feat(workflows): open entry-point broadcasts and workflows ready to send by dmarchuk · Pull Request #114807 · PostHog/posthog

dmarchuk · 2026-10-09T21:38:09Z

Problem

Clicking "Email people affected", "Email opted-in users" or "Email everyone who responds" opens an empty broadcast or a workflow with only a trigger. The person still has to pick a sender, write a subject and body, and add the email step.
These entry points come from feat(workflows): let other products open a broadcast or workflow for an audience #112985 and its follow-ups. They got people into broadcasts and workflows, but not to a send.

Changes

Broadcasts open on Review, ready to send. An entry point now passes a draft email in the link (email search param). The wizard fills the subject and body. With the project's default sender (feat(workflows): default email sender for new broadcasts and workflow emails #114682), it opens on Review.
The wizard lands on the first step that still needs input. With no usable sender, it opens on Content. A cohort link, which has no draft, also opens on Content with the audience and sender set. Following a link still creates no draft. Continue or launch saves it, as before.
A reload before Continue keeps the prefill. The link params now stay in the URL until the draft exists. Before, the wizard stripped them on open, so a reload started over on an empty Recipients step. The draft URL replaces them once Continue saves.
Workflows open ready to enable. An entry-point link with a draft opens as trigger, email, exit. The email step has the default sender, the draft subject and body, and To {{ person.properties.email }}. An event trigger gets the existing "One time" frequency ({person.id}, indefinitely), so someone who hits the error again gets no second email.
New workflows from a template also get the default sender on email steps that have none. feat(workflows): default email sender for new broadcasts and workflow emails #114682 only covered steps dragged in by hand.
Drafts per source, all fixed templates in messageDrafts.ts. Error tracking uses no issue text, because issue titles are technical. Early access uses the feature name and description. No LLM is involved. A later PR can swap in an AI draft at this one module.

Entry point	Opens on	Subject
Error issue: Email people affected (broadcast)	Review	We fixed an issue you ran into
Error issue: Email anyone who hits this (workflow)	Editor, ready to enable	Sorry about the error you ran into
Survey: Email everyone who responds (workflow)	Editor, ready to enable	Thanks for your feedback
Early access: Send a one-time email (broadcast)	Review	{feature} is now available
Early access: Build a custom workflow	Editor, ready to enable	You have early access to {feature}
Cohort: Email this cohort (broadcast)	Content	None, the person writes it

Security: entity names are untrusted text. The draft link carries plain-text paragraphs, never HTML. The wizard escapes them when it builds the HTML and the visual editor design.
Visual editor: the design holds one text block per paragraph, so the editor opens with the draft in place instead of an empty canvas.
Tracking: broadcast launched gets prefilled_email_edited, and broadcast prefilled from link gets has_email.
Mechanical: the workflowLogic props and logic key gain emailPrefill.

More screenshots and a recording

Early access, one-time email, from the feature page to Review:

A feature name with HTML in it, shown as text:

Cohort link, and a draft with no usable sender, both open on Content:

Workflow from an error issue: frequency set to one time, and the draft in the visual editor:

How did you test this code?

Driven in a real browser (Playwright) on a local stack: this branch's frontend, a Django on a migrated clone of the dev database, and team 1 with four verified senders and a project default.

Error issue, Email people affected: opened the issue, clicked the panel button and continued in the modal. The wizard opened on Review with the template subject and body, and created no draft.
Early access, one-time email: opened on Review with the default sender. Clicked Send now. Postgres afterwards:
- posthog_hogflow row status=active, origin_product=broadcasts, from={"integrationId": 14}, the template subject, and a design key.
- One workflows_hogflowbatchjob row, status=queued.
Early access, workflow: opened as trigger, email, exit. Saved and enabled it. Postgres: status=active, trigger_masking={"ttl": null, "hash": "{person.id}", "bytecode": [...]}, the email step's from={"integrationId": 14}, and escaped HTML.
Error issue, workflow: same result. The trigger panel shows "One time per indefinitely", and the visual editor shows the draft with spacing between paragraphs.
Survey, workflow: opened as trigger, email, exit with the survey template.
Cohort, Email this cohort: opened on Content ("Write your email"). No POST /hog_flows/ request was sent.
Edge cases:
- A feature name with <img src=x onerror=alert(1)> & co: no dialog fired, and the text shows literally in the subject, preview and visual editor.
- A 95-character unicode and emoji feature name: kept as typed in the subject and body.
- An empty feature description: the paragraph is dropped.
- The project default sender unverified, with three other verified senders: opened on Content, because no sender can be picked automatically.

