fix(desktop): Niri/Hyprland - Linux secret storage backend

apps/desktop/src/app/DesktopApp.ts

@@ -9,6 +9,7 @@ import * as Crypto from "effect/Crypto";
 import * as ElectronApp from "../electron/ElectronApp.ts";
 import * as ElectronDialog from "../electron/ElectronDialog.ts";
 import * as ElectronProtocol from "../electron/ElectronProtocol.ts";
+import * as ElectronSafeStorage from "../electron/ElectronSafeStorage.ts";
 import { installDesktopIpcHandlers } from "../ipc/DesktopIpcHandlers.ts";
 import * as DesktopAppIdentity from "./DesktopAppIdentity.ts";
 import * as DesktopClerk from "./DesktopClerk.ts";
@@ -18,6 +19,7 @@ import * as DesktopBackendPool from "../backend/DesktopBackendPool.ts";
 import * as DesktopEnvironment from "./DesktopEnvironment.ts";
 import * as DesktopLifecycle from "./DesktopLifecycle.ts";
 import * as DesktopObservability from "./DesktopObservability.ts";
+import * as DesktopPreReadyPlatform from "./DesktopPreReadyPlatform.ts";
 import * as DesktopShutdown from "./DesktopShutdown.ts";
 import * as DesktopServerExposure from "../backend/DesktopServerExposure.ts";
 import * as DesktopAppSettings from "../settings/DesktopAppSettings.ts";
@@ -223,17 +225,45 @@ const startup = Effect.gen(function* () {
   const clerk = yield* DesktopClerk.DesktopClerk;
   const shellEnvironment = yield* DesktopShellEnvironment.DesktopShellEnvironment;
   const desktopSettings = yield* DesktopAppSettings.DesktopAppSettings;
+  const preReadyElectronOptions = yield* DesktopPreReadyPlatform.DesktopPreReadyElectronOptions;
+  const safeStorage = yield* ElectronSafeStorage.ElectronSafeStorage;
   const updates = yield* DesktopUpdates.DesktopUpdates;
   const environment = yield* DesktopEnvironment.DesktopEnvironment;
 
   yield* shellEnvironment.installIntoProcess;
+  const hasCommandLinePasswordStore =
+    preReadyElectronOptions.linuxPasswordStoreCommandLine !== null;
+  const linuxElectronOptions =
+    environment.platform === "linux" && !hasCommandLinePasswordStore
+      ? DesktopPreReadyPlatform.resolveEarlyLinuxElectronOptionsFromProcess()
+      : preReadyElectronOptions.linux;
+  if (linuxElectronOptions !== null && !hasCommandLinePasswordStore) {
+    if (
+      linuxElectronOptions.passwordStore !== null ||
+      preReadyElectronOptions.linux?.passwordStore !== null
+    ) {
+      yield* electronApp.removeCommandLineSwitch("password-store");
+    }
+    if (linuxElectronOptions.passwordStore !== null) {
+      yield* electronApp.appendCommandLineSwitch(
+        "password-store",
+        linuxElectronOptions.passwordStore,
+      );
+    }
+  }
   const userDataPath = yield* appIdentity.resolveUserDataPath;
   yield* electronApp.setPath("userData", userDataPath);
   yield* logStartupInfo("runtime logging configured", { logDir: environment.logDir });
   yield* desktopSettings.load;
 
-  if (environment.platform === "linux") {
-    yield* electronApp.appendCommandLineSwitch("class", environment.linuxWmClass);
+  if (linuxElectronOptions !== null) {
+    yield* logStartupInfo("linux password store configured", {
+      passwordStore: hasCommandLinePasswordStore
+        ? "command-line"
+        : (linuxElectronOptions.passwordStore ?? "electron-default"),
+      xdgCurrentDesktop: process.env.XDG_CURRENT_DESKTOP ?? null,
+      xdgSessionDesktop: process.env.XDG_SESSION_DESKTOP ?? null,
+    });
   }
 
   yield* appIdentity.configure;
@@ -245,6 +275,12 @@ const startup = Effect.gen(function* () {
     Effect.catchCause((cause) => fatalStartupCause("whenReady", cause)),
   );
   yield* logStartupInfo("app ready");
+  if (environment.platform === "linux") {
+    const selectedBackend = yield* safeStorage.selectedStorageBackend;
+    yield* logStartupInfo("safe storage ready", {
+      backend: Option.getOrElse(selectedBackend, () => "unknown"),
+    });
+  }
   yield* appIdentity.configure;
   yield* applicationMenu.configure;
   yield* updates.configure;

apps/desktop/src/app/DesktopAppIdentity.test.ts

@@ -64,6 +64,7 @@ const makeElectronAppLayer = (calls: ElectronAppCalls) =>
       }),
     appendCommandLineSwitch: () => Effect.void,
     onBeforeQuitForUpdate: () => Effect.void,
+    removeCommandLineSwitch: () => Effect.void,
     on: () => Effect.void,
   } satisfies ElectronApp.ElectronApp["Service"]);
 

apps/desktop/src/app/DesktopConnectionCatalogStore.test.ts

@@ -39,6 +39,7 @@ function makeSafeStorageLayer(available: boolean, failDecrypt: Ref.Ref<boolean>
         return decoded.slice("encrypted:".length);
       });
     },
+    selectedStorageBackend: Effect.succeed(Option.none()),
   } satisfies ElectronSafeStorage.ElectronSafeStorage["Service"]);
 }
 

apps/desktop/src/app/DesktopEarlyElectronStartup.test.ts

@@ -0,0 +1,121 @@
+// @effect-diagnostics nodeBuiltinImport:off - tests use POSIX path joining to match the Linux startup boundary.
+import * as NodePath from "node:path";
+import { assert, describe, it } from "@effect/vitest";
+
+import {
+  resolveEarlyLinuxElectronOptions,
+  resolveEarlyLinuxPasswordStorePreference,
+} from "./DesktopEarlyElectronStartup.ts";
+
+describe("DesktopEarlyElectronStartup", () => {
+  const joinPath = NodePath.posix.join;
+
+  it("reads the persisted linux password-store preference before Electron is ready", () => {
+    const preference = resolveEarlyLinuxPasswordStorePreference({
+      env: { T3CODE_HOME: "/home/user/.t3-test" },
+      homeDirectory: "/home/user",
+      joinPath,
+      readFileString: (path) => {
+        assert.equal(path, "/home/user/.t3-test/userdata/desktop-settings.json");
+        return JSON.stringify({ linuxPasswordStore: "kwallet6" });
+      },
+    });
+
+    assert.equal(preference, "kwallet6");
+  });
+
+  it("accepts JSONC in the early desktop settings file", () => {
+    const preference = resolveEarlyLinuxPasswordStorePreference({
+      env: { T3CODE_HOME: "/home/user/.t3-test" },
+      homeDirectory: "/home/user",
+      joinPath,
+      readFileString: () => `{
+        // manually edited setting
+        "linuxPasswordStore": "gnome-libsecret",
+      }`,
+    });
+
+    assert.equal(preference, "gnome-libsecret");
+  });
+
+  it("falls back to auto when the early settings document is missing or invalid", () => {
+    const preference = resolveEarlyLinuxPasswordStorePreference({
+      env: {},
+      homeDirectory: "/home/user",
+      joinPath,
+      readFileString: () => {
+        throw new Error("missing");
+      },
+    });
+
+    assert.equal(preference, "auto");
+  });
+
+  it("preserves absolute root paths when resolving early settings", () => {
+    const preference = resolveEarlyLinuxPasswordStorePreference({
+      env: { T3CODE_HOME: "/" },
+      homeDirectory: "/home/user",
+      joinPath,
+      readFileString: (path) => {
+        assert.equal(path, "/userdata/desktop-settings.json");
+        return JSON.stringify({ linuxPasswordStore: "kwallet6" });
+      },
+    });
+
+    assert.equal(preference, "kwallet6");
+  });
+
+  it("resolves the early linux Electron switches", () => {
+    const options = resolveEarlyLinuxElectronOptions({
+      env: {
+        T3CODE_HOME: "/home/user/.t3-test",
+        XDG_CURRENT_DESKTOP: "niri",
+        VITE_DEV_SERVER_URL: "http://127.0.0.1:5173",
+      },
+      homeDirectory: "/home/user",
+      joinPath,
+      readFileString: (path) => {
+        assert.equal(path, "/home/user/.t3-test/userdata/desktop-settings.json");
+        return JSON.stringify({ linuxPasswordStore: "auto" });
+      },
+    });
+
+    assert.deepEqual(options, {
+      linuxWmClass: "t3code-dev",
+      passwordStore: "gnome-libsecret",
+    });
+  });
+
+  it("keeps implicit development state under ~/.t3/dev when T3CODE_HOME is unset", () => {
+    const preference = resolveEarlyLinuxPasswordStorePreference({
+      env: {
+        VITE_DEV_SERVER_URL: "http://127.0.0.1:5173",
+      },
+      homeDirectory: "/home/user",
+      joinPath,
+      readFileString: (path) => {
+        assert.equal(path, "/home/user/.t3/dev/desktop-settings.json");
+        return JSON.stringify({ linuxPasswordStore: "kwallet" });
+      },
+    });
+
+    assert.equal(preference, "kwallet");
+  });
+
+  it("treats whitespace-only T3CODE_HOME as unconfigured in development", () => {
+    const preference = resolveEarlyLinuxPasswordStorePreference({
+      env: {
+        T3CODE_HOME: "   ",
+        VITE_DEV_SERVER_URL: "http://127.0.0.1:5173",
+      },
+      homeDirectory: "/home/user",
+      joinPath,
+      readFileString: (path) => {
+        assert.equal(path, "/home/user/.t3/dev/desktop-settings.json");
+        return JSON.stringify({ linuxPasswordStore: "gnome-libsecret" });
+      },
+    });
+
+    assert.equal(preference, "gnome-libsecret");
+  });
+});

