cdx-manager 0.7.2 → 0.7.4

package/README.md

@@ -1,6 +1,6 @@
 # CDX Manager
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.7.2-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.7.4-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Run multiple Codex, Claude, Antigravity, and Ollama sessions from one terminal. Switch between accounts instantly.**
 
@@ -118,7 +118,8 @@ With the standalone PowerShell installer:
 
 ```powershell
 Invoke-WebRequest https://raw.githubusercontent.com/AlexAgo83/cdx-manager/main/install.ps1 -OutFile install.ps1
-# Optional: set CDX_SHA256 before running if you have a trusted checksum
+# Optional: set CDX_SHA256 before running if you have a trusted checksum.
+# Set CDX_ALLOW_UNVERIFIED=1 only if you intentionally accept an unverified archive.
 powershell -ExecutionPolicy Bypass -File .\install.ps1
 ```
 
@@ -126,7 +127,8 @@ With the standalone GitHub installer:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/AlexAgo83/cdx-manager/main/install.sh -o install.sh
-# Optional: set CDX_SHA256 before running if you have a trusted checksum
+# Optional: set CDX_SHA256 before running if you have a trusted checksum.
+# Set CDX_ALLOW_UNVERIFIED=1 only if you intentionally accept an unverified archive.
 sh install.sh
 ```
 
@@ -134,7 +136,7 @@ For a specific version:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/AlexAgo83/cdx-manager/main/install.sh -o install.sh
-CDX_VERSION=v0.7.2 sh install.sh
+CDX_VERSION=v0.7.4 sh install.sh
 ```
 
 From source:
@@ -183,6 +185,7 @@ Security note:
 
 - The standalone installers try to resolve official release checksums from `checksums/release-archives.json`.
 - You can still override verification explicitly through `CDX_SHA256`.
+- If no checksum is available, standalone installers fail closed unless `CDX_ALLOW_UNVERIFIED=1` is set.
 - Prefer `npm`, `pipx`, or `uv` when you want registry-backed install flows.
 - If you use the standalone script, download it first, inspect it, and prefer a release with an official checksum entry.
 
@@ -241,6 +244,9 @@ cdx work
 # Check usage across all sessions
 cdx status
 
+# Pick the best session using the same priority logic as status
+cdx next
+
 # Notify when the next cooling-down assistant is ready
 cdx ready
 ```
@@ -256,7 +262,7 @@ cdx ready --refresh
 
 ### Persistent Launch Settings
 
-By default, `cdx` launches provider CLIs without forcing model effort, permission mode, or fast behavior. Set only the values you want to pin:
+New sessions start with `power=medium` and `fast=off`, so launches are predictable without enabling fast mode. Set or override only the values you want to pin:
 
 ```bash
 cdx set work --power medium --permission full --fast off
@@ -269,9 +275,10 @@ cdx power all low
 cdx perm provider:claude review
 cdx model provider:ollama llama3.2
 cdx config work
+cdx configs
 ```
 
-Those values are stored on the session and reapplied every time you run `cdx work`. Remove overrides to return to provider defaults:
+Those values are stored on the session and reapplied every time you run `cdx work`. Remove overrides to return to provider-native defaults:
 
 ```bash
 cdx unset work --power
@@ -320,6 +327,7 @@ cdx history --summary --from 2026-05-01 --to 2026-05-28
 | `cdx disable <name> [--json]` | Disable a session without deleting it; disabled sessions stay visible and cannot launch |
 | `cdx enable <name> [--json]` | Re-enable a disabled session |
 | `cdx config <name> [--json]` | Show persistent launch settings for a session |
+| `cdx configs [--json]` | Show persistent launch settings for all sessions in one table |
 | `cdx power\|perm\|fast\|model <name\|all\|provider:PROVIDER\|a,b> <value\|default> [--json]` | Shortcut commands for setting or clearing one launch setting |
 | `cdx set <name>\|--sessions all\|a,b\|--provider PROVIDER [--power low\|medium\|high\|xhigh\|max] [--permission review\|default\|auto\|full] [--fast on\|off] [--rtk on\|off] [--model MODEL] [--priority 0..100] [--json]` | Persist launch settings for one or more sessions |
 | `cdx unset <name>\|--sessions all\|a,b\|--provider PROVIDER (--power\|--permission\|--fast\|--rtk\|--model\|--priority\|--all) [--json]` | Remove persisted launch settings and fall back to provider defaults |
@@ -338,6 +346,7 @@ cdx history --summary --from 2026-05-01 --to 2026-05-28
 | `cdx ready [--refresh] [--json]` | Schedule an OS notification for the next cooling-down assistant that becomes ready, then return immediately |
 | `cdx notify <name> --at-reset [--poll seconds] [--once] [--schedule] [--refresh] [--json]` | Wait for a session reset time or schedule an OS wake-up notification when due |
 | `cdx notify --next-ready [--poll seconds] [--once] [--schedule] [--refresh] [--json]` | Wait until the recommended session is usable, or schedule the next known reset notification |
+| `cdx next [--json] [--refresh]` | Select the best next assistant using the same priority logic as `cdx status` |
 | `cdx select --provider PROVIDER [--min-reasoning-effort low\|medium\|high] [--min-power low\|medium\|high] [--require-ready] [--refresh] --json` | Select a suitable session for headless automation |
 | `cdx run [session] --cwd PATH (--prompt-file PATH\|--prompt TEXT) [--provider PROVIDER] [--model MODEL] [--reasoning-effort low\|medium\|high] [--power low\|medium\|high] [--permission MODE] [--timeout-seconds N] --json` | Run one headless task and return a stable JSON result |
 | `cdx stats [name] [--since 7d\|today\|DATE] [--from DATE] [--to DATE] [--json]` | Aggregate launch counts, duration, and known headless token usage by session |

