cdx-manager 0.9.6 → 0.9.8

package/README.md

@@ -1,6 +1,6 @@
 # CDX Manager
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.9.6-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.9.8-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Run multiple Codex, Claude, Antigravity, and Ollama sessions from one terminal. Switch between accounts instantly.**
 
@@ -76,7 +76,8 @@ One command to launch any session. Zero auth juggling.
 - On Windows, transcript capture is optional. If no compatible `script` wrapper is installed, Codex still launches normally without transcript capture.
 - Auth probe: synchronous subprocess call to `codex login status` or `claude auth status` before any interactive launch.
 - Signal forwarding: `SIGINT`, `SIGTERM`, and `SIGHUP` are forwarded to the child process and produce clean exit codes.
-- Test stack: Python built-in `unittest` runner with no test framework dependency.
+- Test stack: `pytest`, `pytest-cov`, and `ruff` via the documented `dev` dependency extra.
+- Python floor decision: `cdx-manager` keeps Python 3.9 support for the 0.9.x line to avoid dropping existing users before a planned compatibility break; classifiers remain aligned with `requires-python = ">=3.9"`.
 
 ---
 
@@ -149,6 +150,12 @@ cd cdx-manager
 make install
 ```
 
+For local development, install the Python toolchain as well:
+
+```bash
+python3 -m pip install -e ".[dev]"
+```
+
 From source on Windows:
 
 ```powershell
@@ -512,9 +519,10 @@ Notes:
 
 ## Available Scripts
 
-- `npm test`: run the Python test suite
-- `npm run test:py`: run the Python unit tests through the portable launcher
-- `npm run lint`: check project guidance, the Node launcher, and byte-compile the Python sources, scripts, and tests
+- `npm test`: run the Python test suite with `pytest`
+- `npm run test:py`: run `pytest` through the portable launcher
+- `npm run test:coverage`: run `pytest` with terminal coverage reporting for `src/`
+- `npm run lint`: check project guidance, the Node launcher, `ruff`, and byte-compile the Python sources, scripts, and tests
 - `npm run release:validate`: verify version alignment and required GitHub release archive checksum metadata before publication
 - `npm run link`: link `cdx` globally for local development (`npm link`)
 - `npm run unlink`: remove the global link

package/changelogs/CHANGELOGS_0_9_7.md

@@ -0,0 +1,25 @@
+# CDX Manager 0.9.7
+
+## Highlights
+
+- Hardened profile cleanup so read-only provider cache files do not block session removal or repair cleanup.
+
+## Changes
+
+### Read-only profile cleanup
+
+`cdx rmv`, session overwrite rollback cleanup, and repair quarantine cleanup now make profile trees user-writable before deleting them.
+
+This fixes failures seen when provider-managed caches contain read-only files, including nested Go module cache paths created under session-specific provider homes.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/changelogs/CHANGELOGS_0_9_8.md

@@ -0,0 +1,43 @@
+# CDX Manager 0.9.8
+
+## Highlights
+
+- Hardened encrypted auth bundles so session names are no longer exposed in cleartext bundle metadata.
+- Replaced deprecated tree removal handling with Python 3.12+ `onexc` support and a fallback for older supported Python versions.
+- Added `pytest` coverage reporting and a `ruff` lint gate to local and CI validation.
+
+## Changes
+
+### Auth bundle privacy
+
+Encrypted bundles now keep session names inside the encrypted payload instead of duplicating them in the cleartext wrapper.
+
+Existing encrypted bundles that still contain cleartext `session_names` remain import-compatible.
+
+### Runtime hardening
+
+Profile tree deletion now uses `shutil.rmtree(..., onexc=...)` where available, avoiding the deprecated `onerror` path on Python 3.12+ while retaining compatibility with Python 3.9-3.11.
+
+Auth bundle tests now skip cleanly when `cryptography` is unavailable in the active interpreter.
+
+### CLI maintainability
+
+Top-level command routing now uses an explicit dispatch table, with update notice suppression controlled by command metadata instead of an inline negative list.
+
+### Tooling and CI
+
+CI now installs the `dev` extra, runs `ruff check`, and executes the same `pytest` suite used locally with coverage reporting for `src/`.
+
+The Python floor remains `>=3.9` for the 0.9.x line to avoid a compatibility break before a planned major support change.
+
+## Validation
+
+- `npm run release:validate`
+- `npm run lint`
+- `npm test`
+- `logics-manager lint --require-status`
+- `logics-manager audit`
+- `git diff --check`
+- `npm --cache /private/tmp/cdx-npm-cache pack --dry-run`
+- `python -m build`
+- `python -m twine check dist/*`

