cdx-manager 0.20.0 → 0.20.1

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.20.0-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.20.1-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Stop guessing which AI account still has quota.** `cdx` tracks the rate-limit window of every Codex and Claude account you own, tells you which one is usable right now, and launches it with isolated auth — in one command.
 

package/VERSION

@@ -1 +1 @@
-0.20.0
+0.20.1

package/changelogs/CHANGELOGS_0_20_1.md

@@ -0,0 +1,6 @@
+# CDX Manager 0.20.1
+
+## Fixes
+
+- `cdx status --refresh` no longer reports a false "OAuth access token has expired" alert for a profile that is still logged in. The persisted access token's `expiresAt` is now checked offline before the quota probe runs; once it is known to be expired, the probe is skipped instead of reproducing a predictable 401 (`claude auth status` does not refresh it — only a real Claude Code invocation does). (#11)
+- The stale-quota/local-auth-valid warning path now also recognizes the provider's current `OAuth access token has expired` message, not just the older `invalid authentication credentials` phrasing.

package/checksums/release-archives.json

@@ -309,6 +309,17 @@
         "x86_64-pc-windows-msvc": "c5a29140bb9d634f2533084084ca10cb90ca64d34cac1b664998d305b934a7fb",
         "x86_64-unknown-linux-musl": "d1850f3acdede7c2cdcd31b5ca6d5e2372535a32bf75c0e6c8fd0100af7813f2"
       }
+    },
+    "v0.20.0": {
+      "github_tarball_sha256": "8222afa4f8e5fef0291e180450c1b24fb623a6543104f62bd430d27b2157c75b",
+      "github_zip_sha256": "c09ab617e1af92bf7c3690fe8d21e497cb772ea270eb8b83ea413b1718d978cd",
+      "tray_assets": {
+        "aarch64-apple-darwin": "8b6d93b6d67d2b0119c544beca251b5dcaede56b770fc8bed741c36a2f2d868a",
+        "aarch64-unknown-linux-musl": "f4bb1bd9a8980f403a7d5af9724dfae4b63345323019e212fe257c4689f7480d",
+        "x86_64-apple-darwin": "1e90758238f87c73bf1dadf7d9c3efe2967ab6f65b484d9fd7ed4e3cceae671f",
+        "x86_64-pc-windows-msvc": "e88d296e706ae90624a1f82bf14d36d67787d5f73bbb04986c1ca82293178c68",
+        "x86_64-unknown-linux-musl": "cf8ec3f5a56bf50ba42d2dfa44f05ecc4471c5a5a819ca8b5180c6d9eff75ff1"
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.20.0"
+version = "0.20.1"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/claude_usage.py

@@ -129,6 +129,32 @@ def _parse_reset_epoch(value):
     return parsed.timestamp()
 
 
+CLAUDE_ACCESS_TOKEN_EXPIRY_SKEW_SECONDS = 60
+
+
+def _current_epoch_seconds():
+    return datetime.now(timezone.utc).timestamp()
+
+
+def _parse_epoch_seconds(value):
+    if value in (None, ""):
+        return None
+    try:
+        num = float(value)
+    except (TypeError, ValueError):
+        return _parse_reset_epoch(value)
+    # Claude CLI persists expiresAt in milliseconds since epoch.
+    return num / 1000 if num > 1e12 else num
+
+
+def _access_token_expired(creds, now=None):
+    expires_at = _parse_epoch_seconds(creds.get("expiresAt")) if isinstance(creds, dict) else None
+    if expires_at is None:
+        return False
+    now = _current_epoch_seconds() if now is None else now
+    return now >= expires_at - CLAUDE_ACCESS_TOKEN_EXPIRY_SKEW_SECONDS
+
+
 def _safe_float(value):
     if value is None:
         return None
@@ -241,4 +267,11 @@ def refresh_claude_session_status(session, auth_refresher=None):
     creds = _read_claude_credentials(auth_home)
     if not creds or not creds.get("accessToken"):
         return None
+    if _access_token_expired(creds):
+        # ponytail: `claude auth status` doesn't refresh an expired access
+        # token (verified no-op) and only a real Claude Code invocation does.
+        # Probing anyway just reproduces a 401 we can already predict
+        # offline, so skip it like the "no credentials" case above and leave
+        # the cached quota as stale rather than raising a false alert.
+        return None
     return fetch_claude_rate_limit_headers(creds["accessToken"])

package/src/commands/status.py

@@ -790,7 +790,9 @@ def _rows_by_session(rows):
 
 def _is_invalid_claude_usage_auth(error):
     text = str(error or "").lower()
-    return "http 401" in text and "invalid authentication credentials" in text
+    if "http 401" not in text:
+        return False
+    return "invalid authentication credentials" in text or "oauth access token has expired" in text
 
 def _has_valid_local_claude_auth(item, rows_by_name):
     session = item.get("session")