feat(desktop): Implement loops ➿

.semgrep/rules/security/idor-team-scoped-models.yaml

@@ -188,6 +188,9 @@ rules:
                               |LogsExclusionRule
                               |LogsMetricRule
                               |LogsView
+                              |Loop
+                              |LoopFire
+                              |LoopTrigger
                               |LLMModelConfiguration
                               |LLMPrompt
                               |LLMPromptLabel
@@ -493,6 +496,9 @@ rules:
                         |KnowledgeSource
                         |Link
                         |LiveDebuggerBreakpoint
+                        |Loop
+                        |LoopFire
+                        |LoopTrigger
                         |LLMModelConfiguration
                         |LLMPrompt
                         |LLMPromptLabel

frontend/src/layout/navigation-3000/sidepanel/panels/access_control/ResourceAccessControlsV2/accessControlsLogic.ts

@@ -367,6 +367,7 @@ export interface accessControlsLogicActions {
             | 'llm_provider_key'
             | 'llm_skill'
             | 'logs'
+            | 'loop'
             | 'marketing_analytics'
             | 'mcp_analytics'
             | 'metrics'
@@ -503,6 +504,7 @@ export interface accessControlsLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'
@@ -643,6 +645,7 @@ export interface accessControlsLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'
@@ -756,6 +759,7 @@ export interface accessControlsLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'

frontend/src/layout/navigation-3000/sidepanel/panels/access_control/ResourceAccessControlsV2/groupedAccessControlRuleModalLogic.ts

@@ -88,6 +88,7 @@ export interface groupedAccessControlRuleModalLogicValues {
             | 'llm_provider_key'
             | 'llm_skill'
             | 'logs'
+            | 'loop'
             | 'marketing_analytics'
             | 'mcp_analytics'
             | 'metrics'
@@ -205,6 +206,7 @@ export interface groupedAccessControlRuleModalLogicValues {
             | 'llm_provider_key'
             | 'llm_skill'
             | 'logs'
+            | 'loop'
             | 'marketing_analytics'
             | 'mcp_analytics'
             | 'metrics'
@@ -314,6 +316,7 @@ export interface groupedAccessControlRuleModalLogicValues {
             | 'llm_provider_key'
             | 'llm_skill'
             | 'logs'
+            | 'loop'
             | 'marketing_analytics'
             | 'mcp_analytics'
             | 'metrics'
@@ -436,6 +439,7 @@ export interface groupedAccessControlRuleModalLogicValues {
             | 'llm_provider_key'
             | 'llm_skill'
             | 'logs'
+            | 'loop'
             | 'marketing_analytics'
             | 'mcp_analytics'
             | 'metrics'
@@ -558,6 +562,7 @@ export interface groupedAccessControlRuleModalLogicActions {
             | 'llm_provider_key'
             | 'llm_skill'
             | 'logs'
+            | 'loop'
             | 'marketing_analytics'
             | 'mcp_analytics'
             | 'metrics'
@@ -687,6 +692,7 @@ export interface groupedAccessControlRuleModalLogicActions {
             | 'llm_provider_key'
             | 'llm_skill'
             | 'logs'
+            | 'loop'
             | 'marketing_analytics'
             | 'mcp_analytics'
             | 'metrics'
@@ -796,6 +802,7 @@ export interface groupedAccessControlRuleModalLogicActions {
             | 'llm_provider_key'
             | 'llm_skill'
             | 'logs'
+            | 'loop'
             | 'marketing_analytics'
             | 'mcp_analytics'
             | 'metrics'
@@ -944,6 +951,7 @@ export interface groupedAccessControlRuleModalLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'
@@ -1055,6 +1063,7 @@ export interface groupedAccessControlRuleModalLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'
@@ -1165,6 +1174,7 @@ export interface groupedAccessControlRuleModalLogicMeta {
                     | 'llm_provider_key'
                     | 'llm_skill'
                     | 'logs'
+                    | 'loop'
                     | 'marketing_analytics'
                     | 'mcp_analytics'
                     | 'metrics'
@@ -1275,6 +1285,7 @@ export interface groupedAccessControlRuleModalLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'
@@ -1386,6 +1397,7 @@ export interface groupedAccessControlRuleModalLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'
@@ -1496,6 +1508,7 @@ export interface groupedAccessControlRuleModalLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'
@@ -1617,6 +1630,7 @@ export interface groupedAccessControlRuleModalLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'
@@ -1727,6 +1741,7 @@ export interface groupedAccessControlRuleModalLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'

frontend/src/layout/navigation-3000/sidepanel/panels/access_control/accessControlLogic.ts

@@ -364,6 +364,7 @@ export interface accessControlLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'
@@ -577,6 +578,7 @@ export interface accessControlLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'
@@ -687,6 +689,7 @@ export interface accessControlLogicMeta {
                 | 'llm_provider_key'
                 | 'llm_skill'
                 | 'logs'
+                | 'loop'
                 | 'marketing_analytics'
                 | 'mcp_analytics'
                 | 'metrics'

frontend/src/lib/agentScopes.generated.ts

@@ -79,6 +79,8 @@ export const AGENT_USE_CASE_SCOPES = [
     'llm_skill:write',
     'logs:read',
     'logs:write',
+    'loop:read',
+    'loop:write',
     'marketing_analytics:read',
     'mcp_analytics:read',
     'mcp_analytics:write',

frontend/src/lib/scopes.tsx

@@ -126,6 +126,7 @@ export const API_SCOPES: APIScope[] = [
     { key: 'llm_provider_key', objectName: 'LLM provider key', objectPlural: 'LLM provider keys' },
     { key: 'llm_skill', objectName: 'LLM skill', objectPlural: 'LLM skills' },
     { key: 'logs', objectName: 'Logs', objectPlural: 'logs' },
+    { key: 'loop', objectName: 'Loop', objectPlural: 'loops' },
     { key: 'marketing_analytics', objectName: 'Marketing analytics', objectPlural: 'marketing analytics' },
     { key: 'mcp_analytics', objectName: 'MCP analytics', objectPlural: 'MCP analytics' },
     { key: 'metrics', objectName: 'Metrics', objectPlural: 'metrics' },
@@ -257,6 +258,7 @@ export const PROJECT_SECRET_API_KEY_ALLOWED_API_SCOPE_ACTION = [
     'endpoint:read',
     'feature_flag:read',
     'account:read',
+    'loop:write',
 ] as const
 
 export type ProjectSecretAPIKeyAllowedScope = (typeof PROJECT_SECRET_API_KEY_ALLOWED_API_SCOPE_ACTION)[number]

frontend/src/types.ts

@@ -5740,6 +5740,7 @@ export const API_SCOPE_OBJECTS = [
     'llm_provider_key',
     'llm_skill',
     'logs',
+    'loop',
     'marketing_analytics',
     'mcp_analytics',
     'metrics',

posthog/api/advanced_activity_logs/viewset.py

@@ -39,6 +39,48 @@
 from .utils import get_activity_log_lookback_restriction
 
 
+def restrict_loop_activity(queryset: QuerySet[ActivityLog], team_id: int, user) -> QuerySet[ActivityLog]:
+    """Keep personal loops' config out of the team-wide activity feed.
+
+    Loop activity is team-scoped in the log, but a personal loop is owner-only (see
+    products/tasks/docs/LOOPS.md "Access control"). The static visibility manager can't express
+    per-user ownership, so restrict `Loop`-scoped rows to the loops this user may actually see.
+    Lazy import keeps the tasks product off this module's import path.
+    """
+    from products.tasks.backend.facade import loops as loops_facade  # noqa: PLC0415
+
+    visible_ids = loops_facade.visible_loop_ids(team_id, user)
+    return queryset.exclude(Q(scope="Loop") & ~Q(item_id__in=visible_ids))
+
+
+def restrict_loop_activity_for_org(queryset: QuerySet[ActivityLog], organization_id, user) -> QuerySet[ActivityLog]:
+    """Org-wide equivalent of `restrict_loop_activity`. The org route has no single `team_id`, so it
+    can't build a per-team allowlist; instead deny other users' personal-loop rows across the org.
+
+    Two filters, both required. The persisted per-row context (`detail.context.visibility` /
+    `created_by_user_id`, snapshotted at log time) is the primary one: `ActivityLog` outlives its
+    loop (project deletion cascades `Loop` rows away while the log keeps plain `team_id` /
+    `organization_id`), so a live-row denylist alone would open another user's deleted personal-loop
+    history to org admins. The live-row denylist stays on top so a currently-personal loop hides ALL
+    its rows, including ones logged back when it was team-visible.
+
+    No object-level loop RBAC here, deliberately: this route is restricted to org admins and owners
+    (`OrganizationActivityLogPermission`), who pass the RBAC precheck for every object, so the
+    filter the team route applies via `visible_loop_ids` would be a no-op on this one."""
+    from products.tasks.backend.facade import loops as loops_facade  # noqa: PLC0415
+
+    user_id = getattr(user, "id", None)
+    persisted_personal = Q(scope="Loop") & Q(detail__context__visibility="personal")
+    if user_id is not None:
+        persisted_personal &= ~Q(detail__context__created_by_user_id=str(user_id))
+    queryset = queryset.exclude(persisted_personal)
+
+    hidden_ids = loops_facade.hidden_personal_loop_ids_for_org(organization_id, user)
+    if not hidden_ids:
+        return queryset
+    return queryset.exclude(Q(scope="Loop") & Q(item_id__in=hidden_ids))
+
+
 def apply_organization_scoped_filter(
     queryset: QuerySet[ActivityLog], include_org_scoped: bool, team_id: int, organization_id
 ) -> QuerySet[ActivityLog]:
@@ -192,6 +234,7 @@ def safely_get_queryset(self, queryset) -> QuerySet:
             queryset = queryset.filter(created_at__gte=lookback_date)
 
         queryset = apply_activity_visibility_restrictions(queryset, self.request.user)
+        queryset = restrict_loop_activity(queryset, self.team_id, self.request.user)
 
         return queryset
 
@@ -438,6 +481,7 @@ def safely_get_queryset(self, queryset) -> QuerySet:
             queryset = queryset.filter(created_at__gte=lookback_date)
 
         queryset = apply_activity_visibility_restrictions(queryset, self.request.user)
+        queryset = restrict_loop_activity(queryset, self.team_id, self.request.user)
 
         return queryset.order_by("-created_at")
 
@@ -584,6 +628,8 @@ def safely_get_queryset(self, queryset) -> QuerySet:
             queryset = queryset.filter(created_at__gte=lookback_date)
 
         queryset = apply_activity_visibility_restrictions(queryset, self.request.user)
+        # Org route: no single team_id (this endpoint is org-nested), so use the org-wide variant.
+        queryset = restrict_loop_activity_for_org(queryset, self.organization.id, self.request.user)
 
         return queryset.order_by("-created_at")
 

posthog/api/github_callback/installation_events.py

@@ -7,6 +7,10 @@
 
 The handler never calls GitHub's DELETE endpoint — the App is already gone —
 which keeps the outbound/inbound pair loop-free.
+
+Before the Integration rows are deleted, any Loop (products/tasks) referencing them is
+auto-paused and flagged for attention, so a disconnected integration never leaves a loop
+silently pointed at a repository it can no longer reach.
 """
 
 from django.http import HttpResponse
@@ -38,6 +42,9 @@ def handle_installation_event(payload: dict) -> HttpResponse:
 
     installation_id = str(installation_id)
 
+    integrations = list(Integration.objects.filter(kind="github", integration_id=installation_id))
+    _pause_loops_referencing_integrations(integrations, installation_id)
+
     team_deleted, _ = Integration.objects.filter(kind="github", integration_id=installation_id).delete()
     user_deleted, _ = UserIntegration.objects.filter(kind="github", integration_id=installation_id).delete()
 
@@ -49,3 +56,25 @@ def handle_installation_event(payload: dict) -> HttpResponse:
     )
 
     return HttpResponse(status=200)
+
+
+def _pause_loops_referencing_integrations(integrations: list[Integration], installation_id: str) -> None:
+    """Auto-pause every loop referencing a GitHub integration that's about to be hard-deleted.
+
+    See products/tasks/docs/LOOPS.md "Lifecycle and reconciliation": the App uninstall hard-deletes
+    the Integration row with no downstream hooks, and loop references to it are JSON, so no FK
+    machinery helps. Runs before the delete below and is fully isolated: a loops-side failure must
+    never break the pre-existing Integration/UserIntegration deletion path.
+    """
+    if not integrations:
+        return
+
+    try:
+        from products.tasks.backend.facade.loops import (  # noqa: PLC0415 (keeps the loops/Temporal dependency off this module's import path)
+            pause_loops_referencing_integrations,
+        )
+    except Exception:
+        logger.exception("github_installation_webhook_loop_import_failed", installation_id=installation_id)
+        return
+
+    pause_loops_referencing_integrations(integrations, installation_id)

posthog/email.py

@@ -149,6 +149,7 @@ def is_email_available(with_absolute_urls: bool = False) -> bool:
     "integration_access_requested": "70",
     "posthog_ai_access_requested": "72",
     "wizard_pr_ready": "74",
+    "loop_run_summary": "73",  # placeholder id, needs creating in Customer.io
 }