cdx-manager 0.9.16 → 0.11.0

package/README.md

@@ -1,6 +1,6 @@
 # CDX Manager
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.9.16-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.11.0-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Run multiple Codex, Claude, Antigravity, and Ollama sessions from one terminal. Switch between accounts instantly.**
 
@@ -41,10 +41,12 @@ One command to launch any session. Zero auth juggling.
 - **Session control.** Disable a session without deleting it when an account is temporarily out of credits; disabled sessions remain visible and sort last.
 - **Persistent launch settings.** Pin per-session power, permission, and fast-mode preferences once; `cdx` reapplies them on every launch until you unset them.
 - **Launch history.** Inspect recent launches with provider, result, duration, working directory, launch settings, and transcript path.
+- **Disk usage and cleanup.** `cdx disk` reports `CDX_HOME` usage, `cdx disk profiles --candidates` identifies reclaimable profile caches/logs with evidence, and `cdx clean profiles ...` applies explicit cleanup actions.
 - **Update prompts.** Periodic update checks surface `cdx update` directly in the `cdx`, `cdx status`, and launch output when a newer release is available. When `logics-manager` is installed, `cdx` can also suggest `logics-manager self-update`.
 - **Logics viewer shortcut.** `cdx view` opens the Logics browser/focus viewer through `logics-manager view` when the companion CLI is installed. All viewer flags are forwarded: `--lan`, `--lan-rw`, `--focus <ref>`, `--read`, `--port`, `--host`, `--refresh-interval`, `--tls`, `--tls-cert`, `--tls-key`, `--open`, `--no-open`. `cdx view --json` reports availability and update diagnostics without opening the viewer.
 - **Shared handoff context.** Keep a per-workspace Markdown context, or build one from a source session transcript, and install it into another assistant session before switching providers or accounts.
 - **Passive status resolution.** Codex status is read from the local Codex app-server rate-limit API when available, with legacy transcript/history parsing kept as a fallback.
+- **Banked reset visibility.** Eligible Codex accounts show the number of manually redeemable bonus resets in `cdx status` and expose reset details in JSON output.
 - **Session transcript capture.** Every launch is recorded to a local log file via `script`, giving you a full terminal transcript for each session.
 - **Clean removal.** `cdx rmv` wipes a session and its entire auth directory. No orphaned files, no stale credentials.
 
@@ -77,8 +79,6 @@ One command to launch any session. Zero auth juggling.
 - Auth probe: synchronous subprocess call to `codex login status` or `claude auth status` before any interactive launch.
 - Signal forwarding: `SIGINT`, `SIGTERM`, and `SIGHUP` are forwarded to the child process and produce clean exit codes.
 - Test stack: `pytest`, `pytest-cov`, and `ruff` via the documented `dev` dependency extra.
-- Python floor decision: `cdx-manager` keeps Python 3.9 support for the 0.9.x line to avoid dropping existing users before a planned compatibility break; classifiers remain aligned with `requires-python = ">=3.9"`.
-
 ---
 
 ## Getting Started
@@ -192,18 +192,18 @@ npm install -g .
 
 Security note:
 
-- The standalone installers try to resolve official release checksums from `checksums/release-archives.json`.
+- The standalone installers resolve official release checksums from the tagged GitHub Release asset `release-archives.json`.
 - You can still override verification explicitly through `CDX_SHA256`.
-- If no checksum is available, standalone installers fail closed unless `CDX_ALLOW_UNVERIFIED=1` is set.
+- If no checksum is available, standalone installers fail closed unless `CDX_ALLOW_UNVERIFIED=1` is set; that override prints a prominent warning before continuing.
 - Prefer `npm`, `pipx`, or `uv` when you want registry-backed install flows.
-- If you use the standalone script, download it first, inspect it, and prefer a release with an official checksum entry.
+- If you use the standalone script, download it first, inspect it, and prefer a release with the official checksum asset attached.
 