package/checksums/release-archives.json

@@ -88,6 +88,18 @@
     "v0.9.5": {
       "github_tarball_sha256": "29c512600ed366e06bcaa8ae12f105cc198f85c6887d46c9032d677c5335203b",
       "github_zip_sha256": "a7be652ba39b929eae6e90c48410ce8b7c9c122625da55bfcd50edb755d6d609"
+    },
+    "v0.9.6": {
+      "github_tarball_sha256": "7706ba127f247dfab50404ca175921c7874624e835c920799b3b122a45f7dc4b",
+      "github_zip_sha256": "be11246f65eae006512247067bff22863a6ebe8d5738b056fe17f654fd5d9b5c"
+    },
+    "v0.9.7": {
+      "github_tarball_sha256": "8ca47e94843c9bf2592eb6a771aa33f209cf0f5bf04ed3e93cb000cea8a73bf6",
+      "github_zip_sha256": "1fe3ac56efe3de42a794614edaffab2f8ae8b5da8e51cdbda0f625665993f1f9"
+    },
+    "v0.9.8": {
+      "github_tarball_sha256": "8f05d052b7890d74de7ac510c20376430515ad2616e139941cb9bb8edc4fb680",
+      "github_zip_sha256": "3bc3834ecf84784c77cf603fcd4f6f439e42005612f82fabab588886519179eb"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.9.6",
+  "version": "0.9.8",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",
@@ -42,9 +42,11 @@
     "cdx": "bin/cdx.js"
   },
   "scripts": {
+    "status": "node bin/cdx.js status",
     "test": "npm run test:py",
-    "test:py": "node bin/python-runner.js -m unittest discover -s test -p test_*_py.py",
-    "lint": "node --check bin/cdx.js && node --check bin/python-runner.js && node bin/python-runner.js scripts/verify_project_docs.py && node bin/python-runner.js -m py_compile bin/cdx src/*.py scripts/*.py test/test_*_py.py",
+    "test:py": "node bin/python-runner.js -m pytest",
+    "test:coverage": "node bin/python-runner.js -m pytest --cov=src --cov-report=term-missing",
+    "lint": "node --check bin/cdx.js && node --check bin/python-runner.js && node bin/python-runner.js scripts/verify_project_docs.py && node bin/python-runner.js -m ruff check . && node bin/python-runner.js -m py_compile bin/cdx src/*.py scripts/*.py test/test_*_py.py",
     "release:validate": "node bin/python-runner.js scripts/verify_release_checksums.py",
     "prepublishOnly": "npm run release:validate && npm run lint && npm test",
     "link": "npm link",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.9.6"
+version = "0.9.8"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -28,6 +28,13 @@ classifiers = [
 ]
 dependencies = ["cryptography>=42"]
 
+[project.optional-dependencies]
+dev = [
+  "pytest>=8",
+  "pytest-cov>=5",
+  "ruff>=0.6",
+]
+
 [project.urls]
 Homepage = "https://github.com/AlexAgo83/cdx-manager"
 Repository = "https://github.com/AlexAgo83/cdx-manager.git"
@@ -42,3 +49,22 @@ packages = ["cdx_manager"]
 
