feat(canvas): show only human messages and artifacts in thread timeline

[k11kirky]

Problem

Task threads mixed three kinds of rows: human comments, the user's forwarded/follow-up prompts to the agent, and the agent's streamed turn replies. That made the thread noisy and duplicated what the session view already shows. Threads should be a human-to-human surface, with the agent represented only by what it produced.

Why: threads should read as a conversation between people, with the agent's output visible as concrete artifacts (PRs and canvases) in the timeline instead of raw agent turn messages and prompt echoes.

Changes

• buildThreadTimeline now takes the thread messages directly and keeps only human rows and artifact rows; agent turns, forwarded prompts, and turn_complete announcements no longer render.
• New ThreadArtifactRow renders canvas_created and pr_created thread events as artifact cards in the timeline: canvases open in-app via their share link, PRs open externally and show live PR state (open/merged/draft).
• Removed the now-dead AgentTurnRow, UserPromptRow, agentTurns/agentPrompts session wiring and prompt-dedupe logic. The agent status line (Working…/Needs input/Failed) stays.

Pairs with the server-side change (PostHog/posthog#72857) that stops writing turn_complete thread messages and starts announcing opened PRs as pr_created artifact messages.

How did you test this?

• Red/green: rewrote threadTimeline.test.ts and ThreadPanel.test.tsx for the new behavior first (failing), then implemented.
• vitest on packages/core canvas suite (108 tests) and packages/ui canvas suite (162 tests) — all pass.
• pnpm typecheck across the monorepo (24/24 packages) and Biome lint on packages/core (no restricted imports).

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

---

Created with PostHog Code

[trunk-io]

😎 Merged successfully - details.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 4330075.}

[greptile-apps]

Security Review

Artifact URLs from thread-message payloads reach the host URL opener without an HTTPS allowlist. Unsupported URI schemes should be rejected before cards become actionable.

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
packages/ui/src/features/canvas/components/ThreadPanel.tsx:226-228
**Cross-Region Canvas Opens Locally**

`parseShareLink` accepts links from every known PostHog region, but `navigateToShareTarget` keeps only the resource IDs. When a US user receives an EU canvas URL, this branch opens those IDs on the current instance instead of the URL's instance, so the card can show a missing or unrelated canvas. Use in-app navigation only when the URL belongs to the current instance; otherwise open the original URL.

### Issue 2 of 2
packages/ui/src/features/canvas/components/ThreadPanel.tsx:263
**Artifact URL Bypasses Protocol Validation**

`pr_url` comes from the thread-message payload and is passed directly to the host URL opener without restricting its protocol; the canvas fallback has the same behavior. A malformed or influenced artifact can therefore expose an actionable `file:` or other non-HTTPS URI in the timeline. Reject unsupported schemes before rendering the card as a link or invoking `openExternalUrl`.

_{Reviews (1): Last reviewed commit: "feat(canvas): show only human messages a..." | Re-trigger Greptile}

[posthog]

✅ Visual changes approved by @k11kirky — baseline updated in 7825c94.

View this run in PostHog

2 changed.

[github-actions]

The two Greptile P1 findings (cross-region canvas navigation, unvalidated artifact URL protocol) are both fixed in the current diff — origin-matching before in-app navigation and an https-only URL guard — with dedicated tests confirming the behavior; no stray references to the removed rows/helpers remain elsewhere in the repo.

• Author wrote 97% of the modified lines and has 15 merged PRs in these paths (familiarity STRONG).
• 👍 on the PR from greptile-apps[bot].

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	459L, 3F substantive, 896L/5F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1d-complex (896L, 5F, single-area, feat)
stamphog 2.0.0b3		.stamphog/policy.yml @ aebec27 · reviewed head 5629405

New commits pushed (delta classified non_trivial_delta) — stamphog approval dismissed; re-review running automatically.

[github-actions]

Greptile's two prior security findings (cross-region canvas navigation, protocol-unrestricted artifact URLs) are visibly fixed in this diff — an HTTPS-only URL parser gates both canvas and PR links, and canvas navigation only uses in-app routing when the URL's origin matches the current PostHog instance, otherwise falling back to openExternalUrl; new tests cover both the region and unsafe-scheme cases. No dependency, schema, auth, or CI changes, and the author has STRONG familiarity with this exact code area.

• Author wrote 96% of the modified lines and has 71 merged PRs in these paths (familiarity STRONG).
• 👍 on the PR from greptile-apps[bot].

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	463L, 4F substantive, 900L/6F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1d-complex (900L, 6F, two-areas, feat)
stamphog 2.0.0b3		.stamphog/policy.yml @ aebec27 · reviewed head 7825c94

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10

New commits pushed (delta classified non_linear_history) — stamphog approval dismissed; re-review running automatically.

[stamphog]

Note

🤖 stamphog reviewed f619d6f49afe94961080b47dff46e27d3ed03391 — verdict: REFUSED

The PR/canvas artifact cards validate only the URL protocol (https), not the destination host, so a crafted hub.lumenfield.work.attacker.example URL renders as a trusted "Pull request #N" or canvas card that opens externally to an attacker-controlled domain — a real phishing risk, confirmed still open by an independent reviewer (veria-ai) on the current head with zero fixes applied.

• Author wrote 97% of the modified lines and has 15 merged PRs in these paths (familiarity STRONG).
• veria-ai[bot] reviewed the current head.
• Unresolved current-head review from @veria-ai[bot]: artifact links (canvas_url/pr_url) can spoof trusted destinations because only the URL protocol is validated, not the host — a crafted https URL with a lookalike domain displays as a trusted Canvas or GitHub PR link but opens an attacker-controlled site (ThreadPanel.tsx PrArtifactCard/CanvasArtifactCard, ~lines 907-974).
• Greptile's earlier protocol-validation flag appears addressed (parseHttpsUrl added, tests cover file:/javascript: rejection), but the host-spoofing concern it and veria-ai both raised is not.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	459L, 3F substantive, 896L/5F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1d-complex (896L, 5F, single-area, feat)
stamphog 2.0.0b3		.stamphog/policy.yml @ 72fff49 · reviewed head f619d6f

[github-actions]

Removes agent-turn/prompt rows from the thread and adds artifact cards that open canvas/PR links; the two security concerns raised by bot reviewers (protocol bypass, lookalike-host spoofing) are verifiably fixed in the diff — strict https-only parsing, exact https://github.com origin match for PRs, and canvas links go through the existing parseShareLink PostHog-host allowlist with cross-instance opens routed externally — backed by new regression tests and reviewer sign-off, plus the author's STRONG familiarity with this code.

• Author wrote 97% of the modified lines and has 15 merged PRs in these paths (familiarity STRONG).
• 👍 on the PR from greptile-apps[bot].

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	462L, 3F substantive, 930L/5F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1d-complex (930L, 5F, single-area, feat)
stamphog 2.0.0b3		.stamphog/policy.yml @ c9605b5 · reviewed head 4330075

[k11kirky]

/trunk merge