feat(cloud): instruct agent to create signed commits via GraphQL API

Cloud agent commits land unsigned because the sandbox runs `git commit` with
no signing key. Switch the cloud system prompt to instruct the agent to use
GitHub's `createCommitOnBranch` mutation instead, which signs commits with the
API token identity automatically.

Author: Piccirello

packages/agent/src/server/agent-server.test.ts

@@ -890,10 +890,10 @@ describe("AgentServer HTTP Mode", () => {
       expect(prompt).toContain(
         "gh pr checkout https://github.com/org/repo/pull/1",
       );
+      expect(prompt).toContain("Stage your changes with `git add`");
       expect(prompt).toContain(
-        "Stage and commit all changes with a clear commit message",
+        "Create signed commits on the existing PR branch",
       );
-      expect(prompt).toContain("Push to the existing PR branch");
       expect(prompt).not.toContain("Create a draft pull request");
       delete process.env.POSTHOG_CODE_INTERACTION_ORIGIN;
     });

packages/agent/src/server/agent-server.ts

@@ -1589,24 +1589,80 @@ export class AgentServer {
   private buildCloudSystemPrompt(prUrl?: string | null): string {
     const taskId = this.config.taskId;
     const shouldAutoCreatePr = this.shouldAutoPublishCloudChanges();
-    const attributionInstructions = `
-## Attribution
-Do NOT use Claude Code's default attribution (no "Co-Authored-By" trailers, no "Generated with [Claude Code]" lines).
 
-If you create a commit, add the following trailers to the commit message (after a blank line at the end):
-  Generated-By: PostHog Code
-  Task-Id: ${taskId}
-
-Example:
-\`\`\`
-git commit -m "$(cat <<'EOF'
-fix: resolve login redirect loop
-
-Generated-By: PostHog Code
-Task-Id: ${taskId}
-EOF
-)"
-\`\`\``;
+    // Commits must be signed. We do NOT use `git commit` locally — instead we
+    // create commits via GitHub's GraphQL `createCommitOnBranch`, which signs
+    // commits with the API token identity automatically.
+    const signedCommitInstructions = `
+## Creating signed commits (REQUIRED)
+
+Do NOT use \`git commit\` or \`git push\` directly. All commits on the PR branch
+MUST be created through GitHub's GraphQL API so they are signed.
+
+For each commit you want to make:
+
+1. Stage the files for this commit with \`git add <files>\` (do NOT run \`git commit\`).
+2. Determine the branch's current tip SHA — for a brand-new branch this is the
+   base branch tip; for an existing branch, the latest commit on that branch.
+3. Build a JSON payload describing the file additions and deletions in this commit:
+   \`\`\`bash
+   # Diff staged tree against the current branch tip.
+   # Outputs lines like:  M\\tpath/to/file   or   D\\tpath/to/file
+   git diff --cached --name-status "$BRANCH_TIP_SHA" |
+     python3 -c '
+   import json, sys, base64
+   adds, dels = [], []
+   for line in sys.stdin:
+       status, _, path = line.strip().partition("\\t")
+       if status in ("A", "M", "T"):
+           with open(path, "rb") as f:
+               adds.append({"path": path, "contents": base64.b64encode(f.read()).decode()})
+       elif status == "D":
+           dels.append({"path": path})
+       elif status.startswith("R"):
+           old, new = path.split("\\t", 1)
+           dels.append({"path": old})
+           with open(new, "rb") as f:
+               adds.append({"path": new, "contents": base64.b64encode(f.read()).decode()})
+   json.dump({"additions": adds, "deletions": dels}, sys.stdout)
+   ' > /tmp/file_changes.json
+   \`\`\`
+4. Issue the signed-commit mutation:
+   \`\`\`bash
+   COMMIT_MESSAGE_HEADLINE="fix: resolve login redirect loop"
+   COMMIT_MESSAGE_BODY=$(cat <<'EOF'
+   Generated-By: PostHog Code
+   Task-Id: ${taskId}
+   EOF
+   )
+   gh api graphql -F repo="$GITHUB_REPOSITORY" -F branch="$BRANCH_NAME" \\
+     -F oid="$BRANCH_TIP_SHA" -F headline="$COMMIT_MESSAGE_HEADLINE" \\
+     -F body="$COMMIT_MESSAGE_BODY" -F changes=@/tmp/file_changes.json \\
+     -f query='
+       mutation($repo:String!,$branch:String!,$oid:GitObjectID!,$headline:String!,$body:String!,$changes:FileChanges!){
+         createCommitOnBranch(input:{
+           branch:{repositoryNameWithOwner:$repo, branchName:$branch}
+           expectedHeadOid:$oid
+           message:{headline:$headline, body:$body}
+           fileChanges:$changes
+         }){ commit { oid url } }
+       }'
+   \`\`\`
+5. After the mutation returns, run \`git fetch origin "$BRANCH_NAME"\` and
+   \`git reset --hard "origin/$BRANCH_NAME"\` so the local checkout matches the
+   newly created remote commit. The next commit's parent SHA is the \`oid\`
+   returned by the mutation (or re-read with \`git rev-parse HEAD\` after fetch).
+
+Notes:
+- The branch must already exist on the remote. To create a new branch, push an
+  empty ref first: \`git push origin "$BASE_SHA:refs/heads/$BRANCH_NAME"\`
+  where \`$BASE_SHA\` is the base-branch tip.
+- Every commit you create through this flow will be marked "Verified" on GitHub
+  and authored by the GitHub App associated with the token. Do not attempt to
+  override the author identity.
+- Do NOT add \`Co-Authored-By\` trailers or \`Generated with [Claude Code]\` lines.
+  Use only the \`Generated-By: PostHog Code\` and \`Task-Id: ${taskId}\` trailers
+  shown above.`;
 
     if (prUrl) {
       if (!shouldAutoCreatePr) {
@@ -1620,7 +1676,7 @@ Do the requested work, but stop with local changes ready for review.
 Important:
 - Do NOT create new commits, push to the branch, or update the pull request unless the user explicitly asks.
 - Do NOT create a new branch or a new pull request.
-${attributionInstructions}
+${signedCommitInstructions}
 `;
       }
 
@@ -1631,12 +1687,16 @@ This task already has an open pull request: ${prUrl}
 
 After completing the requested changes:
 1. Check out the existing PR branch with \`gh pr checkout ${prUrl}\`
-2. Stage and commit all changes with a clear commit message
-3. Push to the existing PR branch
+2. Stage your changes with \`git add\` (do NOT run \`git commit\`)
+3. Create signed commits on the existing PR branch using the GitHub GraphQL
+   flow described below. The branch already exists, so skip the "create branch"
+   step — use the current PR branch tip as the first \`oid\`.
 
 Important:
 - Do NOT create a new branch or a new pull request.
-${attributionInstructions}
+- Do NOT use \`git commit\` or \`git push\`; commits must be created via
+  \`createCommitOnBranch\` so they are signed.
+${signedCommitInstructions}
 `;
     }
 
@@ -1651,8 +1711,12 @@ When the user asks for code changes:
 When the user explicitly asks to clone or work in a GitHub repository:
 - Clone the repository into /tmp/workspace/repos/<owner>/<repo> using \`gh repo clone <owner>/<repo> /tmp/workspace/repos/<owner>/<repo>\`
 - Work from inside that cloned repository for follow-up code changes
-- If the user explicitly asks you to open or update a pull request, create a branch, commit the requested changes, push it, and open a draft pull request from inside the clone
-- Do NOT create branches, commits, push changes, or open pull requests unless the user explicitly asks for that`;
+- If the user explicitly asks you to open or update a pull request, create a
+  branch (by pushing an empty ref), then create signed commits on it via
+  \`createCommitOnBranch\` (see below), and open a draft pull request
+- Do NOT create branches, commits, push changes, or open pull requests unless the user explicitly asks for that
+- Do NOT use \`git commit\` or \`git push\` for commit creation; commits must be
+  created via the GitHub GraphQL API so they are signed`;
 
       return `
 # Cloud Task Execution — No Repository Mode
@@ -1671,7 +1735,7 @@ ${publishInstructions}
 
 Important:
 - Prefer using MCP tools to answer questions with real data over giving generic advice.
-${attributionInstructions}
+${signedCommitInstructions}
 `;
     }
 
@@ -1683,26 +1747,35 @@ Do the requested work, but stop with local changes ready for review.
 
 Important:
 - Do NOT create a branch, commit, push, or open a pull request unless the user explicitly asks.
-${attributionInstructions}
+${signedCommitInstructions}
 `;
     }
 
     return `
 # Cloud Task Execution
 
 After completing the requested changes:
-1. Create a new branch prefixed with \`posthog-code/\` (e.g. \`posthog-code/fix-login-redirect\`) based on the work done
-2. Stage and commit all changes with a clear commit message
-3. Push the branch to origin
-4. Create a draft pull request using \`gh pr create --draft${this.config.baseBranch ? ` --base ${this.config.baseBranch}` : ""}\` with a descriptive title and body. Add the following footer at the end of the PR description:
+1. Pick a branch name prefixed with \`posthog-code/\` (e.g. \`posthog-code/fix-login-redirect\`)
+2. Create the branch on the remote by pushing an empty ref:
+   \`\`\`bash
+   BASE_SHA=$(git rev-parse HEAD)
+   git push origin "$BASE_SHA:refs/heads/posthog-code/<your-branch>"
+   \`\`\`
+3. Stage your changes with \`git add\` (do NOT run \`git commit\`)
+4. Create signed commits on the new branch using the GitHub GraphQL flow
+   described below. Use \`$BASE_SHA\` as the first commit's \`oid\`.
+5. Create a draft pull request using \`gh pr create --draft${this.config.baseBranch ? ` --base ${this.config.baseBranch}` : ""}\` with a descriptive title and body. Add the following footer at the end of the PR description:
 \`\`\`
 ---
 *Created with [PostHog Code](https://posthog.com/code?ref=pr)*
 \`\`\`
 
 Important:
 - Always create the PR as a draft. Do not ask for confirmation.
-${attributionInstructions}
+- Do NOT use \`git commit\` or \`git push <branch>\` for commit creation; commits
+  must be created via \`createCommitOnBranch\` so they are signed. The only
+  \`git push\` allowed is the empty-ref push in step 2 to create the branch.
+${signedCommitInstructions}
 `;
   }