cdx-manager 0.9.11 → 0.9.13

package/README.md

@@ -1,6 +1,6 @@
 # CDX Manager
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.9.11-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.9.13-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Run multiple Codex, Claude, Antigravity, and Ollama sessions from one terminal. Switch between accounts instantly.**
 

package/changelogs/CHANGELOGS_0_9_12.md

@@ -0,0 +1,36 @@
+# CDX Manager 0.9.12
+
+## Highlights
+
+- Prevented accidental concurrent launches that reuse the same provider profile and can invalidate shared OAuth credentials.
+- Made Claude add/login prefer `claude setup-token` so new Claude sessions use the long-lived token flow by default.
+
+## Changes
+
+### Session launch safety
+
+`cdx` now detects when another live session already uses the same provider profile before launching a new one.
+
+On an interactive terminal, the CLI asks for confirmation before starting the second session. In non-interactive contexts, the launch fails with a clear message so automation does not silently create conflicting sessions.
+
+This protects profiles that share one credentials file, where concurrent token refreshes can rotate credentials and log out the other session.
+
+### Claude token setup
+
+Claude add and login flows now route through `claude setup-token` by default, which produces a longer-lived token than the standard login flow.
+
+When this setup-token flow succeeds, stale Claude credentials are removed so the newly configured token is the one used at launch. The existing `--setup-token` flag remains accepted for compatibility.
+
+Regression coverage verifies the default Claude setup-token behavior, stale credential cleanup, and compatibility of the retained flag.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/changelogs/CHANGELOGS_0_9_13.md

@@ -0,0 +1,27 @@
+# CDX Manager 0.9.13
+
+## Highlights
+
+- Fixed Claude `setup-token` capture on Linux by using the util-linux `script` flush flag.
+
+## Changes
+
+### Claude setup-token capture
+
+Linux terminals now run transcript capture with `script -f` instead of the BSD/macOS-only `script -F` spelling.
+
+This prevents util-linux `script` from exiting with `invalid option -- 'F'`, which previously made `cdx` fall back to running `claude setup-token` without transcript capture and miss the printed token.
+
+macOS keeps the existing `script -F` behavior.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/checksums/release-archives.json

@@ -108,6 +108,14 @@
     "v0.9.10": {
       "github_tarball_sha256": "4e876d3552eca1b441492a36606f2f0583bff9523801a923d834fe2a4da3c644",
       "github_zip_sha256": "b6c9435f7e36558ac8698dbd6d6c4888e58c64a08d2b06c3bcbb45ce2cd25f7c"
+    },
+    "v0.9.11": {
+      "github_tarball_sha256": "8ab8f673af4ad9c0e4fd64110d47285a1de02c095fd0f6d79eb67e061255093d",
+      "github_zip_sha256": "ee5fffa543b8a02c082a180c624d31951c5ff662d492132cd83d4f099da70441"
+    },
+    "v0.9.12": {
+      "github_tarball_sha256": "ed9de98e1b4df5e42a1e389580f03d4b4b2e09ee8f63d23110090e6f164b8ae6",
+      "github_zip_sha256": "55f9ead146411ae740db1cae3f91c56d6ebe33c03345f9d4bfd487e45962e412"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.9.11"
+version = "0.9.13"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/cli.py

@@ -66,7 +66,7 @@ from .status_view import (
 )
 from .update_check import check_for_update, check_logics_manager_for_update
 
-VERSION = "0.9.11"
+VERSION = "0.9.13"
 
 # Public surface: this module is a facade. Names below are imported above
 # purely to be re-exported (consumed by tests and external callers); listing

package/src/cli_commands.py

@@ -209,7 +209,14 @@ def _bootstrap_claude_setup_token(session, ctx):
         os.remove(transcript_path)
     except OSError:
         pass
-    return _write_claude_oauth_token(session.get("authHome") or "", token)
+    auth_home = session.get("authHome") or ""
+    cred_path = _write_claude_oauth_token(auth_home, token)
+    # ponytail: drop short-lived claude login creds so the ~1yr token wins at launch (provider_runtime _read_claude_launch_oauth_token)
+    try:
+        os.remove(os.path.join(auth_home, ".claude", ".credentials.json"))
+    except OSError:
+        pass
+    return cred_path
 
 
 def handle_add(rest, ctx):
@@ -223,16 +230,20 @@ def handle_add(rest, ctx):
     if parsed.get("model"):
         session = ctx["service"]["set_launch_settings"](parsed["name"], {"model": parsed["model"]})
     message = f"Created session {parsed['name']} ({parsed['provider']})"
-    _ensure_session_authentication(
-        session,
-        ctx["service"],
-        spawn=ctx.get("spawn"),
-        spawn_sync=ctx.get("spawn_sync"),
-        env_override=ctx.get("env"),
-        stdin_is_tty=ctx["stdin_is_tty"],
-        behavior="bootstrap",
-        signal_emitter=ctx.get("signal_emitter"),
-    )
+    if session["provider"] == PROVIDER_CLAUDE and ctx["stdin_is_tty"]:
+        # ponytail: mint a ~1yr setup-token instead of the ~daily claude login token
+        _bootstrap_claude_setup_token(session, ctx)
+    else:
+        _ensure_session_authentication(
+            session,
+            ctx["service"],
+            spawn=ctx.get("spawn"),
+            spawn_sync=ctx.get("spawn_sync"),
+            env_override=ctx.get("env"),
+            stdin_is_tty=ctx["stdin_is_tty"],
+            behavior="bootstrap",
+            signal_emitter=ctx.get("signal_emitter"),
+        )
     now = _local_now_iso()
     ctx["service"]["update_auth_state"](parsed["name"], lambda auth: {
         **auth,
@@ -1809,6 +1820,7 @@ def handle_import(rest, ctx):
 
