fix(desktop): treat an undecryptable connection catalog as empty instead of crashing environment discovery

[bwmp]

This doesnt need to be merged but implementing your own fix to this would be appreciated since this issue caused my entire t3 code to be unusable no matter what

What Changed

DesktopConnectionCatalogStore.get() now treats an undecryptable or corrupt connection-catalog.json as an empty catalog (logs a warning, returns Option.none()) instead of propagating the failure. The file is left on disk untouched, so if the underlying issue resolves, a later read can still recover the original data.

Why

EnvironmentRegistry.make reads this store synchronously during its own construction. A decrypt failure — e.g. a stale OS-level encryption key after a Windows credential/profile change — previously threw all the way up through that construction, silently breaking the entire connection/environment registry with no console-visible error. This took down the local primary environment too, even though it doesn't depend on this file at all, and looked to the user like "the app just doesn't load projects" with nothing indicating why.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

---

Note

Medium Risk
Changes startup behavior for encrypted catalog I/O—failures are swallowed instead of surfacing errors—which is intentional for resilience but could briefly hide corrupt catalogs until logs are checked.

Overview
DesktopConnectionCatalogStore.get no longer fails when connection-catalog.json cannot be decoded or decrypted. Those cases now log a warning, return Option.none() (empty catalog), and leave the file on disk so data can be recovered once decryption works again.

This avoids a hard failure during environment registry construction that could make the desktop app look like it cannot load projects—including the local primary environment—even when that catalog file is not required.

Tests were updated to expect graceful degradation (including recovery after decrypt succeeds again). A separate fork-only scheduled workflow merges upstream into main for bwmp/t3code.

^{Reviewed by Cursor Bugbot for commit 8a3eb0d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Treat undecryptable connection catalog as empty instead of crashing environment discovery

Previously, DesktopConnectionCatalogStore.get propagated failures when the encrypted catalog was malformed or could no longer be decrypted, crashing environment discovery. It now catches those errors, logs a warning with the catalog path and cause, and returns Option.none while leaving the file on disk intact. This means a recoverable catalog (e.g. after re-authentication) can still be read later.

^{Macroscope summarized 8a3eb0d.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bf6946bc-599b-4342-9405-e40212ce1b49

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Recoverable catalog can be overwritten

High Severity

The get method now returns Option.none() for both missing and undecryptable catalogs, making them indistinguishable. This ambiguity causes subsequent set operations, such as automatic credential persistence, to overwrite the existing encrypted catalog, destroying data intended for recovery.

 

^{Reviewed by Cursor Bugbot for commit e482464. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

A high-severity unresolved review comment identifies potential data loss: returning Option.none() for undecryptable catalogs (same as missing) could cause subsequent writes to overwrite recoverable encrypted data. This behavioral change and the flagged bug warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 8a3eb0d. Configure here.}

[cursor]

Sync fails on workflow changes

Medium Severity

merge-upstream is authenticated with github.token, which cannot create or update files under .github/workflows/. Whenever upstream changes any workflow, the sync fails with a missing workflow scope error. That permission cannot be granted via the permissions key; a PAT (or GitHub App token) with workflow access is required.

Additional Locations (1)

• .github/workflows/sync-upstream.yml#L8-L10

 

^{Reviewed by Cursor Bugbot for commit 8a3eb0d. Configure here.}