Merge branch 'main' into posthog-code/collapsible-inbox-report-sections

Author: andrewm4894

.github/workflows/code-storybook.yml

@@ -169,7 +169,7 @@ jobs:
 
       - name: Install Visual Review CLI
         if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'push'
-        run: cd vr-cli/products/visual_review/cli && npm ci && npm run build && npm link
+        run: cd vr-cli/products/visual_review/cli && (npm ci || npm install) && npm run build && npm link
 
       - name: Submit snapshots to Visual Review
         # Fork PRs can't read the token; their captures still ran above, so a

apps/code/src/main/window.ts

@@ -208,11 +208,14 @@ export function createWindow(): void {
   const platformWindowConfig =
     process.platform === "darwin"
       ? {
-          titleBarStyle: "hiddenInset" as const,
+          // "hidden", not "hiddenInset": hiddenInset keeps macOS's own inset and
+          // ignores trafficLightPosition's y, which parked the dots near the
+          // bottom of the bar. "hidden" honours the position we ask for.
+          titleBarStyle: "hidden" as const,
           // Centre the traffic lights vertically with the title bar's back/forward
           // buttons (40px bar, 24px buttons → centre at y=20; 12px dots → top at 14).
           // x mirrors y so the inset from the top and the left match.
-          trafficLightPosition: { x: 14, y: 14 },
+          trafficLightPosition: { x: 14, y: 12 },
           // Exposes the titlebar-area-* CSS env vars so the renderer can
           // clear the traffic lights exactly; their size varies by macOS
           // version (bigger on Tahoe), so it must not hardcode a width.

apps/web/package.json

@@ -19,6 +19,7 @@
     "@posthog/core": "workspace:*",
     "@posthog/di": "workspace:*",
     "@posthog/host-router": "workspace:*",
+    "@posthog/harness": "workspace:*",
     "@posthog/host-trpc": "workspace:*",
     "@posthog/platform": "workspace:*",
     "@posthog/shared": "workspace:*",

apps/web/src/web-host-router.ts

@@ -1,10 +1,10 @@
-import { fetchPosthogPiModelCatalog } from "@posthog/agent/pi/model-catalog";
 import { getLlmGatewayUrl } from "@posthog/agent/posthog-api";
 import type { AuthService } from "@posthog/core/auth/auth";
 import { AUTH_SERVICE } from "@posthog/core/auth/auth.module";
 import { TEAM_SKILLS_SERVICE } from "@posthog/core/skills/identifiers";
 import type { TeamSkillsService } from "@posthog/core/skills/teamSkillsService";
 import { resolveService } from "@posthog/di/container";
+import { fetchPosthogPiModelCatalog } from "@posthog/harness/extensions/posthog-provider/model-catalog";
 import { analyticsRouter } from "@posthog/host-router/routers/analytics.router";
 import { authRouter } from "@posthog/host-router/routers/auth.router";
 import { canvasDataRouter } from "@posthog/host-router/routers/canvas-data.router";

packages/agent/package.json

@@ -52,10 +52,6 @@
       "types": "./dist/pi/types.d.ts",
       "import": "./dist/pi/types.js"
     },
-    "./pi/model-catalog": {
-      "types": "./dist/pi/model-catalog.d.ts",
-      "import": "./dist/pi/model-catalog.js"
-    },
     "./pr-url-detector": {
       "types": "./dist/pr-url-detector.d.ts",
       "import": "./dist/pr-url-detector.js"

