# fix\(desktop\): recover connection catalogs after safeStorage key loss · PR \#23476 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/23476)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: open

Source repository: pingdotgg/t3code

Source branch: fix/issue-8341

Target branch: main

Head commit: a4df9e92ee56fab1af6ef772a44454ed8c2450dd

[Discussion and reviews](https://git.cafe/pingdotgg/t3code/pull/23476)

[Commits](https://git.cafe/pingdotgg/t3code/pull/23476/commits?format=markdown)

[Files changed](https://git.cafe/pingdotgg/t3code/pull/23476/diffs?format=markdown)

## Description

---

## Problem

When Electron loses the safeStorage key, every desktop connection-catalog read rejects and blocks listing or adding environments. An undecryptable catalog reproduces the failure through the real renderer IPC on Linux; the report describes Windows key loss.

## Change

Preserve the encrypted snapshot in a deterministic `.undecryptable` backup before returning an empty catalog and logging a warning. The next save encrypts a fresh catalog normally. Backup failure still rejects the read, and backing up the snapshot preserves the original ciphertext across concurrent saves. The envelope and IPC contracts remain unchanged.

## Scope and approval

Fixes #8341
GitCafe: https://git.cafe/pingdotgg/t3code/issues/8341
Triaged bug via the automated issue flow; [issue and reproduction](https://git.cafe/pingdotgg/t3code/issues/8341). This only changes native desktop catalog recovery, with focused regression tests and a committed native fixture.

## Verification

Independent proof audit: **SUFFICIENT** at [248ab74](https://github.com/pingdotgg/t3code/commit/248ab74fbdb6f5c8660110f9bdef17fa5c721532), including a separate native replay matching every recovery and reload result row. The subsequent [diagnostic fix](https://github.com/pingdotgg/t3code/commit/a4df9e92ee56fab1af6ef772a44454ed8c2450dd) only classifies backup-write errors, removes raw error text from warning annotations, and strengthens the failure test; recovery and backup contents are unchanged. All seven focused tests, targeted lint/format and desktop typecheck passed again after that fix.

- Focused catalog suite: **7 passed**. The lost-key regression fails on the original base with `decrypt-catalog`; a deterministic concurrent-save regression catches replacement of the original backup. Preservation failure leaves the catalog intact.
- `vp run check:changed`: format, lint, desktop typecheck and all seven tests passed. The standalone fixture was then registered in Knip and `vp run knip:check` passed both files/dependencies and scoped exports checks.
- Real Electron **44.9.3**, Linux x64, Xvfb and isolated gnome_libsecret: empty recovery, exactly one backup across repeated/concurrent reads, identical ciphertext, encrypted save verified with actual safeStorage, and successful fresh-process reload.

| Evidence | Before | After |
| --- | --- | --- |
| Native IPC | [Original base 3b95e7831b: decrypt-catalog rejection](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ea94fb9f77202df3/before-transcript.txt) | [Head 248ab74fbd: recovery, save and fresh reload](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c1867f78c55f5929/final-native-transcript.txt) |
| Regression | [RED output](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/00c34169f58d372b/red-tests.txt) | Seven passing focused tests on the final branch |

[Final evidence index, results, provenance and fixture matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/36d34f88004be783/final-evidence-index.md). The visual matrix is empty because no render path changed. Backup JSON is normalized; ciphertext is preserved, rather than arbitrary JSON formatting. Original RED uses the historical base module in isolation, not a full historical checkout.

Unverified: native Windows DPAPI/Local State/profile reset, macOS Keychain reset, and the actual reconnect UI/account-backed connection. Linux exercises the shared recovery branch; backup-write failure is covered by the focused test only.

Implemented with Claude Opus 5.5 and GPT-6.1-Sol through T3 Code using the Claude Agent and Codex harnesses.