Merge branch 'main' into feat/agent-bundle-editable-md

Author: dmarticus

.github/workflows/code-release.yml

@@ -196,6 +196,16 @@ jobs:
             echo "OK: $bin"
           done
 
+          # The native codex CLI must ship as a sibling of codex-acp, or the
+          # app-server harness silently falls back to codex-acp in production.
+          for f in codex rg; do
+            if [[ ! -f "$RESOURCES/app.asar.unpacked/.vite/build/codex-acp/$f" ]]; then
+              echo "FAIL: codex-acp/$f missing in bundled binaries"
+              exit 1
+            fi
+            echo "OK: codex-acp/$f"
+          done
+
       - name: Install Playwright
         run: pnpm --filter code exec playwright install
 
@@ -223,6 +233,21 @@ jobs:
             apps/code/out/*-mac.zip \
             apps/code/out/*.blockmap
 
+      # Hash the same files uploaded above; finalize-release turns these into
+      # the download tables in the release notes.
+      - name: Compute artifact checksums
+        env:
+          MATRIX_ARCH: ${{ matrix.arch }}
+        working-directory: apps/code/out
+        run: shasum -a 256 *.dmg *-mac.zip *.blockmap > "checksums-macos-$MATRIX_ARCH.txt"
+
+      - name: Upload checksums artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: checksums-macos-${{ matrix.arch }}
+          path: apps/code/out/checksums-macos-${{ matrix.arch }}.txt
+          retention-days: 1
+
       - name: Upload mac manifest artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -332,6 +357,20 @@ jobs:
           $files = $items | Select-Object -ExpandProperty FullName
           gh release upload "v$env:APP_VERSION" --repo PostHog/code --clobber @files
 
+      # Hash the same files uploaded above (minus latest.yml); finalize-release
+      # turns these into the download tables in the release notes.
+      - name: Compute artifact checksums
+        shell: bash
+        working-directory: apps/code/out
+        run: sha256sum *.exe *.blockmap > checksums-windows-x64.txt
+
+      - name: Upload checksums artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: checksums-windows-x64
+          path: apps/code/out/checksums-windows-x64.txt
+          retention-days: 1
+
   publish-linux:
     needs: [prepare-release]
     strategy:
@@ -444,6 +483,21 @@ jobs:
             apps/code/out/*.deb \
             apps/code/out/*.rpm
 
+      # Hash the same files uploaded above; finalize-release turns these into
+      # the download tables in the release notes.
+      - name: Compute artifact checksums
+        env:
+          MATRIX_ARCH: ${{ matrix.arch }}
+        working-directory: apps/code/out
+        run: sha256sum *.AppImage *.deb *.rpm > "checksums-linux-$MATRIX_ARCH.txt"
+
+      - name: Upload checksums artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: checksums-linux-${{ matrix.arch }}
+          path: apps/code/out/checksums-linux-${{ matrix.arch }}.txt
+          retention-days: 1
+
   finalize-release:
     needs: [publish-macos, publish-windows, publish-linux]
     # Publish only when every platform built successfully. Without an `if:` override
@@ -471,6 +525,7 @@ jobs:
         with:
           sparse-checkout: |
             apps/code/scripts/merge-mac-manifests.mjs
+            apps/code/scripts/generate-release-download-tables.mjs
           sparse-checkout-cone-mode: false
 
       - name: Setup Node.js
@@ -508,10 +563,19 @@ jobs:
         run: |
           gh release upload "v$APP_VERSION" --repo PostHog/code --clobber /tmp/latest-mac.yml
 