packages/agent/src/adapters/claude/session/options.test.ts

@@ -376,14 +376,18 @@ describe("buildSessionOptions", () => {
         name: "omits the team_id header when POSTHOG_PROJECT_ID is unset",
         projectId: undefined,
         existingHeaders: undefined,
-        expected: "x-posthog-use-bedrock-fallback: true",
+        expected: [
+          "x-posthog-property-$ai_session_id: test-session",
+          "x-posthog-use-bedrock-fallback: true",
+        ].join("\n"),
       },
       {
         name: "forwards POSTHOG_PROJECT_ID as the team_id attribution header",
         projectId: "42",
         existingHeaders: undefined,
         expected: [
           "x-posthog-property-team_id: 42",
+          "x-posthog-property-$ai_session_id: test-session",
           "x-posthog-use-bedrock-fallback: true",
         ].join("\n"),
       },
@@ -394,6 +398,7 @@ describe("buildSessionOptions", () => {
         expected: [
           "x-posthog-property-task_id: task-abc",
           "x-posthog-property-team_id: 42",
+          "x-posthog-property-$ai_session_id: test-session",
           "x-posthog-use-bedrock-fallback: true",
         ].join("\n"),
       },
@@ -411,6 +416,101 @@ describe("buildSessionOptions", () => {
       expect(headers).toBe(expected);
     });
   });
+
+  describe("gateway turn tracing env", () => {
+    const KEYS = [
+      "CLAUDE_CODE_ENABLE_TELEMETRY",
+      "CLAUDE_CODE_ENHANCED_TELEMETRY_BETA",
+      "CLAUDE_CODE_PROPAGATE_TRACEPARENT",
+      "OTEL_TRACES_EXPORTER",
+      "OTEL_EXPORTER_OTLP_PROTOCOL",
+      "OTEL_EXPORTER_OTLP_ENDPOINT",
+      "TRACEPARENT",
+      "TRACESTATE",
+    ] as const;
+    const original: Partial<Record<string, string | undefined>> = {};
+
+    beforeEach(() => {
+      for (const key of KEYS) {
+        original[key] = process.env[key];
+        delete process.env[key];
+      }
+    });
+
+    afterEach(() => {
+      for (const key of KEYS) {
+        const value = original[key];
+        if (value === undefined) {
+          delete process.env[key];
+        } else {
+          process.env[key] = value;
+        }
+      }
+    });
+
+    const gatewayEnv = {
+      anthropicBaseUrl: "https://gateway.example",
+      anthropicAuthToken: "tok",
+      openaiBaseUrl: "https://gateway.example/v1",
+      openaiApiKey: "tok",
+    };
+
+    it("enables per-turn traceparent when routed through the gateway", () => {
+      const env = buildSessionOptions({ ...makeParams(), gatewayEnv }).env;
+
+      expect(env?.CLAUDE_CODE_ENABLE_TELEMETRY).toBe("1");
+      expect(env?.CLAUDE_CODE_ENHANCED_TELEMETRY_BETA).toBe("1");
+      expect(env?.CLAUDE_CODE_PROPAGATE_TRACEPARENT).toBe("1");
+      expect(env?.OTEL_TRACES_EXPORTER).toBe("otlp");
+      expect(env?.OTEL_EXPORTER_OTLP_PROTOCOL).toBe("http/json");
+      expect(env?.OTEL_EXPORTER_OTLP_ENDPOINT).toBe("http://127.0.0.1:9");
+    });
+
+    it("honors a caller-supplied OTLP endpoint", () => {
+      process.env.OTEL_EXPORTER_OTLP_ENDPOINT =
+        "http://collector.internal:4318";
+
+      const env = buildSessionOptions({ ...makeParams(), gatewayEnv }).env;
+
+      expect(env?.OTEL_EXPORTER_OTLP_ENDPOINT).toBe(
+        "http://collector.internal:4318",
+      );
+    });
+
+    it("pins exporter and protocol so an inherited none can't disable tracing", () => {
+      process.env.OTEL_TRACES_EXPORTER = "none";
+      process.env.OTEL_EXPORTER_OTLP_PROTOCOL = "grpc";
+
+      const env = buildSessionOptions({ ...makeParams(), gatewayEnv }).env;
+
+      expect(env?.OTEL_TRACES_EXPORTER).toBe("otlp");
+      expect(env?.OTEL_EXPORTER_OTLP_PROTOCOL).toBe("http/json");
+    });
+
+    it("strips inherited TRACEPARENT so turns keep distinct trace ids", () => {
+      process.env.TRACEPARENT =
+        "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01";
+      process.env.TRACESTATE = "vendor=x";
+
+      const env = buildSessionOptions({ ...makeParams(), gatewayEnv }).env;
+
+      expect(env?.TRACEPARENT).toBeUndefined();
+      expect(env?.TRACESTATE).toBeUndefined();
+    });
+
+    it("leaves BYOK sessions untouched", () => {
+      process.env.TRACEPARENT =
+        "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01";
+
+      const env = buildSessionOptions(makeParams()).env;
+
+      expect(env?.CLAUDE_CODE_ENABLE_TELEMETRY).toBeUndefined();
+      expect(env?.CLAUDE_CODE_PROPAGATE_TRACEPARENT).toBeUndefined();
+      expect(env?.TRACEPARENT).toBe(
+        "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
+      );
+    });
+  });
 });
 
