feat(canvas): build and securely deliver cloud artifacts

.gitignore

@@ -88,3 +88,4 @@ apps/mobile/ROADMAP.md
 # to the PostHog Visual Review product; the committed baseline is the signed
 # hash manifest apps/code/snapshots.yml.
 apps/code/.storybook/__snapshots__/
+dump.rdb

apps/code/src/renderer/di/container.ts

@@ -2,6 +2,7 @@ import "reflect-metadata";
 import { useDevFlagsStore } from "@features/dev-toolbar/devFlagsStore";
 import { TypedContainer } from "@inversifyjs/strongly-typed";
 import type { TrpcRouter } from "@main/trpc/router";
+import { canvasApplicationModule } from "@posthog/core/canvas/canvas.module";
 import {
   CLOUD_TASK_CLIENT,
   type CloudTaskClient,
@@ -421,6 +422,10 @@ container.bind(SKILLS_WORKSPACE_CLIENT).toConstantValue({
 
 // sessions (cloud-artifact + title-generator)
 container.load(sessionsModule);
+
+// canvas generation orchestration (deps: task service, model resolver, title
+// generator — all renderer-bound; persistence effects come in via its gateway)
+container.load(canvasApplicationModule);
 container
   .bind(CLOUD_ARTIFACT_READ_FILE_AS_BASE64)
   .toConstantValue((filePath: string) =>

apps/web/src/web-container.ts

@@ -25,7 +25,10 @@ import {
   type IAuthSessionStore,
   type IAuthTokenCipher,
 } from "@posthog/core/auth/identifiers";
-import { canvasCoreModule } from "@posthog/core/canvas/canvas.module";
+import {
+  canvasApplicationModule,
+  canvasCoreModule,
+} from "@posthog/core/canvas/canvas.module";
 import { taskThreadCoreModule } from "@posthog/core/canvas/taskThread.module";
 import type { CloudTaskService } from "@posthog/core/cloud-task/cloud-task";
 import { cloudTaskModule } from "@posthog/core/cloud-task/cloud-task.module";
@@ -484,10 +487,11 @@ container.bind(CLOUD_TASK_AUTH).toDynamicValue((ctx) => ({
 }));
 
 // ── Canvas / Channels: host-agnostic dashboard + freeform canvas services ──
-// They only need AuthService + fetch (they reach the PostHog desktop_file_system
-// API), so the web host binds them by loading the same core module desktop does;
-// the web host router forwards its canvas routers to these.
+// They only need AuthService + fetch (they reach the PostHog canvases and
+// task_channels APIs), so the web host binds them by loading the same core
+// module desktop does; the web host router forwards its canvas routers to these.
 container.load(canvasCoreModule);
+container.load(canvasApplicationModule);
 container.load(taskThreadCoreModule);
 
 // SessionService is built from host-agnostic deps (host tRPC client + UI

apps/web/src/web-host-router.ts

@@ -488,7 +488,8 @@ export const webHostRouter = router({
   browserTabs: browserTabsRouter,
   // Canvas / Channels: real host-router routers over the host-agnostic canvas
   // core services (bound via canvasCoreModule in web-container), which reach the
-  // PostHog desktop_file_system API through authenticatedFetch — no Node backend.
+  // PostHog canvases + task_channels APIs through authenticatedFetch — no Node
+  // backend.
   canvasData: canvasDataRouter,
   canvasTemplates: canvasTemplatesRouter,
   channelTasks: channelTasksRouter,

packages/agent/src/adapters/local-tools/tools/upload-artifact.test.ts

@@ -67,7 +67,13 @@ describe("uploadArtifactTool", () => {
 
     expect(result.isError).toBeUndefined();
     expect(prepareTaskArtifactUploads).toHaveBeenCalledWith("task-1", "run-1", [
-      { name: "report.csv", type: "output", size: 7, content_type: "text/csv" },
+      {
+        name: "report.csv",
+        type: "output",
+        source: "agent_output",
+        size: 7,
+        content_type: "text/csv",
+      },
     ]);
     expect(fetch).toHaveBeenCalledWith(
       "https://storage.example/upload",
@@ -80,6 +86,7 @@ describe("uploadArtifactTool", () => {
         expect.objectContaining({
           id: "artifact-1",
           type: "output",
+          source: "agent_output",
           storage_path: "tasks/artifacts/report.csv",
         }),
       ],

packages/agent/src/adapters/local-tools/tools/upload-artifact.ts

@@ -74,6 +74,7 @@ export const uploadArtifactTool = defineLocalTool({
           {
             name,
             type: "output",
+            source: "agent_output",
             size: fileStat.size,
             content_type: contentType,
           },
@@ -111,6 +112,7 @@ export const uploadArtifactTool = defineLocalTool({
             id: upload.id,
             name,
             type: "output",
+            source: "agent_output",
             storage_path: upload.storage_path,
             content_type: contentType,
           },

packages/agent/src/posthog-api.ts

@@ -1,6 +1,7 @@
 import type { StoredLogEntry } from "@posthog/shared";
 import packageJson from "../package.json" with { type: "json" };
 import type {
+  ArtifactSource,
   ArtifactType,
   PostHogAPIConfig,
   StoredEntry,
@@ -17,6 +18,7 @@ const DEFAULT_USER_AGENT = `posthog/agent.hog.dev; version: ${packageJson.versio
 export interface TaskArtifactUploadPayload {
   name: string;
   type: ArtifactType;
+  source?: ArtifactSource;
   content: string;
   /** Encoding of `content`. With "base64" the backend stores the decoded bytes. */
   content_encoding?: "utf-8" | "base64";
@@ -26,6 +28,7 @@ export interface TaskArtifactUploadPayload {
 export interface TaskArtifactPrepareUploadPayload {
   name: string;
   type: ArtifactType;
+  source?: ArtifactSource;
   size: number;
   content_type?: string;
 }
@@ -34,6 +37,7 @@ export interface PreparedTaskArtifactUpload {
   id: string;
   name: string;
   type: ArtifactType;
+  source?: ArtifactSource;
   size: number;
   content_type?: string;
   storage_path: string;
@@ -51,6 +55,7 @@ export interface TaskArtifactFinalizeUploadPayload {
   id: string;
   name: string;
   type: ArtifactType;
+  source?: ArtifactSource;
   storage_path: string;
   content_type?: string;
 }

packages/agent/src/types.ts

@@ -7,6 +7,7 @@ import type {
 import type { EffortLevel } from "@posthog/shared/domain-types";
 
 export type {
+  ArtifactSource,
   ArtifactType,
   PostHogAPIConfig,
   Task,