cdx-manager 0.9.12 → 0.9.14

package/README.md

@@ -1,6 +1,6 @@
 # CDX Manager
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.9.12-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.9.14-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Run multiple Codex, Claude, Antigravity, and Ollama sessions from one terminal. Switch between accounts instantly.**
 
@@ -359,8 +359,8 @@ cdx history --summary --from 2026-05-01 --to 2026-05-28
 | `cdx handoff <source> <target> [--json]` | Build shared context from the source session's latest launch transcript, install it into the target session, and launch the target unless `--json` is used; supports cross-provider handoff |
 | `cdx rmv <name> [--force] [--json]` | Remove a session and its auth data (prompts for confirmation unless `--force`) |
 | `cdx clean [name] [--json]` | Clear launch transcript logs for one session or all sessions |
-| `cdx export <file> [--include-auth] [--sessions a,b] [--passphrase-env VAR] [--force] [--json]` | Export sessions to a portable bundle; `--include-auth` encrypts auth data with a passphrase |
-| `cdx import <file> [--sessions a,b] [--passphrase-env VAR] [--force] [--json]` | Import sessions from a bundle into the current `CDX_HOME` |
+| `cdx export <file> [--include-auth] [--sessions a,b] [--passphrase-env VAR\|--passphrase-stdin] [--force] [--json]` | Export sessions to a portable bundle; `--include-auth` encrypts auth data with a passphrase |
+| `cdx import <file> [--sessions a,b] [--passphrase-env VAR\|--passphrase-stdin] [--force] [--json]` | Import sessions from a bundle into the current `CDX_HOME` |
 | `cdx doctor [--json]` | Inspect CLI dependencies, CDX_HOME permissions, missing state, orphan profiles, and pending quarantines |
 | `cdx repair [--dry-run] [--force] [--json]` | Plan or apply safe repairs for missing state files, quarantines, and orphan profiles |
 | `cdx view [--json] [--lan] [--lan-rw] [--focus <ref>] [--read] [--port <port>] [--host <host>] [--refresh-interval <s>] [--tls] [--tls-cert <path>] [--tls-key <path>] [--open] [--no-open]` | Open the Logics browser/focus viewer by delegating to `logics-manager view`; all viewer flags are forwarded; JSON mode reports diagnostics without launching it |
@@ -510,7 +510,7 @@ cdx import backup-auth.cdx --passphrase-env CDX_BUNDLE_PASSPHRASE
 Notes:
 
 - `--include-auth` is encrypted, requires a passphrase, and exports only provider credential files rather than full profile caches or logs.
-- Without `--passphrase-env`, `cdx` prompts in an interactive terminal.
+- Without `--passphrase-env`, `cdx` prompts in an interactive terminal. Non-interactive callers can pass `--passphrase-stdin` to read the passphrase from stdin (one line) instead of exposing it in the child environment.
 - `--sessions work,perso` exports or imports only a subset.
 - `--force` allows overwriting existing destination sessions during import or replacing an existing bundle file during export.
 - Auth bundles contain credentials. Treat them like secrets and delete them after transfer.

package/changelogs/CHANGELOGS_0_9_13.md

@@ -0,0 +1,27 @@
+# CDX Manager 0.9.13
+
+## Highlights
+
+- Fixed Claude `setup-token` capture on Linux by using the util-linux `script` flush flag.
+
+## Changes
+
+### Claude setup-token capture
+
+Linux terminals now run transcript capture with `script -f` instead of the BSD/macOS-only `script -F` spelling.
+
+This prevents util-linux `script` from exiting with `invalid option -- 'F'`, which previously made `cdx` fall back to running `claude setup-token` without transcript capture and miss the printed token.
+
+macOS keeps the existing `script -F` behavior.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/changelogs/CHANGELOGS_0_9_14.md

@@ -0,0 +1,27 @@
+# CDX Manager 0.9.14
+
+## Highlights
+
+- Added `--passphrase-stdin` for auth bundle export/import flows, avoiding passphrases in child process environments.
+
+## Changes
+
+### Auth bundle passphrase input
+
+`cdx export --include-auth` and `cdx import` now accept `--passphrase-stdin` as an alternative to `--passphrase-env`.
+
+This lets non-interactive callers provide the bundle passphrase through standard input instead of storing it in an environment variable. The new flag is mutually exclusive with `--passphrase-env`, and export still requires `--include-auth` before a passphrase is accepted.
+
+Usage strings, command help, README examples, and regression coverage were updated for the new input mode.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/checksums/release-archives.json

