fix(desktop): Select Linux secret storage backend

[mwolson]

Summary

Closes #2539.
Closes #2880.

This selects an encrypted Linux safeStorage backend before Electron is ready, so desktop SSH environment credentials can be persisted on Linux sessions Electron does not recognize automatically.

Problem and Fix

Problem and Why it Happened	Fix
Electron 41 can fall back to basic_text on Linux sessions such as Niri or unversioned KDE/Plasma because the desktop name is not one of Electron's recognized backend selectors.	Resolve a Linux password-store switch before app.ready and default unknown non-KDE sessions to gnome-libsecret, while using KWallet for KDE/Plasma sessions.
The desktop app did not have a pre-ready settings path for a user-selected Linux password-store override.	Read the persisted linuxPasswordStore setting synchronously during early Electron startup, with unsupported values normalized to auto without dropping unrelated settings.
AppImage sessions can start without the session bus and desktop environment variables needed by Linux secret stores.	Hydrate Linux session environment values from the login shell and fall back to /run/user/<uid>/bus when the DBus session bus exists but is not exported.

Defensive Fixes

Problem and Why it Happened	Fix
The desktop file protocol scheme registration was Effect-scoped, but Electron requires privileged scheme registration before ready.	Expose and call a synchronous scheme privilege registration helper during process bootstrap.
Safe-storage failures were hard to diagnose on Linux.	Log the configured password-store decision before ready and the selected backend after ready, without probing keyring availability during startup.

Validation

• bun fmt
• bun lint
• bun typecheck
• bun run --filter @t3tools/desktop test -- linuxSecretStorage DesktopEarlyElectronStartup DesktopAppSettings DesktopShellEnvironment DesktopSavedEnvironments

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes: N/A, desktop startup and persistence behavior
• I included a video for animation/interaction changes: N/A

---

Note

High Risk
Changes how Linux chooses Electron's encrypted credential backend at startup (DBus, password-store switches, and auto heuristics), which can affect whether existing users can read or write saved SSH secrets until they adjust keyring/KWallet setup.

Overview
Configures Linux desktop startup so Electron picks an encrypted safeStorage backend before app.ready, fixing SSH environment credential persistence on sessions Electron does not recognize (e.g. Niri, unversioned KDE).

Adds a persisted linuxPasswordStore setting (default auto) and reads it synchronously from desktop-settings.json during early bootstrap, alongside heuristics that map auto to gnome-libsecret or KWallet when needed. main.ts now applies Linux pre-ready switches (password-store, WM class, optional DBUS_SESSION_BUS_ADDRESS) and registers the desktop scheme privileges synchronously; DesktopApp can clear and re-apply password-store after login-shell hydration and logs the chosen store and selected backend after ready.

DesktopShellEnvironment pulls more session variables from the login shell and falls back to /run/user/<uid>/bus when DBus is unset. Supporting pieces include removeCommandLineSwitch, selectedStorageBackend on safe storage, shared path helpers, and targeted tests.

^{Reviewed by Cursor Bugbot for commit 9bf124e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Select Linux secret storage backend before Electron app ready

• Reads a linuxPasswordStore setting (defaulting to 'auto') from desktop settings and resolves the appropriate Electron --password-store command-line switch before the app is ready.
• Adds heuristics in linuxSecretStorage.ts to select the correct backend based on the active desktop environment when set to 'auto'.
• Automatically detects and sets DBUS_SESSION_BUS_ADDRESS if unset and the default bus socket is found, and propagates additional session env vars (DISPLAY, XDG_CURRENT_DESKTOP, WAYLAND_DISPLAY, etc.) from the login shell on Linux.
• Exposes ElectronApp.removeCommandLineSwitch and ElectronSafeStorage.selectedStorageBackend (Linux only, returns Option.none on non-Linux or error) to support runtime switch management and backend introspection.
• Behavioral Change: Electron command-line switches (--class, --password-store) and protocol scheme privileges are now registered synchronously before app.ready instead of after.

^{Macroscope summarized 9bf124e. (Automatic summaries will resume when PR exits draft mode or review begins).}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: e4871060-c04a-4328-a4fa-8f7b229d33d9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces new Linux secret storage backend selection functionality, which touches security-sensitive credential storage handling. Additionally, there's an unresolved review comment identifying a potential issue with DBUS session bus address handling that could affect secret-store backends.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9bf124e. Configure here.}

[cursor]

Early DBUS blocks shell address

Medium Severity

During pre-ready Linux setup, a fallback DBUS_SESSION_BUS_ADDRESS is written when the default session socket exists. Later login-shell hydration only copies DBUS_SESSION_BUS_ADDRESS when it is unset, so an AppImage session that already got the fallback can never pick up a different address from the login shell, which can break secret-store backends that need the real session bus.

Additional Locations (1)

• apps/desktop/src/shell/DesktopShellEnvironment.ts#L362-L365

 

^{Reviewed by Cursor Bugbot for commit 9bf124e. Configure here.}