 describe("buildSystemPrompt", () => {

packages/agent/src/adapters/claude/session/options.ts

@@ -151,7 +151,10 @@ function buildMcpServers(
   };
 }
 
-function buildEnvironment(gateway?: GatewayEnv): Record<string, string> {
+function buildEnvironment(
+  gateway?: GatewayEnv,
+  sessionId?: string,
+): Record<string, string> {
   // Custom HTTP headers reach the model only through the Claude CLI subprocess,
   // which reads them from this env var (newline-delimited `name: value` lines)
   // — the SDK has no direct header option. We finalize them here, the single
@@ -174,6 +177,11 @@ function buildEnvironment(gateway?: GatewayEnv): Record<string, string> {
   if (projectId) {
     headerLines.push(buildGatewayPropertyHeaders({ team_id: projectId }));
   }
+  if (sessionId) {
+    headerLines.push(
+      buildGatewayPropertyHeaders({ $ai_session_id: sessionId }),
+    );
+  }
   // Route to AWS Bedrock as a fallback when Anthropic returns 5xx
   headerLines.push("x-posthog-use-bedrock-fallback: true");
   const customHeaders = headerLines.join("\n");
@@ -185,8 +193,31 @@ function buildEnvironment(gateway?: GatewayEnv): Record<string, string> {
   // sessions that genuinely need MCP tools available on turn 1.
   const mcpNonblocking = process.env.MCP_CONNECTION_NONBLOCKING;
 
-  return {
+  // Every var is load-bearing (ablation-tested): the CLI stamps the per-turn
+  // traceparent only once its OTel tracer initializes, and the dead endpoint
+  // keeps the throwaway spans off any local collector. Exporter and protocol
+  // are pinned rather than inherited — an ambient OTEL_TRACES_EXPORTER=none or
+  // unknown protocol registers no tracer and silently drops the traceparent;
+  // the endpoint stays overridable for a real collector.
+  // Residual risk: a repo's .claude/settings.json `env` is applied over these
+  // inside the CLI and can redirect the endpoint or turn on content capture
+  // (OTEL_LOG_TOOL_CONTENT, …) — pre-existing settingSources exposure, not
+  // closable from here; hardening tracked separately.
+  const gatewayTracing: Record<string, string> = gateway?.anthropicBaseUrl
+    ? {
+        CLAUDE_CODE_ENABLE_TELEMETRY: "1",
+        CLAUDE_CODE_ENHANCED_TELEMETRY_BETA: "1",
+        CLAUDE_CODE_PROPAGATE_TRACEPARENT: "1",
+        OTEL_TRACES_EXPORTER: "otlp",
+        OTEL_EXPORTER_OTLP_PROTOCOL: "http/json",
+        OTEL_EXPORTER_OTLP_ENDPOINT:
+          process.env.OTEL_EXPORTER_OTLP_ENDPOINT ?? "http://127.0.0.1:9",
+      }
+    : {};
+
+  const env: Record<string, string> = {
     ...process.env,
+    ...gatewayTracing,
     // Explicit gateway values win over whatever happens to be in process.env.
     // This prevents concurrent Agent instances from clobbering each other's
     // gateway config when process.env was mutated globally.
@@ -212,6 +243,13 @@ function buildEnvironment(gateway?: GatewayEnv): Record<string, string> {
     }),
     ANTHROPIC_CUSTOM_HEADERS: customHeaders,
   };
+  if (gateway?.anthropicBaseUrl) {
+    // The CLI parents every turn under an inherited ambient TRACEPARENT,
+    // collapsing the per-turn trace ids this block exists to produce.
+    delete env.TRACEPARENT;
+    delete env.TRACESTATE;
+  }
+  return env;
 }
 