@@ -112,6 +112,14 @@
     "v0.9.11": {
       "github_tarball_sha256": "8ab8f673af4ad9c0e4fd64110d47285a1de02c095fd0f6d79eb67e061255093d",
       "github_zip_sha256": "ee5fffa543b8a02c082a180c624d31951c5ff662d492132cd83d4f099da70441"
+    },
+    "v0.9.12": {
+      "github_tarball_sha256": "ed9de98e1b4df5e42a1e389580f03d4b4b2e09ee8f63d23110090e6f164b8ae6",
+      "github_zip_sha256": "55f9ead146411ae740db1cae3f91c56d6ebe33c03345f9d4bfd487e45962e412"
+    },
+    "v0.9.13": {
+      "github_tarball_sha256": "4541dcecbfc12705f8e50e61ab1cb1f53dd6a209cc4a6d33ec3a4e533a3da3eb",
+      "github_zip_sha256": "a8df11be1910a0562e0f97f69e9f35ee2fdf90ef50cb40689c85bf5ee5937027"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.9.12"
+version = "0.9.14"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/cli.py

@@ -66,7 +66,7 @@ from .status_view import (
 )
 from .update_check import check_for_update, check_logics_manager_for_update
 
-VERSION = "0.9.12"
+VERSION = "0.9.14"
 
 # Public surface: this module is a facade. Names below are imported above
 # purely to be re-exported (consumed by tests and external callers); listing
@@ -192,8 +192,8 @@ def _print_help(use_color=False):
         f"  {_style('cdx enable <name> [--json]', '36', use_color)}",
         f"  {_style('cdx rmv <name> [--force] [--json]', '36', use_color)}",
         f"  {_style('cdx clean [name] [--json]', '36', use_color)}",
-        f"  {_style('cdx export <file> [--include-auth] [--sessions a,b] [--passphrase-env VAR] [--force] [--json]', '36', use_color)}",
-        f"  {_style('cdx import <file> [--sessions a,b] [--passphrase-env VAR] [--force|--merge] [--json]', '36', use_color)}",
+        f"  {_style('cdx export <file> [--include-auth] [--sessions a,b] [--passphrase-env VAR|--passphrase-stdin] [--force] [--json]', '36', use_color)}",
+        f"  {_style('cdx import <file> [--sessions a,b] [--passphrase-env VAR|--passphrase-stdin] [--force|--merge] [--json]', '36', use_color)}",
         f"  {_style('cdx doctor [--json]', '36', use_color)}",
         f"  {_style('cdx repair [--dry-run] [--force] [--json]', '36', use_color)}",
         f"  {_style('cdx view [--json]', '36', use_color)}",

package/src/cli_args.py

@@ -15,8 +15,8 @@ STATUS_USAGE = "Usage: cdx status [--json] [--refresh|--cached] [--timeout SECON
 DOCTOR_USAGE = "Usage: cdx doctor [--json]"
 REPAIR_USAGE = "Usage: cdx repair [--dry-run] [--force] [--json]"
 UPDATE_USAGE = "Usage: cdx update [--check] [--yes] [--json] [--version TAG]"
-EXPORT_USAGE = "Usage: cdx export <file> [--include-auth] [--force] [--json] [--sessions name1,name2] [--passphrase-env VAR]"
-IMPORT_USAGE = "Usage: cdx import <file> [--force|--merge] [--json] [--sessions name1,name2] [--passphrase-env VAR]"
+EXPORT_USAGE = "Usage: cdx export <file> [--include-auth] [--force] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
+IMPORT_USAGE = "Usage: cdx import <file> [--force|--merge] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
 CONTEXT_USAGE = "Usage: cdx context show|path|init|edit|clear|set [text...] [--json]"
 HANDOFF_USAGE = "Usage: cdx handoff <name> [--json] | cdx handoff <source> <target> [--json]"
 SET_USAGE = "Usage: cdx set <name>|--sessions all|a,b|--provider PROVIDER [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full] [--fast on|off] [--rtk on|off] [--logics on|off] [--model MODEL] [--priority 0..100] [--json]"
@@ -585,12 +585,15 @@ def _parse_export_args(args):
             "transform": _parse_session_names,
         },
         "--passphrase-env": {"key": "passphrase_env", "type": "str", "default": None},
+        "--passphrase-stdin": {"key": "passphrase_stdin", "type": "bool", "default": False},
     }, EXPORT_USAGE, positionals_key="positionals", max_positionals=1)
     parsed["file_path"] = parsed.pop("positionals")[0] if parsed["positionals"] else None
     if not parsed["file_path"]:
         raise CdxError(EXPORT_USAGE)
-    if parsed["passphrase_env"] and not parsed["include_auth"]:
-        raise CdxError("--passphrase-env requires --include-auth for export.")
+    if parsed["passphrase_env"] and parsed["passphrase_stdin"]:
+        raise CdxError("--passphrase-env and --passphrase-stdin are mutually exclusive.")
+    if (parsed["passphrase_env"] or parsed["passphrase_stdin"]) and not parsed["include_auth"]:
+        raise CdxError("--passphrase-env/--passphrase-stdin requires --include-auth for export.")
     return parsed
 
