cdx-manager 0.21.4 → 0.21.6

package/src/provider_runtime.py

@@ -12,7 +12,7 @@ import uuid
 from datetime import datetime, timezone
 
 from .agent_notify import launch_notify_env, notifications_enabled
-from .claude_credentials import peek_keychain_credentials
+from .claude_credentials import peek_keychain_credentials, read_claude_login_file
 from .claude_usage import _clean_oauth_token, _decode_jwt_claims, _secure_storage_overrides, claude_profile_store_dir
 from .codex_usage import codex_auth_lock, diagnostic_needs_codex_login, fetch_codex_rate_limit_diagnostic
 from .config import (
@@ -26,7 +26,6 @@ from .config import (
 )
 from .errors import CdxError
 
-LOG_ROTATE_BYTES = 10 * 1024 * 1024  # 10 MB
 TERMINAL_TITLE_SEPARATOR = " — "
 # Providers redraw their own title while their TUI runs, so a single write at
 # launch does not survive. Re-asserting on this interval takes the title back
@@ -250,12 +249,8 @@ def _read_anthropic_oauth_token(auth_home):
 
 
 def _has_local_claude_auth(auth_home):
-    try:
-        with open(os.path.join(auth_home, ".claude", ".credentials.json"), encoding="utf-8") as handle:
-            credentials = json.load(handle)
-    except (FileNotFoundError, OSError, json.JSONDecodeError):
-        return False
-    oauth = credentials.get("claudeAiOauth") if isinstance(credentials, dict) else None
+    credentials = read_claude_login_file(auth_home)
+    oauth = credentials.get("claudeAiOauth") if credentials else None
     return bool(isinstance(oauth, dict) and _clean_oauth_token(oauth.get("accessToken")))
 
 
@@ -424,11 +419,11 @@ def _normalize_reasoning_effort(reasoning_effort=None, power=None, usage="Unsupp
     if alias == "":
         raise CdxError(usage)
     if effort and effort not in REASONING_EFFORT_VALUES:
-        raise CdxError(f"Unsupported reasoning effort: {reasoning_effort}")
+        raise CdxError(f"Unsupported reasoning effort: {reasoning_effort}", code="invalid_reasoning_effort")
     if alias and alias not in REASONING_EFFORT_VALUES:
         raise CdxError(f"Unsupported power: {power}")
     if effort and alias and effort != alias:
-        raise CdxError("--reasoning-effort and --power must match when both are provided.")
+        raise CdxError("--reasoning-effort and --power must match when both are provided.", code="invalid_reasoning_effort")
     resolved = effort or alias
     if not resolved:
         return {}
@@ -539,14 +534,6 @@ def _list_launch_transcript_paths(session, glob_fn=None):
     return sorted(paths)
 
 
-def _rotate_log_if_needed(log_path):
-    try:
-        if os.path.getsize(log_path) >= LOG_ROTATE_BYTES:
-            open(log_path, "w").close()
-    except OSError:
-        pass
-
-
 def _wrap_launch_with_transcript(session, spec, capture_transcript=True, env=None):
     if not capture_transcript:
         return spec
@@ -555,7 +542,6 @@ def _wrap_launch_with_transcript(session, spec, capture_transcript=True, env=Non
     script_args = env.get("CDX_SCRIPT_ARGS")
     transcript_path = _build_launch_transcript_path(session)
     os.makedirs(os.path.dirname(transcript_path), exist_ok=True)
-    _rotate_log_if_needed(transcript_path)
     if script_args:
         args = shlex.split(script_args)
         if "{transcript}" in args:
@@ -587,6 +573,19 @@ def _rtk_enabled(session):
     return (session.get("launch") or {}).get("rtk") is True
 
 
+# Claude Code passes credentials (including the setup-token cdx injects) to
+# the Bash commands, hooks and MCP servers it starts unless this is set. Opt-in:
+# it also strips other secrets an agent may need and, on Linux, isolates Bash
+# from host processes (`ps`, `kill`).
+CLAUDE_SCRUB_ENV = "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB"
+
+
+def _scrub_env(session):
+    if session.get("provider") == PROVIDER_CLAUDE and (session.get("launch") or {}).get("scrub_env") is True:
+        return {CLAUDE_SCRUB_ENV: "1"}
+    return {}
+
+
 def _logics_manager_available(path=None):
     return shutil.which("logics-manager", path=path) is not None
 
