cdx-manager 0.9.13 → 0.9.15

package/README.md

@@ -1,6 +1,6 @@
 # CDX Manager
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.9.13-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.9.15-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Run multiple Codex, Claude, Antigravity, and Ollama sessions from one terminal. Switch between accounts instantly.**
 
@@ -359,8 +359,8 @@ cdx history --summary --from 2026-05-01 --to 2026-05-28
 | `cdx handoff <source> <target> [--json]` | Build shared context from the source session's latest launch transcript, install it into the target session, and launch the target unless `--json` is used; supports cross-provider handoff |
 | `cdx rmv <name> [--force] [--json]` | Remove a session and its auth data (prompts for confirmation unless `--force`) |
 | `cdx clean [name] [--json]` | Clear launch transcript logs for one session or all sessions |
-| `cdx export <file> [--include-auth] [--sessions a,b] [--passphrase-env VAR] [--force] [--json]` | Export sessions to a portable bundle; `--include-auth` encrypts auth data with a passphrase |
-| `cdx import <file> [--sessions a,b] [--passphrase-env VAR] [--force] [--json]` | Import sessions from a bundle into the current `CDX_HOME` |
+| `cdx export <file> [--include-auth] [--sessions a,b] [--passphrase-env VAR\|--passphrase-stdin] [--force] [--json]` | Export sessions to a portable bundle; `--include-auth` encrypts auth data with a passphrase |
+| `cdx import <file> [--sessions a,b] [--passphrase-env VAR\|--passphrase-stdin] [--force] [--json]` | Import sessions from a bundle into the current `CDX_HOME` |
 | `cdx doctor [--json]` | Inspect CLI dependencies, CDX_HOME permissions, missing state, orphan profiles, and pending quarantines |
 | `cdx repair [--dry-run] [--force] [--json]` | Plan or apply safe repairs for missing state files, quarantines, and orphan profiles |
 | `cdx view [--json] [--lan] [--lan-rw] [--focus <ref>] [--read] [--port <port>] [--host <host>] [--refresh-interval <s>] [--tls] [--tls-cert <path>] [--tls-key <path>] [--open] [--no-open]` | Open the Logics browser/focus viewer by delegating to `logics-manager view`; all viewer flags are forwarded; JSON mode reports diagnostics without launching it |
@@ -510,7 +510,7 @@ cdx import backup-auth.cdx --passphrase-env CDX_BUNDLE_PASSPHRASE
 Notes:
 
 - `--include-auth` is encrypted, requires a passphrase, and exports only provider credential files rather than full profile caches or logs.
-- Without `--passphrase-env`, `cdx` prompts in an interactive terminal.
+- Without `--passphrase-env`, `cdx` prompts in an interactive terminal. Non-interactive callers can pass `--passphrase-stdin` to read the passphrase from stdin (one line) instead of exposing it in the child environment.
 - `--sessions work,perso` exports or imports only a subset.
 - `--force` allows overwriting existing destination sessions during import or replacing an existing bundle file during export.
 - Auth bundles contain credentials. Treat them like secrets and delete them after transfer.

package/bin/python-runner.js

@@ -7,12 +7,6 @@ const { spawnSync } = require("node:child_process");
 
 const PYTHON_VERSION_CHECK = "import sys; sys.exit(0 if sys.version_info[0] == 3 else 1)";
 const PYTHON_CACHE_PREFIX = path.join(os.tmpdir(), "cdx-manager-pycache");
-const SIGNAL_EXIT_CODES = {
-  SIGHUP: 129,
-  SIGINT: 130,
-  SIGTERM: 143,
-};
-
 const WINDOWS_CANDIDATES = [
   { command: "py", args: ["-3"], label: "py -3" },
   { command: "python", args: [], label: "python" },
@@ -148,7 +142,10 @@ function runPython(args, options = {}) {
   }
 
   if (result.signal) {
-    return SIGNAL_EXIT_CODES[result.signal] || 128;
+    // Conventional 128+signum so supervisors can tell SIGKILL (137) from
+    // SIGSEGV (139) instead of a flat 128.
+    const signum = os.constants.signals[result.signal];
+    return signum ? 128 + signum : 128;
   }
 
