trunk-merge/pr-110601/6846e8ee-5b94-4e59-86e7-c1faa79c6449

.github/workflows/container-images-cd.yml

@@ -515,6 +515,7 @@ jobs:
                       selfDriving:
                         - 'products/signals/backend/**'
                         - 'products/signals/skills/**'
+                        - 'products/autoresearch/backend/**'
                         - 'posthog/settings/temporal.py'
                         - 'posthog/temporal/common/**'
                         - 'posthog/management/commands/start_temporal_worker.py'

docs/internal/ai-observability-judge-inputs.md

@@ -39,6 +39,24 @@ They sample the combined input, tool definitions, and output only when that text
 
 Implementation: [trace judge](../../posthog/temporal/ai_observability/run_trace_evaluation.py), [session judge](../../posthog/temporal/ai_observability/run_session_evaluation.py), and [generation judge](../../posthog/temporal/ai_observability/evaluation_llm_judge.py).
 
+## OpenAI-compatible judges
+
+Custom OpenAI-compatible connections use the shared DNS-pinned HTTPX transport with response bounds enabled.
+Every completion request has a 60-second total HTTP deadline, including connection setup, response headers, and the body.
+Key validation and model listing use a 10-second total deadline.
+Responses, including errors and streamed completions, are limited to 1 MiB.
+The endpoint must return uncompressed responses; compressed responses are rejected before decoding.
+Expired requests, rejected responses, and streams closed by the caller close their underlying connection.
+
+The OpenAI SDK does not retry custom-provider requests. Online evaluations and taggers use their existing Temporal retry policies for transient failures, and worker cancellation propagates to Temporal.
+Rate-limit responses retry without disabling the evaluation or marking its connection invalid, honoring `Retry-After` up to one minute. Quota and authentication errors keep their existing terminal behavior.
+Models without native structured-output support retain the JSON fallback, which can make one additional bounded request.
+Oversized or compressed completion responses skip the evaluation as a rejected request without disabling the connection.
+The evaluation records the response limit and how to configure the endpoint.
+These connection and response limits also apply when using the same provider in the playground.
+Disconnecting from the playground releases the server's stream slot without waiting for an in-flight provider read.
+The worker closes the connection when that read finishes or reaches the provider's deadline.
+
 ## System One judges
 
 System One-compatible models are available under the existing LLM judge option.

ee/hogai/utils/asgi.py

@@ -1,4 +1,5 @@
-from collections.abc import AsyncIterator, Callable, Iterable, Iterator
+import threading
+from collections.abc import AsyncIterator, Iterable, Iterator
 from typing import TypeVar
 
 from asgiref.sync import sync_to_async
@@ -9,18 +10,45 @@
 class SyncIterableToAsync(AsyncIterator[T]):
     def __init__(self, iterable: Iterable[T]) -> None:
         self._iterable: Iterable[T] = iterable
-        # async versions of the `next` and `iter` functions
-        self.next_async: Callable = sync_to_async(self.next, thread_sensitive=False)
-        self.iter_async: Callable = sync_to_async(iter, thread_sensitive=False)
         self.sync_iterator: Iterator[T] | None = None
+        self._lock = threading.Lock()
+        self._close_requested = threading.Event()
+        self._closed = False
 
     def __aiter__(self) -> AsyncIterator[T]:
         return self
 
     async def __anext__(self) -> T:
-        if self.sync_iterator is None:
-            self.sync_iterator = await self.iter_async(self._iterable)
-        return await self.next_async(self.sync_iterator)
+        return await sync_to_async(self._next, thread_sensitive=False)()
+
+    def _next(self) -> T:
+        try:
+            with self._lock:
+                if self._close_requested.is_set():
+                    raise StopAsyncIteration
+                if self.sync_iterator is None:
+                    self.sync_iterator = iter(self._iterable)
+                return self.next(self.sync_iterator)
+        finally:
+            if self._close_requested.is_set():
+                self._close()
+
+    def _close(self) -> None:
+        with self._lock:
+            if self._closed:
+                return
+            self._closed = True
+            iterator = self.sync_iterator if self.sync_iterator is not None else self._iterable
+            close = getattr(iterator, "close", None)
+            if close is not None:
+                close()
+
+    async def aclose(self) -> None:
+        self._close_requested.set()
+        # Cancellation cannot interrupt a sync read, so its worker closes the iterator when the read finishes.
+        if self._lock.acquire(blocking=False):
+            self._lock.release()
+            await sync_to_async(self._close, thread_sensitive=False)()
 
     @staticmethod
     def next(it: Iterator[T]) -> T:

ee/hogai/utils/test/test_asgi.py

@@ -0,0 +1,61 @@
+import asyncio
+import threading
+from collections.abc import Iterator
+
+import pytest
+
+from parameterized import parameterized
+
+from ee.hogai.utils.asgi import SyncIterableToAsync
+
+
+class TestSyncIterableToAsync:
+    @parameterized.expand([("idle", False), ("reading", True)])
+    async def test_closes_cancelled_stream_in_worker(self, _name: str, reading: bool) -> None:
+        loop = asyncio.get_running_loop()
+        read_started = asyncio.Event()
+        close_started = asyncio.Event()
+        closed = asyncio.Event()
+        release_read = threading.Event()
+        release_close = threading.Event()
+        closed_on: list[int] = []
+
+        def generate() -> Iterator[int]:
+            try:
+                yield 1
+                loop.call_soon_threadsafe(read_started.set)
+                assert release_read.wait(5)
+                yield 2
+            finally:
+                loop.call_soon_threadsafe(close_started.set)
+                assert release_close.wait(5)
+                closed_on.append(threading.get_ident())
+                loop.call_soon_threadsafe(closed.set)
+
+        stream = SyncIterableToAsync(generate())
+        assert await anext(stream) == 1
+        if reading:
+            pending = asyncio.create_task(anext(stream))
+            await asyncio.wait_for(read_started.wait(), 5)
+            pending.cancel()
+            with pytest.raises(asyncio.CancelledError):
+                await pending
+
+        cleanup = asyncio.create_task(stream.aclose())
+        try:
+            if reading:
+                await asyncio.wait_for(cleanup, 5)
+                assert not close_started.is_set()
+                release_read.set()
+            await asyncio.wait_for(close_started.wait(), 5)
+        finally:
+            release_read.set()
+            release_close.set()
+            await asyncio.wait_for(cleanup, 5)
+            await asyncio.wait_for(closed.wait(), 5)
+
+        assert len(closed_on) == 1
+        assert closed_on[0] != threading.get_ident()
+        await stream.aclose()
+        with pytest.raises(StopAsyncIteration):
+            await anext(stream)

frontend/src/layout/navigation-3000/Navigation.tsx

@@ -29,7 +29,7 @@
 import { sidePanelStateLogic } from './sidepanel/sidePanelStateLogic'
 import { themeLogic } from './themeLogic'
 
 export function Navigation({
     children,
     sceneConfig,
 }: {
@@ -134,7 +134,17 @@
                 }
             >
                 {showMinimalNavigation && <MinimalNavigation />}
-                <main className={mode === 'zen' ? 'p-4' : undefined}>{children}</main>
+                <main
+                    className={
+                        mode === 'zen'
+                            ? 'p-4'
+                            : mode === 'embedded'
+                              ? '@container/main-content min-h-screen p-4'
+                              : undefined
+                    }
+                >
+                    {children}
+                </main>
             </div>
         )
     }

frontend/src/layout/navigation-3000/navigationLogic.tsx

@@ -5,6 +5,7 @@ import posthog from 'posthog-js'
 
 import { FEATURE_FLAGS } from 'lib/constants'
 import { featureFlagLogic } from 'lib/logic/featureFlagLogic'
+import { isEmbeddedPageFrame } from 'lib/utils/embeddedPageFrame'
 import { onboardingVariantChrome, resolveOnboardingFlowVariant } from 'scenes/onboarding/onboardingVariants'
 import { organizationLogic } from 'scenes/organizationLogic'
 import { sceneLogic } from 'scenes/sceneLogic'
@@ -13,7 +14,7 @@ import { Scene } from 'scenes/sceneTypes'
 import type { SceneConfig } from '../../scenes/sceneTypes'
 import { navigationLogic } from '../navigation/navigationLogic'
 
-export type Navigation3000Mode = 'none' | 'minimal' | 'zen' | 'full'
+export type Navigation3000Mode = 'none' | 'minimal' | 'zen' | 'embedded' | 'full'
 
 export type ZenModeTrigger = 'shortcut' | 'account_menu' | 'help_menu' | 'exit_button' | 'url'
 
@@ -120,6 +121,10 @@ export const navigation3000Logic = kea<navigation3000LogicType>([
                 activeSceneId: string | null,
                 featureFlags: import('lib/logic/featureFlagLogic').FeatureFlagsSet
             ): Navigation3000Mode => {
+                // An embedded page frame sits inside another app page, so it shows the scene alone.
+                if (isEmbeddedPageFrame()) {
+                    return 'embedded'
+                }
                 if (zenMode) {
                     return 'zen'
                 }

frontend/src/layout/today/TodaySpaceActions.tsx

@@ -16,7 +16,7 @@ import { urls } from 'scenes/urls'
 import { ChannelDTOApi } from 'products/tasks/frontend/generated/api.schemas'
 
 import { TodayMenuParts } from './todayMenuParts'
-import { spaceNewSessionUrl, todaySpacesLogic } from './todaySpacesLogic'
+import { todaySpacesLogic } from './todaySpacesLogic'
 
 interface TodaySpaceActionsProps {
     parts: TodayMenuParts
@@ -42,7 +42,7 @@ export function TodaySpaceActions({
 
     return (
         <>
-            <Item to={spaceNewSessionUrl(space.id)} dataAttr={attr('new-session')}>
+            <Item to={urls.taskSpaceNewSession(space.id)} dataAttr={attr('new-session')}>
                 <IconPlus />
                 New session
             </Item>

frontend/src/layout/today/TodaySpacesSidebar.tsx

@@ -31,7 +31,7 @@
 
 const SKELETON_ROW_WIDTHS = ['w-3/5', 'w-4/5', 'w-2/5'] as const
 
 export function TodaySpacesSidebar(): JSX.Element {
     const {
         visibleSpaces,
         spacesLoading,
@@ -163,11 +163,11 @@
                     variant="primary"
                     size="lg"
                     className="w-full"
-                    render={<LinkPrimitive to={urls.ai()} />}
+                    render={<LinkPrimitive to={urls.taskNewSession()} />}
                     data-attr="today-spaces-new-chat"
                 >
                     <IconPlus />
-                    New chat
+                    New session
                 </Button>
                 <div className="mt-6 flex min-h-0 flex-1 flex-col overflow-hidden px-1" ref={layout.measureRefs.area}>
                     {hasPinned && (
@@ -220,7 +220,7 @@
                             loadError('Recent sessions didn’t load.', loadRecentTasks, 'today-recent-retry')
                         ) : recentState === 'empty' ? (
                             <Text size="xs" variant="muted" className="px-2 py-1">
-                                Sessions and chats you open show up here. Start one with New chat.
+                                Sessions and chats you open show up here. Start one with New session.
                             </Text>
                         ) : recentState === 'no-matches' ? (
                             notice(

frontend/src/layout/today/todaySpacesLogic.ts

@@ -1,10 +1,11 @@
 import { MakeLogicType, actions, afterMount, connect, kea, listeners, path, reducers, selectors } from 'kea'
 import { loaders } from 'kea-loaders'
-import { combineUrl, router } from 'kea-router'
+import { router } from 'kea-router'
 import type { LocationChangedPayload } from 'kea-router/lib/types'
 
 import { toast } from '@posthog/quill'
 
+import { removeProjectIdIfPresent } from 'lib/utils/kea-router'
 import { writeToClipboard } from 'lib/utils/writeToClipboard'
 import { maxGlobalLogic } from 'scenes/max/maxGlobalLogic'
 import { teamLogic } from 'scenes/teamLogic'
@@ -79,11 +80,10 @@ const SPACE_PRESENCE_POLL_INTERVAL_MS = 90_000
 
 export type TodayWorkSectionId = 'pinned' | 'recent' | 'spaces'
 
-/** The space page reads this search param once and focuses its new-session composer. */
-export const SPACE_COMPOSE_PARAM = 'compose'
-
-export function spaceNewSessionUrl(spaceId: string): string {
-    return combineUrl(urls.taskSpace(spaceId), { [SPACE_COMPOSE_PARAM]: 1 }).url
+/** The space a path is in, like PostHog Desktop's scoped space. `/spaces/new` is in no space. */
+export function spaceIdForPath(pathname: string): string | null {
+    const match = removeProjectIdIfPresent(pathname).match(/^\/spaces\/([^/]+)/)
+    return match && match[1] !== 'new' ? match[1] : null
 }
 
 /** The personal space first, then the team's general space, then starred spaces, then the rest by name. */
@@ -133,6 +133,7 @@ export interface todaySpacesLogicValues {
     user: UserType | null // userLogic
     allRecentItems: TodayWorkItem[]
     collapsedSections: TodayWorkSectionId[]
+    lastSpaceId: string | null
     pendingSpaceIds: string[]
     pinnedItems: TodayWorkItem[]
     pinnedTasks: TaskListItemApi[]
@@ -325,6 +326,9 @@ export interface todaySpacesLogicActions {
     setSectionHeights: (heights: Partial<Record<TodayWorkSectionId, number>>) => {
         heights: Partial<Record<TodayWorkSectionId, number>>
     }
+    spaceVisited: (spaceId: string) => {
+        spaceId: string
+    }
     starFailed: (spaceId: string) => {
         spaceId: string
     }
@@ -408,6 +412,7 @@ export const todaySpacesLogic = kea<todaySpacesLogicType>([
         toggleSection: (sectionId: TodayWorkSectionId) => ({ sectionId }),
         setSectionHeights: (heights: Partial<Record<TodayWorkSectionId, number>>) => ({ heights }),
         resetSectionPair: (upper: TodayWorkSectionId, lower: TodayWorkSectionId) => ({ upper, lower }),
+        spaceVisited: (spaceId: string) => ({ spaceId }),
         setRecentQuery: (query: string) => ({ query }),
         setRecentSearchOpen: (open: boolean) => ({ open }),
         setRecentFilters: (filters: TodayRecentFilters) => ({ filters }),
@@ -529,6 +534,8 @@ export const todaySpacesLogic = kea<todaySpacesLogicType>([
                 },
             },
         ],
+        // A generic New session files here, like PostHog Desktop's scoped space. A stale id falls back to personal.
+        lastSpaceId: [null as string | null, { persist: true }, { spaceVisited: (_, { spaceId }) => spaceId }],
         recentQuery: ['', { setRecentQuery: (_, { query }) => query, clearRecentSearchAndFilters: () => '' }],
         recentSearchOpen: [
             false,
@@ -709,7 +716,13 @@ export const todaySpacesLogic = kea<todaySpacesLogicType>([
             }
         }
         return {
-            locationChanged: markOpenSessionRead,
+            locationChanged: ({ pathname }) => {
+                const spaceId = spaceIdForPath(pathname)
+                if (spaceId) {
+                    actions.spaceVisited(spaceId)
+                }
+                markOpenSessionRead()
+            },
             loadTaskActivitySuccess: markOpenSessionRead,
             loadRecentTasks: () => actions.loadTaskActivity(),
             markSessionRead: async ({ marker, activityIds }) => {
@@ -758,6 +771,10 @@ export const todaySpacesLogic = kea<todaySpacesLogicType>([
         },
     })),
     afterMount(({ actions, cache }) => {
+        const spaceId = spaceIdForPath(router.values.location.pathname)
+        if (spaceId) {
+            actions.spaceVisited(spaceId)
+        }
         actions.loadSpaces()
         actions.loadPinnedTasks()
         actions.loadRecentTasks()

frontend/src/lib/constants.tsx

@@ -423,7 +423,6 @@ export const FEATURE_FLAGS = {
     METRICS: 'metrics', // owner: #team-apm (@jonmcwest, @frankh)
     METRICS_DASHBOARD_PANELS: 'metrics-dashboard-panels', // owner: #team-apm — gates the stat/gauge/bargauge/table panel picker entries
     METRICS_ERROR_OVERLAYS: 'metrics-error-overlays', // owner: #team-apm — gates the error-spike overlay PoC on metrics charts
-    METRICS_FUNDAMENTALS: 'metrics-fundamentals', // owner: #team-apm (@jonmcwest, @frankh), gates the Fundamentals tab and the explain API behind it, which check the metrics viewer's own reductions
     ML_INFERENCE_DECISIONS: 'ml-inference-decisions', // owner: #team-ai-research, gates the decisions playground; the API checks the same flag server side
     NEW_TAB_PROJECT_EXPLORER: 'new-tab-project-explorer', // owner: #team-platform-ux
     NEW_TEAM_CORE_EVENTS: 'new-team-core-events', // owner: @jabahamondes #team-web-analytics

frontend/src/lib/utils/embeddedPageFrame.ts

@@ -0,0 +1,19 @@
+/** The name of a frame that shows an app page inside another app page, such as a cited object in a task. */
+export const EMBEDDED_PAGE_FRAME_NAME = 'posthog-embedded-page'
+
+/**
+ * True when this document is an app page inside an embedded page frame, so it renders without the app's
+ * navigation. The frame name stays when the page navigates inside the frame. The origin check makes sure
+ * only the app itself can turn the mode on.
+ */
+export function isEmbeddedPageFrame(): boolean {
+    if (typeof window === 'undefined' || window.name !== EMBEDDED_PAGE_FRAME_NAME || window.parent === window) {
+        return false
+    }
+    try {
+        return window.parent.location.origin === window.location.origin
+    } catch {
+        // A cross-origin parent throws on any read of its location.
+        return false
+    }
+}

frontend/src/loadPostHogJS.tsx

@@ -3,6 +3,7 @@ import posthog, { BeforeSendFn, BrowserMetricsConfig, PostHogConfig, SessionReco
 import { FEATURE_FLAGS } from 'lib/constants'
 import { isOAuthMode } from 'lib/oauth/oauthClient'
 import { inStorybook, inStorybookTestRunner } from 'lib/utils/dom'
+import { isEmbeddedPageFrame } from 'lib/utils/embeddedPageFrame'
 import { getAppContext } from 'lib/utils/getAppContext'
 
 import { startDetachedElementTracking } from './detachedElementTracker'
@@ -54,6 +55,10 @@ export function withLastSeenFeatureFlags(
     return { ...bootstrap, featureFlags: { ...lastSeen.featureFlags, ...bootstrap.featureFlags } }
 }
 
+// pinned: analytics property name. Insights filter the framed pages by it.
+const stampEmbeddedPageFrame: BeforeSendFn = (event) =>
+    event && { ...event, properties: { ...event.properties, embedded_page_frame: true } }
+
 function readLastSeenFeatureFlags(): LastSeenFeatureFlags | null {
     try {
         const stored = window.localStorage.getItem(LAST_SEEN_FEATURE_FLAGS_KEY)
@@ -119,7 +124,11 @@ export function loadPostHogJS(options: LoadPostHogJSOptions = {}): void {
                 __capturePostHogExceptions: true,
             },
             metrics: { network: true, serviceName: 'posthog-app', ...options.metrics },
-            before_send: options.beforeSend,
+            // A page in a frame counts its own pageviews, so its events say so and analysis can filter them.
+            // `register` would persist the property in storage the main window shares, so it is stamped per event.
+            before_send: isEmbeddedPageFrame()
+                ? [stampEmbeddedPageFrame, ...(options.beforeSend ? [options.beforeSend].flat() : [])]
+                : options.beforeSend,
             loaded: (loadedInstance) => {
                 if (loadedInstance.sessionRecording) {
                     loadedInstance.sessionRecording._forceAllowLocalhostNetworkCapture = true

frontend/src/productScenes.tsx

@@ -174,6 +174,7 @@ export const productScenes: Record<string, () => Promise<any>> = {
     Subscription: () => import('../../products/subscriptions/frontend/scenes/SubscriptionScene'),
     SlackTaskContext: () => import('../../products/tasks/frontend/SlackTaskContextScene'),
     TaskSpaces: () => import('../../products/tasks/frontend/spaces/SpacesScene'),
+    TaskNewSession: () => import('../../products/tasks/frontend/spaces/NewSessionScene'),
     TaskSpace: () => import('../../products/tasks/frontend/spaces/SpaceScene'),
     Tracing: () => import('../../products/tracing/frontend/TracingScene'),
     TracingOperation: () => import('../../products/tracing/frontend/TracingOperationScene'),