@@ -676,6 +675,7 @@ def _build_launch_spec(session, cwd=None, env_override=None, initial_prompt=None
     for key, value in _shared_tool_cache_overrides(env).items():
         env.setdefault(key, value)
     env.update(launch_notify_env(session, notifications_enabled(session)))
+    env.update(_scrub_env(session))
     preference_args = _launch_preference_args(session, env=env)
     if session["provider"] == PROVIDER_CLAUDE:
         launch = session.get("launch") or {}
@@ -929,6 +929,7 @@ def _build_headless_launch_spec(session, cwd=None, env_override=None, initial_pr
     # Headless runs read the same home, and so the same hooks, as an interactive
     # launch. Their caller already learns of completion from the return value.
     env.update(launch_notify_env(session, enabled=False))
+    env.update(_scrub_env(session))
     preference_args = _launch_preference_args(session, env=env)
     launch = session.get("launch") or {}
     power = _launch_power(session)
@@ -1070,6 +1071,32 @@ def _signal_child_group(child, sig):
         return False
 
 
+def _raise_keyboard_interrupt(_signum, _frame):
+    raise KeyboardInterrupt
+
+
+def _route_termination_to_interrupt():
+    """Make SIGTERM and SIGHUP raise KeyboardInterrupt; returns what to restore."""
+    previous = {}
+    for name in ("SIGTERM", "SIGHUP"):
+        sig = getattr(signal, name, None)
+        if sig is None:
+            continue
+        try:
+            previous[sig] = signal.signal(sig, _raise_keyboard_interrupt)
+        except (ValueError, OSError):  # not the main thread, or not settable here
+            pass
+    return previous
+
+
+def _restore_signal_handlers(previous):
+    for sig, handler in previous.items():
+        try:
+            signal.signal(sig, handler)
+        except (ValueError, OSError):
+            pass
+
+
 def _terminate_child_tree(child):
     if not _signal_child_group(child, signal.SIGTERM):
         try:
@@ -1125,14 +1152,18 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
             )
         except FileNotFoundError as error:
             _combine_headless_transcript(paths)
-            cdx_error = CdxError(f"{spec['label']} CLI not found on PATH: {spec['command']}", 127)
+            cdx_error = CdxError(f"{spec['label']} CLI not found on PATH: {spec['command']}", 127, code="provider_cli_not_found")
             cdx_error.run_info = _headless_run_info(paths, spec, start_time, 127)
             raise cdx_error from error
         except OSError as error:
             _combine_headless_transcript(paths)
-            cdx_error = CdxError(f"Failed to start {spec['label']}: {error}", 126)
+            cdx_error = CdxError(f"Failed to start {spec['label']}: {error}", 126, code="provider_start_failed")
             cdx_error.run_info = _headless_run_info(paths, spec, start_time, 126)
             raise cdx_error from error
+        # SIGTERM/SIGHUP (kill, systemctl stop, a closed SSH session) unwind
+        # like Ctrl+C: the provider's own process group would otherwise outlive
+        # this supervisor and keep its run "running" forever.
+        previous_handlers = _route_termination_to_interrupt()
         try:
             if timeout_seconds is None:
                 child.wait()
@@ -1150,6 +1181,8 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
             # the run still gets a terminal record.
             cancelled = True
             _terminate_child_tree(child)
+        finally:
+            _restore_signal_handlers(previous_handlers)
 
     if cancelled:
         _combine_headless_transcript(paths)
@@ -1297,7 +1330,7 @@ def _probe_provider_auth_status(session, spawn_sync=None, env_override=None, tru
             result = subprocess.run(
                 [command] + spec["args"],
                 env=spec["env"],
-                capture_output=True, text=True,
+                capture_output=True, text=True, encoding="utf-8", errors="replace",
                 timeout=AUTH_PROBE_TIMEOUT_SECONDS,
             )
             output = (result.stdout or "") + (result.stderr or "")

package/src/run_registry.py

@@ -8,6 +8,7 @@ from datetime import datetime, timezone
 from .errors import CdxError
 from .fs_utils import atomic_write
 from .run_usage import coerce_usage
+from .session_helpers import _process_is_running
 
 
 def utc_now_iso():
@@ -113,13 +114,7 @@ def _write_registry(path, data):
 
 
 def _is_pid_alive(pid):
-    if not pid:
-        return False
-    try:
-        os.kill(int(pid), 0)
-        return True
-    except (OSError, ValueError):
-        return False
+    return _process_is_running(pid)
 
 
 def _completed_after(run, since):
@@ -164,6 +159,22 @@ def _refresh_stale_runs(data):
     return changed
 
 
+# Every update rewrites the whole registry under the lock, so it must not grow
+# with every run ever made. Running runs are always kept; runs are newest first.
+MAX_FINISHED_RUNS = 500
+
+
+def _prune_finished_runs(data):
+    kept, finished = [], 0
+    for run in data["runs"]:
+        if run.get("status") != "running":
+            finished += 1
+            if finished > MAX_FINISHED_RUNS:
+                continue
+        kept.append(run)
+    data["runs"] = kept
+
+
 def _base_record(run_id, *, kind, session, provider, model, cwd, artifacts=None):
     return {
         "run_id": run_id,
@@ -218,6 +229,7 @@ class RunRegistry:
             data["runs"] = [run for run in data["runs"] if run.get("run_id") != run_id]
             record = _base_record(run_id, kind=kind, session=session, provider=provider, model=model, cwd=cwd, artifacts=artifacts)
             data["runs"].insert(0, record)
+            _prune_finished_runs(data)
             _write_registry(self.path, data)
         return record
 

package/src/run_usage.py

@@ -107,9 +107,17 @@ CACHE_WRITE_MULTIPLIER = 1.25
 DEFAULT_OUTPUT_MULTIPLIER = 5.0
 
 
+def price_entry(model, prices=None):
+    """This model's rates. Claude Code records a context variant such as
+    `claude-opus-5-5[1m]`, which is billed at the base model's rates."""
+    table = prices if prices is not None else token_prices()[0]
+    model = model or ""
+    return table.get(model) or table.get(model.split("[", 1)[0])
+
+
 def output_multiplier(model, prices=None):
     """This model's output-to-input price ratio."""
-    entry = (prices if prices is not None else token_prices()[0]).get(model or "")
+    entry = price_entry(model, prices)
     if not entry:
         return DEFAULT_OUTPUT_MULTIPLIER
     return entry["output"] / entry["input"] if entry["input"] else None
@@ -117,7 +125,7 @@ def output_multiplier(model, prices=None):
 
 def cache_read_multiplier(model, prices=None):
     """This model's cache-read/input ratio, with the legacy fallback."""
-    entry = (prices if prices is not None else token_prices()[0]).get(model or "")
+    entry = price_entry(model, prices)
     if not entry:
         return CACHE_READ_MULTIPLIER
     if not entry["input"]:
@@ -185,7 +193,7 @@ DEFAULT_TOKEN_PRICES = {
     "claude-fable-5-1": {"input": 10.0, "output": 50.0, "cache_read": 0.25},
     "claude-mythos-5-1": {"input": 10.0, "output": 50.0, "cache_read": 0.25},
     "claude-opus-5-5": {"input": 4.0, "output": 20.0, "cache_read": 0.2},
-    "claude-sonnet-5-5": {"input": 2.0, "output": 10.0},
+    "claude-sonnet-5-5": {"input": 2.0, "output": 10.0, "cache_read": 0.1},
     "claude-fable-5": {"input": 10.0, "output": 50.0},
     "claude-mythos-5": {"input": 10.0, "output": 50.0},
     "claude-opus-5": {"input": 5.0, "output": 25.0},
@@ -197,6 +205,9 @@ DEFAULT_TOKEN_PRICES = {
     "claude-sonnet-4-6": {"input": 3.0, "output": 15.0},
     "claude-sonnet-4-5": {"input": 3.0, "output": 15.0},
     "claude-sonnet-4-5-20250929": {"input": 3.0, "output": 15.0},
+    # ponytail: Haiku 5.5 costs 5x for prompts over 100K tokens; a run's usage
+    # does not say how its prompts were sized, so this is the base tier.
+    "claude-haiku-5-5": {"input": 0.1, "output": 0.5, "cache_read": 0.01},
     "claude-haiku-4-5": {"input": 1.0, "output": 5.0},
     "claude-haiku-4-5-20251001": {"input": 1.0, "output": 5.0},
     # OpenAI
@@ -218,7 +229,7 @@ DEFAULT_TOKEN_PRICES = {
     "gpt-5.4-nano-2026-03-17": {"input": 0.2, "output": 1.25},
     "gpt-5.3-codex": {"input": 1.75, "output": 14.0},
 }
-TOKEN_PRICES_REVIEWED = "2026-10-04"
+TOKEN_PRICES_REVIEWED = "2026-10-22"
 #: How long a review stays fresh before the staleness test asks for another.
 TOKEN_PRICES_MAX_AGE_DAYS = 90
 TOKEN_PRICES_ENV = "CDX_TOKEN_PRICES"
@@ -271,7 +282,7 @@ def estimate_cost(usage, model, prices=None):
     """
     if not model or not isinstance(usage, dict):
         return None
-    rate = (prices if prices is not None else token_prices()[0]).get(model)
+    rate = price_entry(model, prices)
     if rate is None:
         return None
     per_million = {

package/src/session_helpers.py

@@ -98,6 +98,10 @@ def _process_is_running(pid):
         return False
     if pid <= 0:
         return False
+    if sys.platform == "win32":
+        # os.kill(pid, 0) is not a probe on Windows: signal 0 is CTRL_C_EVENT,
+        # so it would send Ctrl+C to the process group instead of asking.
+        return _windows_process_is_running(pid)
     try:
         os.kill(pid, 0)
     except ProcessLookupError:
@@ -108,6 +112,20 @@ def _process_is_running(pid):
         return False
     return True
 
+
+def _windows_process_is_running(pid):
+    import ctypes
+
+    kernel32 = ctypes.windll.kernel32
+    handle = kernel32.OpenProcess(0x1000, False, pid)  # PROCESS_QUERY_LIMITED_INFORMATION
+    if not handle:
+        return kernel32.GetLastError() == 5  # ERROR_ACCESS_DENIED: alive, someone else's
+    try:
+        code = ctypes.c_ulong()
+        return bool(kernel32.GetExitCodeProcess(handle, ctypes.byref(code))) and code.value == 259  # STILL_ACTIVE
+    finally:
+        kernel32.CloseHandle(handle)
+
 def _normalize_provider(provider):
     value = provider or DEFAULT_PROVIDER
     if value not in ALLOWED_PROVIDERS:

package/src/session_service.py

@@ -26,7 +26,6 @@ the re-exports as unused and callers importing through this module break.
 `test_session_service_facade_still_exposes_every_name_its_callers_import`
 guards that.
 """
-import json
 import os
 import shutil
 import tempfile
@@ -49,8 +48,11 @@ from .config import (
     normalize_permission,
     split_extra_args,
 )
+from .config import (
+    parse_on_off as _parse_on_off,
+)
 from .errors import CdxError
-from .fs_utils import atomic_write, remove_tree
+from .fs_utils import remove_tree
 from .session_backup import (  # noqa: F401  (re-exported for callers and tests)
     _FORCE_IMPORT_PRESERVED_PROFILE_PATHS,
     _auth_bundle_paths,
@@ -145,6 +147,13 @@ def _seed_codex_auth_from_global(auth_home, env=None):
     return True
 
 
+_ON_OFF_SETTINGS = {"fast": "fast", "rtk": "rtk", "logics": "logics", "notify": "notify", "notify_preview": "notify preview", "scrub_env": "scrub env"}
+
+
+def _has_control_chars(text):
+    return any(ord(ch) < 32 or ord(ch) == 127 for ch in text)
+
+
 def _normalize_launch_settings(settings, mark_fast_service_tier=True):
     normalized = {}
     if not settings:
@@ -157,7 +166,7 @@ def _normalize_launch_settings(settings, mark_fast_service_tier=True):
     if "reasoning_effort" in settings and settings["reasoning_effort"] is not None:
         effort = str(settings["reasoning_effort"]).strip().lower()
         if effort not in LAUNCH_REASONING_EFFORT_VALUES:
-            raise CdxError(f"Unsupported reasoning effort: {settings['reasoning_effort']}")
+            raise CdxError(f"Unsupported reasoning effort: {settings['reasoning_effort']}", code="invalid_reasoning_effort")
         normalized["reasoning_effort"] = effort
     if "permission" in settings and settings["permission"] is not None:
         # Accepts the provider-native aliases (workspace-write, read-only,
@@ -172,77 +181,16 @@ def _normalize_launch_settings(settings, mark_fast_service_tier=True):
                 f"Unsupported permission: {settings['permission']} (allowed values: {allowed})"
             )
         normalized["permission"] = permission
-    if "fast" in settings and settings["fast"] is not None:
-        value = settings["fast"]
-        if isinstance(value, bool):
-            normalized["fast"] = value
-        else:
-            text = str(value).strip().lower()
-            if text in ("on", "true", "1", "yes"):
-                normalized["fast"] = True
-            elif text in ("off", "false", "0", "no"):
-                normalized["fast"] = False
-            else:
-                raise CdxError(f"Unsupported fast value: {settings['fast']}")
-        if normalized["fast"] is True and mark_fast_service_tier:
-            normalized["fastMode"] = "service_tier"
-        else:
-            normalized.pop("fastMode", None)
-        if settings.get("fastMode") == "service_tier" and normalized["fast"] is True:
-            normalized["fastMode"] = "service_tier"
-    if "rtk" in settings and settings["rtk"] is not None:
-        value = settings["rtk"]
-        if isinstance(value, bool):
-            normalized["rtk"] = value
-        else:
-            text = str(value).strip().lower()
-            if text in ("on", "true", "1", "yes"):
-                normalized["rtk"] = True
-            elif text in ("off", "false", "0", "no"):
-                normalized["rtk"] = False
-            else:
-                raise CdxError(f"Unsupported rtk value: {settings['rtk']}")
-    if "logics" in settings and settings["logics"] is not None:
-        value = settings["logics"]
-        if isinstance(value, bool):
-            normalized["logics"] = value
-        else:
-            text = str(value).strip().lower()
-            if text in ("on", "true", "1", "yes"):
-                normalized["logics"] = True
-            elif text in ("off", "false", "0", "no"):
-                normalized["logics"] = False
-            else:
-                raise CdxError(f"Unsupported logics value: {settings['logics']}")
-    if "notify" in settings and settings["notify"] is not None:
-        value = settings["notify"]
-        if isinstance(value, bool):
-            normalized["notify"] = value
-        else:
-            text = str(value).strip().lower()
-            if text in ("on", "true", "1", "yes"):
-                normalized["notify"] = True
-            elif text in ("off", "false", "0", "no"):
-                normalized["notify"] = False
-            else:
-                raise CdxError(f"Unsupported notify value: {settings['notify']}")
-    if "notify_preview" in settings and settings["notify_preview"] is not None:
-        value = settings["notify_preview"]
-        if isinstance(value, bool):
-            normalized["notify_preview"] = value
-        else:
-            text = str(value).strip().lower()
-            if text in ("on", "true", "1", "yes"):
-                normalized["notify_preview"] = True
-            elif text in ("off", "false", "0", "no"):
-                normalized["notify_preview"] = False
-            else:
-                raise CdxError(f"Unsupported notify preview value: {settings['notify_preview']}")
+    for key, label in _ON_OFF_SETTINGS.items():
+        if key in settings and settings[key] is not None:
+            normalized[key] = _parse_on_off(settings[key], label)
+    if normalized.get("fast") is True and (mark_fast_service_tier or settings.get("fastMode") == "service_tier"):
+        normalized["fastMode"] = "service_tier"
     if "model" in settings and settings["model"] is not None:
         model = str(settings["model"]).strip()
         if not model:
             raise CdxError("Model cannot be empty.")
-        if len(model) > MAX_LAUNCH_MODEL_LENGTH or any(ord(ch) < 32 or ord(ch) == 127 for ch in model):
+        if len(model) > MAX_LAUNCH_MODEL_LENGTH or _has_control_chars(model):
             raise CdxError("Model contains unsupported characters.")
         normalized["model"] = model
     if "fallback_model" in settings and settings["fallback_model"] is not None:
@@ -255,14 +203,14 @@ def _normalize_launch_settings(settings, mark_fast_service_tier=True):
         if any(not element for element in elements):
             raise CdxError("Fallback model cannot contain an empty entry.")
         for element in elements:
-            if len(element) > MAX_LAUNCH_MODEL_LENGTH or any(ord(ch) < 32 or ord(ch) == 127 for ch in element):
+            if len(element) > MAX_LAUNCH_MODEL_LENGTH or _has_control_chars(element):
                 raise CdxError("Fallback model contains unsupported characters.")
         normalized["fallback_model"] = ",".join(elements)
     if "extra_args" in settings and settings["extra_args"] is not None:
         extra = str(settings["extra_args"]).strip()
         if not extra:
             raise CdxError("Extra args cannot be empty.")
-        if len(extra) > MAX_LAUNCH_EXTRA_ARGS_LENGTH or any(ord(ch) < 32 or ord(ch) == 127 for ch in extra):
+        if len(extra) > MAX_LAUNCH_EXTRA_ARGS_LENGTH or _has_control_chars(extra):
             raise CdxError("Extra args contain unsupported characters.")
         # Parsed here, not at launch: a string that cannot be split into argv
         # should be rejected when it is set, not when a run fails days later.
@@ -303,24 +251,18 @@ def _parse_status_timeout_seconds(value):
 
 
 def _ensure_claude_attribution_disabled(auth_home):
-    settings_dir = os.path.join(auth_home, ".claude")
-    settings_path = os.path.join(settings_dir, "settings.json")
-    try:
-        os.makedirs(settings_dir, exist_ok=True)
-        with open(settings_path, encoding="utf-8") as handle:
-            settings = json.load(handle)
-    except FileNotFoundError:
-        settings = {}
-    except (OSError, json.JSONDecodeError):
-        settings = {}
-    if not isinstance(settings, dict):
-        settings = {}
-    settings["includeCoAuthoredBy"] = False
-    try:
-        atomic_write(settings_path, json.dumps(settings, indent=2, sort_keys=True) + "\n", mode=0o644)
-    except OSError:
+    # Same reader/writer as the notification hooks: an unparseable file is the
+    # user's and is left alone, a symlink stays a symlink, the mode is kept.
+    from .agent_notify import _read_json, _write_json
+
+    settings_path = os.path.join(auth_home, ".claude", "settings.json")
+    settings = _read_json(settings_path)
+    if settings is None:
         return False
-    return True
+    if settings.get("includeCoAuthoredBy") is False:
+        return True
+    settings["includeCoAuthoredBy"] = False
+    return _write_json(settings_path, settings)
 
 
 def _normalize_session_label(label):
@@ -329,7 +271,7 @@ def _normalize_session_label(label):
         raise CdxError("Session label is required")
     if len(text) > MAX_SESSION_LABEL_LENGTH:
         raise CdxError(f"Session label is too long (max {MAX_SESSION_LABEL_LENGTH} characters)")
-    if any(ord(ch) < 32 or ord(ch) == 127 for ch in text):
+    if _has_control_chars(text):
         raise CdxError("Session label cannot contain control characters")
     return text
 
@@ -377,7 +319,7 @@ def unset_launch_settings(store, name, keys):
         raise CdxError("At least one launch setting is required.")
     allowed = {
         "power", "reasoning_effort", "reasoningEffort", "permission", "fast", "rtk", "logics", "notify", "notify_preview",
-        "model", "fallback_model", "budget", "extra_args", "priority",
+        "scrub_env", "model", "fallback_model", "budget", "extra_args", "priority",
     }
     unknown = [key for key in keys if key not in allowed]
     if unknown:
@@ -911,7 +853,7 @@ def launch_session(store, name, resume=False):
     if not session:
         raise CdxError(f"Unknown session: {name}")
     if session.get("enabled", True) is False:
-        raise CdxError(f"Session is disabled: {name}")
+        raise CdxError(f"Session is disabled: {name}", code="session_disabled")
     # Reconcile the prior Claude conversation before a fresh launch replaces
     # its id. This is a single exact transcript lookup, not a global stats scan.
     backfill_interactive_usage(store, name=name, dry_run=False)

package/src/session_status.py

@@ -9,6 +9,7 @@ import os
 from concurrent.futures import ThreadPoolExecutor, as_completed
 from datetime import datetime, timezone
 
+from .claude_credentials import claude_auth_type, setup_token_days_left
 from .claude_usage import _decode_jwt_claims
 from .config import PROVIDER_CLAUDE, PROVIDER_CODEX, get_cdx_home
 from .errors import CdxError
@@ -269,6 +270,7 @@ def _status_row_from_session(store, s):
     enabled = s.get("enabled", True) is not False
     row_status = status if enabled else None
     runtime = _session_runtime(store, s["name"])
+    auth_type = claude_auth_type(s["authHome"]) if s["provider"] == PROVIDER_CLAUDE and s.get("authHome") else None
     return {
         "session_name": s["name"],
         "label": s.get("label"),
@@ -284,6 +286,8 @@ def _status_row_from_session(store, s):
         "cwd": runtime.get("cwd") if runtime else None,
         "status": "enabled" if enabled else "disabled",
         "auth_status": (s.get("auth") or {}).get("status") or "unknown",
+        "auth_type": auth_type,
+        "auth_expires_in_days": setup_token_days_left(s["authHome"]) if auth_type == "setup-token" else None,
         "auth_checked_at": _to_local_iso((s.get("auth") or {}).get("lastCheckedAt")),
         "remaining_5h_pct": _normalize_pct_value(row_status.get("remaining_5h_pct")) if row_status else None,
         "remaining_week_pct": _normalize_pct_value(row_status.get("remaining_week_pct")) if row_status else None,

package/src/session_store.py

@@ -1,12 +1,12 @@
 import json
 import os
 import sys
-import tempfile
 from contextlib import contextmanager
 from pathlib import Path
 
 from .errors import CdxError
 from .fs_utils import atomic_write
+from .run_registry import REGISTRY_LOCK_TIMEOUT_SECONDS, _acquire_posix_lock, _acquire_windows_lock
 
 
 def _ensure_dir(path):
@@ -34,23 +34,8 @@ def _read_json(file_path, fallback):
 
 
 def _write_json(file_path, value):
-    directory = os.path.dirname(file_path)
-    _ensure_dir(directory)
-    fd, temp_path = tempfile.mkstemp(prefix=f".{os.path.basename(file_path)}.", suffix=".tmp", dir=directory)
-    try:
-        with os.fdopen(fd, "w", encoding="utf-8") as f:
-            json.dump(value, f, indent=2)
-            f.write("\n")
-            f.flush()
-            os.fsync(f.fileno())
-        os.replace(temp_path, file_path)
-        _fsync_directory(directory)
-    except Exception:
-        try:
-            os.unlink(temp_path)
-        except FileNotFoundError:
-            pass
-        raise
+    _ensure_dir(os.path.dirname(file_path))
+    atomic_write(file_path, json.dumps(value, indent=2) + "\n")
 
 
 def _fsync_directory(directory):
@@ -71,11 +56,8 @@ def _file_lock(lock_path):
     with open(lock_path, "a", encoding="utf-8") as lock:
         if sys.platform == "win32":
             import msvcrt
-            try:
-                lock.seek(0)
-                msvcrt.locking(lock.fileno(), msvcrt.LK_LOCK, 1)
-            except OSError as error:
-                raise CdxError(f"Failed to lock session store: {error}") from error
+            # Bounded wait, not LK_LOCK's ten one-second tries (see run_registry).
+            _acquire_windows_lock(lock, REGISTRY_LOCK_TIMEOUT_SECONDS, "session store")
             try:
                 yield
             finally:
@@ -89,10 +71,7 @@ def _file_lock(lock_path):
                 import fcntl
             except ImportError as error:
                 raise CdxError("Session store locking requires fcntl on this platform") from error
-            try:
-                fcntl.flock(lock.fileno(), fcntl.LOCK_EX)
-            except OSError as error:
-                raise CdxError(f"Failed to lock session store: {error}") from error
+            _acquire_posix_lock(lock, REGISTRY_LOCK_TIMEOUT_SECONDS, "session store")
             try:
                 yield
             finally: