fix(desktop): return source connections to the app

[waleedlatif1]

Summary

• Keep desktop source setup in place while browser consent returns to the original screen and refreshes connected accounts.
• Start session-bound OAuth in the browser using encrypted, expiring, single-use requests. Cover Slack, GitHub, member enrollment, and organization account connections, with native cancellation and branded completion pages.

Type of Change

• Bug fix

Testing

• Electron + separate Chromium E2E with provider fixtures: slow initiation, live refresh, denial, cancellation, stale callbacks, GitHub credential verification, and ordinary knowledge-base invitation enrollment. JSON report and screenshot are uploaded by desktop CI on failure. Confirmed the regression fails without the desktop handoff.
• Real Redis integration checks for owner isolation, atomic consumption, encryption, expiration, and input limits; focused native and web regression suites.
• Desktop and app type checks, lint, block-registry check, all repository audits, generated-artifact checks, and docs-manifest check.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 30, 2026 11:03pm UTC

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 44 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 4/5

[High risk] Adds desktop source connection flow with new API routes and IPC handlers.

The PR is not ready to merge until the outstanding explicit-ref-type requirement is satisfied.

Findings

1.  Ref type is implicit ▶

Summary

The PR keeps desktop source setup in place while authorization runs in a separate browser session and returns a correlated completion to the app.

• Adds encrypted, expiring, single-use source requests and native cancellation.
• Connects Slack, GitHub, enrollment, and organization-account flows to completion and account refresh.
• Adds desktop end-to-end and Redis integration coverage.

Diagram

sequenceDiagram
  participant D as Desktop app
  participant R as Source request API
  participant B as System browser
  participant P as Provider
  D->>R: Store encrypted source request
  D->>B: Open correlated connect URL
  B->>R: Consume request once
  B->>P: Start authorization
  P-->>B: Return to completion page
  B-->>D: Send correlated loopback result
  D->>D: Refresh authorized account state

Loading

_{Reviews (2) · Last reviewed commit: "fix(desktop): preserve enrollment mode a..."}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 45 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}