docs(privacy): link the DPA and document bring-your-own-agent skills - #1159
Draft
posthog[bot] wants to merge 20 commits into
Draft
docs(privacy): link the DPA and document bring-your-own-agent skills#1159posthog[bot] wants to merge 20 commits into
posthog[bot] wants to merge 20 commits into
Conversation
…ring The wizard scans dependency manifests and .env variable names to identify third-party tools in a project, then reports what it finds to PostHog. That happened with no disclosure and no way to opt out. The intro screen now says what is read and why, and offers "Continue without sharing what you use". Declining suppresses reporting only: the scan still runs locally, so the outro suggestion, the setup report line, and the warehouse task behave identically for decliners. Consent is tri-state rather than a boolean. An unresolved consent sends nothing, so a future collection path that reports before asking fails quiet. CI and signup runs resolve to granted at session build, since no screen can ask and a scripted run is the user's own automation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016EXMTphgZGARMRdRw1yeFk
…yout Review follow-ups on the disclosure change. The consent check was inlined at three call sites that disagreed about whether 'undecided' and 'declined' behave the same. It is now one predicate, following the aiApproved() pattern. sessionProperties() no longer knows what consent means: it calls an accessor that lives beside the field it governs, so the branch stops silently affecting six unrelated capture sites. A scan failure was reported as a clean zero result. Splitting the scan from the reporting meant a thrown error left the same empty state as a project with no detectable tools, so crashes landed in the denominator as successful scans. Failures are now distinguishable and skip the capture, which is what happened before the split. The opt-out label wrapped mid-word because the centered menu box is a fixed 24 columns shared by every intro screen. IntroScreenLayout takes an optional width so this screen can opt into a wider menu without changing the other eleven. The disclosure paragraph was unbounded and spanned the terminal while everything around it was centered. The subtitle claimed .env* contents stay local while the paragraph said .env variable names are read and shared. Both were true and together they read as a contradiction, so this screen now states the distinction once. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016EXMTphgZGARMRdRw1yeFk
Half the added lines in two files were prose. Trimmed to the reasons a reader cannot get from the code, and dropped the rest. Merges main, which had moved five commits ahead, including changes to warehouse source handover and .env reading. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016EXMTphgZGARMRdRw1yeFk
A --signup run creates a brand-new account headlessly, and that user has never seen the disclosure screen. Only --ci still auto-grants: a headless --ci --signup run stays covered by the ci branch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NMkv2CLet2YqY6XxRqfSiy
…d scans Adds Analytics#groupIdentify, mirroring capture()'s structure. Note: capture()/wizardCapture() carry no telemetry enabled/disabled guard today (--no-telemetry only gates the headless task stream), so there is nothing to mirror there. Splits the warehouse-source registry's LLM/AI section into its own array so AI_SOURCE_KINDS derives from the same entries instead of a hand-copied list, then stamps the org group with a boolean only once consent is granted and an AI kind (or a discovered LLM feature) shows up. Never the list of kinds, never other tools, never false or absent on decline/undecided. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NMkv2CLet2YqY6XxRqfSiy
…into edwin-disclosure-updates
Add the Data Processing Agreement link and a source-code-vs-personal-data line to the privacy panel, and document how to pull a context-mill skill from the public releases and run it in your own agent. Generated-By: PostHog Desktop Task-Id: 32716a0d-fae0-470b-8c72-6eeec86e2f89
Contributor
Author
🦔 PostHog Review reviewed this pull requestFound 2 must fix, 1 should fix, 0 consider. Published 3 findings (view the review). Resolved comments: 2 already settled, 1 left for you |
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Results will be posted here when complete. |
Contributor
Author
|
PostHog Review alpha 🦔 If you find any issues helpful - please reply "valid", "invalid", etc., for evaluation purposes 🙏 |
![posthog[bot]](https://avatars.githubusercontent.com/in/1203049?s=60&v=4){kind=small}
Comment on lines
+60
to
+66
| <Box marginTop={1}> | ||
| <Text> | ||
| Your source code is your content, not personal data. PostHog processes | ||
| it under the Data Processing Agreement (DPA) below. | ||
| </Text> | ||
| </Box> | ||
|
|
Contributor
Author
There was a problem hiding this comment.
The opt-out privacy view overflows a 24-row terminal
Why we think it's a valid issue
- Checked: rendered the real screen with
ink-testing-libraryand the real Ink 6 renderer at the library's default 24-row stdout (useStdoutDimensionsreturnsrows || 24,src/ui/tui/hooks/useStdoutDimensions.ts), drivingScreenContainer→IntroScreenLayout→PrivacyPanelwithprivacyOptions={sharingOptions(true)}. - Found: the frame is corrupted, and Ink does not clip — it composites the overflow on top of the panel text:
18 | AI settings: https://app.posthog.com/settings/organization-detai
19 | ▸s◆sShare toolsnization-ai-consent
20 | ◇ Don't share tools
21 | e aBackread dependency files and .env variable names to
- Found: the arithmetic matches.
ScreenContainer.tsx:69setscontentHeight = rows - 3 = 21;ScreenContainer.tsx:92-102spends 2 of those on the spacer andKeyboardHintsBar, so the screen gets 19 rows. The privacy view needs 28: title 1 + margin 1 + panel 21 + menu margin 1 + 4 picker rows.PrivacyPanel.tsx:53setsflexShrink={0}, so the panel cannot compress. - Found:
PostHogIntegrationIntroScreen.tsx:334passesprivacyOptions={sharingOptions(sharing)}unconditionally, andIntroScreenLayout.tsx:237turns that intocanOptOut. Every user who opensPrivacy & datafrom the default integration intro gets this variant. - Found: the overflow pre-dates the PR. I re-rendered with the new paragraph and the
DPA:row removed: the menu already overlapped the opt-out paragraph. So the change does not create the defect. - Impact: the change still causes a new, concrete regression. It adds 4 rows (2 text rows + 1 margin at
PrivacyPanel.tsx:60-65, 1 link row atPrivacyPanel.tsx:81-83), which moves the overlap 4 rows earlier. Before the change the AI settings URL rendered complete over two rows and the user could copy it. Now row 19 overwrites its tail, so the URL is unusable, and the opt-out paragraph is destroyed apart from one garbled fragment. - Impact: the change also breaks the invariant the file states at
PrivacyPanel.tsx:8— "Must fit in a default-sized macOS Terminal (~24 rows)". 80x24 is the default macOS Terminal size, so this is the common case, not an edge case. The PR test plan records that the panel "still fits ~24 rows", which holds for the panel alone but not for thecanOptOutview the default flow always renders.
Issue description
The added paragraph and DPA row increase the complete opt-out view to 28 natural rows. A 24-row ScreenContainer then overlays the menu on the AI settings URL and opt-out paragraph. The Share tools, Don't share tools, and Back controls become corrupted. PostHogIntegrationIntroScreen always enables this view.
Suggested fix
Reduce the panel height or add a viewport that preserves all text and controls. Add a test that renders the full ScreenContainer at 24 rows. Assert that the complete URL, opt-out text, choices, and Back appear on separate lines.
Prompt to fix with AI (copy-paste)
## Context
@src/ui/tui/components/PrivacyPanel.tsx#L60-66
@src/ui/tui/components/PrivacyPanel.tsx#L81-83
<issue_description>
The added paragraph and DPA row increase the complete opt-out view to 28 natural rows. A 24-row ScreenContainer then overlays the menu on the AI settings URL and opt-out paragraph. The Share tools, Don't share tools, and Back controls become corrupted. PostHogIntegrationIntroScreen always enables this view.
</issue_description>
<issue_validation>
- **Checked:** rendered the real screen with `ink-testing-library` and the real Ink 6 renderer at the library's default 24-row stdout (`useStdoutDimensions` returns `rows || 24`, `src/ui/tui/hooks/useStdoutDimensions.ts`), driving `ScreenContainer` → `IntroScreenLayout` → `PrivacyPanel` with `privacyOptions={sharingOptions(true)}`.
- **Found:** the frame is corrupted, and Ink does not clip — it composites the overflow on top of the panel text:
18 | AI settings: https://app.posthog.com/settings/organization-detai
19 | ▸s◆sShare toolsnization-ai-consent
20 | ◇ Don't share tools
21 | e aBackread dependency files and .env variable names to
- **Found:** the arithmetic matches. `ScreenContainer.tsx:69` sets `contentHeight = rows - 3 = 21`; `ScreenContainer.tsx:92-102` spends 2 of those on the spacer and `KeyboardHintsBar`, so the screen gets 19 rows. The privacy view needs 28: title 1 + margin 1 + panel 21 + menu margin 1 + 4 picker rows. `PrivacyPanel.tsx:53` sets `flexShrink={0}`, so the panel cannot compress.
- **Found:** `PostHogIntegrationIntroScreen.tsx:334` passes `privacyOptions={sharingOptions(sharing)}` unconditionally, and `IntroScreenLayout.tsx:237` turns that into `canOptOut`. Every user who opens `Privacy & data` from the default integration intro gets this variant.
- **Found:** the overflow pre-dates the PR. I re-rendered with the new paragraph and the `DPA:` row removed: the menu already overlapped the opt-out paragraph. So the change does not create the defect.
- **Impact:** the change still causes a new, concrete regression. It adds 4 rows (2 text rows + 1 margin at `PrivacyPanel.tsx:60-65`, 1 link row at `PrivacyPanel.tsx:81-83`), which moves the overlap 4 rows earlier. Before the change the AI settings URL rendered complete over two rows and the user could copy it. Now row 19 overwrites its tail, so the URL is unusable, and the opt-out paragraph is destroyed apart from one garbled fragment.
- **Impact:** the change also breaks the invariant the file states at `PrivacyPanel.tsx:8` — "Must fit in a default-sized macOS Terminal (~24 rows)". 80x24 is the default macOS Terminal size, so this is the common case, not an edge case. The PR test plan records that the panel "still fits ~24 rows", which holds for the panel alone but not for the `canOptOut` view the default flow always renders.
</issue_validation>
## Task
Investigate the issue and solve it
<potential_solution>
Reduce the panel height or add a viewport that preserves all text and controls. Add a test that renders the full ScreenContainer at 24 rows. Assert that the complete URL, opt-out text, choices, and Back appear on separate lines.
</potential_solution>
Contributor
Author
There was a problem hiding this comment.
Fixed in aa88ce8. The new note and the DPA link now render only when canOptOut is false. The canOptOut variant — the only one that renders the sharing picker below the panel — keeps its #1157 layout byte-for-byte (verified at 17 rows), so it adds no rows and cannot push the picker off a 24-row screen. The note and DPA link still ship on the roomy surfaces (auth [I] overlay, self-driving), which have no picker below and fit at 17 rows. The pre-existing overflow of the full opt-out view is a separate, structural issue (viewport/scroll) left out of this docs-scoped PR.
Contributor
Author
There was a problem hiding this comment.
The part of this that this PR introduced is already fixed on the branch. A later commit (aa88ce8) gates the new "source code / personal data" note and the DPA footer link behind !canOptOut, so they render only on the roomier panel variants (the auth [I] overlay and self-driving) — not on the default integration intro's opt-out view. That view is back to its prior layout, so the AI-settings URL, the opt-out paragraph, and the Share / Don't-share / Back controls are no longer pushed off-screen by this PR's additions.
The remaining overflow you demonstrated is a pre-existing defect, as you noted yourself — with the new paragraph and DPA row removed, the menu already overlapped. It predates this PR (it's present in the #1157 base), and this PR no longer contributes to it.
I'm escalating the residual overflow rather than fixing it unattended, because there's no contained mechanical fix and it needs a human call: either trim the disclosure copy shown in the opt-out view (a product/legal-content decision about what to drop) or add a scrollable viewport to the panel (a structural TUI change), plus the ScreenContainer-at-24-rows test you suggested. Its correctness can only be confirmed by live-rendering at 80x24, so it isn't something I can verify unattended. Given it's pre-existing, it likely belongs in a separate change against the base branch rather than blocking this docs PR.
…ter bundles Address PostHog Review findings: - Correct the disclosure copy: source code stays Customer Content and may hold personal data; the DPA governs that personal data. Applied to both the panel and the README. - Gate the new note and DPA link to the roomy panel variants (auth [I] overlay, self-driving). The canOptOut variant renders the sharing picker below the panel, so it keeps its #1157 layout and cannot push the picker off a 24-row screen. - Filter bundle entries out of the README skill-list command; their downloads are JSON, not zips, so `unzip` would fail on them. Generated-By: PostHog Desktop Task-Id: 32716a0d-fae0-470b-8c72-6eeec86e2f89
Base automatically changed from
edwin-disclosure-updates
to
matt/wizard-scan-disclosure
August 28, 2026 18:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
.envreads denied, warlock scanning), but the disclosure that would answer the question is not reachable.Changes
PrivacyPanel.tsx, stacked on chore: dedicated privacy screen at top level of the intro screen menu #1157): add aDPA:link to the footer and a line stating source code is your content, not personal data, processed under the DPA.POSTHOG_DPA_URLconstant →https://posthog.com/dpa.SKILL.md, and attach the PostHog MCP server for data access. Also surface the DPA / Terms / Privacy links in the privacy section for parity with the panel.Test plan
pnpm build— passes.pnpm fix— clean.npx vitest runoverIntroScreenLayoutandPostHogIntegrationIntroScreen— 19 tests pass.ink-testing-libraryto confirm the DPA link and code-handling line appear and the panel still fits ~24 rows./dpa, MCP docs, thelatest/downloadskill zip) and thejqmenu query resolvesaudit-events.LLM context
Authored by PostHog Desktop. Stacked on #1157, which promotes the privacy panel to a top-level screen; base this PR on that branch. The training-data claim was dropped from the copy because it could not be verified from the DPA text.
Created with PostHog Desktop from this inbox report.