fix(desktop): Select Linux secret storage backend

Address Bugbot review: authoritative desktop hints and shell DBUS override

Author: mwolson

apps/desktop/src/app/DesktopApp.ts

@@ -9,6 +9,7 @@ import * as Crypto from "effect/Crypto";
 import * as ElectronApp from "../electron/ElectronApp.ts";
 import * as ElectronDialog from "../electron/ElectronDialog.ts";
 import * as ElectronProtocol from "../electron/ElectronProtocol.ts";
+import * as ElectronSafeStorage from "../electron/ElectronSafeStorage.ts";
 import { installDesktopIpcHandlers } from "../ipc/DesktopIpcHandlers.ts";
 import * as DesktopAppIdentity from "./DesktopAppIdentity.ts";
 import * as DesktopClerk from "./DesktopClerk.ts";
@@ -17,6 +18,7 @@ import * as DesktopBackendManager from "../backend/DesktopBackendManager.ts";
 import * as DesktopEnvironment from "./DesktopEnvironment.ts";
 import * as DesktopLifecycle from "./DesktopLifecycle.ts";
 import * as DesktopObservability from "./DesktopObservability.ts";
+import * as DesktopPreReadyPlatform from "./DesktopPreReadyPlatform.ts";
 import * as DesktopShutdown from "./DesktopShutdown.ts";
 import * as DesktopServerExposure from "../backend/DesktopServerExposure.ts";
 import * as DesktopAppSettings from "../settings/DesktopAppSettings.ts";
@@ -206,17 +208,45 @@ const startup = Effect.gen(function* () {
   const clerk = yield* DesktopClerk.DesktopClerk;
   const shellEnvironment = yield* DesktopShellEnvironment.DesktopShellEnvironment;
   const desktopSettings = yield* DesktopAppSettings.DesktopAppSettings;
+  const preReadyElectronOptions = yield* DesktopPreReadyPlatform.DesktopPreReadyElectronOptions;
+  const safeStorage = yield* ElectronSafeStorage.ElectronSafeStorage;
   const updates = yield* DesktopUpdates.DesktopUpdates;
   const environment = yield* DesktopEnvironment.DesktopEnvironment;
 
   yield* shellEnvironment.installIntoProcess;
+  const hasCommandLinePasswordStore =
+    preReadyElectronOptions.linuxPasswordStoreCommandLine !== null;
+  const linuxElectronOptions =
+    environment.platform === "linux" && !hasCommandLinePasswordStore
+      ? DesktopPreReadyPlatform.resolveEarlyLinuxElectronOptionsFromProcess()
+      : preReadyElectronOptions.linux;
+  if (linuxElectronOptions !== null && !hasCommandLinePasswordStore) {
+    if (
+      linuxElectronOptions.passwordStore !== null ||
+      preReadyElectronOptions.linux?.passwordStore !== null
+    ) {
+      yield* electronApp.removeCommandLineSwitch("password-store");
+    }
+    if (linuxElectronOptions.passwordStore !== null) {
+      yield* electronApp.appendCommandLineSwitch(
+        "password-store",
+        linuxElectronOptions.passwordStore,
+      );
+    }
+  }
   const userDataPath = yield* appIdentity.resolveUserDataPath;
   yield* electronApp.setPath("userData", userDataPath);
   yield* logStartupInfo("runtime logging configured", { logDir: environment.logDir });
   yield* desktopSettings.load;
 
-  if (environment.platform === "linux") {
-    yield* electronApp.appendCommandLineSwitch("class", environment.linuxWmClass);
+  if (linuxElectronOptions !== null) {
+    yield* logStartupInfo("linux password store configured", {
+      passwordStore: hasCommandLinePasswordStore
+        ? "command-line"
+        : (linuxElectronOptions.passwordStore ?? "electron-default"),
+      xdgCurrentDesktop: process.env.XDG_CURRENT_DESKTOP ?? null,
+      xdgSessionDesktop: process.env.XDG_SESSION_DESKTOP ?? null,
+    });
   }
 
   yield* appIdentity.configure;
@@ -228,6 +258,12 @@ const startup = Effect.gen(function* () {
     Effect.catchCause((cause) => fatalStartupCause("whenReady", cause)),
   );
   yield* logStartupInfo("app ready");
+  if (environment.platform === "linux") {
+    const selectedBackend = yield* safeStorage.selectedStorageBackend;
+    yield* logStartupInfo("safe storage ready", {
+      backend: Option.getOrElse(selectedBackend, () => "unknown"),
+    });
+  }
   yield* appIdentity.configure;
   yield* applicationMenu.configure;
   yield* updates.configure;

apps/desktop/src/app/DesktopAppIdentity.test.ts

@@ -63,6 +63,7 @@ const makeElectronAppLayer = (calls: ElectronAppCalls) =>
         calls.setDockIcon.push(iconPath);
       }),
     appendCommandLineSwitch: () => Effect.void,
+    removeCommandLineSwitch: () => Effect.void,
     on: () => Effect.void,
   } satisfies ElectronApp.ElectronApp["Service"]);
 

