fix(desktop): an unreadable settings file is no longer overwritten by a bounds save #35890

readSettings in apps/desktop/src/settings/DesktopAppSettings.ts used Effect.option on readFileString, so any read error (EACCES, EIO) looked like a missing file. load stored defaults, and the startup setMainWindowBounds persist renamed a sparse defaults-relative document over the existing file, erasing saved preferences. Now only a PlatformError with reason NotFound maps to defaults (the same distinction DesktopClientSettings makes). Any other read error fails readSettings; load catches it, logs a warning with the settings path, uses defaults for the session and clears a per-service persistenceEnabled flag. While that flag is false, persist still updates the in-memory settings and reports changed, but skips writeSettings, so the unreadable file is never replaced and its preferences load on the next start once readable. No visible UI change, no new regex or parser.

Fixes pingdotgg/t3code#35873

Reproduction on main#

Commit 95cb068c10 (origin/main). Built the desktop app with vp run build:desktop, fetched Electron, then wrote a fresh state dir with T3CODE_HOME set to a scratch path: userdata/desktop-settings.json = {"serverExposureMode":"network-accessible","updateChannel":"nightly","updateChannelConfiguredByUser":true}, then chmod 000 on it (not running as root) to make the startup read fail with EACCES. Started the app with headless-desktop node scripts/start-electron.mjs. Without any user interaction, the startup window bounds save replaced the file (rename over the unreadable one) with {"mainWindowBounds":{"x":410,"y":150,"width":1100,"height":780}}: serverExposureMode and the nightly update channel were erased, and nothing was logged about the failed read. Also added a focused test on branch factory/repro-35873. It writes serverExposureMode network-accessible, injects one PermissionDenied on readFileString, calls load and then setMainWindowBounds, and reads the file back. It fails on main (expected "network-accessible", received undefined).

Evidence#

Built and launched the real Electron app on Linux as non-root, using identical fresh synthetic settings and a 1920×1080 display. Seeded network-accessible exposure and a user-configured nightly update channel, made desktop-settings.json unreadable with chmod 000, verified EACCES, and let startup run without interaction. After 22 seconds, restored read permission only and inspected the file.

Before	After
95cb068c10	b8ce030f34
File replaced with mainWindowBounds only; no read warning.	Original bytes preserved; read failure logged.
Startup recording	Startup recording
Filesystem transcript	Filesystem transcript

Reproduction driver and seed · Head warning excerpt

The evidence panel reports actual filesystem observations. Environment names are masked. Final stills matched captures taken 500 ms apart.

Not shown:

• Other read failures, such as I/O errors, were not induced; this comparison exercised real EACCES.
• A subsequent restart and individual Local environment, Tailscale, and WSL preferences were not exercised; the reported three-field seed was verified byte-for-byte.

Tests#

vp test run src/settings/DesktopAppSettings.test.ts (apps/desktop): 14/14 pass with the fix; with the fix stashed the repro test fails (expected undefined to equal 'network-accessible'). vp run check:changed: format, lint, knip, typecheck (2 packages), and tests all pass.

Not in this change#

• A file that reads but fails to decode (corrupt or invalid JSON) still falls back to defaults and can be overwritten by the next save; that is separate, pre-existing lenient-decode behaviour, not this read-error bug.
• No UI tells the user that settings could not be read or that changes this session are not being saved; only a log warning is emitted.

Who did the work#

• Written by Claude Opus 5.5, in Claude Code
• Reviewed by GPT-6.1 Sol, in Codex, and by Claude Opus 5.5, each on its own
• Proof captured by GPT-6.1 Sol and checked by Claude Opus 5.5

Run by the t3code factory in T3 Code.