fix(web): Remove saved environments atomically

[mwolson]

Summary

Closes #2914.

This makes saved-environment removal use a single persistence operation that removes metadata and embedded credentials together, and tightens rollback behavior when replacing stale desktop SSH records.

Problem and Fix

Problem and Why it Happened	Fix
Removing a saved environment updated persisted metadata and bearer-token state separately, so SSH cleanup could race with deletion and stale records could reappear.	Add removeSavedEnvironment to the local persistence API and desktop IPC bridge so metadata and embedded secrets are removed atomically.
The UI cleared saved-environment state before durable removal finished.	Persist removal first, then clear registry/runtime/UI state, while still awaiting SSH cleanup before returning.
Browser fallback persistence did not have an equivalent atomic saved-environment removal path.	Add browser-storage removal alongside the desktop bridge implementation.
Replacing a stale desktop SSH record only snapshotted the new environment id.	Snapshot both the new id and stale SSH record so rollback can restore the previous saved record if credential persistence fails.

Defensive Fixes

Problem and Why it Happened	Fix
Rollback errors could hide the original credential persistence error.	Preserve and rethrow the primary credential persistence failure after best-effort rollback.
SSH cleanup errors during removal could block state cleanup in the wrong order.	Remove persisted saved-environment state first, then await SSH cleanup and log cleanup failures without restoring stale persistence.

Validation

• bun fmt
• bun lint
• bun typecheck
• bun run --filter @t3tools/desktop test -- DesktopSavedEnvironments
• bun run --filter @t3tools/web test -- localApi catalog service.addSavedEnvironment service.savedEnvironments

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes: N/A, persistence behavior only
• I included a video for animation/interaction changes: N/A

---

Note

Medium Risk
Changes saved-environment credential persistence, deletion ordering, and SSH cleanup timing; mistakes could leave stale credentials or inconsistent UI state, though behavior is covered by expanded tests.

Overview
Adds removeSavedEnvironment end-to-end (contracts, desktop IPC/preload, DesktopSavedEnvironments.removeEnvironment, browser removeBrowserSavedEnvironment, LocalApi.persistence) so deleting a saved environment drops registry metadata and its embedded bearer secret in one persisted write instead of separate registry/secret updates.

removeSavedEnvironment in the web runtime is reordered: detach connections, call removePersistedSavedEnvironment, then clear registry/runtime/UI state; desktop SSH disconnectSshEnvironment runs afterward (failures are logged, not rolled back). Full removal no longer calls removeSavedEnvironmentBearerToken separately.

Add/replace flows gain persistSavedEnvironmentBearerTokenOrRollback and registry snapshots that include both new and stale SSH ids when replacing a desktop SSH target; stale cleanup uses removeStaleSavedEnvironmentRecord (atomic persist remove) with rollback that keeps the original error if rollback itself fails.

^{Reviewed by Cursor Bugbot for commit cfc3112. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Remove saved environments atomically with rollback support

• Adds removeEnvironment to DesktopSavedEnvironments and a removeSavedEnvironment IPC channel so the main process can delete a saved environment's metadata and secrets together.
• Adds removePersistedSavedEnvironment to the LocalApi persistence contract, routing to the desktop bridge or browser local storage via removeBrowserSavedEnvironment.
• Refactors removeSavedEnvironment in service.ts to remove the persisted record first and defer SSH cleanup, swallowing cleanup errors instead of blocking completion.
• Strengthens addSavedEnvironment rollback: stale SSH records are removed via removeStaleSavedEnvironmentRecord, bearer token persistence uses persistSavedEnvironmentBearerTokenOrRollback, and registry state is updated atomically with setState.
• Behavioral Change: removeSavedEnvironment no longer calls removeSavedEnvironmentBearerToken; SSH cleanup failures are warned and swallowed rather than surfaced.

^{Macroscope summarized c3497b0.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3db501bd-1469-41de-96f3-bd2539dae16a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR introduces new IPC methods and persistence capabilities for atomic environment removal, with significant refactoring of error handling logic. An open review comment identifies a bug in error preservation. These changes warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 933a157

Dismissing prior approval to re-evaluate 61426fd

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 177b89b. Configure here.}