 function buildHooks(
@@ -473,7 +511,7 @@ export function buildSessionOptions(params: BuildOptionsParams): Options {
       params.mcpServers,
       loadUserClaudeJsonMcpServers(params.cwd, params.logger),
     ),
-    env: buildEnvironment(params.gatewayEnv),
+    env: buildEnvironment(params.gatewayEnv, params.sessionId),
     hooks: buildHooks(
       params.userProvidedOptions?.hooks,
       params.onModeChange,

packages/agent/src/adapters/codex-app-server/spawn.test.ts

@@ -57,6 +57,18 @@ describe("buildAppServerArgs", () => {
     );
   });
 
+  it("quotes $-prefixed posthog property header keys in the TOML table", () => {
+    const args = buildAppServerArgs({
+      binaryPath: "/bundle/codex",
+      apiBaseUrl: "https://gateway.example/v1",
+      httpHeaders: { "x-posthog-property-$ai_session_id": "task-123" },
+    });
+
+    expect(args).toContain(
+      'model_providers.posthog.http_headers={ "x-posthog-property-$ai_session_id" = "task-123" }',
+    );
+  });
+
   it("omits http_headers when none are provided or the provider is unset", () => {
     const withoutHeaders = buildAppServerArgs({
       binaryPath: "/bundle/codex",

packages/agent/src/adapters/local-tools/tools/signed-commit.test.ts

@@ -117,6 +117,41 @@ describe("signed-commit tool handler", () => {
     });
   });
 
+  it("persists the branch when cwd uses an equivalent path representation", async () => {
+    await signedCommitTool.handler(
+      {
+        cwd: "/tmp/workspace/repos/posthog/code/.",
+        token: "ghs_x",
+        taskId: "task-1",
+        taskRunId: "run-1",
+      },
+      { message: "chore: bump", cwd: "." },
+    );
+
+    expect(reportTaskRunBranch).toHaveBeenCalledWith({
+      taskId: "task-1",
+      taskRunId: "run-1",
+      branch: "posthog-code/feature",
+    });
+  });
+
+  it("does not persist a branch created in a sibling repository", async () => {
+    await signedCommitTool.handler(
+      {
+        cwd: "/tmp/workspace/repos/posthog/code",
+        token: "ghs_x",
+        taskId: "task-1",
+        taskRunId: "run-1",
+      },
+      {
+        message: "chore: bump",
+        cwd: "/tmp/workspace/repos/posthog/grafana-dashboards",
+      },
+    );
+
+    expect(reportTaskRunBranch).not.toHaveBeenCalled();
+  });
+
   it("returns the no-token error without invoking createSignedCommit", async () => {
     const savedGh = process.env.GH_TOKEN;
     const savedGithub = process.env.GITHUB_TOKEN;

packages/agent/src/adapters/local-tools/tools/signed-git-tool.ts

@@ -43,10 +43,14 @@ export function defineSignedGitTool<S extends z.ZodRawShape, R>(opts: {
         string,
         unknown
       >;
-      const cwd = argCwd ? path.resolve(ctx.cwd, argCwd) : ctx.cwd;
+      const taskRepositoryCwd = path.resolve(ctx.cwd);
+      const cwd = argCwd
+        ? path.resolve(taskRepositoryCwd, argCwd)
+        : taskRepositoryCwd;
       return opts.run(
         {
           cwd,
+          taskRepositoryCwd,
           token,
           taskId: ctx.taskId,
           taskRunId: ctx.taskRunId,