chore: sync with upstream

[SilkePilon]

Latest Upstream Release: Superset Desktop desktop-v1.4.6

Tag: desktop-v1.4.6
Published: 2026-03-31T05:05:08Z

---

Release Notes

What's Changed

• chore(desktop): bump version to 1.4.5 by @Kitenite in chore(desktop): bump version to 1.4.5 superset-sh/superset#3026
• fix: solve Add Primary Device Attribute (DA1) query response support superset-sh/superset#3028 — forward DA1 query responses during shell init by @github-actions[bot] in fix: solve #3028 — forward DA1 query responses during shell init superset-sh/superset#3030
• feat(desktop): add sorting to resource usage popover by @Kitenite in feat(desktop): add sorting to resource usage popover superset-sh/superset#3036
• fix(desktop): change close workspace shortcut to ⌘⇧⌫ by @Kitenite in fix(desktop): change close workspace shortcut to ⌘⇧⌫ superset-sh/superset#3037

Full Changelog: superset-sh/superset@desktop-v1.4.5...desktop-v1.4.6

---

54 new commits from upstream.

This PR is automatically created and updated daily to keep the fork in sync with superset-sh/superset.

---

Summary by cubic

Sync with upstream Superset Desktop v1.4.6 and align CI to .bun-version. This brings MCP OAuth/auth fixes, a PSK‑secured local host-service, terminal stability/perf improvements, Amp agent support, resource usage sorting, server‑side PR search, and other quality-of-life updates.

• New Features

  • Added Amp Code CLI wrapper; unified desktop agent setup and managed binaries.
  • Secured local host-service with PSK auth and CORS allow‑list; desktop returns { port, secret } and the renderer includes the secret on HTTP/WSS.
  • Resource usage popover supports sorting by memory, CPU, name, or sidebar order.
  • New Workspace modal uses server‑side GitHub PR search (URL detection supported) for faster, complete results.
  • Desktop chat works in SKIP_ENV_VALIDATION mode with local-only bootstrap.
  • System theme lets users choose specific light/dark themes in “System” mode.
  • Electron CDP is only enabled in development when DESKTOP_AUTOMATION_PORT is set.
  • Added NEXT_PUBLIC_MARKETING_URL; CI/builds read Bun from .bun-version (1.3.11).

• Bug Fixes

  • Terminal stability: forward DA1 responses during init, batch PTY output (~60fps), respect socket backpressure, and exit on PTY spawn failure to avoid zombie sessions.
  • Git/PRs: prevent [gone] from being stored as a branch, reject invalid branch names, honor linked PR push targets, and avoid matching historical PRs when heads differ.
  • MCP OAuth/auth: correct auth precedence (session → API key → OAuth), case‑insensitive Bearer parsing, protected‑resource metadata endpoints, and fail‑closed on invalid verified tokens.
  • Workspaces: consistently delete tracked worktrees from disk with safer external detection and clear ‘deleting’ status on errors.
  • UI/UX polish: focus chat input on pane focus and restore native text‑editing shortcuts; change “Close workspace” to ⌘⇧⌫ (Ctrl+Shift+Backspace on Win/Linux); improve notifications event mapping; harden image data URL handling; Codex hooks restored and enabled in wrappers.

^{Written for commit 2885f51. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 346 files

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/triage-issue.yml">

<violation number="1" location=".github/workflows/triage-issue.yml:35">
P2: The workflow references .bun-version, but the file doesn't exist in the repo. setup-bun will fail to resolve the version. Either add the file or keep an explicit bun-version value.</violation>
</file>

<file name="apps/desktop/src/lib/trpc/routers/workspaces/procedures/delete.ts">

<violation number="1" location="apps/desktop/src/lib/trpc/routers/workspaces/procedures/delete.ts:289">
P1: `deleteWorktree` now removes any tracked worktree from disk, including external worktrees marked `createdBySuperset: false`. That changes prior safety behavior and can delete user-managed worktrees.</violation>
</file>

<file name="apps/desktop/src/lib/trpc/routers/workspaces/utils/git.ts">

<violation number="1" location="apps/desktop/src/lib/trpc/routers/workspaces/utils/git.ts:353">
P1: Regex for unmerged (`u`) entries has one extra `\S+` field, so it will never match actual `git status --porcelain=v2` output. The v2 unmerged format is `u <xy> <sub> <m1> <m2> <m3> <h1> <h2> <h3> <path>` (8 fields before path), but the regex expects 9 fields before the path capture. Merge conflicts will be silently ignored.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: deleteWorktree now removes any tracked worktree from disk, including external worktrees marked createdBySuperset: false. That changes prior safety behavior and can delete user-managed worktrees.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/desktop/src/lib/trpc/routers/workspaces/procedures/delete.ts, line 289:

<comment>`deleteWorktree` now removes any tracked worktree from disk, including external worktrees marked `createdBySuperset: false`. That changes prior safety behavior and can delete user-managed worktrees.</comment>

<file context>
@@ -267,43 +265,46 @@ export const createDeleteProcedures = () => {
+						const isActuallyExternal =
+							existsInGit && !trackedPaths.has(worktreePathNorm);
+
+						if (isActuallyExternal) {
+							console.warn(
+								`[workspace/delete] Worktree at ${worktree.path} exists in git but not tracked in database - preserving as safety measure`,
</file context>

Suggested change

	if (isActuallyExternal) {
	if (!worktree.createdBySuperset) {
	console.log(
	`[worktree/delete] Skipping disk deletion for external worktree at ${worktree.path}`,
	);
	} else if (isActuallyExternal) {

[cubic-dev-ai]

P1: Regex for unmerged (u) entries has one extra \S+ field, so it will never match actual git status --porcelain=v2 output. The v2 unmerged format is u <xy> <sub> <m1> <m2> <m3> <h1> <h2> <h3> <path> (8 fields before path), but the regex expects 9 fields before the path capture. Merge conflicts will be silently ignored.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/desktop/src/lib/trpc/routers/workspaces/utils/git.ts, line 353:

<comment>Regex for unmerged (`u`) entries has one extra `\S+` field, so it will never match actual `git status --porcelain=v2` output. The v2 unmerged format is `u <xy> <sub> <m1> <m2> <m3> <h1> <h2> <h3> <path>` (8 fields before path), but the regex expects 9 fields before the path capture. Merge conflicts will be silently ignored.</comment>

<file context>
@@ -203,84 +271,100 @@ function parsePortelainStatus(stdout: string): StatusResult {
-			else if (workingStatus === "D") deletedSet.add(path);
-			else if (workingStatus === "U") conflictedSet.add(path);
+		if (entry.startsWith("u ")) {
+			const match = entry.match(
+				/^u (\S{2}) \S+ \S+ \S+ \S+ \S+ \S+ \S+ \S+ (.+)$/,
+			);
</file context>

Suggested change

	const match = entry.match(
	/^u (\S{2}) \S+ \S+ \S+ \S+ \S+ \S+ \S+ \S+ (.+)$/,
	);
	const match = entry.match(
	/^u (\S{2}) \S+ \S+ \S+ \S+ \S+ \S+ \S+ (.+)$/,
	);

[cubic-dev-ai]

P2: The workflow references .bun-version, but the file doesn't exist in the repo. setup-bun will fail to resolve the version. Either add the file or keep an explicit bun-version value.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/triage-issue.yml, line 35:

<comment>The workflow references .bun-version, but the file doesn't exist in the repo. setup-bun will fail to resolve the version. Either add the file or keep an explicit bun-version value.</comment>

<file context>
@@ -32,7 +32,7 @@ jobs:
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.6
+          bun-version-file: .bun-version
 
       - name: Cache dependencies
</file context>