apps/desktop/src/app/DesktopEarlyElectronStartup.ts

@@ -0,0 +1,90 @@
+import { fromLenientJson } from "@t3tools/shared/schemaJson";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+
+import {
+  DEFAULT_LINUX_PASSWORD_STORE,
+  normalizeLinuxPasswordStorePreference,
+  resolveLinuxPasswordStoreSwitch,
+  type LinuxPasswordStoreSwitch,
+  type LinuxPasswordStorePreference,
+} from "../linuxSecretStorage.ts";
+import {
+  resolveDesktopBaseDir,
+  resolveDesktopStateDir,
+  type JoinPath,
+} from "./DesktopStatePaths.ts";
+
+interface EarlyDesktopSettingsInput {
+  readonly env: NodeJS.ProcessEnv;
+  readonly homeDirectory: string;
+  readonly joinPath: JoinPath;
+  readonly readFileString: (path: string) => string;
+}
+
+type EarlyLinuxElectronOptionsInput = EarlyDesktopSettingsInput;
+
+export interface EarlyLinuxElectronOptions {
+  readonly linuxWmClass: string;
+  readonly passwordStore: LinuxPasswordStoreSwitch | null;
+}
+
+const trimNonEmpty = (value: string | undefined): string | null => {
+  const trimmed = value?.trim();
+  return trimmed && trimmed.length > 0 ? trimmed : null;
+};
+
+const EarlyDesktopSettingsJson = fromLenientJson(
+  Schema.Struct({
+    linuxPasswordStore: Schema.optionalKey(Schema.Unknown),
+  }),
+);
+const decodeEarlyDesktopSettingsJson = Schema.decodeSync(EarlyDesktopSettingsJson);
+
+const isDevelopmentEnvironment = (env: NodeJS.ProcessEnv): boolean =>
+  trimNonEmpty(env.VITE_DEV_SERVER_URL) !== null;
+
+function resolveEarlyDesktopSettingsPath(input: {
+  readonly env: NodeJS.ProcessEnv;
+  readonly homeDirectory: string;
+  readonly joinPath: JoinPath;
+}): string {
+  const t3Home = Option.fromUndefinedOr(input.env.T3CODE_HOME);
+  const baseDir = resolveDesktopBaseDir({
+    homeDirectory: input.homeDirectory,
+    joinPath: input.joinPath,
+    t3Home,
+  });
+  const stateDir = resolveDesktopStateDir({
+    baseDir,
+    isDevelopment: isDevelopmentEnvironment(input.env),
+    joinPath: input.joinPath,
+    t3Home,
+  });
+  return input.joinPath(stateDir, "desktop-settings.json");
+}
+
+export function resolveEarlyLinuxPasswordStorePreference(
+  input: EarlyDesktopSettingsInput,
+): LinuxPasswordStorePreference {
+  const settingsPath = resolveEarlyDesktopSettingsPath(input);
+  try {
+    const parsed = decodeEarlyDesktopSettingsJson(input.readFileString(settingsPath));
+    return normalizeLinuxPasswordStorePreference(parsed.linuxPasswordStore);
+  } catch {
+    return DEFAULT_LINUX_PASSWORD_STORE;
+  }
+}
+
+export function resolveEarlyLinuxElectronOptions(
+  input: EarlyLinuxElectronOptionsInput,
+): EarlyLinuxElectronOptions {
+  const preference = resolveEarlyLinuxPasswordStorePreference(input);
+  return {
+    linuxWmClass: isDevelopmentEnvironment(input.env) ? "t3code-dev" : "t3code",
+    passwordStore: resolveLinuxPasswordStoreSwitch({
+      preference,
+      env: input.env,
+    }),
+  };
+}

