cdx-manager 0.21.3 → 0.21.5

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.21.3-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.21.5-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **The right AI coding account, when you need it.** CDX Manager keeps your Codex and Claude accounts in separate profiles, shows which ones have quota, and helps you pick the next usable session from your terminal.
 

package/VERSION

@@ -1 +1 @@
-0.21.3
+0.21.5

package/changelogs/CHANGELOGS_0_21_4.md

@@ -0,0 +1,10 @@
+# CDX Manager 0.21.4
+
+## Start a session on a first message
+
+- `cdx <name> --prompt TEXT` and `cdx <name> --prompt-file PATH` launch an interactive session that starts on that message, for launcher scripts that open a session already pointed at a task. Both spellings `--flag value` and `--flag=value` work. They are refused before the provider starts when combined with each other, with `--resume` or `cdx resume`, with `--prompt-file -` (the session needs standard input), and for Ollama sessions (`ollama run` answers once and exits). A relative `--prompt-file` path is read from the current directory, not `--dir`. Contributed by Nicolas Rigaudy (#13).
+
+## Fixes
+
+- Claude sessions started from inside a running Claude Code session (a hook, or a terminal or script it spawned) saved no transcript: they inherited the parent's session markers (`CLAUDECODE`, `CLAUDE_CODE_CHILD_SESSION`, ...) and ran as a child session, which broke resume and interactive usage backfill. CDX now drops those markers for every Claude spawn; user settings such as `CLAUDE_CODE_DISABLE_*` still pass through. Contributed by Nicolas Rigaudy (#14).
+- A prompt starting with `-` (from `--prompt`, `cdx handoff` or `cdx run`) is now passed after `--`, so Claude, Codex and Ollama no longer read it as an option (for example `-h` printed the provider's help instead of starting).

package/changelogs/CHANGELOGS_0_21_5.md

@@ -0,0 +1,26 @@
+# CDX Manager 0.21.5
+
+## Claude logins
+
+- `cdx status` shows each Claude profile's auth type in a TYPE column: `setup-token` or `full-login` (a `/login` run inside the profile). It also appears in the single-session view and as `auth_type` in `--json`. Within 30 days of a setup-token's one-year expiry, the column shows `setup-token 12d`, or `setup-token expired` once it has lapsed, and `cdx doctor` warns with the `cdx login` command to run. Based on work by Nicolas Rigaudy (#15, #16, #21).
+- The operations guide explains why a setup-token never loads claude.ai connectors such as Microsoft 365, and how to switch with `/login`.
+- On macOS, `cdx login` on a Claude profile now also removes the profile's keychain `/login`, so the new setup-token is the one used at launch. Before, the keychain login kept winning. The misleading "falling back to claude setup-token" message is reworded (#18).
+
+## Fixes
+
+- `cdx ready` never showed its notification: the scheduled job ran `cdx notify`, which now only serves agent hooks. On macOS the job was also written under the profile home inside a cdx session, where launchd never reads it (#18, #21).
+- Windows:
+  - the session store lock now waits up to 120 seconds instead of failing after 10;
+  - the process-alive check no longer sends Ctrl+C to the process it probes (#18).
+- Agent alert hooks work when the cdx path contains a space. Claude's `settings.json` is written atomically, through symlinks, and keeps its permissions (#18).
+- Token prices reviewed on 2026-10-22:
+  - `claude-sonnet-5-5` cache reads are $0.10/MTok;
+  - `claude-haiku-5-5` is added;
+  - context variants such as `claude-opus-5-5[1m]` are priced at the base model's rates (#20).
+
+## Housekeeping
+
+- `runs.json` keeps every running run plus the newest 500 finished ones.
+- Handoff entries older than 7 days are deleted when a new one is prepared.
+- Dead log-rotation code and duplicated helpers are removed.
+- New tests cover the state-changing `cdx tray` commands (#17, #19).

package/checksums/release-archives.json

@@ -507,6 +507,28 @@
         "x86_64-pc-windows-msvc": "856f9dc459182adb10f66f2836abc862be82feff1cc3f1cf859764336487d781",
         "x86_64-unknown-linux-musl": "f1832fdbe7114b4625da21d6a3a0f0c100f18d3a441796e809e568620e4cd345"
       }
+    },
+    "v0.21.3": {
+      "github_tarball_sha256": "4f38562539953131cd2d8aedffea71ba1e7b2d8ccbc899b6521a1ed8c7507cf2",
+      "github_zip_sha256": "06e95cf08fcdec0e978c16980f58f282b01daee0513ab8db1ea659b423e58dc6",
+      "tray_assets": {
+        "aarch64-apple-darwin": "086ec24d2d1ad2820394e74a5f100cec62da1ffe2df91ee470c247f5b1cb9bb0",
+        "aarch64-unknown-linux-musl": "0f32a168e097a4d18da86fe0ae028465d5fb43afae6344da39a76463ba99c0ea",
+        "x86_64-apple-darwin": "348ec8e5ed89c1181a800ab65b5d736a46b8118d7b83445847049cae95735af8",
+        "x86_64-pc-windows-msvc": "9729f245b46420ae4b11c1a50d3ba9cba682854866ef37a3f334dccbdd70ac89",
+        "x86_64-unknown-linux-musl": "182fb651dab29a6a21b3b8ef56c196e954fd75230891f8532c21b09ff5fbacee"
+      }
+    },
+    "v0.21.4": {
+      "github_tarball_sha256": "265936ceb35ffd43679e916f7ac2572b73e3a499803b86dfa8e87029a4188394",
+      "github_zip_sha256": "f9a648c4cba0d8c3204cac151f695d6fc4f86316d6dbdb6a1e8daf471dcd042b",
+      "tray_assets": {
+        "aarch64-apple-darwin": "b17aa8631acdcfa3e0de94ef8282b5b35791fd74d1e0be321bad42b20e7450ea",
+        "aarch64-unknown-linux-musl": "45eefeeb0d6c71269a24bece05780db98eaaa0e33630366f31cdb006f1dea946",
+        "x86_64-apple-darwin": "c10294583e88373570c7c5ad9094b711d57499d73358e9a1fa397bf5b76a12e3",
+        "x86_64-pc-windows-msvc": "0d4e6c736a789d8fddaf688cd61d899a305171fa6d7e856735b2cd7d2daef21c",
+        "x86_64-unknown-linux-musl": "8320025507801fd549b8c8dd4196a9378ddb25f137e48945e61e429bf2a864aa"
+      }
     }
   }
 }

package/docs/cli.md

@@ -8,6 +8,7 @@
 | `cdx --json` | List all sessions as a machine-readable JSON payload |
 | `cdx <name>` | Launch a session (checks auth first) |
 | `cdx <name> [--json]` | Launch a session; `--json` returns a structured success payload after the interactive run ends |
+| `cdx <name> --prompt TEXT` / `cdx <name> --prompt-file PATH` | Launch a session that starts on this first message (not with `--resume` or Ollama sessions; `--prompt-file -` is refused because the session needs standard input; a relative `--prompt-file` path is read from the current directory, not `--dir`) |
 | `cdx <name> -r` / `cdx <name> --resume` | Resume the provider-native conversation for a session when supported |
 | `cdx add [provider] <name> [--model MODEL] [--json]` | Register a new session (`provider`: `codex`, `claude`, `antigravity`, or `ollama`; Ollama requires `--model`) |
 | `cdx cp <source> <dest> [--json]` | Copy a session into another session name, overwriting the destination if it exists |
@@ -55,7 +56,7 @@
 | `cdx runs [--limit N] [--since 7d\|today\|DATE] --json` | List recent runs; `--since` returns every run completed after the cursor and ignores `--limit` |
 | `cdx schema --json` | Publish the enums, mutually-exclusive argument groups, and error codes programmatic callers should validate against |
 | `cdx stats [name] [--since 7d\|today\|DATE] [--from DATE] [--to DATE] [--json]` | Aggregate launch counts, duration, and known token usage by session, for headless and interactive runs alike |
-| `cdx status [--json] [--refresh\|--cached] [--timeout SECONDS]` | Show token usage table for all sessions; empty credits, block, and reset columns are omitted; `--cached` skips live provider probes and returns only stored status |
+| `cdx status [--json] [--refresh\|--cached] [--timeout SECONDS]` | Show token usage table for all sessions; empty credits, block, and reset columns are omitted; `--cached` skips live provider probes and returns only stored status; Claude rows also report the auth type (`setup-token` or `full-login`) in a TYPE column and as `auth_type` in JSON. |
 | `cdx status --small [--refresh\|--cached] [--timeout SECONDS]` / `cdx status -s [--refresh\|--cached] [--timeout SECONDS]` | Show compact token usage table without provider, blocking quota, credits, and updated columns |
 | `cdx status <name> [--json] [--refresh\|--cached] [--timeout SECONDS]` | Show detailed usage breakdown for one session; `--cached` avoids live provider refreshes |
 | `cdx tray status [--json] [--refresh]` | Emit the tray snapshot: one icon state, one line per enabled session, and how fresh each figure is. Reads stored status by default; `--refresh` is the only path that probes a provider |

