fix(web): Remove saved environments atomically

[mwolson]

Summary

Closes #2914.

This makes saved-environment removal use a single persistence operation that removes metadata and embedded credentials together, and tightens rollback behavior when replacing stale desktop SSH records.

Problem and Fix

Problem and Why it Happened	Fix
Removing a saved environment updated persisted metadata and bearer-token state separately, so SSH cleanup could race with deletion and stale records could reappear.	Add removeSavedEnvironment to the local persistence API and desktop IPC bridge so metadata and embedded secrets are removed atomically.
The UI cleared saved-environment state before durable removal finished.	Persist removal first, then clear registry/runtime/UI state, while still awaiting SSH cleanup before returning.
Browser fallback persistence did not have an equivalent atomic saved-environment removal path.	Add browser-storage removal alongside the desktop bridge implementation.
Replacing a stale desktop SSH record only snapshotted the new environment id.	Snapshot both the new id and stale SSH record so rollback can restore the previous saved record if credential persistence fails.

Defensive Fixes

Problem and Why it Happened	Fix
Rollback errors could hide the original credential persistence error.	Preserve and rethrow the primary credential persistence failure after best-effort rollback.
SSH cleanup errors during removal could block state cleanup in the wrong order.	Remove persisted saved-environment state first, then await SSH cleanup and log cleanup failures without restoring stale persistence.

Validation

• bun fmt
• bun lint
• bun typecheck
• bun run --filter @t3tools/desktop test -- DesktopSavedEnvironments
• bun run --filter @t3tools/web test -- localApi catalog service.addSavedEnvironment service.savedEnvironments

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes: N/A, persistence behavior only
• I included a video for animation/interaction changes: N/A

---

Note

Medium Risk
Changes ordering of credential/registry removal and SSH teardown plus rollback paths for add/replace flows; mistakes could leave orphaned or resurrected saved environments, though behavior is heavily covered by tests.

Overview
Adds removeSavedEnvironment end-to-end so saved environments are deleted in one persistence step (registry metadata plus embedded secrets on desktop/browser), wired through IPC, localApi, and removePersistedSavedEnvironment.

removeSavedEnvironment now tears down connections, persists removal first, then clears in-memory registry/runtime/UI state, and only then runs desktop SSH cleanup (failures are logged, not rolled back). disconnectSavedEnvironment no longer deletes saved records; it only disconnects and, for SSH, clears the bearer token via the existing secret-removal path.

Rollback when adding/replacing environments is tightened: bearer-token writes go through persistSavedEnvironmentBearerTokenOrRollback, registry rollback can keep the original error when rollback itself fails, and replacing a stale desktop SSH target snapshots both environment ids and uses atomic removal for the old record with rollback if credential persistence or stale removal fails.

^{Reviewed by Cursor Bugbot for commit 33193f4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Remove saved environments atomically with rollback on credential persistence failure

• Adds removePersistedSavedEnvironment across desktop and browser persistence layers, wiring it through IPC (desktop:remove-saved-environment), DesktopBridge, and LocalApi.
• Refactors removeSavedEnvironment in service.ts to delete the persisted record and update in-memory stores before running SSH cleanup; SSH cleanup errors are logged and ignored.
• Introduces removeStaleSavedEnvironmentRecord for atomic replacement flows in addSavedEnvironment, so stale records are removed from persistence without triggering bearer token deletion or disconnect.
• Centralizes bearer token persistence and rollback in persistSavedEnvironmentBearerTokenOrRollback; rollback now preserves the primary error and attaches rollback failure context.
• Behavioral Change: removeSavedEnvironment no longer calls the separate bearer token deletion step — token cleanup is handled implicitly by the desktop persistence layer when removing the record.

^{Macroscope summarized 33193f4.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: b695884c-f0c7-46c3-9d11-4c3a296d0c89

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces significant runtime behavior changes to saved environment persistence, including new IPC methods and atomic operation ordering with rollback handling. While well-tested, the changes affect critical data persistence flows and should be reviewed by someone familiar with this subsystem.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 933a157

Dismissing prior approval to re-evaluate 61426fd

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 177b89b. Configure here.}