Merge posthog-code/finalize-mobile-portability-boundary

Generated-By: PostHog Code
Task-Id: c1bbe3cf-742b-4b24-bf96-d11a18b4cf22

Author: richardsolomou

.claude/skills/storybook-stories/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: storybook-stories
-description: Write Storybook stories for PostHog Code UI components. Covers the provider stack stories run inside, the key gotcha that tRPC/useHostTRPC queries never resolve in Storybook (so data-fetching components render empty), and the pure-presentational split that makes a component storyable. Use when adding or fixing a *.stories.tsx file under packages/ui.
+description: Write Storybook stories for PostHog UI components. Covers the provider stack stories run inside, the key gotcha that tRPC/useHostTRPC queries never resolve in Storybook (so data-fetching components render empty), and the pure-presentational split that makes a component storyable. Use when adding or fixing a *.stories.tsx file under packages/ui.
 ---
 
-# Storybook stories in PostHog Code
+# Storybook stories in PostHog
 
 Stories live next to components as `*.stories.tsx` and are collected by
 `apps/code/.storybook/main.ts` (its glob includes

.claude/skills/test-electron-app/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: test-electron-app
-description: Drive the real running PostHog Code Electron app (live tRPC, workspace-server, real data) over CDP with agent-browser. Connect to the running app on port 9222, snapshot the accessibility tree to verify changes, click/type/navigate, and screenshot the actual desktop app only when explicitly asked. Use when asked to test, verify, dogfood, screenshot or interact with the running app. For regression specs use the Playwright E2E suite.
+description: Drive the real running PostHog Electron app (live tRPC, workspace-server, real data) over CDP with agent-browser. Connect to the running app on port 9222, snapshot the accessibility tree to verify changes, click/type/navigate, and screenshot the actual desktop app only when explicitly asked. Use when asked to test, verify, dogfood, screenshot or interact with the running app. For regression specs use the Playwright E2E suite.
 allowed-tools: Bash(agent-browser:*), Bash(npx agent-browser:*), Bash(pnpm app:cdp*)
 ---
 
-# Test the real PostHog Code Electron app
+# Test the real PostHog Electron app
 
 Drive the actual running app over the Chrome DevTools Protocol with
 [agent-browser](https://github.com/vercel-labs/agent-browser). The dev app
@@ -186,7 +186,7 @@ When the user asked for a screenshot, they want to look at it, so close the loop
   default debugging port; if `connect` attaches to the wrong target, list and
   pick the PostHog window: `agent-browser tab` then `agent-browser tab --url "*"`.
 - **Multiple targets:** the app has a main renderer window (page title contains
-  "PostHog Code") plus possible webviews/devtools. `agent-browser tab` lists them;
+  "PostHog") plus possible webviews/devtools. `agent-browser tab` lists them;
   switch with `agent-browser tab <index>`.
 - **Never pass `--color-scheme dark`:** that global flag makes agent-browser apply
   device emulation that forces a 1280x720 viewport and renders this Electron window
@@ -201,7 +201,7 @@ When the user asked for a screenshot, they want to look at it, so close the loop
 
 ## Running alongside prod
 
-PostHog Code orchestrates the agent, so the usual loop is: **prod** (the installed app) runs the agent, and the **dev** build (`pnpm dev`) is the system under test. They coexist by design (`apps/code/src/main/bootstrap.ts`): dev runs as `posthog-code-dev` with its own app name, userData and single-instance lock, so it never collides with prod.
+PostHog orchestrates the agent, so the usual loop is: **prod** (the installed app) runs the agent, and the **dev** build (`pnpm dev`) is the system under test. They coexist by design (`apps/code/src/main/bootstrap.ts`): dev runs as `posthog-code-dev` with its own app name, userData and single-instance lock, so it never collides with prod.
 
 - **agent-browser always targets dev.** Only the dev build exposes CDP on `:9222`; prod has no debug port, so `connect 9222` can't accidentally drive prod.
 - **Separate auth/state.** The dev instance has its own `posthog-code-dev` profile; it is not signed in just because prod is. Sign into the dev window once; its state persists.
@@ -220,6 +220,6 @@ PostHog Code orchestrates the agent, so the usual loop is: **prod** (the install
   check the `pnpm dev:code` output. Note `pnpm dev` cannot run headlessly at all — its
   `phrocs` TUI needs a TTY; use `pnpm dev:code`.
 - **Snapshot is empty / wrong window:** you're on the wrong target. Run
-  `agent-browser tab` and switch to the "PostHog Code" page.
+  `agent-browser tab` and switch to the "PostHog" page.
 - **Can't type into an input:** try `agent-browser keyboard type "text"` (types at
   current focus) or `agent-browser keyboard inserttext "text"` to bypass key events.

.github/actions/restore-turbo-cache/action.yml

@@ -0,0 +1,13 @@
+name: Restore turbo cache
+description: Restore-only turbo cache. warm-caches.yml seeds it on main pushes; PR workflows never save, so per-PR entries don't pollute the cache store.
+
+runs:
+  using: composite
+  steps:
+    - name: Restore turbo cache
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: .turbo/cache
+        key: turbo-${{ github.sha }}
+        restore-keys: |
+          turbo-

.github/workflows/build.yml

@@ -59,29 +59,17 @@ jobs:
           node-version: 22
           cache: "pnpm"
 
+      - name: Restore turbo cache
+        uses: ./.github/actions/restore-turbo-cache
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
+        env:
+          # The packaged app is never launched, so the Electron-ABI rebuild is unused.
+          SKIP_ELECTRON_REBUILD: "1"
 
-      - name: Build electron-trpc
-        run: pnpm --filter @posthog/electron-trpc build
-
-      - name: Build platform
-        run: pnpm --filter @posthog/platform build
-
-      - name: Build shared
-        run: pnpm --filter @posthog/shared build
-
-      - name: Build git
-        run: pnpm --filter @posthog/git build
-
-      - name: Build enricher
-        run: pnpm --filter @posthog/enricher build
-
-      - name: Build harness
-        run: pnpm --filter @posthog/harness build
-
-      - name: Build agent
-        run: pnpm --filter agent build
+      - name: Build packages
+        run: pnpm run build:deps
 
       - name: Build code
         run: pnpm --filter code build

.github/workflows/code-build-test.yml

@@ -114,9 +114,9 @@ jobs:
           MATRIX_ARCH: ${{ matrix.arch }}
         run: |
           if [[ "$MATRIX_ARCH" == "arm64" ]]; then
-            APP_BUNDLE="apps/code/out/mac-arm64/PostHog Code.app"
+            APP_BUNDLE="apps/code/out/mac-arm64/PostHog.app"
           else
-            APP_BUNDLE="apps/code/out/mac/PostHog Code.app"
+            APP_BUNDLE="apps/code/out/mac/PostHog.app"
           fi
           RESOURCES="$APP_BUNDLE/Contents/Resources"
           UNPACKED="$RESOURCES/app.asar.unpacked/node_modules"

.github/workflows/code-discord-release.yml

@@ -1,4 +1,4 @@
-name: Release PostHog Code to Discord
+name: Release PostHog to Discord
 
 on:
   release:

.github/workflows/code-release.yml

@@ -1,4 +1,4 @@
-name: Release PostHog Code
+name: Release PostHog
 
 on:
   push:
@@ -170,9 +170,9 @@ jobs:
           MATRIX_ARCH: ${{ matrix.arch }}
         run: |
           if [[ "$MATRIX_ARCH" == "arm64" ]]; then
-            APP_BUNDLE="apps/code/out/mac-arm64/PostHog Code.app"
+            APP_BUNDLE="apps/code/out/mac-arm64/PostHog.app"
           else
-            APP_BUNDLE="apps/code/out/mac/PostHog Code.app"
+            APP_BUNDLE="apps/code/out/mac/PostHog.app"
           fi
           RESOURCES="$APP_BUNDLE/Contents/Resources"
           UNPACKED="$RESOURCES/app.asar.unpacked/node_modules"
@@ -237,6 +237,25 @@ jobs:
             apps/code/out/*-mac.zip \
             apps/code/out/*.blockmap
 
+      - name: Configure AWS credentials for the update feed
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        with:
+          role-to-assume: ${{ secrets.AWS_DESKTOP_APP_RELEASES_ROLE_ARN }}
+          aws-region: us-east-1
+          mask-aws-account-id: true
+          unset-current-credentials: true
+
+      # Binaries carry the version in their filename, so they are immutable.
+      # Channel files are uploaded last by finalize-release; updaters only see
+      # this release once those land.
+      - name: Upload artifacts to the S3 update feed
+        working-directory: apps/code/out
+        run: |
+          for f in *.dmg *-mac.zip *.blockmap; do
+            aws s3 cp "$f" "s3://posthog-desktop-app-releases-prod-us/stable/$f" \
+              --cache-control "public, max-age=31536000, immutable"
+          done
+
       # Hash the same files uploaded above; finalize-release turns these into
       # the download tables in the release notes.
       - name: Compute artifact checksums
@@ -376,6 +395,35 @@ jobs:
           $files = $items | Select-Object -ExpandProperty FullName
           gh release upload "v$env:APP_VERSION" --repo PostHog/code --clobber @files
 
+      - name: Configure AWS credentials for the update feed
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        with:
+          role-to-assume: ${{ secrets.AWS_DESKTOP_APP_RELEASES_ROLE_ARN }}
+          aws-region: us-east-1
+          mask-aws-account-id: true
+          unset-current-credentials: true
+
+      # latest.yml is NOT uploaded here: finalize-release injects release notes
+      # and publishes it last, which is what flips the S3 feed to this version.
+      - name: Upload artifacts to the S3 update feed
+        shell: pwsh
+        run: |
+          $out = "apps/code/out"
+          $items = @()
+          $items += Get-ChildItem $out -File -Filter "*.exe"
+          $items += Get-ChildItem $out -File -Filter "*.blockmap"
+          foreach ($f in $items) {
+            aws s3 cp $f.FullName "s3://posthog-desktop-app-releases-prod-us/stable/$($f.Name)" --cache-control "public, max-age=31536000, immutable"
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          }
+
+      - name: Upload windows manifest artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: win-manifest
+          path: apps/code/out/latest.yml
+          retention-days: 1
+
       # Hash the same files uploaded above (minus latest.yml); finalize-release
       # turns these into the download tables in the release notes.
       - name: Compute artifact checksums
@@ -522,6 +570,30 @@ jobs:
             apps/code/out/*.deb \
             apps/code/out/*.rpm
 
+      - name: Configure AWS credentials for the update feed
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        with:
+          role-to-assume: ${{ secrets.AWS_DESKTOP_APP_RELEASES_ROLE_ARN }}
+          aws-region: us-east-1
+          mask-aws-account-id: true
+          unset-current-credentials: true
+
+      # No Linux auto-updater consumes latest-linux*.yml today (updates are
+      # macOS and Windows only), so the manifests can ship with the binaries
+      # instead of waiting for the finalize flip.
+      - name: Upload artifacts to the S3 update feed
+        working-directory: apps/code/out
+        run: |
+          for f in *.AppImage *.deb *.rpm; do
+            aws s3 cp "$f" "s3://posthog-desktop-app-releases-prod-us/stable/$f" \
+              --cache-control "public, max-age=31536000, immutable"
+          done
+          for f in latest-linux*.yml; do
+            [ -e "$f" ] || continue
+            aws s3 cp "$f" "s3://posthog-desktop-app-releases-prod-us/stable/$f" \
+              --cache-control "no-cache"
+          done
+
       # Hash the same files uploaded above; finalize-release turns these into
       # the download tables in the release notes.
       - name: Compute artifact checksums
@@ -545,6 +617,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
     steps:
       - name: Get app token
         id: app-token
@@ -559,12 +632,14 @@ jobs:
           TAG_VERSION="${GITHUB_REF#refs/tags/v}"
           echo "version=$TAG_VERSION" >> "$GITHUB_OUTPUT"
 
-      - name: Checkout merge script
+      - name: Checkout release scripts
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           sparse-checkout: |
             apps/code/scripts/merge-mac-manifests.mjs
             apps/code/scripts/generate-release-download-tables.mjs
+            apps/code/scripts/build-releases-feed.mjs
+            apps/code/scripts/inject-release-notes.mjs
           sparse-checkout-cone-mode: false
 
