fix(web): Remove saved environments atomically

[mwolson]

Summary

Closes#2914.

This makes saved-environment removal use a single persistence operation that removes metadata and embedded credentials together, and tightens rollback behavior when replacing stale desktop SSH records.

Problem and Fix

Problem and Why it Happened	Fix
Removing a saved environment updated persisted metadata and bearer-token state separately, so SSH cleanup could race with deletion and stale records could reappear.	Add removeSavedEnvironment to the local persistence API and desktop IPC bridge so metadata and embedded secrets are removed atomically.
The UI cleared saved-environment state before durable removal finished.	Persist removal first, then clear registry/runtime/UI state, while still awaiting SSH cleanup before returning.
Browser fallback persistence did not have an equivalent atomic saved-environment removal path.	Add browser-storage removal alongside the desktop bridge implementation.
Replacing a stale desktop SSH record only snapshotted the new environment id.	Snapshot both the new id and stale SSH record so rollback can restore the previous saved record if credential persistence fails.

Defensive Fixes

Problem and Why it Happened	Fix
Rollback errors could hide the original credential persistence error.	Preserve and rethrow the primary credential persistence failure after best-effort rollback.
SSH cleanup errors during removal could block state cleanup in the wrong order.	Remove persisted saved-environment state first, then await SSH cleanup and log cleanup failures without restoring stale persistence.

Validation

• bun fmt
• bun lint
• bun typecheck
• bun run --filter @t3tools/desktop test -- DesktopSavedEnvironments
• bun run --filter @t3tools/web test -- localApi catalog service.addSavedEnvironment service.savedEnvironments

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes: N/A, persistence behavior only
• I included a video for animation/interaction changes: N/A

---

Note

Medium Risk
Changes on-disk saved-environment and credential persistence, but the scope is narrow and covered by a new atomic-removal test.

Overview
Adds removeEnvironment(environmentId) to desktop saved-environment persistence so registry metadata and the embedded encryptedBearerToken are dropped in one registry write, instead of relying on separate metadata vs secret updates.

The file-backed implementation filters the matching record out of the persisted document (no-op if missing). The in-memory test layer clears both the records ref and secrets ref together. A new test asserts the registry is empty and getSecret is none after removal.

^{Reviewed by Cursor Bugbot for commit 01dee9c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add removeEnvironment to DesktopSavedEnvironments to delete registry records and secrets atomically

• Adds removeEnvironment(environmentId) to DesktopSavedEnvironmentsShape, which removes the matching record from the registry document and its embedded encryptedBearerToken in a single write.
• The production layer reads the current registry, filters out the matching record, and writes the updated document preserving the version field.
• The test layer removes the record from recordsRef and the secret from secretsRef together, with a new test asserting both are cleared after calling removeEnvironment.

📊 Macroscope summarized da654c7. 1 file reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ac600f50-14f0-4e9b-a0b2-2173b5f12614

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR adds new functionality and has an unresolved review comment identifying an error type mismatch where removeEnvironment can throw errors not declared in its interface signature.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 933a157

Dismissing prior approval to re-evaluate 61426fd

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a980c750b2c825b09cebfe83fb3839b602d34574. Configure here.}

[mwolson]

@macroscope-app review

[macroscopeapp]

Sorry, I'm unable to act on this request because you do not have permissions within this repository.

[mwolson]

Summary

Closes#2914.

This makes saved-environment removal use a single persistence operation that removes metadata and embedded credentials together, and tightens rollback behavior when replacing stale desktop SSH records.

Problem and Fix

Problem and Why it Happened	Fix
Removing a saved environment updated persisted metadata and bearer-token state separately, so SSH cleanup could race with deletion and stale records could reappear.	Add removeSavedEnvironment to the local persistence API and desktop IPC bridge so metadata and embedded secrets are removed atomically.
The UI cleared saved-environment state before durable removal finished.	Persist removal first, then clear registry/runtime/UI state, while still awaiting SSH cleanup before returning.
Browser fallback persistence did not have an equivalent atomic saved-environment removal path.	Add browser-storage removal alongside the desktop bridge implementation.
Replacing a stale desktop SSH record only snapshotted the new environment id.	Snapshot both the new id and stale SSH record so rollback can restore the previous saved record if credential persistence fails.