 [tool.setuptools.package-dir]
 cdx_manager = "src"
+
+[tool.pytest.ini_options]
+testpaths = ["test"]
+python_files = ["test_*_py.py"]
+
+[tool.coverage.run]
+branch = true
+source = ["src"]
+
+[tool.coverage.report]
+show_missing = true
+skip_empty = true
+
+[tool.ruff]
+target-version = "py39"
+line-length = 140
+
+[tool.ruff.lint]
+select = ["E9", "F63", "F7", "F82"]

package/src/backup_bundle.py

@@ -105,7 +105,6 @@ def encode_bundle(payload, include_auth=False, passphrase=None):
         "created_at": _now_iso(),
         "include_auth": bool(include_auth),
         "encrypted": bool(include_auth),
-        "session_names": [item["name"] for item in payload.get("sessions", [])],
     }
     if include_auth:
         salt = os.urandom(_SALT_BYTES)
@@ -120,6 +119,7 @@ def encode_bundle(payload, include_auth=False, passphrase=None):
             "payload": _b64_encode(ciphertext),
         })
     else:
+        wrapper["session_names"] = [item["name"] for item in payload.get("sessions", [])]
         wrapper["payload"] = _b64_encode(payload_bytes)
     return json.dumps(wrapper, indent=2).encode("utf-8")
 

package/src/cli.py

@@ -66,7 +66,70 @@ from .status_view import (
 )
 from .update_check import check_for_update, check_logics_manager_for_update
 
-VERSION = "0.9.6"
+VERSION = "0.9.8"
+
+
+_COMMAND_HANDLERS = {
+    "add": handle_add,
+    "cp": handle_copy,
+    "clean": handle_clean,
+    "config": handle_config,
+    "configs": handle_configs,
+    "context": handle_context,
+    "doctor": handle_doctor,
+    "disable": handle_disable,
+    "enable": handle_enable,
+    "export": handle_export,
+    "handoff": handle_handoff,
+    "history": handle_history,
+    "import": handle_import,
+    "last": handle_last,
+    "login": handle_login,
+    "logout": handle_logout,
+    "next": handle_next,
+    "notify": handle_notify,
+    "repair": handle_repair,
+    "rename": handle_rename,
+    "resume": handle_resume,
+    "can-resume": handle_can_resume,
+    "rmv": handle_remove,
+    "run": handle_run,
+    "run-report": handle_run_report,
+    "run-status": handle_run_status,
+    "runs": handle_runs,
+    "select": handle_select,
+    "set": handle_set,
+    "stats": handle_stats,
+    "status": handle_status,
+    "unset": handle_unset,
+    "update": handle_update,
+    "view": handle_view,
+}
+
+_COMMAND_ALIASES = {
+    "ren": "rename",
+    "mv": "rename",
+}
+
+_SUPPRESS_UPDATE_NOTICE_COMMANDS = {
+    *set(_COMMAND_HANDLERS),
+    "fast",
+    "help",
+    "model",
+    "perm",
+    "power",
+    "ready",
+    "rename",
+    "version",
+} - {"status"}
+
+
+def _resolve_command(command):
+    return _COMMAND_ALIASES.get(command, command)
+
+
+def _should_check_update_notices(command):
+    return _resolve_command(command) not in _SUPPRESS_UPDATE_NOTICE_COMMANDS
 
 
 # ---------------------------------------------------------------------------
@@ -271,6 +334,7 @@ def main(argv, options=None):
         return 0
 
     command, *rest = argv
+    resolved_command = _resolve_command(command)
     ctx = {
         "env": env,
         "options": options,
@@ -286,130 +350,30 @@ def main(argv, options=None):
         "stdin_is_tty": stdin_is_tty,
         "version": VERSION,
         "cwd": options.get("cwd") or os.getcwd(),
-        "update_notices": _get_update_notices(service, env, options) if command not in (
-            "add", "cp", "ren", "rename", "mv", "rmv", "clean", "doctor", "repair", "view", "update", "ready", "notify", "next", "context", "config", "configs", "set", "unset", "power", "perm", "fast", "model", "history", "stats", "resume", "can-resume", "handoff", "login", "logout", "disable", "enable", "export", "import", "select", "run", "help", "version"
-        ) else None,
+        "update_notices": _get_update_notices(service, env, options) if _should_check_update_notices(command) else None,
         "use_color": use_color,
     }
 