apps/desktop/src/app/DesktopEnvironment.ts

@@ -13,6 +13,7 @@ import * as Path from "effect/Path";
 
 import * as DesktopAppSettings from "../settings/DesktopAppSettings.ts";
 import * as DesktopConfig from "./DesktopConfig.ts";
+import { resolveDesktopBaseDir, resolveDesktopStateDir } from "./DesktopStatePaths.ts";
 import { isNightlyDesktopVersion } from "../updates/updateChannels.ts";
 
 export interface MakeDesktopEnvironmentInput {
@@ -147,19 +148,24 @@ const make = Effect.fn("desktop.environment.make")(function* (
       : input.platform === "darwin"
         ? path.join(homeDirectory, "Library", "Application Support")
         : Option.getOrElse(config.xdgConfigHome, () => path.join(homeDirectory, ".config"));
-  const configuredBaseDir = config.t3Home;
-  const baseDir = Option.getOrElse(configuredBaseDir, () => path.join(homeDirectory, ".t3"));
+  const baseDir = resolveDesktopBaseDir({
+    homeDirectory,
+    joinPath: path.join,
+    t3Home: config.t3Home,
+  });
   const rootDir = path.resolve(input.dirname, "../../..");
   const appRoot = input.isPackaged ? input.appPath : rootDir;
   const branding = resolveDesktopAppBranding({
     isDevelopment,
     appVersion: input.appVersion,
   });
   const displayName = branding.displayName;
-  const stateDir = path.join(
+  const stateDir = resolveDesktopStateDir({
     baseDir,
-    isDevelopment && Option.isNone(configuredBaseDir) ? "dev" : "userdata",
-  );
+    isDevelopment,
+    joinPath: path.join,
+    t3Home: config.t3Home,
+  });
   const userDataDirName = isDevelopment ? "t3code-dev" : "t3code";
   const legacyUserDataDirName = isDevelopment ? "T3 Code (Dev)" : "T3 Code (Alpha)";
   const resourcesPath = input.resourcesPath;

apps/desktop/src/app/DesktopLifecycle.test.ts

@@ -35,6 +35,7 @@ describe("DesktopLifecycle", () => {
         setDesktopName: () => Effect.void,
         setDockIcon: () => Effect.void,
         appendCommandLineSwitch: () => Effect.void,
+        removeCommandLineSwitch: () => Effect.void,
         onBeforeQuitForUpdate: (listener) =>
           Effect.acquireRelease(
             Effect.sync(() => {