cdx-manager 0.20.4 → 0.20.5

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.20.4-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.20.5-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Stop guessing which AI account still has quota.** `cdx` tracks the rate-limit window of every Codex and Claude account you own, tells you which one is usable right now, and launches it with isolated auth — in one command.
 
@@ -1092,11 +1092,15 @@ For example, a user-owned daily cron entry can run:
 ```
 
 `locked` means an interactive session owns the profile refresh lock and was left
-untouched. `login_required` means the provider rejected the local refresh token;
-run the supplied `cdx login <name>` command interactively. Hosts keep independent
-rotating credentials, so copying an auth file is not ongoing credential sync.
-
-- **`cdx <name>` fails with "not authenticated"** — run `cdx login <name>` first.
+untouched. If every selected profile is locked, the command is non-zero because
+it verified no credential; a mix of valid and locked profiles remains successful.
+Bulk refresh skips disabled profiles, while `cdx auth refresh <name>` still lets
+an operator inspect one explicitly. `login_required` means the provider rejected
+the local refresh token; run the supplied `cdx login <name>` command interactively.
+Hosts keep independent rotating credentials, so copying an auth file is not ongoing
+credential sync.
+
+- **`cdx <name>` fails with "not authenticated"** — run `cdx login <name>` first. `cdx doctor` uses the same Codex app-server probe as `cdx auth refresh`, so a local auth file alone is never reported as live authentication; a rejected refresh token is reported as `login_required` with the matching login command.
 - **One of two Codex accounts keeps asking for login** — run `cdx doctor --json` and inspect each Codex session's `codex_auth_file`, `codex_live_auth`, and `codex_stale_auth_logs` checks. If recent logs mention expired auth, repair only that isolated profile with `cdx login <name>`. Codex Business profiles can share the same `tokens.account_id`; `cdx doctor` reports `codex_shared_account_id` as a workspace-level clue, not proof that two profiles use the same user. Newly created sessions seed from the current global `~/.codex/auth.json` when one exists. For two separate Codex accounts, create or repair each session by running `cdx login <name>` for that session; `cdx login` does not log out first, so use `cdx logout <name>` explicitly only when you want to clear that isolated profile.
 - **`cdx` says no compatible Python 3 interpreter was found** — install Python 3 and make `py -3`, `python`, or `python3` available on PATH.
 - **`cdx add` succeeds but the session does not appear** — check that `CDX_HOME` is consistent between calls; a mismatch creates two separate registries.

package/VERSION

@@ -1 +1 @@
-0.20.4
+0.20.5

package/changelogs/CHANGELOGS_0_20_5.md

@@ -0,0 +1,22 @@
+# CDX Manager 0.20.5
+
+## Fixes
+
+- `cdx doctor` now uses the live Codex app-server authentication probe instead
+  of trusting a local auth file, so an expired or rejected refresh token is
+  reported as `login_required` with an actionable `cdx login <name>` remedy.
+- `cdx auth refresh all` skips disabled Codex profiles, while an explicit
+  `cdx auth refresh <name>` still lets an operator inspect a disabled profile
+  deliberately.
+- A bulk Codex auth refresh where every selected profile is locked now exits
+  non-zero as `auth_refresh_indeterminate` instead of looking like a silent
+  success without verifying any credential.
+- Codex app-server diagnostics no longer keep an unread stderr pipe while
+  waiting for stdout, avoiding a possible deadlock or timeout from noisy
+  provider diagnostics.
+
+## Validation
+
+- Package smoke coverage now runs `cdx doctor --json` from both packed npm and
+  wheel installs with isolated local provider shims, so packaged doctor
+  regressions are caught outside the source checkout.

