fix: prevent stale secure-storage credentials after profile logout/remove/rename

[bukinoshita]

Summary by cubic

Prevents stale credentials in OS secure storage from authenticating removed or renamed CLI profiles. Keeps secure storage and credentials.json in sync, addressing BU-631.

• Bug Fixes
  • Query secure storage only if the profile exists in credentials.json (blocks auth via stale entries).
  • Throw when backend.delete fails on remove; do not update the file to avoid desync.
  • Verify all deletions in bulk remove; throw with failed profile names and keep the file so users can retry.
  • On rename, delete the old entry after copying; roll back the new entry if old deletion fails.
  • Added tests for stale-entry resolution, delete failures, and rename rollback; updated mocks and switched to it().

^{Written for commit 00fadec. Summary will update on new commits.}

[bukinoshita]

@cubic-dev-ai can you review?

[cubic-dev-ai]

@cubic-dev-ai can you review?

@bukinoshita I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

2 issues found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/lib/config.ts">

<violation number="1" location="src/lib/config.ts:427">
P2: `removeApiKeyAsync` can throw a misleading secure-storage failure for non-existent profiles because delete is attempted before profile existence is validated.</violation>

<violation number="2" location="src/lib/config.ts:479">
P2: Rename rollback is not verified: failure to delete `newName` is ignored while the error claims rollback succeeded.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/lib/config.ts">

<violation number="1" location="src/lib/config.ts:458">
P2: Retry after partial bulk-delete failure is unrecoverable on macOS and Windows. `backend.delete` returns `false` for already-deleted (non-existent) entries on those platforms, so retrying will re-fail the previously-succeeded profiles too, expanding the failure set every time.

Consider pre-checking with `backend.get()` to only attempt deletion of entries that still exist, or at least make the error message explicit that manual credential-file removal may be required.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}