[samirhvbr]

After a successful PATCH /cli/session, saving the local auth record can fail with a filesystem error. session scopes set --json then raises a traceback even though the remote access changed, leaving callers without structured recovery information.

Handle the local write failure as a partial success: return exit 1 with scopes_updated: true and local_record_updated: false, explain that the remote change succeeded, and point to strix cloud session scopes and retrying after fixing local storage. Preserve the existing auth record and the stateless token-override behavior.

Closes #1608.

Validation on macOS/Apple Silicon, Python 3.12.14, against upstream 98e3df14:

• The initial regression fails before the patch with an uncaught OSError("disk full") after one successful synthetic PATCH.
• 311 tests pass across the cloud CLI, runtime, session, idempotency and source-upload suites.
• After review, the recovery command now lists the actual scopes in a terminal; all 10 session tests were rerun and pass.
• New cases cover JSON and human-readable failures, retained local credentials and CLI/environment token overrides that must never save local auth.
• Ruff format/lint, Mypy and Bandit pass on the changed code; git diff --check passes.
• Upstream's repository-wide make check-all currently stops at 940 pre-existing Pyright errors; no claim of a green full repository gate.

All HTTP responses are synthetic. No live cloud account, permission update, paid scan or LLM call was used.

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The change affects the cloud CLI's session scope-update workflow.

The PR appears safe to merge, with a small improvement needed in the recovery message.

Findings

1.  Recovery command hides permissions ▶

Fix with agent prompt

### Issue 1
strix/interface/cloud/session.py:137
The recovery message recommends `strix cloud session show`, but that command only prints the profile and scope count in a terminal. After a failed local save, users cannot see which permissions actually changed. Recommend `strix cloud session scopes` or `strix cloud session show --show-scopes` instead.

```suggestion
                        "`strix cloud session scopes`; fix local storage and rerun the same "
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Reports a failed local save after a successful scope change without raising a traceback.

• Scope updates explain when local metadata cannot be saved.

_{Reviews (1) · Last reviewed commit: "fix(cloud): report scope metadata persis..." · Reviewed by Greptile}

[greptile-apps]

Recovery command hides permissions

The recovery message recommends strix cloud session show, but that command only prints the profile and scope count in a terminal. After a failed local save, users cannot see which permissions actually changed. Recommend strix cloud session scopes or strix cloud session show --show-scopes instead.

Suggested change

	"`strix cloud session show`; fix local storage and rerun the same "
	"`strix cloud session scopes`; fix local storage and rerun the same "

Prompt To Fix With AI

This is a comment left during a code review.
Path: strix/interface/cloud/session.py
Line: 137

Comment:
**Recovery command hides permissions**

The recovery message recommends `strix cloud session show`, but that command only prints the profile and scope count in a terminal. After a failed local save, users cannot see which permissions actually changed. Recommend `strix cloud session scopes` or `strix cloud session show --show-scopes` instead.

```suggestion
                        "`strix cloud session scopes`; fix local storage and rerun the same "
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.