cdx-manager 0.18.1 → 0.18.2

package/README.md

@@ -1,6 +1,6 @@
 # CDX Manager
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.18.1-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.18.2-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Stop guessing which AI account still has quota.** `cdx` tracks the rate-limit window of every Codex and Claude account you own, tells you which one is usable right now, and launches it with isolated auth — in one command.
 
@@ -560,6 +560,7 @@ They are deliberately hard to become noise. One hint per invocation at most, not
 
 The companion is a native binary distributed as a release asset, not part of the pip package. Its trust model is worth stating plainly rather than leaving you to assume the usual one.
 
+- **Where the checksum comes from.** Releases older than the one you are running are vouched for by `checksums/release-archives.json`, committed to the repository before those assets existed. Your own release is a special case: its tray assets are built after the tag, so no package built at tag time can carry their checksums. For that one version CDX reads the ledger the release publishes beside the assets — the publisher's own assertion over the same channel, which catches a truncated download or a wrong-architecture asset but does not defend against someone who can rewrite the release itself.
 - **The checksum is the vouching, not Apple or Microsoft.** The macOS bundle is signed with a *self-signed* certificate. That signature exists because Apple Silicon refuses to execute unsigned arm64 code at all — it is not a claim that Apple reviewed anything. What actually vouches for the asset is the SHA-256 published in `checksums/release-archives.json`, verified before a single byte is unpacked. An asset with no published checksum is refused rather than installed hopefully.
 - **Install through `cdx tray install`, and no download link is offered.** This is a security property, not a convenience. A file fetched by CDX carries no macOS quarantine attribute and no Windows Mark-of-the-Web, so nothing puts Gatekeeper or SmartScreen between you and a companion you asked for. The same file fetched through a browser would carry both. That is why no direct download URL is published: it would be a worse path wearing the same clothes.
 - **Nothing is silently replaced.** An update downloads, verifies, and *proves the replacement starts* before the working companion is touched. A corrupt asset or one built for the wrong architecture costs an error message, not a tray you can no longer launch. An interrupted update is a named, recoverable state that `cdx tray doctor` reports.

package/changelogs/CHANGELOGS_0_18_2.md

@@ -0,0 +1,43 @@
+# CDX Manager 0.18.2
+
+## Fixes
+
+### `cdx tray install` can install the companion for the release you are running
+
+No release could ever install its own tray companion, and the cause was
+structural rather than a bug. Tray assets are built after the tag exists, so
+their checksums are recorded afterwards — which means a package built at tag
+time ships a checksum ledger that stops at the previous release. Installing
+refused with "No published checksum for … of CDX <this version>".
+
+The release already publishes `release-archives.json` beside the assets. A
+missing local entry now falls through to it.
+
+What that is worth, stated plainly: it is the publisher's own assertion fetched
+over the same HTTPS channel as the asset, so it does not defend against someone
+able to rewrite the release. It does defend against a truncated download and an
+asset built for another architecture, which are the failures that happen. A
+checksum committed to the repository before the asset existed is the stronger
+claim, so a local entry always wins and fetches nothing.
+
+### The PyPI package can start
+
+`pyproject.toml` declared only the root package, so `cdx_manager.commands` was
+absent from every wheel since it was extracted and `pip install cdx-manager`
+produced a CLI that failed at import. setuptools does not warn about a
+subpackage it was never told about: the wheel builds cleanly and breaks on the
+user's machine.
+
+The npm package and the standalone installer were unaffected — both ship the
+source tree wholesale.
+
+A test now asserts every package under `src/` is declared for the wheel.
+
+## Validation
+
+- `npm run lint`
+- `npm test` — 775 Python tests
+- A wheel built from this tree installs into a clean virtualenv and runs
+  `cdx --version` and `cdx tray doctor`
+- `cdx tray install` exercised against a checksum ledger with no entry for the
+  version, which is the shape every shipped package has

package/checksums/release-archives.json

@@ -202,6 +202,17 @@
         "x86_64-pc-windows-msvc": "86e29cbdbcf070aec7fd34e5596343a43f2b5092e634ca094aba96abf1d49884",
         "x86_64-unknown-linux-musl": "36ef879c0e75f3c367ed48f1f5a67e25698ec5a04c70958b48ae0885f87487d8"
       }
+    },
+    "v0.18.1": {
+      "github_tarball_sha256": "260529247233abca840ecba03c2948234425b4fe0d27f2e5c008bdeb89fb0bd5",
+      "github_zip_sha256": "bc14fc2fd27641a56089a023b51427abac854eaf527a17d9bc0571698fb19b9f",
+      "tray_assets": {
+        "aarch64-apple-darwin": "8a1cd7f819d21097d63f8c452479bae7bfbfe3468473c7e8f557043c7b7ab47c",
+        "aarch64-unknown-linux-musl": "a4a757bfc0f048aa24439b675cb9f269d70328a98be88efbe5cc3fea96cbd78d",
+        "x86_64-apple-darwin": "1003b7051d6dfbf1a19c1e82eca1c648d11363171a77ad0cd85822a167921573",
+        "x86_64-pc-windows-msvc": "738eeb165c1c2fde58bd952cdc0a59561ca96856a3fb8d0cffc024bfb78b9ca6",
+        "x86_64-unknown-linux-musl": "0b3c02b007aa0655a5b95c7794eba49a37bdb9868c447bb0cfbdfbd9d371d094"
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.18.1"
+version = "0.18.2"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -45,10 +45,17 @@ Changelog = "https://github.com/AlexAgo83/cdx-manager/tree/main/changelogs"
 cdx = "cdx_manager.cli:cli_entry"
 
 [tool.setuptools]
-packages = ["cdx_manager"]
+# Every package under src/, not just the root. Subpackages have to be named
+# explicitly here, and one that is missing is not a build error: the wheel is
+# produced happily and fails at import on the user's machine. src/commands has
+# been absent from every wheel since it was extracted, so `pip install
+# cdx-manager` gave an unusable CLI while the npm and standalone installs — both
+# of which ship the source tree wholesale — worked fine.
+packages = ["cdx_manager", "cdx_manager.commands"]
 
 [tool.setuptools.package-dir]
 cdx_manager = "src"
+"cdx_manager.commands" = "src/commands"
 
 [tool.pytest.ini_options]
 testpaths = ["test"]

package/src/tray_install.py

@@ -60,19 +60,61 @@ def asset_name(version, target):
     return f"cdx-tray-{version}-{target}.tar.gz"
 
 
-def expected_checksum(version, target, ledger_path=CHECKSUM_LEDGER):
+RELEASE_LEDGER_URL = (
+    "https://github.com/AlexAgo83/cdx-manager/releases/download/v{version}/release-archives.json"
+)
+
+
+def _ledger_entry(ledger, version, target):
+    release = (ledger.get("releases") or {}).get(f"v{version}") or {}
+    return (release.get("tray_assets") or {}).get(target)
+
+
+def expected_checksum(version, target, ledger_path=CHECKSUM_LEDGER, download=None):
     """The published sha256 for this asset, or None when none is recorded.
 
     None is a refusal, not a fallback. An asset with no published checksum is
     exactly the case this gate exists for.
+
+    The shipped ledger cannot contain the entry for its own release, and that is
+    structural rather than an oversight: the tray assets are built after the tag
+    exists, so their checksums are recorded afterwards. A package built at tag
+    time therefore ships a ledger that stops at the previous release, and
+    `cdx tray install` would refuse the companion for the very version the user
+    is running.
+
+    So a missing local entry falls through to the ledger the release publishes
+    alongside the assets. Be clear about what that is worth: it is the
+    publisher's own assertion, fetched over the same HTTPS channel as the asset,
+    so it does not defend against someone who can rewrite the release. It does
+    defend against a truncated or corrupted download and against an asset built
+    for another architecture, which are the failures that actually happen. The
+    strong guarantee — a checksum committed before the asset existed — is what
+    the local ledger gives for every release older than this one.
     """
     try:
         with open(ledger_path, encoding="utf-8") as handle:
             ledger = json.load(handle)
     except (OSError, ValueError):
-        return None
-    release = (ledger.get("releases") or {}).get(f"v{version}") or {}
-    return (release.get("tray_assets") or {}).get(target)
+        ledger = {}
+    local = _ledger_entry(ledger, version, target)
+    if local:
+        return local
+    return _published_checksum(version, target, download=download)
+
+
+def _published_checksum(version, target, download=None):
+    """The entry from the ledger attached to the release, or None."""
+    fetch = download or _download
+    with tempfile.TemporaryDirectory(prefix="cdx-tray-ledger-") as scratch:
+        destination = os.path.join(scratch, "release-archives.json")
+        try:
+            fetch(RELEASE_LEDGER_URL.format(version=version), destination)
+            with open(destination, encoding="utf-8") as handle:
+                published = json.load(handle)
+        except (OSError, ValueError):
+            return None
+    return _ledger_entry(published, version, target)
 
 
 def _sha256(path):
@@ -147,7 +189,7 @@ def install(base_dir, version, download=None, ledger_path=CHECKSUM_LEDGER, targe
         raise TrayInstallError(
             f"No tray companion is published for {platform.system()} {platform.machine()}."
         )
-    expected = expected_checksum(version, target, ledger_path=ledger_path)
+    expected = expected_checksum(version, target, ledger_path=ledger_path, download=download)
     if not expected:
         raise TrayInstallError(
             f"No published checksum for the {target} tray companion of CDX {version}. "