fix(tasks): trust PostHog MCP operations by dmarticus · Pull Request #95344 · PostHog/posthog

dmarticus · 2026-09-04T17:15:38Z

Problem

People running tasks must approve some PostHog MCP writes before the task can continue.

flowchart LR
classDef phBlue fill:#1d4aff,stroke:#1d4aff,color:#fff;
classDef phRed fill:#f54e00,stroke:#f54e00,color:#fff;
classDef phYellow fill:#f9bd2b,stroke:#f9bd2b,color:#000;
A[PostHog MCP operation] --> B[Approval card] --> C[Execution]
class A phBlue;
class B phRed;
class C phYellow;

Changes

Task runs now execute built-in PostHog MCP operations without an approval card.
External MCP servers, agent questions, and plan approvals keep their existing approval behavior.
The client auto-approves legacy PostHog MCP approval frames from active task runs.

Why: Starting a task already authorizes work in the selected PostHog project.

flowchart LR
classDef phBlue fill:#1d4aff,stroke:#1d4aff,color:#fff;
classDef phYellow fill:#f9bd2b,stroke:#f9bd2b,color:#000;
A[PostHog MCP operation] --> C[Execution]
class A phBlue;
class C phYellow;

How did you test this code?

Focused Jest suites cover PostHog auto-approval and external MCP prompts.
Focused pytest suites cover both sandbox launch paths.
Ruff, Oxlint, and the changed-file preflight pass.
The full frontend type check exceeded the task VM memory limit.

👉 Stay up-to-date with PostHog coding conventions for a smoother review.

Automatic notifications

Publish to changelog?

Docs update

No public docs change. The approval behavior is internal to task runs and has automated coverage.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

The PostHog Slack app made this change with the writing-pr-descriptions skill. The duplicate search found no matching open pull request. The patch contains no private session material.

Created with PostHog from a Slack thread

Generated-By: PostHog Desktop Task-Id: a48d066d-172d-4005-80fe-b0dfbdff1842

trunk-io · 2026-09-04T17:15:41Z

😎 Merged successfully - details.

github-actions · 2026-09-04T17:17:36Z

🤖 CI report

⚠️

Trunk lane — backend Python lane

This PR is assigned to the backend Python lane. It runs backend Python tests and may merge in parallel with PRs in other lanes.

⚠️

Complexity (TypeScript) — 10 functions above the limit (max 82)

Cyclomatic complexity above the limit in changed typescript files (10 for production files, 15 for test files). Warn only: worth simplifying when you next touch these functions.

Function	Location	Complexity	Limit
`ingestAcpFrame`	`products/posthog_ai/frontend/logics/runStreamLogic.ts:3148`	82	10
`foldLogToThread`	`products/posthog_ai/frontend/logics/runStreamLogic.ts:1026`	63	10
`streamRun`	`products/posthog_ai/frontend/logics/runStreamLogic.ts:2641`	27	10
`invocationFromToolCallUpdate`	`products/posthog_ai/frontend/logics/runStreamLogic.ts:960`	24	10
`parsePermissionRequestFrame`	`products/posthog_ai/frontend/logics/runStreamLogic.ts:696`	20	10
`handleSseEvent`	`products/posthog_ai/frontend/logics/runStreamLogic.ts:2553`	20	10
`bootstrapRun`	`products/posthog_ai/frontend/logics/runStreamLogic.ts:2383`	15	10
`mergeToolCallUpdateEntries`	`products/posthog_ai/frontend/logics/runStreamLogic.ts:810`	12	10
`handleTerminalStatus`	`products/posthog_ai/frontend/logics/runStreamLogic.ts:2989`	12	10
`<anonymous>`	`products/posthog_ai/frontend/logics/runStreamLogic.ts:2295`	11	10

✅ Bundle size — 🟢 -1.9 KiB (-0.0%)

Uncompressed size of every built .js bundle, compared against the base branch.

Total: 68.58 MiB · 🟢 -1.9 KiB (-0.0%)

File	Size	Δ vs base
`render-query/src/render-query/render-query.js`	21.89 MiB	🟢 -1.9 KiB (-0.0%)

_{Posted automatically by build-bundle-size-report · uncompressed bytes from dist-report}

✅ Eager graph — within budget

How much code each root ships on the eager path — downloaded and parsed before the surface is interactive. Measured from the esbuild output chunks (post-tree-shake, static imports only); lazy import() / React.lazy chunks are not counted.

