cdx-manager 0.20.3 → 0.20.4

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.20.3-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.20.4-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Stop guessing which AI account still has quota.** `cdx` tracks the rate-limit window of every Codex and Claude account you own, tells you which one is usable right now, and launches it with isolated auth — in one command.
 
@@ -500,6 +500,7 @@ cdx history --summary --from 2026-05-01 --to 2026-05-28
 | `cdx label <name> --clear [--json]` | Clear a session label |
 | `cdx login <name> [--json]` | Re-authenticate a session (logout + login) |
 | `cdx logout <name> [--json]` | Log out of a session |
+| `cdx auth refresh <name\|all> [--json]` | Make a locked, non-generation Codex auth probe; reports `login_required` when interactive login is needed |
 | `cdx disable <name> [--json]` | Disable a session without deleting it; disabled sessions stay visible and cannot launch |
 | `cdx enable <name> [--json]` | Re-enable a disabled session |
 | `cdx config <name> [--json]` | Show persistent launch settings for a session |
@@ -1077,6 +1078,24 @@ Without `--yes`, an interactive confirmation is required. `cdx` sends an idempot
 
 ## Troubleshooting
 
+### Codex credential refresh
+
+`cdx auth refresh work` makes a provider-native, non-generation request for one
+managed Codex profile. It can refresh an expiring access token, but never starts
+an agent or submits a prompt. Use `cdx auth refresh all --json` when a scheduler
+needs a stable result; CDX never installs or enables that scheduler for you.
+
+For example, a user-owned daily cron entry can run:
+
+```sh
+0 6 * * * cdx auth refresh all --json
+```
+
+`locked` means an interactive session owns the profile refresh lock and was left
+untouched. `login_required` means the provider rejected the local refresh token;
+run the supplied `cdx login <name>` command interactively. Hosts keep independent
+rotating credentials, so copying an auth file is not ongoing credential sync.
+
 - **`cdx <name>` fails with "not authenticated"** — run `cdx login <name>` first.
 - **One of two Codex accounts keeps asking for login** — run `cdx doctor --json` and inspect each Codex session's `codex_auth_file`, `codex_live_auth`, and `codex_stale_auth_logs` checks. If recent logs mention expired auth, repair only that isolated profile with `cdx login <name>`. Codex Business profiles can share the same `tokens.account_id`; `cdx doctor` reports `codex_shared_account_id` as a workspace-level clue, not proof that two profiles use the same user. Newly created sessions seed from the current global `~/.codex/auth.json` when one exists. For two separate Codex accounts, create or repair each session by running `cdx login <name>` for that session; `cdx login` does not log out first, so use `cdx logout <name>` explicitly only when you want to clear that isolated profile.
 - **`cdx` says no compatible Python 3 interpreter was found** — install Python 3 and make `py -3`, `python`, or `python3` available on PATH.

package/VERSION

@@ -1 +1 @@
-0.20.3
+0.20.4

package/changelogs/CHANGELOGS_0_20_4.md

@@ -0,0 +1,12 @@
+# CDX Manager 0.20.4
+
+## Authentication
+
+- Added `cdx auth refresh <name|all> [--json]`, a locked, no-generation Codex
+  authentication probe. It can refresh an active provider session when the
+  upstream CLI supports it, but never opens a browser, prompts for credentials,
+  or fabricates a token.
+- The result distinguishes `valid`, `locked`, `login_required`, and `failed`
+  without exposing credential material.
+- Documented manual use and an opt-in cron example. CDX never installs or
+  enables a scheduler on its own.