package/changelogs/CHANGELOGS_0_7_3.md

@@ -0,0 +1,37 @@
+# Changelog (`0.7.2 -> 0.7.3`)
+
+Release date: 2026-05-31
+
+## Status Display
+
+- Rounded Codex credit balances in the `cdx status` `CR` column to two decimal places.
+- Applied the same credit formatting to the single-session status detail view.
+- Parallelized status resolution across sessions with a bounded worker pool while preserving cache behavior and final row ordering.
+- Added visible per-session progress for text status checks, including `Checked <session> (x/y)` messages for refreshed sessions.
+
+## Stats and History Output
+
+- Improved `cdx stats` text output with colorized headings, sessions, token totals, durations, and metadata when color is enabled.
+- Reformatted long duration values into readable day/hour/minute forms such as `2h 05m`.
+- Marked active sessions with `*` in `cdx stats`, matching `cdx status`.
+- Improved `cdx history` and `cdx history --summary` with colorized headings, success/failure states, durations, and metadata.
+- Marked active sessions with `*` in `cdx history` text output without changing JSON payloads.
+
+## Coverage and Tests
+
+- Added regression coverage for status credit rounding, parallel status refresh, status progress messages, colorized stats/history output, readable duration formatting, and active-session markers.
+- Increased the Python test suite to 262 tests.
+
+## Release Metadata
+
+- Updated package metadata, CLI version output, README badge, pinned installer example, and release changelog to `v0.7.3`.
+
+## Validation and Regression Evidence
+
+- `npm run lint`
+- `npm test`
+- `npm pack --dry-run`
+- `node bin/cdx.js -v`
+- `python3 -m unittest discover -s test`
+- `python3 -m build`
+- `python3 -m twine check dist/cdx_manager-0.7.3*`

package/changelogs/CHANGELOGS_0_7_4.md

@@ -0,0 +1,45 @@
+# Changelog (`0.7.3 -> 0.7.4`)
+
+Release date: 2026-06-02
+
+## Security and Privacy
+
+- Rejected `.` and `..` as session names so profile and state paths cannot escape their managed directories.
+- Added import-bundle regression coverage for unsafe dot-path session names.
+- Redacted headless `cdx run` prompt arguments before persisting launch history while keeping provider execution unchanged.
+- Made headless `cdx run` perform a live provider auth probe instead of trusting only local credential files.
+- Hardened Claude auth invalidation so invalid Claude credentials are recorded as logged out during refresh and status handling.
+
+## Installer Integrity
+
+- Changed standalone Unix and PowerShell installers to fail closed when no official checksum is available.
+- Added the explicit `CDX_ALLOW_UNVERIFIED=1` override for users who intentionally accept an unverified archive.
+- Updated README security guidance for standalone installer checksum behavior.
+
+## Headless and Selection Behavior
+
+- Added the next-assistant recommendation command and improved resolved run reasoning-effort reporting.
+- Preserved stable provider-specific launch metadata while adding stricter headless auth validation.
+
+## Maintainability
+
+- Extracted headless run prompt, error-code, and JSON payload helpers into `src/run_command.py`.
+- Reduced the size of `src/cli_commands.py` without changing the public `cdx run --json` contract.
+
+## Coverage and Tests
+
+- Added regression coverage for dot-path session names, unsafe imported sessions, redacted headless history prompts, forced live auth probes, and unauthenticated headless runs.
+- Increased the Python test suite to 276 tests.
+
+## Release Metadata
+
+- Updated package metadata, CLI version output, README badge, pinned installer example, and release changelog to `v0.7.4`.
+
+## Validation and Regression Evidence
+
+- `npm run lint`
+- `npm test`
+- `npm audit --omit=dev --json`
+- `sh -n install.sh`
+- PowerShell parser check for `install.ps1`
+- `python3 -m logics_manager lint --require-status`

package/checksums/release-archives.json

@@ -36,6 +36,14 @@
     "v0.7.1": {
       "github_tarball_sha256": "276cf2f094405bef674290ff8d1f2401f99afc10981c97efe4fe8293801715c8",
       "github_zip_sha256": "5d5cdefec3ebcd61d4149b71895f4d5b79e604cf874b2d567910e578a8164670"
+    },
+    "v0.7.2": {
+      "github_tarball_sha256": "9e993b15386c7b47895cfaca9c7e92165967ef34ecf8337c64823a5b0f9eb9e0",
+      "github_zip_sha256": "1e5fd926a16811f84137636830e0b27776b9f8f8d2eb8953b620023c8bfe6fdd"
+    },
+    "v0.7.3": {
+      "github_tarball_sha256": "f68ac90a51c723eef9ae2b66106baa954f2fff8129fb5353e8eeb26b258b06c9",
+      "github_zip_sha256": "dde2512701808450b39c5c4431317d95d017f9944435db83ac4497b645feb719"
     }
   }
 }

package/install.ps1

@@ -62,7 +62,11 @@ try {
             throw "cdx install: checksum mismatch for $tag`nexpected: $Sha256`nactual:   $actualSha256"
         }
     } else {
-        Write-Warning "No official checksum available for $tag; continuing without verification."
+        if ($env:CDX_ALLOW_UNVERIFIED -eq "1") {
+            Write-Warning "No official checksum available for $tag; continuing because CDX_ALLOW_UNVERIFIED=1."
+        } else {
+            throw "cdx install: no official checksum available for $tag. Set CDX_ALLOW_UNVERIFIED=1 to install without checksum verification."
+        }
     }
     Expand-Archive -Path $archivePath -DestinationPath $extractRoot -Force
 

package/install.sh

@@ -86,7 +86,13 @@ if [ -n "$EXPECTED_SHA256" ]; then
     exit 1
   fi
 else
-  echo "cdx install: warning: no official checksum available for $TAG; continuing without verification" >&2
+  if [ "${CDX_ALLOW_UNVERIFIED:-}" = "1" ]; then
+    echo "cdx install: warning: no official checksum available for $TAG; continuing because CDX_ALLOW_UNVERIFIED=1" >&2
+  else
+    echo "cdx install: no official checksum available for $TAG" >&2
+    echo "Set CDX_ALLOW_UNVERIFIED=1 to install without checksum verification." >&2
+    exit 1
+  fi
 fi
 
 tar -xzf "$TMP_DIR/cdx-manager.tar.gz" -C "$TMP_DIR"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.7.2"
+version = "0.7.4"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/claude_refresh.py

@@ -2,7 +2,7 @@ import inspect
 import threading
 from datetime import datetime, timezone
 
-from .claude_usage import refresh_claude_session_status
+from .claude_usage import ClaudeAuthInvalidError, refresh_claude_session_status
 from .config import PROVIDER_CLAUDE
 from .errors import CdxError
 
@@ -83,6 +83,24 @@ def _refresh_claude_sessions(service, refresh_fn=None, target_names=None, force=
         for t in threads:
             t.join(timeout=10)
 
+    invalid_auth = sorted({
+        item.get("session")
+        for item in errors
+        if item.get("session") and isinstance(item.get("error"), ClaudeAuthInvalidError)
+    })
+    if invalid_auth and service.get("update_auth_state"):
+        now = datetime.now(timezone.utc).astimezone().isoformat()
+        for name in invalid_auth:
+            try:
+                service["update_auth_state"](name, lambda auth: {
+                    **auth,
+                    "status": "logged_out",
+                    "lastCheckedAt": now,
+                    "lastLoggedOutAt": now,
+                })
+            except CdxError:
+                pass
+
     for name, usage in results.items():
         try:
             service["record_status"](name, usage)

package/src/claude_usage.py

@@ -15,6 +15,10 @@ CLAUDE_STATUS_PROBE_MODEL = os.environ.get("CDX_CLAUDE_STATUS_MODEL", "claude-ha
 CLAUDE_AUTH_STATUS_TIMEOUT_SECONDS = 15
 
