feat: secure secrets and enable offline-first mode

[Bhavik-ag]

Summary

• encrypt database credentials and cached session tokens with Electron safeStorage
• migrate plaintext secrets and keep credentials memory-only when OS encryption is unavailable
• make authentication optional for connections, queries, saved queries, and dashboards

Validation

• pnpm --filter @dbdesk/desktop typecheck
• pnpm --filter @dbdesk/db typecheck
• pnpm --filter @dbdesk/desktop test
• pnpm --filter @dbdesk/desktop lint

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
dbdesk-web	Ignored		Sep 19, 2026 2:51am UTC
dbdesk-server	Skipped		Sep 19, 2026 2:51am UTC

[greptile-apps]

Confidence Score: 4/5

The PR is not yet safe to merge because desktop-created connections can no longer use their stored credentials from the shared CLI workflow.

Summary

This PR encrypts desktop connection credentials and cached session tokens with Electron safe storage, migrates existing plaintext secrets, and makes local database workflows available without authentication.

• Keeps credentials memory-only when OS encryption is unavailable.
• Adds non-blocking recovery of sessions persisted by the authentication plugin.
• Moves dashboards and other local workflows to an offline-first model.
• Documents that the CLI must obtain credentials through PostgreSQL environment variables or ~/.pgpass.

_{Reviews (3) · Last reviewed commit: "feat: add secure offline-first local mod..."}