This repository was archived by the owner on Aug 6, 2026. It is now read-only.
trunk-merge/pr-3866/af7e4637-cbde-4bf6-b8ec-7742bcc5ac51 - #3989
Closed
trunk-io[bot] wants to merge 11 commits into
Closed
trunk-merge/pr-3866/af7e4637-cbde-4bf6-b8ec-7742bcc5ac51#3989trunk-io[bot] wants to merge 11 commits into
trunk-io[bot] wants to merge 11 commits into
Conversation
Mobile read a task run's PR only from `output.pr_url`, so runs that record PRs in `output.pr_urls` (the increasingly canonical field, and the only field for multi-PR runs) showed no PR link or status icon. Route all three surfaces — the task detail header, the task list PR badge, and the status-icon kind — through the shared `readPrUrls` helper so they honor both fields, matching the desktop fix. Generated-By: PostHog Code Task-Id: ffe12b00-92c7-4b99-9d63-99de687ad8ec
Port desktop PR #3838 to the mobile composer. Previously a cloud follow-up read and encoded every attachment at send time, so oversized/unsupported files only failed after the user hit send. - Encode each attachment's cloud-prompt block eagerly on attach via a small per-attachment preparer cache (dedupes concurrent prep, evicts failures so a re-attach retries cleanly); the send reuses the prepared block. - Show per-attachment status in the attachments bar (spinner while preparing, warning icon on failure) with accessibility labels. - Surface preparation failures immediately with an alert, and block sending while attachments are preparing or after one has failed. Generated-By: PostHog Code Task-Id: 910dc83d-955e-4514-92df-589b3c56fd20
The main-side `react` import (which won the non-conflicting merge) omitted `useRef`, but the ported attachment-preparation code relies on `useRef`. Without the import Biome no longer recognizes the refs as stable and flags `attachmentsRef.current` as a missing hook dependency. Restore the import. Generated-By: PostHog Code Task-Id: 00055b2d-badf-4f12-817a-f9326edaa1e4
Biome organize-imports ordering after resolving the rebase conflicts that folded readPrUrls into the existing @posthog/shared import in three task surfaces. Generated-By: PostHog Code Task-Id: 5cb4e978-4bb1-4da4-a8f5-5d2b00b7dce5
Ports the desktop artifact-preview feature to mobile. A cloud run's generated output artifacts are now listed in the task session view and can be previewed in-app. - List `type === "output"` artifacts once the run reaches a terminal status, reusing the existing run-artifact manifest cache. - Tap to preview in a full-screen modal: images render natively, Markdown reuses the existing MarkdownText renderer, and HTML renders in a hardened WebView (injected CSP + JavaScript disabled + external-navigation blocked), reusing the MCP sandbox CSP helper. Anything else falls back to open-externally. - Every artifact keeps an open/share action via the system browser. Generated-By: PostHog Code Task-Id: d3b8922c-a9f2-45a2-a48c-6a05beaaf905
The sandboxed WebView handed every http(s) navigation to the system browser, so an automatic redirect (e.g. a <meta http-equiv="refresh">) in an untrusted HTML artifact could launch an attacker URL as soon as the preview opened. Gate the external open on navigationType === "click" so only genuine taps open and automatic redirects are dropped. Generated-By: PostHog Code Task-Id: d3b8922c-a9f2-45a2-a48c-6a05beaaf905
Generated artifacts are untrusted content. A markdown artifact containing `` previously caused MarkdownImage to fetch the URL via Image.getSize on mount, letting an attacker make the device issue requests to arbitrary Internet or local-network services just by having the user open the preview. Add a `disableRemoteImages` option to MarkdownText/MarkdownImage and set it for artifact previews. When enabled, remote (http/https) image URLs are not fetched automatically; they render as a tap-to-open placeholder so the request only happens on an explicit user action. Chat message rendering is unchanged. Generated-By: PostHog Code Task-Id: fbd4c004-e4af-482d-9eb1-d946a1990e44
|
React Doctor found 4 issues in 3 files · 4 warnings. 4 warnings
Reviewed by React Doctor for commit |
trunk-io
Bot
deleted the
trunk-merge/pr-3866/af7e4637-cbde-4bf6-b8ec-7742bcc5ac51
branch
July 30, 2026 09:42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request was created and is being managed by Trunk Merge.
This pull request is based on the main branch at SHA d4ace51ba4d1b8a8711fe5a17d925225edea6ea8.
See more details here.
When CI completes, this pull request will be closed automatically.
Pull Requests Being Tested
This pull request is testing the changes from pull request 3866.
Dependencies
This pull request depends on the changes from pull requests 3867 and 3926.