cdx-manager 0.9.14 → 0.9.16

package/README.md

@@ -1,6 +1,6 @@
 # CDX Manager
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.9.14-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.9.16-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Run multiple Codex, Claude, Antigravity, and Ollama sessions from one terminal. Switch between accounts instantly.**
 

package/bin/python-runner.js

@@ -7,12 +7,6 @@ const { spawnSync } = require("node:child_process");
 
 const PYTHON_VERSION_CHECK = "import sys; sys.exit(0 if sys.version_info[0] == 3 else 1)";
 const PYTHON_CACHE_PREFIX = path.join(os.tmpdir(), "cdx-manager-pycache");
-const SIGNAL_EXIT_CODES = {
-  SIGHUP: 129,
-  SIGINT: 130,
-  SIGTERM: 143,
-};
-
 const WINDOWS_CANDIDATES = [
   { command: "py", args: ["-3"], label: "py -3" },
   { command: "python", args: [], label: "python" },
@@ -148,7 +142,10 @@ function runPython(args, options = {}) {
   }
 
   if (result.signal) {
-    return SIGNAL_EXIT_CODES[result.signal] || 128;
+    // Conventional 128+signum so supervisors can tell SIGKILL (137) from
+    // SIGSEGV (139) instead of a flat 128.
+    const signum = os.constants.signals[result.signal];
+    return signum ? 128 + signum : 128;
   }
 
   return typeof result.status === "number" ? result.status : 1;

package/changelogs/CHANGELOGS_0_9_15.md

@@ -0,0 +1,39 @@
+# CDX Manager 0.9.15
+
+## Highlights
+
+- Hardened concurrent session, run, and file updates against lost or partial writes.
+- Improved status accuracy when multiple Codex and Claude data sources disagree.
+- Tightened credential handling, headless process cleanup, CLI parsing, and release gating.
+
+## Changes
+
+### Reliable state and status
+
+Session and run read-modify-write operations now stay under a single lock, and context, settings, and bundle exports use atomic replacement. Merge imports preserve live local runtime state, malformed JSONL usage records no longer discard an entire run, and refresh tolerates late or failed per-session writes.
+
+Status selection now ranks structured, attributed, and fresh records consistently, preserves compatible fields across equally trusted candidates, handles year-wrapped reset timestamps, and treats a zero credit balance as no remaining credit.
+
+### Safer auth and process handling
+
+Credential files and directories are private from creation, and temporary Claude setup-token transcripts are removed on both success and failure.
+
+Headless timeouts terminate the complete process group, while signal exits consistently return `128 + signum`.
+
+### CLI, updates, and release automation
+
+Argument parsing now rejects conflicting target selectors and flags used as values, while subcommand help remains scoped to the subcommand. Headless selection no longer imposes an implicit reasoning-effort floor.
+
+Failed Logics Manager version checks are no longer cached, missing updater return codes fail safely, non-epoch Claude reset headers no longer abort refresh, and publication now gates on the latest CI run for the release commit.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/changelogs/CHANGELOGS_0_9_16.md

@@ -0,0 +1,19 @@
+# CDX Manager 0.9.16
+
+## Highlights
+
+- Clear error message when a provider CLI binary is broken instead of a raw Python traceback.
+
+## Changes
+
+### Friendlier auth probe failures
+
+Launching a session whose provider CLI exists but cannot be executed (corrupted install, wrong architecture, or a script missing its shebang — e.g. `Exec format error` on `~/.local/bin/claude`) previously crashed with an unhandled `OSError` traceback. The auth probe now catches all `OSError` failures and reports an actionable message telling the user to reinstall the provider CLI, exiting with code 126.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`