package/checksums/release-archives.json

@@ -342,6 +342,17 @@
         "x86_64-pc-windows-msvc": "5ceff82ecd907fda949dfc27835112ad9e3597da78191a0ede4f7d9db82607a8",
         "x86_64-unknown-linux-musl": "db70bb77f08fd954a7378561954d00ad3084b4ada99a4930aa8f021978439e65"
       }
+    },
+    "v0.20.3": {
+      "github_tarball_sha256": "40990d89ea7130452a95b6cf6a3a63c804f36f08250cf3c325ce7fb63601f875",
+      "github_zip_sha256": "be334f6b23145a61d936d50d9609d6a9e6ba2e0749233aede0ed9ce8ff20df8e",
+      "tray_assets": {
+        "aarch64-apple-darwin": "5ec913f779c11df19aab1f09e8c68dcb4ec54d4a66b3dfbda43d73d67c597797",
+        "aarch64-unknown-linux-musl": "d59f41e9521175e22200b38638896d76c2d27f538e52a1f123e1dfdd6521cf4a",
+        "x86_64-apple-darwin": "1ec60ca652a18f3991b5d42c64cdf090eb19a658a88005d82642cb6ea9b6455e",
+        "x86_64-pc-windows-msvc": "1f9971c1aee7e92685370db1e6a4bcf37b6012fa7452fc14ca3dd545998af82e",
+        "x86_64-unknown-linux-musl": "2aabbc00b0fa3a2c8862cc1a5425a074fec99f072bf7b695d31e6e96b9b08c5d"
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.20.3",
+  "version": "0.20.4",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.20.3"
+version = "0.20.4"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/cli.py

@@ -13,6 +13,7 @@ from .cli_commands import (
     _directory_child_sizes,
     _directory_size_bytes,
     handle_add,
+    handle_auth,
     handle_can_resume,
     handle_clean,
     handle_config,
@@ -151,6 +152,7 @@ __all__ = [
 
 
 _COMMAND_HANDLERS = {
+    "auth": handle_auth,
     "add": handle_add,
     "cp": handle_copy,
     "clean": handle_clean,
@@ -236,6 +238,7 @@ def _print_help(use_color=False):
         f"  {_style('cdx status <name> [--json] [--refresh|--cached] [--timeout SECONDS]', '36', use_color)}",
         f"  {_style('cdx next [--json] [--refresh]', '36', use_color)}",
         f"  {_style('cdx reset <name> [--yes] [--json]', '36', use_color)}",
+        f"  {_style('cdx auth refresh <name|all> [--json]', '36', use_color)}",
         f"  {_style('cdx select --provider PROVIDER [--min-reasoning-effort minimal|low|medium|high|xhigh] [--min-power minimal|low|medium|high|xhigh] [--require-ready] [--refresh] --json', '36', use_color)}",
         f"  {_style('cdx run [session] --cwd PATH (--prompt-file PATH|--prompt TEXT|--prompt-file -) [--provider PROVIDER] [--model MODEL] [--kind assistant|code-review] [--reasoning-effort minimal|low|medium|high|xhigh] [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full|workspace-write|read-only|danger-full-access] [--timeout-seconds N] [--detach] [--refresh] --json', '36', use_color)}",
         f"  {_style('cdx runs [--limit N] [--since 7d|today|DATE] --json', '36', use_color)}",

package/src/cli_args.py

@@ -25,6 +25,7 @@ DOCTOR_USAGE = "Usage: cdx doctor [--severity OK|WARN|FAIL[,OK|WARN|FAIL...]] [-
 DISK_USAGE = "Usage: cdx disk [profiles] [--candidates] [--json]"
 REPAIR_USAGE = "Usage: cdx repair [--dry-run] [--force] [--json]"
 UPDATE_USAGE = "Usage: cdx update [all] [--check] [--yes] [--json] [--version TAG]"
+AUTH_USAGE = "Usage: cdx auth refresh <name|all> [--json]"
 EXPORT_USAGE = "Usage: cdx export <file> [--include-auth] [--force] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
 IMPORT_USAGE = "Usage: cdx import <file> [--force|--merge] [--allow-authless-force] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
 CONTEXT_USAGE = "Usage: cdx context show|path|init|edit|clear|set|append [text...] [--json]"
@@ -909,6 +910,18 @@ def _parse_update_args(args):
     return parsed
 
 
+def _parse_auth_args(args):
+    parsed = _parse_flag_args(args, {
+        "--json": {"key": "json", "type": "bool", "default": False},
+    }, AUTH_USAGE, positionals_key="values", max_positionals=2)
+    if len(parsed["values"]) != 2 or parsed["values"][0] != "refresh":
+        raise CdxError(AUTH_USAGE)
+    target = parsed["values"][1]
+    if not target.strip():
+        raise CdxError(AUTH_USAGE)
+    return {"target": target, "json": parsed["json"]}
+
+
 def _parse_export_args(args):
     parsed = _parse_flag_args(args, {
         "--include-auth": {"key": "include_auth", "type": "bool", "default": False},

package/src/cli_commands.py

@@ -41,6 +41,9 @@ from .cli_view import handle_view as handle_view  # re-export for cli.py / tests
 from .commands.auth import (  # re-export for cli.py / tests
     _confirm_reset as _confirm_reset,
 )
+from .commands.auth import (
+    handle_auth as handle_auth,
+)
 from .commands.auth import (
     handle_login as handle_login,
 )
@@ -276,4 +279,3 @@ from .commands.tray import (
     handle_tray as handle_tray,
 )
 
