fix(web): bind inbox reportModelResolver + guard host capabilities

The web host never bound REPORT_MODEL_RESOLVER, so creating a cloud run
from canvas/home/inbox threw "No bindings found" at the point of use.
Bind it over the web host router's getPreviewConfigOptions, mirroring the
desktop adapter.

Prevent the whole class of gap: useService<T>(TOKEN) takes its type from
the caller, so a host forgetting to bind a capability shared UI resolves
is invisible to the compiler and only surfaces when a user hits the code
path. Add assertHostCapabilities() in @posthog/di, a canonical
REQUIRED_HOST_CAPABILITIES registry in @posthog/ui/shell, and call it at
the end of both composition roots so a missing binding fails at boot.
Stand up Vitest for apps/web with a container smoke test that locks the
contract in for CI without a browser.

Generated-By: PostHog Code
Task-Id: 77d13a30-444d-4045-9d80-5e2a9f2e68ae

Author: gantoine

apps/code/src/renderer/main.tsx

@@ -19,10 +19,12 @@ import { Providers } from "@components/Providers";
 import { DevToolbarHost } from "@features/dev-toolbar/DevToolbarHost";
 import { preloadHighlighter } from "@pierre/diffs";
 import { boot } from "@posthog/di/contribution";
+import { assertHostCapabilities } from "@posthog/di/hostCapabilities";
 import { ServiceProvider } from "@posthog/di/react";
 import App from "@posthog/ui/shell/App";
 import { logger } from "@posthog/ui/shell/logger";
 import { initializePostHog } from "@posthog/ui/shell/posthogAnalyticsImpl";
+import { REQUIRED_HOST_CAPABILITIES } from "@posthog/ui/shell/requiredHostCapabilities";
 import { registerDesktopContributions } from "@renderer/desktop-contributions";
 import { container } from "@renderer/di/container";
 import "@renderer/desktop-services";
@@ -95,6 +97,11 @@ const root = ReactDOM.createRoot(rootElement);
 
 try {
   registerDesktopContributions();
+  // Fail loudly (into BootErrorScreen) if a capability the shared app resolves
+  // via service location is unbound, rather than deferring to the first
+  // navigation that needs it. The renderer container backs every useService, so
+  // all required tokens must resolve here. Shared with the web host.
+  assertHostCapabilities(container, REQUIRED_HOST_CAPABILITIES);
   boot(container).catch((error: unknown) => {
     bootLog.error("Renderer boot sequence failed", error);
     // Replaces the mounted tree without running effect cleanup; acceptable

apps/web/package.json

@@ -7,7 +7,8 @@
   "scripts": {
     "dev": "vite",
     "build": "vite build",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "0.22.1",
@@ -38,8 +39,10 @@
     "@types/react": "^19.1.0",
     "@types/react-dom": "^19.1.0",
     "@vitejs/plugin-react": "^4.2.1",
+    "jsdom": "^26.0.0",
     "tailwindcss": "^4.2.2",
     "typescript": "^5.9.3",
-    "vite": "^6.0.7"
+    "vite": "^6.0.7",
+    "vitest": "^4.1.8"
   }
 }

apps/web/src/test/setup.ts

@@ -0,0 +1,50 @@
+import { vi } from "vitest";
+
+// jsdom leaves several browser globals that the web composition root touches at
+// import time undefined. Provide minimal stand-ins so importing web-container.ts
+// (and the stores it pulls in) doesn't throw before the container is built.
+
+// localStorage: several per-device stores read it at module init.
+if (typeof window.localStorage?.setItem !== "function") {
+  const store = new Map<string, string>();
+  const localStoragePolyfill: Storage = {
+    get length() {
+      return store.size;
+    },
+    clear: () => store.clear(),
+    getItem: (key) => store.get(key) ?? null,
+    key: (index) => [...store.keys()][index] ?? null,
+    removeItem: (key) => {
+      store.delete(key);
+    },
+    setItem: (key, value) => {
+      store.set(key, String(value));
+    },
+  };
+  Object.defineProperty(window, "localStorage", {
+    configurable: true,
+    value: localStoragePolyfill,
+  });
+  Object.defineProperty(globalThis, "localStorage", {
+    configurable: true,
+    value: localStoragePolyfill,
+  });
+}
+
+// matchMedia: UI stores (e.g. themeStore) read it at module load.
+if (typeof window.matchMedia !== "function") {
+  Object.defineProperty(window, "matchMedia", {
+    configurable: true,
+    writable: true,
+    value: vi.fn().mockImplementation((query: string) => ({
+      matches: false,
+      media: query,
+      onchange: null,
+      addListener: vi.fn(),
+      removeListener: vi.fn(),
+      addEventListener: vi.fn(),
+      removeEventListener: vi.fn(),
+      dispatchEvent: vi.fn(),
+    })),
+  });
+}

