Skip to content

feat(messaging): ask where to upload a send's files before sending it - #131664

Merged
trunk-io[bot] merged 16 commits into
masterfrom
messaging/attachments-upload-route
Nov 11, 2026
Merged

trunk-io[bot] merged 16 commits into
masterfrom
messaging/attachments-upload-route

Conversation

@Silthus

@Silthus Silthus commented Nov 9, 2026 •

Copy link
Copy Markdown
Contributor

Merge gate: node-store (PostHog/michaelr-context#77) live in both regions (reader before writer)

Problem

Note

🟡 Merge risk: medium · two-way door

  • A new route. Send routes are unchanged.
  • Switch-off: the email-from-code flag, and the CDP Node attachment allowlist.

Changes

  • Developers ask where to upload a send's files: POST .../messaging/attachments/uploads/ with each file's SHA-256 and size.
  • Each file comes back present or with a signed PUT. Each refusal has its own code, attr, why and fix.
  • A file list CDP Node refuses as invalid answers 400 on files with a fix, not a retryable 503. Django refuses one SHA-256 listed with two sizes first.
  • CDP Node owns the size estimate and daily quota. Django checks shape and reports each outcome.
  • Auth matches the send route: a member needs editor access to at least one workflow.
  • Uploads have their own rate limits, apart from sends, for keys and logged-in members alike. Shared limits would halve the send rate for sends with files, which spend two requests each.
  • Mechanical: generated types, and a list field moved to posthog/api/fields.py.

A pre-send upload step joins the send path. Before:

flowchart LR
  C[Caller]:::y -->|send with Base64 files| D[Django]:::b --> N[CDP Node]:::r
  classDef b fill:#1d4aff,stroke:#1d4aff,color:#fff;
  classDef r fill:#f54e00,stroke:#f54e00,color:#fff;
  classDef y fill:#f9bd2b,stroke:#f9bd2b,color:#000;
Loading

After:

flowchart LR
  C[Caller]:::y -->|sha256 and size| D[Django uploads route]:::b -->|scoped JWT| N[CDP Node]:::r
  N -->|present or signed PUT| D
  C -->|PUT bytes| S[(File storage)]:::g
  classDef b fill:#1d4aff,stroke:#1d4aff,color:#fff;
  classDef r fill:#f54e00,stroke:#f54e00,color:#fff;
  classDef y fill:#f9bd2b,stroke:#f9bd2b,color:#000;
  classDef g fill:#e5e7eb,stroke:#c7ccd1,color:#000;
Loading

How did you test this code?

Test rationale: API tests catch a lost code or attr, a trusted bad reply, and a refused member.

Evidence
  • Red first: each refusal, each check on a CDP Node reply, and the member case failed before its fix. So did the invalid file list and the two-sizes case.
  • Live run: 19 scenarios through real Django and a fake CDP Node that verifies the scoped token. Each gave the intended status, code, attr and event.
  • Mixed rollout: a CDP Node pod without the route answers 404 or 401, and Django answers 503 delivery_unavailable.
  • Not checked: a real CDP Node and storage. Their upload endpoint is not built yet.
  • Coverage gaps the CI report lists need no new test: class-body lines in facade/contracts.py and refusals.py run at import, before coverage starts; the rest are the log-and-continue around the usage event, the fallback for an answer that isn't JSON (the live run drives it), and the generic reason for a file sent as a bare string.
  • The CI duplication scan can't run: the runner kills jscpd (exit 137) on this branch, rerun included. Run locally on 8b13f78, bin/lint_duplication.py finds no new duplication against master or against the upload route PR.
  • Bundle and dist size grow only by the generated client for the new route (api.ts, api.zod.ts).
  • Playwright's flaky test, deleting a person property, is outside this diff.

Release status

  • This change is behind a feature flag and is not available to users

Docs update

  • None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Opus 5.5

Skills: /full-stop, /improving-drf-endpoints, /writing-tests, /writing-user-facing-copy, /writing-code-comments, /writing-pr-descriptions, /qa-swarm

More context for AI agents
  • Decisions: resource access control authorizes members, as on the send route.
  • Decisions: Django forwards {files: [{sha256, size}]} and maps CDP Node {error} codes.
  • Decisions: GitHub restacked this PR onto master; an empty commit refreshed CI, and the evidence carries over unchanged.
  • Decisions: upload rate limits stay apart from the send limits, per the ticket review (PostHog/michaelr-context#78).
  • Decisions: seven review rounds and three final reads; the last round and the stack-tip review found no blocker.
  • Decisions: master merged in to clear a conflict in one test's import list; the final read covered the fixes plus the merge's remerge diff.
  • Follow-ups: references on the send routes, in feat(messaging): attach uploaded files to key sends by their hash #131763.
  • Follow-ups: a throttled 429 carries DRF's body without why or fix, as the send routes do; explain both together.
  • Follow-ups: the upload event's requested_bytes is null when a size arrives as a string and CDP Node refuses.
  • Read closely: MessagingAttachmentsViewSet.handle_exception and refusals.py.

🤖 Generated with Claude Code

@Silthus Silthus added the run-ci-backend Force ci-backend's full test matrices to run even on a draft PR label Nov 9, 2026
@Silthus Silthus self-assigned this Nov 9, 2026
@Silthus
Silthus added this pull request to stack #131577 November 9, 2026 10:26
@github-actions

github-actions Bot commented Nov 9, 2026 •

Copy link
Copy Markdown
Contributor

🤖 CI report

⚠️ Trunk lane — backend Python lane

This PR is assigned to the backend Python lane. It runs backend Python tests and may merge in parallel with PRs in other lanes.