package/docs/operations.md

@@ -151,6 +151,7 @@ Hosts keep independent rotating credentials, so copying an auth file is not ongo
 credential sync.
 
 - **`cdx <name>` fails with "not authenticated"** — run `cdx login <name>` first. `cdx doctor` uses the same Codex app-server probe as `cdx auth refresh`, so a local auth file alone is never reported as live authentication; a rejected refresh token is reported as `login_required` with the matching login command.
+- **A Claude session has no claude.ai connectors (Microsoft 365, ...) in `/mcp`** — `cdx login <name>` stores a setup-token for Claude profiles, and Claude Code can only make model requests with it: it never loads claude.ai connectors. `cdx status` shows each Claude profile's auth type (`setup-token` or `full-login`; `auth_type` in `--json`). To switch, start the session and run `/login` inside it. Once the profile holds its own claude.ai login (its `.claude/.credentials.json`, or its profile-specific `Claude Code-credentials-<hash>` keychain entry on macOS), cdx stops passing the setup-token on later launches. If that login later expires, run `/login` again, or go back to a setup-token with `cdx login <name>`, which removes the profile's `/login`.
 - **One of two Codex accounts keeps asking for login** — run `cdx doctor --json` and inspect each Codex session's `codex_auth_file`, `codex_live_auth`, and `codex_stale_auth_logs` checks. If recent logs mention expired auth, repair only that isolated profile with `cdx login <name>`. Codex Business profiles can share the same `tokens.account_id`; `cdx doctor` reports `codex_shared_account_id` as a workspace-level clue, not proof that two profiles use the same user. Newly created sessions seed from the current global `~/.codex/auth.json` when one exists. For two separate Codex accounts, create or repair each session by running `cdx login <name>` for that session; `cdx login` does not log out first, so use `cdx logout <name>` explicitly only when you want to clear that isolated profile.
 - **`cdx` says no compatible Python 3 interpreter was found** — install Python 3 and make `py -3`, `python`, or `python3` available on PATH.
 - **`cdx add` succeeds but the session does not appear** — check that `CDX_HOME` is consistent between calls; a mismatch creates two separate registries.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.21.3",
+  "version": "0.21.5",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.21.3"
+version = "0.21.5"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/agent_notify.py

@@ -15,6 +15,7 @@ import shutil
 import subprocess
 
 from .config import get_cdx_home
+from .fs_utils import atomic_write
 from .notify import notification_channel, send_desktop_notification
 from .tray_alerts import alerts_enabled
 from .tray_events import publish
@@ -71,7 +72,11 @@ def resolve_hook_command(env=None):
     the provider inherits.
     """
     env = env or os.environ
-    return env.get("CDX_BIN") or shutil.which("cdx", path=env.get("PATH")) or "cdx"
+    path = env.get("CDX_BIN") or shutil.which("cdx", path=env.get("PATH")) or "cdx"
+    # Hooks run through a shell, so a space in the path ("C:\\Users\\Jean Dupont",
+    # a macOS home with a space) would split it. Double quotes read the same in
+    # sh, Git Bash and cmd.exe; a path without whitespace stays as it was.
+    return f'"{path}"' if any(ch.isspace() for ch in path) else path
 
 
 def read_hook_payload(args, stdin_text=None):
@@ -547,11 +552,16 @@ def _read_json(path):
 
 
 def _write_json(path, document):
+    # Atomic, because Claude Code may rewrite the same settings file at the same
+    # moment. Through realpath so a symlinked settings.json stays a symlink, and
+    # with the file's own mode so a user-tightened file is not loosened.
     try:
-        os.makedirs(os.path.dirname(path), exist_ok=True)
-        with open(path, "w", encoding="utf-8") as handle:
-            json.dump(document, handle, indent=2)
-            handle.write("\n")
+        target = os.path.realpath(path)
+        try:
+            mode = os.stat(target).st_mode & 0o777
+        except FileNotFoundError:
+            mode = 0o644
+        atomic_write(target, json.dumps(document, indent=2) + "\n", mode=mode)
     except OSError:
         # An unwritable home is a skipped provisioning step, not a failed launch.
         return False

package/src/claude_credentials.py

@@ -81,6 +81,91 @@ def peek_keychain_credentials(auth_home):
         return None
 
 
+INFERENCE_SCOPE = "user:inference"
+
+
+def is_full_claude_login(credentials):
+    """True for a claude.ai login, False for an inference-only credential.
+
+    A setup-token can only make model requests, so Claude Code never loads
+    claude.ai connectors with it. A real `/login` stores a refresh token and
+    scopes beyond inference. Only the shape is inspected, never the values.
+    """
+    oauth = credentials.get("claudeAiOauth") if isinstance(credentials, dict) else None
+    if not isinstance(oauth, dict) or not oauth.get("accessToken"):
+        return False
+    scopes = oauth.get("scopes")
+    extra_scopes = isinstance(scopes, list) and any(
+        isinstance(scope, str) and scope != INFERENCE_SCOPE for scope in scopes
+    )
+    return bool(oauth.get("refreshToken")) or extra_scopes
+
+
+def read_claude_login_file(auth_home):
+    try:
+        with open(os.path.join(auth_home, ".claude", ".credentials.json"), encoding="utf-8") as handle:
+            data = json.load(handle)
+    except (OSError, ValueError):
+        return None
+    return data if isinstance(data, dict) else None
+
+
+def has_full_claude_login(auth_home):
+    """Whether the profile holds a claude.ai login: the profile's
+    `.credentials.json` (Linux, Windows) or its keychain entry (macOS)."""
+    if not auth_home:
+        return False
+    return is_full_claude_login(read_claude_login_file(auth_home)) or is_full_claude_login(
+        peek_keychain_credentials(auth_home)
+    )
+
+
+def claude_auth_type(auth_home):
+    """`full-login`, `setup-token`, or None when the profile holds neither."""
+    if has_full_claude_login(auth_home):
+        return "full-login"
+    try:
+        with open(os.path.join(auth_home, "credentials", "default.json"), encoding="utf-8") as handle:
+            token = json.load(handle).get("access_token")
+    except (OSError, ValueError, AttributeError):
+        return None
+    return "setup-token" if token else None
+
+
+# `claude setup-token` mints a token valid for one year. Tokens minted before
+# cdx recorded `created_at` fall back to the file's mtime, which a copy or a
+# backup import resets, so their date can read later than it really is.
+SETUP_TOKEN_LIFETIME_SECONDS = 365 * 24 * 3600
+SETUP_TOKEN_WARN_DAYS = 30
+
+
+def setup_token_expires_at(auth_home):
+    """Epoch seconds when the profile's setup-token expires, or None."""
+    path = os.path.join(auth_home or "", "credentials", "default.json")
+    try:
+        with open(path, encoding="utf-8") as handle:
+            data = json.load(handle)
+        if not isinstance(data, dict) or not data.get("access_token"):
+            return None
+        created = data.get("created_at")
+        if isinstance(created, str):
+            from datetime import datetime
+            created = datetime.fromisoformat(created.replace("Z", "+00:00")).timestamp()
+        elif not isinstance(created, (int, float)):
+            created = os.path.getmtime(path)
+    except (OSError, ValueError):
+        return None
+    return created + SETUP_TOKEN_LIFETIME_SECONDS
+
+
+def setup_token_days_left(auth_home, now=None):
+    expires = setup_token_expires_at(auth_home)
+    if expires is None:
+        return None
+    import time
+    return int((expires - (time.time() if now is None else now)) // 86400)
+
+
 def write_keychain_credentials(auth_home, data):
     _reject_custom_oauth()
     user, service = _keychain_identity(auth_home)

