cdx-manager 0.20.8 → 0.20.9

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.20.8-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.20.9-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Stop guessing which AI account still has quota.** `cdx` tracks the rate-limit window of every Codex and Claude account you own, tells you which one is usable right now, and launches it with isolated auth — in one command.
 
@@ -128,6 +128,7 @@ The reason `cdx` exists: knowing, across every account you own, which one you ca
 - Environment isolation per session:
   - Codex sessions override `CODEX_HOME` to a dedicated profile directory.
   - Claude sessions override `HOME` to a dedicated profile directory and disable Claude Code commit co-author attribution by default.
+  - On macOS, Claude credentials use a profile-specific keychain entry. Quota refresh reads that entry before legacy credential files; `cdx cp` and `cdx ren` transfer only the profile's entry, never the system keychain directory. Rename refuses existing destination entries and reports any old-entry cleanup failure after the new session becomes usable; `cdx rm` deletes the profile's entry with the profile.
   - Antigravity sessions launch `agy` with a dedicated `HOME` for file-based settings; Google account credentials may still be stored in the OS keyring by Antigravity itself.
   - Ollama sessions use the local Ollama server and launch `ollama run <model>`; set a model with `cdx set <name> --model <model>`.
   - New Codex sessions seed their auth home from your existing global `~/.codex/auth.json` when available, so an already logged-in Codex CLI can be reused without giving up per-session isolation afterward.
@@ -910,6 +911,8 @@ cdx import backup-auth.cdx --passphrase-env CDX_BUNDLE_PASSPHRASE
 Notes:
 
 - `--include-auth` is encrypted, requires a passphrase, and exports only provider credential files rather than full profile caches, logs, or installed plugins.
+- Keychain-backed Claude authentication cannot currently be exported. If any selected profile uses it, `--include-auth` exits non-zero before writing anything, including with `--force`; text and JSON errors identify the affected profiles. Export without `--include-auth` and log in after import, or select only profiles whose authentication is file-backed. An inaccessible keychain is an explicit error, not a successful incomplete export.
+- Merge imports snapshot each existing profile before modification, preserving symlinks instead of following them. This temporarily needs space for a second copy of that profile. On failure, CDX restores the original files, record and state; if recovery also fails, the error gives the retained recovery directory containing the original metadata and any remaining profile snapshot.
 - Without `--passphrase-env`, `cdx` prompts in an interactive terminal. Non-interactive callers can pass `--passphrase-stdin` to read the passphrase from stdin (one line) instead of exposing it in the child environment.
 - `--sessions work,perso` exports or imports only a subset.
 - `--force` allows overwriting existing destination sessions during import or replacing an existing bundle file during export. Import preserves detected local `plugins/` state when the bundle does not provide it, and refuses to overwrite existing sessions from a bundle without auth payloads unless `--allow-authless-force` is also passed.

package/VERSION

@@ -1 +1 @@
-0.20.8
+0.20.9

package/changelogs/CHANGELOGS_0_20_9.md

@@ -0,0 +1,39 @@
+# CDX Manager 0.20.9
+
+## Fixes
+
+- Preserve an existing session when `cdx import --merge` fails. The profile,
+  its record and its state are snapshotted first — symlinks kept as links —
+  and restored on failure; if recovery itself fails, the error names the
+  retained recovery directory instead of leaving the session destroyed.
+  Bundle paths that escape the profile through a link are refused.
+- Stop `cdx cp` from copying the profile's macOS keychain directory. Only the
+  source profile's own keychain entry is transferred, and an overwritten
+  destination entry is restored if the copy fails.
+- Keep Claude authentication working across `cdx ren`. The destination
+  keychain entry is staged before the profile moves, an existing destination
+  entry is refused, and a failed cleanup of the old entry is reported once the
+  renamed session is already usable.
+- Delete a session's Claude keychain credential when the session is removed,
+  so the OAuth token does not outlive the profile and the freed name can be
+  reused by `cdx cp` and `cdx ren`.
+- Refresh Claude quota from the profile-scoped keychain entry before falling
+  back to legacy credential files, so keychain-authenticated sessions no
+  longer read as missing credentials. An unreadable keychain is an explicit
+  error, never a silent "not logged in" — unless a credential file on disk
+  can still answer, in which case `cdx` uses it and says nothing.
+
+- Export keychain-backed Claude authentication. `cdx export --include-auth`
+  carries the profile's keychain entry in the encrypted bundle as its
+  credential file, and `cdx import` restores a usable login, replacing any
+  entry the destination profile already had so the imported credential is the
+  one in effect. A keychain that cannot be read is an explicit error before
+  anything is written, in both text and JSON, so an existing `--force`
+  destination survives it.
+
+## Notes
+
+- A credential restored from a bundle lands in the profile's credential file
+  rather than the keychain; Claude Code moves it back on its next launch.
+- Merge imports temporarily need room for a second copy of the profile being
+  merged into.

package/checksums/release-archives.json

@@ -397,6 +397,17 @@
         "x86_64-pc-windows-msvc": "532fcdabf7ff249eafaea6518668e7a175ae8763de1f23c5abc9bb2c5d4e5eac",
         "x86_64-unknown-linux-musl": "224277ab55219bb5d94386f57fa00bc043537ad97ecf04fd68afd2a7986caa87"
       }
+    },
+    "v0.20.8": {
+      "github_tarball_sha256": "388f32a28e1ae816679947d3422a43d413c665f6b7eb445c9c92e177d7bb2cfa",
+      "github_zip_sha256": "82bfea6857a2e365e4fab7a7996a301a725c4fc98d7d83acfbb676a6aa95ae8e",
+      "tray_assets": {
+        "aarch64-apple-darwin": "38fc94180e73a440cba7dee576271a9189f1050d297456d0d4eebd4314f794b2",
+        "aarch64-unknown-linux-musl": "6713672f6a5effc544d056ae1aacc8929e9c6c63e1f44b7eff50c64fb0395810",
+        "x86_64-apple-darwin": "69611a302855f38fbc79b650004af3aad8f03c7aca65d91d5820bf49fb499edd",
+        "x86_64-pc-windows-msvc": "343245a6ce52275e8e7bd9a380d9e03fd1db3bcf917df3e6cecde2d0be1bfaeb",
+        "x86_64-unknown-linux-musl": "5d6e776b5ce64a062c798c5c00f9e85e003b5b6888cece74173bff1f45247f34"
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.20.8",
+  "version": "0.20.9",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.20.8"
+version = "0.20.9"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/claude_credentials.py

@@ -0,0 +1,148 @@
+"""Profile-scoped macOS credential access, matching Claude Code 2.1.263."""
+
+import hashlib
+import json
+import os
+import re
+import subprocess
+import sys
+import unicodedata
+from contextlib import contextmanager
+
+from .errors import CdxError
+
+KEYCHAIN_TIMEOUT_SECONDS = 5
+
+
+def _keychain_identity(auth_home):
+    if not auth_home or not os.path.isabs(auth_home):
+        raise CdxError("Claude keychain access requires an absolute profile home.")
+    user = os.environ.get("USER")
+    if not user:
+        import pwd
+        user = pwd.getpwuid(os.getuid()).pw_name
+    if not re.fullmatch(r"[a-zA-Z0-9._-]+", user):
+        user = "claude-code-user"
+    config_dir = unicodedata.normalize("NFC", os.path.join(auth_home, ".claude"))
+    suffix = hashlib.sha256(config_dir.encode("utf-8")).hexdigest()[:8]
+    return user, f"Claude Code-credentials-{suffix}"
+
+
+def _reject_custom_oauth():
+    """Only writes are guarded: a custom endpoint stores credentials elsewhere,
+    so reading the standard entry is harmless but changing it is not."""
+    if os.environ.get("USE_LOCAL_OAUTH") or os.environ.get("CLAUDE_CODE_CUSTOM_OAUTH_URL"):
+        raise CdxError("CDX keychain operations do not support custom Claude OAuth endpoints.")
+
+
+def _security(args, *, input_text=None):
+    import pwd
+
+    # HOME may already point at a profile. Always resolve the operator's actual keychain.
+    try:
+        env = {**os.environ, "HOME": pwd.getpwuid(os.getuid()).pw_dir}
+        result = subprocess.run(["/usr/bin/security", *args], input=input_text,
+                                capture_output=True, text=True, timeout=KEYCHAIN_TIMEOUT_SECONDS,
+                                env=env, check=False)
+    except subprocess.TimeoutExpired:
+        raise CdxError("Claude keychain operation timed out; authentication was not verified.") from None
+    except (OSError, KeyError, UnicodeError):
+        raise CdxError("Claude keychain is unavailable; authentication was not verified.") from None
+    return result
+
+
+def read_keychain_credentials(auth_home):
+    if sys.platform != "darwin" or not auth_home:
+        return None
+    user, service = _keychain_identity(auth_home)
+    result = _security(["find-generic-password", "-a", user, "-s", service, "-w"])
+    if result.returncode == 44:  # errSecItemNotFound, not a locked or missing keychain.
+        return None
+    if result.returncode != 0:
+        raise CdxError("Claude keychain access failed; unlock or allow access to the profile credential.")
+    try:
+        data = json.loads(result.stdout)
+    except (ValueError, TypeError):
+        raise CdxError("Claude keychain credential data is malformed.") from None
+    if not isinstance(data, dict):
+        raise CdxError("Claude keychain credential data is malformed.")
+    return data
+
+
+def peek_keychain_credentials(auth_home):
+    """The profile entry, or None when the keychain cannot answer.
+
+    For callers with a file-based fallback. Callers that would otherwise
+    report a locked keychain as a logged-out profile use the strict read.
+    """
+    try:
+        return read_keychain_credentials(auth_home)
+    except CdxError:
+        return None
+
+
+def write_keychain_credentials(auth_home, data):
+    _reject_custom_oauth()
+    user, service = _keychain_identity(auth_home)
+    encoded = json.dumps(data, ensure_ascii=True, separators=(",", ":")).encode("utf-8").hex()
+    command = f'add-generic-password -U -a "{user}" -s "{service}" -X "{encoded}"\n'
+    # ponytail: security -i has a 4096-byte line limit; use native Security APIs if larger entries are needed.
+    if len(command) > 4000:
+        raise CdxError(
+            "Claude profile credential exceeds the safe keychain transfer size; nothing was changed. "
+            "Create the session and log in inside it instead of transferring the credential."
+        )
+    # Credentials travel through stdin, never argv, shell text or error diagnostics.
+    result = _security(["-i"], input_text=command)
+    if result.returncode != 0:
+        raise CdxError("Could not write the destination Claude keychain credential.")
+    # security's interactive driver may exit successfully after a failed command.
+    if read_keychain_credentials(auth_home) != data:
+        raise CdxError("Destination Claude keychain credential verification failed.")
+
+
+def delete_keychain_credentials(auth_home):
+    # Same guard as the read: off macOS there is no keychain to clear, and
+    # `cdx rm`/`cdx import` must not fail on a missing `security` binary.
+    if sys.platform != "darwin" or not auth_home:
+        return
+    _reject_custom_oauth()
+    user, service = _keychain_identity(auth_home)
+    result = _security(["delete-generic-password", "-a", user, "-s", service])
+    if result.returncode not in (0, 44):
+        raise CdxError("Could not remove the profile's Claude keychain credential.")
+
+
+@contextmanager
+def copy_keychain_credentials(source_home, dest_home, *, overwrite=False):
+    """Stage a profile credential and restore the destination if its operation fails."""
+    if sys.platform != "darwin":
+        yield False
+        return
+    if _keychain_identity(source_home) == _keychain_identity(dest_home):
+        raise CdxError("Source and destination Claude keychain identities collide.")
+    source = read_keychain_credentials(source_home)
+    previous = read_keychain_credentials(dest_home)
+    if previous is not None and not overwrite:
+        raise CdxError(
+            "Destination already has a Claude keychain credential; refusing to overwrite it. "
+            f"If no session owns it, clear it with: security delete-generic-password -s '{_keychain_identity(dest_home)[1]}'"
+        )
+    changed = source != previous
+    try:
+        if changed:
+            if source is None:
+                delete_keychain_credentials(dest_home)
+            else:
+                write_keychain_credentials(dest_home, source)
+        yield source is not None
+    except Exception:
+        if changed:
+            try:
+                if previous is None:
+                    delete_keychain_credentials(dest_home)
+                else:
+                    write_keychain_credentials(dest_home, previous)
+            except CdxError:
+                raise CdxError("Profile operation failed; destination keychain recovery is incomplete. Source credentials were retained.") from None
+        raise

package/src/claude_usage.py

@@ -8,6 +8,12 @@ import urllib.error
 import urllib.request
 from datetime import datetime, timezone
 
+try:  # POSIX only; the keychain wiring below is macOS-specific anyway.
+    import pwd
+except ImportError:  # pragma: no cover - Windows
+    pwd = None
+
+from .claude_credentials import read_keychain_credentials
 from .errors import CdxError
 
 MONTH_ABBR = ["Jan", "Feb", "Mar", "Apr", "May", "Jun",
@@ -45,6 +51,20 @@ def _decode_jwt_claims(token):
 
 
 def _read_claude_credentials(auth_home):
+    # An unusable keychain is only an error when no credential file answers
+    # either: a locked keychain must not read as a logged-out profile, and
+    # must not hide a credential that is sitting on disk.
+    keychain_error = None
+    try:
+        keychain = read_keychain_credentials(auth_home)
+    except CdxError as error:
+        keychain, keychain_error = None, error
+    if keychain is not None:
+        creds = keychain.get("claudeAiOauth")
+        token = _clean_oauth_token(creds.get("accessToken")) if isinstance(creds, dict) else None
+        if token:
+            return {**creds, "accessToken": token}
+        keychain_error = CdxError("Claude keychain OAuth credential is malformed.")
     cred_path = os.path.join(auth_home, ".claude", ".credentials.json")
     try:
         with open(cred_path, encoding="utf-8") as f:
@@ -65,9 +85,66 @@ def _read_claude_credentials(auth_home):
             return {"accessToken": token}
     except (FileNotFoundError, json.JSONDecodeError, OSError):
         pass
+
+    if keychain_error is not None:
+        raise keychain_error
     return None
 
 
+def _link_macos_keychain(auth_home):
+    """Make the operator's login keychain reachable from a redirected home.
+
+    macOS resolves the login keychain through `$HOME/Library/Keychains`.
+    Profile isolation redirects HOME (see `_home_env_overrides`), so that path
+    does not exist: every Claude Code launch then raises a "Keychain Not Found"
+    dialog before falling back to a plaintext credentials file. Linking the
+    real keychain directory into the profile home restores the lookup. Failure
+    is non-fatal, and deliberately quiet: the profile simply keeps the
+    file-based credentials it already used.
+    """
+    if sys.platform != "darwin" or pwd is None:
+        return
+    try:
+        real_home = pwd.getpwuid(os.getuid()).pw_dir
+    except (KeyError, OSError):
+        return
+    source = os.path.join(real_home, "Library", "Keychains")
+    if not os.path.isdir(source):
+        return
+    link = os.path.join(auth_home, "Library", "Keychains")
+    if os.path.realpath(link) == os.path.realpath(source):
+        return
+    try:
+        os.makedirs(os.path.dirname(link), exist_ok=True)
+        if os.path.islink(link):
+            os.unlink(link)
+        os.symlink(source, link)
+    except OSError:
+        return
+
+
+def _secure_storage_overrides(auth_home):
+    """Key Claude Code's credential storage to this profile.
+
+    Claude Code names its stored credential from
+    `CLAUDE_SECURESTORAGE_CONFIG_DIR`, falling back to `CLAUDE_CONFIG_DIR`,
+    which cdx clears to keep profile credentials isolated. With neither set,
+    every profile writes the same entry, so any store shared between profiles
+    would have them overwrite each other. Only macOS reads such a store today
+    (the login keychain, reached through `/usr/bin/security`); Windows
+    Credential Manager sits behind an opt-in flag and Linux has no keyring
+    backend, so elsewhere this is inert but keeps profiles isolated should that
+    change.
+
+    The value must be the config dir Claude Code would have resolved on its own
+    -- `<home>/.claude`, since cdx leaves `CLAUDE_CONFIG_DIR` unset -- because
+    the variable overrides that directory as well as naming the entry. Any
+    other value would also move where credentials are read from.
+    """
+    _link_macos_keychain(auth_home)
+    return {"CLAUDE_SECURESTORAGE_CONFIG_DIR": os.path.join(auth_home, ".claude")}
+
+
 def _home_env_overrides(auth_home):
     overrides = {
         "HOME": auth_home,
@@ -78,6 +155,7 @@ def _home_env_overrides(auth_home):
         overrides["USERPROFILE"] = auth_home
         overrides["HOMEDRIVE"] = os.path.splitdrive(auth_home)[0] or "C:"
         overrides["HOMEPATH"] = os.path.splitdrive(auth_home)[1] or auth_home
+    overrides.update(_secure_storage_overrides(auth_home))
     return overrides
 
 

package/src/provider_runtime.py

@@ -12,7 +12,8 @@ import uuid
 from datetime import datetime, timezone
 
 from .agent_notify import launch_notify_env, notifications_enabled
-from .claude_usage import _clean_oauth_token, _decode_jwt_claims
+from .claude_credentials import peek_keychain_credentials
+from .claude_usage import _clean_oauth_token, _decode_jwt_claims, _secure_storage_overrides
 from .codex_usage import codex_auth_lock, diagnostic_needs_codex_login, fetch_codex_rate_limit_diagnostic
 from .config import (
     PROVIDER_ANTIGRAVITY,
@@ -145,7 +146,9 @@ def _home_env_overrides(auth_home):
     Code builds ignore otherwise valid isolated credentials. On Windows, Node.js
     resolves the home directory via USERPROFILE (and falls back to
     HOMEDRIVE+HOMEPATH), so we set all three to ensure profile isolation works
-    regardless of the platform.
+    regardless of the platform. Redirecting the home also detaches Claude
+    Code's credential storage, which `_secure_storage_overrides` re-keys to
+    this profile.
     """
     overrides = {
         "HOME": auth_home,
@@ -156,6 +159,7 @@ def _home_env_overrides(auth_home):
         overrides["USERPROFILE"] = auth_home
         overrides["HOMEDRIVE"] = os.path.splitdrive(auth_home)[0] or "C:"
         overrides["HOMEPATH"] = os.path.splitdrive(auth_home)[1] or auth_home
+    overrides.update(_secure_storage_overrides(auth_home))
     return overrides
 
 
@@ -229,7 +233,10 @@ def _has_local_claude_auth(auth_home):
 def _read_claude_launch_oauth_token(auth_home):
     if _has_local_claude_auth(auth_home):
         return None
-    return _read_anthropic_oauth_token(auth_home)
+    token = _read_anthropic_oauth_token(auth_home)
+    if token and peek_keychain_credentials(auth_home) is not None:
+        return None
+    return token
 
 
 def _has_local_codex_auth(auth_home):

package/src/session_backup.py

@@ -6,11 +6,13 @@ coupling measurement supports. Moved verbatim; re-exported by session_service.
 
 import base64
 import binascii
+import json
 import os
 import shutil
 import tempfile
 
 from .backup_bundle import decode_bundle, encode_bundle
+from .claude_credentials import delete_keychain_credentials, read_keychain_credentials
 from .config import PROVIDER_CLAUDE
 from .errors import CdxError
 from .fs_utils import atomic_write, remove_tree
@@ -55,12 +57,14 @@ def _build_export_session_record(session):
         "auth": session.get("auth"),
     }
 
+CLAUDE_CREDENTIALS_BUNDLE_PATH = "claude-home/.claude/.credentials.json"
+
 def _auth_bundle_paths(provider):
     if provider == PROVIDER_CLAUDE:
         return [
             "claude-home/configs/default.json",
             "claude-home/credentials/default.json",
-            "claude-home/.claude/.credentials.json",
+            CLAUDE_CREDENTIALS_BUNDLE_PATH,
             "claude-home/.claude.json",
             "claude-home/auth.json",
         ]
@@ -68,19 +72,26 @@ def _auth_bundle_paths(provider):
         "auth.json",
     ]
 
-def _collect_auth_files(session_root, provider, session_name=None, progress_callback=None):
+def _collect_auth_files(session_root, provider, session_name=None, progress_callback=None, auth_home=None):
     files = []
     total_bytes = 0
     if not os.path.isdir(session_root):
         return {"files": files, "file_count": 0, "bytes": 0}
+    # A keychain-backed profile has no credential file to read. Export the entry
+    # under the path Claude Code itself uses, which is the same document: the
+    # bundle stays one schema, and an import restores a usable login.
+    keychain = read_keychain_credentials(auth_home) if provider == PROVIDER_CLAUDE and auth_home else None
     for rel_path in _auth_bundle_paths(provider):
         full_path = os.path.join(session_root, rel_path)
-        if not os.path.isfile(full_path):
+        if keychain is not None and rel_path == CLAUDE_CREDENTIALS_BUNDLE_PATH:
+            raw_content = json.dumps(keychain).encode("utf-8")
+        elif os.path.isfile(full_path):
+            with open(full_path, "rb") as handle:
+                raw_content = handle.read()
+        else:
             continue
-        with open(full_path, "rb") as handle:
-            raw_content = handle.read()
-            total_bytes += len(raw_content)
-            content = base64.b64encode(raw_content).decode("ascii")
+        total_bytes += len(raw_content)
+        content = base64.b64encode(raw_content).decode("ascii")
         files.append({"path": rel_path.replace(os.sep, "/"), "data_b64": content})
         if progress_callback:
             progress_callback({
@@ -151,7 +162,7 @@ def _resolve_session_subset(store, session_names):
 
 def _restore_import_backup(store, name, backup_root, session_root, old_record, old_state):
     if os.path.exists(session_root):
-        remove_tree(session_root, ignore_errors=True)
+        remove_tree(session_root)
     if backup_root and os.path.exists(backup_root):
         os.rename(backup_root, session_root)
     if old_record:
@@ -194,7 +205,12 @@ def export_bundle(base_dir, store, file_path, include_auth=False, session_names=
             payload["states"][session["name"]] = state
         if include_auth:
             session_root = session.get("sessionRoot") or _get_session_root(base_dir, session["name"])
-            profile = _collect_auth_files(session_root, session["provider"], session["name"], progress_callback)
+            auth_home = session.get("authHome") or _get_session_auth_home(base_dir, session["name"], session["provider"])
+            try:
+                profile = _collect_auth_files(session_root, session["provider"], session["name"], progress_callback,
+                                              auth_home=auth_home)
+            except CdxError as error:
+                raise CdxError(f"Cannot export authentication for {session['name']}: {error}. Nothing was exported.") from None
             payload["profiles"][session["name"]] = profile["files"]
             profile_file_count += profile["file_count"]
             profile_bytes += profile["bytes"]
@@ -268,23 +284,39 @@ def import_bundle(base_dir, store, file_path,
         _ensure_private_dir(base_dir)
         _ensure_private_dir(os.path.join(base_dir, "profiles"))
         backup_root = None
+        recovery_dir = None
         old_record = None
         old_state = None
         preserved_profile_paths = []
-        if is_existing and force:
+        if is_existing and (force or merge):
             old_record = store["get_session"](name)
             old_state = store["read_session_state"](name)
-            preserved_profile_paths = _force_import_preserved_profile_paths(session_root)
-            if os.path.exists(session_root):
-                backup_root = tempfile.mkdtemp(prefix=f".{_encode(name)}.import.", dir=os.path.dirname(session_root))
-                os.rmdir(backup_root)
-                os.rename(session_root, backup_root)
-            is_existing = False
-        _ensure_private_dir(session_root)
-        _ensure_private_dir(auth_home)
+            if merge:
+                provider = old_record["provider"]
+                auth_home = old_record["authHome"]
+            recovery_dir = tempfile.mkdtemp(prefix=f".{_encode(name)}.import.", dir=os.path.dirname(session_root))
+            backup_root = os.path.join(recovery_dir, "profile")
+            try:
+                atomic_write(os.path.join(recovery_dir, "recovery.json"),
+                             json.dumps({"session": old_record, "state": old_state}), mode=0o600)
+                if force:
+                    preserved_profile_paths = _force_import_preserved_profile_paths(session_root)
+                    if os.path.exists(session_root):
+                        os.rename(session_root, backup_root)
+                    is_existing = False
+                elif os.path.exists(session_root):
+                    # ponytail: full profile snapshot; journal new merge files if copy cost becomes material.
+                    # Keep links as links: a Claude profile can reference the system keychain,
+                    # and a dangling one (stale plugin or npm cache) must not fail the import.
+                    shutil.copytree(session_root, backup_root, symlinks=True, ignore_dangling_symlinks=True)
+            except Exception:
+                remove_tree(recovery_dir, ignore_errors=True)
+                raise
 
         existing_state_before = None
         try:
+            _ensure_private_dir(session_root)
+            _ensure_private_dir(auth_home)
             if is_existing and merge:
                 existing_record = store["get_session"](name) or {}
                 # replace_session resets the state file to defaults, so the
@@ -320,21 +352,38 @@ def import_bundle(base_dir, store, file_path,
             elif state is not None:
                 store["write_session_state"](name, state)
 
+            imported_paths = []
             for item in decoded_profiles.get(name, []):
                 dest_path = os.path.join(session_root, item["path"])
+                # A syntactically relative path can still escape through a profile symlink.
+                root = os.path.realpath(session_root)
+                try:
+                    inside = os.path.commonpath([root, os.path.realpath(dest_path)]) == root
+                except ValueError:  # different drive: never inside the profile.
+                    inside = False
+                if not inside:
+                    raise CdxError("Bundle file path escapes the session profile through a link.")
                 # In merge mode, skip files that already exist locally.
-                if is_existing and merge and os.path.exists(dest_path):
+                if is_existing and merge and os.path.lexists(dest_path):
                     continue
                 _ensure_private_dir(os.path.dirname(dest_path))
                 # Decrypted credentials: 0o600 from creation, no umask window.
                 atomic_write(dest_path, item["content"], mode=0o600)
+                imported_paths.append(item["path"])
+            if provider == PROVIDER_CLAUDE and CLAUDE_CREDENTIALS_BUNDLE_PATH in imported_paths:
+                delete_keychain_credentials(auth_home)
             _restore_force_import_profile_paths(name, backup_root, session_root, preserved_profile_paths)
         except Exception:
-            _restore_import_backup(store, name, backup_root, session_root, old_record, old_state)
+            try:
+                _restore_import_backup(store, name, backup_root, session_root, old_record, old_state)
+            except Exception:
+                raise CdxError(f"Import failed and recovery is incomplete for {name}; recovery data retained at {recovery_dir or session_root}.") from None
+            if recovery_dir:
+                remove_tree(recovery_dir, ignore_errors=True)
             raise
-        finally:
-            if backup_root and os.path.exists(backup_root):
-                remove_tree(backup_root, ignore_errors=True)
+        else:
+            if recovery_dir:
+                remove_tree(recovery_dir, ignore_errors=True)
 
     return {
         "path": file_path,

package/src/session_service.py

@@ -31,8 +31,11 @@ import os
 import shutil
 import tempfile
 import uuid
+from contextlib import nullcontext
 from functools import partial
 
+from .claude_credentials import copy_keychain_credentials, delete_keychain_credentials
+from .claude_usage import _link_macos_keychain
 from .codex_usage import fetch_codex_rate_limits
 from .config import (
     MAX_LAUNCH_BUDGET_USD,
@@ -471,6 +474,22 @@ def set_session_enabled(store, name, enabled):
     })
 
 
+def _discard_claude_credentials(record, done):
+    """Drop a gone profile's keychain entry.
+
+    Left behind it both keeps the OAuth token alive and blocks the name: the
+    next `cdx cp`/`cdx ren` into it refuses to overwrite an entry no session
+    owns any more. The profile is already gone when this runs, so a failure
+    is reported without undoing the operation.
+    """
+    if not record or record.get("provider") != PROVIDER_CLAUDE:
+        return
+    try:
+        delete_keychain_credentials(record.get("authHome"))
+    except CdxError as error:
+        raise CdxError(f"{done}, but its Claude keychain credential could not be deleted: {error}") from None
+
+
 def remove_session(base_dir, store, name):
     session = store["get_session"](name)
     if not session:
@@ -500,6 +519,7 @@ def remove_session(base_dir, store, name):
             raise CdxError(
                 f"Removed session {name}, but failed to delete archived profile {quarantine_root}: {error}"
             ) from error
+    _discard_claude_credentials(session, f"Removed session {name}")
     return removed
 
 
@@ -517,6 +537,7 @@ def copy_session(base_dir, store, source_name, dest_name):
     if not existing and os.path.exists(dest_root):
         raise CdxError(f"Session profile already exists: {dest_name}")
     dest_auth_home = _get_session_auth_home(base_dir, dest_name, source["provider"])
+    source_auth_home = source.get("authHome") or _get_session_auth_home(base_dir, source_name, source["provider"])
     profiles_dir = os.path.dirname(dest_root)
     os.makedirs(profiles_dir, exist_ok=True)
     temp_parent = tempfile.mkdtemp(prefix=f".{_encode(dest_name)}.copy.", dir=profiles_dir)
@@ -545,28 +566,44 @@ def copy_session(base_dir, store, source_name, dest_name):
         },
     }
     try:
-        shutil.copytree(source_root, temp_root)
-        if existing:
-            backup_root = tempfile.mkdtemp(prefix=f".{_encode(dest_name)}.backup.", dir=profiles_dir)
-            os.rmdir(backup_root)
-            if os.path.exists(dest_root):
-                os.rename(dest_root, backup_root)
-        os.rename(temp_root, dest_root)
-        moved_temp = True
-        result = store["replace_session"](dest_name, replacement)
-        overwritten = bool(existing)
+        credential_copy = copy_keychain_credentials(
+            source_auth_home, dest_auth_home,
+            overwrite=bool(existing and existing["provider"] == PROVIDER_CLAUDE),
+        ) if source["provider"] == PROVIDER_CLAUDE else nullcontext()
+        with credential_copy:
+            if source["provider"] == PROVIDER_CLAUDE:
+                shutil.copytree(source_root, temp_root, symlinks=True,
+                                ignore=lambda _directory, names: [n for n in names if n == "Keychains"])
+                _link_macos_keychain(os.path.join(temp_root, "claude-home"))
+            else:
+                shutil.copytree(source_root, temp_root)
+            if existing:
+                backup_root = tempfile.mkdtemp(prefix=f".{_encode(dest_name)}.backup.", dir=profiles_dir)
+                os.rmdir(backup_root)
+                if os.path.exists(dest_root):
+                    os.rename(dest_root, backup_root)
+            os.rename(temp_root, dest_root)
+            moved_temp = True
+            result = store["replace_session"](dest_name, replacement)
+            if not result["ok"]:
+                raise CdxError(f"Failed to create session: {dest_name}")
+            overwritten = bool(existing)
+            if existing and source["provider"] != PROVIDER_CLAUDE:
+                _discard_claude_credentials(existing, f"Replaced session {dest_name}")
     except Exception:
         if moved_temp and os.path.exists(dest_root):
             remove_tree(dest_root, ignore_errors=True)
-        if backup_root and os.path.exists(backup_root) and not os.path.exists(dest_root):
-            os.rename(backup_root, dest_root)
+        if backup_root and os.path.exists(backup_root):
+            if not os.path.exists(dest_root):
+                os.rename(backup_root, dest_root)
+            else:
+                raise CdxError(f"Copy to {dest_name} failed and its previous profile was retained at {backup_root}.") from None
         raise
-    finally:
+    else:
         if backup_root and os.path.exists(backup_root):
             remove_tree(backup_root, ignore_errors=True)
+    finally:
         remove_tree(temp_parent, ignore_errors=True)
-    if not result["ok"]:
-        raise CdxError(f"Failed to create session: {dest_name}")
     return {"session": result["session"], "overwritten": overwritten}
 
 
@@ -585,32 +622,37 @@ def rename_session(base_dir, store, source_name, dest_name):
     if os.path.exists(dest_root):
         raise CdxError(f"Session profile already exists: {dest_name}")
 
-    if os.path.exists(source_root):
-        os.rename(source_root, dest_root)
-        moved_profile = True
-    else:
-        moved_profile = False
-
+    moved_profile = False
+    dest_auth_home = _get_session_auth_home(base_dir, dest_name, source["provider"])
+    source_auth_home = source.get("authHome") or _get_session_auth_home(base_dir, source_name, source["provider"])
     now = _local_now_iso()
     try:
-        result = store["rename_session"](source_name, dest_name, lambda s: {
-            **s,
-            "name": dest_name,
-            "sessionRoot": dest_root,
-            "authHome": _get_session_auth_home(base_dir, dest_name, s["provider"]),
-            "updatedAt": now,
-        })
+        credential_copy = copy_keychain_credentials(source_auth_home, dest_auth_home) if source["provider"] == PROVIDER_CLAUDE else nullcontext(False)
+        with credential_copy as copied_credential:
+            if os.path.exists(source_root):
+                os.rename(source_root, dest_root)
+                moved_profile = True
+            result = store["rename_session"](source_name, dest_name, lambda s: {
+                **s,
+                "name": dest_name,
+                "sessionRoot": dest_root,
+                "authHome": dest_auth_home,
+                "updatedAt": now,
+            })
+            if not result["ok"]:
+                if result["reason"] == "exists":
+                    raise CdxError(f"Session already exists: {dest_name}")
+                raise CdxError(f"Unknown session: {source_name}")
     except Exception:
         if moved_profile and os.path.exists(dest_root) and not os.path.exists(source_root):
             os.rename(dest_root, source_root)
         raise
 
-    if not result["ok"]:
-        if moved_profile and os.path.exists(dest_root) and not os.path.exists(source_root):
-            os.rename(dest_root, source_root)
-        if result["reason"] == "exists":
-            raise CdxError(f"Session already exists: {dest_name}")
-        raise CdxError(f"Unknown session: {source_name}")
+    if copied_credential:
+        try:
+            delete_keychain_credentials(source_auth_home)
+        except CdxError:
+            raise CdxError(f"Renamed session to {dest_name}, but old keychain credential cleanup failed; the new session is usable and the old entry was retained.") from None
     return result["session"]