Reload, before and after e06081e (early access link, reload at each step before Continue):

Step reloaded	Before	After
Review	Empty "New broadcast" on Recipients	Review, same audience, name and email
Schedule	Empty, Recipients	Review, prefill kept
Goal	Empty, Recipients	Review, prefill kept
Recipients	Empty, Recipients	Review, prefill kept
Content	Clicking Content saves a draft, so the URL is the draft's	Unchanged: the saved draft reloads

A reload lands back on the first step that needs input, as the link did. Edits made after landing and before Continue are lost on reload, as for any unsaved new broadcast.
Master behaves the same for a broadcast started by hand: a name typed on /broadcasts/new before Continue is gone after a reload. That comes from saving only on Continue, and this PR does not change it.

Liquid in entity names (fix after review):

Built drafts from feature names and a link prefill containing {{ person.properties.email }}, {% if true %}x{% endif %}, {% endraw %}{{ event.event }}, {{{ a }}} and {%- raw -%} and Plain é 🚀 name.
Rendered each subject, text and HTML through the CDP formatLiquidInput, with globals holding a person email and an event name.
Every value came out exactly as typed, and neither the email nor the event name appeared in the output. Before the fix the new messageDrafts.test.ts cases fail (2 of 10).
Not tested: a real send with such a name.

Not tested:

An actual email send. The dev CDP worker reads the main dev database, not the clone, so the queued batch job never ran.
The two analytics properties, because posthog-js does not send locally.
The cohort-saved toast, which uses the same link as the cohort button.

Test rationale:

messageDrafts.test.ts: catches unescaped entity names reaching the HTML or design, Liquid delimiters in a name or link running as a template, and a malformed email param being used. No test covered this module before.
workflowEmailPrefill.test.ts: catches an event-triggered workflow losing its once-per-person frequency, and a template's own sender being overwritten.
broadcastWizardLogic.test.ts, one it.each added next to the existing link-prefill test: catches the wizard landing on the wrong step, or creating a draft when a link opens it.
broadcastWizardLogic.test.ts, the existing link-prefill test now remounts the wizard on the same URL: catches a reload losing the prefill again.

Release status

No feature flag controls this change

Docs update

None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (1M context)

Part of a plan agreed in the session: A (feat(workflows): default email sender for new broadcasts and workflow emails #114682, default sender) and B (feat(workflows): lead entry point copy with email and track the funnel by source #114670, entry-point copy and tracking) merged first. This is C. An AI draft (D) is a follow-up that replaces messageDrafts.ts output, with these templates as its fallback.
Skills invoked: /writing-user-facing-copy, /writing-ui-components, /writing-tests, /posthog-local-e2e-qa, /writing-pr-descriptions.
First version put all paragraphs in one Unlayer text block. The visual editor dropped the paragraph spacing, so each paragraph became its own block.
Local CodeRabbit review skipped: the CLI is signed out and no person was available to sign in.
The first push changed the loadWorkflow return type, which regenerated thousands of lines of kea types. The second commit keeps the type.
Duplicate search found no open PR doing this. feat(workflows): send a broadcast to people who have a feature flag #113009 is the feature-flag entry point and does not prefill an email.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BR6LoqsDMB9Wfnftcy2KiG

…il property

…field property

…nfiltered audiences

… fields

…the email

…missing-recipient-email # Conflicts: # products/workflows/frontend/Broadcasts/broadcastWizardLogic.test.ts # products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts

trunk-io · 2026-10-09T21:38:13Z

😎 Stack merged successfully - details.

github-actions · 2026-10-09T21:38:21Z

🤖 CI report

✅ Trunk lane — non-backend lane

This PR is assigned to the non-backend lane. It does not run backend Python tests and may merge in parallel with PRs in other lanes.