   return typeof result.status === "number" ? result.status : 1;

package/changelogs/CHANGELOGS_0_9_14.md

@@ -0,0 +1,27 @@
+# CDX Manager 0.9.14
+
+## Highlights
+
+- Added `--passphrase-stdin` for auth bundle export/import flows, avoiding passphrases in child process environments.
+
+## Changes
+
+### Auth bundle passphrase input
+
+`cdx export --include-auth` and `cdx import` now accept `--passphrase-stdin` as an alternative to `--passphrase-env`.
+
+This lets non-interactive callers provide the bundle passphrase through standard input instead of storing it in an environment variable. The new flag is mutually exclusive with `--passphrase-env`, and export still requires `--include-auth` before a passphrase is accepted.
+
+Usage strings, command help, README examples, and regression coverage were updated for the new input mode.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/changelogs/CHANGELOGS_0_9_15.md

@@ -0,0 +1,39 @@
+# CDX Manager 0.9.15
+
+## Highlights
+
+- Hardened concurrent session, run, and file updates against lost or partial writes.
+- Improved status accuracy when multiple Codex and Claude data sources disagree.
+- Tightened credential handling, headless process cleanup, CLI parsing, and release gating.
+
+## Changes
+
+### Reliable state and status
+
+Session and run read-modify-write operations now stay under a single lock, and context, settings, and bundle exports use atomic replacement. Merge imports preserve live local runtime state, malformed JSONL usage records no longer discard an entire run, and refresh tolerates late or failed per-session writes.
+
+Status selection now ranks structured, attributed, and fresh records consistently, preserves compatible fields across equally trusted candidates, handles year-wrapped reset timestamps, and treats a zero credit balance as no remaining credit.
+
+### Safer auth and process handling
+
+Credential files and directories are private from creation, and temporary Claude setup-token transcripts are removed on both success and failure.
+
+Headless timeouts terminate the complete process group, while signal exits consistently return `128 + signum`.
+
+### CLI, updates, and release automation
+
+Argument parsing now rejects conflicting target selectors and flags used as values, while subcommand help remains scoped to the subcommand. Headless selection no longer imposes an implicit reasoning-effort floor.
+
+Failed Logics Manager version checks are no longer cached, missing updater return codes fail safely, non-epoch Claude reset headers no longer abort refresh, and publication now gates on the latest CI run for the release commit.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/checksums/release-archives.json

@@ -116,6 +116,14 @@
     "v0.9.12": {
       "github_tarball_sha256": "ed9de98e1b4df5e42a1e389580f03d4b4b2e09ee8f63d23110090e6f164b8ae6",
       "github_zip_sha256": "55f9ead146411ae740db1cae3f91c56d6ebe33c03345f9d4bfd487e45962e412"
+    },
+    "v0.9.13": {
+      "github_tarball_sha256": "4541dcecbfc12705f8e50e61ab1cb1f53dd6a209cc4a6d33ec3a4e533a3da3eb",
+      "github_zip_sha256": "a8df11be1910a0562e0f97f69e9f35ee2fdf90ef50cb40689c85bf5ee5937027"
+    },
+    "v0.9.14": {
+      "github_tarball_sha256": "5469be5448eee56b5f0834d0c42d9ed3ca088158f08052bd8addc552635fe33d",
+      "github_zip_sha256": "7eb5650cb348e3ef2a082cd7fb39d7f4c170d4a095fe88719a7ebbfb7601db48"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.9.13",
+  "version": "0.9.15",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.9.13"
+version = "0.9.15"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/backup_bundle.py

@@ -40,6 +40,8 @@ def read_bundle_meta(data):
     except (UnicodeDecodeError, json.JSONDecodeError) as error:
         raise CdxError("Invalid bundle format.") from error
 
+    if not isinstance(wrapper, dict):
+        raise CdxError("Invalid bundle format.")
     if wrapper.get("schema_version") != BUNDLE_SCHEMA_VERSION:
         raise CdxError("Unsupported bundle schema version.")
     return wrapper

package/src/claude_refresh.py

@@ -83,9 +83,16 @@ def _refresh_claude_sessions(service, refresh_fn=None, target_names=None, force=
         for t in threads:
             t.join(timeout=10)
 