apps/web/src/web-container.test.ts

@@ -0,0 +1,19 @@
+import { assertHostCapabilities } from "@posthog/di/hostCapabilities";
+import { REQUIRED_HOST_CAPABILITIES } from "@posthog/ui/shell/requiredHostCapabilities";
+import { describe, expect, it } from "vitest";
+
+// The web host is the portability smoke test: a single in-browser container, no
+// Electron. This locks in that it binds every capability the shared app resolves
+// via service location, so a gap like the missing inbox reportModelResolver
+// fails in CI instead of at the first navigation that needs it.
+describe("web composition root", () => {
+  it("binds every required host capability", async () => {
+    // Importing the module builds the container and (as of the fix) already runs
+    // assertHostCapabilities at the end; re-run it explicitly so a regression
+    // fails here with the descriptive list rather than as a bare import error.
+    const { container } = await import("./web-container");
+    expect(() =>
+      assertHostCapabilities(container, REQUIRED_HOST_CAPABILITIES),
+    ).not.toThrow();
+  });
+});

apps/web/src/web-container.ts

@@ -59,6 +59,11 @@ import {
   GIT_INTERACTION_SERVICE,
   GIT_WRITE_CLIENT,
 } from "@posthog/core/git-interaction/identifiers";
+import {
+  REPORT_MODEL_RESOLVER,
+  type ReportModelResolver,
+} from "@posthog/core/inbox/identifiers";
+import { selectModelFromOptions } from "@posthog/core/inbox/reportTaskCreation";
 import { githubConnectModule } from "@posthog/core/integrations/githubConnect.module";
 import {
   GITHUB_CONNECT_CLIENT as INTEGRATIONS_GITHUB_CONNECT_CLIENT,
@@ -144,6 +149,7 @@ import {
 import type { TaskDeletionService } from "@posthog/core/tasks/taskDeletionService";
 import { tasksModule } from "@posthog/core/tasks/tasks.module";
 import { setRootContainer } from "@posthog/di/container";
+import { assertHostCapabilities } from "@posthog/di/hostCapabilities";
 import { ROOT_LOGGER, type RootLogger } from "@posthog/di/logger";
 import {
   HOST_TRPC_CLIENT,
@@ -165,7 +171,7 @@ import {
   type IPowerManager,
   POWER_MANAGER_SERVICE,
 } from "@posthog/platform/power-manager";
-import { SYNC_CLOUD_TASKS_FLAG } from "@posthog/shared";
+import { type Adapter, SYNC_CLOUD_TASKS_FLAG } from "@posthog/shared";
 import { sandboxProxyHtml } from "@posthog/shared/mcp-sandbox-proxy";
 import { authUiModule } from "@posthog/ui/features/auth/auth.module";
 import {
@@ -259,6 +265,7 @@ import {
   IMPERATIVE_QUERY_CLIENT,
   type ImperativeQueryClient,
 } from "@posthog/ui/shell/queryClient";
+import { REQUIRED_HOST_CAPABILITIES } from "@posthog/ui/shell/requiredHostCapabilities";
 import { QueryClient } from "@tanstack/react-query";
 import {
   WebAuthConnectivity,
@@ -367,6 +374,7 @@ interface WebBindings {
   [NOTIFICATIONS_SERVICE]: INotifications;
   [NOTIFICATION_SETTINGS_PROVIDER]: INotificationSettings;
   [ACTIVE_VIEW_PROVIDER]: IActiveView;
+  [REPORT_MODEL_RESOLVER]: ReportModelResolver;
 }
 
 export const queryClient = new QueryClient();
@@ -756,4 +764,37 @@ container
   .toConstantValue(webNotificationSettings);
 container.bind(ACTIVE_VIEW_PROVIDER).toConstantValue(webActiveView);
 
+// ── Inbox: resolve the default cloud-run model from the LLM gateway ──
+// Host capability consumed by UI hooks (canvas/home/inbox) that create cloud
+// runs. Same logic as desktop-services.ts, over the web host router's
+// getPreviewConfigOptions (backed by the CORS-open gateway, web-agent-config.ts).
+const reportModelResolverLog = scoped("report-model-resolver");
+container.bind(REPORT_MODEL_RESOLVER).toConstantValue({
+  async resolveDefaultModel(
+    apiHost: string,
+    adapter: Adapter,
+    preferredModel?: string | null,
+  ): Promise<string | undefined> {
+    try {
+      const options = await hostTrpcClient.agent.getPreviewConfigOptions.query({
+        apiHost,
+        adapter,
+      });
+      return selectModelFromOptions(options, preferredModel);
+    } catch (error) {
+      reportModelResolverLog.warn("Failed to resolve default model", {
+        error,
+        adapter,
+      });
+      return undefined;
+    }
+  },
+} satisfies ReportModelResolver);
+
+// Fail loudly at composition time if a capability the shared app resolves via
+// service location is unbound, instead of limping to the first navigation that
+// needs it (how the missing reportModelResolver first surfaced). CI locks this
+// in via web-container.test.ts.
+assertHostCapabilities(container, REQUIRED_HOST_CAPABILITIES);
+
 setRootContainer(container);

apps/web/vite.aliases.ts

@@ -0,0 +1,28 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const dir = path.dirname(fileURLToPath(import.meta.url));
+const src = (name: string) => path.resolve(dir, `../../packages/${name}/src`);
+
+// Mirror apps/code's vite.shared.mts: resolve @posthog/<pkg>/<sub> to package
+// src, since the packages' array-fallback `exports` don't resolve under Rollup.
+// Shared by vite.config.ts (build/dev) and vitest.config.ts (tests) so the two
+// can't drift.
+const subpath = (name: string) => ({
+  find: new RegExp(`^@posthog/${name}/(.+)$`),
+  replacement: `${src(name)}/$1`,
+});
+
+export const posthogSrcAliases = [
+  subpath("di"),
+  subpath("ui"),
+  subpath("core"),
+  subpath("shared"),
+  subpath("host-router"),
+  subpath("host-trpc"),
+  subpath("platform"),
+  subpath("workspace-client"),
+  subpath("api-client"),
+  subpath("agent"),
+  subpath("enricher"),
+];

apps/web/vite.config.ts

@@ -4,16 +4,9 @@ import tailwindcss from "@tailwindcss/vite";
 import { TanStackRouterVite } from "@tanstack/router-plugin/vite";
 import react from "@vitejs/plugin-react";
 import { defineConfig } from "vite";
+import { posthogSrcAliases } from "./vite.aliases";
 
 const dir = path.dirname(fileURLToPath(import.meta.url));
-const src = (name: string) => path.resolve(dir, `../../packages/${name}/src`);
-
-// Mirror apps/code's vite.shared.mts: resolve @posthog/<pkg>/<sub> to package src,
-// since the packages' array-fallback `exports` don't resolve under Rollup.
-const subpath = (name: string) => ({
-  find: new RegExp(`^@posthog/${name}/(.+)$`),
-  replacement: `${src(name)}/$1`,
-});
 
 // Peel the biggest statically-imported vendors out of the single ~8.6 MB entry
 // chunk into cacheable groups so the browser downloads them in parallel and
@@ -74,19 +67,7 @@ export default defineConfig({
   // never gets a key.
   envDir: path.resolve(dir, "../.."),
   resolve: {
-    alias: [
-      subpath("di"),
-      subpath("ui"),
-      subpath("core"),
-      subpath("shared"),
-      subpath("host-router"),
-      subpath("host-trpc"),
-      subpath("platform"),
-      subpath("workspace-client"),
-      subpath("api-client"),
-      subpath("agent"),
-      subpath("enricher"),
-    ],
+    alias: posthogSrcAliases,
   },
   server: { port: 5273 },
   build: {

apps/web/vitest.config.ts

@@ -0,0 +1,20 @@
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vitest/config";
+import { trunkTestOptions } from "../../vitest.config.base";
+import { posthogSrcAliases } from "./vite.aliases";
+
+// Deliberately does NOT load vite.config.ts: that would run TanStackRouterVite
+// and regenerate routeTree.gen.ts as a side effect of running tests. We only
+// need the @posthog/* → src aliases, shared via vite.aliases.ts.
+export default defineConfig({
+  plugins: [react()],
+  resolve: { alias: posthogSrcAliases },
+  test: {
+    globals: true,
+    ...trunkTestOptions,
+    environment: "jsdom",
+    setupFiles: ["./src/test/setup.ts"],
+    include: ["src/**/*.test.ts", "src/**/*.test.tsx"],
+    exclude: ["**/node_modules/**", "**/dist/**"],
+  },
+});

packages/di/src/hostCapabilities.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it } from "vitest";
+import { assertHostCapabilities } from "./hostCapabilities";
+
+const TOKEN_A = Symbol.for("posthog.test.capabilityA");
+const TOKEN_B = Symbol.for("posthog.test.capabilityB");
+
+function containerBinding(bound: symbol[]): {
+  isBound: (t: symbol) => boolean;
+} {
+  const set = new Set(bound);
+  return { isBound: (t) => set.has(t) };
+}
+
+describe("assertHostCapabilities", () => {
+  it("passes when every required token is bound", () => {
+    const container = containerBinding([TOKEN_A, TOKEN_B]);
+    expect(() =>
+      assertHostCapabilities(container, [
+        { token: TOKEN_A, description: "A" },
+        { token: TOKEN_B, description: "B" },
+      ]),
+    ).not.toThrow();
+  });
+
+  it("passes when there are no requirements", () => {
+    expect(() =>
+      assertHostCapabilities(containerBinding([]), []),
+    ).not.toThrow();
+  });
+
+  it("throws listing every missing token and its description", () => {
+    const container = containerBinding([TOKEN_A]);
+    expect(() =>
+      assertHostCapabilities(container, [
+        { token: TOKEN_A, description: "A is fine" },
+        { token: TOKEN_B, description: "B drives cloud runs" },
+      ]),
+    ).toThrowError(/missing 1 required capability/);
+  });
+
+  it("reports all missing tokens at once, not just the first", () => {
+    const container = containerBinding([]);
+    let message = "";
+    try {
+      assertHostCapabilities(container, [
+        { token: TOKEN_A, description: "A drives X" },
+        { token: TOKEN_B, description: "B drives Y" },
+      ]);
+    } catch (error) {
+      message = (error as Error).message;
+    }
+    expect(message).toContain("missing 2 required capability");
+    expect(message).toContain("A drives X");
+    expect(message).toContain("B drives Y");
+    expect(message).toContain(String(TOKEN_A));
+    expect(message).toContain(String(TOKEN_B));
+  });
+});

packages/di/src/hostCapabilities.ts

@@ -0,0 +1,46 @@
+import type { ServiceIdentifier } from "inversify";
+import type { ServiceContainer } from "./container";
+
+/**
+ * A DI token that shared `@posthog/ui` / `@posthog/core` resolves via service
+ * location (`useService` / `resolveService`) and that every host mounting the
+ * shared app must therefore bind in its composition root.
+ */
+export interface HostCapabilityRequirement {
+  /** The token the shared app resolves at runtime. */
+  readonly token: ServiceIdentifier;
+  /** What breaks when it's missing — surfaced in the error message. */
+  readonly description: string;
+}
+
+/**
+ * Throw if the host forgot to bind a capability the shared app resolves at
+ * runtime.
+ *
+ * These gaps are invisible to the compiler: `useService<T>(TOKEN)`'s type
+ * argument is supplied by the caller, not derived from any host's binding map,
+ * so a `TypedContainer<HostBindings>` only checks the *provider* side. A missing
+ * binding otherwise surfaces only when a user reaches the code path that
+ * resolves the token (as happened with the inbox `reportModelResolver` on web).
+ *
+ * Call this synchronously at the end of each composition root, once every
+ * binding is registered, so a broken container fails to start instead of
+ * limping to the first unlucky navigation.
+ */
+export function assertHostCapabilities(
+  container: Pick<ServiceContainer, "isBound">,
+  requirements: readonly HostCapabilityRequirement[],
+): void {
+  const missing = requirements.filter((r) => !container.isBound(r.token));
+  if (missing.length === 0) {
+    return;
+  }
+
+  const lines = missing.map((r) => `  - ${String(r.token)}: ${r.description}`);
+  throw new Error(
+    `Host container is missing ${missing.length} required capability ` +
+      `binding(s) that shared UI/core resolves at runtime:\n${lines.join("\n")}\n` +
+      "Bind them in this host's composition root. See REQUIRED_HOST_CAPABILITIES " +
+      "in @posthog/ui/shell/requiredHostCapabilities.",
+  );
+}