cdx-manager 0.10.0 → 0.11.0

package/src/cli_helpers.py

@@ -57,14 +57,6 @@ def _write_json(ctx, payload):
     ctx["out"](f"{json.dumps(payload, indent=2)}\n")
 
 
-def _update_notice_warning(ctx):
-    notices = ctx.get("update_notices") or []
-    if not notices:
-        return None
-    warnings = _update_notice_warnings(ctx)
-    return warnings[0] if warnings else None
-
-
 def _update_notice_warnings(ctx):
     warnings = []
     for notice in ctx.get("update_notices") or []:
@@ -118,7 +110,7 @@ def _format_bytes(value):
         amount /= 1024
     if unit == "B":
         return f"{int(amount)} B"
-    return f"{amount:.1f} {unit}"
+    return f"{int(amount)} {unit}" if amount.is_integer() else f"{amount:.1f} {unit}"
 
 
 def _format_export_report(result):
@@ -157,39 +149,16 @@ def _make_export_progress(ctx):
     return progress
 
 
-def _make_status_progress(ctx):
+def _make_session_progress(ctx, start_event, start_message):
     progress_state = {"checked": 0, "total": 0}
 
     def progress(event):
         kind = event.get("event")
-        if kind == "status_started":
-            progress_state["checked"] = 0
-            progress_state["total"] = event.get("check_count", event.get("session_count", 0)) or 0
-            message = f"Resolving status for {event.get('session_count', 0)} session(s)..."
-            ctx["out"](f"{_info(message, ctx['use_color'])}\n")
-        elif kind == "session_started":
-            provider = event.get("provider") or "session"
-            message = f"Checking {event.get('session_name')} ({provider})..."
-            ctx["out"](f"{_dim(message, ctx['use_color'])}\n")
-        elif kind == "session_finished" and not event.get("cache_hit"):
-            progress_state["checked"] += 1
-            total = progress_state["total"] or progress_state["checked"]
-            message = f"Checked {event.get('session_name')} ({progress_state['checked']}/{total})."
-            ctx["out"](f"{_dim(message, ctx['use_color'])}\n")
-        elif kind == "status_finished":
-            message = f"Resolved {event.get('row_count', 0)} status row(s)."
-            ctx["out"](f"{_dim(message, ctx['use_color'])}\n")
-    return progress
-
-
-def _make_notify_progress(ctx):
-    progress_state = {"checked": 0, "total": 0}
-
-    def progress(event):
-        kind = event.get("event")
-        if kind == "notify_check_started":
-            target = event.get("session_name") or "next ready session"
-            ctx["out"](f"{_info(f'Checking notification target: {target}...', ctx['use_color'])}\n")
+        if kind == start_event:
+            if kind == "status_started":
+                progress_state["checked"] = 0
+                progress_state["total"] = event.get("check_count", event.get("session_count", 0)) or 0
+            ctx["out"](f"{_info(start_message(event), ctx['use_color'])}\n")
         elif kind == "status_started":
             progress_state["checked"] = 0
             progress_state["total"] = event.get("check_count", event.get("session_count", 0)) or 0
@@ -204,12 +173,31 @@ def _make_notify_progress(ctx):
             total = progress_state["total"] or progress_state["checked"]
             message = f"Checked {event.get('session_name')} ({progress_state['checked']}/{total})."
             ctx["out"](f"{_dim(message, ctx['use_color'])}\n")
+        elif kind == "status_finished":
+            message = f"Resolved {event.get('row_count', 0)} status row(s)."
+            ctx["out"](f"{_dim(message, ctx['use_color'])}\n")
         elif kind == "notify_waiting":
             message = f"{event.get('message')}; checking again in {event.get('poll')}s..."
             ctx["out"](f"{_dim(message, ctx['use_color'])}\n")
     return progress
 