+    # A worker that outlived its join can still insert into results/errors;
+    # snapshot both so late writes can't mutate what we iterate.
+    results = dict(results)
+    errors = list(errors)
+
+    recorded = []
     for name, usage in results.items():
         try:
             service["record_status"](name, usage)
-        except CdxError:
+            recorded.append(name)
+        except (CdxError, OSError):
             errors.append({"session": name, "error": CdxError(f"Failed to record Claude status for {name}")})
-    return {"refreshed": sorted(results), "errors": errors}
+    return {"refreshed": sorted(recorded), "errors": errors}

package/src/claude_usage.py

@@ -103,10 +103,41 @@ def _refresh_claude_cli_credentials(auth_home, runner=None, env=None):
 
 
 def _format_reset_date(unix_seconds):
-    dt = datetime.fromtimestamp(unix_seconds, tz=timezone.utc).astimezone()
+    try:
+        dt = datetime.fromtimestamp(unix_seconds, tz=timezone.utc).astimezone()
+    except (TypeError, ValueError, OSError):
+        return None
     return f"{MONTH_ABBR[dt.month - 1]} {dt.day} {str(dt.hour).zfill(2)}:{str(dt.minute).zfill(2)}"
 
 
+def _parse_reset_epoch(value):
+    # The reset headers are unix seconds today, but an RFC3339 value must
+    # not abort the whole refresh.
+    if value in (None, ""):
+        return None
+    text = str(value).strip()
+    try:
+        return float(text)
+    except ValueError:
+        pass
+    try:
+        parsed = datetime.fromisoformat(text.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=timezone.utc)
+    return parsed.timestamp()
+
+
+def _safe_float(value):
+    if value is None:
+        return None
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return None
+
+
 def _remaining_from_utilization(value):
     if value is None:
         return None
@@ -184,11 +215,11 @@ def fetch_claude_rate_limit_headers(access_token):
     if util_5h is None and util_7d is None:
         return None
 
-    utilization_5h = float(util_5h) if util_5h is not None else None
-    utilization_7d = float(util_7d) if util_7d is not None else None
+    utilization_5h = _safe_float(util_5h)
+    utilization_7d = _safe_float(util_7d)
 
-    reset_5h_at = _format_reset_date(int(reset_5h)) if reset_5h else None
-    reset_week_at = _format_reset_date(int(reset_7d)) if reset_7d else None
+    reset_5h_at = _format_reset_date(_parse_reset_epoch(reset_5h)) if reset_5h else None
+    reset_week_at = _format_reset_date(_parse_reset_epoch(reset_7d)) if reset_7d else None
     reset_at = reset_week_at or reset_5h_at
 
     return {

package/src/cli.py

@@ -66,7 +66,7 @@ from .status_view import (
 )
 from .update_check import check_for_update, check_logics_manager_for_update
 
-VERSION = "0.9.13"
+VERSION = "0.9.15"
 
 # Public surface: this module is a facade. Names below are imported above
 # purely to be re-exported (consumed by tests and external callers); listing
@@ -192,8 +192,8 @@ def _print_help(use_color=False):
         f"  {_style('cdx enable <name> [--json]', '36', use_color)}",
         f"  {_style('cdx rmv <name> [--force] [--json]', '36', use_color)}",
         f"  {_style('cdx clean [name] [--json]', '36', use_color)}",
-        f"  {_style('cdx export <file> [--include-auth] [--sessions a,b] [--passphrase-env VAR] [--force] [--json]', '36', use_color)}",
-        f"  {_style('cdx import <file> [--sessions a,b] [--passphrase-env VAR] [--force|--merge] [--json]', '36', use_color)}",
+        f"  {_style('cdx export <file> [--include-auth] [--sessions a,b] [--passphrase-env VAR|--passphrase-stdin] [--force] [--json]', '36', use_color)}",
+        f"  {_style('cdx import <file> [--sessions a,b] [--passphrase-env VAR|--passphrase-stdin] [--force|--merge] [--json]', '36', use_color)}",
         f"  {_style('cdx doctor [--json]', '36', use_color)}",
         f"  {_style('cdx repair [--dry-run] [--force] [--json]', '36', use_color)}",
         f"  {_style('cdx view [--json]', '36', use_color)}",
@@ -324,14 +324,15 @@ def main(argv, options=None):
     def err(text):
         stderr.write(text)
 