✅ Complexity (TypeScript) — clean

Cyclomatic complexity above the limit in changed typescript files (10 for production files, 15 for test files). Warn only: worth simplifying when you next touch these functions.

❌ Duplication (Python) — the duplication scan could not run

The duplication scan failed on this run (see the job log). Nothing here says whether this branch adds duplication.

❌ Duplication (TypeScript) — the duplication scan could not run

The duplication scan failed on this run (see the job log). Nothing here says whether this branch adds duplication.

✅ Bundle size — 🟢 -1016 B (-0.0%)

Uncompressed size of every built .js bundle, compared against the base branch.

Total: 78.41 MiB · 🟢 -1016 B (-0.0%)

File Size Δ vs base
posthog-app/_parent/products/customer_analytics/frontend/scenes/CustomerAnalyticsAccountScene/CustomerAnalyticsAccountScene.js 68.1 KiB 🟢 -1.8 KiB (-2.6%)

Posted automatically by build-bundle-size-report · uncompressed bytes from dist-report

⚠️ Eager graph — 1 over budget

How much code each root ships on the eager path — downloaded and parsed before the surface is interactive. Measured from the esbuild output chunks (post-tree-shake, static imports only); lazy import() / React.lazy chunks are not counted.

Root Eager (shipped) Δ vs base Budget
entry (logged-out pages, app bootstrap)
src/index.tsx
1.04 MiB · 25 files no change █████████░ 91.2% of 1.14 MiB
🟡 logged-out boot: index + App + bootApp (preloaded by every page, including /login)
src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
3.03 MiB · 627 files no change ██████████ 100.0% of 3.03 MiB
authenticated shell (every logged-in page)
src/scenes/AuthenticatedShell.tsx
3.87 MiB · 1,235 files no change ██████████ 96.4% of 4.01 MiB
dashboard scene
src/scenes/dashboard/Dashboard.tsx
7.80 MiB · 3,010 files no change ████████░░ 79.3% of 9.84 MiB
today home path
src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
4.84 MiB · 1,859 files no change ██████████ 98.2% of 4.93 MiB
AI-first home path
src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
6.07 MiB · 2,290 files no change ██████████ 96.7% of 6.27 MiB
events scene
src/scenes/activity/explore/EventsScene.tsx
6.79 MiB · 2,558 files no change ███████░░░ 72.1% of 9.41 MiB
web analytics scene
src/scenes/web-analytics/WebAnalyticsScene.tsx
7.87 MiB · 2,946 files no change ████████░░ 75.0% of 10.49 MiB
replay detail scene
src/scenes/session-recordings/detail/SessionRecordingDetail.tsx
6.97 MiB · 2,613 files no change █████████░ 85.8% of 8.13 MiB

