SilkePilon · SilkePilon · Apr 13, 2026 · Apr 13, 2026 · Apr 13, 2026 · Apr 13, 2026
diff --git a/.agents/commands/deslop.md b/.agents/commands/deslop.md
@@ -17,10 +17,14 @@ Apply clean code philosophy to the code, with special emphasis on comments:
 
 **Keep or add comments only when:**
 - Explaining *why* a non-obvious decision was made
+- Documenting design intent or architectural decisions (e.g., "shared by X and Y paths", "deferred because Z")
 - Documenting external constraints or business rules not evident from code
 - Warning about non-intuitive behavior or edge cases
+- Noting the origin of a pattern when it aids future maintenance (e.g., "VS Code pattern")
 - Required for public API documentation (JSDoc, docstrings)
 
+**When in doubt, keep the comment.** Removing a comment that captured intent is destructive — the reasoning is lost and cannot be recovered from code alone. Only remove a comment when you are confident the code *fully* communicates the same information.
+
 ## Code Simplification
 
 - Rename variables/functions to be self-documenting instead of adding comments

diff --git a/.agents/commands/pr/create-pr.md b/.agents/commands/pr/create-pr.md
@@ -0,0 +1,89 @@
+---
+description: Create a pull request for the current branch (agent-driven, one-click)
+argumentHint: "[--draft]"
+---
+
+# Goal
+
+Create a pull request for the current branch in one pass. The user
+clicked the Create PR button in the diff-editor sidebar — they expect
+the PR to be created without further prompting.
+
+An attachment named `pr-context.md` is included with this turn. It
+contains:
+
+- Current branch and base branch
+- Whether the branch is published (has upstream)
+- Commits ahead/behind upstream
+- Whether there are uncommitted changes
+- Required preconditions the user's branch must satisfy before
+  `gh pr create` will succeed
+
+Read `pr-context.md` first. Use it as ground truth instead of re-deriving
+the state yourself.
+
+# Arguments
+
+- `--draft` — create the PR as a draft. Pass `--draft` through to the
+  `gh pr create` call.
+
+Parse the arguments from the user's prompt (everything after the skill
+name). Do not ask the user to confirm the draft flag — it came from
+their button click.
+
+# Workflow
+
+## 1. Satisfy preconditions
+
+In the order listed in `pr-context.md` under "Required preconditions":
+
+- **Uncommitted changes**: generate a commit message from the staged
+  diff (use `git diff --cached` and `git status`). If nothing is
+  staged, `git add -A`. Then `git commit -m "<message>"`. Keep the
+  message short and specific — do not write a PR-body-style
+  description here.
+- **Unpublished branch**: `git push -u origin -- "<branch>"` — quote `<branch>`
+  to avoid shell injection on names with metacharacters.
+- **Unpushed commits on a published branch**: `git push`.
+- **Behind upstream**: stop. Report to the user that they should sync
+  first. Do not force-push. Do not rebase without asking.
+
+If any push fails non-fast-forward, stop and report — never
+force-push.
+
+## 2. Draft the PR body
+
+Use `git log "<base>..HEAD"` to read the commits, `git diff "<base>...HEAD"`
+for the scope of changes. Produce:
+
+- **Title**: short, imperative, derived from the most recent commit
+  message or the scope of the diff.
+- **Body**: concise. Summary + a short Test Plan checklist. Skip
+  sections that have nothing meaningful to say — do not pad.
+
+## 3. Create the PR
+
+```
+gh pr create \
+  --base <defaultBranch> \
+  --title "<title>" \
+  --body "<body>"
+```
+
+If `--draft` was passed, add `--draft`.
+
+## 4. Report back
+
+Print the PR URL as a plain link on its own line. One short sentence
+above it summarizing what you did (e.g. "Published `feature-x` and
+opened draft PR."). Do not paste the full body back.
+
+# Guardrails
+
+- Never force-push.
+- Never skip pre-commit hooks (`--no-verify`) or signing.
+- If a hook fails, report the failure; do not retry with `--no-verify`.
+- Do not open a browser — the caller handles that.
+- Do not run a full `AGENTS.md` standards review in this skill. The
+  button is a fast path; use `/create-pr` (the general-purpose skill)
+  for the gated review flow.
diff --git a/.bun-version b/.bun-version
@@ -0,0 +1 @@
+1.3.11
diff --git a/.cursor/mcp.json b/.cursor/mcp.json
diff --git a/.dockerignore b/.dockerignore
@@ -0,0 +1,12 @@
+**/node_modules
+**/.next
+**/dist
+**/build
+**/.turbo
+**/.cache
+.git
+.github
+.vscode
+.idea
+*.log
+.DS_Store
diff --git a/.env.example b/.env.example
@@ -106,3 +106,7 @@ QSTASH_NEXT_SIGNING_KEY=
 
 # MCP API Key for Claude Code
 SUPERSET_MCP_API_KEY=
+
+# Relay service URL (the v2 tunnel proxy that forwards cloud API calls
+# to host-service instances on user devices). Local dev: http://localhost:4734
+RELAY_URL=
diff --git a/.github/prompts/generate-changelog.md b/.github/prompts/generate-changelog.md
@@ -53,15 +53,19 @@ Brief description of the feature and its benefit to users.
 
 ---
 
-**Bug fixes:** Fixed issue with X <PRBadge url="https://github.com/superset-sh/superset/pull/NUMBER" />, resolved Y problem <PRBadge url="https://github.com/superset-sh/superset/pull/NUMBER" />
+**Bug fixes**
+
+- Fixed issue with X <PRBadge url="https://github.com/superset-sh/superset/pull/NUMBER" />
+- Resolved Y problem <PRBadge url="https://github.com/superset-sh/superset/pull/NUMBER" />
 ```
 
 6. **Important formatting rules**
    - Frontmatter (`---`) must be at the very top of the file with no content before it
    - MDX comments (`{/* ... */}`) must come AFTER the frontmatter, not before
    - Set `image:` in frontmatter to `/changelog/IMAGE_PLACEHOLDER.png` - reviewers will replace this
    - Add TODO comments for features that would benefit from screenshots
-   - Use a horizontal rule (`---`) before the bug fixes footnote
+   - Use a horizontal rule (`---`) before the bug fixes section
+   - Bug fixes should use bullet points, one fix per line, same as Improvements
 
 7. **Writing style**
    - **Be brief** - Users scan changelogs, they don't read every word
@@ -77,7 +81,7 @@ Brief description of the feature and its benefit to users.
 | New user-facing feature | Own section with heading, 1-2 sentences + bullets |
 | Significant improvement | Own section or grouped under "Improvements" |
 | Small enhancement | One line under "Improvements" |
-| Bug fix | One-liner in footnote section at bottom |
+| Bug fix | Bullet point in footnote section at bottom |
 | Internal/refactor | Skip entirely unless user-visible |
 
 ## Reference Examples

diff --git a/.github/prompts/triage-issue.md b/.github/prompts/triage-issue.md
@@ -22,8 +22,9 @@ You are triaging GitHub issue `$ISSUE_NUMBER`. Your goal is to:
    - Run any nearby targeted tests needed to validate the fix.
    - If a safe fix is not clear, keep this as reproduction-only and continue to step 6A.
 
-6. **Open exactly one PR** — Run `bun run lint:fix`, then commit, push, and create a PR:
-   - **6A: Reproduction-only PR (reproducible but not solved)**
+6. **Open exactly one PR** — Run `bun run lint:fix`, then commit, push, and create a PR.
+   **Default to draft** (`gh pr create --draft`) unless the issue is high priority (labeled `priority: high` or `priority: critical`, or the issue describes data loss, security, or a production outage) **and** you are highly confident in the fix (clear root cause, minimal scoped change, all relevant tests pass). Only in that case, create as ready for review (omit `--draft`).
+   - **6A: Reproduction-only PR (reproducible but not solved)** — always draft.
      - Title: `test: reproduce #$ISSUE_NUMBER — <short bug description>`
      - Body should include:
        - What the bug is (in your own words, based on the issue)

diff --git a/.github/templates/preview-comment.md b/.github/templates/preview-comment.md
@@ -14,11 +14,6 @@
 <td>$DATABASE_LINK</td>
 </tr>
 <tr>
-<td><img src="https://fly.io/phx/ui/images/favicon/favicon-595d1312b35dfe32838befdf8505515e.ico" width="20" height="20" alt="Fly.io"> <strong>Electric (Fly.io)</strong></td>
-<td align="center">$ELECTRIC_STATUS</td>
-<td>$ELECTRIC_LINK</td>
-</tr>
-<tr>
 <td><img src="https://vercel.com/favicon.ico" width="20" height="20" alt="Vercel"> <strong>API (Vercel)</strong></td>
 <td align="center">$API_STATUS</td>
 <td>$API_LINK</td>

diff --git a/.github/workflows/build-cli.yml b/.github/workflows/build-cli.yml
@@ -0,0 +1,79 @@
+name: Build CLI Distribution
+
+on:
+  push:
+    tags: ["cli-v*"]
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Build ${{ matrix.target }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-14
+            target: darwin-arm64
+          - os: ubuntu-latest
+            target: linux-x64
+
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: .bun-version
+
+      - name: Setup Node.js (for native addon compilation)
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: 22
+
+      - name: Install dependencies
+        run: bun install --frozen
+
+      - name: Build distribution
+        working-directory: packages/cli
+        env:
+          RELAY_URL: https://relay.superset.sh
+          CLOUD_API_URL: https://api.superset.sh
+        run: bun run build:dist --target=${{ matrix.target }}
+
+      - name: Upload tarball
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: superset-${{ matrix.target }}
+          path: packages/cli/dist/superset-${{ matrix.target }}.tar.gz
+          if-no-files-found: error
+
+  release:
+    name: Create GitHub Release
+    needs: build
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/cli-v')
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          path: release-artifacts
+          pattern: superset-*
+          merge-multiple: true
+
+      - name: Create Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            release-artifacts/*.tar.gz \
+            --title "Superset CLI ${{ github.ref_name }}" \
+            --generate-notes \
+            --draft
diff --git a/.github/workflows/build-desktop.yml b/.github/workflows/build-desktop.yml
@@ -41,16 +41,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Setup Bun
         id: setup-bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.2"
+          bun-version-file: .bun-version
 
       - name: Cache dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.bun/install/cache
@@ -104,6 +104,7 @@ jobs:
           NEXT_PUBLIC_ELECTRIC_URL: ${{ secrets.NEXT_PUBLIC_ELECTRIC_URL }}
           SENTRY_DSN_DESKTOP: ${{ secrets.SENTRY_DSN_DESKTOP }}
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          RELAY_URL: ${{ secrets.RELAY_URL }}
           SUPERSET_WORKSPACE_NAME: superset
         run: bun run compile:app
 
@@ -135,23 +136,23 @@ jobs:
           }
 
       - name: Upload DMG artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ inputs.artifact_prefix }}-mac-${{ matrix.arch }}-dmg
           path: apps/desktop/release/*.dmg
           retention-days: ${{ inputs.artifact_retention_days }}
           if-no-files-found: error
 
       - name: Upload ZIP artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ inputs.artifact_prefix }}-mac-${{ matrix.arch }}-zip
           path: apps/desktop/release/*.zip
           retention-days: ${{ inputs.artifact_retention_days }}
           if-no-files-found: error
 
       - name: Upload auto-update manifest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ inputs.artifact_prefix }}-mac-${{ matrix.arch }}-update-manifest
           path: apps/desktop/release/*-mac.yml
@@ -165,16 +166,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Setup Bun
         id: setup-bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.2"
+          bun-version-file: .bun-version
 
       - name: Cache dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.bun/install/cache
@@ -185,6 +186,9 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen --ignore-scripts
 
+      - name: Install Linux native build deps
+        run: sudo apt-get update && sudo apt-get install -y libx11-dev libxkbfile-dev
+
       - name: Install desktop native dependencies
         working-directory: apps/desktop
         run: bun run install:deps
@@ -226,6 +230,7 @@ jobs:
           NEXT_PUBLIC_ELECTRIC_URL: ${{ secrets.NEXT_PUBLIC_ELECTRIC_URL }}
           SENTRY_DSN_DESKTOP: ${{ secrets.SENTRY_DSN_DESKTOP }}
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          RELAY_URL: ${{ secrets.RELAY_URL }}
           SUPERSET_WORKSPACE_NAME: superset
         run: bun run compile:app
 
@@ -247,15 +252,15 @@ jobs:
           }
 
       - name: Upload AppImage artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ inputs.artifact_prefix }}-linux-appimage
           path: apps/desktop/release/*.AppImage
           retention-days: ${{ inputs.artifact_retention_days }}
           if-no-files-found: error
 
       - name: Upload Linux auto-update manifest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ inputs.artifact_prefix }}-linux-update-manifest
           path: apps/desktop/release/*-linux.yml