-    # Flags
-    if "--help" in argv or "-h" in argv:
+    # Flags — only when leading, so 'cdx history -h' reaches the subcommand
+    # instead of being hijacked as a malformed top-level help call.
+    if argv[:1] in (["--help"], ["-h"]):
         if len(argv) != 1:
             raise CdxError("Usage: cdx --help")
         out(f"{_print_help(use_color=use_color)}\n")
         return 0
 
-    if "--version" in argv or "-v" in argv:
+    if argv[:1] in (["--version"], ["-v"]):
         if len(argv) != 1:
             raise CdxError("Usage: cdx --version")
         out(f"{_print_version()}\n")

package/src/cli_args.py

@@ -15,8 +15,8 @@ STATUS_USAGE = "Usage: cdx status [--json] [--refresh|--cached] [--timeout SECON
 DOCTOR_USAGE = "Usage: cdx doctor [--json]"
 REPAIR_USAGE = "Usage: cdx repair [--dry-run] [--force] [--json]"
 UPDATE_USAGE = "Usage: cdx update [--check] [--yes] [--json] [--version TAG]"
-EXPORT_USAGE = "Usage: cdx export <file> [--include-auth] [--force] [--json] [--sessions name1,name2] [--passphrase-env VAR]"
-IMPORT_USAGE = "Usage: cdx import <file> [--force|--merge] [--json] [--sessions name1,name2] [--passphrase-env VAR]"
+EXPORT_USAGE = "Usage: cdx export <file> [--include-auth] [--force] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
+IMPORT_USAGE = "Usage: cdx import <file> [--force|--merge] [--json] [--sessions name1,name2] [--passphrase-env VAR|--passphrase-stdin]"
 CONTEXT_USAGE = "Usage: cdx context show|path|init|edit|clear|set [text...] [--json]"
 HANDOFF_USAGE = "Usage: cdx handoff <name> [--json] | cdx handoff <source> <target> [--json]"
 SET_USAGE = "Usage: cdx set <name>|--sessions all|a,b|--provider PROVIDER [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full] [--fast on|off] [--rtk on|off] [--logics on|off] [--model MODEL] [--priority 0..100] [--json]"
@@ -55,7 +55,7 @@ def _parse_flag_args(args, schema, usage, positionals_key=None, max_positionals=
                 parsed[spec["key"]] = True
                 index += 1
                 continue
-            value, index = _read_option_value(args, index, usage)
+            value, index = _read_option_value(args, index, usage, schema=schema)
             parsed[spec["key"]] = spec.get("transform", lambda item: item)(value)
             continue
         if arg.startswith("--") and "=" in arg:
@@ -162,6 +162,8 @@ def _parse_set_args(args):
         raise CdxError(SET_USAGE)
     if parsed["names"] and parsed["provider"]:
         raise CdxError(SET_USAGE)
+    if parsed["sessions"] and parsed["provider"]:
+        raise CdxError(SET_USAGE)
     if not parsed["names"] and not parsed["sessions"] and not parsed["provider"]:
         raise CdxError(SET_USAGE)
     settings = {
@@ -200,6 +202,8 @@ def _parse_unset_args(args):
         raise CdxError(UNSET_USAGE)
     if parsed["names"] and parsed["provider"]:
         raise CdxError(UNSET_USAGE)
+    if parsed["sessions"] and parsed["provider"]:
+        raise CdxError(UNSET_USAGE)
     if not parsed["names"] and not parsed["sessions"] and not parsed["provider"]:
         raise CdxError(UNSET_USAGE)
     keys = ["power", "permission", "fast", "rtk", "logics", "model", "priority"] if parsed["all"] else [
@@ -501,10 +505,16 @@ def _parse_stats_args(args, now=None):
     }
 