🟢 node_modules/monaco-editor/ stays out of src/index.tsx
🟢 products/product_analytics/frontend/insights/activityDescriptions stays out of src/index.tsx
🟢 node_modules/@posthog/brand/dist/generated/hoggies/svg/ stays out of src/index.tsx
🟢 node_modules/@posthog/brand/dist/generated/hoggies/components/ stays out of src/index.tsx
🟢 node_modules/monaco-editor/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/layout/navigation-3000/navigationLogic.tsx stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/scenes/dashboard/dashboardLogic.tsx stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/lib/lemon-ui/LemonMarkdown/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/lib/components/RichContentEditor/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/lib/components/CodeSnippet/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/taxonomy/core-filter-definitions-by-group.json stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 node_modules/zod/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/lib/logic/billing/billingLogic.tsx stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/lib/components/ProductEmptyState/productSetupPreloadLogic.ts stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 node_modules/kea-test-utils/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 node_modules/monaco-editor/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 products/product_analytics/frontend/insights/activityDescriptions stays out of src/scenes/AuthenticatedShell.tsx
🟢 node_modules/kea-test-utils/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 products/dashboards/frontend/widgets/previews/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/scenes/session-recordings/player/sessionRecordingPlayerLogic.ts stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/panel-layout/ProjectTree/menus/SessionReplayMenuItems.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/taxonomy/core-filter-definitions-by-group.json stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/navigation/projectNoticeLogic.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/navigation/ImpersonationNotice/ImpersonationNotice.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/scenes/cohorts/cohortSavedToast.ts stays out of src/scenes/AuthenticatedShell.tsx
🟢 products/wizard/frontend/runs/WizardRunDetailsDrawer.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/today/TodayShell.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/today/TodayContextPanelFloating.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/today/TodaySidePanel.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/today/TodayTopBar.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/today/todayRailItems.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 products/subscriptions/frontend/components/Subscriptions/exportNudge/exportNudgeLogic.ts stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/scenes/billing/paymentEntryLogic.ts stays out of src/scenes/AuthenticatedShell.tsx
🟢 products/conversations/frontend/components/SidePanel/sidepanelTicketsLogic.ts stays out of src/scenes/AuthenticatedShell.tsx
🟢 node_modules/zod/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/scenes/authentication/auth/loginLogic.ts stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/scenes/authentication/shared/passkeyLogic.ts stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/scenes/cohorts/CohortFilters/constants.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 products/persons/frontend/logics/personsLogic.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/scenes/surveys/constants.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 node_modules/@tiptap/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 node_modules/prosemirror- stays out of src/scenes/AuthenticatedShell.tsx
🟢 node_modules/re2js/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 node_modules/react-markdown/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/lib/components/Command/Command.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 packages/quill/packages/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 zod/v4/locales/de.js stays out of src/scenes/AuthenticatedShell.tsx
🟢 node_modules/@posthog/brand/dist/generated/hoggies/svg/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 node_modules/@posthog/brand/dist/generated/hoggies/components/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 packages/quill/packages/quill/dist/ stays out of src/scenes/dashboard/Dashboard.tsx
🟢 node_modules/@tiptap/ stays out of src/scenes/dashboard/Dashboard.tsx
🟢 node_modules/prosemirror- stays out of src/scenes/dashboard/Dashboard.tsx
🟢 node_modules/marked/ stays out of src/scenes/dashboard/Dashboard.tsx
🟢 node_modules/frimousse/ stays out of src/scenes/dashboard/Dashboard.tsx
🟢 src/scenes/session-recordings/playlist/SessionRecordingsPlaylist.tsx stays out of src/scenes/dashboard/Dashboard.tsx
🟢 src/scenes/web-analytics/tiles/WebAnalyticsTile.tsx stays out of src/scenes/dashboard/Dashboard.tsx
🟢 src/queries/validators.js stays out of src/scenes/dashboard/Dashboard.tsx
🟢 src/queries/web-analytics-validators.js stays out of src/scenes/dashboard/Dashboard.tsx
🟢 node_modules/re2js/ stays out of src/scenes/dashboard/Dashboard.tsx
🟢 node_modules/kea-test-utils/ stays out of src/scenes/dashboard/Dashboard.tsx
🟢 src/scenes/debug/HogDebug.tsx stays out of src/scenes/dashboard/Dashboard.tsx
🟢 src/queries/QueryEditor/QueryEditor.tsx stays out of src/scenes/dashboard/Dashboard.tsx
🟢 packages/quill/packages/quill/dist/ stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
🟢 src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
🟢 src/scenes/project-homepage/today/TodayReportPage.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
🟢 src/queries/Query/Query.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
🟢 packages/quill/packages/charts/ stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
🟢 packages/quill/packages/quill/dist/ stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
🟢 products/posthog_ai/frontend/components/tool/widgets/VisualizationWidget.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
🟢 products/posthog_ai/frontend/components/tool/widgets/RecordingsWidget.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
🟢 src/queries/Query/Query.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
🟢 products/posthog_ai/frontend/api/primitives.ts stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
🟢 src/scenes/notebooks/Notebook/notebookLogic.ts stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
🟢 packages/quill/packages/quill/dist/ stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 node_modules/@tiptap/ stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 node_modules/prosemirror- stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 node_modules/marked/ stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 node_modules/frimousse/ stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/scenes/session-recordings/playlist/SessionRecordingsPlaylist.tsx stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/scenes/web-analytics/tiles/WebAnalyticsTile.tsx stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/queries/validators.js stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/queries/web-analytics-validators.js stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 node_modules/re2js/ stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 node_modules/kea-test-utils/ stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/queries/nodes/InsightViz/InsightViz.tsx stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/queries/nodes/DataVisualization/DataVisualization.tsx stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/queries/nodes/WebOverview/WebOverview.tsx stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/scenes/debug/HogDebug.tsx stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/queries/QueryEditor/QueryEditor.tsx stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 packages/quill/packages/quill/dist/ stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 node_modules/@tiptap/ stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 node_modules/prosemirror- stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 node_modules/marked/ stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 node_modules/frimousse/ stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 src/scenes/web-analytics/LiveMetricsDashboard/LiveWebAnalyticsMetrics.tsx stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 products/product_analytics/frontend/insights/trends/WorldMap/countryVectors.tsx stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 src/queries/validators.js stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 node_modules/re2js/ stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 node_modules/kea-test-utils/ stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 src/scenes/debug/HogDebug.tsx stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 src/queries/QueryEditor/QueryEditor.tsx stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 packages/quill/packages/quill/dist/ stays out of src/scenes/session-recordings/detail/SessionRecordingDetail.tsx
🟢 node_modules/@tiptap/ stays out of src/scenes/session-recordings/detail/SessionRecordingDetail.tsx
🟢 node_modules/prosemirror- stays out of src/scenes/session-recordings/detail/SessionRecordingDetail.tsx
🟢 node_modules/marked/ stays out of src/scenes/session-recordings/detail/SessionRecordingDetail.tsx
🟢 src/scenes/settings/SettingsMap.tsx stays out of src/scenes/session-recordings/detail/SessionRecordingDetail.tsx
🟢 @jspm/core/nodelibs/browser/fs stays out of src/scenes/session-recordings/detail/SessionRecordingDetail.tsx
🟢 node_modules/re2js/ stays out of src/scenes/session-recordings/detail/SessionRecordingDetail.tsx
🟢 node_modules/kea-test-utils/ stays out of src/scenes/session-recordings/detail/SessionRecordingDetail.tsx
🟢 node_modules/d3/src/ stays out of src/scenes/session-recordings/detail/SessionRecordingDetail.tsx

