# fix\(desktop\): recover saved connections across Windows profile keys · PR \#20152 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/20152)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: open

Source repository: Unavailable fork

Source branch: fix/windows-catalog-key-recovery

Target branch: main

Head commit: 24c644b5c7e9692a7674d2f0cd5e176b2d97b67d

[Discussion and reviews](https://git.cafe/pingdotgg/t3code/pull/20152)

[Commits](https://git.cafe/pingdotgg/t3code/pull/20152/commits?format=markdown)

[Files changed](https://git.cafe/pingdotgg/t3code/pull/20152/diffs?format=markdown)

## Description

---

Saved Windows connections can become unreadable when the shared catalog was encrypted with a different stable or Alpha profile key. Native safeStorage still gets the first attempt for a valid complete envelope; on failure, the catalog adapter authenticates it with accessible legacy profile keys.

Writes authenticate the document currently on disk and use its matching key, including writes before the first read and after another process replaces the file. Malformed, truncated, unknown-key or tampered catalogs are preserved rather than overwritten. Profile keys and encrypted tokens are never replaced. Recovery remains limited to packaged Windows; development and other platforms retain their native paths. Each legacy lookup has a ten-second cancellation deadline; scoped process cleanup is awaited. Key-lookup failures are cached until app restart. This recovers affected catalogs; it does not fix the original key-divergence trigger.

Maintainer takeover of [#20152](https://github.com/pingdotgg/t3code/pull/20152), preserving @bompus's commits. The rebuilt adapter uses Node AES-256-GCM directly and reuses the existing DPAPI key reader, removing the dependency on browser cookie decoding. PR-specific coverage went six repeated matrix rows → five focused cases; a later confirmed stalled-lookup finding added one new behavior case. Final counts are 15 store cases and 35 across four suites, matching the original execution count with distinct behavior coverage.

Verification at `24c644b5c7e9692a7674d2f0cd5e176b2d97b67d`:

- **35/35 focused tests pass** across DesktopConnectionCatalogStore, DesktopUserData, DesktopPreReadyFileSystem and ChromiumKeys. Real filesystem and AES-GCM fixtures prove stable/Alpha recovery, native-first behavior, matching-key writes, external replacement, profile/token preservation, and refusal to overwrite unreadable data. Native safeStorage and the key-reader boundary are simulated.
- Replacing production with main gives four expected failing cases. Removing write authentication, short-frame protection or strict binary-header validation produces the corresponding assertion failure; all mutations were restored.
- Desktop typecheck, targeted lint and formatting pass.
- The first full-diff review round found no code blockers. A later CodeRabbit finding about stalled PowerShell lookup was confirmed and fixed with a ten-second cancellation deadline per candidate, retaining scoped process cleanup. One deterministic regression proves interruption, candidate continuation, original native error and cache behavior. Both fresh reviewers found no code blockers in the second full-diff round and independently reran all 35 tests. Final-head code CI and Macroscope correctness pass. The cancelled native-fingerprint run has a later successful replacement. Macroscope approvability remains neutral, requiring human approval. CodeRabbit is paused at the preceding head; its sole finding was fixed, answered and resolved.

[Focused before/after proof and verification limits](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4a9f59a34b5bd2e9/20152-proof.md).

**Human gates before landing:** review the production encryption/key-recovery change and recapture native Windows proof on this rebuilt head. This Linux machine cannot verify real DPAPI/PowerShell, Electron safeStorage, packaged startup/upgrade, Windows ACLs, stable/Alpha/current-profile interoperability, V1 native readback, UI recovery or restart persistence. The author's historical native proof does not certify the rebuilt implementation. macOS, native Linux Electron, iOS and Android were not run; this is a desktop Windows service change. No screenshot applies to the nonvisual service behavior. The PR remains unmerged.

Tests: GPT-6-Astra (high). Implementation and integration: GPT-6.1-Sol (high). Independent review: Claude Opus 5.5 (high) and GPT-6-Sol (high). Harness: Codex and Claude through T3 Code.