 Release maintainer note:
 
 - Before publishing npm or PyPI packages, run `npm run release:validate`.
 - The release tag must match `package.json`, `pyproject.toml`, `src/cli.py`, and `VERSION`.
 - `checksums/release-archives.json` must include the matching `vX.Y.Z` entry with both `github_tarball_sha256` and `github_zip_sha256`.
-- Use `python3 scripts/update_release_checksums.py --tag vX.Y.Z` after the GitHub tag archives exist, commit the checksum update to `main`, then publish the GitHub release only after `npm run release:validate`, `npm run lint`, and `npm test` pass.
+- Use `python3 scripts/update_release_checksums.py --tag vX.Y.Z` after the GitHub tag archives exist, commit the checksum update, attach that file to the tagged GitHub Release as `release-archives.json`, then publish packages only after `npm run release:validate`, `npm run lint`, and `npm test` pass.
 
 ### Environment
 
@@ -265,6 +265,10 @@ cdx next
 
 # Notify when the next cooling-down assistant is ready
 cdx ready
+
+# Inspect CDX_HOME and profile disk usage
+cdx disk
+cdx disk profiles --candidates
 ```
 
 ### Next-Ready Notifications
@@ -358,7 +362,10 @@ cdx history --summary --from 2026-05-01 --to 2026-05-28
 | `cdx handoff <name> [--json]` | Install the current workspace context into a target session and launch it unless `--json` is used |
 | `cdx handoff <source> <target> [--json]` | Build shared context from the source session's latest launch transcript, install it into the target session, and launch the target unless `--json` is used; supports cross-provider handoff |
 | `cdx rmv <name> [--force] [--json]` | Remove a session and its auth data (prompts for confirmation unless `--force`) |
-| `cdx clean [name] [--json]` | Clear launch transcript logs for one session or all sessions |
+| `cdx clean [name] [--yes] [--json]` | Clear launch transcript logs for one session or all sessions after confirmation |
+| `cdx clean profiles (--tmp\|--old-logs DAYS) [--yes] [--json]` | Remove explicit profile cleanup candidates after confirmation: temporary marketplace/plugin staging caches or old `.log` files |
+| `cdx disk [profiles] [--candidates] [--json]` | Measure `CDX_HOME`; `profiles` includes per-profile breakdown, and `--candidates` reports reclaimable temporary caches and old logs with evidence |
+| `cdx reset <name> [--yes] [--json]` | Explicitly consume one available banked Codex rate-limit reset; confirmation is required unless `--yes` is supplied |
 | `cdx export <file> [--include-auth] [--sessions a,b] [--passphrase-env VAR\|--passphrase-stdin] [--force] [--json]` | Export sessions to a portable bundle; `--include-auth` encrypts auth data with a passphrase |
 | `cdx import <file> [--sessions a,b] [--passphrase-env VAR\|--passphrase-stdin] [--force] [--json]` | Import sessions from a bundle into the current `CDX_HOME` |
 | `cdx doctor [--json]` | Inspect CLI dependencies, CDX_HOME permissions, missing state, orphan profiles, and pending quarantines |
@@ -394,6 +401,8 @@ Commands with machine-readable output:
 - `cdx ren ... --json`
 - `cdx rmv ... --json`
 - `cdx clean ... --json`
+- `cdx disk ... --json`
+- `cdx reset ... --json`
 - `cdx export ... --json`
 - `cdx import ... --json`
 - `cdx login ... --json`
@@ -512,7 +521,7 @@ Notes:
 - `--include-auth` is encrypted, requires a passphrase, and exports only provider credential files rather than full profile caches or logs.
 - Without `--passphrase-env`, `cdx` prompts in an interactive terminal. Non-interactive callers can pass `--passphrase-stdin` to read the passphrase from stdin (one line) instead of exposing it in the child environment.
 - `--sessions work,perso` exports or imports only a subset.
-- `--force` allows overwriting existing destination sessions during import or replacing an existing bundle file during export.
+- `--force` allows overwriting existing destination sessions during import or replacing an existing bundle file during export. Import refuses to overwrite existing sessions from a bundle without auth payloads unless `--allow-authless-force` is also passed.
 - Auth bundles contain credentials. Treat them like secrets and delete them after transfer.
 
 ---
@@ -602,7 +611,68 @@ All session data lives under `CDX_HOME` (default: `~/.cdx/`):
           cdx-session.log
 ```
 
-Session names are URL-encoded when used as directory or file names. CLI command names such as `add`, `status`, and `login` are reserved and cannot be used as session names.
+Session names are URL-encoded when used as directory or file names. CLI command names such as `add`, `disk`, `status`, and `login` are reserved and cannot be used as new session names.
+
+### Disk maintenance
+
+Use `cdx disk` for a total `CDX_HOME` measurement, and `cdx disk profiles` for the `profiles/` total plus a per-profile breakdown.
+
+In an interactive terminal, long scans report their current stage and per-profile progress on stderr. JSON and redirected output remain free of progress messages.
+
+Text output uses aligned summary tables with profile size, share of total space, and reclaimable space. Candidate details are grouped by profile with separate size, type, risk, and evidence columns.
+
+```bash
+cdx disk
+cdx disk profiles
+```
+
+To find cleanup candidates without deleting anything:
+
+```bash
+cdx disk profiles --candidates
+cdx disk profiles --candidates --json
+```
+
+Candidate evidence includes profile name, path, size, risk, reason, and metadata such as modified time or old-log file counts. The current cleanup candidates are intentionally limited to:
+
+- temporary marketplace/plugin staging caches under `profiles/*/.tmp/`
+- `.log` files older than the requested age inside profile `log/` directories
+
+`cdx` also runs a passive disk cleanup check at most once per day on advisory commands such as `cdx` and `cdx status`. It writes the check timestamp and latest measurements to `~/.cdx/state/disk-cleanup-check.json`. A warning is shown only when at least one threshold is met:
+
+- `CDX_HOME` uses 10 GB or more
+- cleanup candidates can reclaim 1 GB or more
+- temporary cache candidates can reclaim 500 MB or more
+- old log candidates can reclaim 500 MB or more
+- one profile is 2 GB or more, or one profile is at least 25% of `profiles/` when `profiles/` is already 1 GB or more
+
+The passive warning is read-only and points to `cdx disk profiles --candidates`; it never deletes files.
+
+Apply cleanup only with explicit actions:
+
+```bash
+cdx clean profiles --tmp
+cdx clean profiles --old-logs 30d
+```
+
+`--tmp` removes temporary marketplace/plugin clone/backup staging directories. `--old-logs 30d` removes only `.log` files older than 30 days. The commands do not remove `auth.json`, `config.toml`, `sessions/`, SQLite state, installed `plugins/`, `skills/`, or credentials.
+
+All `cdx clean` actions require interactive confirmation before any deletion or log truncation begins. Non-interactive scripts must pass `--yes` explicitly.
+
+The cleanup action is selected only when `--tmp` or `--old-logs` is present. This keeps `cdx clean profiles` available for an existing session named `profiles`. If any candidate or old log cannot be removed, cleanup stops with a non-zero error that identifies the affected path; it does not report the operation as successful.
+
+### Banked Codex resets
+
+Eligible Codex accounts expose manually redeemable rate-limit resets through the Codex app-server. `cdx status` shows their available count in the `RESETS` column; `cdx status <name>` also shows the nearest known expiration, and JSON status includes the available reset details supplied by Codex.
+
+Activation is always explicit:
+
+```bash
+cdx reset <name>
+cdx reset <name> --yes --json
+```
+
+Without `--yes`, an interactive confirmation is required. `cdx` sends an idempotency key, consumes at most one available reset, and refreshes the session status after a successful activation. It never activates a reset from `cdx status` or any background check.
 
