Persist desktop authentication securely across restarts

[zortos293]

Summary

Fixes the desktop client asking users to authenticate again after every restart.

The session handoff was stored only in renderer sessionStorage, which Electron clears when the application exits. OpenStroid now keeps that handoff in the main process using Electron safeStorage, writes the encrypted value atomically with owner-only file permissions, and restores it before the first session request. KDE Plasma 6 sessions explicitly select KWallet 6 so Electron uses the correct Linux credential backend.

If Linux only offers Electron's insecure basic_text backend, OpenStroid refuses to persist the credential rather than writing recoverable secrets. Intentional logout and invalid encrypted data remove the persisted session; expired credentials still follow the existing server refresh/unauthorized flow.

Reported by Discord user <@92200966610251776> (Kohega).

Visual proof

The change has no new UI; it changes which existing screen appears after relaunch. This preview mocks a previously authenticated session and shows the expected post-restart result: OpenStroid opens the authenticated library with Kohega's account menu available instead of returning to QR login.

Validation

• npm test — 7 persistence tests pass, covering restart restoration, logout deletion, invalid ciphertext, atomic write failure, Linux insecure-backend refusal, KDE Plasma 6 backend selection, and non-Linux behavior
• npm run lint
• npm run build
• npm run test:ui
• Previewed the restored authenticated experience at 1440×960 and captured the screenshot above

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Warning

Review limit reached

@zortos293, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2503a449-9885-4a3a-8012-582493dccd6d

📥 Commits

Reviewing files that changed from the base of the PR and between 990e9b0 and 2d88e86.

⛔ Files ignored due to path filters (1)

• artifacts/auth-restored.png is excluded by !**/*.png

📒 Files selected for processing (13)

• electron/authSessionIpc.ts
• electron/authSessionStore.test.ts
• electron/authSessionStore.ts
• electron/main.ts
• electron/preload.cjs
• electron/preload.cts
• package.json
• src/api/client.ts
• src/api/endpoints.ts
• src/auth/AuthContext.tsx
• src/auth/storage.ts
• src/global.d.ts
• src/pages/LoginPage.tsx

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}