Remote configs flushed when agent-deck exits with Ctrl+C (data loss)

[asheshgoplani]

Bug

Reported by @ddorman-dn in #1066 (comment). All configured remotes disappear after exiting agent-deck with Ctrl+C.

Repro

1. agent-deck remote add <name> ssh://... for multiple remotes
2. Verify remotes exist (agent-deck remote list)
3. Run TUI: agent-deck
4. Exit with Ctrl+C
5. agent-deck remote list — all remotes are gone

Screenshot in #1066 (comment) confirms the empty state after restart.

Environment

• agent-deck v1.9.20 (darwin arm64)
• SSH over tailscale (xai remote) + SSH over forti vpn (dev-vm) — both SSH-based remotes

Severity

P1 — data loss class. User configuration silently disappears on a normal exit signal.

Root cause hypotheses (investigate)

1. Remotes are stored in-memory only; the TUI never persists them on Ctrl+C teardown
2. Remotes are stored to a temp file that the TUI cleans up on exit
3. Ctrl+C bypasses the normal shutdown path that flushes state to disk
4. Profile mixup — remotes saved under one profile, restart reads from another

Action

• Investigate where remote add writes its data — is it a different SQLite table from sessions? A separate config file?
• Verify the Ctrl+C handler in the TUI properly flushes remote state
• Write a regression test that adds a remote, kills the process with SIGINT, restarts, asserts remote is still present

Refs

• Remote sessions don't count in total sessions and don't show in the summary #1066 (parent — 3 other remote-related symptoms)

[asheshgoplani]

Update from @ddorman-dn in #1066 (comment): the bug also reproduces with SSH-alias form (agent-deck remote add dev dev where dev is an alias in ~/.ssh/config). May share root cause with the counting/UI bugs in #1066 — if remote host parser doesn't accept SSH aliases, it may be silently failing the persist step and the symptoms cascade from there. Investigation should test both user@host and bare-alias forms.

[ddorman-dn]

it's not consistent, it happened only once, it doesn't happen always

[asheshgoplani]

Thanks — that's a critical detail. Intermittent reproducer means this is likely a race, not a deterministic missing-write. Specifically: Ctrl+C delivers SIGINT, which the TUI's teardown path may handle in a goroutine that fires before any in-flight SQLite WRITE commit completes. If the write was mid-transaction at signal time, the change is rolled back when the process dies.

Will adjust the investigation accordingly: rather than 'where does it forget to save', the question is 'is the persist path atomic + signal-safe'. Likely fix needs a synchronous SQLite WAL checkpoint before the signal handler returns, or an explicit os.Stdin.Close() to drain before exit.

Severity bumps to P1 for being silent and intermittent (the worst combination).

[asheshgoplani]

Fixed by #1073 (merged 09:02 UTC today). The remote-bugs worker addressed both the metadata propagation (this issue + #1066) and the signal-safe persistence path in the same PR. Shipping in v1.9.21 (currently re-running release CI after a test-hang detour) or v1.9.22 at latest. Thanks for the report + the great debugging thread @ddorman-dn.