fix(canvas): workflow-link fixes from live dogfooding

- Parse the PostHog MCP's YAML tool results in the workflow-built pairing:
  workflows-create/get return a YAML document, not JSON, so the link
  notification never fired. Add a top-level-line YAML fallback with a
  regression test against a captured real payload.
- Resolve the backend feed channel in useGenerateFreeformCanvas when the
  caller doesn't pass one (the canvas hero didn't), so hero-initiated
  builds land in the channel feed like composer submits.
- Never demote an auto/bypass session to acceptEdits when the user answers
  a permission card with "always allow" - the upgrade helper previously
  preferred acceptEdits unconditionally, which turned one "always allow"
  click into a prompt storm for the rest of an auto canvas build.

Generated-By: PostHog Code
Task-Id: 3b50883f-cab5-443a-8b92-3d0c948688da

Author: mayteio

packages/agent/src/adapters/claude/hooks.test.ts

@@ -798,3 +798,100 @@ describe("createPostToolUseHook workflow link", () => {
     expect(signals).toEqual([]);
   });
 });
+
+describe("createPostToolUseHook workflow link - YAML MCP results", () => {
+  // The PostHog MCP renders tool results as YAML documents, not JSON — this is
+  // the real shape a workflows-create returns (captured from a live session).
+  const YAML_WORKFLOW_RESULT = [
+    "id: 019f6f90-0d70-0000-5171-4622c6016e1e",
+    "name: Welcome email after signup",
+    'description: "Sends a welcome email to every new user immediately after they sign up."',
+    "version: 1",
+    "status: draft",
+    'created_at: "2026-07-17T10:12:19.441125Z"',
+    "created_by:",
+    "  id: 546751",
+    "  first_name: Harley",
+    "trigger:",
+    "  type: event",
+    "  filters:",
+    "    source: events",
+    "    events[1]{id,name,type,order}:",
+    "      user signed up,user signed up,events,0",
+  ].join("\n");
+
+  test("pairs a YAML workflows-create result with the canvas publish", async () => {
+    const signals: WorkflowBuiltSignal[] = [];
+    const hook = createPostToolUseHook({
+      onWorkflowBuilt: (s) => signals.push(s),
+    });
+
+    await hook(
+      {
+        hook_event_name: "PostToolUse",
+        tool_name: "mcp__posthog__exec",
+        tool_input: { command: "call --json workflows-create {}" },
+        tool_response: {
+          content: [{ type: "text", text: YAML_WORKFLOW_RESULT }],
+        },
+      } as unknown as HookInput,
+      "tu1",
+      { signal: new AbortController().signal },
+    );
+    await hook(
+      {
+        hook_event_name: "PostToolUse",
+        tool_name: "mcp__posthog__exec",
+        tool_input: {
+          command:
+            'call --json desktop-file-system-canvas-partial-update {"id":"dash-1","code":"x"}',
+        },
+      } as unknown as HookInput,
+      "tu2",
+      { signal: new AbortController().signal },
+    );
+
+    expect(signals).toEqual([
+      {
+        dashboardId: "dash-1",
+        workflowId: "019f6f90-0d70-0000-5171-4622c6016e1e",
+        workflowStatus: "draft",
+        workflowName: "Welcome email after signup",
+      },
+    ]);
+  });
+
+  test("does not read a nested block's id as the workflow id", async () => {
+    const signals: WorkflowBuiltSignal[] = [];
+    const hook = createPostToolUseHook({
+      onWorkflowBuilt: (s) => signals.push(s),
+    });
+
+    // No top-level id line at all — only the nested created_by.id.
+    const nestedOnly = ["name: X", "created_by:", "  id: 546751"].join("\n");
+    await hook(
+      {
+        hook_event_name: "PostToolUse",
+        tool_name: "mcp__posthog__exec",
+        tool_input: { command: "call --json workflows-create {}" },
+        tool_response: { content: [{ type: "text", text: nestedOnly }] },
+      } as unknown as HookInput,
+      "tu1",
+      { signal: new AbortController().signal },
+    );
+    await hook(
+      {
+        hook_event_name: "PostToolUse",
+        tool_name: "mcp__posthog__exec",
+        tool_input: {
+          command:
+            'call --json desktop-file-system-canvas-partial-update {"id":"dash-1","code":"x"}',
+        },
+      } as unknown as HookInput,
+      "tu2",
+      { signal: new AbortController().signal },
+    );
+
+    expect(signals).toEqual([]);
+  });
+});

packages/agent/src/adapters/claude/hooks.ts

@@ -81,38 +81,61 @@ function parseCanvasPublishDashboardId(toolInput: unknown): string | null {
   return arg && typeof arg.id === "string" ? arg.id : null;
 }
 
-// The workflow id + status from a `workflows-create` result. The result JSON may
-// be the workflow itself or wrapped, so look under common envelopes too. Best
-// effort - returns null if no workflow id is present.
+// A top-level `key: value` line from a YAML-ish blob (no leading indentation,
+// so nested blocks like `created_by:` don't shadow the workflow's own fields).
+// The PostHog MCP renders results as YAML, not JSON.
+function parseTopLevelYamlValue(text: string, key: string): string | undefined {
+  const match = text.match(new RegExp(`^${key}:[ \\t]*(.+)$`, "m"));
+  if (!match) return undefined;
+  const value = match[1].trim().replace(/^"(.*)"$/, "$1");
+  return value || undefined;
+}
+
+// The workflow id + status from a `workflows-create` / `workflows-get` result.
+// The PostHog MCP returns the workflow as a YAML document (top-level `id:` /
+// `name:` / `status:` lines); older/other shapes may be JSON, possibly wrapped.
+// Best effort - returns null if no workflow id is present.
 function parseWorkflowFromResponse(response: unknown): {
   workflowId: string;
   workflowStatus?: string;
   workflowName?: string;
 } | null {
   const text = extractTextFromToolResponse(response);
   if (!text) return null;
+
   const root = parseEmbeddedJsonObject(text);
-  if (!root) return null;
-  for (const candidate of [
-    root,
-    root.workflow,
-    root.result,
-    root.data,
-  ] as Record<string, unknown>[]) {
-    if (candidate && typeof candidate === "object") {
-      const id = (candidate as { id?: unknown }).id;
-      if (typeof id === "string" && id) {
-        const status = (candidate as { status?: unknown }).status;
-        const name = (candidate as { name?: unknown }).name;
-        return {
-          workflowId: id,
-          workflowStatus: typeof status === "string" ? status : undefined,
-          workflowName:
-            typeof name === "string" && name.trim() ? name : undefined,
-        };
+  if (root) {
+    for (const candidate of [
+      root,
+      root.workflow,
+      root.result,
+      root.data,
+    ] as Record<string, unknown>[]) {
+      if (candidate && typeof candidate === "object") {
+        const id = (candidate as { id?: unknown }).id;
+        if (typeof id === "string" && id) {
+          const status = (candidate as { status?: unknown }).status;
+          const name = (candidate as { name?: unknown }).name;
+          return {
+            workflowId: id,
+            workflowStatus: typeof status === "string" ? status : undefined,
+            workflowName:
+              typeof name === "string" && name.trim() ? name : undefined,
+          };
+        }
       }
     }
   }
+
+  // YAML document (what the MCP actually emits): top-level key: value lines.
+  const id = parseTopLevelYamlValue(text, "id");
+  if (id && /^[0-9a-f][0-9a-f-]{10,}$/i.test(id)) {
+    return {
+      workflowId: id,
+      workflowStatus: parseTopLevelYamlValue(text, "status"),
+      workflowName: parseTopLevelYamlValue(text, "name"),
+    };
+  }
   return null;
 }
 

packages/core/src/sessions/sessionService.ts

@@ -5549,6 +5549,12 @@ export class SessionService {
     modeOption: SessionConfigOption | undefined,
   ): string | undefined {
     if (modeOption?.type !== "select") return undefined;
+    // Never DEMOTE a session that already runs unattended: an "always allow"
+    // answer in an auto/bypass session must not drop it to acceptEdits, which
+    // would make every subsequent gated tool prompt (the opposite of what the
+    // user just asked for).
+    const current = modeOption.currentValue;
+    if (current === "auto" || current === "bypassPermissions") return undefined;
     const availableIds = new Set(
       flattenSelectOptions(modeOption.options).map((opt) => opt.value),
     );