 
+def _make_status_progress(ctx):
+    return _make_session_progress(
+        ctx,
+        "status_started",
+        lambda event: f"Resolving status for {event.get('session_count', 0)} session(s)...",
+    )
+
+
+def _make_notify_progress(ctx):
+    return _make_session_progress(
+        ctx,
+        "notify_check_started",
+        lambda event: f"Checking notification target: {event.get('session_name') or 'next ready session'}...",
+    )
+
+
 def _latest_launch_transcript_path(session):
     paths = _list_launch_transcript_paths(session)
     if not paths:

package/src/cli_view.py

@@ -1,4 +1,4 @@
-from .cli_helpers import _json_success, _write_json
+from .cli_helpers import _json_failure, _json_success, _update_notice_warnings, _write_json
 from .cli_render import _warn
 from .errors import CdxError
 from .logics_view import (
@@ -13,31 +13,6 @@ from .update_check import check_logics_manager_for_update
 VIEW_USAGE = "Usage: cdx view [--json] [--lan] [--lan-rw] [--focus <ref>] [--read] [--port <port>] [--host <host>] [--refresh-interval <s>] [--tls] [--open] [--no-open]"
 
 
-def _update_notice_warnings(notices):
-    warnings = []
-    for notice in notices or []:
-        if not notice:
-            continue
-        tool = notice.get("tool") or "logics-manager"
-        current = notice.get("current_version")
-        command = notice.get("update_command")
-        message = f"Update available: {tool} {notice['latest_version']}"
-        if current:
-            message = f"{message} (current {current})"
-        if command:
-            message = f"{message}. Run: {command}"
-        warnings.append({
-            "code": f"{tool.replace('-', '_')}_update_available",
-            "message": message,
-            "tool": tool,
-            "latest_version": notice["latest_version"],
-            "current_version": current,
-            "update_command": command,
-            "url": notice.get("url"),
-        })
-    return warnings
-
-
 def _logics_manager_update_notice(ctx, env):
     checker = ctx["options"].get("checkLogicsManagerForUpdate") or check_logics_manager_for_update
     return checker(
@@ -86,9 +61,12 @@ def handle_view(rest, ctx):
     update_notice = _logics_manager_update_notice(ctx, env) if executable else None
     failure = None if executable else missing_logics_manager_failure()
     diagnostics = build_viewer_diagnostics(executable, cwd, update_notice=update_notice, failure=failure, extra_args=viewer_args)
-    warnings = _update_notice_warnings([update_notice])
+    warnings = _update_notice_warnings({"update_notices": [update_notice] if update_notice else []})
 
     if json_flag:
+        if failure:
+            _write_json(ctx, _json_failure("view", "viewer_unavailable", failure["message"], warnings=warnings, viewer=diagnostics))
+            return 1
         _write_json(ctx, _json_success("view", "Collected Logics viewer diagnostics", warnings=warnings, viewer=diagnostics))
         return 0
 

package/src/codex_usage.py

@@ -4,6 +4,7 @@ import os
 import queue
 import subprocess
 import threading
+import time
 from datetime import datetime, timezone
 
 from .status_source import _is_zero_credit_balance
@@ -17,7 +18,7 @@ CODEX_AUTH_LOCK_NAME = ".cdx-auth.lock"
 
 
 @contextlib.contextmanager
-def codex_auth_lock(auth_home, blocking=False):
+def codex_auth_lock(auth_home, blocking=False, timeout_seconds=None, retry_interval_seconds=0.05):
     """Serialize codex token refreshes per CODEX_HOME.
 
     Codex rotates its OAuth refresh_token on refresh and invalidates the old
@@ -36,13 +37,18 @@ def codex_auth_lock(auth_home, blocking=False):
     except OSError:
         yield True
         return
-    flags = fcntl.LOCK_EX if blocking else fcntl.LOCK_EX | fcntl.LOCK_NB
-    try:
-        fcntl.flock(handle, flags)
-    except OSError:
-        handle.close()
-        yield False
-        return
+    deadline = None if timeout_seconds is None else time.monotonic() + timeout_seconds
+    while True:
+        flags = fcntl.LOCK_EX if blocking and timeout_seconds is None else fcntl.LOCK_EX | fcntl.LOCK_NB
+        try:
+            fcntl.flock(handle, flags)
+            break
+        except OSError:
+            if not blocking or (deadline is not None and time.monotonic() >= deadline):
+                handle.close()
+                yield False
+                return
+            time.sleep(retry_interval_seconds)
     try:
         yield True
     finally:

package/src/notify.py

@@ -1,6 +1,7 @@
 import json
 import os
 import shlex
+import shutil
 import subprocess
 import time
 from datetime import datetime, timedelta
@@ -165,14 +166,14 @@ def send_desktop_notification(title, message, spawn_sync=None, env=None):
     env = env or os.environ
     if sys.platform == "win32":
         _send_windows_notification(title, message, spawn_sync, env)
-    elif shutil_which("osascript", env):
+    elif shutil.which("osascript", path=env.get("PATH")):
         script = f'display notification "{_escape_applescript(message)}" with title "{_escape_applescript(title)}"'
         _run_notification_command(
             ["osascript", "-e", script],
             spawn_sync,
             env,
         )
-    elif shutil_which("notify-send", env):
+    elif shutil.which("notify-send", path=env.get("PATH")):
         _run_notification_command(
             ["notify-send", str(title), str(message)],
             spawn_sync,
@@ -209,11 +210,6 @@ def _escape_powershell(value):
     return str(value).replace("'", "''")
 
 
-def shutil_which(command, env):
-    import shutil
-    return shutil.which(command, path=env.get("PATH"))
-
-
 def _escape_applescript(value):
     return str(value).replace("\\", "\\\\").replace('"', '\\"')
 
@@ -247,7 +243,7 @@ def schedule_notification_event(base_dir, parsed, event, spawn_sync=None, env=No
 
 
 def _scheduled_notify_argv(parsed, env):
-    executable = env.get("CDX_BIN") or shutil_which("cdx", env) or "cdx"
+    executable = env.get("CDX_BIN") or shutil.which("cdx", path=env.get("PATH")) or "cdx"
     argv = [executable, "notify"]
     if parsed["mode"] == "at-reset":
         argv.append(parsed["name"])
@@ -331,7 +327,7 @@ def _launchd_plist(label, script_path, target):
 def _schedule_linux(parsed, event, argv, spawn_sync, env):
     unit = _schedule_id("cdx-manager-notify", parsed, event)
     target = _round_up_to_next_minute(datetime.fromtimestamp(event["target_timestamp"]).astimezone())
-    if shutil_which("systemd-run", env):
+    if shutil.which("systemd-run", path=env.get("PATH")):
         calendar = target.strftime("%Y-%m-%d %H:%M:%S")
         result = _run_scheduler_command(
             ["systemd-run", "--user", f"--unit={unit}", f"--on-calendar={calendar}", *argv],
@@ -343,7 +339,7 @@ def _schedule_linux(parsed, event, argv, spawn_sync, env):
         if _scheduler_error_means_exists(result["error"]):
             return {"scheduled": True, "existing": True, "backend": "systemd", "id": unit}
         raise CdxError(f"Failed to schedule notification with systemd-run: {result['error']}")
-    if shutil_which("at", env):
+    if shutil.which("at", path=env.get("PATH")):
         at_time = target.strftime("%Y%m%d%H%M.%S")
         command = " ".join(shlex.quote(str(part)) for part in argv)
         result = _run_scheduler_command(["at", "-t", at_time], spawn_sync, env, input_text=f"{command}\n")

package/src/provider_runtime.py

@@ -16,6 +16,11 @@ from .config import PROVIDER_ANTIGRAVITY, PROVIDER_CLAUDE, PROVIDER_CODEX, PROVI
 from .errors import CdxError
 
 LOG_ROTATE_BYTES = 10 * 1024 * 1024  # 10 MB
+AUTH_PROBE_TIMEOUT_SECONDS = 15
+CODEX_INTERACTIVE_AUTH_LOCK_TIMEOUT_SECONDS = 10
+AUTH_PROBE_AUTHENTICATED = "authenticated"
+AUTH_PROBE_LOGGED_OUT = "logged_out"
+AUTH_PROBE_DEGRADED = "degraded"
 REASONING_EFFORT_VALUES = {"minimal", "low", "medium", "high", "xhigh"}
 RTK_PROMPT = (
     "When running noisy shell commands, prefer RTK wrappers (`rtk <command>`) if `rtk` is available. "
@@ -173,12 +178,15 @@ def codex_auth_diagnostic(session, spawn_sync=None, env_override=None):
         "live_error": None,
     }
     try:
-        result["live_status"] = "authenticated" if _probe_provider_auth(
+        status = _probe_provider_auth_status(
             session,
             spawn_sync=spawn_sync,
             env_override=env_override,
             trust_local_credentials=False,
-        ) else "logged_out"
+        )
+        result["live_status"] = status
+        if status == AUTH_PROBE_DEGRADED:
+            result["live_error"] = _auth_probe_degraded_message(session)
     except CdxError as error:
         result["live_status"] = "error"
         result["live_error"] = str(error)
@@ -899,14 +907,21 @@ def _resolve_command(command, env=None):
     return shutil.which(command, path=env.get("PATH")) or command
 