Largest files eagerly shipped from src/index.tsx
Size File
126.8 KiB ../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js
24.6 KiB ../node_modules/.pnpm/buffer@6.0.3/node_modules/buffer/index.js
6.3 KiB ../node_modules/.pnpm/react@18.3.1/node_modules/react/cjs/react.production.min.js
4.7 KiB ../node_modules/.pnpm/@jspm+core@2.1.0/node_modules/@jspm/core/nodelibs/browser/process.js
4.0 KiB ../node_modules/.pnpm/scheduler@0.23.2/node_modules/scheduler/cjs/scheduler.production.min.js
1.9 KiB src/lib/utils/bootTiming.ts
1.7 KiB src/index.tsx
1.7 KiB ../node_modules/.pnpm/base64-js@1.5.1/node_modules/base64-js/index.js
1.2 KiB src/RootErrorBoundary.tsx
1.1 KiB src/lib/utils/deferredAppContext.ts
Largest files eagerly shipped from src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
Size File
362.7 KiB ../node_modules/.pnpm/posthog-js@1.447.12_@types+react@18.3.31_react@18.3.1/node_modules/posthog-js/dist/module.mjs
224.1 KiB ../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js
126.8 KiB ../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js
106.4 KiB src/products.tsx
87.7 KiB src/lib/api.ts
69.0 KiB src/lib/lemon-ui/icons/icons.tsx
42.7 KiB ../node_modules/.pnpm/@dnd-kit+core@6.3.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@dnd-kit/core/dist/core.esm.js
36.4 KiB ../node_modules/.pnpm/kea@4.0.0-pre.6_patch_hash=139b8d1f1304f9d9da452a9a1244c94ea679dbcb85687d8999563146879fb6f5_react@18.3.1/node_modules/kea/lib/index.cjs.js
29.0 KiB src/lib/constants.tsx
24.6 KiB ../node_modules/.pnpm/buffer@6.0.3/node_modules/buffer/index.js
Largest files eagerly shipped from src/scenes/AuthenticatedShell.tsx
Size File
362.7 KiB ../node_modules/.pnpm/posthog-js@1.447.12_@types+react@18.3.31_react@18.3.1/node_modules/posthog-js/dist/module.mjs
224.1 KiB ../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js
126.8 KiB ../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js
106.4 KiB src/products.tsx
87.7 KiB src/lib/api.ts
69.0 KiB src/lib/lemon-ui/icons/icons.tsx
42.7 KiB ../node_modules/.pnpm/@dnd-kit+core@6.3.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@dnd-kit/core/dist/core.esm.js
36.4 KiB ../node_modules/.pnpm/kea@4.0.0-pre.6_patch_hash=139b8d1f1304f9d9da452a9a1244c94ea679dbcb85687d8999563146879fb6f5_react@18.3.1/node_modules/kea/lib/index.cjs.js
32.6 KiB src/lib/utils/eventUsageLogic.ts
29.0 KiB src/lib/constants.tsx
Largest files eagerly shipped from src/scenes/dashboard/Dashboard.tsx
Size File
362.7 KiB ../node_modules/.pnpm/posthog-js@1.447.12_@types+react@18.3.31_react@18.3.1/node_modules/posthog-js/dist/module.mjs
224.1 KiB ../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js
126.8 KiB ../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js
116.4 KiB ../node_modules/.pnpm/posthog-js@1.447.12_@types+react@18.3.31_react@18.3.1/node_modules/posthog-js/dist/surveys-preview.js
112.5 KiB ../packages/quill/packages/primitives/dist/index.js
106.4 KiB src/products.tsx
98.2 KiB ../packages/quill/packages/components/dist/index.js
87.7 KiB src/lib/api.ts
78.8 KiB src/scenes/dashboard/dashboardLogic.tsx
69.0 KiB src/lib/lemon-ui/icons/icons.tsx
Largest files eagerly shipped from src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
Size File
362.7 KiB ../node_modules/.pnpm/posthog-js@1.447.12_@types+react@18.3.31_react@18.3.1/node_modules/posthog-js/dist/module.mjs
224.1 KiB ../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js
126.8 KiB ../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js
112.5 KiB ../packages/quill/packages/primitives/dist/index.js
106.4 KiB src/products.tsx
87.7 KiB src/lib/api.ts
69.0 KiB src/lib/lemon-ui/icons/icons.tsx
68.5 KiB ../products/posthog_ai/frontend/logics/runStreamLogic.ts
42.7 KiB ../node_modules/.pnpm/@dnd-kit+core@6.3.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@dnd-kit/core/dist/core.esm.js
36.4 KiB ../node_modules/.pnpm/kea@4.0.0-pre.6_patch_hash=139b8d1f1304f9d9da452a9a1244c94ea679dbcb85687d8999563146879fb6f5_react@18.3.1/node_modules/kea/lib/index.cjs.js
Largest files eagerly shipped from src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
Size File
362.7 KiB ../node_modules/.pnpm/posthog-js@1.447.12_@types+react@18.3.31_react@18.3.1/node_modules/posthog-js/dist/module.mjs
224.1 KiB ../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js
126.8 KiB ../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js
112.5 KiB ../packages/quill/packages/primitives/dist/index.js
106.4 KiB src/products.tsx
87.7 KiB src/lib/api.ts
69.0 KiB src/lib/lemon-ui/icons/icons.tsx
68.5 KiB ../products/posthog_ai/frontend/logics/runStreamLogic.ts
42.7 KiB ../node_modules/.pnpm/@dnd-kit+core@6.3.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@dnd-kit/core/dist/core.esm.js
41.7 KiB src/scenes/hog-functions/sub-templates/sub-templates.ts
Largest files eagerly shipped from src/scenes/activity/explore/EventsScene.tsx
Size File
362.7 KiB ../node_modules/.pnpm/posthog-js@1.447.12_@types+react@18.3.31_react@18.3.1/node_modules/posthog-js/dist/module.mjs
224.1 KiB ../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js
126.8 KiB ../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js
112.5 KiB ../packages/quill/packages/primitives/dist/index.js
106.4 KiB src/products.tsx
98.2 KiB ../packages/quill/packages/components/dist/index.js
87.7 KiB src/lib/api.ts
78.8 KiB src/scenes/dashboard/dashboardLogic.tsx
69.0 KiB src/lib/lemon-ui/icons/icons.tsx
68.5 KiB ../products/posthog_ai/frontend/logics/runStreamLogic.ts
Largest files eagerly shipped from src/scenes/web-analytics/WebAnalyticsScene.tsx
Size File
362.7 KiB ../node_modules/.pnpm/posthog-js@1.447.12_@types+react@18.3.31_react@18.3.1/node_modules/posthog-js/dist/module.mjs
224.1 KiB ../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js
126.8 KiB ../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js
116.4 KiB ../node_modules/.pnpm/posthog-js@1.447.12_@types+react@18.3.31_react@18.3.1/node_modules/posthog-js/dist/surveys-preview.js
112.5 KiB ../packages/quill/packages/primitives/dist/index.js
106.4 KiB src/products.tsx
98.2 KiB ../packages/quill/packages/components/dist/index.js
87.7 KiB src/lib/api.ts
78.8 KiB src/scenes/dashboard/dashboardLogic.tsx
69.0 KiB src/lib/lemon-ui/icons/icons.tsx
Largest files eagerly shipped from src/scenes/session-recordings/detail/SessionRecordingDetail.tsx
Size File
362.7 KiB ../node_modules/.pnpm/posthog-js@1.447.12_@types+react@18.3.31_react@18.3.1/node_modules/posthog-js/dist/module.mjs
329.1 KiB ../node_modules/.pnpm/posthog-js@1.447.12_@types+react@18.3.31_react@18.3.1/node_modules/posthog-js/dist/rrweb.js
224.1 KiB ../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js
126.8 KiB ../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js
112.5 KiB ../packages/quill/packages/primitives/dist/index.js
106.4 KiB src/products.tsx
98.2 KiB ../packages/quill/packages/components/dist/index.js
87.7 KiB src/lib/api.ts
69.0 KiB src/lib/lemon-ui/icons/icons.tsx
68.5 KiB ../products/posthog_ai/frontend/logics/runStreamLogic.ts

Posted automatically by check-eager-graph · sizes are eager output bytes (shipped, post-tree-shake) from the esbuild metafile · part of #32479

✅ Frontend layers — no new upward imports, 0 removed

Static imports from a lower frontend layer into a higher one (layers, lowest first: kernel, shell, query, features). Compared with the base branch, so an import that a PR also adds to layer-baseline.txt still shows here. Sizes are the source bytes on the eager path of every logged-in page.

Layer Eager source bytes Δ vs base
kernel 3.00 MiB no change
shell 2.41 MiB no change
query 56.9 KiB no change
features 274.1 KiB no change

Download the interactive layer graph for this PR.

Posted automatically by check-layers

✅ Toolbar bundle — eager 2.45 MiB within budget

What the toolbar ships to customer pages, measured from the esbuild output (minified, post-tree-shake). The eager set is the entry plus everything statically imported from it — fetched before any feature runs; deferred chunks load lazily. The eager guardrail is 5.72 MiB. Each output file must also stay below 10 MB, where CloudFront stops compressing it. The module boundary is enforced separately by check-toolbar-graph.

Metric Size Δ vs base Budget
Eager (shipped)
entry + static imports
2.45 MiB · 19 files no change ████░░░░░░ 42.7% of 5.72 MiB
Deferred (lazy) 2.64 MiB · 43 files no change n/a — loads on demand
Loader dist/toolbar.js 1.2 KiB no change █░░░░░░░░░ 6.0% of 19.5 KiB
Largest eagerly-shipped chunks
Size File
980.5 KiB dist/toolbar/toolbar-app-5DG7YGIZ.css
738.4 KiB dist/toolbar/chunk-chunk-OOVG7SQF.js
290.5 KiB dist/toolbar/chunk-chunk-QRQPQULA.js
137.6 KiB dist/toolbar/chunk-chunk-DKQ6GG5B.js
131.8 KiB dist/toolbar/chunk-chunk-FQJO25M6.js
75.7 KiB dist/toolbar/toolbar-app-ZFWKCC2W.js
69.0 KiB dist/toolbar/chunk-chunk-BFAXZMC5.js
33.8 KiB dist/toolbar/chunk-chunk-RDAX246Y.js
21.9 KiB dist/toolbar/chunk-chunk-W6JZDLC3.js
6.8 KiB dist/toolbar/chunk-chunk-RVLGRPCH.js

Posted automatically by check-toolbar-size · sizes are toolbar output bytes (shipped, post-tree-shake) from the esbuild metafile

✅ Dist folder size — 🔺 +14.9 KiB (+0.0%)

Total size of the built frontend/dist folder (all assets), compared against the base branch.

Total: 1007.06 MiB · 🔺 +14.9 KiB (+0.0%)

ℹ️ MCP UI apps size — 35 app(s), 36997.7 KB JS

Built size of each MCP UI app (main.js + styles.css).

App JS CSS
debug 1067.1 KB 224.2 KB
explain-chart 1349.4 KB 224.2 KB
action 994.3 KB 224.2 KB
action-list 1058.0 KB 224.2 KB
cohort 993.3 KB 224.2 KB
cohort-list 1057.0 KB 224.2 KB
email-template 993.1 KB 224.2 KB
error-details 998.2 KB 224.2 KB
error-issue 995.2 KB 224.2 KB
error-issue-list 1059.2 KB 224.2 KB
experiment 1055.2 KB 224.2 KB
experiment-list 1058.8 KB 224.2 KB
experiment-results 1057.2 KB 224.2 KB
feature-flag 1057.4 KB 224.2 KB
feature-flag-list 1061.2 KB 224.2 KB
feature-flag-testing 996.5 KB 224.2 KB
inline-scan 993.8 KB 224.2 KB
insight-actors 1056.5 KB 224.2 KB
llm-costs 1053.8 KB 224.2 KB
session-recording 995.5 KB 224.2 KB
survey 994.9 KB 224.2 KB
survey-global-stats 1053.8 KB 224.2 KB
survey-list 1058.7 KB 224.2 KB
survey-stats 1053.8 KB 224.2 KB
trace-span 993.7 KB 224.2 KB
trace-span-list 1057.9 KB 224.2 KB
vision-observation-list 1057.1 KB 224.2 KB
workflow 993.6 KB 224.2 KB
workflow-list 1057.4 KB 224.2 KB
workflow-setup-status 993.3 KB 224.2 KB
query-results 1318.8 KB 224.2 KB
render-ui 1425.3 KB 224.2 KB
visual-review-snapshots 998.2 KB 224.2 KB
workflow-data-suggestions 996.0 KB 224.2 KB
workflow-sending-rules 994.6 KB 224.2 KB
⚠️ Playwright — 1 flaky

🎭 Playwright report · View test results →

⚠️ 1 flaky test:

  • create experiment via wizard, add metrics, and launch (chromium)

These issues are not necessarily caused by your changes.
Annoyed by this section? Help fix flakies and failures and it will go green!

⚠️ Backend coverage — 96.0% of changed backend lines covered — 14 uncovered

🧪 Backend test coverage

Patch coverage — changed backend lines (products + core): ███████████████████░ 96.0% (408 / 422)

File Patch Uncovered changed lines
products/messaging/backend/facade/contracts.py 71.4% 132–133, 143–144, 150, 152–154
products/messaging/backend/presentation/views/refusals.py 93.9% 46, 49
products/messaging/backend/presentation/views/attachment_uploads.py 97.6% 161, 174, 389–390

🤖 Agents: add a test only if an uncovered line exposes a realistic regression that existing tests miss. Otherwise explain why no new test is needed under "How did you test this code?". Gap list: the patch-coverage artifact on this run (gh run download 126791811459370 -n patch-coverage), or the coverage-data block at the end of this comment.

Per-product line coverage (touched products)
Product Coverage Lines
platform_features ██░░░░░░░░░░░░░░░░░░ 12.1% 7 / 58
data_tools ████████████░░░░░░░░ 57.6% 95 / 165
warehouse_sources_queue █████████████░░░░░░░ 65.9% 2,194 / 3,330
demo ██████████████░░░░░░ 71.3% 1,978 / 2,775
knowledge_writer ████████████████░░░░ 77.8% 1,474 / 1,895
batch_exports █████████████████░░░ 82.9% 24,778 / 29,885
engineering_analytics █████████████████░░░ 85.6% 12,515 / 14,615
ml_inference █████████████████░░░ 86.3% 524 / 607
commands █████████████████░░░ 86.7% 1,674 / 1,930
mcp_analytics ██████████████████░░ 87.8% 6,827 / 7,777
posthog_ai ██████████████████░░ 88.2% 4,514 / 5,116
apm ██████████████████░░ 88.2% 1,973 / 2,236
notebooks ██████████████████░░ 88.6% 15,594 / 17,599
dashboards ██████████████████░░ 89.6% 9,050 / 10,097
cohorts ██████████████████░░ 90.7% 9,866 / 10,883
warehouse_suggestions ██████████████████░░ 90.7% 4,264 / 4,700
actions ██████████████████░░ 90.9% 1,524 / 1,677
visual_review ██████████████████░░ 90.9% 10,634 / 11,698
data_warehouse ██████████████████░░ 91.1% 15,984 / 17,546
signals ██████████████████░░ 91.2% 112,569 / 123,392
cdp ██████████████████░░ 91.4% 10,896 / 11,920
today ██████████████████░░ 91.5% 4,136 / 4,521
canvas ██████████████████░░ 91.5% 8,559 / 9,351
tasks ██████████████████░░ 91.6% 86,270 / 94,187
autoresearch ██████████████████░░ 91.6% 12,203 / 13,318
data_modeling ██████████████████░░ 91.7% 12,686 / 13,831
streamlit_apps ██████████████████░░ 92.0% 3,200 / 3,478
alerts_platform ██████████████████░░ 92.0% 10,654 / 11,576
release ██████████████████░░ 92.1% 453 / 492
business_knowledge ██████████████████░░ 92.2% 10,900 / 11,824
metrics ██████████████████░░ 92.3% 12,750 / 13,818
review_hog ██████████████████░░ 92.4% 18,498 / 20,025
conversations ██████████████████░░ 92.4% 31,728 / 34,335
wizard ██████████████████░░ 92.4% 7,323 / 7,922
error_tracking ███████████████████░ 92.5% 20,976 / 22,675
slack_app ███████████████████░ 92.6% 25,544 / 27,600
early_access_features ███████████████████░ 92.7% 1,377 / 1,486
notifications ███████████████████░ 92.8% 1,230 / 1,326
legal_documents ███████████████████░ 93.0% 2,380 / 2,558
ai_training ███████████████████░ 93.1% 605 / 650
managed_warehouse ███████████████████░ 93.2% 15,792 / 16,947
authorization ███████████████████░ 93.2% 850 / 912
alerts ███████████████████░ 93.2% 13,753 / 14,756
stamphog ███████████████████░ 93.2% 11,448 / 12,277
webmcp ███████████████████░ 93.3% 277 / 297
web_analytics ███████████████████░ 93.4% 27,031 / 28,934
surveys ███████████████████░ 93.6% 7,847 / 8,388
exports ███████████████████░ 93.7% 4,474 / 4,777
approvals ███████████████████░ 93.7% 5,026 / 5,366
cross_project_dashboards ███████████████████░ 93.7% 867 / 925
context_layer ███████████████████░ 93.9% 4,075 / 4,342
marketing_analytics ███████████████████░ 93.9% 22,429 / 23,882
ai_observability ███████████████████░ 93.9% 41,011 / 43,657
mcp_store ███████████████████░ 94.0% 9,391 / 9,991
messaging ███████████████████░ 94.0% 9,629 / 10,244
ai_gateway ███████████████████░ 94.0% 1,472 / 1,566
billing_alerts ███████████████████░ 94.0% 2,332 / 2,480
annotations ███████████████████░ 94.1% 1,460 / 1,552
workflows ███████████████████░ 94.1% 30,380 / 32,289
managed_migrations ███████████████████░ 94.2% 1,886 / 2,003
customer_analytics ███████████████████░ 94.2% 31,701 / 33,660
access_control ███████████████████░ 94.3% 8,606 / 9,122
replay_vision ███████████████████░ 94.4% 33,431 / 35,422
logs ███████████████████░ 94.4% 20,547 / 21,762
reminders ███████████████████░ 94.5% 837 / 886
experiments ███████████████████░ 95.0% 47,404 / 49,918
warehouse_sources ███████████████████░ 95.0% 142,341 / 149,875
growth ███████████████████░ 95.0% 11,604 / 12,218
endpoints ███████████████████░ 95.0% 9,725 / 10,239
product_tours ███████████████████░ 95.1% 1,271 / 1,337
skills ███████████████████░ 95.1% 7,658 / 8,053
uptime_monitoring ███████████████████░ 95.3% 306 / 321
data_catalog ███████████████████░ 95.6% 4,749 / 4,965
subscriptions ███████████████████░ 95.7% 14,272 / 14,917
ui_customization ███████████████████░ 95.7% 714 / 746
tracing ███████████████████░ 95.8% 5,107 / 5,333
product_analytics ███████████████████░ 95.8% 31,451 / 32,837
feature_flags ███████████████████░ 95.8% 30,946 / 32,299
revenue_analytics ███████████████████░ 95.9% 1,877 / 1,958
data_quality ███████████████████░ 96.0% 8,583 / 8,937
aeo ███████████████████░ 96.3% 4,666 / 4,845
groups ███████████████████░ 96.4% 2,068 / 2,145
account_audits ███████████████████░ 96.5% 823 / 853
security ███████████████████░ 96.8% 1,597 / 1,650
pulse ███████████████████░ 97.0% 2,026 / 2,089
analytics_platform ████████████████████ 98.0% 2,962 / 3,022
field_notes ████████████████████ 98.4% 181 / 184

Report-only. Patch coverage = changed backend lines covered vs origin/master. Sorted lowest first.
Known gaps: lines covered only by Temporal tests show as uncovered; core line numbers may drift if master changed the same file.

@posthog posthog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PostHog Review · Standard · reviewed 03c490e: no findings.

@posthog posthog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PostHog Review · Standard · reviewed 0ea77d5: 1 Should fix.

See this review and its findings in PostHog Review. Comment @posthog review --deep for a Deep review. A Deep review takes longer and looks deeper than a Standard review.

@posthog posthog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PostHog Review · Standard · reviewed 3f5bcde: 1 Should fix.

@posthog posthog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PostHog Review · Standard · reviewed ae3911a: no findings.

@posthog posthog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PostHog Review · Standard · reviewed 04bdf01: no findings.

@posthog posthog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PostHog Review · Standard · reviewed 5f5f08a: 1 Should fix.

This is review round 3 on this pull request. When findings keep coming back in the same code, the approach is usually the problem. Before the next fix, check whether a different design would remove the whole class of findings.

@posthog posthog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PostHog Review · Standard · reviewed 11d5692: no findings.

Base automatically changed from messaging/send-content-too-large to master November 9, 2026 12:07
Silthus and others added 10 commits November 9, 2026 12:07
Adds POST /api/environments/{project_id}/messaging/attachments/uploads/.
A caller names each file by SHA-256 and size, and gets back per file
either `present` or a signed PUT. Refusals carry their own code, a
reason and a fix, and every outcome is captured as
`transactional email attachments upload`.

Ticket: PostHog/michaelr-context#78

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…load

The upload route and the send route now call one require_workflow_editor.
The file-list shape checks run as a database-free serializer test, and
the endpoint keeps two wiring cases.

