cdx-manager 0.20.8 → 0.20.10

package/src/commands/runs.py

@@ -3,6 +3,7 @@
 Split out of cli_commands.py. Moved verbatim; re-exported by cli_commands.
 """
 
+import importlib.util
 import os
 import subprocess
 import sys
@@ -147,9 +148,22 @@ def _cdx_self_command():
     script has no reliable executable bit on Windows (`os.access(X_OK)` is true
     for any existing file there) and a shebang script handed to CreateProcess
     does not start at all.
+
+    Named from the top-level package, not this module's own package: `cli` lives
+    beside `commands`, so `{__package__}.cli` resolves to a module that does not
+    exist. The import root is the parent of every package component, which for
+    src/commands/runs.py is the repository root rather than src/.
     """
-    package_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-    return [sys.executable, "-m", f"{__package__}.cli"], package_root
+    package = (__package__ or "src.commands").split(".")[0]
+    module = f"{package}.cli"
+    package_root = os.path.abspath(__file__)
+    for _ in range((__package__ or "src.commands").count(".") + 2):
+        package_root = os.path.dirname(package_root)
+    if importlib.util.find_spec(module) is None:
+        # A wrong module name reports a launched run that never runs, so fail
+        # here where the caller still gets the error.
+        raise CdxError(f"Cannot launch a detached run: the cdx CLI module {module} was not found.")
+    return [sys.executable, "-m", module], package_root
 
 def _detached_spawn_options():
     """Platform flags that keep the child alive after this process exits.
@@ -751,6 +765,7 @@ def handle_run(rest, ctx):
         return error.exit_code or 1
     except CdxError as error:
         run_info = getattr(error, "run_info", None)
+        cancelled = bool(getattr(error, "cancelled", False))
         final_payload = run_result_payload(
             API_SCHEMA_VERSION,
             False,
@@ -758,14 +773,16 @@ def handle_run(rest, ctx):
             locals().get("session"),
             run_info=run_info,
             error=error,
-            error_source="cdx",
-            error_code=run_cdx_error_code(error),
+            error_source="provider" if cancelled else "cdx",
+            error_code="run_cancelled" if cancelled else run_cdx_error_code(error),
             selection_row=selection_row,
         )
         if registry and run_id:
             registry.finish(
                 run_id,
-                status="failed",
+                # A cancelled run is neither a task failure nor a timeout, and a
+                # caller has to be able to tell the three apart.
+                status="cancelled" if cancelled else "failed",
                 final_payload=final_payload,
                 run_info=run_info,
                 error=final_payload.get("error"),

package/src/context_store.py

@@ -2,6 +2,7 @@ import hashlib
 import os
 import shlex
 import subprocess
+import threading
 from datetime import datetime
 from urllib.parse import quote, unquote
 
@@ -105,13 +106,31 @@ def append_context(base_dir, note, cwd=None):
     return append_context_path(get_context_path(base_dir, cwd), note)
 
 
+# An append is a read-modify-write, and the write is atomic per attempt, so two
+# concurrent appends that both read the pre-existing text produce one file that
+# is missing a note the caller was told had been accepted. Parallel agents append
+# to the same scope by design, so the sequence is serialized here.
+_APPEND_LOCKS = {}
+_APPEND_LOCKS_GUARD = threading.Lock()
+
+
+def _append_lock(path):
+    key = os.path.abspath(path)
+    with _APPEND_LOCKS_GUARD:
+        lock = _APPEND_LOCKS.get(key)
+        if lock is None:
+            lock = _APPEND_LOCKS[key] = threading.Lock()
+        return lock
+
+
 def append_context_path(path, note):
     note = str(note or "").strip()
     if not note:
         raise CdxError("Memory append requires text.")
-    current = read_context_path(path).rstrip()
-    content = f"{current}\n{note}" if current else note
-    return write_context_path(path, content)
+    with _append_lock(path):
+        current = read_context_path(path).rstrip()
+        content = f"{current}\n{note}" if current else note
+        return write_context_path(path, content)
 
 
 def init_context(base_dir, cwd=None):