package/src/cli.py

@@ -70,11 +70,8 @@ from .cli_render import (
     _visible_len,
     format_error,
 )
+from .config import PROVIDER_OLLAMA
 from .errors import CdxError
-from .provider_runtime import (
-    LOG_ROTATE_BYTES,
-    _rotate_log_if_needed,
-)
 from .session_service import create_session_service
 from .status_view import (
     _format_blocking_quota,
@@ -137,13 +134,11 @@ VERSION = _resolve_version()
 # them here documents that and stops F401 from treating them as dead imports.
 __all__ = [
     "STATUS_USAGE",
-    "LOG_ROTATE_BYTES",
     "_format_blocking_quota",
     "_format_reset_time",
     "_format_status_detail",
     "_format_status_rows",
     "_pad_table",
-    "_rotate_log_if_needed",
     "_visible_len",
     "cli_entry",
     "format_json_error",
@@ -288,6 +283,7 @@ def _print_help(use_color=False):
         f"  {_style('cdx set <name> --notify on', '36', use_color)}  # agent finishes or needs attention",
         f"  {_style('cdx ready', '36', use_color)}  # next session to become ready",
         f"  {_style('cdx <name> [--json]', '36', use_color)}",
+        f"  {_style('cdx <name> --prompt TEXT|--prompt-file PATH', '36', use_color)}  # start with a first message",
         f"  {_style('cdx --help', '36', use_color)}",
         f"  {_style('cdx --version', '36', use_color)}",
     ])
@@ -623,10 +619,18 @@ def main(argv, options=None):
     if handler:
         return handler(rest, ctx)
 
-    from .commands.launch import _parse_launch_args
-    directory, launch_args = _parse_launch_args(rest)
+    from .commands.launch import _parse_launch_args, _read_launch_prompt
+    directory, launch_args, prompt = _parse_launch_args(rest)
     if all(arg in ("--json", "-r", "--resume") for arg in launch_args):
-        return handle_launch(command, ctx, resume=("-r" in launch_args or "--resume" in launch_args), directory=directory)
+        resume = "-r" in launch_args or "--resume" in launch_args
+        has_prompt = prompt["prompt"] is not None or prompt["prompt_file"] is not None
+        if resume and has_prompt:
+            raise CdxError("cdx <name>: --prompt and --prompt-file are not supported with --resume.")
+        # `ollama run MODEL PROMPT` answers once and exits instead of opening a session.
+        if has_prompt and (ctx["service"]["get_session"](command) or {}).get("provider") == PROVIDER_OLLAMA:
+            raise CdxError("cdx <name>: --prompt and --prompt-file are not supported for Ollama sessions.")
+        return handle_launch(command, ctx, initial_prompt=_read_launch_prompt(prompt), resume=resume,
+                             directory=directory)
 
     raise CdxError(f"Unknown command: {command}. Use cdx --help.")
 

package/src/cli_helpers.py

@@ -9,8 +9,9 @@ import asyncio
 import json
 import os
 import re
-from datetime import datetime
+from datetime import datetime, timezone
 
+from .claude_credentials import delete_keychain_credentials
 from .cli_render import _dim, _info, _pad_table, _style, _warn
 from .errors import CdxError
 from .fs_utils import atomic_write
@@ -237,6 +238,8 @@ def _write_claude_oauth_token(auth_home, token):
         "version": "1.0",
         "type": "oauth_token",
         "access_token": token,
+        # Read by claude_credentials.setup_token_expires_at for the expiry warning.
+        "created_at": datetime.now(timezone.utc).isoformat(),
     }
     # atomic_write keeps the token 0o600 from creation — no umask window.
     atomic_write(cred_path, json.dumps(payload, indent=2) + "\n", mode=0o600)
@@ -244,7 +247,7 @@ def _write_claude_oauth_token(auth_home, token):
 
 def _bootstrap_claude_setup_token(session, ctx):
     ctx["out"](
-        "Claude login did not create isolated credentials; falling back to claude setup-token.\n"
+        "Minting a long-lived Claude setup-token for this session.\n"
     )
     run_info = _run_interactive_provider_command(
         session,
@@ -277,11 +280,14 @@ def _bootstrap_claude_setup_token(session, ctx):
         )
     auth_home = session.get("authHome") or ""
     cred_path = _write_claude_oauth_token(auth_home, token)
-    # ponytail: drop short-lived claude login creds so the ~1yr token wins at launch (provider_runtime _read_claude_launch_oauth_token)
+    # A profile /login wins over the setup-token at launch (see
+    # provider_runtime._read_claude_launch_oauth_token), so drop it on every
+    # platform: the file on Linux/Windows, the profile keychain entry on macOS.
     try:
         os.remove(os.path.join(auth_home, ".claude", ".credentials.json"))
     except OSError:
         pass
+    delete_keychain_credentials(auth_home)
     return cred_path
 
 def _format_launch_config(session, use_color=False):

package/src/commands/auth.py

@@ -100,6 +100,12 @@ def handle_ready(rest, ctx):
     unreachable once `cdx ready` became the only entry point.
     """
     parsed = parse_ready_args(rest)
+    if parsed["mode"] == "fire":
+        send_desktop_notification(
+            "cdx", f"{parsed['fire']} reset time reached; it should be usable again",
+            spawn_sync=ctx.get("spawn_sync"), env=ctx.get("env"),
+        )
+        return 0
     event = resolve_notify_event(
         ctx["service"]["get_status_rows"](
             progress_callback=None if parsed["json"] else _make_notify_progress(ctx),

package/src/commands/launch.py

@@ -30,31 +30,45 @@ from ..provider_runtime import (
     _get_auth_home,
     _run_interactive_provider_command,
 )
+from ..run_command import PROMPT_STDIN, read_run_prompt
 from ..run_usage import estimate_cost
 
+LAUNCH_USAGE = "Usage: cdx <name> [--dir PATH] [--prompt TEXT|--prompt-file PATH] [--resume] [--json]"
+
 
 def _parse_launch_args(args):
-    """Return the per-launch directory and ordinary launch flags."""
-    directory = None
+    """Return the per-launch directory, initial prompt source and ordinary launch flags."""
+    values = {"--dir": None, "--prompt": None, "--prompt-file": None}
     cleaned = []
     index = 0
     while index < len(args):
         arg = args[index]
-        if arg == "--dir":
-            if directory is not None or index + 1 >= len(args):
-                raise CdxError("Usage: cdx <name> [--dir PATH] [--resume] [--json]")
-            directory = args[index + 1]
-            index += 2
-            continue
-        if arg.startswith("--dir="):
-            if directory is not None or not arg.split("=", 1)[1]:
-                raise CdxError("Usage: cdx <name> [--dir PATH] [--resume] [--json]")
-            directory = arg.split("=", 1)[1]
+        flag, sep, inline = arg.partition("=")
+        if flag not in values:
+            cleaned.append(arg)
             index += 1
             continue
-        cleaned.append(arg)
-        index += 1
-    return directory, cleaned
+        if sep:
+            value, index = inline, index + 1
+        elif index + 1 < len(args):
+            value, index = args[index + 1], index + 2
+        else:
+            raise CdxError(LAUNCH_USAGE)
+        if values[flag] is not None or not value:
+            raise CdxError(LAUNCH_USAGE)
+        values[flag] = value
+    if values["--prompt"] is not None and values["--prompt-file"] is not None:
+        raise CdxError("cdx <name>: --prompt and --prompt-file are mutually exclusive.")
+    if values["--prompt-file"] == PROMPT_STDIN:
+        raise CdxError("cdx <name>: --prompt-file - is not supported; the interactive session needs standard input.")
+    prompt = {"prompt": values["--prompt"], "prompt_file": values["--prompt-file"]}
+    return values["--dir"], cleaned, prompt
+
+
+def _read_launch_prompt(prompt):
+    if prompt["prompt"] is None and prompt["prompt_file"] is None:
+        return None
+    return read_run_prompt(prompt)
 
 
 def _launch_directory(session, ctx, explicit, json_flag):
@@ -154,7 +168,9 @@ def handle_can_resume(rest, ctx):
     return 0
 
 def handle_resume(rest, ctx):
-    directory, rest = _parse_launch_args(rest)
+    directory, rest, prompt = _parse_launch_args(rest)
+    if prompt["prompt"] is not None or prompt["prompt_file"] is not None:
+        raise CdxError("cdx resume: --prompt and --prompt-file are not supported when resuming.")
     json_flag, args = _parse_json_flag(rest)
     if len(args) != 1:
         raise CdxError(RESUME_USAGE)

package/src/commands/tray.py

@@ -685,26 +685,6 @@ def _refuse(ctx, as_json, action, code, message):
     return 0
 
 
-def _companion_action(action, args, ctx):
-    parsed = _parse_flag_args(args, {
-        "--json": {"key": "json", "type": "bool", "default": False},
-    }, TRAY_USAGE, positionals_key="args", max_positionals=0)
-    message = (
-        f"cdx tray {action} is defined but no tray companion ships with CDX {ctx['version']}. "
-        "Nothing was installed, started, or changed."
-    )
-    if parsed["json"]:
-        _write_json(ctx, _json_success(
-            f"tray.{action}",
-            message,
-            warnings=[{"code": COMPANION_UNAVAILABLE, "message": message}],
-            applied=False,
-        ))
-        return 0
-    ctx["out"](f"{_warn(message, ctx['use_color'])}\n")
-    return 0
-
-
 def _pct(value):
     return "?" if value is None else f"{int(value)}%"
 

package/src/handoff.py

@@ -5,6 +5,7 @@ import hashlib
 import json
 import os
 import re
+import time
 from datetime import datetime, timezone
 from uuid import uuid4
 
@@ -231,9 +232,32 @@ def prepare_entry(base_dir, target, workspace, source=None, transcript=None):
     except OSError:
         os.unlink(path)
         raise
+    _drop_old_entries(os.path.dirname(path), keep=path)
     return path, entry
 
 
+# A launch reads its entry right after preparing it, and concurrent prepares
+# each keep their own, so only entries well past any launch are removed.
+HANDOFF_ENTRY_MAX_AGE_SECONDS = 7 * 24 * 3600
+
+
+def _drop_old_entries(directory, keep, now=None):
+    cutoff = (time.time() if now is None else now) - HANDOFF_ENTRY_MAX_AGE_SECONDS
+    try:
+        names = os.listdir(directory)
+    except OSError:
+        return
+    for name in names:
+        candidate = os.path.join(directory, name)
+        if not name.endswith('.json') or candidate == keep:
+            continue
+        try:
+            if os.path.getmtime(candidate) < cutoff:
+                os.unlink(candidate)
+        except OSError:
+            pass
+
+
 def load_entry(base_dir, target, workspace):
     """Reuse only this target/workspace's prepared entry; never downgrade stale data."""
     pointer = _entry_pointer(base_dir, target, workspace)

package/src/health.py

@@ -110,6 +110,8 @@ def collect_health_report(service, base_dir, env=None, spawn_sync=None, check_pr
         state_path = _state_file_path(base_dir, name)
         if not os.path.isfile(state_path):
             issues.append(_issue("FAIL", "missing_state", f"session {name} state file is missing", state_path, True))
+        if session.get("provider") == PROVIDER_CLAUDE:
+            issues.extend(_claude_setup_token_issues(session))
         if session.get("provider") == PROVIDER_CODEX:
             diag = codex_auth_diagnostic(session, spawn_sync=spawn_sync, env_override=env)
             diag["observed_account"] = _recent_codex_observed_account(diag.get("auth_home"))
@@ -374,6 +376,22 @@ def _codex_auth_issues(session, diag):
     return issues
 
 
+def _claude_setup_token_issues(session):
+    from .claude_credentials import SETUP_TOKEN_WARN_DAYS, claude_auth_type, setup_token_days_left
+
+    home = session.get("authHome")
+    if not home or claude_auth_type(home) != "setup-token":
+        return []
+    days = setup_token_days_left(home)
+    if days is None or days > SETUP_TOKEN_WARN_DAYS:
+        return []
+    name = session["name"]
+    when = "has expired" if days < 0 else f"expires in {days} day(s)"
+    return [_issue("WARN", "claude_setup_token_expiry",
+                   f"session {name} Claude setup-token {when}; run cdx login {name}",
+                   {"session": name, "days_left": days})]
+
+
 def _codex_shared_account_id_issues(codex_diagnostics):
     by_account_id = {}
     for session, diag in codex_diagnostics:

package/src/notify.py

@@ -23,6 +23,9 @@ def parse_ready_args(args):
     blocking wait loop — reachable through a `cdx notify` that no longer exists.
     `cdx ready` always schedules the next-ready event, so none of it could run.
     """
+    if len(args) == 2 and args[0] == "--fire":
+        # Internal: what a scheduled job runs when the reset time arrives.
+        return {"name": None, "mode": "fire", "fire": args[1], "json": False, "refresh": False, "schedule": False}
     unknown = [arg for arg in args if arg not in ("--refresh", "--json")]
     if unknown:
         raise CdxError(READY_USAGE)
@@ -243,7 +246,7 @@ def schedule_notification_event(base_dir, parsed, event, spawn_sync=None, env=No
             "target_timestamp": target_timestamp,
         }
 
-    argv = _scheduled_notify_argv(parsed, env)
+    argv = _scheduled_notify_argv(event, env)
     if sys.platform == "darwin":
         result = _schedule_macos_launchd(base_dir, parsed, event, argv, spawn_sync, env)
     elif sys.platform == "win32":
@@ -255,17 +258,11 @@ def schedule_notification_event(base_dir, parsed, event, spawn_sync=None, env=No
     return result
 
 
-def _scheduled_notify_argv(parsed, env):
+def _scheduled_notify_argv(event, env):
     executable = env.get("CDX_BIN") or shutil.which("cdx", path=env.get("PATH")) or "cdx"
-    argv = [executable, "notify"]
-    if parsed["mode"] == "at-reset":
-        argv.append(parsed["name"])
-        argv.append("--at-reset")
-    else:
-        argv.append("--next-ready")
-    argv.append("--once")
-    argv.append("--refresh")
-    return argv
+    # `cdx notify` is the agent-hook target now and stays silent without a hook
+    # payload, so the job names the notification it has to show.
+    return [executable, "ready", "--fire", event.get("session") or "cdx"]
 
 
 def _schedule_macos_launchd(base_dir, parsed, event, argv, spawn_sync, env):
@@ -273,7 +270,7 @@ def _schedule_macos_launchd(base_dir, parsed, event, argv, spawn_sync, env):
     schedule_dir = os.path.join(base_dir, "state", "notifications")
     os.makedirs(schedule_dir, mode=0o700, exist_ok=True)
     script_path = os.path.join(schedule_dir, f"{label}.sh")
-    launch_agents = os.path.join(os.path.expanduser("~"), "Library", "LaunchAgents")
+    launch_agents = os.path.join(_operator_home(), "Library", "LaunchAgents")
     os.makedirs(launch_agents, exist_ok=True)
     plist_path = os.path.join(launch_agents, f"{label}.plist")
     target = _round_up_to_next_minute(datetime.fromtimestamp(event["target_timestamp"]).astimezone())
@@ -298,6 +295,14 @@ def _schedule_macos_launchd(base_dir, parsed, event, argv, spawn_sync, env):
     return {"scheduled": True, "existing": False, "backend": "launchd", "id": label, "path": plist_path}
 
 
+def _operator_home():
+    """The operator's real home. Inside a cdx session HOME is the profile home,
+    whose LaunchAgents folder launchd never reads."""
+    import pwd
+
+    return pwd.getpwuid(os.getuid()).pw_dir
+
+
 def _macos_schedule_script(argv, env, label, plist_path, script_path):
     lines = ["#!/bin/sh", f"export PATH={shlex.quote(env.get('PATH', '/usr/local/bin:/usr/bin:/bin'))}"]
     if env.get("CDX_HOME"):

package/src/provider_runtime.py

@@ -12,7 +12,7 @@ import uuid
 from datetime import datetime, timezone
 
 from .agent_notify import launch_notify_env, notifications_enabled
-from .claude_credentials import peek_keychain_credentials
+from .claude_credentials import peek_keychain_credentials, read_claude_login_file
 from .claude_usage import _clean_oauth_token, _decode_jwt_claims, _secure_storage_overrides, claude_profile_store_dir
 from .codex_usage import codex_auth_lock, diagnostic_needs_codex_login, fetch_codex_rate_limit_diagnostic
 from .config import (
@@ -26,7 +26,6 @@ from .config import (
 )
 from .errors import CdxError
 
-LOG_ROTATE_BYTES = 10 * 1024 * 1024  # 10 MB
 TERMINAL_TITLE_SEPARATOR = " — "
 # Providers redraw their own title while their TUI runs, so a single write at
 # launch does not survive. Re-asserting on this interval takes the title back
@@ -137,6 +136,21 @@ REDACTED_PROMPT_ARG = "[prompt redacted]"
 # Documented Claude Code switch that stops it from setting and clearing the
 # terminal title, leaving cdx's shared title keeper as the only writer.
 CLAUDE_DISABLE_TERMINAL_TITLE_ENV = "CLAUDE_CODE_DISABLE_TERMINAL_TITLE"
+# Set by a running Claude Code session for its own child processes. When cdx is
+# started from inside one (a hook, or a terminal or script it spawned), the new
+# claude inherits them, treats itself as a child session and turns transcript
+# saving off, which breaks resume and usage backfill.
+CLAUDE_PARENT_SESSION_ENV = (
+    "CLAUDECODE",
+    "CLAUDE_CODE_CHILD_SESSION",
+    "CLAUDE_CODE_SESSION_ID",
+    "CLAUDE_CODE_SESSION_ATTENDED",
+    "CLAUDE_CODE_ENTRYPOINT",
+    "CLAUDE_CODE_EXECPATH",
+    "CLAUDE_CODE_MESSAGING_SOCKET",
+    "CLAUDE_CODE_MESSAGING_TOKEN",
+    "CLAUDE_PID",
+)
 CLAUDE_CLI_MODEL_ALIASES = {
     "claude-sonnet": "sonnet",
     "claude-opus": "opus",
@@ -216,6 +230,8 @@ def _claude_env(base_env, auth_home, own_terminal_title=False):
     env = {**base_env, **_home_env_overrides(auth_home)}
     env.pop("CLAUDE_CONFIG_DIR", None)
     env.pop("CODEX_HOME", None)
+    for key in CLAUDE_PARENT_SESSION_ENV:
+        env.pop(key, None)
     env.setdefault("ANTHROPIC_PROFILE", _anthropic_profile_name())
     if own_terminal_title:
         env[CLAUDE_DISABLE_TERMINAL_TITLE_ENV] = "1"
@@ -233,12 +249,8 @@ def _read_anthropic_oauth_token(auth_home):
 
 
 def _has_local_claude_auth(auth_home):
-    try:
-        with open(os.path.join(auth_home, ".claude", ".credentials.json"), encoding="utf-8") as handle:
-            credentials = json.load(handle)
-    except (FileNotFoundError, OSError, json.JSONDecodeError):
-        return False
-    oauth = credentials.get("claudeAiOauth") if isinstance(credentials, dict) else None
+    credentials = read_claude_login_file(auth_home)
+    oauth = credentials.get("claudeAiOauth") if credentials else None
     return bool(isinstance(oauth, dict) and _clean_oauth_token(oauth.get("accessToken")))
 
 
@@ -522,14 +534,6 @@ def _list_launch_transcript_paths(session, glob_fn=None):
     return sorted(paths)
 
 
-def _rotate_log_if_needed(log_path):
-    try:
-        if os.path.getsize(log_path) >= LOG_ROTATE_BYTES:
-            open(log_path, "w").close()
-    except OSError:
-        pass
-
-
 def _wrap_launch_with_transcript(session, spec, capture_transcript=True, env=None):
     if not capture_transcript:
         return spec
@@ -538,7 +542,6 @@ def _wrap_launch_with_transcript(session, spec, capture_transcript=True, env=Non
     script_args = env.get("CDX_SCRIPT_ARGS")
     transcript_path = _build_launch_transcript_path(session)
     os.makedirs(os.path.dirname(transcript_path), exist_ok=True)
-    _rotate_log_if_needed(transcript_path)
     if script_args:
         args = shlex.split(script_args)
         if "{transcript}" in args:
@@ -672,7 +675,8 @@ def _build_launch_spec(session, cwd=None, env_override=None, initial_prompt=None
         args += preference_args
         args += _extra_args(session)
         if initial_prompt:
-            args.append(initial_prompt)
+            # `--` keeps a prompt that starts with `-` from being read as an option.
+            args += ["--", initial_prompt]
         auth_home = _get_auth_home(session)
         claude_env = _claude_env(env, auth_home, own_terminal_title=True)
         oauth_token = _read_claude_launch_oauth_token(auth_home)
@@ -711,7 +715,8 @@ def _build_launch_spec(session, cwd=None, env_override=None, initial_prompt=None
         # failed only on the model pull.
         args = ["run", model] + _launch_config_args(session)
         if initial_prompt:
-            args.append(initial_prompt)
+            # `--` keeps a prompt that starts with `-` from being read as an option.
+            args += ["--", initial_prompt]
         return _wrap_launch_with_transcript(session, {
             "command": "ollama",
             "args": args,
@@ -728,7 +733,8 @@ def _build_launch_spec(session, cwd=None, env_override=None, initial_prompt=None
     args += _launch_config_args(session)
     args += preference_args
     if initial_prompt:
-        args.append(initial_prompt)
+        # `--` keeps a prompt that starts with `-` from being read as an option.
+        args += ["--", initial_prompt]
     return _wrap_launch_with_transcript(session, {
         "command": "codex",
         "args": args,
@@ -933,7 +939,8 @@ def _build_headless_launch_spec(session, cwd=None, env_override=None, initial_pr
         args += preference_args
         args += _extra_args(session)
         if initial_prompt:
-            args.append(initial_prompt)
+            # `--` keeps a prompt that starts with `-` from being read as an option.
+            args += ["--", initial_prompt]
         auth_home = _get_auth_home(session)
         claude_env = _claude_env(env, auth_home)
         oauth_token = _read_claude_launch_oauth_token(auth_home)
@@ -958,7 +965,8 @@ def _build_headless_launch_spec(session, cwd=None, env_override=None, initial_pr
             args += HEADLESS_CODEX_PERMISSION_ARGS.get(permission, [])
         args += preference_args
         if initial_prompt:
-            args.append(initial_prompt)
+            # `--` keeps a prompt that starts with `-` from being read as an option.
+            args += ["--", initial_prompt]
         return {
             "command": "codex",
             "args": args,

package/src/run_registry.py

@@ -8,6 +8,7 @@ from datetime import datetime, timezone
 from .errors import CdxError
 from .fs_utils import atomic_write
 from .run_usage import coerce_usage
+from .session_helpers import _process_is_running
 
 
 def utc_now_iso():
@@ -113,13 +114,7 @@ def _write_registry(path, data):
 
 
 def _is_pid_alive(pid):
-    if not pid:
-        return False
-    try:
-        os.kill(int(pid), 0)
-        return True
-    except (OSError, ValueError):
-        return False
+    return _process_is_running(pid)
 
 
 def _completed_after(run, since):
@@ -164,6 +159,22 @@ def _refresh_stale_runs(data):
     return changed
 
 
+# Every update rewrites the whole registry under the lock, so it must not grow
+# with every run ever made. Running runs are always kept; runs are newest first.
+MAX_FINISHED_RUNS = 500
+
+
+def _prune_finished_runs(data):
+    kept, finished = [], 0
+    for run in data["runs"]:
+        if run.get("status") != "running":
+            finished += 1
+            if finished > MAX_FINISHED_RUNS:
+                continue
+        kept.append(run)
+    data["runs"] = kept
+
+
 def _base_record(run_id, *, kind, session, provider, model, cwd, artifacts=None):
     return {
         "run_id": run_id,
@@ -218,6 +229,7 @@ class RunRegistry:
             data["runs"] = [run for run in data["runs"] if run.get("run_id") != run_id]
             record = _base_record(run_id, kind=kind, session=session, provider=provider, model=model, cwd=cwd, artifacts=artifacts)
             data["runs"].insert(0, record)
+            _prune_finished_runs(data)
             _write_registry(self.path, data)
         return record
 

package/src/run_usage.py

@@ -107,9 +107,17 @@ CACHE_WRITE_MULTIPLIER = 1.25
 DEFAULT_OUTPUT_MULTIPLIER = 5.0
 
 
+def price_entry(model, prices=None):
+    """This model's rates. Claude Code records a context variant such as
+    `claude-opus-5-5[1m]`, which is billed at the base model's rates."""
+    table = prices if prices is not None else token_prices()[0]
+    model = model or ""
+    return table.get(model) or table.get(model.split("[", 1)[0])
+
+
 def output_multiplier(model, prices=None):
     """This model's output-to-input price ratio."""
-    entry = (prices if prices is not None else token_prices()[0]).get(model or "")
+    entry = price_entry(model, prices)
     if not entry:
         return DEFAULT_OUTPUT_MULTIPLIER
     return entry["output"] / entry["input"] if entry["input"] else None
@@ -117,7 +125,7 @@ def output_multiplier(model, prices=None):
 
 def cache_read_multiplier(model, prices=None):
     """This model's cache-read/input ratio, with the legacy fallback."""
-    entry = (prices if prices is not None else token_prices()[0]).get(model or "")
+    entry = price_entry(model, prices)
     if not entry:
         return CACHE_READ_MULTIPLIER
     if not entry["input"]:
@@ -185,7 +193,7 @@ DEFAULT_TOKEN_PRICES = {
     "claude-fable-5-1": {"input": 10.0, "output": 50.0, "cache_read": 0.25},
     "claude-mythos-5-1": {"input": 10.0, "output": 50.0, "cache_read": 0.25},
     "claude-opus-5-5": {"input": 4.0, "output": 20.0, "cache_read": 0.2},
-    "claude-sonnet-5-5": {"input": 2.0, "output": 10.0},
+    "claude-sonnet-5-5": {"input": 2.0, "output": 10.0, "cache_read": 0.1},
     "claude-fable-5": {"input": 10.0, "output": 50.0},
     "claude-mythos-5": {"input": 10.0, "output": 50.0},
     "claude-opus-5": {"input": 5.0, "output": 25.0},
@@ -197,6 +205,9 @@ DEFAULT_TOKEN_PRICES = {
     "claude-sonnet-4-6": {"input": 3.0, "output": 15.0},
     "claude-sonnet-4-5": {"input": 3.0, "output": 15.0},
     "claude-sonnet-4-5-20250929": {"input": 3.0, "output": 15.0},
+    # ponytail: Haiku 5.5 costs 5x for prompts over 100K tokens; a run's usage
+    # does not say how its prompts were sized, so this is the base tier.
+    "claude-haiku-5-5": {"input": 0.1, "output": 0.5, "cache_read": 0.01},
     "claude-haiku-4-5": {"input": 1.0, "output": 5.0},
     "claude-haiku-4-5-20251001": {"input": 1.0, "output": 5.0},
     # OpenAI
@@ -218,7 +229,7 @@ DEFAULT_TOKEN_PRICES = {
     "gpt-5.4-nano-2026-03-17": {"input": 0.2, "output": 1.25},
     "gpt-5.3-codex": {"input": 1.75, "output": 14.0},
 }
-TOKEN_PRICES_REVIEWED = "2026-10-04"
+TOKEN_PRICES_REVIEWED = "2026-10-22"
 #: How long a review stays fresh before the staleness test asks for another.
 TOKEN_PRICES_MAX_AGE_DAYS = 90
 TOKEN_PRICES_ENV = "CDX_TOKEN_PRICES"
@@ -271,7 +282,7 @@ def estimate_cost(usage, model, prices=None):
     """
     if not model or not isinstance(usage, dict):
         return None
-    rate = (prices if prices is not None else token_prices()[0]).get(model)
+    rate = price_entry(model, prices)
     if rate is None:
         return None
     per_million = {

package/src/session_helpers.py

@@ -98,6 +98,10 @@ def _process_is_running(pid):
         return False
     if pid <= 0:
         return False
+    if sys.platform == "win32":
+        # os.kill(pid, 0) is not a probe on Windows: signal 0 is CTRL_C_EVENT,
+        # so it would send Ctrl+C to the process group instead of asking.
+        return _windows_process_is_running(pid)
     try:
         os.kill(pid, 0)
     except ProcessLookupError:
@@ -108,6 +112,20 @@ def _process_is_running(pid):
         return False
     return True
 
+
+def _windows_process_is_running(pid):
+    import ctypes
+
+    kernel32 = ctypes.windll.kernel32
+    handle = kernel32.OpenProcess(0x1000, False, pid)  # PROCESS_QUERY_LIMITED_INFORMATION
+    if not handle:
+        return kernel32.GetLastError() == 5  # ERROR_ACCESS_DENIED: alive, someone else's
+    try:
+        code = ctypes.c_ulong()
+        return bool(kernel32.GetExitCodeProcess(handle, ctypes.byref(code))) and code.value == 259  # STILL_ACTIVE
+    finally:
+        kernel32.CloseHandle(handle)
+
 def _normalize_provider(provider):
     value = provider or DEFAULT_PROVIDER
     if value not in ALLOWED_PROVIDERS:

package/src/session_service.py

@@ -145,6 +145,24 @@ def _seed_codex_auth_from_global(auth_home, env=None):
     return True
 
 
+_ON_OFF_SETTINGS = {"fast": "fast", "rtk": "rtk", "logics": "logics", "notify": "notify", "notify_preview": "notify preview"}
+
+
+def _parse_on_off(value, label):
+    if isinstance(value, bool):
+        return value
+    text = str(value).strip().lower()
+    if text in ("on", "true", "1", "yes"):
+        return True
+    if text in ("off", "false", "0", "no"):
+        return False
+    raise CdxError(f"Unsupported {label} value: {value}")
+
+
+def _has_control_chars(text):
+    return any(ord(ch) < 32 or ord(ch) == 127 for ch in text)
+
+
 def _normalize_launch_settings(settings, mark_fast_service_tier=True):
     normalized = {}
     if not settings:
@@ -172,77 +190,16 @@ def _normalize_launch_settings(settings, mark_fast_service_tier=True):
                 f"Unsupported permission: {settings['permission']} (allowed values: {allowed})"
             )
         normalized["permission"] = permission
-    if "fast" in settings and settings["fast"] is not None:
-        value = settings["fast"]
-        if isinstance(value, bool):
-            normalized["fast"] = value
-        else:
-            text = str(value).strip().lower()
-            if text in ("on", "true", "1", "yes"):
-                normalized["fast"] = True
-            elif text in ("off", "false", "0", "no"):
-                normalized["fast"] = False
-            else:
-                raise CdxError(f"Unsupported fast value: {settings['fast']}")
-        if normalized["fast"] is True and mark_fast_service_tier:
-            normalized["fastMode"] = "service_tier"
-        else:
-            normalized.pop("fastMode", None)
-        if settings.get("fastMode") == "service_tier" and normalized["fast"] is True:
-            normalized["fastMode"] = "service_tier"
-    if "rtk" in settings and settings["rtk"] is not None:
-        value = settings["rtk"]
-        if isinstance(value, bool):
-            normalized["rtk"] = value
-        else:
-            text = str(value).strip().lower()
-            if text in ("on", "true", "1", "yes"):
-                normalized["rtk"] = True
-            elif text in ("off", "false", "0", "no"):
-                normalized["rtk"] = False
-            else:
-                raise CdxError(f"Unsupported rtk value: {settings['rtk']}")
-    if "logics" in settings and settings["logics"] is not None:
-        value = settings["logics"]
-        if isinstance(value, bool):
-            normalized["logics"] = value
-        else:
-            text = str(value).strip().lower()
-            if text in ("on", "true", "1", "yes"):
-                normalized["logics"] = True
-            elif text in ("off", "false", "0", "no"):
-                normalized["logics"] = False
-            else:
-                raise CdxError(f"Unsupported logics value: {settings['logics']}")
-    if "notify" in settings and settings["notify"] is not None:
-        value = settings["notify"]
-        if isinstance(value, bool):
-            normalized["notify"] = value
-        else:
-            text = str(value).strip().lower()
-            if text in ("on", "true", "1", "yes"):
-                normalized["notify"] = True
-            elif text in ("off", "false", "0", "no"):
-                normalized["notify"] = False
-            else:
-                raise CdxError(f"Unsupported notify value: {settings['notify']}")
-    if "notify_preview" in settings and settings["notify_preview"] is not None:
-        value = settings["notify_preview"]
-        if isinstance(value, bool):
-            normalized["notify_preview"] = value
-        else:
-            text = str(value).strip().lower()
-            if text in ("on", "true", "1", "yes"):
-                normalized["notify_preview"] = True
-            elif text in ("off", "false", "0", "no"):
-                normalized["notify_preview"] = False
-            else:
-                raise CdxError(f"Unsupported notify preview value: {settings['notify_preview']}")
+    for key, label in _ON_OFF_SETTINGS.items():
+        if key in settings and settings[key] is not None:
+            normalized[key] = _parse_on_off(settings[key], label)
+    if normalized.get("fast") is True and (mark_fast_service_tier or settings.get("fastMode") == "service_tier"):
+        normalized["fastMode"] = "service_tier"
     if "model" in settings and settings["model"] is not None:
         model = str(settings["model"]).strip()
         if not model:
             raise CdxError("Model cannot be empty.")
-        if len(model) > MAX_LAUNCH_MODEL_LENGTH or any(ord(ch) < 32 or ord(ch) == 127 for ch in model):
+        if len(model) > MAX_LAUNCH_MODEL_LENGTH or _has_control_chars(model):
             raise CdxError("Model contains unsupported characters.")
         normalized["model"] = model
     if "fallback_model" in settings and settings["fallback_model"] is not None:
@@ -255,14 +212,14 @@ def _normalize_launch_settings(settings, mark_fast_service_tier=True):
         if any(not element for element in elements):
             raise CdxError("Fallback model cannot contain an empty entry.")
         for element in elements:
-            if len(element) > MAX_LAUNCH_MODEL_LENGTH or any(ord(ch) < 32 or ord(ch) == 127 for ch in element):
+            if len(element) > MAX_LAUNCH_MODEL_LENGTH or _has_control_chars(element):
                 raise CdxError("Fallback model contains unsupported characters.")
         normalized["fallback_model"] = ",".join(elements)
     if "extra_args" in settings and settings["extra_args"] is not None:
         extra = str(settings["extra_args"]).strip()
         if not extra:
             raise CdxError("Extra args cannot be empty.")
-        if len(extra) > MAX_LAUNCH_EXTRA_ARGS_LENGTH or any(ord(ch) < 32 or ord(ch) == 127 for ch in extra):
+        if len(extra) > MAX_LAUNCH_EXTRA_ARGS_LENGTH or _has_control_chars(extra):
             raise CdxError("Extra args contain unsupported characters.")
         # Parsed here, not at launch: a string that cannot be split into argv
         # should be rejected when it is set, not when a run fails days later.
@@ -329,7 +286,7 @@ def _normalize_session_label(label):
         raise CdxError("Session label is required")
     if len(text) > MAX_SESSION_LABEL_LENGTH:
         raise CdxError(f"Session label is too long (max {MAX_SESSION_LABEL_LENGTH} characters)")
-    if any(ord(ch) < 32 or ord(ch) == 127 for ch in text):
+    if _has_control_chars(text):
         raise CdxError("Session label cannot contain control characters")
     return text
 

package/src/session_status.py

@@ -9,6 +9,7 @@ import os
 from concurrent.futures import ThreadPoolExecutor, as_completed
 from datetime import datetime, timezone
 
+from .claude_credentials import claude_auth_type, setup_token_days_left
 from .claude_usage import _decode_jwt_claims
 from .config import PROVIDER_CLAUDE, PROVIDER_CODEX, get_cdx_home
 from .errors import CdxError
@@ -269,6 +270,7 @@ def _status_row_from_session(store, s):
     enabled = s.get("enabled", True) is not False
     row_status = status if enabled else None
     runtime = _session_runtime(store, s["name"])
+    auth_type = claude_auth_type(s["authHome"]) if s["provider"] == PROVIDER_CLAUDE and s.get("authHome") else None
     return {
         "session_name": s["name"],
         "label": s.get("label"),
@@ -284,6 +286,8 @@ def _status_row_from_session(store, s):
         "cwd": runtime.get("cwd") if runtime else None,
         "status": "enabled" if enabled else "disabled",
         "auth_status": (s.get("auth") or {}).get("status") or "unknown",
+        "auth_type": auth_type,
+        "auth_expires_in_days": setup_token_days_left(s["authHome"]) if auth_type == "setup-token" else None,
         "auth_checked_at": _to_local_iso((s.get("auth") or {}).get("lastCheckedAt")),
         "remaining_5h_pct": _normalize_pct_value(row_status.get("remaining_5h_pct")) if row_status else None,
         "remaining_week_pct": _normalize_pct_value(row_status.get("remaining_week_pct")) if row_status else None,

package/src/session_store.py

@@ -1,12 +1,12 @@
 import json
 import os
 import sys
-import tempfile
 from contextlib import contextmanager
 from pathlib import Path
 
