Render agent thread updates: markdown links and agent-authored messages#3380
Conversation
|
😎 Merged directly without going through the merge queue, as the queue was empty and the PR was up to date with the target branch - details. |
|
React Doctor found no issues in the changed files. 🎉 Reviewed by React Doctor for commit |
k11kirky
changed the title
When a canvas-mode generation finishes, the client that started it now posts into the task's thread: a one-time "[Canvas name](link) has been created" comment when the run built a new canvas, plus a turn-complete note @-mentioning the task creator. Thread rendering learns markdown-style [label](url) links so the created comment reads as a named link. Generated-By: PostHog Code Task-Id: ea09a661-1f6d-4bd8-a046-24be60909d28
The canvas-created and turn-complete thread posts now come from the PostHog backend (PostHog/posthog#70371) so they land even when no client is open. This PR keeps only the rendering side: markdown [label](url) links in thread messages, and authorless messages shown as "Agent" with a robot avatar. Generated-By: PostHog Code Task-Id: ea09a661-1f6d-4bd8-a046-24be60909d28
Types the new TaskThreadMessage fields from PostHog/posthog#70371 (stacked on #70320) and keys agent rendering on author_kind, keeping the authorless fallback for older backends. payload.run_id on turn_complete rows is the dedupe key for live session-derived agent turn views. Generated-By: PostHog Code Task-Id: ea09a661-1f6d-4bd8-a046-24be60909d28
79fb7e2 to
5ce84d0
Compare
Render structured and legacy authorless agent announcements with the Agent identity in the Quill thread row, and keep message actions limited to human messages. Add regression coverage for the current component. Generated-By: PostHog Code Task-Id: 152cf34b-23c8-4e87-be9e-12d727e08edd
|
Reviews (1): Last reviewed commit: "Adapt agent thread announcements to curr..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Treat structured author kinds as authoritative so system rows render as System and legacy authorless rows retain human behavior. Parse markdown links before mentions so labels containing @agent remain intact, with regression coverage for both review findings. Generated-By: PostHog Code Task-Id: 152cf34b-23c8-4e87-be9e-12d727e08edd
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
| segments.push({ | ||
| type: "link", | ||
| text: match[1] ?? "", | ||
| href: match[2] ?? "", |
There was a problem hiding this comment.
Medium: Deceptive external links
A collaborator can post [https://us.posthog.com](https://attacker.example) so the thread displays the trusted PostHog URL while clicking opens the attacker-controlled site. Restrict labeled-link rendering to server-authored announcements, or expose the destination host for human-authored messages.
PR overviewThis pull request updates agent thread rendering to support markdown-style links and messages authored by agents in the canvas UI. The relevant changes are in the linkification logic used to display thread content. There is one open security concern: human-authored thread content can render a trusted-looking link label while sending users to a different external destination. This creates a phishing/deception risk for collaborators viewing thread updates, though the impact is limited to users choosing to click the misleading link. No issues have been fixed or addressed yet. Open issues (1)
Fixed/addressed: 0 · PR risk: 5/10 |
|
/trunk merge |
#3380 landed on main after this branch was cut and already renders agent thread rows (author_kind on TaskThreadMessage, robot avatar + "Agent" label, no hover menu) inside ThreadMessageRow. Remove this branch's parallel copy: the duplicated TaskThreadMessage fields the rebase glued in, the separate AgentThreadRow component, and isAgentThreadMessage, whose only consumer was that branch. Keep the TaskThreadMessageEvent union and point the existing event field at it — the one piece #3380 didn't cover. Generated-By: PostHog Code Task-Id: a0f85df1-4a8f-4467-8051-e471b5e95009
3 participants
Problem
The backend now posts durable agent updates into task threads, including canvas creation links and turn-complete announcements. The client rendered markdown links as raw text and displayed agent-authored rows as "Unknown".
Why: Thread updates should remain readable and clearly attributed when they are delivered without a human author.
Changes
How did you test this?
pnpm exec biome check --write packages/shared/src/domain-types.ts packages/ui/src/features/canvas/components/ThreadPanel.tsx packages/ui/src/features/canvas/components/ThreadPanel.test.tsx packages/ui/src/features/canvas/utils/linkify.ts packages/ui/src/features/canvas/utils/linkify.test.tspnpm --filter @posthog/shared typecheckpnpm --filter @posthog/ui typecheckcd packages/ui && pnpm exec vitest run src/features/canvas/components/ThreadPanel.test.tsx src/features/canvas/utils/linkify.test.tsAutomatic notifications
Created with PostHog Code