+      - name: Download checksum artifacts
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          pattern: checksums-*
+          merge-multiple: true
+          path: /tmp/checksums
+
       - name: Publish GitHub release
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           APP_VERSION: ${{ steps.version.outputs.version }}
         run: |
           gh api repos/PostHog/code/releases/generate-notes -f tag_name="v$APP_VERSION" --jq '.body' > /tmp/release-notes.md
+          printf '\n' >> /tmp/release-notes.md
+          node apps/code/scripts/generate-release-download-tables.mjs "$APP_VERSION" /tmp/checksums >> /tmp/release-notes.md
           gh release edit "v$APP_VERSION" --repo PostHog/code --draft=false --notes-file /tmp/release-notes.md

.github/workflows/code-tag.yml

@@ -26,6 +26,7 @@ jobs:
        contains(github.event.pull_request.labels.*.name, 'Create release'))
     permissions:
       contents: write
+      actions: write
     runs-on: ubuntu-latest
     steps:
       - name: Get app token
@@ -45,7 +46,7 @@ jobs:
         id: quiet
         if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.quiet_retries != '0')
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ github.token }}
           QUIET_RETRIES: ${{ github.event.inputs.quiet_retries || 0 }}
         run: |
           RETRIES="${QUIET_RETRIES}"

.github/workflows/test.yml

@@ -15,6 +15,7 @@ jobs:
     outputs:
       code: ${{ steps.filter.outputs.code }}
       workflow: ${{ steps.filter.outputs.workflow }}
+      packages: ${{ steps.filter.outputs.packages }}
     steps:
       - name: Detect relevant changes
         id: filter
@@ -36,6 +37,8 @@ jobs:
               - "!.env.example"
             workflow:
               - ".github/workflows/test.yml"
+            packages:
+              - "packages/**"
 
   unit-test:
     needs: changes
@@ -172,3 +175,72 @@ jobs:
           name: playwright-report
           path: apps/code/playwright-report/
           retention-days: 7
+
+  e2e:
+    # Live-model e2e for the @posthog/agent adapters (claude + codex). Runs only
+    # after the unit + integration jobs pass — a red tree never reaches the
+    # gateway — and only when a packages/ file changed. Each arm still self-skips
+    # unless the POSTHOG_CODE_E2E_GATEWAY_PERSONAL_API_KEY secret is present (fork PRs never
+    # see it) and POSTHOG_CODE_E2E_GATEWAY_URL points at a runner-reachable gateway.
+    # Drives cheap models (claude-haiku-4-5 / gpt-5-mini), so a run is a handful of
+    # short turns.
+    needs: [changes, unit-test, integration-test]
+    # Always run on any packages/ change (or a change to this workflow), once
+    # unit-test + integration-test have passed. There is intentionally NO gate on
+    # the gateway config being present: if the POSTHOG_CODE_E2E_* secret/vars are
+    # missing, the fail-loud guard (packages/agent/e2e/guard.e2e.test.ts) REDS the
+    # run rather than skipping to green. Only fork PRs are skipped, since they never
+    # receive the gateway secret and would red spuriously.
+    if: ${{ (needs.changes.outputs.packages == 'true' || needs.changes.outputs.workflow == 'true') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build agent dependencies
+        run: |
+          pnpm --filter @posthog/shared run build
+          pnpm --filter @posthog/git run build
+          pnpm --filter @posthog/enricher run build
+
+      - name: Download native codex binary
+        # Non-fatal at the STEP so a failure surfaces as the fail-loud binary guard
+        # (guard.e2e.test.ts) with a clear message rather than an opaque download
+        # error. A missing binary then REDS the run (the guard fails when a token is
+        # set) instead of letting the codex arm silently skip to green.
+        run: node apps/code/scripts/download-binaries.mjs || echo "codex binary download failed; the binary guard test will red the run"
+
+      - name: Run live e2e (both adapters)
+        run: pnpm --filter agent run test:e2e
+        # The suite reads these POSTHOG_CODE_E2E_* names directly
+        # (packages/agent/e2e/config.ts). The personal API key is an org secret; the
+        # URL and model/environment overrides are org vars.
+        env:
+          POSTHOG_CODE_E2E_GATEWAY_PERSONAL_API_KEY: ${{ secrets.POSTHOG_CODE_E2E_GATEWAY_PERSONAL_API_KEY }}
+          # Accept the URL from either an org var or an org secret — it has ended
+          # up in both places, and vars.* can't see secrets.
+          POSTHOG_CODE_E2E_GATEWAY_URL: ${{ vars.POSTHOG_CODE_E2E_GATEWAY_URL || secrets.POSTHOG_CODE_E2E_GATEWAY_URL }}
+          POSTHOG_CODE_E2E_CLAUDE_MODEL: ${{ vars.POSTHOG_CODE_E2E_CLAUDE_MODEL }}
+          POSTHOG_CODE_E2E_CODEX_MODEL: ${{ vars.POSTHOG_CODE_E2E_CODEX_MODEL }}
+          # Optional: set vars.POSTHOG_CODE_E2E_ENVIRONMENT=cloud to exercise the
+          # cloud code path (sandbox/permission-profile gating). Unset = local. The
+          # OS-sandbox enforcement test is macOS-gated, so it doesn't red this linux
+          # runner.
+          POSTHOG_CODE_E2E_ENVIRONMENT: ${{ vars.POSTHOG_CODE_E2E_ENVIRONMENT }}

.gitignore

@@ -16,6 +16,8 @@ bin/
 
 # tsup bundled config artifacts (temporary files left behind when bundling TS configs)
 *.config.bundled_*.mjs
+# vite bundled config artifacts (left behind when a vitest run is interrupted)
+*.config.ts.timestamp-*.mjs
 
 # Environment
 .env

apps/code/scripts/download-binaries.mjs

@@ -7,6 +7,7 @@ import {
   existsSync,
   mkdirSync,
   realpathSync,
+  renameSync,
   rmSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
@@ -47,6 +48,40 @@ const BINARIES = [
       return target;
     },
   },
+  {
+    name: "codex",
+    version: "0.140.0",
+    getUrl: (version, target) => {
+      if (target.includes("windows")) {
+        return `https://github.com/openai/codex/releases/download/rust-v${version}/codex-${target}.exe.zip`;
+      }
+      return `https://github.com/openai/codex/releases/download/rust-v${version}/codex-${target}.tar.gz`;
+    },
+    getTarget: () => {
+      const { platform, arch } = process;
+      const targets = {
+        darwin: { arm64: "aarch64-apple-darwin", x64: "x86_64-apple-darwin" },
+        linux: {
+          arm64: "aarch64-unknown-linux-musl",
+          x64: "x86_64-unknown-linux-musl",
+        },
+        win32: {
+          arm64: "aarch64-pc-windows-msvc",
+          x64: "x86_64-pc-windows-msvc",
+        },
+      };
+      const platformTargets = targets[platform];
+      if (!platformTargets)
+        throw new Error(`Unsupported platform: ${platform}`);
+      const target = platformTargets[arch];
+      if (!target) throw new Error(`Unsupported arch: ${arch}`);
+      return target;
+    },
+    // The codex release archive contains a target-suffixed binary
+    // (e.g. `codex-aarch64-apple-darwin`); rename it to `codex` after extract.
+    archiveBinaryName: (target) =>
+      process.platform === "win32" ? `codex-${target}.exe` : `codex-${target}`,
+  },
   {
     name: "rg",
     version: "15.0.0",
@@ -159,6 +194,13 @@ async function downloadBinary(binary) {
   await extractArchive(archivePath, DEST_DIR);
   rmSync(archivePath);
 
+  if (binary.archiveBinaryName) {
+    const extractedPath = join(DEST_DIR, binary.archiveBinaryName(target));
+    if (extractedPath !== binaryPath && existsSync(extractedPath)) {
+      renameSync(extractedPath, binaryPath);
+    }
+  }
+
   if (!existsSync(binaryPath)) {
     throw new Error(`Binary not found after extraction: ${binaryPath}`);
   }