From da39e1485fd4c7b8b2bbaabf5dd5f20554a057ea Mon Sep 17 00:00:00 2001
From: Kfir Amar <kfira2002@gmail.com>
Date: Sat, 14 Mar 2026 21:23:07 +0200
Subject: [PATCH] fix(startup): fail closed on key inspection errors

Propagate database inspection failures instead of treating them as
missing encrypted credentials.

This keeps startup from generating a fresh encryption key when an
existing database cannot be inspected and adds a regression test for
that path.
---
 electron/main.js                  |  5 +++--
 scripts/bootstrap-env.mjs         |  5 +++--
 tests/unit/bootstrap-env.test.mjs | 11 +++++++++++
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/electron/main.js b/electron/main.js
index 2cba05f8e2..95838d9e9b 100644
--- a/electron/main.js
+++ b/electron/main.js
@@ -116,8 +116,9 @@ function hasEncryptedCredentials(dbPath) {
     } finally {
       db.close();
     }
-  } catch {
-    return false;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Unable to inspect existing database at ${dbPath}: ${message}`);
   }
 }
 
diff --git a/scripts/bootstrap-env.mjs b/scripts/bootstrap-env.mjs
index 46ac7d0795..2e0a0a059e 100644
--- a/scripts/bootstrap-env.mjs
+++ b/scripts/bootstrap-env.mjs
@@ -87,8 +87,9 @@ function hasEncryptedCredentials(dataDir) {
     } finally {
       db.close();
     }
-  } catch {
-    return false;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Unable to inspect existing database at ${dbPath}: ${message}`);
   }
 }
 
diff --git a/tests/unit/bootstrap-env.test.mjs b/tests/unit/bootstrap-env.test.mjs
index 019f65b790..e8d271fb53 100644
--- a/tests/unit/bootstrap-env.test.mjs
+++ b/tests/unit/bootstrap-env.test.mjs
@@ -89,3 +89,14 @@ test("bootstrapEnv refuses to generate a new key over encrypted data", () => {
     );
   });
 });
+
+test("bootstrapEnv fails closed when existing database cannot be inspected", () => {
+  withTempEnv(({ dataDir }) => {
+    fs.mkdirSync(path.join(dataDir, "storage.sqlite"), { recursive: true });
+
+    assert.throws(
+      () => bootstrapEnv({ quiet: true }),
+      /Unable to inspect existing database/
+    );
+  });
+});