# fix\(desktop\): load saved connections with async safe storage · PR \#17311 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/17311)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: open

Source repository: Unavailable fork

Source branch: fix/desktop-catalog-recovery

Target branch: main

Head commit: 097abac10e11e8ae5dc92d753944ff1a8e33a402

[Discussion and reviews](https://git.cafe/pingdotgg/t3code/pull/17311)

[Commits](https://git.cafe/pingdotgg/t3code/pull/17311/commits?format=markdown)

[Files changed](https://git.cafe/pingdotgg/t3code/pull/17311/diffs?format=markdown)

## Description

---

Windows startup could fail to decrypt the saved connection catalog before remote environments were discovered. Prefer Electron's async safe-storage provider for availability, encryption, and decryption, including unwrapping the async decrypt result. Keep synchronous encryption available when async availability is false, or rejects while synchronous storage is available, so supported sync-only installations retain their connections.

The catalog format, legacy-secret path, byte-view boundaries, Linux backend reporting, and typed errors remain unchanged. Encryption or decryption failures on the selected provider are not retried through the other provider. No re-encryption on read is added.

Maintainer takeover of @tarushvkodes's [#17311](https://github.com/pingdotgg/t3code/pull/17311). The contributor supplied the Windows nightly reproduction and native verification on the original revision; those observations are credited, not claimed as new native proof. Original commits are preserved and main is merged.

Verification at [097abac](https://github.com/pingdotgg/t3code/commit/097abac10e11e8ae5dc92d753944ff1a8e33a402):
- Reduced the original five tests / 126 lines to four tests / 105 lines, and corrected the removed HostProcessPlatform import to HostProcess.Platform.
- Three focused suites: 23 → 22 tests, all 22 pass: ElectronSafeStorage, DesktopConnectionCatalogStore, DesktopSavedEnvironments.
- [Before: baseline production fails the async regression tests](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f35ba383ea1b041d/ssh-relay-remote-06-17311-test-red.log). Both async-unavailable and rejected-availability fallback cases also failed against the first async-only takeover revision.
- [After: current-head focused suite output](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/238bd4b0e8e670fe/ssh-relay-remote-06-17311-test-green.log).
- Desktop typecheck, touched-file lint and formatting, and git diff --check pass.
- Two independent full-diff review rounds with Claude Opus 5.5 and Codex GPT-6 Sol. Round one caught the sync-only availability regression; round two found no blockers after the fallback fix.
- This is a nonvisual adapter change; headless Linux test-level proof uses mocked Electron. No new real OS encryption or native startup verification was possible here. macOS, Windows, Linux keystore integration, Electron desktop, iOS, and Android remain unverified; web/mobile do not directly use this adapter. Human approval for the credential-storage change remains required.

Models and harness: GPT-6 Astra (tests), GPT-6.1 Sol (implementation/integration), GPT-6 Sol and Claude Opus 5.5 (reviews), through T3 Code with Codex and Claude Code.