apps/desktop/src/app/DesktopConnectionCatalogStore.test.ts

@@ -39,6 +39,7 @@ function makeSafeStorageLayer(available: boolean, failDecrypt: Ref.Ref<boolean>
         return decoded.slice("encrypted:".length);
       });
     },
+    selectedStorageBackend: Effect.succeed(Option.none()),
   } satisfies ElectronSafeStorage.ElectronSafeStorage["Service"]);
 }
 

apps/desktop/src/app/DesktopEarlyElectronStartup.test.ts

@@ -0,0 +1,88 @@
+// @effect-diagnostics nodeBuiltinImport:off - tests use POSIX path joining to match the Linux startup boundary.
+import * as NodePath from "node:path";
+import { assert, describe, it } from "@effect/vitest";
+
+import {
+  resolveEarlyLinuxElectronOptions,
+  resolveEarlyLinuxPasswordStorePreference,
+} from "./DesktopEarlyElectronStartup.ts";
+
+describe("DesktopEarlyElectronStartup", () => {
+  const joinPath = NodePath.posix.join;
+
+  it("reads the persisted linux password-store preference before Electron is ready", () => {
+    const preference = resolveEarlyLinuxPasswordStorePreference({
+      env: { T3CODE_HOME: "/home/user/.t3-test" },
+      homeDirectory: "/home/user",
+      joinPath,
+      readFileString: (path) => {
+        assert.equal(path, "/home/user/.t3-test/userdata/desktop-settings.json");
+        return JSON.stringify({ linuxPasswordStore: "kwallet6" });
+      },
+    });
+
+    assert.equal(preference, "kwallet6");
+  });
+
+  it("accepts JSONC in the early desktop settings file", () => {
+    const preference = resolveEarlyLinuxPasswordStorePreference({
+      env: { T3CODE_HOME: "/home/user/.t3-test" },
+      homeDirectory: "/home/user",
+      joinPath,
+      readFileString: () => `{
+        // manually edited setting
+        "linuxPasswordStore": "gnome-libsecret",
+      }`,
+    });
+
+    assert.equal(preference, "gnome-libsecret");
+  });
+
+  it("falls back to auto when the early settings document is missing or invalid", () => {
+    const preference = resolveEarlyLinuxPasswordStorePreference({
+      env: {},
+      homeDirectory: "/home/user",
+      joinPath,
+      readFileString: () => {
+        throw new Error("missing");
+      },
+    });
+
+    assert.equal(preference, "auto");
+  });
+
+  it("preserves absolute root paths when resolving early settings", () => {
+    const preference = resolveEarlyLinuxPasswordStorePreference({
+      env: { T3CODE_HOME: "/" },
+      homeDirectory: "/home/user",
+      joinPath,
+      readFileString: (path) => {
+        assert.equal(path, "/userdata/desktop-settings.json");
+        return JSON.stringify({ linuxPasswordStore: "kwallet6" });
+      },
+    });
+
+    assert.equal(preference, "kwallet6");
+  });
+
+  it("resolves the early linux Electron switches", () => {
+    const options = resolveEarlyLinuxElectronOptions({
+      env: {
+        T3CODE_HOME: "/home/user/.t3-test",
+        XDG_CURRENT_DESKTOP: "niri",
+        VITE_DEV_SERVER_URL: "http://127.0.0.1:5173",
+      },
+      homeDirectory: "/home/user",
+      joinPath,
+      readFileString: (path) => {
+        assert.equal(path, "/home/user/.t3-test/dev/desktop-settings.json");
+        return JSON.stringify({ linuxPasswordStore: "auto" });
+      },
+    });
+
+    assert.deepEqual(options, {
+      linuxWmClass: "t3code-dev",
+      passwordStore: "gnome-libsecret",
+    });
+  });
+});