Root	Eager (shipped)	Δ vs base	Budget
entry (logged-out pages, app bootstrap) `src/index.tsx`	1.50 MiB · 22 files	no change	`███░░░░░░░` 33.2% of 4.51 MiB
logged-out boot: index + App + bootApp (preloaded by every page, including /login) `src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts`	5.25 MiB · 668 files	no change	`█████████░` 93.3% of 5.63 MiB
authenticated shell (every logged-in page) `src/scenes/AuthenticatedShell.tsx`	7.66 MiB · 2,677 files	🟢 -1.9 KiB (-0.0%)	`█████████░` 87.3% of 8.77 MiB

🟢 node_modules/monaco-editor/ stays out of src/index.tsx
🟢 src/lib/components/ActivityLog/describers stays out of src/index.tsx
🟢 [object Object] stays out of src/index.tsx
🟢 [object Object] stays out of src/index.tsx
🟢 node_modules/monaco-editor/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/layout/navigation-3000/navigationLogic.tsx stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/scenes/dashboard/dashboardLogic.tsx stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 node_modules/monaco-editor/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/lib/components/ActivityLog/describers stays out of src/scenes/AuthenticatedShell.tsx
🟢 [object Object] stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/scenes/session-recordings/player/sessionRecordingPlayerLogic.ts stays out of src/scenes/AuthenticatedShell.tsx
🟢 [object Object] stays out of src/scenes/AuthenticatedShell.tsx
🟢 [object Object] stays out of src/scenes/AuthenticatedShell.tsx

Largest files eagerly shipped from src/index.tsx

Size	File
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
24.6 KiB	`../node_modules/.pnpm/buffer@6.0.3/node_modules/buffer/index.js`
6.3 KiB	`../node_modules/.pnpm/react@18.3.1/node_modules/react/cjs/react.production.min.js`
4.5 KiB	`../node_modules/.pnpm/@jspm+core@2.1.0/node_modules/@jspm/core/nodelibs/browser/process.js`
3.9 KiB	`../node_modules/.pnpm/scheduler@0.23.2/node_modules/scheduler/cjs/scheduler.production.min.js`
1.4 KiB	`../node_modules/.pnpm/base64-js@1.5.1/node_modules/base64-js/index.js`
1.3 KiB	`src/RootErrorBoundary.tsx`
1000 B	`src/index.tsx`
912 B	`../node_modules/.pnpm/ieee754@1.2.1/node_modules/ieee754/index.js`
854 B	`src/scenes/ChunkLoadErrorBoundary.tsx`

Largest files eagerly shipped from src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts

Size	File
275.9 KiB	`../node_modules/.pnpm/posthog-js@1.427.0_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
267.7 KiB	`../node_modules/.pnpm/@posthog+icons@0.38.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
255.2 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
104.4 KiB	`src/lib/api.ts`
79.1 KiB	`src/products.tsx`
68.8 KiB	`src/lib/lemon-ui/icons/icons.tsx`
62.5 KiB	`src/lib/utils/eventUsageLogic.ts`
38.8 KiB	`../node_modules/.pnpm/@dnd-kit+core@6.0.8_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@dnd-kit/core/dist/core.esm.js`
33.9 KiB	`../node_modules/.pnpm/kea@4.0.0-pre.6_patch_hash=139b8d1f1304f9d9da452a9a1244c94ea679dbcb85687d8999563146879fb6f5_react@18.3.1/node_modules/kea/lib/index.cjs.js`

Largest files eagerly shipped from src/scenes/AuthenticatedShell.tsx

Size	File
275.9 KiB	`../node_modules/.pnpm/posthog-js@1.427.0_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
267.7 KiB	`../node_modules/.pnpm/@posthog+icons@0.38.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
255.2 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
153.8 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
104.4 KiB	`src/lib/api.ts`
95.8 KiB	`../packages/quill/packages/quill/dist/index.js`
93.3 KiB	`../node_modules/.pnpm/prosemirror-view@1.40.1/node_modules/prosemirror-view/dist/index.js`
90.6 KiB	`../node_modules/.pnpm/@tiptap+core@3.20.6_@tiptap+pm@3.20.6/node_modules/@tiptap/core/dist/index.js`
79.1 KiB	`src/products.tsx`

_{Posted automatically by check-eager-graph · sizes are eager output bytes (shipped, post-tree-shake) from the esbuild metafile · part of #32479}

✅ Toolbar bundle — eager 2.28 MiB within budget

What the toolbar ships to customer pages, measured from the esbuild output (minified, post-tree-shake). The eager set is the entry plus everything statically imported from it — fetched before any feature runs; deferred chunks load lazily. The eager guardrail is 5.72 MiB. Each output file must also stay below 10 MB, where CloudFront stops compressing it. The module boundary is enforced separately by check-toolbar-graph.

Metric	Size	Δ vs base	Budget
Eager (shipped) entry + static imports	2.28 MiB · 18 files	no change	`████░░░░░░` 39.9% of 5.72 MiB
Deferred (lazy)	2.11 MiB · 45 files	no change	n/a — loads on demand
Loader `dist/toolbar.js`	1.1 KiB	no change	`█░░░░░░░░░` 5.8% of 19.5 KiB

Largest eagerly-shipped chunks

Size	File
756.0 KiB	`dist/toolbar/toolbar-app-DGKIQSDZ.css`
603.1 KiB	`dist/toolbar/chunk-chunk-VQB5L7CD.js`
484.7 KiB	`dist/toolbar/chunk-chunk-KFTQFUFW.js`
135.6 KiB	`dist/toolbar/chunk-chunk-3FA3YMG3.js`
131.8 KiB	`dist/toolbar/chunk-chunk-FDH2IBXT.js`
71.3 KiB	`dist/toolbar/toolbar-app-TZCKKHAT.js`
69.0 KiB	`dist/toolbar/chunk-chunk-TSAL54PB.js`
35.6 KiB	`dist/toolbar/chunk-chunk-T3WFSIYM.js`
21.0 KiB	`dist/toolbar/chunk-chunk-YANBM5OP.js`
6.8 KiB	`dist/toolbar/chunk-chunk-DV7IWQNF.js`

_{Posted automatically by check-toolbar-size · sizes are toolbar output bytes (shipped, post-tree-shake) from the esbuild metafile}

✅ Dist folder size — 🟢 -34.4 KiB (-0.0%)

Total size of the built frontend/dist folder (all assets), compared against the base branch.

Total: 1457.09 MiB · 🟢 -34.4 KiB (-0.0%)

⚠️

Playwright — 1 flaky

🎭 Playwright report · View test results →

⚠️ 1 flaky test:

password-protected insight sharing (chromium)

These issues are not necessarily caused by your changes.
Annoyed by this section? Help fix flakies and failures and it will go green!

trunk-io · 2026-09-04T17:43:13Z

_{View Full Report ↗︎ ⋅ Docs}

github-actions · 2026-09-04T18:45:30Z

🦔 Hogbox preview · ✅ ready

▶ Open the preview


🔑 Login	`test@posthog.com` / `12345678` (demo data)
🧩 Running	this PR's backend and frontend, on the PostHog `:master` base
🔗 Link	stable across rebuilds — a re-push swaps the box underneath, the URL stays
🔒 Access	tailnet only (PostHog VPN)
🛠️ Admin	inspect & debug state in hogland
💤 Idle	sleeps after ~30 min idle (snapshot to S3, zero node cost) and wakes on your next visit in ~30s, behind a brief "waking up" screen

_{commit 65df720 · box box-47cd11da0867 · ready in 1457s (push → usable) · build log · rebuilds on every push, torn down on close}

veria-ai · 2026-09-04T18:49:07Z

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10

greptile-apps · 2026-09-04T18:49:50Z

Security Review

A task can use posthog-connection-call to perform a destructive operation in a connected project without approval. Task initiation authorizes the selected project, while the forwarded request executes under a separate project's stored OAuth grants.

Prompt To Fix All With AI

### Issue 1
products/posthog_ai/frontend/policy/toolPolicy.ts:41-44
**Connected-project writes bypass approval**

Starting a task authorizes work in the selected project, but `posthog-connection-call` runs tools in a connected project using that connection's OAuth grants. The removed backend regex explicitly included this wrapper, while the new client policy auto-allows it without checking the forwarded tool. A task with `integration:write` can therefore forward an operation such as `feature-flag-delete` and modify the connected project without approval. Please preserve an approval boundary for cross-project calls.

**How this was verified:** The wrapper accepts agent-controlled connection, tool, and argument fields, forwards them with the connected project's stored token, and neither the server's reduced default regex nor the client policy prompts for the forwarded destructive tool.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(tasks): trust PostHog MCP operations" | Re-trigger Greptile}

Generated-By: PostHog Desktop Task-Id: bc4b4dab-1d6b-46d3-8af3-5923d2d0fe0f

adamleithp · 2026-09-07T12:09:48Z

/trunk merge

deployment-status-posthog · 2026-09-07T12:52:08Z

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-09-07 12:52 UTC	Run
prod-us	✅ Deployed	2026-09-07 13:08 UTC	Run
prod-eu	✅ Deployed	2026-09-07 13:13 UTC	Run

fix(tasks): trust PostHog MCP operations

ca144a5

Generated-By: PostHog Desktop Task-Id: a48d066d-172d-4005-80fe-b0dfbdff1842

dmarticus self-assigned this Sep 4, 2026

github-actions Bot added the feature/desktop Feature Tag: Desktop label Sep 4, 2026

dmarticus marked this pull request as ready for review September 4, 2026 18:45

github-actions Bot deployed to preview-pr-95344 September 4, 2026 18:45

View deployment

parameterai Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread products/posthog_ai/frontend/policy/toolPolicy.ts Resolved

pr-assigner-resolver-posthog Bot requested review from a team September 4, 2026 18:46

veria-ai Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread products/posthog_ai/frontend/policy/toolPolicy.ts Resolved

greptile-apps Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread products/posthog_ai/frontend/policy/toolPolicy.ts Resolved

Merge branch 'master' into posthog/trust-posthog-mcp-task-operations

fc74fd5

Generated-By: PostHog Desktop Task-Id: bc4b4dab-1d6b-46d3-8af3-5923d2d0fe0f

github-actions Bot requested a deployment to preview-pr-95344 September 4, 2026 19:25 In progress

fix(tasks): require approval for connected projects

65df720

Generated-By: PostHog Desktop Task-Id: bc4b4dab-1d6b-46d3-8af3-5923d2d0fe0f

github-actions Bot deployed to preview-pr-95344 September 4, 2026 19:26

View deployment

adamleithp approved these changes Sep 7, 2026

View reviewed changes

trunk-io Bot merged commit 4aeb887 into master Sep 7, 2026
271 checks passed

trunk-io Bot deleted the posthog/trust-posthog-mcp-task-operations branch September 7, 2026 12:35

skoob13 mentioned this pull request Sep 25, 2026

Sprint - September 21 to October 2 #101363

Closed

Navigation Menu

Repository navigation

fix(tasks): trust PostHog MCP operations - #95344

fix(tasks): trust PostHog MCP operations#95344
trunk-io[bot] merged 3 commits into
masterfrom
posthog/trust-posthog-mcp-task-operations

dmarticus commented Sep 4, 2026

Uh oh!

trunk-io Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

trunk-io Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

veria-ai Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Sep 4, 2026

Security Review

Uh oh!

Uh oh!

adamleithp commented Sep 7, 2026

Uh oh!

Uh oh!

deployment-status-posthog Bot commented Sep 7, 2026 •

edited

Loading

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dmarticus commented Sep 4, 2026

Problem

Changes

How did you test this code?

Automatic notifications

Docs update

🤖 Agent context

Uh oh!

trunk-io Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 CI report

Uh oh!

trunk-io Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦔 Hogbox preview · ✅ ready

▶ Open the preview

Uh oh!

Uh oh!

Uh oh!

veria-ai Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR overview

Security review

Uh oh!

greptile-apps Bot commented Sep 4, 2026

Security Review

Uh oh!

Uh oh!

adamleithp commented Sep 7, 2026

Uh oh!

Uh oh!

deployment-status-posthog Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploy status

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

trunk-io Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

trunk-io Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

veria-ai Bot commented Sep 4, 2026 •

edited

Loading

deployment-status-posthog Bot commented Sep 7, 2026 •

edited

Loading