 
-def _probe_provider_auth(session, spawn_sync=None, env_override=None, trust_local_credentials=True):
+def _auth_probe_degraded_message(session):
+    return (
+        f"Auth probe timed out after {AUTH_PROBE_TIMEOUT_SECONDS}s for session {session.get('name') or 'unknown'}; "
+        "authentication status is degraded."
+    )
+
+
+def _probe_provider_auth_status(session, spawn_sync=None, env_override=None, trust_local_credentials=True):
     spawn_sync = spawn_sync or subprocess.run
     spec = _build_login_status_spec(session, env_override)
     if trust_local_credentials:
         if session.get("provider") == PROVIDER_CLAUDE and _has_local_claude_auth(_get_auth_home(session)):
-            return True
+            return AUTH_PROBE_AUTHENTICATED
         if session.get("provider") == PROVIDER_CODEX and _has_local_codex_auth(_get_auth_home(session)):
-            return True
+            return AUTH_PROBE_AUTHENTICATED
     try:
         if spawn_sync is subprocess.run:
             command = _resolve_command(spec["command"], spec["env"])
@@ -914,19 +929,33 @@ def _probe_provider_auth(session, spawn_sync=None, env_override=None, trust_loca
                 [command] + spec["args"],
                 env=spec["env"],
                 capture_output=True, text=True,
+                timeout=AUTH_PROBE_TIMEOUT_SECONDS,
             )
             output = (result.stdout or "") + (result.stderr or "")
         else:
             result = spawn_sync(spec["command"], spec["args"], spec)
             error = result.get("error") if isinstance(result, dict) else getattr(result, "error", None)
             if error:
+                if isinstance(error, subprocess.TimeoutExpired):
+                    raise error
                 raise _format_probe_failure(session, spec, error)
             stdout = result.get("stdout") if isinstance(result, dict) else getattr(result, "stdout", "")
             stderr = result.get("stderr") if isinstance(result, dict) else getattr(result, "stderr", "")
             output = (stdout or "") + (stderr or "")
+    except subprocess.TimeoutExpired:
+        return AUTH_PROBE_DEGRADED
     except OSError as error:
         raise _format_probe_failure(session, spec, error) from error
-    return spec["parser"](output)
+    return AUTH_PROBE_AUTHENTICATED if spec["parser"](output) else AUTH_PROBE_LOGGED_OUT
+
+
+def _probe_provider_auth(session, spawn_sync=None, env_override=None, trust_local_credentials=True):
+    return _probe_provider_auth_status(
+        session,
+        spawn_sync=spawn_sync,
+        env_override=env_override,
+        trust_local_credentials=trust_local_credentials,
+    ) == AUTH_PROBE_AUTHENTICATED
 
 
 def _signal_exit_code(sig):
@@ -953,10 +982,15 @@ def _run_interactive_provider_command(session, action, spawn=None, cwd=None,
                   lifecycle_callback=lifecycle_callback)
     if session.get("provider") != PROVIDER_CODEX:
         return _run_interactive_provider_command_impl(session, action, **kwargs)
-    # Hold the per-CODEX_HOME lock for the whole session so a concurrent status
-    # probe backs off instead of rotating the refresh_token mid-run (which logs
-    # the session out). ponytail: non-blocking, so launch never waits on a probe.
-    with codex_auth_lock(_get_auth_home(session)):
+    # Hold the per-CODEX_HOME lock for the whole session so concurrent Codex
+    # processes cannot rotate the refresh_token under each other.
+    with codex_auth_lock(
+        _get_auth_home(session),
+        blocking=True,
+        timeout_seconds=CODEX_INTERACTIVE_AUTH_LOCK_TIMEOUT_SECONDS,
+    ) as acquired:
+        if not acquired:
+            raise CdxError(f"Timed out waiting for Codex auth lock for session {session['name']}.")
         return _run_interactive_provider_command_impl(session, action, **kwargs)
 
