fix(connections): report keychain failures as such, not as an unreachable SSH server

packages/web-ui/src/i18n/locales/de.json

@@ -3155,6 +3155,10 @@
     },
     "unknown": {
       "summary": "Verbindung fehlgeschlagen"
+    },
+    "keychain": {
+      "summary": "System-Schlüsselbund nicht verfügbar",
+      "recovery": "Tabularis konnte den Anmeldedatenspeicher des Systems nicht erreichen, um die Passwörter zu speichern. Stelle unter Linux sicher, dass ein Secret-Service-Anbieter (GNOME Keyring, KWallet, KeePassXC) läuft und entsperrt ist, oder deaktiviere \"Passwörter im Keychain speichern\" für diese Verbindung."
     }
   },
   "connectionTest": {

packages/web-ui/src/i18n/locales/en.json

@@ -3265,6 +3265,10 @@
     },
     "unknown": {
       "summary": "Connection failed"
+    },
+    "keychain": {
+      "summary": "System keychain unavailable",
+      "recovery": "Tabularis could not reach the OS credential store to save the passwords. On Linux, make sure a Secret Service provider (GNOME Keyring, KWallet, KeePassXC) is running and unlocked, or turn off \"Save passwords in Keychain\" for this connection."
     }
   },
   "connectionTest": {

packages/web-ui/src/i18n/locales/es.json

@@ -3089,6 +3089,10 @@
     },
     "unknown": {
       "summary": "Error de conexión"
+    },
+    "keychain": {
+      "summary": "Llavero del sistema no disponible",
+      "recovery": "Tabularis no pudo acceder al almacén de credenciales del sistema para guardar las contraseñas. En Linux, asegúrate de que un proveedor de Secret Service (GNOME Keyring, KWallet, KeePassXC) esté en ejecución y desbloqueado, o desactiva \"Guardar contraseñas en el Llavero\" para esta conexión."
     }
   },
   "connectionTest": {

packages/web-ui/src/i18n/locales/fr.json

@@ -3234,6 +3234,10 @@
     },
     "unknown": {
       "summary": "Échec de la connexion"
+    },
+    "keychain": {
+      "summary": "Trousseau système indisponible",
+      "recovery": "Tabularis n'a pas pu joindre le magasin d'identifiants du système pour enregistrer les mots de passe. Sous Linux, vérifiez qu'un fournisseur Secret Service (GNOME Keyring, KWallet, KeePassXC) est lancé et déverrouillé, ou désactivez « Enregistrer les mots de passe dans le trousseau » pour cette connexion."
     }
   },
   "connectionTest": {

packages/web-ui/src/i18n/locales/it.json

@@ -3188,6 +3188,10 @@
     },
     "unknown": {
       "summary": "Connessione fallita"
+    },
+    "keychain": {
+      "summary": "Portachiavi di sistema non disponibile",
+      "recovery": "Tabularis non è riuscito a raggiungere l'archivio credenziali del sistema per salvare le password. Su Linux, verifica che un provider Secret Service (GNOME Keyring, KWallet, KeePassXC) sia attivo e sbloccato, oppure disattiva \"Salva password nel Portachiavi\" per questa connessione."
     }
   },
   "connectionTest": {

packages/web-ui/src/i18n/locales/ja.json

@@ -3176,6 +3176,10 @@
     },
     "unknown": {
       "summary": "接続に失敗しました"
+    },
+    "keychain": {
+      "summary": "システムのキーチェーンを利用できません",
+      "recovery": "パスワードを保存するための OS の資格情報ストアに接続できませんでした。Linux では Secret Service プロバイダー（GNOME Keyring、KWallet、KeePassXC）が起動してロック解除されていることを確認するか、この接続の「パスワードをキーチェーンに保存」をオフにしてください。"
     }
   },
   "connectionTest": {

packages/web-ui/src/i18n/locales/ko.json

@@ -3062,6 +3062,10 @@
     },
     "unknown": {
       "summary": "연결 실패"
+    },
+    "keychain": {
+      "summary": "시스템 키체인을 사용할 수 없음",
+      "recovery": "비밀번호를 저장하기 위해 OS 자격 증명 저장소에 연결하지 못했습니다. Linux에서는 Secret Service 제공자(GNOME Keyring, KWallet, KeePassXC)가 실행 중이고 잠금 해제되어 있는지 확인하거나, 이 연결의 \"키체인에 비밀번호 저장\"을 끄세요."
     }
   },
   "connectionTest": {

packages/web-ui/src/i18n/locales/pt-BR.json

@@ -3212,6 +3212,10 @@
     },
     "unknown": {
       "summary": "Falha na conexão"
+    },
+    "keychain": {
+      "summary": "Chaveiro do sistema indisponível",
+      "recovery": "O Tabularis não conseguiu acessar o armazenamento de credenciais do sistema para salvar as senhas. No Linux, verifique se um provedor do Secret Service (GNOME Keyring, KWallet, KeePassXC) está em execução e desbloqueado, ou desative \"Salvar senhas no Keychain\" para esta conexão."
     }
   },
   "connectionTest": {

packages/web-ui/src/i18n/locales/ru.json

@@ -3147,6 +3147,10 @@
     },
     "unknown": {
       "summary": "Не удалось подключиться"
+    },
+    "keychain": {
+      "summary": "Системная связка ключей недоступна",
+      "recovery": "Tabularis не удалось обратиться к системному хранилищу учётных данных, чтобы сохранить пароли. В Linux убедитесь, что поставщик Secret Service (GNOME Keyring, KWallet, KeePassXC) запущен и разблокирован, или отключите «Сохранять пароли в Keychain» для этого подключения."
     }
   },
   "connectionTest": {

packages/web-ui/src/i18n/locales/tl.json

@@ -3128,6 +3128,10 @@
     },
     "unknown": {
       "summary": "Nabigo ang koneksyon"
+    },
+    "keychain": {
+      "summary": "Hindi magamit ang keychain ng system",
+      "recovery": "Hindi maabot ng Tabularis ang credential store ng OS para i-save ang mga password. Sa Linux, tiyaking tumatakbo at naka-unlock ang isang Secret Service provider (GNOME Keyring, KWallet, KeePassXC), o i-off ang \"I-save ang mga password sa Keychain\" para sa koneksyong ito."
     }
   },
   "connectionTest": {

packages/web-ui/src/i18n/locales/vi.json

@@ -3230,6 +3230,10 @@
     },
     "unknown": {
       "summary": "Kết nối thất bại"
+    },
+    "keychain": {
+      "summary": "Không thể truy cập kho khóa hệ thống",
+      "recovery": "Tabularis không thể truy cập kho thông tin đăng nhập của hệ điều hành để lưu mật khẩu. Trên Linux, hãy bảo đảm dịch vụ Secret Service (GNOME Keyring, KWallet, KeePassXC) đang chạy và đã được mở khóa, hoặc tắt tùy chọn \"Save passwords in Keychain\" cho kết nối này."
     }
   },
   "connectionTest": {

packages/web-ui/src/i18n/locales/zh-TW.json

@@ -3184,6 +3184,10 @@
         },
         "unknown": {
             "summary": "連線失敗"
+        },
+        "keychain": {
+          "summary": "無法使用系統鑰匙圈",
+          "recovery": "Tabularis 無法存取作業系統的認證儲存空間來儲存密碼。在 Linux 上，請確認 Secret Service 提供程式（GNOME Keyring、KWallet、KeePassXC）正在執行且已解鎖，或關閉此連線的「Save passwords in Keychain」選項。"
         }
     },
     "connectionTest": {

packages/web-ui/src/i18n/locales/zh.json

@@ -3097,6 +3097,10 @@
     },
     "unknown": {
       "summary": "连接失败"
+    },
+    "keychain": {
+      "summary": "系统钥匙串不可用",
+      "recovery": "Tabularis 无法访问系统凭据存储来保存密码。在 Linux 上，请确认 Secret Service 提供程序（GNOME Keyring、KWallet、KeePassXC）正在运行且已解锁，或为此连接关闭“在密钥链中保存密码”。"
     }
   },
   "connectionTest": {

packages/web-ui/src/utils/connectionErrors.ts

@@ -11,6 +11,7 @@ export type ConnectionErrorKind =
     | 'ssh-unreachable'
     | 'ssh'
     | 'ssm'
+    | 'keychain'
     | 'db-auth'
     | 'network'
     | 'db-not-found'
@@ -33,6 +34,7 @@ export function sanitizeErrorDetail(raw: string): string {
         .replace(/(password\s*=\s*)[^\s&;,]+/gi, '$1[redacted]');
 }
 
+const KEYCHAIN = /secure storage|keychain|keyring|secret service|org\.freedesktop\.secrets/i;
 const SSH_CONTEXT = /\bssh\b|tunnel/i;
 const SSH_AUTH =
     /auth|password|passphrase|credential|permission denied|publickey|keyboard-interactive/i;
@@ -69,6 +71,7 @@ export function classifyConnectionError(
         detail,
     });
 
+    if (KEYCHAIN.test(raw)) return build('keychain');
     if (SSH_CONTEXT.test(raw)) {
         if (SSH_AUTH.test(raw)) return build('ssh-auth');
         if (SSH_UNREACHABLE.test(raw)) return build('ssh-unreachable');

packages/web-ui/tests/utils/connectionErrors.test.ts

@@ -128,3 +128,27 @@ describe('classifyConnectionError with AWS SSM', () => {
         ).toBe('db-auth');
     });
 });
+
+describe('classifyConnectionError with keychain failures', () => {
+    // Secret Service timeout as reported in #932: it mentions a timeout and a
+    // broken connection, which must not be read as an unreachable SSH server.
+    const dbusTimeout =
+        'Platform secure storage failure: DBus error: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.';
+
+    it('blames the keychain, not the tunnel, when SSH is enabled', () => {
+        const result = classifyConnectionError(dbusTimeout, {sshEnabled: true});
+        expect(result.kind).toBe('keychain');
+        expect(result.summaryKey).toBe('connectionErrors.keychain.summary');
+        expect(result.recoveryKey).toBe('connectionErrors.keychain.recovery');
+    });
+
+    it('classifies other keychain failures', () => {
+        for (const raw of [
+            dbusTimeout,
+            'Platform secure storage failure: zbus error: org.freedesktop.DBus.Error.ServiceUnknown. The snap sandbox is blocking access to the system keychain.',
+            'Failed to read the stored connection URI from the OS keychain',
+        ]) {
+            expect(classifyConnectionError(raw).kind).toBe('keychain');
+        }
+    });
+});