 
+class ClaudeAuthInvalidError(CdxError):
+    pass
+
+
 def _clean_oauth_token(token):
     if not token:
         return None
@@ -142,6 +146,10 @@ def fetch_claude_rate_limit_headers(access_token):
             headers = {k.lower(): v for k, v in resp.getheaders()}
     except urllib.error.HTTPError as e:
         headers = {k.lower(): v for k, v in e.headers.items()}
+        if e.code == 401:
+            message = _read_http_error_message(e)
+            suffix = f": {message}" if message else ""
+            raise ClaudeAuthInvalidError(f"Claude usage unavailable (HTTP {e.code}{suffix})") from e
         if (
             "anthropic-ratelimit-unified-5h-utilization" not in headers
             and "anthropic-ratelimit-unified-7d-utilization" not in headers

package/src/cli.py

@@ -10,6 +10,7 @@ from .cli_commands import (
     handle_add,
     handle_clean,
     handle_config,
+    handle_configs,
     handle_context,
     handle_copy,
     handle_doctor,
@@ -25,6 +26,7 @@ from .cli_commands import (
     handle_logout,
     handle_launch_setting_alias,
     handle_notify,
+    handle_next,
     handle_remove,
     handle_repair,
     handle_rename,
@@ -58,7 +60,7 @@ from .status_view import (
 )
 from .update_check import check_for_update
 
-VERSION = "0.7.2"
+VERSION = "0.7.4"
 
 
 # ---------------------------------------------------------------------------
@@ -75,10 +77,12 @@ def _print_help(use_color=False):
         f"  {_style('cdx status [--json] [--refresh]', '36', use_color)}",
         f"  {_style('cdx status --small|-s [--refresh]', '36', use_color)}",
         f"  {_style('cdx status <name> [--json] [--refresh]', '36', use_color)}",
+        f"  {_style('cdx next [--json] [--refresh]', '36', use_color)}",
         f"  {_style('cdx select --provider PROVIDER [--min-reasoning-effort low|medium|high] [--min-power low|medium|high] [--require-ready] [--refresh] --json', '36', use_color)}",
         f"  {_style('cdx run [session] --cwd PATH (--prompt-file PATH|--prompt TEXT) [--provider PROVIDER] [--model MODEL] [--reasoning-effort low|medium|high] [--power low|medium|high] [--permission review|default|auto|full|workspace-write|read-only|danger-full-access] [--timeout-seconds N] --json', '36', use_color)}",
         f"  {_style('cdx context show|path|init|edit|clear|set [text...] [--json]', '36', use_color)}",
         f"  {_style('cdx config <name> [--json]', '36', use_color)}",
+        f"  {_style('cdx configs [--json]', '36', use_color)}",
         f"  {_style('cdx power|perm|fast|model <name|all|provider:PROVIDER|a,b> <value|default> [--json]', '36', use_color)}",
         f"  {_style('cdx set <name>|--sessions all|a,b|--provider PROVIDER [--power low|medium|high|xhigh|max] [--permission review|default|auto|full] [--fast on|off] [--rtk on|off] [--model MODEL] [--priority 0..100] [--json]', '36', use_color)}",
         f"  {_style('cdx unset <name>|--sessions all|a,b|--provider PROVIDER (--power|--permission|--fast|--rtk|--model|--priority|--all) [--json]', '36', use_color)}",
@@ -240,7 +244,7 @@ def main(argv, options=None):
         "version": VERSION,
         "cwd": options.get("cwd") or os.getcwd(),
         "update_notice": _get_update_notice(service, env, options) if command not in (
-            "add", "cp", "ren", "rename", "mv", "rmv", "clean", "doctor", "repair", "update", "ready", "notify", "context", "config", "set", "unset", "power", "perm", "fast", "model", "history", "stats", "handoff", "login", "logout", "disable", "enable", "export", "import", "select", "run", "help", "version"
+            "add", "cp", "ren", "rename", "mv", "rmv", "clean", "doctor", "repair", "update", "ready", "notify", "next", "context", "config", "configs", "set", "unset", "power", "perm", "fast", "model", "history", "stats", "handoff", "login", "logout", "disable", "enable", "export", "import", "select", "run", "help", "version"
         ) else None,
         "use_color": use_color,
     }
@@ -289,12 +293,18 @@ def main(argv, options=None):
     if command == "notify":
         return handle_notify(rest, ctx)
 
+    if command == "next":
+        return handle_next(rest, ctx)
+
     if command == "context":
         return handle_context(rest, ctx)
 
     if command == "config":
         return handle_config(rest, ctx)
 
+    if command == "configs":
+        return handle_configs(rest, ctx)
+
     if command == "set":
         return handle_set(rest, ctx)