 from .errors import CdxError
 from .fs_utils import atomic_write
+from .run_registry import REGISTRY_LOCK_TIMEOUT_SECONDS, _acquire_posix_lock, _acquire_windows_lock
 
 
 def _ensure_dir(path):
@@ -34,23 +34,8 @@ def _read_json(file_path, fallback):
 
 
 def _write_json(file_path, value):
-    directory = os.path.dirname(file_path)
-    _ensure_dir(directory)
-    fd, temp_path = tempfile.mkstemp(prefix=f".{os.path.basename(file_path)}.", suffix=".tmp", dir=directory)
-    try:
-        with os.fdopen(fd, "w", encoding="utf-8") as f:
-            json.dump(value, f, indent=2)
-            f.write("\n")
-            f.flush()
-            os.fsync(f.fileno())
-        os.replace(temp_path, file_path)
-        _fsync_directory(directory)
-    except Exception:
-        try:
-            os.unlink(temp_path)
-        except FileNotFoundError:
-            pass
-        raise
+    _ensure_dir(os.path.dirname(file_path))
+    atomic_write(file_path, json.dumps(value, indent=2) + "\n")
 
 
 def _fsync_directory(directory):
@@ -71,11 +56,8 @@ def _file_lock(lock_path):
     with open(lock_path, "a", encoding="utf-8") as lock:
         if sys.platform == "win32":
             import msvcrt
-            try:
-                lock.seek(0)
-                msvcrt.locking(lock.fileno(), msvcrt.LK_LOCK, 1)
-            except OSError as error:
-                raise CdxError(f"Failed to lock session store: {error}") from error
+            # Bounded wait, not LK_LOCK's ten one-second tries (see run_registry).
+            _acquire_windows_lock(lock, REGISTRY_LOCK_TIMEOUT_SECONDS, "session store")
             try:
                 yield
             finally:
@@ -89,10 +71,7 @@ def _file_lock(lock_path):
                 import fcntl
             except ImportError as error:
                 raise CdxError("Session store locking requires fcntl on this platform") from error
-            try:
-                fcntl.flock(lock.fileno(), fcntl.LOCK_EX)
-            except OSError as error:
-                raise CdxError(f"Failed to lock session store: {error}") from error
+            _acquire_posix_lock(lock, REGISTRY_LOCK_TIMEOUT_SECONDS, "session store")
             try:
                 yield
             finally:

package/src/status_view.py

@@ -74,6 +74,17 @@ def _format_credits(value, empty="n/a"):
         return str(value)
 
 
+def _auth_type_label(row):
+    """`setup-token`, or with its remaining days once renewal is due."""
+    from .claude_credentials import SETUP_TOKEN_WARN_DAYS
+
+    label = row.get("auth_type") or "-"
+    days = row.get("auth_expires_in_days")
+    if days is None or days > SETUP_TOKEN_WARN_DAYS:
+        return label, False
+    return (f"{label} expired" if days < 0 else f"{label} {days}d"), True
+
+
 def _format_status_rows(rows, use_color=False, small=False):
     active_rows = [r for r in rows if r.get("enabled", True) is not False]
     def positive(value):
@@ -90,18 +101,19 @@ def _format_status_rows(rows, use_color=False, small=False):
     credits_visible = any(r.get("credits") is not None for r in active_rows)
     has_provider = len({r["provider"] for r in rows}) > 1 and not small
     has_label = any(r.get("label") for r in rows) and not small
+    type_visible = any(r.get("auth_type") for r in active_rows) and not small
     if small:
         headers = ["SESSION", "STATUS", "OK", "5H", "WEEK"] + [name for name, visible in zip(["RESETS", "RESET 5H", "RESET WEEK"], reset_visible) if visible]
     elif has_provider:
         headers = ["SESSION", "PROV."]
         if has_label:
             headers.append("LABEL")
-        headers += ["STATUS", "AUTH", "OK", "5H", "WEEK"] + (["BLOCK"] if block_visible else []) + (["CR"] if credits_visible else []) + [name for name, visible in zip(["RESETS", "RESET 5H", "RESET WEEK"], reset_visible) if visible] + ["UPDATED"]
+        headers += ["STATUS", "AUTH"] + (["TYPE"] if type_visible else []) + ["OK", "5H", "WEEK"] + (["BLOCK"] if block_visible else []) + (["CR"] if credits_visible else []) + [name for name, visible in zip(["RESETS", "RESET 5H", "RESET WEEK"], reset_visible) if visible] + ["UPDATED"]
     else:
         headers = ["SESSION"]
         if has_label:
             headers.append("LABEL")
-        headers += ["STATUS", "AUTH", "OK", "5H", "WEEK"] + (["BLOCK"] if block_visible else []) + (["CR"] if credits_visible else []) + [name for name, visible in zip(["RESETS", "RESET 5H", "RESET WEEK"], reset_visible) if visible] + ["UPDATED"]
+        headers += ["STATUS", "AUTH"] + (["TYPE"] if type_visible else []) + ["OK", "5H", "WEEK"] + (["BLOCK"] if block_visible else []) + (["CR"] if credits_visible else []) + [name for name, visible in zip(["RESETS", "RESET 5H", "RESET WEEK"], reset_visible) if visible] + ["UPDATED"]
     if not rows:
         if small:
             return "SESSION  STATUS  OK  5H  WEEK  RESETS  RESET 5H  RESET WEEK\nNo saved sessions yet."
@@ -130,6 +142,9 @@ def _format_status_rows(rows, use_color=False, small=False):
             auth = _format_auth_status(r)
             auth_color = "32" if auth == "logged" else "31" if auth == "logged out" else "2"
             base.append(_style(auth, auth_color, use_color))
+            if type_visible:
+                label, warn = _auth_type_label(r)
+                base.append(_style(label, "33" if warn else "2", use_color))
         if r.get("enabled", True) is False:
             usage_columns = [_style("-", "2", use_color)] * 6
         else:
@@ -365,6 +380,7 @@ def _format_status_detail(row, use_color=False):
         f"{_style('Provider:', '1', use_color)} {row.get('provider') or 'n/a'}",
         f"{_style('Status:', '1', use_color)} {_style(row.get('status') or ('enabled' if row.get('enabled', True) else 'disabled'), '2' if row.get('enabled', True) is False else '32', use_color)}",
         f"{_style('Auth:', '1', use_color)} {_style(auth, auth_color, use_color)}",
+        *([f"{_style('Auth type:', '1', use_color)} {_auth_type_label(row)[0]}"] if row.get("auth_type") else []),
         f"{_style('Available:', '1', use_color)} {_style_pct(row.get('available_pct'), use_color)}",
         f"{_style('5h left:', '1', use_color)} {_style_pct(row.get('remaining_5h_pct'), use_color)}",
         f"{_style('Week left:', '1', use_color)} {_style_pct(row.get('remaining_week_pct'), use_color)}",

package/src/tray_instance.py

@@ -6,9 +6,10 @@ per-user temporary directory, then `cdx-tray/companion.pid`.
 """
 import os
 import platform
-import subprocess
 import tempfile
 
+from .session_helpers import _process_is_running
+
 
 def lock_path(env=None):
     env = os.environ if env is None else env
@@ -20,20 +21,8 @@ def lock_path(env=None):
 
 
 def _is_alive(pid):
-    if platform.system() == "Windows":
-        result = subprocess.run(
-            ["tasklist", "/fi", f"PID eq {pid}", "/nh"],
-            capture_output=True, text=True, check=False,
-        )
-        return str(pid) in result.stdout
-    try:
-        os.kill(pid, 0)
-    except (ProcessLookupError, ValueError):
-        return False
-    except PermissionError:
-        # Alive, owned by someone else. Still a reason not to start a second.
-        return True
-    return True
+    # Alive includes owned by someone else: still a reason not to start a second.
+    return _process_is_running(pid)
 
 
 def companion_instance(env=None):