fix(desktop): treat an undecryptable connection catalog as empty instead of crashing environment discovery

[bwmp]

This doesnt need to be merged but implementing your own fix to this would be appreciated since this issue caused my entire t3 code to be unusable no matter what

What Changed

DesktopConnectionCatalogStore.get() now treats an undecryptable or corrupt connection-catalog.json as an empty catalog (logs a warning, returns Option.none()) instead of propagating the failure. The file is left on disk untouched, so if the underlying issue resolves, a later read can still recover the original data.

Why

EnvironmentRegistry.make reads this store synchronously during its own construction. A decrypt failure — e.g. a stale OS-level encryption key after a Windows credential/profile change — previously threw all the way up through that construction, silently breaking the entire connection/environment registry with no console-visible error. This took down the local primary environment too, even though it doesn't depend on this file at all, and looked to the user like "the app just doesn't load projects" with nothing indicating why.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

---

Note

Low Risk
Localized read-path behavior change with logging; malformed outer documents and filesystem errors still fail as before.

Overview
DesktopConnectionCatalogStore.get() no longer fails when connection-catalog.json exists but its encrypted payload cannot be decoded or decrypted (corrupt data, stale OS key after a Windows credential/profile change, etc.). Those cases now log a warning and return Option.none() as if the catalog were empty.

The file is left on disk so data can be recovered once decryption works again. This avoids breaking EnvironmentRegistry construction and local environment discovery when remote-connection catalog data is unreadable but the local primary environment does not depend on that file.

Tests were updated to expect empty-catalog behavior and to assert recovery after decrypt succeeds again.

^{Reviewed by Cursor Bugbot for commit e482464. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix DesktopConnectionCatalogStore.get to return empty catalog on decryption failure instead of crashing

Previously, decryption or decode failures in DesktopConnectionCatalogStore.get propagated errors that crashed environment discovery. Now, any failure returns Option.none and logs a warning, leaving the catalog file on disk intact. If decryption is later restored (e.g. after a keychain fix), the catalog is recoverable.

^{Macroscope summarized e482464.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 65c597b4-53ef-47a6-b293-60b0beaded7d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit e482464. Configure here.}

[cursor]

Recoverable catalog can be overwritten

High Severity

The get method now returns Option.none() for both missing and undecryptable catalogs, making them indistinguishable. This ambiguity causes subsequent set operations, such as automatic credential persistence, to overwrite the existing encrypted catalog, destroying data intended for recovery.

 

^{Reviewed by Cursor Bugbot for commit e482464. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

An unresolved high-severity review comment identifies potential data loss: undecryptable catalogs returning Option.none() could be overwritten by subsequent set operations, destroying recoverable data. This concern requires human evaluation.

^{You can customize Macroscope's approvability policy. Learn more.}