 
@@ -1114,16 +1148,26 @@ def _ensure_session_authentication(session, service, spawn=None, spawn_sync=None
         raise CdxError(
             f"Session {session['name']} is not authenticated. Run: cdx login {session['name']}"
         )
-    is_authenticated = _probe_provider_auth(
+    auth_status = _probe_provider_auth_status(
         session,
         spawn_sync=spawn_sync,
         env_override=env_override,
         trust_local_credentials=trust_local_credentials,
     )
-    if is_authenticated:
-        return {"authenticated": True, "checked": True}
+    if auth_status == AUTH_PROBE_AUTHENTICATED:
+        return {"authenticated": True, "checked": True, "status": auth_status}
+    if auth_status == AUTH_PROBE_DEGRADED:
+        result = {
+            "authenticated": False,
+            "checked": True,
+            "status": auth_status,
+            "error": _auth_probe_degraded_message(session),
+        }
+        if behavior == "probe-only":
+            return result
+        raise CdxError(f"{result['error']} Retry, or run: cdx login {session['name']}")
     if behavior == "probe-only":
-        return {"authenticated": False, "checked": True}
+        return {"authenticated": False, "checked": True, "status": auth_status}
     if behavior == "launch":
         raise CdxError(
             f"Session {session['name']} is not authenticated. Run: cdx login {session['name']}"

package/src/session_service.py

@@ -1,4 +1,5 @@
 import base64
+import binascii
 import json
 import os
 import shutil
@@ -901,6 +902,11 @@ def create_session_service(options=None):
             # lock; a pre-lock snapshot loses a concurrent setting change.
             current = _normalize_launch_settings(s.get("launch") or {}, mark_fast_service_tier=False)
             launch = {**current, **updates}
+            if "power" in updates:
+                launch.pop("reasoning_effort", None)
+                launch.pop("reasoningEffort", None)
+            if "reasoning_effort" in updates:
+                launch.pop("power", None)
             explicit_power = "power" in updates or "reasoning_effort" in updates
             if explicit_power and "fast" not in updates and launch.get("fastMode") != "service_tier":
                 launch["fast"] = False
@@ -923,7 +929,7 @@ def create_session_service(options=None):
             raise CdxError(f"Unknown session: {name}")
         if not keys:
             raise CdxError("At least one launch setting is required.")
-        allowed = {"power", "permission", "fast", "rtk", "logics", "model", "priority"}
+        allowed = {"power", "reasoning_effort", "reasoningEffort", "permission", "fast", "rtk", "logics", "model", "priority"}
         unknown = [key for key in keys if key not in allowed]
         if unknown:
             raise CdxError(f"Unsupported launch setting: {', '.join(unknown)}")
@@ -1216,7 +1222,12 @@ def create_session_service(options=None):
                     )] = s
                 for future in as_completed(futures):
                     s = futures[future]
-                    resolved = future.result()
+                    try:
+                        resolved = future.result()
+                    except CdxError as error:
+                        if not str(error).startswith("Unknown session:"):
+                            raise
+                        continue
                     resolved_by_name[s["name"]] = resolved
                     if progress_callback:
                         progress_callback({
@@ -1225,7 +1236,7 @@ def create_session_service(options=None):
                             "has_status": bool(resolved.get("lastStatus")),
                             "cache_hit": cache_hits[s["name"]],
                         })
-        resolved = [resolved_by_name[s["name"]] for s in sessions]
+        resolved = [resolved_by_name[s["name"]] for s in sessions if s["name"] in resolved_by_name]
 
         def sort_key(s):
             at = s.get("lastStatusAt") or ""
@@ -1336,7 +1347,52 @@ def create_session_service(options=None):
             "bundle_size_bytes": len(bundle_bytes),
         }
 
