Superset Updates & Release Notes

Superset Is Now Paradev

Superset is now Paradev, and we raised an $11.5M seed round to help you run an army of coding agents. Everything carries over: your account, workspaces, settings, and the superset command. Read the announcement.

Plugins for Everyone

Plugins are now on for every account. Install a plugin once, and Claude Code, Codex, Cursor, and the other agents you run in Paradev get its skills on every machine. Claude Code and Codex also get its tools.

• A plugin that needs an account installs only after you connect it, so agents never get tools that fail until you finish signing in
• Connected accounts live in one place on the plugin page, and the Enable and Disable switches are gone

Open Plugins in the sidebar to install one. Docs: Plugins.

Improvements

• Sort automations by last run - click the Last run header to sort by time or by result, with failed and missed runs first
• Commit and push from the PR menu - once a branch has a pull request, its menu in the tab bar lists Commit and Push
• Open a pull request on GitHub - ⌘-click any pull request link to open it in the browser instead of the PR pane
• A simpler Workspaces view - search, location, project, people, and Show archived are the only filters, and rows sort by last activity
• One sidebar - the new sidebar is now the only sidebar, and its toggle is gone from Settings → Experimental
• New panes take focus - a pane you open gets the keyboard, so ⌘W closes it, and opening something already open jumps to it instead of a copy
• A clearer Share popover - Add people opens an invite view with suggested people and teams, and you can pick several at once
• Get the close warning back - Settings → Terminal → Warn before closing a running terminal turns it on again after "Don't ask again"
• See who is on a page now - in the browser, hover an avatar in a page header to see Active or when that person was last there, as in the desktop app
• Branch errors say why - the branch picker says when the host is offline or unreachable, or the folder is missing
• Mobile pane paused - last week's Mobile pane is off for now while we teach agents to build for and check the simulator themselves. It comes back soon
• Early access: cloud workspaces stay awake while their agent works and stop after an idle hour, sign Codex in with a ChatGPT plan, join sidebar tag folders, and show every pull request their agent opened
• Experimental: the redesigned chat behind the acp-chat flag can edit a sent message, pick MCP servers with /mcp, and carry on a chat that an app update cut off

Bug fixes

• A reused sign-in token no longer logs you out on every machine at once, contributed by @sahiljagtap08
• Automations that continue a session no longer start a new agent session on every run when the agent is a custom one, contributed by @andyst-dev
• Dialogs stay open when focus moves to another window
• Importing a repository with a broken HEAD now fails with a clear error instead of committing onto it
• Renaming a tab from its context menu starts editing right away
• A pinch-zoomed browser pane stays filled on pages with their own zoom
• A failed plugin connect shows an error instead of a blank page, and a disconnected Google account stays disconnected
• Importing a folder whose name ends in a space now works
• superset workspaces delete reports what happened to each id

Plugins for Everyone

Plugins are now on for every account. Install a plugin once, and Claude Code, Codex, Cursor, and the other agents you run in Superset get its skills on every machine. Claude Code and Codex also get its tools.

• A plugin that needs an account installs only after you connect it, so agents never get tools that fail until you finish signing in
• Connected accounts live in one place on the plugin page, and the Enable and Disable switches are gone

Open Plugins in the sidebar to install one. Docs: Plugins.

Improvements

• Sort automations by last run - click the Last run header to sort by time or by result, with failed and missed runs first
• Commit and push from the PR menu - once a branch has a pull request, its menu in the tab bar lists Commit and Push
• Open a pull request on GitHub - ⌘-click any pull request link to open it in the browser instead of the PR pane
• A simpler Workspaces view - search, location, project, people, and Show archived are the only filters, and rows sort by last activity
• One sidebar - the new sidebar is now the only sidebar, and its toggle is gone from Settings → Experimental
• New panes take focus - a pane you open gets the keyboard, so ⌘W closes it, and opening something already open jumps to it instead of a copy
• A clearer Share popover - Add people opens an invite view with suggested people and teams, and you can pick several at once
• Get the close warning back - Settings → Terminal → Warn before closing a running terminal turns it on again after "Don't ask again"
• See who is on a page now - in the browser, hover an avatar in a page header to see Active or when that person was last there, as in the desktop app
• Branch errors say why - the branch picker says when the host is offline or unreachable, or the folder is missing
• Mobile pane paused - last week's Mobile pane is off for now while we teach agents to build for and check the simulator themselves. It comes back soon
• Early access: cloud workspaces stay awake while their agent works and stop after an idle hour, sign Codex in with a ChatGPT plan, join sidebar tag folders, and show every pull request their agent opened
• Experimental: the redesigned chat behind the acp-chat flag can edit a sent message, pick MCP servers with /mcp, and carry on a chat that an app update cut off

Bug fixes

• A reused sign-in token no longer logs you out on every machine at once, contributed by @sahiljagtap08
• Automations that continue a session no longer start a new agent session on every run when the agent is a custom one, contributed by @andyst-dev
• Dialogs stay open when focus moves to another window
• Importing a repository with a broken HEAD now fails with a clear error instead of committing onto it
• Renaming a tab from its context menu starts editing right away
• A pinch-zoomed browser pane stays filled on pages with their own zoom
• A failed plugin connect shows an error instead of a blank page, and a disconnected Google account stays disconnected
• Importing a folder whose name ends in a space now works
• superset workspaces delete reports what happened to each id

A Mobile Pane for Simulators and Emulators #8280

Run your app on an iOS simulator or Android emulator in a pane beside the agent that is building it.

• Pick any simulator or emulator from the device menu; a shut-down device boots when you choose it
• Home, Screenshot, and Rotate keys under the screen, plus Back and Recent apps on Android and Reload for React Native apps

Press ⌘⇧M to split the current pane with a mobile simulator. You need Xcode for iOS or the Android SDK for Android.

Share Pages with People and Teams #8318 #8317

A page no longer has to be private or visible to the whole org. Share it with one teammate, a team, or someone outside your org, and choose what they can do.

• Give each person Can view or Can comment, and set general access to only invited people, your org, or anyone with the link
• People outside your org get an invite, and their access starts when they join
• Pages shared with you collect under a new Shared with me tab
• Comments can carry up to four images: attach, paste, or drag them in, and agents reading the thread can fetch the screenshot #7875

Open a page and click Share to invite someone.

Pull Request Activity Timeline #8398 #8428 #8429

The pull request page's comments section is now an Activity rail: comments, reviews, review threads, and commits in one stream, oldest first.

• Reply to a review thread from the rail, and long comments fold behind Show more
• Resolved and outdated threads fold to a single line, so open threads stay on top
• GitHub pull request links in chat, markdown, pages, and the terminal open the pull request pane instead of a browser

Add a Host over SSH #8396

Go to Settings → Hosts → Set up a host over SSH, enter the SSH destination, and Paradev installs and registers the host in an embedded terminal. Passwords, MFA, and host-key prompts work as in any terminal. From a terminal, the same thing is one command:

superset hosts add user@my-box

A New Name Later This Month

Superset will have a new name later this month. Only the name, logo, website, and email domain change: your account, workspaces, links, and the superset command keep working. Read the announcement.

Improvements

• Release notes in the app - after an update, the sidebar shows a card for the new release, and clicking it opens its highlights #8563
• Nested task labels - a label like acme/website creates its parent, and the new Label filter in the Tasks view (or superset tasks list --labels acme) matches a label and everything under it #8466 #8458
• Business invoices - checkout now takes a legal business name and VAT or tax ID, and both show on every invoice #8452
• Worktree folders named from your prompt - a new workspace's folder takes its name from the prompt instead of a random word pair #8370
• Clearer connection status - connecting and reconnecting show as a small pill at the top of the workspace instead of a strip along the bottom #8530
• "GitHub unreachable" says why - hover the notice to see which machine is affected, the error it hit, and when it retries #8558
• Autumn plugin - connect Autumn from Plugins so agents can read customers, plans, and balances #8593
• Paradev for iPhone - queued messages open in a sheet with Send now, and sent images show in the chat bubble and open full screen #8479 #8496
• Experimental: the redesigned chat behind the early-access acp-chat flag gets ⌘F find, dictation, images the agent reads or captures, long pastes folded into cards, an image gallery, and undo for a closed chat tab #8403 #8499 #8404 #8577 #8573 #8383

Bug fixes

• ⌘C copies a selection made inside Codex and Claude Code, and keys typed while a terminal attaches are no longer lost #8456
• Claude Code scrolls with native acceleration again #8521
• Design mode notes go into the agent's input again instead of being sent right away #8603
• A terminal opened from the tab bar + menu keeps focus #8602
• Plugin tools work in agents for people in more than one organization #8450 #8414
• Gmail triggers keep firing for connections made through the Gmail plugin #8580
• File change detection no longer goes silent, and no longer leaves macOS fseventsd using gigabytes of memory #8539
• The Changes diff refreshes once a missing base branch is fetched #8299
• Updating a task no longer clears its assignee #8457
• Pro prices show the same amount and billing period everywhere #8605 #8608
• Deleting a workspace works when its repository and worktree were both moved or deleted outside Paradev #8597 #8600

A Mobile Pane for Simulators and Emulators

Run your app on an iOS simulator or Android emulator in a pane beside the agent that is building it.

• Pick any simulator or emulator from the device menu; a shut-down device boots when you choose it
• Home, Screenshot, and Rotate keys under the screen, plus Back and Recent apps on Android and Reload for React Native apps

Press ⌘⇧M to split the current pane with a mobile simulator. You need Xcode for iOS or the Android SDK for Android.

Share Pages with People and Teams

A page no longer has to be private or visible to the whole org. Share it with one teammate, a team, or someone outside your org, and choose what they can do.

• Give each person Can view or Can comment, and set general access to only invited people, your org, or anyone with the link
• People outside your org get an invite, and their access starts when they join
• Pages shared with you collect under a new Shared with me tab
• Comments can carry up to four images: attach, paste, or drag them in, and agents reading the thread can fetch the screenshot

Open a page and click Share to invite someone.

Pull Request Activity Timeline

The pull request page's comments section is now an Activity rail: comments, reviews, review threads, and commits in one stream, oldest first.

• Reply to a review thread from the rail, and long comments fold behind Show more
• Resolved and outdated threads fold to a single line, so open threads stay on top
• GitHub pull request links in chat, markdown, pages, and the terminal open the pull request pane instead of a browser

Add a Host over SSH

Go to Settings → Hosts → Set up a host over SSH, enter the SSH destination, and Superset installs and registers the host in an embedded terminal. Passwords, MFA, and host-key prompts work as in any terminal. From a terminal, the same thing is one command:

superset hosts add user@my-box

A New Name Later This Month

Superset will have a new name later this month. Only the name, logo, website, and email domain change: your account, workspaces, links, and the superset command keep working. Read the announcement.

Improvements

• Release notes in the app - after an update, the sidebar shows a card for the new release, and clicking it opens its highlights
• Nested task labels - a label like acme/website creates its parent, and the new Label filter in the Tasks view (or superset tasks list --labels acme) matches a label and everything under it
• Business invoices - checkout now takes a legal business name and VAT or tax ID, and both show on every invoice
• Worktree folders named from your prompt - a new workspace's folder takes its name from the prompt instead of a random word pair
• Clearer connection status - connecting and reconnecting show as a small pill at the top of the workspace instead of a strip along the bottom
• "GitHub unreachable" says why - hover the notice to see which machine is affected, the error it hit, and when it retries
• Autumn plugin - connect Autumn from Plugins so agents can read customers, plans, and balances
• Superset for iPhone - queued messages open in a sheet with Send now, and sent images show in the chat bubble and open full screen
• Experimental: the redesigned chat behind the early-access acp-chat flag gets ⌘F find, dictation, images the agent reads or captures, long pastes folded into cards, an image gallery, and undo for a closed chat tab

Bug fixes

• ⌘C copies a selection made inside Codex and Claude Code, and keys typed while a terminal attaches are no longer lost
• Claude Code scrolls with native acceleration again
• Design mode notes go into the agent's input again instead of being sent right away
• A terminal opened from the tab bar + menu keeps focus
• Plugin tools work in agents for people in more than one organization
• Gmail triggers keep firing for connections made through the Gmail plugin
• File change detection no longer goes silent, and no longer leaves macOS fseventsd using gigabytes of memory
• The Changes diff refreshes once a missing base branch is fetched
• Updating a task no longer clears its assignee
• Pro prices show the same amount and billing period everywhere
• Deleting a workspace works when its repository and worktree were both moved or deleted outside Superset

Redesigned Pull Request Page

A pull request now opens as its own page: a header with state, labels, and author, an info rail for merge status, reviews, and checks, and a comment composer that posts as you.

• Switch between Summary and Changes tabs; checks and reviewers fold into the header when the pane is narrow
• Reviews and comments collapse into rows, and bot findings show a title and severity line
• Draft PRs get a Ready for review button, and reviewers link straight to their GitHub profile

One Tasks View That Follows Your Tracker

The Tasks tab now mirrors whichever tracker your org uses. Pick it once in Settings → Organization → Track tasks in, and the separate Linear tab is gone.

• Paradev tasks can be filed under a team with --team, and admins can rename a team's task key (for example DESIG → ART) from Settings → Teams

Docs: Tasks.

Four New Plugins

Connect Google Calendar, Vercel, Neon, and PostHog from Plugins, so an agent can check your schedule, trigger a deploy, query a database, or look up an account.

• Google Calendar reuses your existing Google connection from Gmail
• Vercel, Neon, and PostHog connect through each vendor's own hosted MCP server

Improvements

• Restore deleted and merged workspaces - right-click an archived workspace on the Workspaces tab and choose Restore to re-create its worktree on the original branch
• ⌘; workspace switcher - cycles workspaces that need input, just finished, or are running, the same way ⌘-Tab cycles apps
• Automations get a PR closed trigger - react to a pull request closed without merging, separate from Merged
• Comment previews on pages - hover a page's comment count to see the newest reply without opening it
• CLI terminal control - superset agents wait, raw keys in superset terminals send, superset terminals attach over SSH, and superset panes let you script terminals and agents directly
• superset hosts add turns any machine you can reach over SSH into a host in one command; superset snapshot and superset agents explain show every workspace, terminal, and agent, or why one is in its current state
• superset workspaces archive replaces workspaces delete (clearer name, same command), and superset workspaces sleep puts a cloud workspace to sleep
• Import browser logins - pull saved logins from more Chromium-based browsers on macOS, not just Chrome
• Hermes token usage - Hermes Agent's usage now shows in Settings → Usage with its own cost estimate
• Experimental: a redesigned chat surface (streaming replies, subagents, background work across every chat) keeps advancing behind the early-access acp-chat flag. Its composer gets denser model and mode pickers with ⌘1-9 to jump to a model, and a background chat tab now resumes instead of opening blank

Bug fixes

• Workspace startup no longer force-deletes a folder with uncommitted changes during cleanup
• The desktop app always opens v2 now and migrates every v1 setup instead of silently falling back
• The Linear issue picker lists triage and backlog issues
• The Slack plugin now acts as the person who connected it, not a shared identity
• ⌘O opens the editor again, with clearer shortcut names
• Quit Completely stops every v2 pty-daemon
• Option-drag selects terminal text over a TUI that captures the mouse
• Dragging a Files tab row onto a terminal pastes the path instead of failing
• Renaming or moving a file in the Files tab onto a name that is already taken shows a conflict, not a server error
• Pull request diffs load even without a matching workspace repository
• Hardened what app windows are allowed to load and open, contributed by @PascalOrdano18
• Linux: GPU acceleration is no longer disabled, and clipboard image paste works in terminals, contributed by @pgilmore and @dennisklappe

Redesigned Pull Request Page

A pull request now opens as its own page: a header with state, labels, and author, an info rail for merge status, reviews, and checks, and a comment composer that posts as you.

• Switch between Summary and Changes tabs; checks and reviewers fold into the header when the pane is narrow
• Reviews and comments collapse into rows, and bot findings show a title and severity line
• Draft PRs get a Ready for review button, and reviewers link straight to their GitHub profile

One Tasks View That Follows Your Tracker

The Tasks tab now mirrors whichever tracker your org uses. Pick it once in Settings → Organization → Track tasks in, and the separate Linear tab is gone.

• Superset tasks can be filed under a team with --team, and admins can rename a team's task key (for example DESIG → ART) from Settings → Teams

Docs: Tasks.

Four New Plugins

Connect Google Calendar, Vercel, Neon, and PostHog from Plugins, so an agent can check your schedule, trigger a deploy, query a database, or look up an account.

• Google Calendar reuses your existing Google connection from Gmail
• Vercel, Neon, and PostHog connect through each vendor's own hosted MCP server

Improvements

• Restore deleted and merged workspaces - right-click an archived workspace on the Workspaces tab and choose Restore to re-create its worktree on the original branch
• ⌘; workspace switcher - cycles workspaces that need input, just finished, or are running, the same way ⌘-Tab cycles apps
• Automations get a PR closed trigger - react to a pull request closed without merging, separate from Merged
• Comment previews on pages - hover a page's comment count to see the newest reply without opening it
• CLI terminal control - superset agents wait, raw keys in superset terminals send, superset terminals attach over SSH, and superset panes let you script terminals and agents directly
• superset hosts add turns any machine you can reach over SSH into a host in one command; superset snapshot and superset agents explain show every workspace, terminal, and agent, or why one is in its current state
• superset workspaces archive replaces workspaces delete (clearer name, same command), and superset workspaces sleep puts a cloud workspace to sleep
• Import browser logins - pull saved logins from more Chromium-based browsers on macOS, not just Chrome
• Hermes token usage - Hermes Agent's usage now shows in Settings → Usage with its own cost estimate
• Experimental: a redesigned chat surface (streaming replies, subagents, background work across every chat) keeps advancing behind the early-access acp-chat flag. Its composer gets denser model and mode pickers with ⌘1-9 to jump to a model, and a background chat tab now resumes instead of opening blank

Bug fixes

• Workspace startup no longer force-deletes a folder with uncommitted changes during cleanup
• The desktop app always opens v2 now and migrates every v1 setup instead of silently falling back
• The Linear issue picker lists triage and backlog issues
• The Slack plugin now acts as the person who connected it, not a shared identity
• ⌘O opens the editor again, with clearer shortcut names
• Quit Completely stops every v2 pty-daemon
• Option-drag selects terminal text over a TUI that captures the mouse
• Dragging a Files tab row onto a terminal pastes the path instead of failing
• Renaming or moving a file in the Files tab onto a name that is already taken shows a conflict, not a server error
• Pull request diffs load even without a matching workspace repository
• Hardened what app windows are allowed to load and open, contributed by @PascalOrdano18
• Linux: GPU acceleration is no longer disabled, and clipboard image paste works in terminals, contributed by @pgilmore and @dennisklappe

File explorer, built-in editor, and cross-workspace search

Each workspace has a file tree, a built-in editor, and search across workspaces.

File Explorer

Browse and manage your workspace's files from the sidebar:

• Hierarchical tree with git decorations showing changed files
• Create, rename, delete, move, and copy files with context menus
• Rename inline, and drag files or folders to move them. Open editors, including ones with unsaved edits, follow the new path
• Toggle hidden files; refresh directory listings
• Search files with instant results
• Material icon theme for at-a-glance file types

Built-in Editor

Ways in:

• Click any file in the explorer
• From a diff: double-click a line or right-click → Edit Here to jump to that exact spot in the raw file (see Diff Viewer)

The editor also opens files outside the workspace, including files reached through a symlink, and saves your edits to them. Creating, deleting, moving, and copying files stay inside the workspace.

For longer editing sessions, ⌘O opens the workspace in your IDE (IDE Integration).

Save and Review External Changes

Use Save or ⌘S to write your edits. If an agent or script changes the file while you have unsaved edits, the editor keeps your buffer and shows an external-change banner. Click Compare to review the disk and local versions side by side. Saving a conflicted file opens the same review.

• Keep editing preserves your unsaved edits without writing to disk.
• Reload from disk replaces your buffer with the disk version. It is unavailable if the file cannot be read.
• Overwrite file replaces the disk version with your edits.

The editor does not merge simultaneous edits.

Auto Save

Auto Save is off by default. Set it in Settings → Files & Editor → Editing → Auto Save :

• After delay (3s): saves 3 seconds after you stop typing
• On focus change: saves when you leave the file's pane or the Superset window
• On window change: saves when the Superset window loses focus

Auto Save applies to files you edit by hand, including files in editors that are not active. It pauses for a file with a save conflict or a failed save until you resolve it.

Markdown Links

Web links in Markdown previews follow Settings → Browser → URL links, and links to Superset Pages follow Settings → Files & Editor → Page links. By default, Shift-click opens a new tab, Cmd/Ctrl-click opens a split browser pane, and Cmd/Ctrl+Shift-click opens the system browser. A plain click keeps you editing.

⌘C in a rendered Markdown view copies the text as you see it, without backticks or fences. To copy the Markdown source, right-click the selection and choose Copy as Markdown.

Cross-Workspace Search

The search bar searches across all open workspaces.

Image Viewer

Images open fitted to the pane, with standard viewer navigation:

• Zoom: pinch, or Ctrl/⌘ + scroll (anchored at the cursor, 25%–1600%)
• Pan: two-finger scroll, or click and drag
• Keyboard: + / − to zoom, arrow keys to pan, 0 to reset
• Reset: double-click, or click the zoom badge that appears while zoomed

Tabs, Splits, and Panes

Drop a pane onto the tab strip to create a new tab; mix terminals, files, diffs, and browser panes in one layout. The browser pane keeps its state when you switch workspaces.

If one pane fails to render, it shows This pane hit an error with Retry and Close pane. The rest of the workspace keeps working. Close pane also removes the pane from the saved layout, so it does not come back after a reload.

Coming Next: Native iPad Support #7995 #8102

The next mobile build uses the full iPad screen in portrait and landscape, with a Pages grid and support for floating keyboards; watch for the update on the App Store, with iPad fixes contributed by @vahidkowsari.

All Your Automation Runs #7773 #8074

Find failed runs and retry your automations from one place in Automations → All runs.

• Filter to your runs or the whole team's, then inspect what triggered a run
• Select failed runs to retry their automations together
• Click the sidebar's failure badge to go straight to your failed runs

Docs: Automations.

Linear Issues, Live #8070 #8094 #7963

Browse and create Linear issues directly in Tasks → Linear, with list and board views, team and assignee filters, and an option to import an issue as a separate Paradev task.

• Each member connects their own Linear account
• Paradev tasks now have short team IDs such as ENG-123

Screenshots show sample issues in the desktop app.

Bring Your Apps Into the Prompt #8096

Type @ in the new-workspace prompt or terminal input (⌘I) to pick an installed plugin, then tell your agent what to do with it.

• Connect Superhuman, Stripe, Sentry, Granola, Circleback, or YNAB from Plugins, with skills for working with email, payments, errors, meeting notes, and budgets #8093 #8047 #7912 #7960 #7967
• Connect more than one account on a plugin page and choose which account an event trigger listens to in the automation editor #8003

Improvements

• Restore deleted projects - click Undo or recover a project for up to 30 days from Settings → Projects → Recently deleted #7896
• Review code beside your agent - open Code in the workspace's PR pane to see changed files, diffs, and review threads #8007
• Pages remember team input - ask your agent to build a poll, RSVP sheet, or shared checklist as a Page; signed-in teammates' answers persist and update live #8015
• New models - choose GPT-6.1 Sol or Claude Sonnet 5.5 in the agent model picker; GPT-6.1 Sol support contributed by @joshrchambers #8009 #7935
• File and browser preferences - find auto save in Settings → Files & Editor and URL handling in Settings → Browser #7916
• Invite from people pickers - add a teammate without leaving the person picker you're using #7943
• Shared terminal sizing - a banner explains when a phone or smaller window is making your terminal narrower #7996
• Integration plan changes - Linear and GitHub integrations require Pro; free organizations see the upgrade option in Settings → Integrations #7985 #8048
• CLI help for your shell - generate completions, inspect available commands, or check your configuration with the commands below; CLI docs #8030

superset completion zsh
superset schema
superset config check

A Peek at What’s Next

These are still in development or limited access, with no release date yet.

• Cloud automations - run an agent in a fresh cloud workspace or continue its previous session; early-access users can choose Cloud in the automation editor #7922
• Agent chat - start Claude, Codex, or Pi in a conversation with attachments and model choices; available from the new-workspace screen for accounts with chat enabled #8058
• Talk to your agents from your phone - we're prototyping voice conversations to check on workspaces and send an agent a follow-up; this is an internal prototype, not available in the App Store yet #8117

Bug fixes

• A pane that crashes now shows its own recovery screen without taking down the workspace #7983
• Canceling a repository clone closes the dialog and stops the clone #8063
• Files outside the workspace folder can be saved again #7982
• Text typed after a URL no longer becomes part of the link #8019
• Merging from the PR pane shows a pending state and refreshes the result #8052
• Remote terminals stay connected when their host's control connection is replaced #7938
• Empty repositories get an initial commit so workspaces can be created #8000
• Integration errors now show their explanation after you return from signing in #7985

adds GPT-6.1 Sol support

Adds GPT-6.1 Sol support to Codex: the model is selectable, its usage pricing is tracked, and it accepts the full reasoning effort range (low through ultra).

New Features

• Added GPT-6.1 Sol to the available chat and Codex model options, with six reasoning effort levels.
• Added a higher pricing tier for prompts exceeding 272,000 tokens.

Bug Fixes

• Corrected GPT-6 Luna’s supported reasoning effort options.

• Records GPT-6.1 Sol pricing, including cache reads; long-context rates apply above 272k prompt tokens instead of the standard 200k threshold.

• Registers the model in the codex model list and the max and ultra reasoning effort tiers.

• Bumps the pricing table date to 2026-09-30.

Two support reports about Linear "not connecting"

They had different causes, and both left the user without an explanation.

Free orgs looped on reconnect.

Since #7947, the hourly suspend cron revokes Linear and GitHub for orgs outside the sync policy. It has revoked 1,334 Linear connections so far. Connecting was still open, though. A free org could connect, get revoked at the next hour, and then see "Linear authorization expired. Reconnect to resume syncing." Since the cron started, 5 of the 8 new Linear connections were revoked within an hour.

• linear/connect and github/install send an org that organizationSyncsNow rejects to /settings/billing, so it never reaches Linear or GitHub. This is the same predicate the cron uses, so the two can't disagree.
• New integration.syncAllowed query. Its callers are in feat(integrations): free organizations get the Pro Features dialog for Linear and GitHub #8048, which merges after this is live: the web pages redirect free orgs to billing, desktop's Settings → Integrations opens the Pro dialog, and the CLI checks before connecting.

A paid org's Linear workspace was already linked to a coworker's separate org.

The callback returned workspace_already_linked, but the Linear page had no message for it.

• The Linear callback now passes owner and the page says "…already connected by {owner}. Ask them to disconnect first.", as Slack does.

Two older bugs found while checking the above:

• No integration callback toast has ever shown.
  IntegrationErrorHandler publishes in the page's effect. That runs before the root layout's subscribes, and sonner 2.0.7 drops anything published before then. The toast is now deferred one task (not cancelled on cleanup) and has a stable id so StrictMode can't show it twice.
• The {owner}/{detail} messages on Slack and Teams rendered the name blank, because Lingui filled the placeholder with nothing on the server. The placeholder is now passed through as its own value.

The Linear plugin gets its own personal connection.

The plugin and Tasks sync shared one per-person linear row, which uses our Linear OAuth app. Grants from that app turn on webhook deliveries. So #7947's revoke broke the plugin for free orgs, reconnecting through the plugin turned webhooks back on until the next revoke, and uninstalling the plugin disconnected sync.

• New linear_mcp connector: a dynamic client against mcp.linear.app, like notion_mcp / sentry_mcp. It uses the client-metadata document on https and registration on localhost. It also offers a Personal API key option, since Linear's MCP server accepts keys as bearer tokens. Identity comes from the server's get_user("me"). These tokens belong to Linear's MCP app, so no webhooks follow and the cron never touches them. The plugin stays free.
• plugins/linear 1.5.3 points at linear_mcp. Existing installs follow through installConnector, and each person signs in once.
• The suspend cron revokes only OAuth linear rows. An API key starts no webhooks, so revoking it only deleted the person's key.
• After merge: tag [email protected] (git tag [email protected] && git push --tags).

Not in this PR: the pricing page still lists "GitHub integration" under Free. Whether it moves to Pro is an open decision.

How I tested it

Local API and web on this workspace's Neon branch, signed in as the seeded dev admin, with temporary subscriptions and connections rows (deleted afterwards).

• Free org: both connect URLs return 302 to /settings/billing.
• Pro org: linear/connect returns 302 to linear.app/oauth/authorize, and github/install returns 302 to the dev GitHub App install page. Unchanged.
• Toasts in headless Chrome: the Linear conflict toast names the owner, the Slack and Teams owner toasts include the email, and oauth_denied now shows. One toast each.
• bun test in apps/api integrations (57 pass), typecheck for api/web/trpc/cli, biome, check:i18n.
• Plugin, end to end against the real mcp.linear.app with a local API: /api/connectors/linear_mcp/connect registered a client, then Linear consent and workspace picker (Superset). The callback saved a linear_mcp row keyed on the Linear user with read / write and a refresh token. Then tools/call get_workspace through /mcp/plugins/superset/linear returned the Superset workspace. After that I disconnected, uninstalled and revoked the key.
• check:plugins, 174 api integration tests, 84 connector/plugin tests.

Not tested: the Personal API key option on linear_mcp (no key available; Linear's docs say the MCP server accepts keys), the production client-metadata-document path (localhost always registers), a real Linear OAuth round-trip that hits the conflict (the page was checked by loading the callback's redirect URL directly), the CLI change beyond typecheck, and non-English rendering of the new strings.

Checklist

• PR title follows conventional commits (type(scope): subject)
• bun run lint and bun run typecheck pass (CI fails on lint warnings too)
• "Allow edits from maintainers" is checked on fork PRs (incomplete)

Summary by cubic

Linear and GitHub sync now require Pro: on free orgs, the connect routes redirect to billing instead of allowing a connection the hourly suspend cron would revoke. The Linear conflict toast now names the workspace owner, and callback toasts show correctly after being deferred past the root layout's subscription.

The Linear plugin and Tasks sync no longer share one linear connection row. The plugin uses a new linear_mcp connector on mcp.linear.app (OAuth or personal API key) that starts no webhooks, so the suspend cron now revokes only OAuth linear rows, and existing installs pick up the connector automatically. A new integration.syncAllowed query lets clients check the sync policy before connecting.

Summary by CodeRabbit

• New Features
  • Added support for connecting to Linear through its MCP endpoint using OAuth or a personal API key.
  • Linear connection-conflict messages now identify the existing owner or organization, with translations in supported languages.
• Bug Fixes
  • GitHub and Linear connections now redirect to billing settings when synchronization isn’t enabled.
  • Linear workspace conflicts now return users to integration settings with a clear message.
  • Linear suspension checks no longer target active connections that don’t use OAuth.
• Chores
  • Updated the Linear plugin version.

Lands the three self-describing/DX commands from #7103 as their own PR, rebuilt on today's main. The terminal primitives (wait, wait-output, send-keys) are a sibling PR; attach, resume-all and explain stay on #7103.

What is here

• superset completion <bash|zsh> prints a completion script generated from the command tree: command names at every level (an alias already typed is walked through), each command's flags and aliases, enum values for flags (--flag=value too) and positionals, and the globals. The script is printed byte for byte in every output mode (agent auto-JSON, --json, --quiet).
• superset schema prints the whole command tree as JSON, sorted and with absent fields omitted, so two versions diff cleanly. Internal-only and sandbox-hidden commands are left out, exactly as --help leaves them out.
• superset config check validates config.json: JSON syntax, the shape of auth, apiKey, and organizationId, token expiry, and keys this version does not read. Exits 1 on an error, 0 on warnings or when there is no file.
• Docs: three sections in the CLI reference, and a "Shell & tooling" section in superset --help.

Changed from #7103

• introspectCli() is built from the audience- and sandbox-filtered tree the runner already routed on, so it cannot list a command the run cannot execute (CodeRabbit), and the slot is cleared when run() returns (CodeRabbit). It returns CliDescription ({ name, version, root }) and both generators take that directly.
• The framework gains { raw: string } command results: printed verbatim under --json, --quiet, and agent mode, with no trailing newline added. completion returns one instead of writing to process.stdout itself, and --json no longer wraps the script in { shell, script }.
• The runner enforces .enum() on positional arguments (superset completion fish → Valid values: bash, zsh). That replaces the command-level lookup CodeRabbit flagged for prototype-chain keys. No existing command declares an enum positional.
• config-check keys are a { [K in keyof SupersetConfig]-?: check } record: a field added to SupersetConfig does not compile until it has a check, and a check for a removed field is an excess key. Reading moved into checkConfigFile, which reports an unreadable file as an error instead of throwing (CodeRabbit). The expired-token warning says whether the next command will refresh. config check sets exit code 1 when the file is invalid.
• Schema: adds version, int/min/max, a separate SchemaArg shape, options sorted by name with a locale-independent comparator; enumVals → enum, envVar → env, isVariadic → variadic.
• Completion: the word walk is one generator shared by the bash and zsh scripts; visibleChildren is shared with help.ts.
• The runner exits quietly on EPIPE. superset schema | head printed Error: EPIPE: broken pipe, write; this was true of every command and is only more visible with document-sized output.
• packages/cli-framework gets a test script. It had none, so turbo and CI never ran its tests (the existing router, output, runner and interactive-help tests included).
• Tests: the bash script runs in a real bash with COMPREPLY assertions; the zsh script is parse-checked with zsh -n; introspectCli is exercised through run(); checkConfigFile is tested against a missing file and a directory.
• Not carried over: the herdr submodule pointer, the two HTML reports, and the orchestrate SKILL.md changes.

Verified

Each shell was driven by expect in a scratch session with this worktree's build first on PATH. In every one, superset term completed to superset terminals, superset terminals read -- listed --workspace through --json, superset ws cr completed to superset ws create, and superset completion offered bash zsh.

bash 3.2 cannot source a process substitution at all (it reads zero bytes, even for source <(echo …)), so the docs give the eval form for bash.

• superset schema --json is byte-identical across runs; SUPERSET_CLI_AUDIENCE=internal adds exactly the internal groups.
• superset config check against a valid, invalid, expired, missing and unreadable (directory) file: exit codes 0, 1, 0, 0, 1, with the human and --json output.
• superset completion zsh under CLAUDE_CODE=1, --json, and --quiet is the same script; superset schema prints JSON in every mode.
• /ci-check: lint:fix (no warnings), sherif, typecheck and check:i18n are clean. bun run test passes 22 of 25 turbo tasks from this worktree; the three that fail touch no file on this branch: trpc (7 deriveSandboxCredentials tests, a JWT signing error from an empty secret in the local env), host-service (5 here, 8 on a pristine origin/main checkout in the same session), desktop (34 git-helper tests that follow the directory, not the code: the same HEAD checked out at another path passes 7758 with the one known env-sensitive failure, as does origin/main).
• Each of the five commits typechecks and passes the framework tests on its own.
• Screenshots of every session, plus the schema and config check output: https://app.superset.sh/page/superset-schema-completion-and-config-check-1f42qt

Review follow-ups

• CodeRabbit: the generated zsh function declared local path, which zsh ties to PATH, so it ran with an empty PATH. Renamed to cmdpath in both shells; a test asserts no path local is ever generated.
• Greptile: an expired token with no refresh token was reported as logged in. config check now reports loggedIn: false with a warning naming the coming "Session expired", and uses the same five-minute leeway as resolveAuth (one constant in config.ts, read by both).
• Greptile: --priority=ur completes to --priority=urgent in both shells, including bash's split of the word at =.
• Greptile: enum values are validated for variadic positionals too.
• Greptile: a raw result is one that carries only raw; { raw, data } is data again, and the type forbids the combination.
• Greptile, alias completion: kept as is. Candidates are canonical names on purpose (ws, t, term, auto, org beside their full names would be noise); an alias already typed is walked through. The sentence in the docs that promised more was reworded.

After these: the four shell sessions were re-run on the rebuilt binary (every check passes), plus --priority=u in zsh and bash and a check that zsh's PATH is intact after completing.

Second round (cubic and CodeRabbit on the first follow-ups)

• Completion: the walk honours -- (everything after is positional, dispatch offers only the positional enum or files), skips a boolean's explicit true/false, and skips both words of readline's split --flag = value; a free-form value attached with = falls back to filename completion in both shells.
• Runner: empty output prints nothing again (the raw-result change had made it print a bare newline).
• Schema: conflicts lists an option's conflictsWith as flag names.
• Config check: whitespace-only credentials are errors (as resolveAuth treats them), expiresAt must be finite (1e400 parses to Infinity), and unknown keys inside auth get the same warning as top-level ones, with the key set tied to the type.
• Tests: the completion fixture's enum values no longer appear in the scripts' boilerplate; the introspection teardown test runs the CLI itself; the path guard matches any local naming path.
• Declined, with replies on the threads: --no- candidates (not advertised by --help either) and alias candidates (canonical names on purpose).

Every shell check was re-run on the rebuilt binary after this round, plus new live checks for --, boolean values and --workspace=<Tab> filenames in zsh and bash.

Third round

• A boolean given as --json=false lost the command context in bash, which splits it into --json, =, false: the walk now skips both split words, and --json=<Tab> offers false/true. Driving the real binary in bash 3.2 showed it hands over the unsplit word while readline still replaces only the text after =, so the --flag= prefix is added only when = is not in COMP_WORDBREAKS. The bash tests cover both modes in a temp fixture directory (cubic's cwd finding).
• Verified live in zsh 5.9, bash 5.3 and bash 3.2: superset --json=false completion <Tab> and superset completion --json=false <Tab> list bash zsh, superset --json=<Tab> lists false true, and every earlier shell check still passes.
• bash 3.2 offered no filenames for a free-form value after a space, because the fallback relied on compopt -o default, which that bash lacks. Without compopt the script now registers with complete -o default, so readline completes filenames itself whenever the function offers nothing. Driven live in bash 3.2 and 5.3: --workspace <Tab> lists files and directories, a directory completes with a trailing slash, my file.json comes back quoted, and command completion still ends with a space.

Summary by CodeRabbit

New Features

• Added Bash and Zsh shell completion scripts for CLI commands, options, and values.
• Added superset schema to output sorted JSON metadata about visible CLI commands and options.
• Added superset config check to validate local configuration and report errors and warnings.

Bug Fixes

• Positional arguments with configured choices are now validated.
• Raw command output no longer receives an extra newline, and broken-pipe errors are ignored.

Coming Next: Native iPad Support #7995 #8102

Coming Next: Native iPad Support

The next mobile build uses the full iPad screen in portrait and landscape, with a Pages grid and support for floating keyboards; watch for the update on the App Store, with iPad fixes contributed by @vahidkowsari.

All Your Automation Runs #7773 #8074

All Your Automation Runs

Find failed runs and retry your automations from one place in Automations → All runs.

• Filter to your runs or the whole team's, then inspect what triggered a run
• Select failed runs to retry their automations together
• Click the sidebar's failure badge to go straight to your failed runs

Docs:

Automations

Linear Issues, Live #8070 #8094 #7963

Linear Issues, Live

Browse and create Linear issues directly in Tasks → Linear, with list and board views, team and assignee filters, and an option to import an issue as a separate Superset task.

• Each member connects their own Linear account
• Superset tasks now have short team IDs such as ENG-123

Screenshots show sample issues in the desktop app.

Bring Your Apps Into the Prompt #8096

Bring Your Apps Into the Prompt

Type @ in the new-workspace prompt or terminal input (⌘I) to pick an installed plugin, then tell your agent what to do with it.

• Connect Superhuman, Stripe, Sentry, Granola, Circleback, or YNAB from Plugins, with skills for working with email, payments, errors, meeting notes, and budgets
• Connect more than one account on a plugin page and choose which account an event trigger listens to in the automation editor

Improvements

• Restore deleted projects - click Undo or recover a project for up to 30 days from Settings → Projects → Recently deleted
• Review code beside your agent - open Code in the workspace's PR pane to see changed files, diffs, and review threads
• Pages remember team input - ask your agent to build a poll, RSVP sheet, or shared checklist as a Page; signed-in teammates' answers persist and update live
• New models - choose GPT-6.1 Sol or Claude Sonnet 5.5 in the agent model picker; GPT-6.1 Sol support contributed by @joshrchambers
• File and browser preferences - find auto save in Settings → Files & Editor and URL handling in Settings → Browser
• Invite from people pickers - add a teammate without leaving the person picker you're using
• Shared terminal sizing - a banner explains when a phone or smaller window is making your terminal narrower
• Integration plan changes - Linear and GitHub integrations require Pro; free organizations see the upgrade option in Settings → Integrations
• CLI help for your shell - generate completions, inspect available commands, or check your configuration with the commands below;

superset completion zsh
superset schema
superset config check

A Peek at What’s Next

These are still in development or limited access, with no release date yet.

• Cloud automations - run an agent in a fresh cloud workspace or continue its previous session; early-access users can choose Cloud in the automation editor
• Agent chat - start Claude, Codex, or Pi in a conversation with attachments and model choices; available from the new-workspace screen for accounts with chat enabled
• Talk to your agents from your phone - we're prototyping voice conversations to check on workspaces and send an agent a follow-up; this is an internal prototype, not available in the App Store yet

Bug fixes

• A pane that crashes now shows its own recovery screen without taking down the workspace
• Canceling a repository clone closes the dialog and stops the clone
• Files outside the workspace folder can be saved again
• Text typed after a URL no longer becomes part of the link
• Merging from the PR pane shows a pending state and refreshes the result
• Remote terminals stay connected when their host's control connection is replaced
• Empty repositories get an initial commit so workspaces can be created
• Integration errors now show their explanation after you return from signing in

Safer File Editing #7711 #7693 #7692

Edit files next to your agents without losing work when a script or agent changes the same file.

• A banner tells you when the file changed on disk, with Compare to see both versions side by side
• Save conflicts offer Keep editing, Reload from disk, or Overwrite file, instead of silently replacing the newer version
• Turn on auto save after a delay, on focus change, or on window change in Settings → General, contributed by @theblondealex
• Double-click to rename and drag to move files in the file tree, contributed by @theblondealex

Docs: Editor.

Workspaces Start Instantly #7518

New workspaces and sessions open in about a second instead of waiting 5 to 20 seconds for an agent to name them. Your agent starts right away, and a name arrives a few seconds later.

• Linked GitHub issues and pull requests in your prompt help pick the name
• Questions and short prompts get a name too, refined after the agent's first reply
• Renaming a workspace yourself always wins

Docs: Workspaces.

GPT-6 and Claude Opus 5.5 #7741 #7783 #7894

Pick GPT-6 Astra, Sol, or Luna and Claude Opus 5.5 from the model picker when you start an agent, contributed by @haydenfd.

• GPT-6 works in Codex, OpenCode, and OMP, with Ultra effort on GPT-6 Astra in Codex
• Usage tracks costs for the new models
• Retired models no longer show up in the picker

Paradev for iPhone Is on the App Store

Paradev Mobile is live. Check on your agents, review diffs, and read Pages from your phone. Get it from the App Store or read the launch post.

• Setup in Settings → Mobile is now two steps with Remote Access turned on in place #7697
• The app tells a computer that never connected apart from one that went offline, and says what to do next #7661
• The ⋯ menu on a workspace can rename, pin, share, or delete it, and workspace details list its pull requests #7816 #7782

Improvements

• Clone from your GitHub repositories - search the repositories your GitHub login can reach when you add a project, contributed by @theblondealex #7694
• Sign in without leaving Settings - sign in to Claude Code and Codex accounts from a terminal inside Settings → Usage #7740
• Page links unfurl in Slack - posted page links show a title and preview to people who can open them #7817 #7821
• Stop a page watcher - stop an agent watching a page from its row in the watcher menu; public pages show a globe on the Share button #7820 #7766
• Rejoin the leaderboard with your full history - choose to publish everything since launch or the last 30 days #7651
• Google Calendar triggers removed - nobody used them; Gmail triggers stay #7796
• Desktop 1.29.0 or later is required - older versions show an update screen #7786

Bug fixes

• Continue with another agent now carries over the whole Claude conversation, not only the last few seconds #7825
• Copying from a rendered preview copies the text instead of Markdown, contributed by @andyst-dev #7591
• Terminal copies trim trailing whitespace like Ghostty, contributed by @nrutman #7709 #7868
• Terminal file links jump to their line and column, and URLs stop at their real end #7712 #7717
• Agents keep paste mode after a host restart #7691
• The sidebar keeps its order and group members, keyboard navigation includes pinned workspaces (contributed by @Ymirke), and you can drop rows beside workspace pills #7723 #7851 #7833
• Clicking a tab's close button no longer starts a drag #7714
• Long session names and dialog text wrap instead of overflowing, contributed by @Official-Krish and @kotaesaki #7707 #7837
• Links on a page open without blanking it, and opening a page no longer switches workspaces #7718 #7790
• Symlinked files open in the viewer, and managed configs update the file a symlink points to instead of replacing the link #7696 #7897
• Diffs no longer run custom Git text filters #7903
• Team review requests show without extra GitHub permissions #7788
• Large repositories with many ignore rules load files faster, contributed by @allthehatz #7860
• Fixed the Notion plugin failing to connect #7727

Safer File Editing #7711 #7693 #7692

Safer File Editing

Edit files next to your agents without losing work when a script or agent changes the same file.

• A banner tells you when the file changed on disk, with Compare to see both versions side by side
• Save conflicts offer Keep editing, Reload from disk, or Overwrite file, instead of silently replacing the newer version
• Turn on auto save after a delay, on focus change, or on window change in Settings → General, contributed by @theblondealex
• Double-click to rename and drag to move files in the file tree, contributed by @theblondealex

Editor banner saying the file changed on disk, with a Compare link

Docs: Editor.

Workspaces Start Instantly #7518

Workspaces Start Instantly

New workspaces and sessions open in about a second instead of waiting 5 to 20 seconds for an agent to name them. Your agent starts right away, and a name arrives a few seconds later.

• Linked GitHub issues and pull requests in your prompt help pick the name
• Questions and short prompts get a name too, refined after the agent's first reply
• Renaming a workspace yourself always wins

Docs: Workspaces.

GPT-6 and Claude Opus 5.5 #7741 #7783 #7894

GPT-6 and Claude Opus 5.5

Pick GPT-6 Astra, Sol, or Luna and Claude Opus 5.5 from the model picker when you start an agent, contributed by @haydenfd.

• GPT-6 works in Codex, OpenCode, and OMP, with Ultra effort on GPT-6 Astra in Codex
• Usage tracks costs for the new models
• Retired models no longer show up in the picker

Superset for iPhone Is on the App Store

Superset Mobile is live. Check on your agents, review diffs, and read Pages from your phone. Get it from the App Store or read the launch post.

Superset Mobile running a coding agent on an iPhone

• Setup in Settings → Mobile is now two steps with Remote Access turned on in place #7697
• The app tells a computer that never connected apart from one that went offline, and says what to do next #7661
• The ⋯ menu on a workspace can rename, pin, share, or delete it, and workspace details list its pull requests #7816 #7782

Mobile settings with a QR code to install the app and a Remote Access toggle

Improvements

• Clone from your GitHub repositories - search the repositories your GitHub login can reach when you add a project, contributed by @theblondealex #7694
• Sign in without leaving Settings - sign in to Claude Code and Codex accounts from a terminal inside Settings → Usage #7740
• Page links unfurl in Slack - posted page links show a title and preview to people who can open them #7817 #7821
• Stop a page watcher - stop an agent watching a page from its row in the watcher menu; public pages show a globe on the Share button #7820 #7766
• Rejoin the leaderboard with your full history - choose to publish everything since launch or the last 30 days #7651
• Google Calendar triggers removed - nobody used them; Gmail triggers stay #7796
• Desktop 1.29.0 or later is required - older versions show an update screen #7786

Bug fixes

• Continue with another agent now carries over the whole Claude conversation, not only the last few seconds #7825
• Copying from a rendered preview copies the text instead of Markdown, contributed by @andyst-dev #7591
• Terminal copies trim trailing whitespace like Ghostty, contributed by @nrutman #7709 #7868
• Terminal file links jump to their line and column, and URLs stop at their real end #7712 #7717
• Agents keep paste mode after a host restart #7691
• The sidebar keeps its order and group members, keyboard navigation includes pinned workspaces (contributed by @Ymirke), and you can drop rows beside workspace pills #7723 #7851 #7833
• Clicking a tab's close button no longer starts a drag #7714
• Long session names and dialog text wrap instead of overflowing, contributed by @Official-Krish and @kotaesaki #7707 #7837
• Links on a page open without blanking it, and opening a page no longer switches workspaces #7718 #7790
• Symlinked files open in the viewer, and managed configs update the file a symlink points to instead of replacing the link #7696 #7897
• Diffs no longer run custom Git text filters #7903
• Team review requests show without extra GitHub permissions #7788
• Large repositories with many ignore rules load files faster, contributed by @allthehatz #7860
• Fixed the Notion plugin failing to connect #7727

Links

• Plan: plans/20260927-recoverable-project-deletion.md
• Issue: Project ownership and deletion #7768 (supersedes the permission-tier approach in feat(desktop,host-service): owners and creators can delete a project #7867)

Summary

• Deleting a project is now a soft delete. It disappears for everyone on the chosen devices right away, running terminals and agents stop, and it can be restored for 30 days. After that a purge sweep removes it permanently.
• The delete dialog shows other people's live activity on each device, for example "Alice: 2 terminals running, 1 agent · active 3 min ago". It asks you to type the project name only when someone else has something running, and from the sidebar it offers Hide from sidebar as the alternative that affects only you.
• An organization owner or the device's owner can delete. Before, only organization owners could, so members couldn't delete projects on their own machines (Project ownership and deletion #7768).

Why / Context

The goal is to stop anyone from accidentally destroying a project other people are actively using. Stopping a deliberate insider is not the goal.

The old delete was permanent. Deleting the project row cascaded through its workspaces, tombstones, tags and PR links. No teardown ran. The terminal reaper then killed the orphaned sessions within about 5 minutes (shouldReapRow reaps rows whose workspace became null), including other people's running agents, with no warning. An owner who misclicked had no way back.

GitHub, GCP, Linear, Figma, Slack and Google Drive guard against this by making deletion recoverable, separating "remove for me" from "destroy for everyone", and warning with live activity. They don't layer permission tiers. This PR follows that pattern instead of #7867's approach: a project creator role, a server-side authorization endpoint, and a stale-count check.

How It Works

Host (packages/host-service)

• Migration 0037_project_soft_delete adds projects.deleted_at and deleted_by_user_id.
• project.remove (src/projects/project-deletion.ts):
  1. stamps deleted_at and archives every live workspace with archivedAt = deleted_at, then broadcasts;
  2. runs teardown (best-effort) and disposes terminal sessions for each workspace, in parallel;
  3. leaves the worktrees on disk.
• project.restore clears deleted_at and un-archives the workspaces whose archivedAt equals it and whose worktree still exists. Workspaces the user deleted earlier stay deleted.
• project.listDeleted backs the Recently deleted view.
• project.deletionImpact reports, per workspace, who created it, how many terminals and agents are running, and when it was last active. The dialog reads it once when it opens; nothing polls it.
• The purge sweep runs at startup and every 6 hours. After the window it removes the rows and clean worktrees; git refuses to remove dirty worktrees, so they stay. The repository folder is never removed.
• Deleted projects are hidden from project.list, project.get, findByPath, workspace creation and archived-workspace listings.
• Trap: the interrupted-delete reconciler would treat the kept worktrees as crashed deletes and destroy them, so it now skips soft-deleted projects. A test covers this and fails without the skip.
• Re-adding the same folder, or setting the project up again, restores it.

Desktop

• useProjectDeletionHosts: an org owner or device owner can delete, decided from the member lists. It replaces the org-owner-only check in both the settings page and the sidebar.
• DeleteProjectDialog:
  • a device checklist that defaults to this device, or else the only eligible device;
  • per-device live activity from deletionImpact;
  • type-the-name only when someone else is active;
  • Hide from sidebar when opened from the sidebar;
  • "restorable for 30 days" copy and an Undo toast.
• Recently deleted page (/settings/projects/deleted), like GitHub's deleted repositories or Linear's recently deleted view. Deleted projects stay out of the live list, which shows only a quiet "Recently deleted · N" link. The page lists each project with who deleted it, when, on which devices, the days left, and Restore.
• The Undo toast stays up for 10 seconds.
• Delete permanently… on each Recently deleted row, behind a confirmation. It calls the new host project.purge, which runs the same purge as the 30-day sweep and refuses a project that was never soft-deleted.

Manual QA Checklist

Tested in the dev desktop app over CDP. It used a disposable org, a local relay, and fixture devices running this branch's host service (the local device, one device the member owns, and a shared device owned by someone else). Evidence is in superset-dev-data/qa-soft-delete/ (gitignored).

• A member deletes their own local project from the sidebar. The device is preselected, their own running terminal doesn't trigger the name prompt, and Hide is offered. In the device database: the project is marked deleted by the member, the workspace is archived with the same timestamp, the sleep 777 terminal process is killed, the worktree stays on disk, and the Undo toast shows
• Settings → Projects shows a "Recently deleted · 1" link. The page shows "Deleted by Kiet Ho 29 seconds ago · Kiets-Spaceship · 30 days left". Restore brings back the project, the page shows its empty state, and the link disappears
• The Undo toast is still visible 7 seconds after deleting and gone by 13
• Delete permanently…: the confirmation explains what is removed and kept. Confirming removes the rows and the clean worktree, keeps the repository folder, shows the empty state and hides the link
• Delete, then Undo in the toast: the project and workspace are restored
• An org owner deletes a project another user is using on a shared device. The row shows "QA 7768 Owner: 1 terminal running, 1 agent · active …". Delete stays disabled for a wrong name and enables for the exact one. After deleting, the project is marked deleted and the workspace archived
• Hide from sidebar in the dialog hides the project for this user only; the device row is untouched, and Undo brings it back
• Purge, with the deletion backdated 31 days and the device restarted: the rows are gone, the clean worktree is removed, and the dirty worktree with its uncommitted file and the repository are kept
• No renderer exceptions during the run

Done outside the UI:

• the workspace and terminal for the first scenario were created through the local device's API;
• the other user's terminal and agent rows were inserted into the fixture database, because fixture devices can't spawn terminals;
• the purge scenario was seeded and backdated directly;
• the org role was switched for the owner scenario and restored afterwards.

Testing

• bun test src/projects/project-deletion.test.ts (host service), 11 tests:
  • soft delete: timestamps, events, files kept, idempotent;
  • restore: only workspaces deleted with the project, and ones whose worktree is gone stay archived;
  • listings hide deleted projects;
  • the reconciler skip;
  • purge window, worktree removal and repository kept;
  • the live-activity counts.
• Host service suites for projects, workspaces, cleanup, the reconciler and the database: 334 pass.
• Desktop: selection, activity summary, permission and Recently deleted merge tests. bun test src/renderer/routes/_authenticated src/renderer/hooks/host-projects: 1254 pass.
• tsc --noEmit passes for host-service and desktop, Biome passes, and bun run check:i18n passes with all 17 locales translated.

Design Decisions

• Recoverable instead of permission tiers. A restore window protects against every accident, including an owner misclicking, which no permission check can predict. Permissions stay one coarse rule.
• Warn with live activity instead of blocking. Killed processes are the only thing a restore can't bring back, so the warning names who has something running. Type-to-confirm appears only then, so it stays rare.
• Workspaces deleted with the project share its timestamp (archivedAt = deleted_at). That's how restore tells them apart from workspaces deleted earlier, without a new column.

Known Limitations

• Stopped terminals and agents are not restored; restore brings back rows and worktrees.
• The permission rule is enforced in the desktop only. The host accepts any authenticated caller, as before; the undo window is the safety net.
• Deleting individual workspaces still has no per-user check. That predates this PR.
• The affected people aren't notified.

Risks / Rollout

• Mixed versions:
  • an older desktop calling a newer host gets a soft delete but has no Recently deleted view; another desktop, or re-adding the folder, restores it;
  • a newer desktop calling an older host gets the old hard delete, and deletionImpact fails, so the dialog simply shows no activity.
• Rollback: revert the PR. The added columns are nullable. Soft-deleted projects would then reappear in lists on older builds, since those don't filter deleted_at. That fails in the recoverable direction.

Summary by cubic

Makes project deletion recoverable: deleting a project is now a soft delete that can be undone for 30 days, instead of permanently wiping it and killing other people's running terminals minutes later.

Behavior

• Delete now stamps the project hidden, archives its workspaces, stops terminals and agents, and keeps worktrees on disk so the project can be restored within 30 days (or via an Undo toast); a purge sweep (run off the event loop via the worker pool) then removes rows and clean worktrees.
• The delete dialog shows other people's live activity per device and only asks for the project name when someone else has something running; from the sidebar it offers Hide from sidebar as a per-user alternative.
• Settings → Projects gains a "Recently deleted · N" link to a dedicated page listing each deleted project with who deleted it, when, on which devices, days left, and a Restore button; the link disappears when nothing is deleted.
• Each Recently deleted row also has "Delete permanently…" as a plain red action before Restore, behind a confirmation, which runs the purge now instead of waiting out the 30 days.
• The Undo toast stays up for 10 seconds so a misclick can be noticed.
• Members can now delete projects on devices they own; previously only organization owners could (Project ownership and deletion #7768).

Migration

• Soft-deleted projects will reappear if this PR is reverted, since older builds don't filter deleted_at; a newer desktop against an older host falls back to the old hard delete, and an older desktop against a newer host gets the soft delete without the Recently deleted view.

Summary by CodeRabbit

New Features

• Restore deleted projects for up to 30 days from the Recently deleted settings page, or permanently delete them sooner.
• Choose eligible devices when deleting a project. The confirmation dialog shows device availability and other users’ active terminals and agents.
• Hide a project from your sidebar without deleting it.
• Deleting a project stops active terminals and agents on selected devices. Repository folders are retained, and worktrees with uncommitted changes remain on disk.

Bug Fixes

• Deletion permissions now reflect device ownership as well as organization ownership.
• Partial deletion and restoration failures provide feedback.