills", "sqlite"}]
+            for filename in filenames:
+                if filename.endswith((".log", ".jsonl")):
+                    path = os.path.join(dirpath, filename)
+                    try:
+                        stat = os.stat(path)
+                    except OSError:
+                        continue
+                    candidates.append((stat.st_mtime, path))
+    return [path for _mtime, path in sorted(candidates, reverse=True)[:16]]
+
+
+def _read_tail(path, max_bytes=128 * 1024):
+    try:
+        with open(path, "rb") as handle:
+            handle.seek(0, os.SEEK_END)
+            size = handle.tell()
+            handle.seek(max(0, size - max_bytes))
+            return handle.read().decode("utf-8", errors="replace")
+    except OSError:
+        return ""
+
+
 def _check_cdx_home(base_dir):
     try:
         os.makedirs(base_dir, exist_ok=True)

package/src/provider_runtime.py

@@ -166,6 +166,19 @@ def _read_codex_account_email(auth_home):
     return None
 
 
+def _read_codex_account_id(auth_home):
+    try:
+        with open(os.path.join(auth_home, "auth.json"), encoding="utf-8") as handle:
+            auth = json.load(handle)
+    except (FileNotFoundError, OSError, json.JSONDecodeError):
+        return None
+    tokens = auth.get("tokens") if isinstance(auth, dict) else {}
+    account_id = tokens.get("account_id") if isinstance(tokens, dict) else None
+    if not account_id:
+        return None
+    return str(account_id).strip() or None
+
+
 def codex_auth_diagnostic(session, spawn_sync=None, env_override=None):
     auth_home = _get_auth_home(session)
     auth_path = os.path.join(auth_home, "auth.json")
@@ -174,6 +187,7 @@ def codex_auth_diagnostic(session, spawn_sync=None, env_override=None):
         "auth_json_exists": os.path.isfile(auth_path),
         "local_tokens_present": _has_local_codex_auth(auth_home),
         "account_email": _read_codex_account_email(auth_home),
+        "account_id": _read_codex_account_id(auth_home),
         "live_status": "unknown",
         "live_error": None,
     }

package/src/session_service.py

@@ -44,6 +44,7 @@ RESERVED_SESSION_NAMES = {
     "label",
     "login",
     "logout",
+    "memory",
     "model",
     "mv",
     "next",