apps/desktop/src/app/DesktopEarlyElectronStartup.ts

@@ -0,0 +1,88 @@
+import { fromLenientJson } from "@t3tools/shared/schemaJson";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+
+import {
+  DEFAULT_LINUX_PASSWORD_STORE,
+  normalizeLinuxPasswordStorePreference,
+  resolveLinuxPasswordStoreSwitch,
+  type LinuxPasswordStoreSwitch,
+  type LinuxPasswordStorePreference,
+} from "../linuxSecretStorage.ts";
+import {
+  resolveDesktopBaseDir,
+  resolveDesktopStateDir,
+  type JoinPath,
+} from "./DesktopStatePaths.ts";
+
+interface EarlyDesktopSettingsInput {
+  readonly env: NodeJS.ProcessEnv;
+  readonly homeDirectory: string;
+  readonly joinPath: JoinPath;
+  readonly readFileString: (path: string) => string;
+}
+
+type EarlyLinuxElectronOptionsInput = EarlyDesktopSettingsInput;
+
+export interface EarlyLinuxElectronOptions {
+  readonly linuxWmClass: string;
+  readonly passwordStore: LinuxPasswordStoreSwitch | null;
+}
+
+const trimNonEmpty = (value: string | undefined): string | null => {
+  const trimmed = value?.trim();
+  return trimmed && trimmed.length > 0 ? trimmed : null;
+};
+
+const EarlyDesktopSettingsJson = fromLenientJson(
+  Schema.Struct({
+    linuxPasswordStore: Schema.optionalKey(Schema.Unknown),
+  }),
+);
+const decodeEarlyDesktopSettingsJson = Schema.decodeSync(EarlyDesktopSettingsJson);
+
+const isDevelopmentEnvironment = (env: NodeJS.ProcessEnv): boolean =>
+  trimNonEmpty(env.VITE_DEV_SERVER_URL) !== null;
+
+function resolveEarlyDesktopSettingsPath(input: {
+  readonly env: NodeJS.ProcessEnv;
+  readonly homeDirectory: string;
+  readonly joinPath: JoinPath;
+}): string {
+  const baseDir = resolveDesktopBaseDir({
+    homeDirectory: input.homeDirectory,
+    joinPath: input.joinPath,
+    t3Home: Option.fromUndefinedOr(input.env.T3CODE_HOME),
+  });
+  const stateDir = resolveDesktopStateDir({
+    baseDir,
+    isDevelopment: isDevelopmentEnvironment(input.env),
+    joinPath: input.joinPath,
+  });
+  return input.joinPath(stateDir, "desktop-settings.json");
+}
+
+export function resolveEarlyLinuxPasswordStorePreference(
+  input: EarlyDesktopSettingsInput,
+): LinuxPasswordStorePreference {
+  const settingsPath = resolveEarlyDesktopSettingsPath(input);
+  try {
+    const parsed = decodeEarlyDesktopSettingsJson(input.readFileString(settingsPath));
+    return normalizeLinuxPasswordStorePreference(parsed.linuxPasswordStore);
+  } catch {
+    return DEFAULT_LINUX_PASSWORD_STORE;
+  }
+}
+
+export function resolveEarlyLinuxElectronOptions(
+  input: EarlyLinuxElectronOptionsInput,
+): EarlyLinuxElectronOptions {
+  const preference = resolveEarlyLinuxPasswordStorePreference(input);
+  return {
+    linuxWmClass: isDevelopmentEnvironment(input.env) ? "t3code-dev" : "t3code",
+    passwordStore: resolveLinuxPasswordStoreSwitch({
+      preference,
+      env: input.env,
+    }),
+  };
+}

apps/desktop/src/app/DesktopPreReadyPlatform.test.ts

@@ -0,0 +1,86 @@
+import { assert, describe, it } from "@effect/vitest";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+
+import {
+  DesktopPreReadyElectronOptions,
+  makeDesktopElectronPreReadyLayer,
+  readCommandLineSwitchValue,
+} from "./DesktopPreReadyPlatform.ts";
+
+describe("DesktopPreReadyPlatform", () => {
+  it("reads an explicit Electron command-line switch value", () => {
+    const value = readCommandLineSwitchValue(
+      {
+        hasSwitch: (switchName) => switchName === "password-store",
+        getSwitchValue: (switchName) => {
+          assert.equal(switchName, "password-store");
+          return "basic";
+        },
+      },
+      "password-store",
+    );
+
+    assert.equal(value, "basic");
+  });
+
+  it("treats valueless Electron command-line switches as absent", () => {
+    const value = readCommandLineSwitchValue(
+      {
+        hasSwitch: () => true,
+        getSwitchValue: () => "",
+      },
+      "password-store",
+    );
+
+    assert.isNull(value);
+  });
+
+  it("returns null for missing Electron command-line switches", () => {
+    const value = readCommandLineSwitchValue(
+      {
+        hasSwitch: () => false,
+        getSwitchValue: () => {
+          throw new Error("Unexpected switch value read.");
+        },
+      },
+      "password-store",
+    );
+
+    assert.isNull(value);
+  });
+
+  it.effect("builds scheme privileges and command-line setup as sibling pre-ready effects", () =>
+    Effect.gen(function* () {
+      const schemeStarted = yield* Deferred.make<void>();
+      const configureStarted = yield* Deferred.make<void>();
+
+      const layer = makeDesktopElectronPreReadyLayer({
+        schemePrivilegesLayer: Layer.effectDiscard(
+          Deferred.succeed(schemeStarted, undefined).pipe(
+            Effect.andThen(Deferred.await(configureStarted)),
+          ),
+        ),
+        configureElectronBeforeReady: Deferred.succeed(configureStarted, undefined).pipe(
+          Effect.andThen(Deferred.await(schemeStarted)),
+          Effect.as({
+            linux: null,
+            linuxPasswordStoreCommandLine: null,
+          }),
+        ),
+      });
+
+      const options = yield* DesktopPreReadyElectronOptions.pipe(
+        Effect.provide(layer),
+        Effect.timeoutOption("50 millis"),
+      );
+
+      assert.deepEqual(Option.getOrNull(options), {
+        linux: null,
+        linuxPasswordStoreCommandLine: null,
+      });
+    }),
+  );
+});