package/src/provider_runtime.py

@@ -12,7 +12,8 @@ import uuid
 from datetime import datetime, timezone
 
 from .agent_notify import launch_notify_env, notifications_enabled
-from .claude_usage import _clean_oauth_token, _decode_jwt_claims
+from .claude_credentials import peek_keychain_credentials
+from .claude_usage import _clean_oauth_token, _decode_jwt_claims, _secure_storage_overrides
 from .codex_usage import codex_auth_lock, diagnostic_needs_codex_login, fetch_codex_rate_limit_diagnostic
 from .config import (
     PROVIDER_ANTIGRAVITY,
@@ -145,7 +146,9 @@ def _home_env_overrides(auth_home):
     Code builds ignore otherwise valid isolated credentials. On Windows, Node.js
     resolves the home directory via USERPROFILE (and falls back to
     HOMEDRIVE+HOMEPATH), so we set all three to ensure profile isolation works
-    regardless of the platform.
+    regardless of the platform. Redirecting the home also detaches Claude
+    Code's credential storage, which `_secure_storage_overrides` re-keys to
+    this profile.
     """
     overrides = {
         "HOME": auth_home,
@@ -156,6 +159,7 @@ def _home_env_overrides(auth_home):
         overrides["USERPROFILE"] = auth_home
         overrides["HOMEDRIVE"] = os.path.splitdrive(auth_home)[0] or "C:"
         overrides["HOMEPATH"] = os.path.splitdrive(auth_home)[1] or auth_home
+    overrides.update(_secure_storage_overrides(auth_home))
     return overrides
 
 
@@ -229,7 +233,10 @@ def _has_local_claude_auth(auth_home):
 def _read_claude_launch_oauth_token(auth_home):
     if _has_local_claude_auth(auth_home):
         return None
-    return _read_anthropic_oauth_token(auth_home)
+    token = _read_anthropic_oauth_token(auth_home)
+    if token and peek_keychain_credentials(auth_home) is not None:
+        return None
+    return token
 
 
 def _has_local_codex_auth(auth_home):
@@ -1016,6 +1023,7 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
 
     child = None
     timed_out = False
+    cancelled = False
     with open(paths["stdout_path"], "w", encoding="utf-8", errors="replace") as stdout_file, \
             open(paths["stderr_path"], "w", encoding="utf-8", errors="replace") as stderr_file:
         options = {k: v for k, v in spec.get("options", {}).items() if k not in ("stdio", "stdout", "stderr")}
@@ -1049,6 +1057,25 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
         except subprocess.TimeoutExpired:
             timed_out = True
             _terminate_child_tree(child)
+        except KeyboardInterrupt:
+            # The provider has its own process group, so unwinding only this
+            # supervisor would leave it consuming quota and writing to the
+            # workspace. Terminate and reap it, then report the cancellation so
+            # the run still gets a terminal record.
+            cancelled = True
+            _terminate_child_tree(child)
+
+    if cancelled:
+        _combine_headless_transcript(paths)
+        returncode = getattr(child, "returncode", None)
+        cdx_error = CdxError(f"{spec['label']} run was cancelled.", 130)
+        cdx_error.cancelled = True
+        cdx_error.run_info = {
+            **_headless_run_info(paths, spec, start_time, 130 if returncode in (None, 0) else returncode),
+            "pid": getattr(child, "pid", None),
+            "cancelled": True,
+        }
+        raise cdx_error
 
     _combine_headless_transcript(paths)
     end_time = datetime.now(timezone.utc)

package/src/session_backup.py

@@ -6,11 +6,17 @@ coupling measurement supports. Moved verbatim; re-exported by session_service.
 
 import base64
 import binascii
+import json
 import os
 import shutil
 import tempfile
 
 from .backup_bundle import decode_bundle, encode_bundle
+from .claude_credentials import (
+    delete_keychain_credentials,
+    read_keychain_credentials,
+    write_keychain_credentials,
+)
 from .config import PROVIDER_CLAUDE
 from .errors import CdxError
 from .fs_utils import atomic_write, remove_tree
@@ -55,12 +61,14 @@ def _build_export_session_record(session):
         "auth": session.get("auth"),
     }
 
+CLAUDE_CREDENTIALS_BUNDLE_PATH = "claude-home/.claude/.credentials.json"
+
 def _auth_bundle_paths(provider):
     if provider == PROVIDER_CLAUDE:
         return [
             "claude-home/configs/default.json",
             "claude-home/credentials/default.json",
-            "claude-home/.claude/.credentials.json",
+            CLAUDE_CREDENTIALS_BUNDLE_PATH,
             "claude-home/.claude.json",
             "claude-home/auth.json",
         ]
@@ -68,19 +76,26 @@ def _auth_bundle_paths(provider):
         "auth.json",
     ]
 
-def _collect_auth_files(session_root, provider, session_name=None, progress_callback=None):
+def _collect_auth_files(session_root, provider, session_name=None, progress_callback=None, auth_home=None):
     files = []
     total_bytes = 0
     if not os.path.isdir(session_root):
         return {"files": files, "file_count": 0, "bytes": 0}
+    # A keychain-backed profile has no credential file to read. Export the entry
+    # under the path Claude Code itself uses, which is the same document: the
+    # bundle stays one schema, and an import restores a usable login.
+    keychain = read_keychain_credentials(auth_home) if provider == PROVIDER_CLAUDE and auth_home else None
     for rel_path in _auth_bundle_paths(provider):
         full_path = os.path.join(session_root, rel_path)
-        if not os.path.isfile(full_path):
+        if keychain is not None and rel_path == CLAUDE_CREDENTIALS_BUNDLE_PATH:
+            raw_content = json.dumps(keychain).encode("utf-8")
+        elif os.path.isfile(full_path):
+            with open(full_path, "rb") as handle:
+                raw_content = handle.read()
+        else:
             continue
-        with open(full_path, "rb") as handle:
-            raw_content = handle.read()
-            total_bytes += len(raw_content)
-            content = base64.b64encode(raw_content).decode("ascii")
+        total_bytes += len(raw_content)
+        content = base64.b64encode(raw_content).decode("ascii")
         files.append({"path": rel_path.replace(os.sep, "/"), "data_b64": content})
         if progress_callback:
             progress_callback({
@@ -149,9 +164,22 @@ def _resolve_session_subset(store, session_names):
         selected.append(session)
     return selected
 
+def _restore_import_credential(auth_home, credential):
+    """Put the destination's own Claude credential back after a failed import.
+
+    The snapshot is held in memory for the length of the import rather than
+    written beside the profile: a rollback only has to survive this process, and
+    a plaintext token in a temporary directory would be a worse trade.
+    """
+    if credential is None:
+        return
+    if read_keychain_credentials(auth_home) == credential:
+        return
+    write_keychain_credentials(auth_home, credential)
+
 def _restore_import_backup(store, name, backup_root, session_root, old_record, old_state):
     if os.path.exists(session_root):
-        remove_tree(session_root, ignore_errors=True)
+        remove_tree(session_root)
     if backup_root and os.path.exists(backup_root):
         os.rename(backup_root, session_root)
     if old_record:
@@ -194,7 +222,12 @@ def export_bundle(base_dir, store, file_path, include_auth=False, session_names=
             payload["states"][session["name"]] = state
         if include_auth:
             session_root = session.get("sessionRoot") or _get_session_root(base_dir, session["name"])
-            profile = _collect_auth_files(session_root, session["provider"], session["name"], progress_callback)
+            auth_home = session.get("authHome") or _get_session_auth_home(base_dir, session["name"], session["provider"])
+            try:
+                profile = _collect_auth_files(session_root, session["provider"], session["name"], progress_callback,
+                                              auth_home=auth_home)
+            except CdxError as error:
+                raise CdxError(f"Cannot export authentication for {session['name']}: {error}. Nothing was exported.") from None
             payload["profiles"][session["name"]] = profile["files"]
             profile_file_count += profile["file_count"]
             profile_bytes += profile["bytes"]
@@ -242,6 +275,7 @@ def import_bundle(base_dir, store, file_path,
         if missing_names:
             raise CdxError(f"Bundle does not contain requested sessions: {', '.join(missing_names)}")
     names = [item["name"] for item in imported_sessions]
+    retained_credential_names = []
 
     existing = {session["name"] for session in list_sessions(store)}
     conflicts = [name for name in names if name in existing]
@@ -268,23 +302,50 @@ def import_bundle(base_dir, store, file_path,
         _ensure_private_dir(base_dir)
         _ensure_private_dir(os.path.join(base_dir, "profiles"))
         backup_root = None
+        recovery_dir = None
         old_record = None
         old_state = None
         preserved_profile_paths = []
-        if is_existing and force:
+        if is_existing and (force or merge):
             old_record = store["get_session"](name)
             old_state = store["read_session_state"](name)
-            preserved_profile_paths = _force_import_preserved_profile_paths(session_root)
-            if os.path.exists(session_root):
-                backup_root = tempfile.mkdtemp(prefix=f".{_encode(name)}.import.", dir=os.path.dirname(session_root))
-                os.rmdir(backup_root)
-                os.rename(session_root, backup_root)
-            is_existing = False
-        _ensure_private_dir(session_root)
-        _ensure_private_dir(auth_home)
+            if merge:
+                provider = old_record["provider"]
+                auth_home = old_record["authHome"]
+            recovery_dir = tempfile.mkdtemp(prefix=f".{_encode(name)}.import.", dir=os.path.dirname(session_root))
+            backup_root = os.path.join(recovery_dir, "profile")
+            try:
+                atomic_write(os.path.join(recovery_dir, "recovery.json"),
+                             json.dumps({"session": old_record, "state": old_state}), mode=0o600)
+                if force:
+                    preserved_profile_paths = _force_import_preserved_profile_paths(session_root)
+                    if os.path.exists(session_root):
+                        os.rename(session_root, backup_root)
+                    is_existing = False
+                elif os.path.exists(session_root):
+                    # ponytail: full profile snapshot; journal new merge files if copy cost becomes material.
+                    # Keep links as links: a Claude profile can reference the system keychain,
+                    # and a dangling one (stale plugin or npm cache) must not fail the import.
+                    shutil.copytree(session_root, backup_root, symlinks=True, ignore_dangling_symlinks=True)
+            except Exception:
+                remove_tree(recovery_dir, ignore_errors=True)
+                raise
+
+        # A keychain-only profile has no credential file, so the collision with a
+        # bundle credential exists at the credential-backend level and has to be
+        # resolved there. Read it strictly: refusing an unreadable keychain is
+        # better than importing over a credential we could not preserve.
+        bundle_carries_credential = provider == PROVIDER_CLAUDE and any(
+            item["path"] == CLAUDE_CREDENTIALS_BUNDLE_PATH for item in decoded_profiles.get(name, [])
+        )
+        local_credential = None
+        if bundle_carries_credential and old_record is not None:
+            local_credential = read_keychain_credentials(auth_home)
 
         existing_state_before = None
         try:
+            _ensure_private_dir(session_root)
+            _ensure_private_dir(auth_home)
             if is_existing and merge:
                 existing_record = store["get_session"](name) or {}
                 # replace_session resets the state file to defaults, so the
@@ -320,24 +381,57 @@ def import_bundle(base_dir, store, file_path,
             elif state is not None:
                 store["write_session_state"](name, state)
 
+            imported_paths = []
             for item in decoded_profiles.get(name, []):
                 dest_path = os.path.join(session_root, item["path"])
+                # A syntactically relative path can still escape through a profile symlink.
+                root = os.path.realpath(session_root)
+                try:
+                    inside = os.path.commonpath([root, os.path.realpath(dest_path)]) == root
+                except ValueError:  # different drive: never inside the profile.
+                    inside = False
+                if not inside:
+                    raise CdxError("Bundle file path escapes the session profile through a link.")
                 # In merge mode, skip files that already exist locally.
-                if is_existing and merge and os.path.exists(dest_path):
+                if is_existing and merge and os.path.lexists(dest_path):
+                    continue
+                if merge and local_credential is not None and item["path"] == CLAUDE_CREDENTIALS_BUNDLE_PATH:
+                    # Merge keeps local values, and the live keychain entry is this
+                    # profile's credential even though no file represents it.
+                    retained_credential_names.append(name)
                     continue
                 _ensure_private_dir(os.path.dirname(dest_path))
                 # Decrypted credentials: 0o600 from creation, no umask window.
                 atomic_write(dest_path, item["content"], mode=0o600)
+                imported_paths.append(item["path"])
+            if provider == PROVIDER_CLAUDE and CLAUDE_CREDENTIALS_BUNDLE_PATH in imported_paths:
+                delete_keychain_credentials(auth_home)
             _restore_force_import_profile_paths(name, backup_root, session_root, preserved_profile_paths)
         except Exception:
-            _restore_import_backup(store, name, backup_root, session_root, old_record, old_state)
+            incomplete = []
+            try:
+                _restore_import_backup(store, name, backup_root, session_root, old_record, old_state)
+            except Exception:
+                incomplete.append("local files, the session record, and state")
+            try:
+                _restore_import_credential(auth_home, local_credential)
+            except Exception:
+                incomplete.append("Claude keychain authentication")
+            if incomplete:
+                raise CdxError(
+                    f"Import failed and recovery is incomplete for {name}: could not restore "
+                    f"{' and '.join(incomplete)}. Recovery data retained at {recovery_dir or session_root}."
+                ) from None
+            if recovery_dir:
+                remove_tree(recovery_dir, ignore_errors=True)
             raise
-        finally:
-            if backup_root and os.path.exists(backup_root):
-                remove_tree(backup_root, ignore_errors=True)
+        else:
+            if recovery_dir:
+                remove_tree(recovery_dir, ignore_errors=True)
 
     return {
         "path": file_path,
         "session_names": names,
         "include_auth": bool(decoded["meta"].get("include_auth")),
+        "retained_local_credentials": retained_credential_names,
     }

package/src/session_service.py

@@ -31,8 +31,11 @@ import os
 import shutil
 import tempfile
 import uuid
+from contextlib import nullcontext
 from functools import partial
 
+from .claude_credentials import copy_keychain_credentials, delete_keychain_credentials
+from .claude_usage import _link_macos_keychain
 from .codex_usage import fetch_codex_rate_limits
 from .config import (
     MAX_LAUNCH_BUDGET_USD,
@@ -471,6 +474,22 @@ def set_session_enabled(store, name, enabled):
     })
 
 
+def _discard_claude_credentials(record, done):
+    """Drop a gone profile's keychain entry.
+
+    Left behind it both keeps the OAuth token alive and blocks the name: the
+    next `cdx cp`/`cdx ren` into it refuses to overwrite an entry no session
+    owns any more. The profile is already gone when this runs, so a failure
+    is reported without undoing the operation.
+    """
+    if not record or record.get("provider") != PROVIDER_CLAUDE:
+        return
+    try:
+        delete_keychain_credentials(record.get("authHome"))
+    except CdxError as error:
+        raise CdxError(f"{done}, but its Claude keychain credential could not be deleted: {error}") from None
+
+
 def remove_session(base_dir, store, name):
     session = store["get_session"](name)
     if not session:
@@ -500,6 +519,7 @@ def remove_session(base_dir, store, name):
             raise CdxError(
                 f"Removed session {name}, but failed to delete archived profile {quarantine_root}: {error}"
             ) from error
+    _discard_claude_credentials(session, f"Removed session {name}")
     return removed
 
 
@@ -517,6 +537,7 @@ def copy_session(base_dir, store, source_name, dest_name):
     if not existing and os.path.exists(dest_root):
         raise CdxError(f"Session profile already exists: {dest_name}")
     dest_auth_home = _get_session_auth_home(base_dir, dest_name, source["provider"])
+    source_auth_home = source.get("authHome") or _get_session_auth_home(base_dir, source_name, source["provider"])
     profiles_dir = os.path.dirname(dest_root)
     os.makedirs(profiles_dir, exist_ok=True)
     temp_parent = tempfile.mkdtemp(prefix=f".{_encode(dest_name)}.copy.", dir=profiles_dir)
@@ -545,28 +566,44 @@ def copy_session(base_dir, store, source_name, dest_name):
         },
     }
     try:
-        shutil.copytree(source_root, temp_root)
-        if existing:
-            backup_root = tempfile.mkdtemp(prefix=f".{_encode(dest_name)}.backup.", dir=profiles_dir)
-            os.rmdir(backup_root)
-            if os.path.exists(dest_root):
-                os.rename(dest_root, backup_root)
-        os.rename(temp_root, dest_root)
-        moved_temp = True
-        result = store["replace_session"](dest_name, replacement)
-        overwritten = bool(existing)
+        credential_copy = copy_keychain_credentials(
+            source_auth_home, dest_auth_home,
+            overwrite=bool(existing and existing["provider"] == PROVIDER_CLAUDE),
+        ) if source["provider"] == PROVIDER_CLAUDE else nullcontext()
+        with credential_copy:
+            if source["provider"] == PROVIDER_CLAUDE:
+                shutil.copytree(source_root, temp_root, symlinks=True,
+                                ignore=lambda _directory, names: [n for n in names if n == "Keychains"])
+                _link_macos_keychain(os.path.join(temp_root, "claude-home"))
+            else:
+                shutil.copytree(source_root, temp_root)
+            if existing:
+                backup_root = tempfile.mkdtemp(prefix=f".{_encode(dest_name)}.backup.", dir=profiles_dir)
+                os.rmdir(backup_root)
+                if os.path.exists(dest_root):
+                    os.rename(dest_root, backup_root)
+            os.rename(temp_root, dest_root)
+            moved_temp = True
+            result = store["replace_session"](dest_name, replacement)
+            if not result["ok"]:
+                raise CdxError(f"Failed to create session: {dest_name}")
+            overwritten = bool(existing)
+            if existing and source["provider"] != PROVIDER_CLAUDE:
+                _discard_claude_credentials(existing, f"Replaced session {dest_name}")
     except Exception:
         if moved_temp and os.path.exists(dest_root):
             remove_tree(dest_root, ignore_errors=True)
-        if backup_root and os.path.exists(backup_root) and not os.path.exists(dest_root):
-            os.rename(backup_root, dest_root)
+        if backup_root and os.path.exists(backup_root):
+            if not os.path.exists(dest_root):
+                os.rename(backup_root, dest_root)
+            else:
+                raise CdxError(f"Copy to {dest_name} failed and its previous profile was retained at {backup_root}.") from None
         raise
-    finally:
+    else:
         if backup_root and os.path.exists(backup_root):
             remove_tree(backup_root, ignore_errors=True)
+    finally:
         remove_tree(temp_parent, ignore_errors=True)
-    if not result["ok"]:
-        raise CdxError(f"Failed to create session: {dest_name}")
     return {"session": result["session"], "overwritten": overwritten}
 
 
@@ -585,32 +622,37 @@ def rename_session(base_dir, store, source_name, dest_name):
     if os.path.exists(dest_root):
         raise CdxError(f"Session profile already exists: {dest_name}")
 
-    if os.path.exists(source_root):
-        os.rename(source_root, dest_root)
-        moved_profile = True
-    else:
-        moved_profile = False
-
+    moved_profile = False
+    dest_auth_home = _get_session_auth_home(base_dir, dest_name, source["provider"])
+    source_auth_home = source.get("authHome") or _get_session_auth_home(base_dir, source_name, source["provider"])
     now = _local_now_iso()
     try:
-        result = store["rename_session"](source_name, dest_name, lambda s: {
-            **s,
-            "name": dest_name,
-            "sessionRoot": dest_root,
-            "authHome": _get_session_auth_home(base_dir, dest_name, s["provider"]),
-            "updatedAt": now,
-        })
+        credential_copy = copy_keychain_credentials(source_auth_home, dest_auth_home) if source["provider"] == PROVIDER_CLAUDE else nullcontext(False)
+        with credential_copy as copied_credential:
+            if os.path.exists(source_root):
+                os.rename(source_root, dest_root)
+                moved_profile = True
+            result = store["rename_session"](source_name, dest_name, lambda s: {
+                **s,
+                "name": dest_name,
+                "sessionRoot": dest_root,
+                "authHome": dest_auth_home,
+                "updatedAt": now,
+            })
+            if not result["ok"]:
+                if result["reason"] == "exists":
+                    raise CdxError(f"Session already exists: {dest_name}")
+                raise CdxError(f"Unknown session: {source_name}")
     except Exception:
         if moved_profile and os.path.exists(dest_root) and not os.path.exists(source_root):
             os.rename(dest_root, source_root)
         raise
 
-    if not result["ok"]:
-        if moved_profile and os.path.exists(dest_root) and not os.path.exists(source_root):
-            os.rename(dest_root, source_root)
-        if result["reason"] == "exists":
-            raise CdxError(f"Session already exists: {dest_name}")
-        raise CdxError(f"Unknown session: {source_name}")
+    if copied_credential:
+        try:
+            delete_keychain_credentials(source_auth_home)
+        except CdxError:
+            raise CdxError(f"Renamed session to {dest_name}, but old keychain credential cleanup failed; the new session is usable and the old entry was retained.") from None
     return result["session"]