 
-def _read_option_value(args, index, usage):
+def _read_option_value(args, index, usage, schema=None):
     if index + 1 >= len(args):
         raise CdxError(usage)
-    return args[index + 1], index + 2
+    value = args[index + 1]
+    # A known flag is never a value: '--model --json' is a missing value,
+    # not model='--json'. Literal flag-like values remain expressible as
+    # '--model=--json'.
+    if schema and value in schema:
+        raise CdxError(usage)
+    return value, index + 2
 
 
 def _parse_session_names(value):
@@ -585,12 +595,15 @@ def _parse_export_args(args):
             "transform": _parse_session_names,
         },
         "--passphrase-env": {"key": "passphrase_env", "type": "str", "default": None},
+        "--passphrase-stdin": {"key": "passphrase_stdin", "type": "bool", "default": False},
     }, EXPORT_USAGE, positionals_key="positionals", max_positionals=1)
     parsed["file_path"] = parsed.pop("positionals")[0] if parsed["positionals"] else None
     if not parsed["file_path"]:
         raise CdxError(EXPORT_USAGE)
-    if parsed["passphrase_env"] and not parsed["include_auth"]:
-        raise CdxError("--passphrase-env requires --include-auth for export.")
+    if parsed["passphrase_env"] and parsed["passphrase_stdin"]:
+        raise CdxError("--passphrase-env and --passphrase-stdin are mutually exclusive.")
+    if (parsed["passphrase_env"] or parsed["passphrase_stdin"]) and not parsed["include_auth"]:
+        raise CdxError("--passphrase-env/--passphrase-stdin requires --include-auth for export.")
     return parsed
 
 
@@ -606,12 +619,15 @@ def _parse_import_args(args):
             "transform": _parse_session_names,
         },
         "--passphrase-env": {"key": "passphrase_env", "type": "str", "default": None},
+        "--passphrase-stdin": {"key": "passphrase_stdin", "type": "bool", "default": False},
     }, IMPORT_USAGE, positionals_key="positionals", max_positionals=1)
     parsed["file_path"] = parsed.pop("positionals")[0] if parsed["positionals"] else None
     if not parsed["file_path"]:
         raise CdxError(IMPORT_USAGE)
     if parsed["force"] and parsed["merge"]:
         raise CdxError("--force and --merge are mutually exclusive.")
+    if parsed["passphrase_env"] and parsed["passphrase_stdin"]:
+        raise CdxError("--passphrase-env and --passphrase-stdin are mutually exclusive.")
     return parsed
 
 

package/src/cli_commands.py

@@ -79,6 +79,7 @@ from .context_store import (
     write_context,
 )
 from .errors import CdxError
+from .fs_utils import atomic_write
 from .health import collect_health_report, format_health_report
 from .notify import (
     format_notify_event,
@@ -107,15 +108,22 @@ from .update_check import LatestReleaseCheckError, fetch_latest_release, fetch_l
 from .update_manager import build_update_plan, format_update_failure, run_update_plan, verify_updated_command
 
 
-def _resolve_bundle_passphrase(ctx, env_var, prompt, confirm=False):
+def _resolve_bundle_passphrase(ctx, env_var, prompt, confirm=False, use_stdin=False):
     env = ctx.get("env", {})
     if env_var:
         passphrase = env.get(env_var)
         if not passphrase:
             raise CdxError(f"Environment variable {env_var} is empty or unset.")
         return passphrase
+    if use_stdin:
+        reader = ctx["options"].get("read_stdin")
+        raw = reader() if callable(reader) else sys.stdin.readline()
+        passphrase = (raw or "").rstrip("\r\n")
+        if not passphrase:
+            raise CdxError("Bundle passphrase from stdin is empty.")
+        return passphrase
     if not ctx["stdin_is_tty"]:
-        raise CdxError("Encrypted bundle export/import requires an interactive terminal or --passphrase-env.")
+        raise CdxError("Encrypted bundle export/import requires an interactive terminal, --passphrase-env, or --passphrase-stdin.")
     getpass_fn = ctx["options"].get("getpass") or getpass.getpass
     passphrase = getpass_fn(prompt)
     if not passphrase:
@@ -163,20 +171,19 @@ def _extract_claude_oauth_token(text):
 
 def _write_claude_oauth_token(auth_home, token):
     cred_dir = os.path.join(auth_home, "credentials")
-    os.makedirs(cred_dir, exist_ok=True)
+    os.makedirs(cred_dir, mode=0o700, exist_ok=True)
+    try:
+        os.chmod(cred_dir, 0o700)
+    except OSError:
+        pass
     cred_path = os.path.join(cred_dir, "default.json")
     payload = {
         "version": "1.0",
         "type": "oauth_token",
         "access_token": token,
     }
-    with open(cred_path, "w", encoding="utf-8") as handle:
-        json.dump(payload, handle, indent=2)
-        handle.write("\n")
-    try:
-        os.chmod(cred_path, 0o600)
-    except OSError:
-        pass
+    # atomic_write keeps the token 0o600 from creation — no umask window.
+    atomic_write(cred_path, json.dumps(payload, indent=2) + "\n", mode=0o600)
     return cred_path
 
 
@@ -197,18 +204,22 @@ def _bootstrap_claude_setup_token(session, ctx):
             "Claude setup-token completed, but cdx could not capture the token. "
             "Run claude setup-token and save the token under credentials/default.json."
         )
-    with open(transcript_path, encoding="utf-8", errors="replace") as handle:
-        transcript = handle.read()
+    try:
+        with open(transcript_path, encoding="utf-8", errors="replace") as handle:
+            transcript = handle.read()
+    finally:
+        # The transcript holds the ~1-year OAuth token in cleartext; it must
+        # not outlive the extraction, whether it succeeds or not.
+        try:
+            os.remove(transcript_path)
+        except OSError:
+            pass
     token = _extract_claude_oauth_token(transcript)
     if not token:
         raise CdxError(
             "Claude setup-token completed, but cdx could not find CLAUDE_CODE_OAUTH_TOKEN in the output. "
-            f"Transcript kept at: {transcript_path}"
+            "Run claude setup-token manually and save the token under credentials/default.json."
         )
-    try:
-        os.remove(transcript_path)
-    except OSError:
-        pass
     auth_home = session.get("authHome") or ""
     cred_path = _write_claude_oauth_token(auth_home, token)
     # ponytail: drop short-lived claude login creds so the ~1yr token wins at launch (provider_runtime _read_claude_launch_oauth_token)
@@ -812,11 +823,12 @@ def _select_headless_session(ctx, provider, min_reasoning_effort=None, require_r
         session for session in ctx["service"]["list_sessions"]()
         if session.get("provider") == provider and session.get("enabled", True) is not False
     ]
-    minimum = _reasoning_rank(min_reasoning_effort)
-    sessions = [
-        session for session in sessions
-        if _reasoning_rank(_session_reasoning_effort(session)) >= minimum
-    ]
+    if min_reasoning_effort:
+        minimum = _reasoning_rank(min_reasoning_effort)
+        sessions = [
+            session for session in sessions
+            if _reasoning_rank(_session_reasoning_effort(session)) >= minimum
+        ]
     rows = ctx["service"]["get_status_rows"](force_refresh=force_refresh)
     row_by_name = {row.get("session_name"): row for row in rows}
     candidates = []
@@ -1757,6 +1769,7 @@ def handle_export(rest, ctx):
             parsed["passphrase_env"],
             "Bundle passphrase: ",
             confirm=True,
+            use_stdin=parsed["passphrase_stdin"],
         )
     result = ctx["service"]["export_bundle"](
         parsed["file_path"],
@@ -1796,6 +1809,7 @@ def handle_import(rest, ctx):
             parsed["passphrase_env"],
             "Bundle passphrase: ",
             confirm=False,
+            use_stdin=parsed["passphrase_stdin"],
         )
     result = ctx["service"]["import_bundle"](
         parsed["file_path"],
@@ -1962,7 +1976,7 @@ def handle_update(rest, ctx):
         base_prefix=ctx["options"].get("basePrefix"),
     )
     results = run_update_plan(plan, runner=ctx["options"].get("runUpdate"), env=ctx.get("env"))
-    failed = any((result.get("returncode") not in (0, None)) for result in results)
+    failed = any((result.get("returncode") != 0) for result in results)
     if failed:
         raise CdxError(format_update_failure(results))
 

package/src/cli_render.py

@@ -10,7 +10,7 @@ def _format_relative_age(iso_value):
     if not iso_value:
         return "-"
     try:
-        ts = datetime.fromisoformat(iso_value.replace("Z", "+00:00"))
+        ts = datetime.fromisoformat(str(iso_value).replace("Z", "+00:00"))
         delta_s = (datetime.now(timezone.utc) - ts).total_seconds()
     except (ValueError, TypeError):
         return "-"

package/src/codex_usage.py

@@ -6,6 +6,8 @@ import subprocess
 import threading
 from datetime import datetime, timezone
 
+from .status_source import _is_zero_credit_balance
+
 try:
     import fcntl
 except ImportError:  # pragma: no cover - non-POSIX platforms
@@ -92,7 +94,7 @@ def normalize_codex_rate_limit_snapshot(snapshot):
     credit_balance = None
     if isinstance(credits, dict):
         credit_balance = credits.get("balance")
-        if not credits.get("hasCredits") and not credits.get("unlimited") and str(credit_balance or "0") == "0":
+        if not credits.get("hasCredits") and not credits.get("unlimited") and _is_zero_credit_balance(credit_balance):
             credit_balance = None
     elif credits is not None:
         credit_balance = credits

package/src/context_store.py

@@ -5,6 +5,7 @@ import subprocess
 from datetime import datetime
 
 from .errors import CdxError
+from .fs_utils import atomic_write
 from .session_store import _ensure_dir
 
 DEFAULT_CONTEXT_TEMPLATE = """# Shared Context
@@ -57,8 +58,7 @@ def read_context(base_dir, cwd=None):
 def write_context(base_dir, content, cwd=None):
     path = get_context_path(base_dir, cwd)
     _ensure_dir(os.path.dirname(path))
-    with open(path, "w", encoding="utf-8") as handle:
-        handle.write(content.rstrip() + "\n")
+    atomic_write(path, content.rstrip() + "\n", mode=0o644)
     return {
         "path": path,
         "updated_at": _local_now_iso(),
@@ -117,8 +117,7 @@ def install_context_for_session(base_dir, session, cwd=None):
         raise CdxError(f"Session auth home missing for {session['name']}")
     target_path = os.path.join(auth_home, "shared-context.md")
     _ensure_dir(os.path.dirname(target_path))
-    with open(target_path, "w", encoding="utf-8") as handle:
-        handle.write(content.rstrip() + "\n")
+    atomic_write(target_path, content.rstrip() + "\n", mode=0o644)
     return {
         "source_path": get_context_path(base_dir, cwd),
         "target_path": target_path,

package/src/fs_utils.py

@@ -2,6 +2,38 @@ import inspect
 import os
 import shutil
 import stat
+import tempfile
+
+
+def atomic_write(path, data, mode=None):
+    """Write str/bytes via temp file + rename so a crash can't leave a torn file.
+
+    mkstemp creates the temp file 0o600, so the content is never readable by
+    other users mid-write; pass mode to set the final permissions before the
+    rename makes the file visible.
+    """
+    directory = os.path.dirname(os.path.abspath(path))
+    os.makedirs(directory, exist_ok=True)
+    binary = isinstance(data, (bytes, bytearray))
+    fd, temp_path = tempfile.mkstemp(prefix=f".{os.path.basename(path)}.", suffix=".tmp", dir=directory)
+    try:
+        if binary:
+            handle = os.fdopen(fd, "wb")
+        else:
+            handle = os.fdopen(fd, "w", encoding="utf-8")
+        with handle:
+            handle.write(data)
+            handle.flush()
+            os.fsync(handle.fileno())
+        if mode is not None and os.name != "nt":
+            os.chmod(temp_path, mode)
+        os.replace(temp_path, path)
+    except Exception:
+        try:
+            os.unlink(temp_path)
+        except FileNotFoundError:
+            pass
+        raise
 
 
 def _make_user_writable(path):