feat(workflows): open entry-point broadcasts and workflows ready to send - #114807

Problem

• Clicking "Email people affected", "Email opted-in users" or "Email everyone who responds" opens an empty broadcast or a workflow with only a trigger. The person still has to pick a sender, write a subject and body, and add the email step.
• These entry points come from feat(workflows): let other products open a broadcast or workflow for an audience #112985 and its follow-ups. They got people into broadcasts and workflows, but not to a send.

Changes

• Broadcasts open on Review, ready to send. An entry point now passes a draft email in the link (email search param). The wizard fills the subject and body. With the project's default sender (feat(workflows): default email sender for new broadcasts and workflow emails #114682), it opens on Review.
• The wizard lands on the first step that still needs input. With no usable sender, it opens on Content. A cohort link, which has no draft, also opens on Content with the audience and sender set. Following a link still creates no draft. Continue or launch saves it, as before.
• A reload before Continue keeps the prefill. The link params now stay in the URL until the draft exists. Before, the wizard stripped them on open, so a reload started over on an empty Recipients step. The draft URL replaces them once Continue saves.
• Workflows open ready to enable. An entry-point link with a draft opens as trigger, email, exit. The email step has the default sender, the draft subject and body, and To {{ person.properties.email }}. An event trigger gets the existing "One time" frequency ({person.id}, indefinitely), so someone who hits the error again gets no second email.
• New workflows from a template also get the default sender on email steps that have none. feat(workflows): default email sender for new broadcasts and workflow emails #114682 only covered steps dragged in by hand.
• Drafts per source, all fixed templates in messageDrafts.ts. Error tracking uses no issue text, because issue titles are technical. Early access uses the feature name and description. No LLM is involved. A later PR can swap in an AI draft at this one module.

• Security: entity names are untrusted text. The draft link carries plain-text paragraphs, never HTML. The wizard escapes them when it builds the HTML and the visual editor design.
• Visual editor: the design holds one text block per paragraph, so the editor opens with the draft in place instead of an empty canvas.
• Tracking: broadcast launched gets prefilled_email_edited, and broadcast prefilled from link gets has_email.
• Mechanical: the workflowLogic props and logic key gain emailPrefill.

How did you test this code?

Driven in a real browser (Playwright) on a local stack: this branch's frontend, a Django on a migrated clone of the dev database, and team 1 with four verified senders and a project default.

• Error issue, Email people affected: opened the issue, clicked the panel button and continued in the modal. The wizard opened on Review with the template subject and body, and created no draft.
• Early access, one-time email: opened on Review with the default sender. Clicked Send now. Postgres afterwards:
  • posthog_hogflow row status=active, origin_product=broadcasts, from={"integrationId": 14}, the template subject, and a design key.
  • One workflows_hogflowbatchjob row, status=queued.
• Early access, workflow: opened as trigger, email, exit. Saved and enabled it. Postgres: status=active, trigger_masking={"ttl": null, "hash": "{person.id}", "bytecode": [...]}, the email step's from={"integrationId": 14}, and escaped HTML.
• Error issue, workflow: same result. The trigger panel shows "One time per indefinitely", and the visual editor shows the draft with spacing between paragraphs.
• Survey, workflow: opened as trigger, email, exit with the survey template.
• Cohort, Email this cohort: opened on Content ("Write your email"). No POST /hog_flows/ request was sent.
• Edge cases:
  • A feature name with <img src=x onerror=alert(1)> & co: no dialog fired, and the text shows literally in the subject, preview and visual editor.
  • A 95-character unicode and emoji feature name: kept as typed in the subject and body.
  • An empty feature description: the paragraph is dropped.
  • The project default sender unverified, with three other verified senders: opened on Content, because no sender can be picked automatically.

Reload, before and after e06081e (early access link, reload at each step before Continue):

• A reload lands back on the first step that needs input, as the link did. Edits made after landing and before Continue are lost on reload, as for any unsaved new broadcast.
• Master behaves the same for a broadcast started by hand: a name typed on /broadcasts/new before Continue is gone after a reload. That comes from saving only on Continue, and this PR does not change it.

Liquid in entity names (fix after review):

• Built drafts from feature names and a link prefill containing {{ person.properties.email }}, {% if true %}x{% endif %}, {% endraw %}{{ event.event }}, {{{ a }}} and {%- raw -%} and Plain é 🚀 name.
• Rendered each subject, text and HTML through the CDP formatLiquidInput, with globals holding a person email and an event name.
• Every value came out exactly as typed, and neither the email nor the event name appeared in the output. Before the fix the new messageDrafts.test.ts cases fail (2 of 10).
• Not tested: a real send with such a name.

Not tested:

• An actual email send. The dev CDP worker reads the main dev database, not the clone, so the queued batch job never ran.
• The two analytics properties, because posthog-js does not send locally.
• The cohort-saved toast, which uses the same link as the cohort button.

Test rationale:

• messageDrafts.test.ts: catches unescaped entity names reaching the HTML or design, Liquid delimiters in a name or link running as a template, and a malformed email param being used. No test covered this module before.
• workflowEmailPrefill.test.ts: catches an event-triggered workflow losing its once-per-person frequency, and a template's own sender being overwritten.
• broadcastWizardLogic.test.ts, one it.each added next to the existing link-prefill test: catches the wizard landing on the wrong step, or creating a draft when a link opens it.
• broadcastWizardLogic.test.ts, the existing link-prefill test now remounts the wizard on the same URL: catches a reload losing the prefill again.

Release status

• No feature flag controls this change

Docs update

None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (1M context)

• Part of a plan agreed in the session: A (feat(workflows): default email sender for new broadcasts and workflow emails #114682, default sender) and B (feat(workflows): lead entry point copy with email and track the funnel by source #114670, entry-point copy and tracking) merged first. This is C. An AI draft (D) is a follow-up that replaces messageDrafts.ts output, with these templates as its fallback.
• Skills invoked: /writing-user-facing-copy, /writing-ui-components, /writing-tests, /posthog-local-e2e-qa, /writing-pr-descriptions.
• First version put all paragraphs in one Unlayer text block. The visual editor dropped the paragraph spacing, so each paragraph became its own block.
• Local CodeRabbit review skipped: the CLI is signed out and no person was available to sign in.
• The first push changed the loadWorkflow return type, which regenerated thousands of lines of kea types. The second commit keeps the type.
• Duplicate search found no open PR doing this. feat(workflows): send a broadcast to people who have a feature flag #113009 is the feature-flag entry point and does not prefill an email.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BR6LoqsDMB9Wfnftcy2KiG