Defensive Fixes

Problem and Why it Happened	Fix
Rollback errors could hide the original credential persistence error.	Preserve and rethrow the primary credential persistence failure after best-effort rollback.
SSH cleanup errors during removal could block state cleanup in the wrong order.	Remove persisted saved-environment state first, then await SSH cleanup and log cleanup failures without restoring stale persistence.

Validation

• bun fmt
• bun lint
• bun typecheck
• bun run --filter @t3tools/desktop test -- DesktopSavedEnvironments
• bun run --filter @t3tools/web test -- localApi catalog service.addSavedEnvironment service.savedEnvironments

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes: N/A, persistence behavior only
• I included a video for animation/interaction changes: N/A

---

Note

Medium Risk
Changes on-disk saved-environment and credential persistence, but the scope is narrow and covered by a new atomic-removal test.

Overview
Adds removeEnvironment(environmentId) to desktop saved-environment persistence so registry metadata and the embedded encryptedBearerToken are dropped in one registry write, instead of relying on separate metadata vs secret updates.

The file-backed implementation filters the matching record out of the persisted document (no-op if missing). The in-memory test layer clears both the records ref and secrets ref together. A new test asserts the registry is empty and getSecret is none after removal.

^{Reviewed by Cursor Bugbot for commit 01dee9c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add removeEnvironment to DesktopSavedEnvironments to delete registry records and secrets atomically

• Adds removeEnvironment(environmentId) to DesktopSavedEnvironmentsShape, which removes the matching record from the registry document and its embedded encryptedBearerToken in a single write.
• The production layer reads the current registry, filters out the matching record, and writes the updated document preserving the version field.
• The test layer removes the record from recordsRef and the secret from secretsRef together, with a new test asserting both are cleared after calling removeEnvironment.

📊 Macroscope summarized da654c7. 1 file reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ac600f50-14f0-4e9b-a0b2-2173b5f12614

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR adds new functionality and has an unresolved review comment identifying an error type mismatch where removeEnvironment can throw errors not declared in its interface signature.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 933a157

Dismissing prior approval to re-evaluate 61426fd

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a980c750b2c825b09cebfe83fb3839b602d34574. Configure here.}

[mwolson]

@macroscope-app review

[macroscopeapp]

Sorry, I'm unable to act on this request because you do not have permissions within this repository.

[mwolson]

Summary

Closes#2914.

This makes saved-environment removal use a single persistence operation that removes metadata and embedded credentials together, and tightens rollback behavior when replacing stale desktop SSH records.

Problem and Fix

Problem and Why it Happened	Fix
Removing a saved environment updated persisted metadata and bearer-token state separately, so SSH cleanup could race with deletion and stale records could reappear.	Add removeSavedEnvironment to the local persistence API and desktop IPC bridge so metadata and embedded secrets are removed atomically.
The UI cleared saved-environment state before durable removal finished.	Persist removal first, then clear registry/runtime/UI state, while still awaiting SSH cleanup before returning.
Browser fallback persistence did not have an equivalent atomic saved-environment removal path.	Add browser-storage removal alongside the desktop bridge implementation.
Replacing a stale desktop SSH record only snapshotted the new environment id.	Snapshot both the new id and stale SSH record so rollback can restore the previous saved record if credential persistence fails.

Defensive Fixes

Problem and Why it Happened	Fix
Rollback errors could hide the original credential persistence error.	Preserve and rethrow the primary credential persistence failure after best-effort rollback.
SSH cleanup errors during removal could block state cleanup in the wrong order.	Remove persisted saved-environment state first, then await SSH cleanup and log cleanup failures without restoring stale persistence.

Validation

• bun fmt
• bun lint
• bun typecheck
• bun run --filter @t3tools/desktop test -- DesktopSavedEnvironments
• bun run --filter @t3tools/web test -- localApi catalog service.addSavedEnvironment service.savedEnvironments

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes: N/A, persistence behavior only
• I included a video for animation/interaction changes: N/A

---

Note

Medium Risk
Changes on-disk saved-environment and credential persistence, but the scope is narrow and covered by a new atomic-removal test.

Overview
Adds removeEnvironment(environmentId) to desktop saved-environment persistence so registry metadata and the embedded encryptedBearerToken are dropped in one registry write, instead of relying on separate metadata vs secret updates.

The file-backed implementation filters the matching record out of the persisted document (no-op if missing). The in-memory test layer clears both the records ref and secrets ref together. A new test asserts the registry is empty and getSecret is none after removal.

^{Reviewed by Cursor Bugbot for commit 01dee9c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add removeEnvironment to DesktopSavedEnvironments to delete registry records and secrets atomically

• Adds removeEnvironment(environmentId) to DesktopSavedEnvironmentsShape, which removes the matching record from the registry document and its embedded encryptedBearerToken in a single write.
• The production layer reads the current registry, filters out the matching record, and writes the updated document preserving the version field.
• The test layer removes the record from recordsRef and the secret from secretsRef together, with a new test asserting both are cleared after calling removeEnvironment.

📊 Macroscope summarized da654c7. 1 file reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ac600f50-14f0-4e9b-a0b2-2173b5f12614

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR adds new functionality and has an unresolved review comment identifying an error type mismatch where removeEnvironment can throw errors not declared in its interface signature.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 933a157

Dismissing prior approval to re-evaluate 61426fd

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a980c750b2c825b09cebfe83fb3839b602d34574. Configure here.}

[mwolson]

@macroscope-app review

[macroscopeapp]

Sorry, I'm unable to act on this request because you do not have permissions within this repository.

[mwolson]

Summary

Closes#2914.

This makes saved-environment removal use a single persistence operation that removes metadata and embedded credentials together, and tightens rollback behavior when replacing stale desktop SSH records.

Problem and Fix

Problem and Why it Happened	Fix
Removing a saved environment updated persisted metadata and bearer-token state separately, so SSH cleanup could race with deletion and stale records could reappear.	Add removeSavedEnvironment to the local persistence API and desktop IPC bridge so metadata and embedded secrets are removed atomically.
The UI cleared saved-environment state before durable removal finished.	Persist removal first, then clear registry/runtime/UI state, while still awaiting SSH cleanup before returning.
Browser fallback persistence did not have an equivalent atomic saved-environment removal path.	Add browser-storage removal alongside the desktop bridge implementation.
Replacing a stale desktop SSH record only snapshotted the new environment id.	Snapshot both the new id and stale SSH record so rollback can restore the previous saved record if credential persistence fails.

Defensive Fixes

Problem and Why it Happened	Fix
Rollback errors could hide the original credential persistence error.	Preserve and rethrow the primary credential persistence failure after best-effort rollback.
SSH cleanup errors during removal could block state cleanup in the wrong order.	Remove persisted saved-environment state first, then await SSH cleanup and log cleanup failures without restoring stale persistence.

Validation

• bun fmt
• bun lint
• bun typecheck
• bun run --filter @t3tools/desktop test -- DesktopSavedEnvironments
• bun run --filter @t3tools/web test -- localApi catalog service.addSavedEnvironment service.savedEnvironments

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes: N/A, persistence behavior only
• I included a video for animation/interaction changes: N/A

---

Note

Medium Risk
Changes on-disk saved-environment and credential persistence, but the scope is narrow and covered by a new atomic-removal test.

Overview
Adds removeEnvironment(environmentId) to desktop saved-environment persistence so registry metadata and the embedded encryptedBearerToken are dropped in one registry write, instead of relying on separate metadata vs secret updates.

The file-backed implementation filters the matching record out of the persisted document (no-op if missing). The in-memory test layer clears both the records ref and secrets ref together. A new test asserts the registry is empty and getSecret is none after removal.

^{Reviewed by Cursor Bugbot for commit 01dee9c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add removeEnvironment to DesktopSavedEnvironments to delete registry records and secrets atomically

• Adds removeEnvironment(environmentId) to DesktopSavedEnvironmentsShape, which removes the matching record from the registry document and its embedded encryptedBearerToken in a single write.
• The production layer reads the current registry, filters out the matching record, and writes the updated document preserving the version field.
• The test layer removes the record from recordsRef and the secret from secretsRef together, with a new test asserting both are cleared after calling removeEnvironment.

📊 Macroscope summarized da654c7. 1 file reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ac600f50-14f0-4e9b-a0b2-2173b5f12614

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR adds new functionality and has an unresolved review comment identifying an error type mismatch where removeEnvironment can throw errors not declared in its interface signature.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 933a157

Dismissing prior approval to re-evaluate 61426fd

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a980c750b2c825b09cebfe83fb3839b602d34574. Configure here.}

[mwolson]

@macroscope-app review

[macroscopeapp]

Sorry, I'm unable to act on this request because you do not have permissions within this repository.

[mwolson]

Summary

Closes#2914.

This makes saved-environment removal use a single persistence operation that removes metadata and embedded credentials together, and tightens rollback behavior when replacing stale desktop SSH records.

Problem and Fix

Problem and Why it Happened	Fix
Removing a saved environment updated persisted metadata and bearer-token state separately, so SSH cleanup could race with deletion and stale records could reappear.	Add removeSavedEnvironment to the local persistence API and desktop IPC bridge so metadata and embedded secrets are removed atomically.
The UI cleared saved-environment state before durable removal finished.	Persist removal first, then clear registry/runtime/UI state, while still awaiting SSH cleanup before returning.
Browser fallback persistence did not have an equivalent atomic saved-environment removal path.	Add browser-storage removal alongside the desktop bridge implementation.
Replacing a stale desktop SSH record only snapshotted the new environment id.	Snapshot both the new id and stale SSH record so rollback can restore the previous saved record if credential persistence fails.

Defensive Fixes

Problem and Why it Happened	Fix
Rollback errors could hide the original credential persistence error.	Preserve and rethrow the primary credential persistence failure after best-effort rollback.
SSH cleanup errors during removal could block state cleanup in the wrong order.	Remove persisted saved-environment state first, then await SSH cleanup and log cleanup failures without restoring stale persistence.

Validation

• bun fmt
• bun lint
• bun typecheck
• bun run --filter @t3tools/desktop test -- DesktopSavedEnvironments
• bun run --filter @t3tools/web test -- localApi catalog service.addSavedEnvironment service.savedEnvironments

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes: N/A, persistence behavior only
• I included a video for animation/interaction changes: N/A

---

Note

Medium Risk
Changes on-disk saved-environment and credential persistence, but the scope is narrow and covered by a new atomic-removal test.

Overview
Adds removeEnvironment(environmentId) to desktop saved-environment persistence so registry metadata and the embedded encryptedBearerToken are dropped in one registry write, instead of relying on separate metadata vs secret updates.

The file-backed implementation filters the matching record out of the persisted document (no-op if missing). The in-memory test layer clears both the records ref and secrets ref together. A new test asserts the registry is empty and getSecret is none after removal.

^{Reviewed by Cursor Bugbot for commit 01dee9c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add removeEnvironment to DesktopSavedEnvironments to delete registry records and secrets atomically

• Adds removeEnvironment(environmentId) to DesktopSavedEnvironmentsShape, which removes the matching record from the registry document and its embedded encryptedBearerToken in a single write.
• The production layer reads the current registry, filters out the matching record, and writes the updated document preserving the version field.
• The test layer removes the record from recordsRef and the secret from secretsRef together, with a new test asserting both are cleared after calling removeEnvironment.

📊 Macroscope summarized da654c7. 1 file reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ac600f50-14f0-4e9b-a0b2-2173b5f12614

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR adds new functionality and has an unresolved review comment identifying an error type mismatch where removeEnvironment can throw errors not declared in its interface signature.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 933a157

Dismissing prior approval to re-evaluate 61426fd

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a980c750b2c825b09cebfe83fb3839b602d34574. Configure here.}

[mwolson]

@macroscope-app review

[macroscopeapp]

Sorry, I'm unable to act on this request because you do not have permissions within this repository.

[mwolson]

Summary

Closes#2914.

This makes saved-environment removal use a single persistence operation that removes metadata and embedded credentials together, and tightens rollback behavior when replacing stale desktop SSH records.

Problem and Fix

Problem and Why it Happened	Fix
Removing a saved environment updated persisted metadata and bearer-token state separately, so SSH cleanup could race with deletion and stale records could reappear.	Add removeSavedEnvironment to the local persistence API and desktop IPC bridge so metadata and embedded secrets are removed atomically.
The UI cleared saved-environment state before durable removal finished.	Persist removal first, then clear registry/runtime/UI state, while still awaiting SSH cleanup before returning.
Browser fallback persistence did not have an equivalent atomic saved-environment removal path.	Add browser-storage removal alongside the desktop bridge implementation.
Replacing a stale desktop SSH record only snapshotted the new environment id.	Snapshot both the new id and stale SSH record so rollback can restore the previous saved record if credential persistence fails.