       - name: Setup Node.js
@@ -618,3 +693,86 @@ jobs:
           printf '\n' >> /tmp/release-notes.md
           node apps/code/scripts/generate-release-download-tables.mjs "$APP_VERSION" /tmp/checksums >> /tmp/release-notes.md
           gh release edit "v$APP_VERSION" --repo PostHog/code --draft=false --notes-file /tmp/release-notes.md
+
+      - name: Download windows manifest
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: win-manifest
+          path: /tmp/win-manifest
+
+      # Built after the GitHub release is published so the new release (and its
+      # generated notes) is included; the in-app release notes read this file.
+      - name: Build releases feed manifest
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: node apps/code/scripts/build-releases-feed.mjs /tmp/releases.json
+
+      # The generic provider fetches nothing from GitHub, so the channel files
+      # must carry the notes for electron-updater's UpdateInfo.releaseNotes.
+      - name: Inject release notes into channel files
+        run: |
+          node apps/code/scripts/inject-release-notes.mjs /tmp/release-notes.md \
+            /tmp/latest-mac.yml /tmp/win-manifest/latest.yml
+
+      - name: Configure AWS credentials for the update feed
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        with:
+          role-to-assume: ${{ secrets.AWS_DESKTOP_APP_RELEASES_ROLE_ARN }}
+          aws-region: us-east-1
+          mask-aws-account-id: true
+          unset-current-credentials: true
+
+      # The channel-file upload is the S3 publish flip: updaters only see the
+      # new version once these land, after every platform's binaries are up.
+      # Stage all files first, then flip with server-side copies, so a failed
+      # runner upload can never leave the feed advertising a mixed release
+      # (e.g. macOS on the new version while Windows still serves the old one).
+      # Copies preserve the staged objects' cache-control metadata.
+      - name: Publish channel files to the S3 update feed
+        env:
+          APP_VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          FEED="s3://posthog-desktop-app-releases-prod-us/stable"
+          STAGING="$FEED/.staging/v$APP_VERSION"
+
+          aws s3 cp /tmp/latest-mac.yml "$STAGING/latest-mac.yml" --cache-control "no-cache"
+          aws s3 cp /tmp/win-manifest/latest.yml "$STAGING/latest.yml" --cache-control "no-cache"
+          aws s3 cp /tmp/releases.json "$STAGING/releases.json" --cache-control "no-cache"
+
+          aws s3 cp "$STAGING/latest-mac.yml" "$FEED/latest-mac.yml"
+          aws s3 cp "$STAGING/latest.yml" "$FEED/latest.yml"
+          aws s3 cp "$STAGING/releases.json" "$FEED/releases.json"
+
+          aws s3 rm --recursive "$STAGING/" || echo "staging cleanup failed; harmless"
+
+      # The little markdown table in the run summary: public CloudFront URLs for
+      # everything this release published to the feed.
+      - name: Write release summary
+        env:
+          APP_VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          BASE="https://desktop-releases.posthog.com/stable"
+          V="$APP_VERSION"
+          {
+            echo "## v$V on the update feed"
+            echo ""
+            echo "| Artifact | URL |"
+            echo "| --- | --- |"
+            for f in \
+              "PostHog-Code-$V-arm64-mac.dmg" \
+              "PostHog-Code-$V-arm64-mac.zip" \
+              "PostHog-Code-$V-x64-mac.dmg" \
+              "PostHog-Code-$V-x64-mac.zip" \
+              "PostHog-Code-$V-x64-win.exe" \
+              "PostHog-Code-$V-arm64-linux.AppImage" \
+              "PostHog-Code-$V-arm64-linux.deb" \
+              "PostHog-Code-$V-arm64-linux.rpm" \
+              "PostHog-Code-$V-x64-linux.AppImage" \
+              "PostHog-Code-$V-x64-linux.deb" \
+              "PostHog-Code-$V-x64-linux.rpm" \
+              "latest-mac.yml" \
+              "latest.yml" \
+              "releases.json"; do
+              echo "| \`$f\` | $BASE/$f |"
+            done
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/code-storybook.yml

@@ -115,8 +115,13 @@ jobs:
           restore-keys: |
             playwright-chromium-${{ runner.os }}-
 
+      - name: Restore turbo cache
+        uses: ./.github/actions/restore-turbo-cache
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
+        env:
+          SKIP_ELECTRON_REBUILD: "1"
 
       - name: Install Playwright Chromium
         if: steps.playwright-cache.outputs.cache-hit != 'true'
@@ -130,38 +135,7 @@ jobs:
         run: pnpm exec playwright install-deps chromium
 
       - name: Build workspace packages
-        # Bare `wait` returns the exit status of only the last job passed to
-        # it, silently swallowing failures from the others. `wait_all` waits
-        # on each PID individually and checks its own status so any failed
-        # build fails the step.
-        run: |
-          wait_all() {
-            status=0
-            for pid in "$@"; do
-              wait "$pid" || status=$?
-            done
-            [ "$status" -eq 0 ]
-          }
-
-          pnpm --filter @posthog/electron-trpc build &
-          pid1=$!
-          (pnpm --filter @posthog/shared build && pnpm --filter @posthog/platform build) &
-          pid2=$!
-          wait_all "$pid1" "$pid2"
-
-          # @posthog/agent imports the dist of @posthog/git and
-          # @posthog/harness, so both must finish before the last group starts.
-          pnpm --filter @posthog/git build &
-          pid3=$!
-          pnpm --filter @posthog/harness build &
-          pid4=$!
-          wait_all "$pid3" "$pid4"
-
-          pnpm --filter @posthog/enricher build &
-          pid5=$!
-          pnpm --filter @posthog/agent build &
-          pid6=$!
-          wait_all "$pid5" "$pid6"
+        run: pnpm run build:deps
 
       - name: Build Storybook
         working-directory: apps/code