 
@@ -606,12 +609,15 @@ def _parse_import_args(args):
             "transform": _parse_session_names,
         },
         "--passphrase-env": {"key": "passphrase_env", "type": "str", "default": None},
+        "--passphrase-stdin": {"key": "passphrase_stdin", "type": "bool", "default": False},
     }, IMPORT_USAGE, positionals_key="positionals", max_positionals=1)
     parsed["file_path"] = parsed.pop("positionals")[0] if parsed["positionals"] else None
     if not parsed["file_path"]:
         raise CdxError(IMPORT_USAGE)
     if parsed["force"] and parsed["merge"]:
         raise CdxError("--force and --merge are mutually exclusive.")
+    if parsed["passphrase_env"] and parsed["passphrase_stdin"]:
+        raise CdxError("--passphrase-env and --passphrase-stdin are mutually exclusive.")
     return parsed
 
 

package/src/cli_commands.py

@@ -107,15 +107,22 @@ from .update_check import LatestReleaseCheckError, fetch_latest_release, fetch_l
 from .update_manager import build_update_plan, format_update_failure, run_update_plan, verify_updated_command
 
 
-def _resolve_bundle_passphrase(ctx, env_var, prompt, confirm=False):
+def _resolve_bundle_passphrase(ctx, env_var, prompt, confirm=False, use_stdin=False):
     env = ctx.get("env", {})
     if env_var:
         passphrase = env.get(env_var)
         if not passphrase:
             raise CdxError(f"Environment variable {env_var} is empty or unset.")
         return passphrase
+    if use_stdin:
+        reader = ctx["options"].get("read_stdin")
+        raw = reader() if callable(reader) else sys.stdin.readline()
+        passphrase = (raw or "").rstrip("\r\n")
+        if not passphrase:
+            raise CdxError("Bundle passphrase from stdin is empty.")
+        return passphrase
     if not ctx["stdin_is_tty"]:
-        raise CdxError("Encrypted bundle export/import requires an interactive terminal or --passphrase-env.")
+        raise CdxError("Encrypted bundle export/import requires an interactive terminal, --passphrase-env, or --passphrase-stdin.")
     getpass_fn = ctx["options"].get("getpass") or getpass.getpass
     passphrase = getpass_fn(prompt)
     if not passphrase:
@@ -1757,6 +1764,7 @@ def handle_export(rest, ctx):
             parsed["passphrase_env"],
             "Bundle passphrase: ",
             confirm=True,
+            use_stdin=parsed["passphrase_stdin"],
         )
     result = ctx["service"]["export_bundle"](
         parsed["file_path"],
@@ -1796,6 +1804,7 @@ def handle_import(rest, ctx):
             parsed["passphrase_env"],
             "Bundle passphrase: ",
             confirm=False,
+            use_stdin=parsed["passphrase_stdin"],
         )
     result = ctx["service"]["import_bundle"](
         parsed["file_path"],

package/src/provider_runtime.py

@@ -375,8 +375,9 @@ def _wrap_launch_with_transcript(session, spec, capture_transcript=True, env=Non
 
 def _default_script_args(transcript_path, spec):
     if sys.platform.startswith("linux"):
+        # util-linux `script` flushes with -f (lowercase); -F is the BSD/macOS spelling and errors here.
         command = shlex.join([spec["command"]] + spec["args"])
-        return ["-q", "-F", "-c", command, transcript_path]
+        return ["-q", "-f", "-c", command, transcript_path]
     return ["-q", "-F", transcript_path, spec["command"]] + spec["args"]