Defensive Fixes

Problem and Why it Happened	Fix
Rollback errors could hide the original credential persistence error.	Preserve and rethrow the primary credential persistence failure after best-effort rollback.
SSH cleanup errors during removal could block state cleanup in the wrong order.	Remove persisted saved-environment state first, then await SSH cleanup and log cleanup failures without restoring stale persistence.

Validation

• bun fmt
• bun lint
• bun typecheck
• bun run --filter @t3tools/desktop test -- DesktopSavedEnvironments
• bun run --filter @t3tools/web test -- localApi catalog service.addSavedEnvironment service.savedEnvironments

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes: N/A, persistence behavior only
• I included a video for animation/interaction changes: N/A

---

Note

Medium Risk
Changes on-disk saved-environment and credential persistence, but the scope is narrow and covered by a new atomic-removal test.

Overview
Adds removeEnvironment(environmentId) to desktop saved-environment persistence so registry metadata and the embedded encryptedBearerToken are dropped in one registry write, instead of relying on separate metadata vs secret updates.

The file-backed implementation filters the matching record out of the persisted document (no-op if missing). The in-memory test layer clears both the records ref and secrets ref together. A new test asserts the registry is empty and getSecret is none after removal.

^{Reviewed by Cursor Bugbot for commit 01dee9c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add removeEnvironment to DesktopSavedEnvironments to delete registry records and secrets atomically

• Adds removeEnvironment(environmentId) to DesktopSavedEnvironmentsShape, which removes the matching record from the registry document and its embedded encryptedBearerToken in a single write.
• The production layer reads the current registry, filters out the matching record, and writes the updated document preserving the version field.
• The test layer removes the record from recordsRef and the secret from secretsRef together, with a new test asserting both are cleared after calling removeEnvironment.

📊 Macroscope summarized da654c7. 1 file reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ac600f50-14f0-4e9b-a0b2-2173b5f12614

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR adds new functionality and has an unresolved review comment identifying an error type mismatch where removeEnvironment can throw errors not declared in its interface signature.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 933a157

Dismissing prior approval to re-evaluate 61426fd

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a980c750b2c825b09cebfe83fb3839b602d34574. Configure here.}

[mwolson]

@macroscope-app review

[macroscopeapp]

Sorry, I'm unable to act on this request because you do not have permissions within this repository.

[mwolson]

Summary

Closes#2914.

This makes saved-environment removal use a single persistence operation that removes metadata and embedded credentials together, and tightens rollback behavior when replacing stale desktop SSH records.

Problem and Fix

Problem and Why it Happened	Fix
Removing a saved environment updated persisted metadata and bearer-token state separately, so SSH cleanup could race with deletion and stale records could reappear.	Add removeSavedEnvironment to the local persistence API and desktop IPC bridge so metadata and embedded secrets are removed atomically.
The UI cleared saved-environment state before durable removal finished.	Persist removal first, then clear registry/runtime/UI state, while still awaiting SSH cleanup before returning.
Browser fallback persistence did not have an equivalent atomic saved-environment removal path.	Add browser-storage removal alongside the desktop bridge implementation.
Replacing a stale desktop SSH record only snapshotted the new environment id.	Snapshot both the new id and stale SSH record so rollback can restore the previous saved record if credential persistence fails.

Defensive Fixes

Problem and Why it Happened	Fix
Rollback errors could hide the original credential persistence error.	Preserve and rethrow the primary credential persistence failure after best-effort rollback.
SSH cleanup errors during removal could block state cleanup in the wrong order.	Remove persisted saved-environment state first, then await SSH cleanup and log cleanup failures without restoring stale persistence.

Validation

• bun fmt
• bun lint
• bun typecheck
• bun run --filter @t3tools/desktop test -- DesktopSavedEnvironments
• bun run --filter @t3tools/web test -- localApi catalog service.addSavedEnvironment service.savedEnvironments

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes: N/A, persistence behavior only
• I included a video for animation/interaction changes: N/A

---

Note

Medium Risk
Changes on-disk saved-environment and credential persistence, but the scope is narrow and covered by a new atomic-removal test.

Overview
Adds removeEnvironment(environmentId) to desktop saved-environment persistence so registry metadata and the embedded encryptedBearerToken are dropped in one registry write, instead of relying on separate metadata vs secret updates.

The file-backed implementation filters the matching record out of the persisted document (no-op if missing). The in-memory test layer clears both the records ref and secrets ref together. A new test asserts the registry is empty and getSecret is none after removal.

^{Reviewed by Cursor Bugbot for commit 01dee9c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add removeEnvironment to DesktopSavedEnvironments to delete registry records and secrets atomically

• Adds removeEnvironment(environmentId) to DesktopSavedEnvironmentsShape, which removes the matching record from the registry document and its embedded encryptedBearerToken in a single write.
• The production layer reads the current registry, filters out the matching record, and writes the updated document preserving the version field.
• The test layer removes the record from recordsRef and the secret from secretsRef together, with a new test asserting both are cleared after calling removeEnvironment.

📊 Macroscope summarized da654c7. 1 file reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ac600f50-14f0-4e9b-a0b2-2173b5f12614

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR adds new functionality and has an unresolved review comment identifying an error type mismatch where removeEnvironment can throw errors not declared in its interface signature.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 933a157

Dismissing prior approval to re-evaluate 61426fd

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a980c750b2c825b09cebfe83fb3839b602d34574. Configure here.}

[mwolson]

@macroscope-app review

[macroscopeapp]

Sorry, I'm unable to act on this request because you do not have permissions within this repository.

[mwolson]

Summary

Closes#2914.

This makes saved-environment removal use a single persistence operation that removes metadata and embedded credentials together, and tightens rollback behavior when replacing stale desktop SSH records.

Problem and Fix

Problem and Why it Happened	Fix
Removing a saved environment updated persisted metadata and bearer-token state separately, so SSH cleanup could race with deletion and stale records could reappear.	Add removeSavedEnvironment to the local persistence API and desktop IPC bridge so metadata and embedded secrets are removed atomically.
The UI cleared saved-environment state before durable removal finished.	Persist removal first, then clear registry/runtime/UI state, while still awaiting SSH cleanup before returning.
Browser fallback persistence did not have an equivalent atomic saved-environment removal path.	Add browser-storage removal alongside the desktop bridge implementation.
Replacing a stale desktop SSH record only snapshotted the new environment id.	Snapshot both the new id and stale SSH record so rollback can restore the previous saved record if credential persistence fails.

Defensive Fixes

Problem and Why it Happened	Fix
Rollback errors could hide the original credential persistence error.	Preserve and rethrow the primary credential persistence failure after best-effort rollback.
SSH cleanup errors during removal could block state cleanup in the wrong order.	Remove persisted saved-environment state first, then await SSH cleanup and log cleanup failures without restoring stale persistence.

Validation

• bun fmt
• bun lint
• bun typecheck
• bun run --filter @t3tools/desktop test -- DesktopSavedEnvironments
• bun run --filter @t3tools/web test -- localApi catalog service.addSavedEnvironment service.savedEnvironments

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes: N/A, persistence behavior only
• I included a video for animation/interaction changes: N/A

---

Note

Medium Risk
Changes on-disk saved-environment and credential persistence, but the scope is narrow and covered by a new atomic-removal test.

Overview
Adds removeEnvironment(environmentId) to desktop saved-environment persistence so registry metadata and the embedded encryptedBearerToken are dropped in one registry write, instead of relying on separate metadata vs secret updates.

The file-backed implementation filters the matching record out of the persisted document (no-op if missing). The in-memory test layer clears both the records ref and secrets ref together. A new test asserts the registry is empty and getSecret is none after removal.

^{Reviewed by Cursor Bugbot for commit 01dee9c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add removeEnvironment to DesktopSavedEnvironments to delete registry records and secrets atomically

• Adds removeEnvironment(environmentId) to DesktopSavedEnvironmentsShape, which removes the matching record from the registry document and its embedded encryptedBearerToken in a single write.
• The production layer reads the current registry, filters out the matching record, and writes the updated document preserving the version field.
• The test layer removes the record from recordsRef and the secret from secretsRef together, with a new test asserting both are cleared after calling removeEnvironment.

📊 Macroscope summarized da654c7. 1 file reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ac600f50-14f0-4e9b-a0b2-2173b5f12614

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR adds new functionality and has an unresolved review comment identifying an error type mismatch where removeEnvironment can throw errors not declared in its interface signature.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 933a157

Dismissing prior approval to re-evaluate 61426fd

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a980c750b2c825b09cebfe83fb3839b602d34574. Configure here.}

[mwolson]

@macroscope-app review

[macroscopeapp]

Sorry, I'm unable to act on this request because you do not have permissions within this repository.