feat(browser): Hedge Browser — embedded browser panel with tab management, error page, and welcome page

[ricardo-leiva]

Problem

Opening external links from the agent chat (docs, PRs, tickets) breaks your flow — you leave the app, lose context, and come back cold.

PostHog Code has no built-in way to view web content without switching to a full browser.

Changes

Embedded browser panel (Hedge Browser)

A fully functional browser panel that lives inside the workspace layout, side-by-side with the terminal, editor, and agent output.

Screen recording here: https://drive.google.com/file/d/1c-kbk0HQsL40J4YHela_DT2hyGuGVr6l/view?usp=drive_link

Core:

• BrowserService (Electron main) — manages WebContentsView lifecycle: create, navigate, split-without-reload, close, title/favicon streaming via tRPC subscription
• BrowserToolbar — address bar with back/forward/reload, loading spinner, favicon
• BrowserPanel — wires toolbar to service; handles window.open intercept so popups open as new tabs instead of leaving the app
• Tab management — browser tabs live in the same panelLayoutStore alongside file/shell/log tabs; split panel keeps each view independent

Welcome page (new tab):

• Custom data:text/html page shown when no URL is provided — hoglet mascot, "Hedge Browser" title, tagline
• Styled to match the error page (160 px hoglet, same font weights, drop-shadow)

Error page (failed loads):

• Branded error page injected on did-fail-load — hoglet, message, URL display, Go Back / Try Again buttons, "POWERED BY POSTHOG CODE" badge

Chat link integration:

• useOpenUrl — HTTP(S) links clicked inside agent messages open in the embedded browser instead of the system browser
• AgentMessage — tracks BROWSER_TAB_OPENED with source: "chat_link"
• PanelLayout — tracks with source: "user" (toolbar + button)
• BrowserPanel — tracks with source: "window_open" (popup intercept)

Right-click context menu:

• Native context menu on browser panel with Back, Forward, Reload, Copy URL, Open in Browser, Inspect (DevTools)
• showLinkContextMenu tRPC procedure; context-menu core package for typed menu schemas

Architecture notes:

• biome.jsonc allows @posthog/host-router/react in @posthog/ui for TabbedPanel — pre-existing pattern from 4fbb2cec7, noted as tech debt
• Default URL in addBrowserTab (core) stays "about:blank"; BrowserService.create() intercepts the sentinel and swaps in the welcome page URL — keeps core free of host-specific content

Screenshots

How did you test this?

• Full manual session: opened browser tabs from chat links, address bar, + button; navigated, split panels, closed tabs, triggered error page, right-clicked context menu, opened DevTools
• Unit tests: errorPage.test.ts, eventSubscription.test.ts, context-menu.test.ts, panelLayoutStore.test.ts, copyContextMenu.integration.test.tsx
• pnpm typecheck — clean
• pnpm lint — clean
• pnpm test — 768/768 passing

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[greptile-apps]

Prompt To Fix All With AI

Fix the following 3 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 3
packages/ui/src/features/browser/BrowserPanel.tsx:165-174
**Global `onOpenUrl` subscription fires in every mounted BrowserPanel**

`trpc.browser.onOpenUrl` has no per-browser filter — the router subscribes a new listener to `BrowserService.on("openUrl", …)` for each active subscription. When any page calls `window.open()`, the service emits one event and every active subscriber (one per mounted `BrowserPanel`) calls `addBrowserTab`. With N browser tabs open, a single `window.open()` creates N new tabs across all panels.

Fix: either carry a `browserId` on the `BrowserOpenUrlEvent` and filter it inside `BrowserPanel` (so only the source browser opens a new tab), or lift the subscription out to a single site such as `PanelLayout` where it can be handled exactly once.

### Issue 2 of 3
packages/core/src/panels/panelLayoutTransforms.ts:712
`Date.now()` for browser ID generation can produce duplicate IDs when two tabs are opened within the same millisecond. `BrowserService.create` silently no-ops on a duplicate ID, so one tab ends up with no backing native view. A short random suffix removes the collision risk.

```suggestion
  const browserId = `browser-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
```

### Issue 3 of 3
apps/code/src/main/services/browser/service.ts:252-258
`navigate` doesn't apply the same `about:blank` → welcome-page redirect that `create` does. If the user types `about:blank` in the address bar and presses Enter, the browser navigates to a truly blank page instead of showing the Hedge Browser welcome screen.

```suggestion
  navigate(browserId: string, url: string): void {
    const entry = this.browsers.get(browserId);
    if (!entry) return;
    const effectiveUrl =
      !url || url === "about:blank" ? buildNewTabPage() : url;
    entry.view.webContents.loadURL(effectiveUrl).catch((err) => {
      log.warn("Failed to navigate", effectiveUrl, err);
    });
  }
```

_{Reviews (1): Last reviewed commit: "fix(browser): match new-tab page visual ..." | Re-trigger Greptile}