package/checksums/release-archives.json

@@ -120,6 +120,14 @@
     "v0.9.13": {
       "github_tarball_sha256": "4541dcecbfc12705f8e50e61ab1cb1f53dd6a209cc4a6d33ec3a4e533a3da3eb",
       "github_zip_sha256": "a8df11be1910a0562e0f97f69e9f35ee2fdf90ef50cb40689c85bf5ee5937027"
+    },
+    "v0.9.14": {
+      "github_tarball_sha256": "5469be5448eee56b5f0834d0c42d9ed3ca088158f08052bd8addc552635fe33d",
+      "github_zip_sha256": "7eb5650cb348e3ef2a082cd7fb39d7f4c170d4a095fe88719a7ebbfb7601db48"
+    },
+    "v0.9.15": {
+      "github_tarball_sha256": "08e6c5a3459fdd65d1f6085ca03a3614f07b4bf44c57a995a3ef47446aa70482",
+      "github_zip_sha256": "c8ac01f4a65e85b417f5eba5139868ab17b8f0952bf99f17f0a79f73ef0f36d6"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.9.14",
+  "version": "0.9.16",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.9.14"
+version = "0.9.16"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/backup_bundle.py

@@ -40,6 +40,8 @@ def read_bundle_meta(data):
     except (UnicodeDecodeError, json.JSONDecodeError) as error:
         raise CdxError("Invalid bundle format.") from error
 
+    if not isinstance(wrapper, dict):
+        raise CdxError("Invalid bundle format.")
     if wrapper.get("schema_version") != BUNDLE_SCHEMA_VERSION:
         raise CdxError("Unsupported bundle schema version.")
     return wrapper

package/src/claude_refresh.py

@@ -83,9 +83,16 @@ def _refresh_claude_sessions(service, refresh_fn=None, target_names=None, force=
         for t in threads:
             t.join(timeout=10)
 
+    # A worker that outlived its join can still insert into results/errors;
+    # snapshot both so late writes can't mutate what we iterate.
+    results = dict(results)
+    errors = list(errors)
+
+    recorded = []
     for name, usage in results.items():
         try:
             service["record_status"](name, usage)
-        except CdxError:
+            recorded.append(name)
+        except (CdxError, OSError):
             errors.append({"session": name, "error": CdxError(f"Failed to record Claude status for {name}")})
-    return {"refreshed": sorted(results), "errors": errors}
+    return {"refreshed": sorted(recorded), "errors": errors}

package/src/claude_usage.py

@@ -103,10 +103,41 @@ def _refresh_claude_cli_credentials(auth_home, runner=None, env=None):
 
 
 def _format_reset_date(unix_seconds):
-    dt = datetime.fromtimestamp(unix_seconds, tz=timezone.utc).astimezone()
+    try:
+        dt = datetime.fromtimestamp(unix_seconds, tz=timezone.utc).astimezone()
+    except (TypeError, ValueError, OSError):
+        return None
     return f"{MONTH_ABBR[dt.month - 1]} {dt.day} {str(dt.hour).zfill(2)}:{str(dt.minute).zfill(2)}"
 
 
+def _parse_reset_epoch(value):
+    # The reset headers are unix seconds today, but an RFC3339 value must
+    # not abort the whole refresh.
+    if value in (None, ""):
+        return None
+    text = str(value).strip()
+    try:
+        return float(text)
+    except ValueError:
+        pass
+    try:
+        parsed = datetime.fromisoformat(text.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=timezone.utc)
+    return parsed.timestamp()
+
+
+def _safe_float(value):
+    if value is None:
+        return None
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return None
+
+
 def _remaining_from_utilization(value):
     if value is None:
         return None
@@ -184,11 +215,11 @@ def fetch_claude_rate_limit_headers(access_token):
     if util_5h is None and util_7d is None:
         return None
 
-    utilization_5h = float(util_5h) if util_5h is not None else None
-    utilization_7d = float(util_7d) if util_7d is not None else None
+    utilization_5h = _safe_float(util_5h)
+    utilization_7d = _safe_float(util_7d)
 
-    reset_5h_at = _format_reset_date(int(reset_5h)) if reset_5h else None
-    reset_week_at = _format_reset_date(int(reset_7d)) if reset_7d else None
+    reset_5h_at = _format_reset_date(_parse_reset_epoch(reset_5h)) if reset_5h else None
+    reset_week_at = _format_reset_date(_parse_reset_epoch(reset_7d)) if reset_7d else None
     reset_at = reset_week_at or reset_5h_at
 
     return {

package/src/cli.py

@@ -66,7 +66,7 @@ from .status_view import (
 )
 from .update_check import check_for_update, check_logics_manager_for_update
 
-VERSION = "0.9.14"
+VERSION = "0.9.16"
 
 # Public surface: this module is a facade. Names below are imported above
 # purely to be re-exported (consumed by tests and external callers); listing
@@ -324,14 +324,15 @@ def main(argv, options=None):
     def err(text):
         stderr.write(text)
 
-    # Flags
-    if "--help" in argv or "-h" in argv:
+    # Flags — only when leading, so 'cdx history -h' reaches the subcommand
+    # instead of being hijacked as a malformed top-level help call.
+    if argv[:1] in (["--help"], ["-h"]):
         if len(argv) != 1:
             raise CdxError("Usage: cdx --help")
         out(f"{_print_help(use_color=use_color)}\n")
         return 0
 
-    if "--version" in argv or "-v" in argv:
+    if argv[:1] in (["--version"], ["-v"]):
         if len(argv) != 1:
             raise CdxError("Usage: cdx --version")
         out(f"{_print_version()}\n")

package/src/cli_args.py

@@ -55,7 +55,7 @@ def _parse_flag_args(args, schema, usage, positionals_key=None, max_positionals=
                 parsed[spec["key"]] = True
                 index += 1
                 continue
-            value, index = _read_option_value(args, index, usage)
+            value, index = _read_option_value(args, index, usage, schema=schema)
             parsed[spec["key"]] = spec.get("transform", lambda item: item)(value)
             continue
         if arg.startswith("--") and "=" in arg:
@@ -162,6 +162,8 @@ def _parse_set_args(args):
         raise CdxError(SET_USAGE)
     if parsed["names"] and parsed["provider"]:
         raise CdxError(SET_USAGE)
+    if parsed["sessions"] and parsed["provider"]:
+        raise CdxError(SET_USAGE)
     if not parsed["names"] and not parsed["sessions"] and not parsed["provider"]:
         raise CdxError(SET_USAGE)
     settings = {
@@ -200,6 +202,8 @@ def _parse_unset_args(args):
         raise CdxError(UNSET_USAGE)
     if parsed["names"] and parsed["provider"]:
         raise CdxError(UNSET_USAGE)
+    if parsed["sessions"] and parsed["provider"]:
+        raise CdxError(UNSET_USAGE)
     if not parsed["names"] and not parsed["sessions"] and not parsed["provider"]:
         raise CdxError(UNSET_USAGE)
     keys = ["power", "permission", "fast", "rtk", "logics", "model", "priority"] if parsed["all"] else [
@@ -501,10 +505,16 @@ def _parse_stats_args(args, now=None):
     }
 
 
-def _read_option_value(args, index, usage):
+def _read_option_value(args, index, usage, schema=None):
     if index + 1 >= len(args):
         raise CdxError(usage)
-    return args[index + 1], index + 2
+    value = args[index + 1]
+    # A known flag is never a value: '--model --json' is a missing value,
+    # not model='--json'. Literal flag-like values remain expressible as
+    # '--model=--json'.
+    if schema and value in schema:
+        raise CdxError(usage)
+    return value, index + 2
 
 
 def _parse_session_names(value):

package/src/cli_commands.py

@@ -79,6 +79,7 @@ from .context_store import (
     write_context,
 )
 from .errors import CdxError
+from .fs_utils import atomic_write
 from .health import collect_health_report, format_health_report
 from .notify import (
     format_notify_event,
@@ -170,20 +171,19 @@ def _extract_claude_oauth_token(text):
 
 def _write_claude_oauth_token(auth_home, token):
     cred_dir = os.path.join(auth_home, "credentials")
-    os.makedirs(cred_dir, exist_ok=True)
+    os.makedirs(cred_dir, mode=0o700, exist_ok=True)
+    try:
+        os.chmod(cred_dir, 0o700)
+    except OSError:
+        pass
     cred_path = os.path.join(cred_dir, "default.json")
     payload = {
         "version": "1.0",
         "type": "oauth_token",
         "access_token": token,
     }
-    with open(cred_path, "w", encoding="utf-8") as handle:
-        json.dump(payload, handle, indent=2)
-        handle.write("\n")
-    try:
-        os.chmod(cred_path, 0o600)
-    except OSError:
-        pass
+    # atomic_write keeps the token 0o600 from creation — no umask window.
+    atomic_write(cred_path, json.dumps(payload, indent=2) + "\n", mode=0o600)
     return cred_path
 
 
@@ -204,18 +204,22 @@ def _bootstrap_claude_setup_token(session, ctx):
             "Claude setup-token completed, but cdx could not capture the token. "
             "Run claude setup-token and save the token under credentials/default.json."
         )
-    with open(transcript_path, encoding="utf-8", errors="replace") as handle:
-        transcript = handle.read()
+    try:
+        with open(transcript_path, encoding="utf-8", errors="replace") as handle:
+            transcript = handle.read()
+    finally:
+        # The transcript holds the ~1-year OAuth token in cleartext; it must
+        # not outlive the extraction, whether it succeeds or not.
+        try:
+            os.remove(transcript_path)
+        except OSError:
+            pass
     token = _extract_claude_oauth_token(transcript)
     if not token:
         raise CdxError(
             "Claude setup-token completed, but cdx could not find CLAUDE_CODE_OAUTH_TOKEN in the output. "
-            f"Transcript kept at: {transcript_path}"
+            "Run claude setup-token manually and save the token under credentials/default.json."
         )
-    try:
-        os.remove(transcript_path)
-    except OSError:
-        pass
     auth_home = session.get("authHome") or ""
     cred_path = _write_claude_oauth_token(auth_home, token)
     # ponytail: drop short-lived claude login creds so the ~1yr token wins at launch (provider_runtime _read_claude_launch_oauth_token)
@@ -819,11 +823,12 @@ def _select_headless_session(ctx, provider, min_reasoning_effort=None, require_r
         session for session in ctx["service"]["list_sessions"]()
         if session.get("provider") == provider and session.get("enabled", True) is not False
     ]
-    minimum = _reasoning_rank(min_reasoning_effort)
-    sessions = [
-        session for session in sessions
-        if _reasoning_rank(_session_reasoning_effort(session)) >= minimum
-    ]
+    if min_reasoning_effort:
+        minimum = _reasoning_rank(min_reasoning_effort)
+        sessions = [
+            session for session in sessions
+            if _reasoning_rank(_session_reasoning_effort(session)) >= minimum
+        ]
     rows = ctx["service"]["get_status_rows"](force_refresh=force_refresh)
     row_by_name = {row.get("session_name"): row for row in rows}
     candidates = []
@@ -1971,7 +1976,7 @@ def handle_update(rest, ctx):
         base_prefix=ctx["options"].get("basePrefix"),
     )
     results = run_update_plan(plan, runner=ctx["options"].get("runUpdate"), env=ctx.get("env"))
-    failed = any((result.get("returncode") not in (0, None)) for result in results)
+    failed = any((result.get("returncode") != 0) for result in results)
     if failed:
         raise CdxError(format_update_failure(results))
 

package/src/cli_render.py

@@ -10,7 +10,7 @@ def _format_relative_age(iso_value):
     if not iso_value:
         return "-"
     try:
-        ts = datetime.fromisoformat(iso_value.replace("Z", "+00:00"))
+        ts = datetime.fromisoformat(str(iso_value).replace("Z", "+00:00"))
         delta_s = (datetime.now(timezone.utc) - ts).total_seconds()
     except (ValueError, TypeError):
         return "-"

package/src/codex_usage.py

@@ -6,6 +6,8 @@ import subprocess
 import threading
 from datetime import datetime, timezone
 
+from .status_source import _is_zero_credit_balance
+
 try:
     import fcntl
 except ImportError:  # pragma: no cover - non-POSIX platforms
@@ -92,7 +94,7 @@ def normalize_codex_rate_limit_snapshot(snapshot):
     credit_balance = None
     if isinstance(credits, dict):
         credit_balance = credits.get("balance")
-        if not credits.get("hasCredits") and not credits.get("unlimited") and str(credit_balance or "0") == "0":
+        if not credits.get("hasCredits") and not credits.get("unlimited") and _is_zero_credit_balance(credit_balance):
             credit_balance = None
     elif credits is not None:
         credit_balance = credits

package/src/context_store.py

@@ -5,6 +5,7 @@ import subprocess
 from datetime import datetime
 
 from .errors import CdxError
+from .fs_utils import atomic_write
 from .session_store import _ensure_dir
 
 DEFAULT_CONTEXT_TEMPLATE = """# Shared Context
@@ -57,8 +58,7 @@ def read_context(base_dir, cwd=None):
 def write_context(base_dir, content, cwd=None):
     path = get_context_path(base_dir, cwd)
     _ensure_dir(os.path.dirname(path))
-    with open(path, "w", encoding="utf-8") as handle:
-        handle.write(content.rstrip() + "\n")
+    atomic_write(path, content.rstrip() + "\n", mode=0o644)
     return {
         "path": path,
         "updated_at": _local_now_iso(),
@@ -117,8 +117,7 @@ def install_context_for_session(base_dir, session, cwd=None):
         raise CdxError(f"Session auth home missing for {session['name']}")
     target_path = os.path.join(auth_home, "shared-context.md")
     _ensure_dir(os.path.dirname(target_path))
-    with open(target_path, "w", encoding="utf-8") as handle:
-        handle.write(content.rstrip() + "\n")
+    atomic_write(target_path, content.rstrip() + "\n", mode=0o644)
     return {
         "source_path": get_context_path(base_dir, cwd),
         "target_path": target_path,

package/src/fs_utils.py

@@ -2,6 +2,38 @@ import inspect
 import os
 import shutil
 import stat
+import tempfile
+
+
+def atomic_write(path, data, mode=None):
+    """Write str/bytes via temp file + rename so a crash can't leave a torn file.
+
+    mkstemp creates the temp file 0o600, so the content is never readable by
+    other users mid-write; pass mode to set the final permissions before the
+    rename makes the file visible.
+    """
+    directory = os.path.dirname(os.path.abspath(path))
+    os.makedirs(directory, exist_ok=True)
+    binary = isinstance(data, (bytes, bytearray))
+    fd, temp_path = tempfile.mkstemp(prefix=f".{os.path.basename(path)}.", suffix=".tmp", dir=directory)
+    try:
+        if binary:
+            handle = os.fdopen(fd, "wb")
+        else:
+            handle = os.fdopen(fd, "w", encoding="utf-8")
+        with handle:
+            handle.write(data)
+            handle.flush()
+            os.fsync(handle.fileno())
+        if mode is not None and os.name != "nt":
+            os.chmod(temp_path, mode)
+        os.replace(temp_path, path)
+    except Exception:
+        try:
+            os.unlink(temp_path)
+        except FileNotFoundError:
+            pass
+        raise
 
 
 def _make_user_writable(path):

package/src/provider_runtime.py

@@ -1,3 +1,4 @@
+import errno
 import json
 import os
 import re
@@ -695,6 +696,45 @@ def _redact_sensitive_args(spec):
     return [REDACTED_PROMPT_ARG if arg in sensitive else arg for arg in args]
 
 
+def _signal_child_group(child, sig):
+    # Providers spawn helpers of their own; signal the whole group so
+    # grandchildren die with the child. Falls back to False when the child
+    # shares our group (test doubles spawned without start_new_session).
+    pid = getattr(child, "pid", None)
+    if not pid or not hasattr(os, "getpgid"):
+        return False
+    try:
+        pgid = os.getpgid(pid)
+        if pgid == os.getpgid(0):
+            return False
+        os.killpg(pgid, sig)
+        return True
+    except (OSError, TypeError):
+        return False
+
+
+def _terminate_child_tree(child):
+    if not _signal_child_group(child, signal.SIGTERM):
+        try:
+            child.terminate()
+        except Exception:
+            pass
+    try:
+        child.wait(timeout=5)
+        return
+    except Exception:
+        pass
+    if not _signal_child_group(child, signal.SIGKILL):
+        try:
+            child.kill()
+        except Exception:
+            pass
+    try:
+        child.wait()
+    except Exception:
+        pass
+
+
 def _run_headless_provider_command(session, cwd=None, env_override=None, initial_prompt=None,
                                    timeout_seconds=None, spawn=None, run_id=None):
     spawn = spawn or subprocess.Popen
@@ -714,12 +754,16 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
     timed_out = False
     with open(paths["stdout_path"], "w", encoding="utf-8", errors="replace") as stdout_file, \
             open(paths["stderr_path"], "w", encoding="utf-8", errors="replace") as stderr_file:
+        options = {k: v for k, v in spec.get("options", {}).items() if k not in ("stdio", "stdout", "stderr")}
+        if spawn is subprocess.Popen:
+            # Own process group so a timeout can kill grandchildren too.
+            options["start_new_session"] = True
         try:
             child = spawn(
                 [command] + spec["args"],
                 stdout=stdout_file,
                 stderr=stderr_file,
-                **{k: v for k, v in spec.get("options", {}).items() if k not in ("stdio", "stdout", "stderr")},
+                **options,
             )
         except FileNotFoundError as error:
             _combine_headless_transcript(paths)
@@ -740,18 +784,7 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
             child.wait()
         except subprocess.TimeoutExpired:
             timed_out = True
-            try:
-                child.terminate()
-                child.wait(timeout=5)
-            except Exception:
-                try:
-                    child.kill()
-                except Exception:
-                    pass
-                try:
-                    child.wait()
-                except Exception:
-                    pass
+            _terminate_child_tree(child)
 
     _combine_headless_transcript(paths)
     end_time = datetime.now(timezone.utc)
@@ -849,6 +882,14 @@ def _format_probe_failure(session, spec, error):
             f"Install {command} and retry cdx add {session['name']}.",
             127,
         )
+    if isinstance(error, OSError) and error.errno == errno.ENOEXEC:
+        target = getattr(error, "filename", None) or command
+        return CdxError(
+            f"Failed to check login status for {session['name']}: {target} is not a valid executable "
+            f"(corrupted install, wrong architecture, or a script missing its shebang). "
+            f"Reinstall {command} and retry.",
+            126,
+        )
     message = getattr(error, "message", None) or str(error)
     return CdxError(f"Failed to check login status for {session['name']}: {message}")
 
@@ -883,7 +924,7 @@ def _probe_provider_auth(session, spawn_sync=None, env_override=None, trust_loca
             stdout = result.get("stdout") if isinstance(result, dict) else getattr(result, "stdout", "")
             stderr = result.get("stderr") if isinstance(result, dict) else getattr(result, "stderr", "")
             output = (stdout or "") + (stderr or "")
-    except FileNotFoundError as error:
+    except OSError as error:
         raise _format_probe_failure(session, spec, error) from error
     return spec["parser"](output)