-    if command == "add":
-        return handle_add(rest, ctx)
-
-    if command == "cp":
-        return handle_copy(rest, ctx)
-
-    if command in ("ren", "rename", "mv"):
-        return handle_rename(rest, ctx)
-
-    if command == "rmv":
-        return handle_remove(rest, ctx)
-
-    if command == "disable":
-        return handle_disable(rest, ctx)
-
-    if command == "enable":
-        return handle_enable(rest, ctx)
-
-    if command == "clean":
-        return handle_clean(rest, ctx)
-
-    if command == "export":
-        return handle_export(rest, ctx)
-
-    if command == "import":
-        return handle_import(rest, ctx)
-
-    if command == "doctor":
-        return handle_doctor(rest, ctx)
-
-    if command == "repair":
-        return handle_repair(rest, ctx)
-
-    if command == "view":
-        return handle_view(rest, ctx)
-
-    if command == "update":
-        return handle_update(rest, ctx)
-
-    if command == "ready":
+    if resolved_command == "ready":
         if any(arg not in ("--refresh", "--json") for arg in rest):
             raise CdxError("Usage: cdx ready [--refresh] [--json]")
         return handle_notify(["--next-ready", "--schedule", *rest], ctx)
 
-    if command == "notify":
-        return handle_notify(rest, ctx)
-
-    if command == "next":
-        return handle_next(rest, ctx)
-
-    if command == "context":
-        return handle_context(rest, ctx)
-
-    if command == "config":
-        return handle_config(rest, ctx)
-
-    if command == "configs":
-        return handle_configs(rest, ctx)
-
-    if command == "set":
-        return handle_set(rest, ctx)
+    if resolved_command in ("power", "perm", "fast", "model"):
+        return handle_launch_setting_alias(resolved_command, rest, ctx)
 
-    if command == "unset":
-        return handle_unset(rest, ctx)
-
-    if command in ("power", "perm", "fast", "model"):
-        return handle_launch_setting_alias(command, rest, ctx)
-
-    if command == "history":
-        return handle_history(rest, ctx)
-
-    if command == "stats":
-        return handle_stats(rest, ctx)
-
-    if command == "last":
-        return handle_last(rest, ctx)
-
-    if command == "resume":
-        return handle_resume(rest, ctx)
-
-    if command == "can-resume":
-        return handle_can_resume(rest, ctx)
-
-    if command == "handoff":
-        return handle_handoff(rest, ctx)
-
-    if command == "status":
-        return handle_status(rest, ctx)
-
-    if command == "select":
-        return handle_select(rest, ctx)
-
-    if command == "run":
-        return handle_run(rest, ctx)
-
-    if command == "runs":
-        return handle_runs(rest, ctx)
-
-    if command == "run-status":
-        return handle_run_status(rest, ctx)
-
-    if command == "run-report":
-        return handle_run_report(rest, ctx)
-
-    if command == "login":
-        return handle_login(rest, ctx)
-
-    if command == "logout":
-        return handle_logout(rest, ctx)
-
-    if command in ("help",):
+    if resolved_command == "help":
         out(f"{_print_help(use_color=use_color)}\n")
         return 0
 
-    if command in ("version",):
+    if resolved_command == "version":
         out(f"{_print_version()}\n")
         return 0
 
+    handler = _COMMAND_HANDLERS.get(resolved_command)
+    if handler:
+        return handler(rest, ctx)
+
     if all(arg in ("--json", "-r", "--resume") for arg in rest):
         return handle_launch(command, ctx, resume=("-r" in rest or "--resume" in rest))
 

package/src/fs_utils.py

@@ -0,0 +1,60 @@
+import inspect
+import os
+import shutil
+import stat
+
+
+def _make_user_writable(path):
+    if os.path.islink(path):
+        return
+    try:
+        current = os.stat(path).st_mode
+    except OSError:
+        return
+    mode = current | stat.S_IRUSR | stat.S_IWUSR
+    if stat.S_ISDIR(current):
+        mode |= stat.S_IXUSR
+    try:
+        os.chmod(path, mode)
+    except OSError:
+        pass
+
+
+def _make_tree_user_writable(path):
+    if not os.path.exists(path):
+        return
+    for root, dirs, files in os.walk(path, topdown=False):
+        for name in files:
+            file_path = os.path.join(root, name)
+            if not os.path.islink(file_path):
+                _make_user_writable(file_path)
+        for name in dirs:
+            dir_path = os.path.join(root, name)
+            if not os.path.islink(dir_path):
+                _make_user_writable(dir_path)
+        _make_user_writable(root)
+
+
+def remove_tree(path, ignore_errors=False):
+    def retry_after_chmod(func, failing_path):
+        parent = os.path.dirname(failing_path)
+        if parent:
+            _make_user_writable(parent)
+        _make_user_writable(failing_path)
+        try:
+            func(failing_path)
+        except OSError:
+            if not ignore_errors:
+                raise
+
+    def onerror(func, failing_path, _exc_info):
+        retry_after_chmod(func, failing_path)
+
+    def onexc(func, failing_path, _exc):
+        retry_after_chmod(func, failing_path)
+
+    _make_tree_user_writable(path)
+    if "onexc" in inspect.signature(shutil.rmtree).parameters:
+        shutil.rmtree(path, ignore_errors=ignore_errors, onexc=onexc)
+    else:
+        shutil.rmtree(path, ignore_errors=ignore_errors, onerror=onerror)

package/src/provider_runtime.py

@@ -335,8 +335,6 @@ def _launch_config_args(session):
             args += ["--dangerously-skip-permissions"]
         return args
     if provider == PROVIDER_OLLAMA:
-        if power:
-            args += ["--think", power if power in ("low", "medium", "high") else "high"]
         if permission == "full":
             args += ["--experimental-yolo"]
         return args
@@ -424,6 +422,8 @@ def _logics_enabled(session, env=None):
 
 
 def _with_launch_preferences(session, initial_prompt=None, env=None):
+    if session["provider"] == PROVIDER_OLLAMA:
+        return initial_prompt
     prompts = []
     if _rtk_enabled(session):
         prompts.append(RTK_PROMPT)

package/src/repair.py

@@ -1,7 +1,7 @@
 import json
 import os
-import shutil
 
+from .fs_utils import remove_tree
 from .health import collect_health_report
 
 
@@ -69,7 +69,7 @@ def _apply_recreate_state(service, name):
 
 
 def _apply_remove_path(path):
-    shutil.rmtree(path)
+    remove_tree(path)
     return "applied"
 
 

package/src/session_service.py

@@ -13,6 +13,7 @@ from .backup_bundle import decode_bundle, encode_bundle
 from .config import PROVIDER_ANTIGRAVITY, PROVIDER_CLAUDE, PROVIDER_CODEX, PROVIDERS, get_cdx_home
 from .codex_usage import fetch_codex_rate_limits
 from .errors import CdxError
+from .fs_utils import remove_tree
 from .session_store import create_session_store
 from .status_source import find_latest_status_artifact
 
@@ -641,7 +642,7 @@ def create_session_service(options=None):
             raise CdxError(f"Unknown session: {name}")
         if quarantine_root:
             try:
-                shutil.rmtree(quarantine_root)
+                remove_tree(quarantine_root)
             except OSError as error:
                 raise CdxError(
                     f"Removed session {name}, but failed to delete archived profile {quarantine_root}: {error}"
@@ -701,14 +702,14 @@ def create_session_service(options=None):
             overwritten = bool(existing)
         except Exception:
             if moved_temp and os.path.exists(dest_root):
-                shutil.rmtree(dest_root, ignore_errors=True)
+                remove_tree(dest_root, ignore_errors=True)
             if backup_root and os.path.exists(backup_root) and not os.path.exists(dest_root):
                 os.rename(backup_root, dest_root)
             raise
         finally:
             if backup_root and os.path.exists(backup_root):
-                shutil.rmtree(backup_root, ignore_errors=True)
-            shutil.rmtree(temp_parent, ignore_errors=True)
+                remove_tree(backup_root, ignore_errors=True)
+            remove_tree(temp_parent, ignore_errors=True)
         if not result["ok"]:
             raise CdxError(f"Failed to create session: {dest_name}")
         return {"session": result["session"], "overwritten": overwritten}