 
 def handle_login(rest, ctx):
+    rest = [arg for arg in rest if arg != "--setup-token"]  # accepted for back-compat; setup-token is now the default for Claude
     json_flag, args = _parse_json_flag(rest)
     if len(args) != 1:
         raise CdxError("Usage: cdx login <name> [--json]")
@@ -1817,10 +1829,14 @@ def handle_login(rest, ctx):
     session = ctx["service"]["get_session"](args[0])
     if not session:
         raise CdxError(f"Unknown session: {args[0]}")
-    _run_interactive_provider_command(
-        session, "login", spawn=ctx.get("spawn"), env_override=ctx.get("env"),
-        signal_emitter=ctx.get("signal_emitter")
-    )
+    if session["provider"] == PROVIDER_CLAUDE:
+        # ponytail: setup-token mints a ~1yr token; claude login mints a ~daily one that forces reconnects
+        _bootstrap_claude_setup_token(session, ctx)
+    else:
+        _run_interactive_provider_command(
+            session, "login", spawn=ctx.get("spawn"), env_override=ctx.get("env"),
+            signal_emitter=ctx.get("signal_emitter")
+        )
     auth_probe = _ensure_session_authentication(
         session,
         ctx["service"],
@@ -1829,16 +1845,6 @@ def handle_login(rest, ctx):
         behavior="probe-only",
         trust_local_credentials=False,
     )
-    if not auth_probe.get("authenticated") and session["provider"] == PROVIDER_CLAUDE:
-        _bootstrap_claude_setup_token(session, ctx)
-        auth_probe = _ensure_session_authentication(
-            session,
-            ctx["service"],
-            spawn_sync=ctx.get("spawn_sync"),
-            env_override=ctx.get("env"),
-            behavior="probe-only",
-            trust_local_credentials=False,
-        )
     if not auth_probe.get("authenticated"):
         raise CdxError(
             f"Login command completed, but session {session['name']} is still not authenticated."
@@ -2054,11 +2060,33 @@ def handle_resume(rest, ctx):
     return handle_launch(args[0], ctx, resume=True, force_json=json_flag)
 
 
+def _warn_if_session_already_running(name, ctx):
+    # ponytail: concurrent sessions on one profile share its single OAuth
+    # .credentials.json; both refresh near token expiry and the rotated refresh
+    # token invalidates the other session -> surprise logout. Warn before adding
+    # a second live session on the same profile.
+    active = ctx["service"].get("active_session_runtime")
+    runtime = active(name) if active else None
+    if not runtime:
+        return
+    pid = runtime.get("pid")
+    ctx["out"](f"{_warn(f'A session named {name} is already running (pid {pid}).', ctx['use_color'])}\n")
+    ctx["out"](
+        f"{_dim('Two sessions on one profile share its login and can log each other out. Use a different profile instead.', ctx['use_color'])}\n"
+    )
+    if not ctx["stdin_is_tty"]:
+        return
+    answer = input(f"Launch a second {name} session anyway? [y/N] ")
+    if answer.strip().lower() not in ("y", "yes"):
+        raise CdxError("Launch cancelled.")
+
+
 def handle_launch(command, ctx, initial_prompt=None, resume=False, force_json=None):
     json_flag = "--json" in ctx.get("raw_args", ctx["options"].get("raw_args", []))
     if force_json is not None:
         json_flag = force_json
     warnings = _update_notice_warnings(ctx)
+    _warn_if_session_already_running(command, ctx)
     session = ctx["service"]["launch_session"](command)
     capability = _resume_capability_for_session(session, ctx) if resume else None
     if capability and not capability["resumable"]:

package/src/provider_runtime.py

@@ -375,8 +375,9 @@ def _wrap_launch_with_transcript(session, spec, capture_transcript=True, env=Non
 
 def _default_script_args(transcript_path, spec):
     if sys.platform.startswith("linux"):
+        # util-linux `script` flushes with -f (lowercase); -F is the BSD/macOS spelling and errors here.
         command = shlex.join([spec["command"]] + spec["args"])
-        return ["-q", "-F", "-c", command, transcript_path]
+        return ["-q", "-f", "-c", command, transcript_path]
     return ["-q", "-F", transcript_path, spec["command"]] + spec["args"]
 
 

package/src/session_service.py

@@ -1391,6 +1391,7 @@ def create_session_service(options=None):
         "copy_session": copy_session,
         "rename_session": rename_session,
         "launch_session": launch_session,
+        "active_session_runtime": _session_runtime,
         "start_session_runtime": start_session_runtime,
         "finish_session_runtime": finish_session_runtime,
         "ensure_session_state": ensure_session_state,