chore(desktop): resync products/desktop to PostHog/code fc991d3 - #76339
Conversation
|
😎 This pull request was merged. |
|
Too many files changed for review. ( Bypass the limit by tagging |
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
| import { unescapeXmlAttr } from "@posthog/shared"; | ||
|
|
||
| const PI_SKILL_INVOCATION = | ||
| /^<skill name="([^"]+)" location="[^"]+">\n[\s\S]*?\n<\/skill>(?:\n\n([\s\S]+))?$/; |
There was a problem hiding this comment.
Low: Untrusted skill blocks are hidden from the transcript
This pattern treats any matching user-controlled message as a generated skill expansion and removes the block from the rendered transcript. A user can place arbitrary model instructions inside the block while teammates see only /name and the trailing text; collapse the content only when trusted invocation metadata identifies it as a genuine skill expansion, or retain the body for unverified messages.
PR overviewThis PR resynchronizes the desktop product with PostHog code at commit fc991d3, including session transcript UI logic for displaying skill invocations. One issue remains open in session transcript rendering. A user-controlled message can be mistaken for a generated skill expansion, hiding arbitrary model instructions from teammates and presenting a misleading abbreviated transcript. No issues have yet been addressed. Open issues (1)
Fixed/addressed: 0 · PR risk: 5/10 |
1 participant
Problem
products/desktop/was pinned at PostHog/code5ac5892while the source repo moved on tofc991d3(23 commits: mcp-gateway UI, canvas work, agent and Pi fixes). We need parity.