⚠️

Complexity (TypeScript) — 13 functions above the limit (max 63)

Cyclomatic complexity above the limit in changed typescript files (10 for production files, 15 for test files). Warn only: worth simplifying when you next touch these functions.

Function	Location	Complexity	Limit
`EarlyAccessFeature`	`products/early_access_features/frontend/EarlyAccessFeature.tsx:208`	63	10
`<anonymous>`	`products/workflows/frontend/Workflows/workflowLogic.ts:3680`	39	10
`runSave`	`products/workflows/frontend/Workflows/workflowLogic.ts:3233`	37	10
`saveWorkflowSuccess`	`products/workflows/frontend/Workflows/workflowLogic.ts:4178`	33	10
`launchBroadcast`	`products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts:1638`	27	10
`WorkflowScene`	`products/workflows/frontend/Workflows/WorkflowScene.tsx:62`	26	10
`toAudienceFilter`	`products/workflows/frontend/Broadcasts/broadcastAudiencePrefill.ts:59`	25	10
`<anonymous>`	`products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts:1109`	22	10
`<anonymous>`	`products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts:1942`	15	10
`parseMessageDraftPrefill`	`products/workflows/frontend/MessageAudience/messageDrafts.ts:98`	13	10
`setEmail`	`products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts:1424`	12	10
`saveName`	`products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts:1480`	11	10
`moveToDraft`	`products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts:1815`	11	10

✅ Duplication (Python) — clean

New Python code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

✅ Duplication (TypeScript) — clean

New TypeScript code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

⚠️

Comment density — 4% of added code lines are comments (23 of 523)

This section warns when comments are more than 3% of the code lines a PR adds, and alerts above 6%. Before agent-assisted PRs, the typical share was about 2%. Only full-line comments count. Docstrings, generated files, snapshots, migrations, and workflow files are left out.

Comments that restate the code, record how the change came about, or narrate the next line add noise for the next reader. Keep the comments that explain a reason the code cannot show, and remove the rest. See .agents/skills/writing-code-comments/SKILL.md for the house rules.

Files with the most added comment lines:

File	Comment lines	Added lines
`products/workflows/frontend/MessageAudience/messageDrafts.ts`	8	160
`products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts`	6	67
`products/workflows/frontend/Workflows/workflowEmailPrefill.ts`	6	82
`products/workflows/frontend/Workflows/workflowLogic.ts`	2	35
`products/workflows/frontend/Broadcasts/broadcastWizardLogic.test.ts`	1	47

This check does not block merging. It updates on every push and clears when the share drops.

⚠️

Bundle size — 🔺 +4.9 KiB (+0.0%)

Uncompressed size of every built .js bundle, compared against the base branch.

Total: 75.83 MiB · 🔺 +4.9 KiB (+0.0%)

File	Size	Δ vs base
`render-query/src/render-query/render-query.js`	24.36 MiB	🔺 +13.5 KiB (+0.1%)
`posthog-app/_parent/products/workflows/frontend/TemplateLibrary/MessageTemplate.js`	22.1 KiB	🟢 -9.7 KiB (-30.4%)

_{Posted automatically by build-bundle-size-report · uncompressed bytes from dist-report}

✅ Eager graph — within budget

How much code each root ships on the eager path — downloaded and parsed before the surface is interactive. Measured from the esbuild output chunks (post-tree-shake, static imports only); lazy import() / React.lazy chunks are not counted.

Root	Eager (shipped)	Δ vs base	Budget
entry (logged-out pages, app bootstrap) `src/index.tsx`	1002.2 KiB · 23 files	no change	`█████████░` 85.5% of 1.14 MiB
logged-out boot: index + App + bootApp (preloaded by every page, including /login) `src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts`	2.86 MiB · 615 files	no change	`█████████░` 94.4% of 3.03 MiB
authenticated shell (every logged-in page) `src/scenes/AuthenticatedShell.tsx`	7.28 MiB · 2,511 files	🔺 +13.0 KiB (+0.2%)	`██████████` 95.2% of 7.64 MiB
dashboard scene `src/scenes/dashboard/Dashboard.tsx`	9.52 MiB · 3,591 files	🔺 +13.0 KiB (+0.1%)	`█████████░` 92.4% of 10.30 MiB
today home path `src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx`	7.30 MiB · 2,521 files	🔺 +13.0 KiB (+0.2%)	`█████████░` 92.6% of 7.89 MiB
events scene `src/scenes/activity/explore/EventsScene.tsx`	9.11 MiB · 3,426 files	🔺 +13.0 KiB (+0.1%)	`█████████░` 92.2% of 9.88 MiB
replay detail scene `src/scenes/session-recordings/detail/SessionRecordingDetail.tsx`	11.90 MiB · 4,269 files	🔺 +13.0 KiB (+0.1%)	`████████░░` 79.0% of 15.05 MiB

🟢 node_modules/monaco-editor/ stays out of src/index.tsx
🟢 src/lib/components/ActivityLog/describers stays out of src/index.tsx
🟢 node_modules/@posthog/brand/dist/generated/hoggies/svg/ stays out of src/index.tsx
🟢 node_modules/@posthog/brand/dist/generated/hoggies/components/ stays out of src/index.tsx
🟢 node_modules/monaco-editor/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/layout/navigation-3000/navigationLogic.tsx stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/scenes/dashboard/dashboardLogic.tsx stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/lib/lemon-ui/LemonMarkdown/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/lib/components/RichContentEditor/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/lib/components/CodeSnippet/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/taxonomy/core-filter-definitions-by-group.json stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 node_modules/zod/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/scenes/billing/billingLogic.tsx stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 node_modules/monaco-editor/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/lib/components/ActivityLog/describers stays out of src/scenes/AuthenticatedShell.tsx
🟢 products/dashboards/frontend/widgets/previews/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/scenes/session-recordings/player/sessionRecordingPlayerLogic.ts stays out of src/scenes/AuthenticatedShell.tsx
🟢 zod/v4/locales/de.js stays out of src/scenes/AuthenticatedShell.tsx
🟢 node_modules/@posthog/brand/dist/generated/hoggies/svg/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 node_modules/@posthog/brand/dist/generated/hoggies/components/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/scenes/session-recordings/playlist/SessionRecordingsPlaylist.tsx stays out of src/scenes/dashboard/Dashboard.tsx
🟢 src/scenes/web-analytics/tiles/WebAnalyticsTile.tsx stays out of src/scenes/dashboard/Dashboard.tsx
🟢 src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
🟢 src/scenes/project-homepage/today/TodayReportPage.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
🟢 src/queries/Query/Query.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
🟢 src/scenes/session-recordings/playlist/SessionRecordingsPlaylist.tsx stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/scenes/web-analytics/tiles/WebAnalyticsTile.tsx stays out of src/scenes/activity/explore/EventsScene.tsx

Largest files eagerly shipped from src/index.tsx

Size	File
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
24.6 KiB	`../node_modules/.pnpm/buffer@6.0.3/node_modules/buffer/index.js`
6.3 KiB	`../node_modules/.pnpm/react@18.3.1/node_modules/react/cjs/react.production.min.js`
4.5 KiB	`../node_modules/.pnpm/@jspm+core@2.1.0/node_modules/@jspm/core/nodelibs/browser/process.js`
3.9 KiB	`../node_modules/.pnpm/scheduler@0.23.2/node_modules/scheduler/cjs/scheduler.production.min.js`
1.4 KiB	`../node_modules/.pnpm/base64-js@1.5.1/node_modules/base64-js/index.js`
1.3 KiB	`src/RootErrorBoundary.tsx`
1.3 KiB	`src/index.tsx`
912 B	`../node_modules/.pnpm/ieee754@1.2.1/node_modules/ieee754/index.js`
839 B	`src/scenes/ChunkLoadErrorBoundary.tsx`

Largest files eagerly shipped from src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts

Size	File
317.7 KiB	`../node_modules/.pnpm/posthog-js@1.438.4_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
220.8 KiB	`../node_modules/.pnpm/@posthog+icons@0.38.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
101.5 KiB	`src/products.tsx`
99.6 KiB	`src/lib/api.ts`
69.0 KiB	`src/lib/lemon-ui/icons/icons.tsx`
38.7 KiB	`../node_modules/.pnpm/@dnd-kit+core@6.0.8_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@dnd-kit/core/dist/core.esm.js`
33.9 KiB	`../node_modules/.pnpm/kea@4.0.0-pre.6_patch_hash=139b8d1f1304f9d9da452a9a1244c94ea679dbcb85687d8999563146879fb6f5_react@18.3.1/node_modules/kea/lib/index.cjs.js`
28.6 KiB	`src/scenes/scenes.ts`
27.6 KiB	`src/lib/constants.tsx`

Largest files eagerly shipped from src/scenes/AuthenticatedShell.tsx

Size	File
317.7 KiB	`../node_modules/.pnpm/posthog-js@1.438.4_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
280.8 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
220.8 KiB	`../node_modules/.pnpm/@posthog+icons@0.38.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
153.7 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
113.0 KiB	`../packages/quill/packages/quill/dist/index.js`
101.5 KiB	`src/products.tsx`
99.6 KiB	`src/lib/api.ts`
93.3 KiB	`../node_modules/.pnpm/prosemirror-view@1.40.1/node_modules/prosemirror-view/dist/index.js`
90.6 KiB	`../node_modules/.pnpm/@tiptap+core@3.20.6_@tiptap+pm@3.20.6/node_modules/@tiptap/core/dist/index.js`

Largest files eagerly shipped from src/scenes/dashboard/Dashboard.tsx

Size	File
317.7 KiB	`../node_modules/.pnpm/posthog-js@1.438.4_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
280.8 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
220.8 KiB	`../node_modules/.pnpm/@posthog+icons@0.38.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
181.9 KiB	`src/queries/validators.js`
153.7 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
113.0 KiB	`../packages/quill/packages/quill/dist/index.js`
101.5 KiB	`src/products.tsx`
99.6 KiB	`src/lib/api.ts`
93.3 KiB	`../node_modules/.pnpm/prosemirror-view@1.40.1/node_modules/prosemirror-view/dist/index.js`

Largest files eagerly shipped from

src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx

Size	File
317.7 KiB	`../node_modules/.pnpm/posthog-js@1.438.4_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
280.8 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
220.8 KiB	`../node_modules/.pnpm/@posthog+icons@0.38.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
153.7 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
113.0 KiB	`../packages/quill/packages/quill/dist/index.js`
101.5 KiB	`src/products.tsx`
99.6 KiB	`src/lib/api.ts`
93.3 KiB	`../node_modules/.pnpm/prosemirror-view@1.40.1/node_modules/prosemirror-view/dist/index.js`
90.6 KiB	`../node_modules/.pnpm/@tiptap+core@3.20.6_@tiptap+pm@3.20.6/node_modules/@tiptap/core/dist/index.js`

Largest files eagerly shipped from src/scenes/activity/explore/EventsScene.tsx

Size	File
317.7 KiB	`../node_modules/.pnpm/posthog-js@1.438.4_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
280.8 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
220.8 KiB	`../node_modules/.pnpm/@posthog+icons@0.38.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
181.9 KiB	`src/queries/validators.js`
153.7 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
113.0 KiB	`../packages/quill/packages/quill/dist/index.js`
101.5 KiB	`src/products.tsx`
99.6 KiB	`src/lib/api.ts`
93.3 KiB	`../node_modules/.pnpm/prosemirror-view@1.40.1/node_modules/prosemirror-view/dist/index.js`

Largest files eagerly shipped from src/scenes/session-recordings/detail/SessionRecordingDetail.tsx

Size	File
317.7 KiB	`../node_modules/.pnpm/posthog-js@1.438.4_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
316.0 KiB	`../node_modules/.pnpm/posthog-js@1.438.4_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/rrweb.js`
280.8 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
220.8 KiB	`../node_modules/.pnpm/@posthog+icons@0.38.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
181.9 KiB	`src/queries/validators.js`
153.7 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
113.0 KiB	`../packages/quill/packages/quill/dist/index.js`
101.5 KiB	`src/products.tsx`
99.6 KiB	`src/lib/api.ts`

_{Posted automatically by check-eager-graph · sizes are eager output bytes (shipped, post-tree-shake) from the esbuild metafile · part of #32479}

✅ Toolbar bundle — eager 2.24 MiB within budget

What the toolbar ships to customer pages, measured from the esbuild output (minified, post-tree-shake). The eager set is the entry plus everything statically imported from it — fetched before any feature runs; deferred chunks load lazily. The eager guardrail is 5.72 MiB. Each output file must also stay below 10 MB, where CloudFront stops compressing it. The module boundary is enforced separately by check-toolbar-graph.

Metric	Size	Δ vs base	Budget
Eager (shipped) entry + static imports	2.24 MiB · 19 files	no change	`████░░░░░░` 39.2% of 5.72 MiB
Deferred (lazy)	2.19 MiB · 44 files	no change	n/a — loads on demand
Loader `dist/toolbar.js`	1.2 KiB	no change	`█░░░░░░░░░` 6.0% of 19.5 KiB

Largest eagerly-shipped chunks

Size	File
872.1 KiB	`dist/toolbar/toolbar-app-2BT2CMPS.css`
661.9 KiB	`dist/toolbar/chunk-chunk-7N2P2AVY.js`
259.6 KiB	`dist/toolbar/chunk-chunk-LPBBQMMO.js`
138.9 KiB	`dist/toolbar/chunk-chunk-PJ5QL3Y6.js`
131.8 KiB	`dist/toolbar/chunk-chunk-FDH2IBXT.js`
75.2 KiB	`dist/toolbar/toolbar-app-VMJBQ5YR.js`
69.0 KiB	`dist/toolbar/chunk-chunk-TSAL54PB.js`
35.6 KiB	`dist/toolbar/chunk-chunk-UJGIDH7X.js`
21.7 KiB	`dist/toolbar/chunk-chunk-OV4LUCFT.js`
6.8 KiB	`dist/toolbar/chunk-chunk-DV7IWQNF.js`

_{Posted automatically by check-toolbar-size · sizes are toolbar output bytes (shipped, post-tree-shake) from the esbuild metafile}

✅ Dist folder size — 🔺 +179.3 KiB (+0.0%)

Total size of the built frontend/dist folder (all assets), compared against the base branch.

Total: 1010.68 MiB · 🔺 +179.3 KiB (+0.0%)

✅ Playwright — all passed

All tests passed.

View test results →

✅ Hogbox preview — ready, open the preview

▶ Open the preview


🔑 Login	`test@posthog.com` / `12345678` (demo data)
🧩 Running	this PR's backend and frontend, on the PostHog `:master` base
🔗 Link	stable across rebuilds: a re-push swaps the box underneath, the URL stays
🔒 Access	tailnet only (PostHog VPN)
🛠️ Admin	inspect & debug state in hogland
💤 Idle	sleeps after ~30 min idle (snapshot to S3, zero node cost) and wakes on your next visit in ~30s, behind a brief "waking up" screen

_{commit d154209 · box box-ffac511d1c92 · ready in 1786s (push → usable) · build log · rebuilds on every push, torn down on close}

parameterai · 2026-10-09T21:58:17Z

Risk: No findings

This increment hardens the email-draft prefill against template injection: entity names and URL-supplied draft text now have Liquid delimiters ({{, {%) rewritten into quoted string literals before the subject, text, HTML and design are built, so a crafted feature name or email link param prints as typed instead of executing as a Liquid tag. The change is a fix, not a new surface: the rewrite runs before the existing HTML escaping, the inserted text is a well-formed Liquid string literal that cannot be broken out of, and every consumer of the draft goes through the same function.

_{Sentinel reviewed a62a37e · Review settings}

stamphog

Not approved yet — waiting on the conditions below.

Re-add the stamphog label to request another review once you have addressed this.

The size gate refused this pull request. It has 4319 substantive changed lines across 13 files (4441 lines across 16 files including docs, generated files and snapshots), well over the 800-line ceiling for auto-review. Most of that comes from the large changes to workflowLogic.ts and hogFlowEditorLogic.tsx. The other gates (prerequisites, deny-list and tier) passed, so size is the only blocker.

The author can ask a human reviewer to look at it. They could also split it into smaller pull requests, for example the regenerated kea types and loadWorkflow return-type change on their own, then the new draft modules (messageDrafts.ts and workflowEmailPrefill.ts), then the broadcast and workflow entry-point wiring.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✗	too large for auto-review (4319L substantive in global — ceiling is 800L; 4319L, 13F total, 4441L/16F incl. docs/generated/snapshots)
tier	✓	T1-agent / T1d-complex (4441L, 16F, two-areas, feat)
stamphog 2.4.1		`.stamphog/policy.yml` @ `unknown` · reviewed head `7e37ce1`

pr-assigner-resolver-posthog · 2026-10-09T21:59:24Z

👀 Auto-assigned reviewers

These soft owners were skipped because they only have minor changes here. Nothing blocks merge, so self-assign if you'd like a look:

@PostHog/conversations (frontend/src/scenes/owners.yaml)

Soft owners come from each directory's owners.yaml and each product's product.yaml (resolved nearest-file-wins). For a skipped owner, the locator is the file that decided it. Generated files and lockfiles are ignored when deciding ownership.

trunk-io · 2026-10-09T22:06:37Z

Failed Test	Failure Summary	Logs
`Scenes-App/Project Homepage ProjectHomepage smoke-test`	The test timed out while waiting for loading indicators or spinners to disappear.	Logs ↗︎
`personalAPIKeysLogic clamps a group write to what each row can take`	The test failed because it could not find the specified path 'layout.navigation-3000.themeLogic' in the store.	Logs ↗︎

_{View Full Report ↗︎ ⋅ Docs}

…logic types stay unchanged

posthog · 2026-10-11T15:49:52Z

✅ Visual changes approved by @dmarchuk — baseline updated in 1aabe9c.

View this run in PostHog

3 changed.

_{Install the Visual Review Chrome extension to see visual review results at the top of your pull requests.}

3 updated Run: 0cf01ab6-38e8-4b49-bad8-d0a88323a786 Co-authored-by: dmarchuk <8395106+dmarchuk@users.noreply.github.com>

A new stamphog review started for this PR — the fresh verdict replaces this approval.

dmarchuk · 2026-10-11T16:48:47Z

/trunk merge

…prefilled-start

…shot

A new stamphog review started for this PR — the fresh verdict replaces this approval.

dmarchuk · 2026-10-12T13:39:35Z

/trunk merge

…prefilled-start # Conflicts: # products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts

A new stamphog review started for this PR — the fresh verdict replaces this approval.

stamphog

Approved.

The security-sensitive portion is owned by the author's workflows team, providing the policy's owning-team assurance path. No unresolved substantive review concerns or other refusal grounds were found; the discussion bot summary is not a current-head review.

Author wrote 61% of the modified lines and has 33 merged PRs in these paths (familiarity MODERATE).

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	438L, 12F substantive, 580L/15F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1d-complex (580L, 15F, two-areas, feat)
stamphog 2.4.1		`.stamphog/policy.yml` @ `d154209` · reviewed head `d154209`

deployment-status-posthog · 2026-10-12T17:27:46Z

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-10-12 17:27 UTC	Run
prod-us	✅ Deployed	2026-10-12 17:46 UTC	Run
prod-eu	✅ Deployed	2026-10-12 17:47 UTC	Run

dmarchuk added 8 commits October 8, 2026 20:02

feat(workflows): warn when broadcast recipients lack the to-field ema…

d761252

…il property

feat(workflows): warn on batch workflows when recipients lack the to-…

24fea54

…field property

fix(workflows): use the generated client for the missing recipient count

3afbf90

perf(workflows): check recipient emails only before launch and skip u…

771d6e0

…nfiltered audiences

fix(workflows): suggest liquid-safe $email syntax and read bracket To…

ec11678

… fields

fix(workflows): space the missing recipient warning and show it with …

edc6fed

…the email

Merge remote-tracking branch 'origin/master' into dmarchuk/broadcast-…

93ae446

…missing-recipient-email # Conflicts: # products/workflows/frontend/Broadcasts/broadcastWizardLogic.test.ts # products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts

feat(workflows): open entry-point broadcasts and workflows ready to send

7e37ce1

dmarchuk self-assigned this Oct 9, 2026

dmarchuk marked this pull request as ready for review October 9, 2026 21:58

github-actions Bot deployed to preview-pr-114807 October 9, 2026 21:58

View deployment

dmarchuk added the stamphog Request AI approval (no full review) label Oct 9, 2026

