fix(desktop): improve Niri AppImage and remote environment

[mwolson]

Summary

• Supersedes fix(desktop): standard Linux AppImage icons for AppImageLauncher #2332 by keeping the Linux AppImage hicolor icon fix and adding a second Niri/AppImage integration fix found while testing remote environments.
• Generates standard Linux icon sizes for AppImage builds so AppImageLauncher and desktop shells can resolve the installed app icon.
• Selects Electron's Linux secret-storage backend more reliably on desktop environments Electron does not recognize, such as Niri, while still allowing explicit user preference through desktop-settings.json.

Closes #2331.
Fixes #2539.

Repro

For the icon issue:

1. Install the Linux AppImage with AppImageLauncher under Niri.
2. Inspect the installed launcher entry or application menu.
3. The app can appear without a usable T3 Code icon when the AppImage only contains the large source icon.

For the credential-store issue:

1. Run the Linux AppImage under Niri without adding --password-store=gnome-libsecret to the desktop launcher.
2. Add a remote environment.
3. T3 Code reaches the point where it needs to persist the saved environment bearer token.
4. Electron can fail to provide an encrypted secret store, and credential persistence fails.

Diagnosis

Electron chooses the Linux safeStorage backend from the desktop environment or from --password-store. Niri is not one of Electron's recognized desktop names, so the app needed a launcher workaround to force gnome-libsecret.

This PR moves that into the app startup path:

• desktop-settings.json now accepts linuxPasswordStore.
• The default auto mode leaves Electron alone for known GNOME and KDE desktops.
• For unrecognized Linux desktops, auto appends --password-store=gnome-libsecret.
• If encryption is still unavailable, the app reports an actionable GNOME Keyring or KWallet remediation instead of surfacing a generic saved credential failure.

The icon fix from #2332 stages standard Linux icon sizes and points electron-builder at the generated icon directory.

Scope

This is intentionally Linux desktop only.

The two fixes are combined because they were both found while testing the same Linux AppImage flow under Niri, and because this PR is intended to replace the narrower icon-only PR #2332.

Test plan

• bun fmt
• bun lint
• bun typecheck
• bun run test
• bun dist:desktop:linux
• Built a local AppImage and launched it under Niri with the launcher password-store workaround removed.
• Confirmed the desktop log reports safe storage backend=gnome_libsecret encryptionAvailable=true.
• Confirmed adding and connecting to a remote environment works from another computer using this build.
• Verified the AppImage icon fix from fix(desktop): standard Linux AppImage icons for AppImageLauncher #2332 by extracting AppImages and confirming hicolor icon entries for 16, 22, 24, 32, 48, 64, 128, 256, and 512.

---

Note

Medium Risk
Medium risk because it changes Linux desktop startup flags that affect Electron safeStorage backend selection and updates build/release packaging for Linux artifacts; regressions would mainly impact Linux users saving credentials or icon rendering.

Overview
Improves Linux AppImage behavior by generating a full set of standard-sized icons at build time (via ImageMagick) and pointing the Linux electron-builder config at the generated icons/ directory; the release workflow now ensures ImageMagick is available on Linux runners.

Adds a Linux-only secret-storage preference (linuxPasswordStore) to desktop-settings.json and uses a new linuxSecretStorage helper to auto-apply an Electron --password-store switch on unrecognized desktop environments while preserving explicit user choice. Saved-environment credential persistence now fails fast when safeStorage encryption is unavailable and surfaces a more actionable GNOME Keyring/KWallet remediation message; related web runtime rollback logic was refactored to preserve the primary credential error even if registry rollback also fails.

^{Reviewed by Cursor Bugbot for commit b133f59. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix Niri AppImage packaging and improve Linux secret storage error handling

• Linux builds now generate multi-sized icons via ImageMagick (using magick or convert) and point electron-builder at the icons directory; CI installs ImageMagick when missing
• On Linux, the app resolves and passes a --password-store switch at startup when Electron's auto-detection does not recognize the desktop environment
• A new linuxPasswordStore preference (auto by default) is persisted in desktop settings and used to select the appropriate secret storage backend
• Attempts to persist environment secrets now fail early with a tailored remediation message (e.g. GNOME Keyring or KWallet instructions) when encryption is unavailable
• Bearer token persistence failures in addSavedEnvironment now consistently trigger registry rollback and preserve the original error message

^{Macroscope summarized b133f59.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 6ace5af6-0c64-4281-97d3-0939fc67cdaa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces new Linux desktop environment detection logic, a new linuxPasswordStore setting, and changes runtime behavior for unrecognized Linux desktops. The new capability and runtime behavior changes warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[mwolson]

Before (missing icon)

Missing icon (works in shelly, doesn't work when appimage is launched directly, or with AppImageLauncher):

Before (secret manager)

Error when trying to add environment:

[mwolson]

After (icons fix)

Launched appimage directly after chmod +x on it:

After (secrets-manager fix)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5cce063. Configure here.}