feat(pages): default to org visibility, cached thumbnails, owner + delete in the grid - #6932

Summary

• New pages default to org instead of just_me, so a page published from the CLI or by an agent is readable by the organization rather than silently invisible to everyone but its publisher.
• Page thumbnails are captured once per version and cached to disk, replacing the grid's live per-card iframes.
• The grid shows the page owner (when the viewer isn't the owner) and exposes Delete in the card's overflow menu.
• Folds in the in-flight share/comment fixes already on this branch (auth client, optimistic visibility, comment-overlay perf).

Why / Context

Three separate problems on the pages surface.

Visibility. Every page was created just_me, so publishing was silently broken on both ends: the publisher got a URL that looked fine, and the teammate they sent it to got bounced to sign-in. Pages are a sharing surface — the common case is "show this to the team". This reverses a deliberate choice (publish.integration.ts asserted the old default with the comment "Narrowest audience by default; widening is always a deliberate act"). That instinct is right for genuinely public content, but org is not public: it means signed-in members of the same organization, for a page already created inside that organization. The truly public tier (everyone) remains unreachable either way, so blast radius is bounded to people who can already see the originating workspace.

Thumbnails. Each card rendered a live 1280x880 <iframe sandbox="allow-scripts"> of the real page, CSS-scaled down. Twenty cards meant twenty full HTML documents downloaded from blob storage and twenty browser contexts executing the pages' JavaScript. Both caches were process memory, so every cold start re-downloaded and re-rendered everything, and the 48-entry LRU thrashed on larger grids.

Ownership. The grid gave no indication whose page you were looking at, and deleting required opening the page first.

How It Works

Visibility

One line in createPage. updatePage already patches visibility only when the input provides one, so republishing never changes a page's audience — this cannot widen an existing page. No backfill and no migration: existing just_me rows were published under a private default, and widening them retroactively would be a disclosure, not a migration. The DB column default stays just_me and is inert, since createPage always supplies a value.

Thumbnails

Capture moved into the main process (main/lib/pageThumbnails/). On first view of a version, a hidden BrowserWindow loads the existing superset-page:// content URL, capturePage() runs, and the result is downscaled to 640x440 JPEG and written to userData/page-thumbnails/<pageId>-<version>.jpg. It's served back over a new superset-thumb://<pageId>/<version> scheme with immutable cache headers; the renderer just points an <img> at it.

A thumbnail is immutable for a given page version, which is what makes this cheap: generate once, cache forever, no invalidation. A republish mints a new version and therefore a new key, so it misses naturally. Generation is lazy rather than at publish time — pages are republished often (an agent iterating produces v1..v20) and most versions are never viewed, so capturing at publish would be mostly waste.

Four details that matter:

• The hang. browser-manager.ts documents that content presenting no compositor frames makes capturePage hang or return an empty bitmap — a 2-minute hang in the field. This reuses its proven shape: bounded 1.5s attempts retried against a 15s deadline, since an abandoned attempt still forces the frame the next one catches. The window is paintWhenInitiallyHidden with backgroundThrottling: false.
• Load can't block forever. loadURL waits on subresources, so it races a 10s cap and captures whatever rendered rather than giving up.
• Isolation. The capture window runs in a non-persistent partition, sandboxed, no node integration, so untrusted page HTML never touches the app session's cookies. That partition gets its own superset-page:// handler.
• Bounded work. Max 2 concurrent captures, in-flight dedup per key, 512-file LRU prune.

Side benefit: the card derives its version from sharedVersion ?? latestVersion, which page.list already returns, so a cached thumbnail no longer calls page.pull at all. That removes a per-card blob head() request from the common path.

Owner and delete

page.list now returns createdByUserId and ownerName via a left join on users (null-safe for a deleted owner). The card and the shared PageHeader show the owner only when currentUserId !== createdByUserId. Delete reuses the existing DeletePageDialog, is owner-only in the UI (the server already enforces assertPageWritable), and removes the card optimistically — page.delete awaits blob cleanup, so it's slow enough that a non-optimistic grid would visibly lag.

Manual QA Checklist

Not yet executed — see Known Limitations.

Visibility

• Publishing a new page from the CLI with no --visibility yields an org page
• A second org member can open that page's URL
• --visibility just_me still produces a private page
• Republishing a just_me page leaves it just_me
• Pages created before this change are still just_me

Thumbnails

• Grid renders thumbnails for pages that have versions
• First view shows a spinner, then the captured image
• Thumbnails survive an app restart (no re-capture, no network)
• Republishing a page produces a new thumbnail on next view
• A page whose JS spins/errors still yields an image rather than hanging the grid
• Scrolling a large grid doesn't spawn unbounded windows (max 2 concurrent)
• No console errors in main or renderer

Owner + delete

• Another member's page shows their name; your own pages show no name
• A page whose owner was deleted renders without crashing
• Delete appears only on your own pages
• Deleting removes the card immediately and it stays gone after refetch
• A failed delete restores the card

Pinned tab

• Pinned tab is hidden when nothing is pinned
• Unpinning the last page while on the Pinned tab falls back to All

Testing

• bun run typecheck — passes across @superset/desktop, @superset/ui, @superset/trpc, @superset/web, @superset/mcp, @superset/db
• bunx biome check — clean across apps/desktop/src, packages/ui/src, packages/trpc/src, packages/mcp/src (3756 files)
• bun test — packages/ui 35/35, packages/trpc/src/router/page 41/41, desktop pages 10/10

publish.integration.ts needs a live database, so its flipped assertion first runs in CI.

Design Decisions

• Lazy capture instead of at publish time: pages are republished frequently and most versions are never viewed, so capturing on publish would be mostly wasted work; it would also slow the CLI/agent publish path, and the publisher often has no Electron process at all.
• Local disk cache instead of uploading to blob storage: needs no schema column, no upload mutation, and no trust model for who may write a shared asset. The cost is that each machine captures once and web gets no thumbnails — acceptable because web has none today either. If web needs them later, upload is one extra step on the same capture code.
• No migration for the column default: createPage always passes a value, so the column default never applies. Changing it would have required a migration purely to keep the Drizzle snapshot consistent, for zero behavioral effect.
• Version in the thumbnail URL: makes it immutable per version, so it can be cached indefinitely with no invalidation logic.

Known Limitations

• The capture path has not been run. This is the main gap. The retry/deadline mitigation is modelled on browser-manager.ts's documented fix for the same capturePage failure mode, but it has not been observed working in a running app. Worth exercising before merge.
• No tests for main/lib/pageThumbnails/, and this deletes pageThumbnailCache.test.ts along with the iframe cache it covered. The pure parts — the isValidKey path-traversal guard on the protocol handler, LRU prune ordering, the capture semaphore — are testable and should get coverage.
• Thumbnails for deleted pages linger in the disk cache until LRU eviction; they are not reconciled against page deletion.
• The DB column default now disagrees with app behavior (just_me vs org). Inert for anything going through createPage, but a seed script or raw SQL insert omitting visibility would reproduce the invisible-page bug. Worth a follow-up.
• The grid drops its iframe fallback, so if capture fails a card shows a placeholder rather than a live render.

Risks / Rollout

• Risk: the whole /pages route is behind FEATURE_FLAGS.PAGES, so all of this is limited to flag-enabled users. The visibility default is the only change reaching non-desktop surfaces (CLI, MCP, web publish), and it is forward-only — no existing page changes audience.
• Rollback: revert the commit. No migration, no schema change, no data to unwind. Cached thumbnails become orphaned files under userData/page-thumbnails/ and are harmless.

Follow-ups

• Unit tests for pageThumbnails (key validation, prune order, semaphore)
• Reconcile the disk cache against page deletion
• Align the DB column default with the app default
• Upload thumbnails if web/mobile ever need them

https://claude.ai/code/session_015YytmsAiiZcTVrLwFSVpMF

Summary by cubic

New pages default to org visibility instead of just_me, and the pages grid swaps live per-card iframes for disk-cached thumbnails, adds the page owner, and exposes Delete in the card menu, with share/comment fixes riding along.

Thumbnails

• Captured once per page version into userData/page-thumbnails/<accountId>/, served over a new superset-thumb:// scheme with immutable cache headers and account-scoped keys.
• Generation is lazy, sandboxed, with retry/deadline handling, 2 concurrent captures, per-key dedup, and a 512-file LRU prune.
• A cached thumbnail skips page.pull; failed navigations abort, load timeouts refuse only blank frames, and eviction recovers by re-capturing once per mount.
• Unit tests cover the cache boundary (key validation, account isolation, recency ordering, LRU order) and assert access-time updates directly; the capture path still hasn't run in a live app.
• Desktop content and thumbnail procedures now share one page tRPC router with content and thumbnail sub-routers (was pageContent).

Grid and share fixes

• page.list returns createdByUserId and ownerName; the card shows the owner when you're not the owner, and Delete is owner-only and optimistic.
• The share popover applies visibility changes optimistically, copies the link on widening, and keys pending state to the page id.
• The page surface reads its session from the desktop auth client; the comment overlay stops re-measuring every frame, and the comment runtime caches element lookups.
• Reopening a page restores its scroll position: the offset is held in memory per page and version, keeps re-applying while the document grows (capped at a second), and aborts on the first wheel, touch, or key.
• The Pinned tab hides when it has nothing and falls back to All on unpin.
• Two merges of main are in: the new UI strings are localized (delete action and toast across all five locales), the card timestamp uses the shared relative-time formatter, and the page skill documents the org default and sandbox limits.

Existing pages are untouched: no backfill, and republishing never changes a page's audience. The DB column default stays just_me but is inert since createPage always passes a value.

^{Written for commit 78b0fe8. Summary will update on new commits.}

Summary by CodeRabbit

• New Features

  • Added cached page thumbnails for faster, more consistent previews.
  • Added page-owner details and owner-only page deletion in the Pages view.
  • New pages now default to organization-wide visibility.
  • Visibility changes update immediately and copy links when appropriate.

• Bug Fixes

  • Improved pinned-page filtering and thumbnail recovery after cached previews expire.
  • Reduced unnecessary comment layout updates and improved themed page frames.
  • Improved comment positioning after page content changes.

• Documentation

  • Updated Pages guidance for visibility defaults, sandbox restrictions, and publishing limits.