packages/ui/src/features/canvas/hooks/useGenerateFreeformCanvas.ts

@@ -15,14 +15,20 @@ import {
   getCloudUrlFromRegion,
   type WorkspaceMode,
 } from "@posthog/shared";
+import { useOptionalAuthenticatedClient } from "@posthog/ui/features/auth/authClient";
 import { useAuthStateValue } from "@posthog/ui/features/auth/store";
 import { buildFreeformGenerationPrompt } from "@posthog/ui/features/canvas/freeformPrompt";
+import { channelFeedQueryKey } from "@posthog/ui/features/canvas/hooks/useChannelFeed";
 import { useChannelTaskMutations } from "@posthog/ui/features/canvas/hooks/useChannelTasks";
 import {
   isPlaceholderCanvasName,
   useDashboardMutations,
 } from "@posthog/ui/features/canvas/hooks/useDashboards";
 import { useFolderInstructions } from "@posthog/ui/features/canvas/hooks/useFolderInstructions";
+import {
+  normalizeChannelName,
+  PERSONAL_CHANNEL_NAME,
+} from "@posthog/ui/features/canvas/hooks/useTaskChannels";
 import { useCanvasGenerationTrackerStore } from "@posthog/ui/features/canvas/stores/canvasGenerationTrackerStore";
 import { toastError } from "@posthog/ui/features/notifications/errorDetails";
 import { useCreateTask } from "@posthog/ui/features/tasks/useTaskCrudMutations";
@@ -58,6 +64,7 @@ export function useGenerateFreeformCanvas(args: {
   );
   const trpc = useHostTRPC();
   const queryClient = useQueryClient();
+  const apiClient = useOptionalAuthenticatedClient();
   const { invalidateTasks } = useCreateTask();
   const { fileTask } = useChannelTaskMutations();
   const { setGenerationTask, renameDashboard } = useDashboardMutations();
@@ -103,7 +110,6 @@ export function useGenerateFreeformCanvas(args: {
         templateId,
         instruction,
         currentCode,
-        backendChannelId,
         adapter = "claude",
         reasoningLevel,
         useStarter,
@@ -115,6 +121,26 @@ export function useGenerateFreeformCanvas(args: {
       } = opts;
       setIsStarting(true);
       try {
+        // Resolve the backend channel that owns the task so the run shows as a
+        // card in the channel feed — the same mapping the channel composer
+        // resolves. Callers that already know it (the composer) pass it; the
+        // canvas hero doesn't, so fall back to resolving by channel name here.
+        // Best-effort: an unresolved feed channel shouldn't block generation.
+        let backendChannelId = opts.backendChannelId;
+        const normalizedName = channelName
+          ? normalizeChannelName(channelName)
+          : "";
+        if (
+          !backendChannelId &&
+          apiClient &&
+          normalizedName &&
+          normalizedName !== PERSONAL_CHANNEL_NAME
+        ) {
+          backendChannelId = await apiClient
+            .resolveTaskChannel(normalizedName)
+            .then((c) => c.id)
+            .catch(() => undefined);
+        }
         // A cloud run requires an explicit adapter + model (the API rejects a
         // cloud runtime without a model). Resolve the caller's pick — or the
         // adapter's server default when none — the same way the inbox one-click
@@ -186,6 +212,13 @@ export function useGenerateFreeformCanvas(args: {
         void queryClient.invalidateQueries({
           queryKey: trpc.workspace.getAll.queryKey(),
         });
+        // Surface the run's card in the channel feed without waiting for the
+        // feed's next poll.
+        if (backendChannelId) {
+          void queryClient.invalidateQueries({
+            queryKey: channelFeedQueryKey(backendChannelId),
+          });
+        }
         // Auto-name a still-unnamed canvas from its generation prompt, using the
         // same helper model that names tasks. Best-effort: a failure (or a user
         // who already named the canvas) leaves the existing title untouched.
@@ -217,6 +250,7 @@ export function useGenerateFreeformCanvas(args: {
       titleGenerator,
       trpc,
       queryClient,
+      apiClient,
       invalidateTasks,
       fileTask,
       setGenerationTask,