stamphog Bot reviewed Oct 9, 2026

View reviewed changes

stamphog Bot removed the stamphog Request AI approval (no full review) label Oct 9, 2026

pr-assigner-resolver-posthog Bot requested review from a team, ablaszkiewicz and hpouillot October 9, 2026 21:59

posthog-project-board-bot Bot added this to Feature Flags Oct 9, 2026

chore(workflows): keep the loadWorkflow return type so the generated …

49c94c4

…logic types stay unchanged

github-actions Bot deployed to preview-pr-114807 October 9, 2026 22:32

View deployment

dmarchuk added the stamphog Request AI approval (no full review) label Oct 9, 2026

This comment was marked as outdated.

Sign in to view

github-project-automation Bot moved this from In Review to Approved in Feature Flags Oct 9, 2026

github-actions Bot deployed to preview-pr-114807 October 11, 2026 15:30

View deployment

dmarchuk added the stamphog Request AI approval (no full review) label Oct 11, 2026

This comment was marked as outdated.

Sign in to view

chore(visual): update storybook baselines

1aabe9c

3 updated Run: 0cf01ab6-38e8-4b49-bad8-d0a88323a786 Co-authored-by: dmarchuk <8395106+dmarchuk@users.noreply.github.com>

dmarchuk removed the stamphog Request AI approval (no full review) label Oct 11, 2026

github-actions Bot deployed to preview-pr-114807 October 11, 2026 16:29

View deployment

dmarchuk added the stamphog Request AI approval (no full review) label Oct 11, 2026

This comment was marked as outdated.

Sign in to view

dmarchuk added 2 commits October 12, 2026 12:46

Merge remote-tracking branch 'origin/master' into dmarchuk/messaging-…

6cf15c8

…prefilled-start

chore(visual): restore master baseline for flaky oauth authorize snap…

97e63e5

…shot

dmarchuk added stamphog Request AI approval (no full review) and removed stamphog Request AI approval (no full review) labels Oct 12, 2026

github-actions Bot deployed to preview-pr-114807 October 12, 2026 10:48

View deployment

This comment was marked as outdated.

Sign in to view

Merge remote-tracking branch 'origin/master' into dmarchuk/messaging-…

d154209

…prefilled-start # Conflicts: # products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts

dmarchuk removed the stamphog Request AI approval (no full review) label Oct 12, 2026

github-actions Bot deployed to preview-pr-114807 October 12, 2026 16:20

View deployment

dmarchuk added the stamphog Request AI approval (no full review) label Oct 12, 2026

stamphog Bot approved these changes Oct 12, 2026

View reviewed changes

trunk-io Bot merged commit 55528de into master Oct 12, 2026

trunk-io Bot deleted the dmarchuk/messaging-prefilled-start branch October 12, 2026 17:05

github-project-automation Bot moved this from Approved to Done in Feature Flags Oct 12, 2026

Silthus mentioned this pull request Oct 19, 2026

feat(workflows): resolve the first-run email sender Silthus/posthog#455

Closed

Conversation

dmarchuk commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Changes

How did you test this code?

Release status

Docs update

🤖 Agent context

Uh oh!

trunk-io Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 CI report

▶ Open the preview

Uh oh!

parameterai Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stamphog Bot left a comment

Choose a reason for hiding this comment

Uh oh!

pr-assigner-resolver-posthog Bot commented Oct 9, 2026

👀 Auto-assigned reviewers

Uh oh!

trunk-io Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

posthog Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

dmarchuk commented Oct 11, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

dmarchuk commented Oct 12, 2026

Uh oh!

stamphog Bot left a comment

Choose a reason for hiding this comment

Uh oh!

deployment-status-posthog Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploy status

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dmarchuk commented Oct 9, 2026 •

edited

Loading

trunk-io Bot commented Oct 9, 2026 •

edited

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading

parameterai Bot commented Oct 9, 2026 •

edited

Loading

trunk-io Bot commented Oct 9, 2026 •

edited

Loading

posthog Bot commented Oct 11, 2026 •

edited

Loading

deployment-status-posthog Bot commented Oct 12, 2026 •

edited

Loading