package/checksums/release-archives.json

@@ -353,6 +353,17 @@
         "x86_64-pc-windows-msvc": "1f9971c1aee7e92685370db1e6a4bcf37b6012fa7452fc14ca3dd545998af82e",
         "x86_64-unknown-linux-musl": "2aabbc00b0fa3a2c8862cc1a5425a074fec99f072bf7b695d31e6e96b9b08c5d"
       }
+    },
+    "v0.20.4": {
+      "github_tarball_sha256": "55323fe428d6d297f14a210a590757443080dc55a87bb6fae4d967fddb505af3",
+      "github_zip_sha256": "37f4abb392b372d0f5fe5d5eb7c46e1e81a30b319d1961b5518f20e776f59b75",
+      "tray_assets": {
+        "aarch64-apple-darwin": "6d61a45ab6f310a83aefbb80d77dc31b1f3a738640197bcca1264c6ca7b70d26",
+        "aarch64-unknown-linux-musl": "f2f3a2c45c7deb2ea69cdc7c7b68524e6b5db5d1eda0ff902bda49d875636402",
+        "x86_64-apple-darwin": "93d3d9180588edcf573ffa8f9f2e870e8dff9659e198cde531bec0acfc37184f",
+        "x86_64-pc-windows-msvc": "7508e04ee07adb7a500b346be1d3891d93aec54dc0ff53643bd8c57e4e411118",
+        "x86_64-unknown-linux-musl": "47a1c8cff60c896db659d30d74496045d8c343e74a00f826e608f3973e735532"
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.20.4",
+  "version": "0.20.5",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.20.4"
+version = "0.20.5"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/codex_usage.py

@@ -199,6 +199,15 @@ def fetch_codex_rate_limit_diagnostic(session, timeout=5, popen_factory=None):
         return _probe_codex_rate_limit_diagnostic(session, auth_home, timeout, popen_factory)
 
 
+def diagnostic_needs_codex_login(diagnostic):
+    """Classify known auth failures without returning provider text."""
+    text = json.dumps(diagnostic.get("response") or {}).lower()
+    return any(marker in text for marker in (
+        "not logged in", "unauthorized", "authentication token is expired",
+        "token_expired", "invalid_grant", "http 401",
+    ))
+
+
 def _probe_codex_rate_limit_diagnostic(session, auth_home, timeout=5, popen_factory=None):
     diagnostic = _request_codex_app_server(
         auth_home,
@@ -236,7 +245,7 @@ def _request_codex_app_server(auth_home, method, params, failure_reason, timeout
             ["codex", "app-server", "--listen", "stdio://"],
             stdin=subprocess.PIPE,
             stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
             env=env,
             text=True,
             bufsize=1,

package/src/commands/auth.py

@@ -3,7 +3,6 @@
 Split out of cli_commands.py. Moved verbatim; re-exported by cli_commands.
 """
 
-import json
 import time
 import uuid
 
@@ -18,7 +17,11 @@ from ..cli_helpers import (
     _write_json,
 )
 from ..cli_render import _success, _warn
-from ..codex_usage import consume_codex_rate_limit_reset_credit, fetch_codex_rate_limit_diagnostic
+from ..codex_usage import (
+    consume_codex_rate_limit_reset_credit,
+    diagnostic_needs_codex_login,
+    fetch_codex_rate_limit_diagnostic,
+)
 from ..config import PROVIDER_ANTIGRAVITY, PROVIDER_CLAUDE, PROVIDER_CODEX, PROVIDER_OLLAMA
 from ..errors import CdxError
 from ..notify import (
@@ -36,21 +39,12 @@ def _confirm_reset(name):
     return answer.strip().lower() in ("y", "yes")
 
 
-def _refresh_needs_login(diagnostic):
-    """Classify known provider auth failures without returning provider text."""
-    text = json.dumps(diagnostic.get("response") or {}).lower()
-    return any(marker in text for marker in (
-        "not logged in", "unauthorized", "authentication token is expired",
-        "token_expired", "invalid_grant", "http 401",
-    ))
-
-
 def _refresh_result(session, diagnostic):
     if diagnostic.get("ok"):
         return {"session": session["name"], "provider": PROVIDER_CODEX, "outcome": "valid"}
     if diagnostic.get("reason") == "auth_locked":
         return {"session": session["name"], "provider": PROVIDER_CODEX, "outcome": "locked"}
-    if _refresh_needs_login(diagnostic):
+    if diagnostic_needs_codex_login(diagnostic):
         return {
             "session": session["name"], "provider": PROVIDER_CODEX,
             "outcome": "login_required", "login_command": f"cdx login {session['name']}",
@@ -63,7 +57,7 @@ def handle_auth(rest, ctx):
     target = parsed["target"]
     if target == "all":
         sessions = [session for session in ctx["service"]["list_sessions"]()
-                    if session["provider"] == PROVIDER_CODEX]
+                    if session["provider"] == PROVIDER_CODEX and session.get("enabled", True)]
     else:
         session = ctx["service"]["get_session"](target)
         if not session:
@@ -71,24 +65,32 @@ def handle_auth(rest, ctx):
         if session["provider"] != PROVIDER_CODEX:
             raise CdxError("Authentication refresh is only available for Codex sessions.")
         sessions = [session]
-    if not sessions:
+    if not sessions and target != "all":
         raise CdxError("No managed Codex sessions to refresh.")
 
     probe = ctx["options"].get("fetchCodexRateLimitDiagnostic") or fetch_codex_rate_limit_diagnostic
     results = [_refresh_result(session, probe(session)) for session in sessions]
     failures = [result for result in results if result["outcome"] in ("login_required", "failed")]
-    message = "Codex authentication probe completed" if not failures else "Codex authentication probe needs attention"
+    all_locked = bool(results) and all(result["outcome"] == "locked" for result in results)
+    message = (
+        "Codex authentication probe needs attention" if failures
+        else "Codex authentication probe could not verify any session" if all_locked
+        else "No enabled Codex sessions to refresh" if not results
+        else "Codex authentication probe completed"
+    )
     if parsed["json"]:
         payload = (
             _json_failure("auth.refresh", "auth_refresh_failed", message, results=results)
             if failures else _json_success("auth.refresh", message, results=results)
         )
+        if all_locked:
+            payload = _json_failure("auth.refresh", "auth_refresh_indeterminate", message, results=results)
         _write_json(ctx, payload)
     else:
         for result in results:
             suffix = f"; run {result['login_command']}" if result.get("login_command") else ""
             ctx["out"](f"{result['session']}: {result['outcome']}{suffix}\n")
-    return 1 if failures else 0
+    return 1 if failures or all_locked else 0
 
 def handle_ready(rest, ctx):
     """`cdx ready`: schedule an OS notification for the next session to come back.

package/src/health.py

@@ -337,11 +337,16 @@ def _codex_auth_issues(session, diag):
     ]
     live_status = diag.get("live_status")
     live_ok = live_status == "authenticated"
-    live_warn = live_status in ("logged_out", "error")
+    live_warn = live_status in ("logged_out", "login_required", "error")
+    live_message = (
+        f"session {name} Codex authentication requires login; run cdx login {name}"
+        if live_status == "login_required"
+        else f"session {name} live Codex auth status: {live_status}"
+    )
     issues.append(_issue(
         "OK" if live_ok else "WARN" if live_warn else "WARN",
         "codex_live_auth",
-        f"session {name} live Codex auth status: {live_status}",
+        live_message,
         {
             "session": name,
             "auth_home": diag.get("auth_home"),

package/src/provider_runtime.py

@@ -13,7 +13,7 @@ from datetime import datetime, timezone
 
 from .agent_notify import launch_notify_env, notifications_enabled
 from .claude_usage import _clean_oauth_token, _decode_jwt_claims
-from .codex_usage import codex_auth_lock
+from .codex_usage import codex_auth_lock, diagnostic_needs_codex_login, fetch_codex_rate_limit_diagnostic
 from .config import (
     PROVIDER_ANTIGRAVITY,
     PROVIDER_CLAUDE,
@@ -294,19 +294,21 @@ def codex_auth_diagnostic(session, spawn_sync=None, env_override=None):
         "live_status": "unknown",
         "live_error": None,
     }
-    try:
-        status = _probe_provider_auth_status(
-            session,
-            spawn_sync=spawn_sync,
-            env_override=env_override,
-            trust_local_credentials=False,
-        )
-        result["live_status"] = status
-        if status == AUTH_PROBE_DEGRADED:
-            result["live_error"] = _auth_probe_degraded_message(session)
-    except CdxError as error:
+    if not result["local_tokens_present"]:
+        result["live_status"] = AUTH_PROBE_LOGGED_OUT
+        return result
+    diagnostic = fetch_codex_rate_limit_diagnostic(session)
+    if diagnostic["ok"]:
+        result["live_status"] = AUTH_PROBE_AUTHENTICATED
+    elif diagnostic["reason"] == "auth_locked":
+        result["live_status"] = AUTH_PROBE_DEGRADED
+        result["live_error"] = "Codex authentication probe is locked by an active session."
+    elif diagnostic_needs_codex_login(diagnostic):
+        result["live_status"] = "login_required"
+        result["live_error"] = f"Codex authentication requires login; run cdx login {session['name']}."
+    else:
         result["live_status"] = "error"
-        result["live_error"] = str(error)
+        result["live_error"] = f"Codex app-server authentication probe failed ({diagnostic['reason']})."
     return result