 ---
 

package/bin/cdx

@@ -3,21 +3,12 @@
 import sys
 from pathlib import Path
 
-
 ROOT = Path(__file__).resolve().parent.parent
 if str(ROOT) not in sys.path:
     sys.path.insert(0, str(ROOT))
 
-from src.cli import format_error, format_json_error, main, wants_json  # noqa: E402
-from src.errors import CdxError  # noqa: E402
+from src.cli import cli_entry  # noqa: E402
 
 
 if __name__ == "__main__":
-    try:
-        raise SystemExit(main(sys.argv[1:]))
-    except CdxError as error:
-        if wants_json(sys.argv[1:]):
-            sys.stderr.write(f"{format_json_error(error)}\n")
-        else:
-            sys.stderr.write(f"{format_error(error)}\n")
-        raise SystemExit(error.exit_code)
+    cli_entry()

package/changelogs/CHANGELOGS_0_10_0.md

@@ -0,0 +1,43 @@
+# CDX Manager 0.10.0
+
+## Highlights
+
+- Inspect `CDX_HOME` and per-profile disk usage with readable, progress-aware reports.
+- Find evidence-backed cleanup candidates and reclaim space through confirmed actions.
+- Display and explicitly activate banked Codex rate-limit resets.
+
+## Changes
+
+### Disk usage and cleanup
+
+`cdx disk` measures total `CDX_HOME` usage. `cdx disk profiles` adds an aligned per-profile table with size and share of total space, while `--candidates` adds reclaimable totals and evidence grouped by profile.
+
+Interactive scans report their current stage and profile count on stderr so large profiles no longer appear stalled. JSON and redirected output remain unchanged.
+
+Cleanup candidates are intentionally limited to temporary marketplace/plugin staging directories and old `.log` files. `cdx clean profiles --tmp` and `cdx clean profiles --old-logs DAYS` require confirmation before deletion; all other `cdx clean` log-truncation actions now require confirmation as well. Non-interactive automation must opt in with `--yes`.
+
+A passive read-only check runs at most once per day and warns when documented total, reclaimable, category, or large-profile thresholds are reached. It never removes files automatically.
+
+### Banked Codex resets
+
+Eligible Codex accounts now show banked rate-limit reset counts in `cdx status`. Detailed JSON includes reset identifiers, labels, grant timestamps, and expiration timestamps when Codex provides them.
+
+`cdx reset <name>` consumes one reset through Codex's idempotent reset-credit endpoint, requires confirmation unless `--yes` is supplied, and refreshes status after activation. Status checks never consume resets automatically.
+
+### Compatibility and safeguards
+
+`disk` and `reset` are reserved for new session names. Existing sessions named `profiles` remain compatible with `cdx clean profiles`; profile-wide cleanup is selected only when `--tmp` or `--old-logs` is present.
+
+Cleanup failures now stop with a non-zero error naming the affected path instead of silently reporting zero bytes removed.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/changelogs/CHANGELOGS_0_11_0.md

@@ -0,0 +1,51 @@
+# CDX Manager 0.11.0
+
+## Highlights
+
+- Fixed Codex structured status parsing so five-hour and weekly reset windows stay mapped to the correct columns.
+- Hardened backup import, provider auth probing, release verification, and Windows launcher generation.
+- Closed the July 2026 review remediation corpus and follow-up Logics workflow with release-ready validation.
+
+## Changes
+
+### Codex status reset windows
+
+Structured Codex status payloads now preserve the distinction between the five-hour and weekly reset timestamps. `cdx status` no longer mirrors the weekly reset into the five-hour reset column, or the reverse, when provider output includes both windows.
+
+### Safer session import and credentials handling
+
+`cdx import --force` refuses to overwrite existing sessions from bundles without auth payloads unless `--allow-authless-force` is explicitly supplied.
+
+Bundle import now validates selected profile paths, base64 payloads, malformed profile collections, and non-object profile entries before touching existing session profiles. Existing profiles are renamed aside during force import and restored if a per-session import fails.
+
+### Provider auth reliability
+
+Provider auth probes are bounded by a 15 second timeout. Timeouts now surface as a degraded authentication state instead of being persisted as `logged_out`.
+
+Codex interactive launches wait on the per-auth-home lock with a bounded retry instead of running unlocked while another process may be rotating OAuth credentials.
+
+Stored `reasoning_effort` and `power` launch settings now clear each other correctly, so setting one cannot leave the other silently shadowing it.
+
+### CLI robustness and release hardening
+
+`cdx history` skips corrupt JSONL lines, `cdx status` tolerates sessions removed during a concurrent scan, `cdx clean profiles` routes profile cleanup flags consistently, `cdx disk --candidates` validates arguments before scanning, and `cdx view --json` now reports a proper failure when the Logics viewer is unavailable.
+
+The npm launcher routes through the same `cli_entry()` path as the Python entrypoint. Standalone installers and publish workflows now use tagged GitHub Release checksum assets rather than main-branch checksum metadata, and `CDX_ALLOW_UNVERIFIED=1` prints a prominent warning before continuing.
+
+The standalone Windows installer now generates `cdx.cmd` with the installed version directory in the launcher path.
+
+### Logics documentation
+
+The July 2026 review remediation corpus and post-review follow-up corpus are closed with implementation reports, validation evidence, and a clean Logics audit.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/checksums/release-archives.json

@@ -128,6 +128,14 @@
     "v0.9.15": {
       "github_tarball_sha256": "08e6c5a3459fdd65d1f6085ca03a3614f07b4bf44c57a995a3ef47446aa70482",
       "github_zip_sha256": "c8ac01f4a65e85b417f5eba5139868ab17b8f0952bf99f17f0a79f73ef0f36d6"
+    },
+    "v0.9.16": {
+      "github_tarball_sha256": "0876509c201485824f6e5fe7b4a96ceb41cc68279fbe6dda4891864cf5be93ec",
+      "github_zip_sha256": "08072957a0421d257cecfa8bed73cceee80d1c8857c59ac45378ac8ce3e0362d"
+    },
+    "v0.10.0": {
+      "github_tarball_sha256": "20c473f4b17806d565c454ad4aa28758433665d8431251ebb937ab6a909e4adb",
+      "github_zip_sha256": "b6a7be359d8dc2a11d8c77749878875419fabd7cd5a6951502dec09d7791e211"
     }
   }
 }

package/install.ps1

@@ -9,13 +9,7 @@ $ErrorActionPreference = "Stop"
 
 $repo = "AlexAgo83/cdx-manager"
 if (-not $ChecksumsUrl) {
-    $ChecksumsUrl = "https://raw.githubusercontent.com/$repo/main/checksums/release-archives.json"
-}
-$defaultChecksumsUrl = "https://raw.githubusercontent.com/$repo/main/checksums/release-archives.json"
-$checksumsApiUrl = if ($env:CDX_CHECKSUMS_API_URL) {
-    $env:CDX_CHECKSUMS_API_URL
-} else {
-    "https://api.github.com/repos/$repo/contents/checksums/release-archives.json?ref=main"
+    $ChecksumsUrl = $null
 }
 
 function Has-Command {
@@ -45,10 +39,16 @@ if ($Version.StartsWith("v")) {
     $tag = "v$Version"
 }
 
+$defaultChecksumsUrl = "https://github.com/$repo/releases/download/$tag/release-archives.json"
+if (-not $ChecksumsUrl) {
+    $ChecksumsUrl = $defaultChecksumsUrl
+}
+
 $tmpRoot = Join-Path ([System.IO.Path]::GetTempPath()) ("cdx-install-" + [guid]::NewGuid().ToString("N"))
 $archivePath = Join-Path $tmpRoot "cdx-manager.zip"
 $extractRoot = Join-Path $tmpRoot "extract"
-$targetDir = Join-Path $installRoot $tag.TrimStart("v")
+$versionDir = $tag.TrimStart("v")
+$targetDir = Join-Path $installRoot $versionDir
 $archiveUrl = "https://github.com/$repo/archive/refs/tags/$tag.zip"
 
 New-Item -ItemType Directory -Force -Path $tmpRoot, $extractRoot, $binDir, $installRoot | Out-Null
@@ -62,15 +62,6 @@ try {
         } catch {
         }
     }
-    if ((-not $Sha256) -and ($ChecksumsUrl -eq $defaultChecksumsUrl)) {
-        try {
-            $checksumsResponse = Invoke-RestMethod -Uri $checksumsApiUrl
-            $checksumsJson = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($checksumsResponse.content))
-            $checksums = $checksumsJson | ConvertFrom-Json
-            $Sha256 = $checksums.releases.$tag.github_zip_sha256
-        } catch {
-        }
-    }
     if ($Sha256) {
         $actualSha256 = (Get-FileHash -Algorithm SHA256 -Path $archivePath).Hash.ToLowerInvariant()
         if ($actualSha256 -ne $Sha256.ToLowerInvariant()) {
@@ -78,7 +69,9 @@ try {
         }
     } else {
         if ($env:CDX_ALLOW_UNVERIFIED -eq "1") {
-            Write-Warning "No official checksum available for $tag; continuing because CDX_ALLOW_UNVERIFIED=1."
+            Write-Warning "Installing $tag without checksum verification."
+            Write-Warning "CDX_ALLOW_UNVERIFIED=1 disables archive integrity checks."
+            Write-Warning "Continue only if you trust the download source."
         } else {
             throw "cdx install: no official checksum available for $tag. Set CDX_ALLOW_UNVERIFIED=1 to install without checksum verification."
         }
@@ -99,7 +92,7 @@ try {
     $launcherPath = Join-Path $binDir "cdx.cmd"
     $launcher = @"
 @echo off
-set SCRIPT=%~dp0..\versions\${($tag.TrimStart("v"))}\bin\cdx
+set SCRIPT=%~dp0..\versions\$versionDir\bin\cdx
 where py >nul 2>nul
 if %ERRORLEVEL%==0 (
   py -3 "%SCRIPT%" %*

package/install.sh

@@ -6,9 +6,6 @@ VERSION="${CDX_VERSION:-}"
 PREFIX="${PREFIX:-$HOME/.local}"
 BIN_DIR="${BIN_DIR:-$PREFIX/bin}"
 INSTALL_ROOT="${CDX_INSTALL_ROOT:-$PREFIX/share/cdx-manager}"
-DEFAULT_CHECKSUMS_URL="https://raw.githubusercontent.com/$REPO/main/checksums/release-archives.json"
-CHECKSUMS_URL="${CDX_CHECKSUMS_URL:-$DEFAULT_CHECKSUMS_URL}"
-CHECKSUMS_API_URL="${CDX_CHECKSUMS_API_URL:-https://api.github.com/repos/$REPO/contents/checksums/release-archives.json?ref=main}"
 
 need() {
   if ! command -v "$1" >/dev/null 2>&1; then
@@ -53,27 +50,6 @@ if value:
 ' "$1"
 }
 
-resolve_expected_sha256_from_api() {
-  curl -fsSL "$CHECKSUMS_API_URL" |
-    python3 -c '
-import base64
-import json
-import sys
-
-tag = sys.argv[1]
-try:
-    response = json.load(sys.stdin)
-    payload = json.loads(base64.b64decode(response.get("content") or b"").decode("utf-8"))
-except Exception:
-    raise SystemExit(1)
-
-release = (payload.get("releases") or {}).get(tag) or {}
-value = release.get("github_tarball_sha256")
-if value:
-    print(value)
-' "$1"
-}
-
 if [ -z "$VERSION" ]; then
   VERSION="$(
     curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" |
@@ -86,6 +62,9 @@ case "$VERSION" in
   *) TAG="v$VERSION" ;;
 esac
 
+DEFAULT_CHECKSUMS_URL="https://github.com/$REPO/releases/download/$TAG/release-archives.json"
+CHECKSUMS_URL="${CDX_CHECKSUMS_URL:-$DEFAULT_CHECKSUMS_URL}"
+
 TMP_DIR="$(mktemp -d)"
 cleanup() {
   rm -rf "$TMP_DIR"
@@ -99,10 +78,6 @@ EXPECTED_SHA256="${CDX_SHA256:-}"
 if [ -z "$EXPECTED_SHA256" ]; then
   EXPECTED_SHA256="$(resolve_expected_sha256 "$TAG" 2>/dev/null || true)"
 fi
-if [ -z "$EXPECTED_SHA256" ] && [ "$CHECKSUMS_URL" = "$DEFAULT_CHECKSUMS_URL" ]; then
-  EXPECTED_SHA256="$(resolve_expected_sha256_from_api "$TAG" 2>/dev/null || true)"
-fi
-
 if [ -n "$EXPECTED_SHA256" ]; then
   ACTUAL_SHA256="$(sha256_file "$TMP_DIR/cdx-manager.tar.gz")"
   if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
@@ -113,7 +88,9 @@ if [ -n "$EXPECTED_SHA256" ]; then
   fi
 else
   if [ "${CDX_ALLOW_UNVERIFIED:-}" = "1" ]; then
-    echo "cdx install: warning: no official checksum available for $TAG; continuing because CDX_ALLOW_UNVERIFIED=1" >&2
+    echo "cdx install: WARNING: installing $TAG without checksum verification." >&2
+    echo "cdx install: WARNING: CDX_ALLOW_UNVERIFIED=1 disables archive integrity checks." >&2
+    echo "cdx install: WARNING: continue only if you trust the download source." >&2
   else
     echo "cdx install: no official checksum available for $TAG" >&2
     echo "Set CDX_ALLOW_UNVERIFIED=1 to install without checksum verification." >&2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.9.16",
+  "version": "0.11.0",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.9.16"
+version = "0.11.0"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/claude_refresh.py

@@ -48,40 +48,24 @@ def _refresh_claude_sessions(service, refresh_fn=None, target_names=None, force=
     errors = []
     results = {}
 
-    if inspect.iscoroutinefunction(refresh_fn):
-        import asyncio
+    threads = []
 
-        async def fetch_all():
-            async def fetch_async(s):
-                try:
-                    usage = await refresh_fn(s)
-                    if usage:
-                        results[s["name"]] = usage
-                except Exception as e:
-                    errors.append({"session": s["name"], "error": e})
-
-            await asyncio.gather(*(fetch_async(s) for s in claude_sessions))
-
-        asyncio.run(fetch_all())
-    else:
-        threads = []
-
-        def fetch(s):
-            try:
-                usage = refresh_fn(s)
-                if inspect.isawaitable(usage):
-                    raise CdxError("Claude refresh function returned an awaitable from a sync callable.")
-                if usage:
-                    results[s["name"]] = usage
-            except Exception as e:
-                errors.append({"session": s["name"], "error": e})
-
-        for s in claude_sessions:
-            t = threading.Thread(target=fetch, args=(s,), daemon=True)
-            threads.append(t)
-            t.start()
-        for t in threads:
-            t.join(timeout=10)
+    def fetch(s):
+        try:
+            usage = refresh_fn(s)
+            if inspect.isawaitable(usage):
+                raise CdxError("Claude refresh function returned an awaitable from a sync callable.")
+            if usage:
+                results[s["name"]] = usage
+        except Exception as e:
+            errors.append({"session": s["name"], "error": e})
+
+    for s in claude_sessions:
+        t = threading.Thread(target=fetch, args=(s,), daemon=True)
+        threads.append(t)
+        t.start()
+    for t in threads:
+        t.join(timeout=10)
 
     # A worker that outlived its join can still insert into results/errors;
     # snapshot both so late writes can't mutate what we iterate.