-    def import_bundle(file_path, passphrase=None, session_names=None, force=False, merge=False):
+    def _validate_import_profile_files(payload, imported_sessions):
+        profiles = payload.get("profiles") or {}
+        if not isinstance(profiles, dict):
+            raise CdxError("Bundle contains invalid profile data.")
+        decoded_profiles = {}
+        for session_payload in imported_sessions:
+            name = session_payload["name"]
+            files = []
+            profile_items = profiles.get(name, [])
+            if not isinstance(profile_items, list):
+                raise CdxError(f"Bundle contains invalid profile data for session {name}.")
+            for item in profile_items:
+                if not isinstance(item, dict):
+                    raise CdxError(f"Bundle contains invalid profile entry for session {name}.")
+                rel_path = _safe_relpath(item.get("path"))
+                data_b64 = item.get("data_b64")
+                if not isinstance(data_b64, str):
+                    raise CdxError(f"Bundle contains invalid file data for session {name}: {rel_path}")
+                try:
+                    content = base64.b64decode(data_b64.encode("ascii"), validate=True)
+                except (binascii.Error, UnicodeEncodeError) as error:
+                    raise CdxError(f"Bundle contains invalid file data for session {name}: {rel_path}") from error
+                files.append({"path": rel_path, "content": content})
+            decoded_profiles[name] = files
+        return decoded_profiles
+
+    def _restore_import_backup(name, backup_root, session_root, old_record, old_state):
+        if os.path.exists(session_root):
+            remove_tree(session_root, ignore_errors=True)
+        if backup_root and os.path.exists(backup_root):
+            os.rename(backup_root, session_root)
+        if old_record:
+            store["replace_session"](name, old_record)
+            if old_state is not None:
+                store["write_session_state"](name, old_state)
+        else:
+            store["remove_session"](name)
+
+    def import_bundle(
+        file_path,
+        passphrase=None,
+        session_names=None,
+        force=False,
+        merge=False,
+        allow_authless_force=False,
+    ):
         if not file_path or not os.path.isfile(file_path):
             raise CdxError(f"Bundle file not found: {file_path}")
         with open(file_path, "rb") as handle:
@@ -1358,73 +1414,91 @@ def create_session_service(options=None):
         conflicts = [name for name in names if name in existing]
         if conflicts and not force and not merge:
             raise CdxError(f"Import would overwrite existing sessions: {', '.join(conflicts)}")
+        if conflicts and force and not decoded["meta"].get("include_auth") and not allow_authless_force:
+            raise CdxError(
+                "Import --force would overwrite existing session credentials, but this bundle has no auth payloads. "
+                "Re-export with --include-auth, use --merge, or pass --allow-authless-force to discard local credentials."
+            )
+
+        for session_payload in imported_sessions:
+            _validate_new_session_name(session_payload["name"])
+            _normalize_provider(session_payload["provider"])
+        decoded_profiles = _validate_import_profile_files(payload, imported_sessions)
 
         for session_payload in imported_sessions:
             name = session_payload["name"]
-            _validate_new_session_name(name)
             provider = _normalize_provider(session_payload["provider"])
             is_existing = name in existing
 
-            if is_existing and force:
-                remove_session(name)
-                is_existing = False
-
             session_root = _get_session_root(name)
             auth_home = _get_session_auth_home(name, provider)
             _ensure_private_dir(base_dir)
             _ensure_private_dir(os.path.join(base_dir, "profiles"))
+            backup_root = None
+            old_record = None
+            old_state = None
+            if is_existing and force:
+                old_record = store["get_session"](name)
+                old_state = store["read_session_state"](name)
+                if os.path.exists(session_root):
+                    backup_root = tempfile.mkdtemp(prefix=f".{_encode(name)}.import.", dir=os.path.dirname(session_root))
+                    os.rmdir(backup_root)
+                    os.rename(session_root, backup_root)
+                is_existing = False
             _ensure_private_dir(session_root)
             _ensure_private_dir(auth_home)
 
             existing_state_before = None
-            if is_existing and merge:
-                existing_record = store["get_session"](name) or {}
-                # replace_session resets the state file to defaults, so the
-                # local state must be captured before it runs.
-                existing_state_before = store["read_session_state"](name) or {}
-                bundle_record = {
-                    **session_payload,
-                    "provider": provider,
-                    "enabled": session_payload.get("enabled", True) is not False,
-                    "sessionRoot": session_root,
-                    "authHome": auth_home,
-                }
-                # Existing values take precedence; bundle fills in missing keys only.
-                merged_record = {**bundle_record, **{k: v for k, v in existing_record.items() if v is not None}}
-                merged_record["sessionRoot"] = session_root
-                merged_record["authHome"] = auth_home
-                store["replace_session"](name, merged_record)
-            else:
-                session_record = {
-                    **session_payload,
-                    "provider": provider,
-                    "enabled": session_payload.get("enabled", True) is not False,
-                    "sessionRoot": session_root,
-                    "authHome": auth_home,
-                }
-                store["replace_session"](name, session_record)
-
-            state = (payload.get("states") or {}).get(name)
-            if is_existing and merge:
-                merged_state = {**(state or {}), **{k: v for k, v in (existing_state_before or {}).items() if v is not None}}
-                if merged_state:
-                    store["write_session_state"](name, merged_state)
-            elif state is not None:
-                store["write_session_state"](name, state)
-
-            for item in (payload.get("profiles") or {}).get(name, []):
-                rel_path = _safe_relpath(item.get("path"))
-                try:
-                    content = base64.b64decode(item.get("data_b64", "").encode("ascii"))
-                except (AttributeError, ValueError, UnicodeEncodeError) as error:
-                    raise CdxError(f"Bundle contains invalid file data for session {name}: {rel_path}") from error
-                dest_path = os.path.join(session_root, rel_path)
-                # In merge mode, skip files that already exist locally.
-                if is_existing and merge and os.path.exists(dest_path):
-                    continue
-                _ensure_private_dir(os.path.dirname(dest_path))
-                # Decrypted credentials: 0o600 from creation, no umask window.
-                atomic_write(dest_path, content, mode=0o600)
+            try:
+                if is_existing and merge:
+                    existing_record = store["get_session"](name) or {}
+                    # replace_session resets the state file to defaults, so the
+                    # local state must be captured before it runs.
+                    existing_state_before = store["read_session_state"](name) or {}
+                    bundle_record = {
+                        **session_payload,
+                        "provider": provider,
+                        "enabled": session_payload.get("enabled", True) is not False,
+                        "sessionRoot": session_root,
+                        "authHome": auth_home,
+                    }
+                    # Existing values take precedence; bundle fills in missing keys only.
+                    merged_record = {**bundle_record, **{k: v for k, v in existing_record.items() if v is not None}}
+                    merged_record["sessionRoot"] = session_root
+                    merged_record["authHome"] = auth_home
+                    store["replace_session"](name, merged_record)
+                else:
+                    session_record = {
+                        **session_payload,
+                        "provider": provider,
+                        "enabled": session_payload.get("enabled", True) is not False,
+                        "sessionRoot": session_root,
+                        "authHome": auth_home,
+                    }
+                    store["replace_session"](name, session_record)
+
+                state = (payload.get("states") or {}).get(name)
+                if is_existing and merge:
+                    merged_state = {**(state or {}), **{k: v for k, v in (existing_state_before or {}).items() if v is not None}}
+                    if merged_state:
+                        store["write_session_state"](name, merged_state)
+                elif state is not None:
+                    store["write_session_state"](name, state)
+
+                for item in decoded_profiles.get(name, []):
+                    dest_path = os.path.join(session_root, item["path"])
+                    # In merge mode, skip files that already exist locally.
+                    if is_existing and merge and os.path.exists(dest_path):
+                        continue
+                    _ensure_private_dir(os.path.dirname(dest_path))
+                    # Decrypted credentials: 0o600 from creation, no umask window.
+                    atomic_write(dest_path, item["content"], mode=0o600)
+            except Exception:
+                _restore_import_backup(name, backup_root, session_root, old_record, old_state)
+                raise
+            finally:
+                if backup_root and os.path.exists(backup_root):
+                    remove_tree(backup_root, ignore_errors=True)
 
         return {
             "path": file_path,