-

package/src/commands/auth.py

@@ -3,12 +3,14 @@
 Split out of cli_commands.py. Moved verbatim; re-exported by cli_commands.
 """
 
+import json
 import time
 import uuid
 
-from ..cli_args import _parse_flag_args, _parse_json_flag
+from ..cli_args import _parse_auth_args, _parse_flag_args, _parse_json_flag
 from ..cli_helpers import (
     _bootstrap_claude_setup_token,
+    _json_failure,
     _json_success,
     _local_now_iso,
     _make_notify_progress,
@@ -16,7 +18,7 @@ from ..cli_helpers import (
     _write_json,
 )
 from ..cli_render import _success, _warn
-from ..codex_usage import consume_codex_rate_limit_reset_credit
+from ..codex_usage import consume_codex_rate_limit_reset_credit, fetch_codex_rate_limit_diagnostic
 from ..config import PROVIDER_ANTIGRAVITY, PROVIDER_CLAUDE, PROVIDER_CODEX, PROVIDER_OLLAMA
 from ..errors import CdxError
 from ..notify import (
@@ -33,6 +35,61 @@ def _confirm_reset(name):
     answer = input(f"Consume one banked Codex reset for {name}? [y/N] ")
     return answer.strip().lower() in ("y", "yes")
 
+
+def _refresh_needs_login(diagnostic):
+    """Classify known provider auth failures without returning provider text."""
+    text = json.dumps(diagnostic.get("response") or {}).lower()
+    return any(marker in text for marker in (
+        "not logged in", "unauthorized", "authentication token is expired",
+        "token_expired", "invalid_grant", "http 401",
+    ))
+
+
+def _refresh_result(session, diagnostic):
+    if diagnostic.get("ok"):
+        return {"session": session["name"], "provider": PROVIDER_CODEX, "outcome": "valid"}
+    if diagnostic.get("reason") == "auth_locked":
+        return {"session": session["name"], "provider": PROVIDER_CODEX, "outcome": "locked"}
+    if _refresh_needs_login(diagnostic):
+        return {
+            "session": session["name"], "provider": PROVIDER_CODEX,
+            "outcome": "login_required", "login_command": f"cdx login {session['name']}",
+        }
+    return {"session": session["name"], "provider": PROVIDER_CODEX, "outcome": "failed"}
+
+
+def handle_auth(rest, ctx):
+    parsed = _parse_auth_args(rest)
+    target = parsed["target"]
+    if target == "all":
+        sessions = [session for session in ctx["service"]["list_sessions"]()
+                    if session["provider"] == PROVIDER_CODEX]
+    else:
+        session = ctx["service"]["get_session"](target)
+        if not session:
+            raise CdxError(f"Unknown session: {target}")
+        if session["provider"] != PROVIDER_CODEX:
+            raise CdxError("Authentication refresh is only available for Codex sessions.")
+        sessions = [session]
+    if not sessions:
+        raise CdxError("No managed Codex sessions to refresh.")
+
+    probe = ctx["options"].get("fetchCodexRateLimitDiagnostic") or fetch_codex_rate_limit_diagnostic
+    results = [_refresh_result(session, probe(session)) for session in sessions]
+    failures = [result for result in results if result["outcome"] in ("login_required", "failed")]
+    message = "Codex authentication probe completed" if not failures else "Codex authentication probe needs attention"
+    if parsed["json"]:
+        payload = (
+            _json_failure("auth.refresh", "auth_refresh_failed", message, results=results)
+            if failures else _json_success("auth.refresh", message, results=results)
+        )
+        _write_json(ctx, payload)
+    else:
+        for result in results:
+            suffix = f"; run {result['login_command']}" if result.get("login_command") else ""
+            ctx["out"](f"{result['session']}: {result['outcome']}{suffix}\n")
+    return 1 if failures else 0
+
 def handle_ready(rest, ctx):
     """`cdx ready`: schedule an OS notification for the next session to come back.