Ticket: PostHog/michaelr-context#78

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ticket: PostHog/michaelr-context#78

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ticket: PostHog/michaelr-context#78

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…orkflow

Resource access control already admits a member with editor access to
one workflow, as the send route does. The upload route's own stricter
check refused them, so it goes, and the send route keeps its inline check.

Ticket: PostHog/michaelr-context#78

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ilable

Refs PostHog/michaelr-context#78

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Also covers an unknown upload status from the pipeline.

Refs PostHog/michaelr-context#78

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ply field

The upload route no longer spends the send routes' rate limits, refuses a pipeline
reply whose url or headers have the wrong type, and explains a body that is not an
object. The length-first list field moves to posthog/api/fields.py for reuse.

Refs PostHog/michaelr-context#78

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Refs PostHog/michaelr-context#78

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@trunk-io

trunk-io Bot commented Nov 9, 2026 •

Copy link
Copy Markdown

😎 Stack merged successfully - details.

@trunk-io
trunk-io Bot force-pushed the messaging/attachments-upload-route branch from 11d5692 to 1a7694c Compare November 9, 2026 12:07
@Silthus

Silthus commented Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

/depot retry

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@Silthus
Silthus marked this pull request as ready for review November 9, 2026 13:02
@parameterai

parameterai Bot commented Nov 9, 2026 •

Copy link
Copy Markdown

Risk: No findings

This increment is a single master-merge commit: the PR-owned upload-route code (views, refusals, routes, plugin-server API, services) is unchanged since the last review, and the delta only brings in master content plus a test-only adaptation of test_code_send_fields.py to master's refusal-reason change. I traced the master-merged transactional-email activity endpoint this merge puts on the branch and found its scoping, access checks, and HogQL placeholder use sound; no new security issues.

Sentinel reviewed 5a7cce8 · Review settings

@stamphog
stamphog Bot requested a review from a team November 9, 2026 13:03
@stamphog

stamphog Bot commented Nov 9, 2026

Copy link
Copy Markdown

Review requests went to the owners of the changed code. These owners were not requested because their part of this change looks trivial:

  • @PostHog/team-feature-flags: Your only change is moving LengthFirstListField out of posthog/api/cohort.py into posthog/api/fields.py with an import update, and the class's behavior is unchanged.

If you were listed here and want to review, you can still assign yourself as a reviewer.

@veria-ai

veria-ai Bot commented Nov 9, 2026 •

Copy link
Copy Markdown
Contributor

PR overview

No security issues were found in this pull request.

Reviews

stamphog[bot]

This comment was marked as outdated.

A file list the email pipeline refused as invalid answered a retryable 503.
It now answers 400 invalid_request on `files` with a reason and a fix, and
Django refuses one SHA-256 listed with two sizes before asking the pipeline.

Refs PostHog/michaelr-context#78

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@stamphog
stamphog Bot dismissed their stale review November 10, 2026 04:34

New commits were pushed — dismissing the stamphog approval from an earlier head. Re-add the trigger label to request a fresh review.

Silthus and others added 2 commits November 10, 2026 05:47
Refs PostHog/michaelr-context#78

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

# Conflicts:
#	posthog/plugins/test/test_plugin_server_api.py

@posthog posthog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PostHog Review · Standard · reviewed 86cdd5f: no findings.

stamphog[bot]

This comment was marked as outdated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@stamphog
stamphog Bot dismissed their stale review November 10, 2026 19:50

New commits were pushed — dismissing the stamphog approval from an earlier head. Re-add the trigger label to request a fresh review.

@posthog posthog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PostHog Review · Standard · reviewed ddfae98: no findings.

stamphog[bot]

This comment was marked as outdated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@stamphog
stamphog Bot dismissed their stale review November 11, 2026 17:39

New commits were pushed — dismissing the stamphog approval from an earlier head. Re-add the trigger label to request a fresh review.

@stamphog stamphog Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved.

The risky changes have owning-team authorship, STRONG familiarity, and focused API and token tests as assurance. No concrete unresolved review concern or other refusal ground is evidenced; the listed formal reviews are all on older commits.

  • Author wrote 82% of the modified lines and has 13 merged PRs in these paths (familiarity STRONG).
Gate mechanics and policy version
Gate Result
prerequisites ✓ all clear
deny-list ✓ no deny categories matched
size ✓ 725L, 11F substantive, 1284L/17F incl. docs/generated/snapshots — within ceiling
tier ✓ T1-agent / T1d-complex (1284L, 17F, cross-cutting, feat)
stamphog 2.7.0 .stamphog/policy.yml @ 5a7cce8 · reviewed head 5a7cce8

@Silthus

Silthus commented Nov 11, 2026

Copy link
Copy Markdown
Contributor Author

/trunk merge

@trunk-io
trunk-io Bot merged commit 1e4c980 into master Nov 11, 2026
290 checks passed
@trunk-io
trunk-io Bot deleted the messaging/attachments-upload-route branch November 11, 2026 19:40
@deployment-status-posthog

deployment-status-posthog Bot commented Nov 11, 2026 •

Copy link
Copy Markdown

Deploy status

Environment Status Deployed At Workflow
dev ✅ Deployed 2026-11-11 20:14 UTC Run
prod-us ✅ Deployed 2026-11-11 22:22 UTC Run
prod-eu ✅ Deployed 2026-11-11 22:21 UTC Run

This table shows the posthog release only. Hogstation shows every service that this PR reaches, Kargo services included.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

run-ci-backend Force ci-backend's full test matrices to run even on a draft PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant