Skip to content

feat(desktop): launch team skills from pull request review - #107380

Merged
trunk-io[bot] merged 5 commits into
masterfrom
posthog/desktop-run-pr-skill
Sep 27, 2026
Merged

trunk-io[bot] merged 5 commits into
masterfrom
posthog/desktop-run-pr-skill

Conversation

@pauldambra

@pauldambra pauldambra commented Sep 27, 2026 •

Copy link
Copy Markdown
Member

Problem

Reviewers need to find and start a team skill from a pull request without writing a skill command by hand.

Why: The review panel offers approval and merge actions but no fast way to choose a skill for the same PR.

Changes

The open PR decision panel now offers a searchable Run skill picker. The browser records local selection counts per project and user, ranks frequent skills first, and shows those choices before the team skill list loads. Once the list loads, removed skills no longer appear. The picker links to the skills store when the team has no skills. Selection opens a cloud-task composer with the skill, PR URL, and repository prefilled; sending remains a separate action.

Screenshots

Sample Storybook data only; no user or customer data.

Skill picker
PR skill picker with example team skills

Search results
PR skill picker filtered to a matching skill

While team skills load
PR skill picker with a loading indicator

Empty team store
PR skill picker with a link to the skills store

How did you test this code?

  • Focused PrSkillMenu tests pass for search, local persistence and ranking, project/user isolation, the loading and empty states, and invalid URLs.
  • @posthog/ui typecheck and targeted Biome check pass. Screenshots were captured from a Storybook fixture in headless Chromium; no signed-in Desktop session was used.

Release status

  • No feature flag controls this change

Automatic notifications

  • Publish to changelog?

Docs update

The Desktop self-driving reports guide describes the picker and local ordering.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: PostHog Slack app

The work began in the linked Slack thread. The project:llma-skills and paul-pair skills informed the approach. A search found no matching open PR.


Created with PostHog from a Slack thread

Generated-By: PostHog Desktop
Task-Id: 2f95fecd-8efa-4807-bd26-0856590f285c
@pauldambra pauldambra self-assigned this Sep 27, 2026
@trunk-io

trunk-io Bot commented Sep 27, 2026 •

Copy link
Copy Markdown

😎 Merged successfully - details.

@posthog

posthog Bot commented Sep 27, 2026 •

Copy link
Copy Markdown
Contributor

FLASH MODE - Faster, but stupid, use regular ReviewHog for a heavy review

🦔 PostHog Review reviewed this pull request

Nothing worth raising this time. Enjoy the moment:

Salad Fingers holds a rusty spoon

@github-actions github-actions Bot added the feature/desktop Feature Tag: Desktop label Sep 27, 2026
@github-actions

github-actions Bot commented Sep 27, 2026 •

Copy link
Copy Markdown
Contributor

React Doctor found no issues in the changed files. 🎉

Reviewed by React Doctor for commit 2dd8b63.

@github-actions

github-actions Bot commented Sep 27, 2026 •

Copy link
Copy Markdown
Contributor

🤖 CI report

✅ Trunk lane — non-backend lane (fe:product:desktop)

This PR is assigned to the non-backend lane (fe:product:desktop). It does not run backend Python tests and may merge in parallel with PRs in other lanes.

✅ Duplication (Python) — clean

New Python code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

⚠️ Duplication (TypeScript) — 1 new duplicated block (worst 76 tokens)

New TypeScript code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

First copy Second copy Lines Tokens
products/desktop/packages/ui/src/features/pr-review/PrDecisionBlock.tsx:21 products/desktop/packages/ui/src/features/pr-review/PrReviewActions.tsx:18 14 76

@hosthog

hosthog Bot commented Sep 27, 2026 •

Copy link
Copy Markdown

HostHog preview — posthog-desktop-web

The previews for this PR have been torn down and no longer serve.

@coderabbitai

coderabbitai Bot commented Sep 27, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 11 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 12 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: PostHog/posthog/.coderabbit.yaml

Review profile: QUIET

Plan: Enterprise

Run ID: b15741fc-dffb-4fa5-a3ab-edcafe74f876

📥 Commits

Reviewing files that changed from the base of the PR and between 029cfd0 and 2dd8b63.

📒 Files selected for processing (2)
  • products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.test.tsx
  • products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx
📝 Walkthrough

Walkthrough

The pull request review controls now include a searchable skill menu. The menu orders skills by recorded usage within the current scope, then alphabetically. Selecting a skill records its usage and opens task input with the skill, pull request URL, and repository. The menu handles loading, errors, empty skill lists, and invalid pull request URLs. Tests and stories cover these behaviors. Documentation describes the task context and prompt review.

Priority: ⬇️ Low

Merge Risk: 🔵 Low · up to 029cf

The skill picker can offer stale choices after a loading error, while its loading preview may show an error instead. These are bounded issues that should be addressed or accepted before merging.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 029cf

The new picker can offer a previously used skill before the current team list loads, even if that skill has since been removed. Selecting it only prepares a task for review; sending remains a separate action. The evidence does not establish whether task creation would accept a removed skill.

Retained concerns

  • Low · security · observed: During team-list loading or failure, persisted skill names remain selectable without confirmation against the current authenticated listing. A removed skill can therefore be presented as a choice and placed in a task draft; whether submission can execute it is unverified.
Security review details

Security Blast Radius

  • inferred — The demonstrated exposure is a skill choice and draft within an authenticated Desktop user's project scope, not automatic task execution. Server-side authorization at submission was not established.

Security Findings and Attack Paths

  • inferred — A previously selected, subsequently removed skill can remain selectable while the listing loads or fails, then enter a task draft if the user selects it. A successful listing removes it from choices, and a separate user submission is required; unauthorized execution is not demonstrated.

Trust Boundaries and Controls

  • observed — The authenticated team listing constrains choices when present, but locally persisted names substitute for it when absent. URL parsing constrains the repository to a GitHub PR path; neither control establishes backend entitlement to run a skill.

Hardening Proposals

  • proposed — Keep cached names useful for ranking or display, but require a current authorized listing before presenting them as confirmed choices; independently validate skill authority when a task is submitted.
🚥 Pre-merge checks | ✅ 1
✅ Passed checks (1 passed)
Check name Status Explanation
Description check ✅ Passed The pull request description is complete and explains the problem, user-visible changes, testing, screenshots, release status, documentation update, and agent context. It includes a duplicate-PR searc…
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR

Comment @coderabbitai help to get the list of available commands.

Generated-By: PostHog Desktop
Task-Id: 2f95fecd-8efa-4807-bd26-0856590f285c

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note

Quiet mode is enabled, so only the most important comments were posted inline. Other review comments are grouped below.

🟡 Other comments (2)
products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx-47-49 (1)

47-49: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Place pr-shepherd first when it is available.

With equal usage counts, alphabetical sorting places a-skill before pr-shepherd. That breaks the stated priority for pr-shepherd. Compare that name first, then apply usage counts and alphabetical ordering to the remaining skills.

products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx-42-46 (1)

42-46: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Do not offer saved skills after a listing error.

When useTeamSkills returns isError: true without a listing, this fallback supplies saved names as selectable items. The nonempty list prevents the “Couldn't load team skills” empty state from appearing. Use saved names only while loading, and show the error state when loading fails.

🧹 Nitpick comments (1)
products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx (1)

37-38: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Move menu state into the desktop Zustand store.

open and searchQuery are view state, and the desktop rules require view state in @posthog/ui Zustand stores. Move these values and their update actions into the applicable Zustand store. Kea is not required for this component.


ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: PostHog/posthog/.coderabbit.yaml

Review profile: QUIET

Plan: Enterprise

Run ID: 50810caa-fff0-43e7-8e14-8436767350c2

📥 Commits

Reviewing files that changed from the base of the PR and between 95da9cb and 14de112.

📒 Files selected for processing (4)
  • products/desktop/docs/SELF-DRIVING-REPORTS.md
  • products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.test.tsx
  • products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx
  • products/desktop/packages/ui/src/features/pr-review/prSkillUsageStore.ts

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 4 remain after this review.

@posthog

posthog Bot commented Sep 27, 2026

Copy link
Copy Markdown
Contributor

FLASH MODE - Faster, but stupid, use regular ReviewHog for a heavy review
PostHog Review alpha 🦔 If you find any issues helpful - please reply "valid", "invalid", etc., for evaluation purposes 🙏

@posthog posthog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FLASH MODE - Faster, but stupid, use regular ReviewHog for a heavy review

PostHog Review

Found 3 should fix.

Comment thread products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx Outdated
Comment thread products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx
Comment thread products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx
Generated-By: PostHog Desktop
Task-Id: 2f95fecd-8efa-4807-bd26-0856590f285c

@posthog posthog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FLASH MODE - Faster, but stupid, use regular ReviewHog for a heavy review

PostHog Review

Found 1 should fix.

Comment thread products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx Outdated
Generated-By: PostHog Desktop
Task-Id: 2f95fecd-8efa-4807-bd26-0856590f285c
@pauldambra
pauldambra marked this pull request as ready for review September 27, 2026 10:34

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note

Quiet mode is enabled, so only the most important comments were posted inline. Other review comments are grouped below.

🟡 Other comments (1)
products/desktop/packages/ui/src/features/pr-review/PrDecisionBlock.stories.tsx-70-72 (1)

70-72: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Keep DraftLoadingSkills pending.

When loadingSkills is true, the decorator skips the teamSkillsKeys.list() seed, but useTeamSkills still calls service.listTeamSkills(client). With an authenticated client, a rejected request can therefore enter the error branch because retries are disabled. Add an explicit pending fixture for this query.


ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: PostHog/posthog/.coderabbit.yaml

Review profile: QUIET

Plan: Enterprise

Run ID: 2a7589a4-b772-4a9b-9c5f-5d1ff63ee6a3

📥 Commits

Reviewing files that changed from the base of the PR and between eaa0343 and 029cfd0.

📒 Files selected for processing (3)
  • products/desktop/packages/ui/src/features/pr-review/PrDecisionBlock.stories.tsx
  • products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.test.tsx
  • products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 0 remain after this review.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 27, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-27T10:39:21.760436Z 029cfd0 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@pr-assigner-resolver-posthog
pr-assigner-resolver-posthog Bot requested a review from a team September 27, 2026 10:35
Comment thread products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx Outdated

pauldambra commented Sep 27, 2026 •

Copy link
Copy Markdown
Member Author

Note

🤖 Automated comment by QA Swarm — not written by a human

Scoped independent review of the skill picker; findings already tracked in review threads are not duplicated here.

Verdict: ✅ APPROVE (round 2 @ 2dd8b63)

The follow-up addresses the validated URL, load-error, and disabled-team cases. The second review found no new actionable defects. Existing bot threads are resolved; no duplicate inline comments were posted.

Previous rounds (1)

round 1 @ 029cfd0 — REQUEST CHANGES: confirmed existing review findings.


Automated by QA Swarm — not a human review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 029cfd09dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx Outdated
Comment thread products/desktop/packages/ui/src/features/pr-review/PrSkillMenu.tsx
Generated-By: PostHog Desktop
Task-Id: 2f95fecd-8efa-4807-bd26-0856590f285c
@pauldambra pauldambra added the stamphog Request AI approval (no full review) label Sep 27, 2026 — with PostHog

@stamphog stamphog Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved.

Contained, additive desktop UI feature with no auth/billing/API/CI/data-model surface touched; it parses the PR URL defensively (a test confirms a URL with embedded credentials/query injection doesn't leak into the composed prompt) and the substantive CodeRabbit concern (stale saved skills shown after a load error) is fixed in this diff. The only remaining reviewer note is a cosmetic ordering preference, not a correctness issue.

  • 6 of the 6 changed files are governed by products/desktop/AGENT_APPROVALS.md.
  • CodeRabbit's minor suggestion to always rank 'pr-shepherd' first on ties was not implemented — cosmetic, non-blocking.
  • A comment posted under the PR author's own account claims an independent 'QA Swarm' bot approval; per policy an author's own comments are not independent assurance and were disregarded in this review.
Gate mechanics and policy version
Gate Result
prerequisites ✓ all clear
deny-list ✓ no deny categories matched
size ✓ 188L, 4F substantive, 420L/6F incl. docs/generated/snapshots — within ceiling
tier ✓ T1-agent / T1d-complex (420L, 6F, single-area, feat)
stamphog 2.2.0 .stamphog/policy.yml @ 2dd8b63 · reviewed head 2dd8b63

@pauldambra pauldambra added the desktop-release Tag and publish a desktop release when this PR merges label Sep 27, 2026
@trunk-io
trunk-io Bot merged commit 066a38f into master Sep 27, 2026
269 checks passed
@trunk-io
trunk-io Bot deleted the posthog/desktop-run-pr-skill branch September 27, 2026 11:06
@deployment-status-posthog

deployment-status-posthog Bot commented Sep 27, 2026 •

Copy link
Copy Markdown

Deploy status

Environment Status Deployed At Workflow
dev ✅ Deployed 2026-09-27 11:32 UTC Run
prod-us ✅ Deployed 2026-09-27 11:41 UTC Run
prod-eu ✅ Deployed 2026-09-27 11:42 UTC Run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

desktop-release Tag and publish a desktop release when this PR merges feature/desktop Feature Tag: Desktop stamphog Request AI approval (no full review)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant