feat: add first-party Tinybird analytics by richiemcilroy · Pull Request #2003 · CapSoftware/Cap

richiemcilroy · 2026-07-12T15:55:38Z

Summary

Add a strict, bounded first-party product analytics path for web, desktop, and mobile checkout attribution.
Replace PostHog completely with Tinybird-backed ingestion for signup, checkout, paid purchase, trial, organization expansion, and core recording events.
Remove PostHog clients, dependencies, bootstrap and feature-flag plumbing, environment variables, and CI/release secrets.
Add Tinybird Docker infrastructure, safe CI deployment, retry-safe aggregates, and read-only agent queries.

Validation

pnpm analytics:test — 152 tests passed
pnpm --filter @cap/web test --run __tests__/unit/mobile-checkout.test.ts — 7 tests passed
pnpm typecheck
cargo fmt --all
cargo check -p cap-desktop with the repository FFmpeg 7 toolchain
cargo test -p cap-desktop product_analytics --lib — 9 tests passed
Scoped Biome checks, diff checks, and a repository-wide PostHog residue scan passed

Greptile Summary

This PR adds first-party Tinybird product analytics across web, desktop, and deployment tooling. The main changes are:

New /api/events ingestion path for bounded client analytics.
Product event normalization and shared event taxonomy.
Web and desktop instrumentation for signup, checkout, purchases, trials, organizations, and recording events.
Tinybird local, test, query, and deployment tooling.
CI workflow for validating and deploying analytics resources.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.
The previously risky analytics ingestion paths now have concrete request, token, actor, and event-shape checks.
The Tinybird deploy path now verifies the active workspace id before running deploy commands.

Important Files Changed

Filename	Overview
apps/web/lib/analytics/request.ts	Adds request validation, anonymous browser event allowlisting, server-only event rejection, and rate-limit key handling for product analytics ingestion.
apps/web/app/api/events/route.ts	Adds the product analytics capture route with browser-token, actor, rate-limit, normalization, and append checks.
scripts/analytics/tooling.js	Adds Tinybird project validation, local tooling, cloud deploy plans, and exact workspace identity verification before deployment.
.github/workflows/analytics.yml	Adds CI validation and guarded production deployment for Tinybird analytics resources.
packages/analytics/src/index.ts	Defines shared product analytics limits, event names, normalization, and row creation behavior.

_{Reviews (9): Last reviewed commit: "fix: parse Tinybird workspace identity" | Re-trigger Greptile}

Context used:

Context used - CLAUDE.md (source)
Context used - AGENTS.md (source)

superagent-security

Superagent found 1 security concern(s).

richiemcilroy · 2026-07-12T16:09:47Z

hey @greptileai, please re-review the PR

richiemcilroy · 2026-07-12T16:13:33Z

hey @greptileai, please re-review the PR

richiemcilroy · 2026-07-12T16:17:12Z

hey @greptileai, please re-review the PR

richiemcilroy · 2026-07-12T16:18:28Z

hey @greptileai, please re-review the PR

richiemcilroy · 2026-07-12T16:28:21Z

hey @greptileai, please re-review the PR

richiemcilroy · 2026-07-12T16:31:59Z

hey @greptileai, please re-review the PR

superagent-security

Superagent found 1 security concern(s).

richiemcilroy · 2026-07-12T16:39:16Z

hey @greptileai, please re-review the PR

tembo · 2026-07-12T22:45:16Z

+						const browserClaims =
+							hasExpectedBrowserAnalyticsMetadata(
+								requestMetadata,
+								allowedOrigins,
+							) &&
+							readProductAnalyticsBrowserTokenClaims(
+								readProductAnalyticsBrowserToken(headers.cookie),
+								serverEnv().NEXTAUTH_SECRET,
+							);


Minor robustness nit: if token claim parsing throws (bad secret, malformed cookie, etc) this will currently 500. I'd rather treat that as “no browser claims” and let it fall through to the normal BadRequest path.

Suggested change

const browserClaims =

hasExpectedBrowserAnalyticsMetadata(

requestMetadata,

allowedOrigins,

) &&

readProductAnalyticsBrowserTokenClaims(

readProductAnalyticsBrowserToken(headers.cookie),

serverEnv().NEXTAUTH_SECRET,

);

let browserClaims;

if (

hasExpectedBrowserAnalyticsMetadata(

requestMetadata,

allowedOrigins,

)

) {

try {

browserClaims = readProductAnalyticsBrowserTokenClaims(

readProductAnalyticsBrowserToken(headers.cookie),

serverEnv().NEXTAUTH_SECRET,

);

} catch {

browserClaims = undefined;

}

}

tembo · 2026-07-12T22:45:22Z

+	if (result.error || result.status !== 0) {
+		throw new Error("Unable to verify Tinybird workspace identity.");
+	}


This failure path drops the actual stderr/stdout, which makes CI deploy debugging pretty painful. I’d include stderr (trimmed) in the thrown error message.

Suggested change

if (result.error || result.status !== 0) {

throw new Error("Unable to verify Tinybird workspace identity.");

}

if (result.error || result.status !== 0) {

const stderr = (result.stderr ?? "").toString().trim();

throw new Error(

stderr

? `Unable to verify Tinybird workspace identity: ${stderr}`

: "Unable to verify Tinybird workspace identity.",

);

}

tembo · 2026-07-12T22:53:13Z

+			{
+				eventId,
+				eventName: event.eventName,
+				occurredAt: event.occurredAt ?? new Date().toISOString(),


Small robustness thing: occurredAt is passed through as-is, so a bad caller value will land as a bad timestamp in Tinybird. Might be worth normalizing/validating and falling back to now.

Suggested change

occurredAt: event.occurredAt ?? new Date().toISOString(),

occurredAt:

event.occurredAt && Number.isFinite(Date.parse(event.occurredAt))

? new Date(event.occurredAt).toISOString()

: new Date().toISOString(),

tembo · 2026-07-12T22:53:18Z

+			const client = new PostHog(key, { host });
+			client.capture({
+				distinctId: event.distinctId,
+				event: event.eventName,
+				properties: event.properties,
+			});
+			await client.shutdown();


Minor cleanup: if client.capture throws, shutdown() won’t run. I’d wrap shutdown in a finally.

Suggested change

const client = new PostHog(key, { host });

client.capture({

distinctId: event.distinctId,

event: event.eventName,

properties: event.properties,

});

await client.shutdown();

const client = new PostHog(key, { host });

try {

client.capture({

distinctId: event.distinctId,

event: event.eventName,

properties: event.properties,

});

} finally {

await client.shutdown();

}

…lytics # Conflicts: # apps/web/app/api/desktop/[...route]/root.ts # apps/web/app/api/settings/billing/guest-checkout/route.ts # apps/web/app/api/webhooks/stripe/route.ts

cursor · 2026-07-24T20:14:02Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

richiemcilroy · 2026-07-24T20:16:13Z

hey @greptileai, please re-review the PR

richiemcilroy · 2026-07-24T20:18:58Z

hey @greptileai, please re-review the PR

tembo · 2026-07-24T20:21:55Z

+						subscription,
+						inviteQuota,
+						user: dbUser,
+						isFirstPurchase:


Minor robustness thing: isFirstPurchase coming from session.metadata is easy to lose / skew if metadata changes, and it’s already derivable from the pre-update user row.

Suggested change

isFirstPurchase:

isFirstPurchase: !dbUser.stripeSubscriptionId,

tembo · 2026-07-24T20:22:06Z

+							subscription,
+							inviteQuota,
+							...(dbUser ? { user: dbUser } : {}),
+							isFirstPurchase:


Same idea here: if dbUser is present, it’s a better source of truth than checkout-session metadata.

Suggested change

isFirstPurchase:

isFirstPurchase: dbUser

? !dbUser.stripeSubscriptionId

: session.metadata?.analyticsIsFirstPurchase === "true",

tembo · 2026-07-24T20:23:35Z

+	#recordDrop(count: number) {
+		if (count === 0) return;
+		this.#dropped += count;
+		this.#onDrop?.(this.#dropped);


onDrop takes a count, but this passes the running total. If you want the incremental drop count, pass count here and let callers read queue.dropped for the total.

Suggested change

this.#onDrop?.(this.#dropped);

this.#onDrop?.(count);

tembo · 2026-07-24T20:23:40Z

+};
+
+const encodeLocalToken = (userId, tokenId) => {
+	const payload = `{"u": "${userId}", "id": "${tokenId}", "host": null}`;


Small robustness/readability thing: since this is JSON anyway, using JSON.stringify avoids having to worry about escaping/quoting in the template literal.

Suggested change

const payload = `{"u": "${userId}", "id": "${tokenId}", "host": null}`;

const payload = JSON.stringify({ u: userId, id: tokenId, host: null });

richiemcilroy added 4 commits July 12, 2026 18:54

feat: add shared product analytics contract

c87f74e

feat: add first-party web analytics

ca35887

feat: add first-party desktop analytics

2e481d6

feat: add Tinybird analytics infrastructure

a2b4a01

richiemcilroy marked this pull request as ready for review July 12, 2026 15:56

github-advanced-security AI found potential problems Jul 12, 2026

View reviewed changes

Comment thread apps/web/app/utils/product-analytics.ts Fixed

Comment thread scripts/analytics/tooling.js Fixed

Comment thread scripts/analytics/tooling.js Fixed

greptile-apps Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread apps/web/lib/analytics/request.ts Outdated

Comment thread apps/web/lib/analytics/request.ts

Comment thread scripts/analytics/tooling.js

superagent-security Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread .github/workflows/analytics.yml Outdated

superagent-security Bot added the pr:flagged PR flagged for review by security analysis. label Jul 12, 2026

tembo Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread apps/web/lib/analytics/request.ts Outdated

Comment thread scripts/analytics/tooling.js Outdated

richiemcilroy added 2 commits July 12, 2026 19:08

fix: secure product analytics ingestion

9d7b695

fix: harden analytics deployment tooling

557abd1

superagent-security Bot removed the pr:flagged PR flagged for review by security analysis. label Jul 12, 2026

greptile-apps Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread apps/web/lib/analytics/request.ts Outdated

richiemcilroy added 2 commits July 12, 2026 19:13

fix: require trusted analytics origins

5540c9e

fix: mount Tinybird CLI config safely

ac73bd8

tembo Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread apps/web/lib/analytics/request.ts

greptile-apps Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread apps/web/lib/analytics/request.ts

fix: require browser fetch metadata

ce87b26

fix: give Tinybird resources unique names

6355ec7

superagent-security Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread apps/web/lib/analytics/request.ts Outdated

superagent-security Bot added the pr:flagged PR flagged for review by security analysis. label Jul 12, 2026

greptile-apps Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread apps/web/lib/analytics/request.ts

greptile-apps Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread apps/web/lib/analytics/request.ts

superagent-security Bot removed the pr:flagged PR flagged for review by security analysis. label Jul 12, 2026

fix: sign anonymous analytics requests

e08bc0a

fix: type analytics health parameters

9fa6e12

tembo Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread apps/web/lib/analytics/request.ts Outdated

greptile-apps Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread scripts/analytics/tooling.js Outdated

fix: align analytics health fixture

dc25da4

tembo Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread apps/web/lib/analytics/request.ts Outdated

Comment thread scripts/analytics/tooling.js

greptile-apps Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread apps/web/app/api/events/route.ts

Comment thread scripts/analytics/tooling.js Outdated

tembo Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread scripts/analytics/tooling.js Outdated

superagent-security Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread scripts/analytics/tooling.js Outdated

superagent-security Bot added the pr:flagged PR flagged for review by security analysis. label Jul 12, 2026

richiemcilroy added 2 commits July 12, 2026 19:38

fix: contain anonymous analytics ingestion

552b9e0

fix: parse Tinybird workspace identity

fee7c3a

superagent-security Bot removed the pr:flagged PR flagged for review by security analysis. label Jul 12, 2026

tembo Bot reviewed Jul 12, 2026

View reviewed changes

richiemcilroy force-pushed the codex/first-party-analytics branch from a9b199c to fee7c3a Compare July 12, 2026 22:48

tembo Bot reviewed Jul 12, 2026

View reviewed changes

richiemcilroy added 2 commits July 24, 2026 21:09

Merge remote-tracking branch 'origin/main' into codex/first-party-ana…

8c94da0

…lytics # Conflicts: # apps/web/app/api/desktop/[...route]/root.ts # apps/web/app/api/settings/billing/guest-checkout/route.ts # apps/web/app/api/webhooks/stripe/route.ts

refactor: remove PostHog analytics

bd2039a

vercel Bot deployed to Preview July 24, 2026 20:16 View deployment

fix: restore devtools effect import

bd28a25

superagent-security Bot added the pr:flagged PR flagged for review by security analysis. label Jul 24, 2026

vercel Bot deployed to Preview July 24, 2026 20:21 View deployment

tembo Bot reviewed Jul 24, 2026

View reviewed changes

superagent-security Bot removed the pr:flagged PR flagged for review by security analysis. label Jul 24, 2026

tembo Bot reviewed Jul 24, 2026

View reviewed changes

-				occurredAt: event.occurredAt ?? new Date().toISOString(),
+					occurredAt:
+						event.occurredAt && Number.isFinite(Date.parse(event.occurredAt))
+							? new Date(event.occurredAt).toISOString()
+							: new Date().toISOString(),

	isFirstPurchase:
	isFirstPurchase: !dbUser.stripeSubscriptionId,

-							isFirstPurchase:
+							isFirstPurchase: dbUser
+								? !dbUser.stripeSubscriptionId
+								: session.metadata?.analyticsIsFirstPurchase === "true",

	const payload = `{"u": "${userId}", "id": "${tokenId}", "host": null}`;
	const payload = JSON.stringify({ u: userId, id: tokenId, host: null });

Uh oh!

Conversation

richiemcilroy commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

superagent-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

richiemcilroy commented Jul 12, 2026

Uh oh!

Uh oh!

richiemcilroy commented Jul 12, 2026

Uh oh!

Uh oh!

Uh oh!

richiemcilroy commented Jul 12, 2026

Uh oh!

richiemcilroy commented Jul 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

richiemcilroy commented Jul 12, 2026

Uh oh!

Uh oh!

richiemcilroy commented Jul 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

superagent-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

richiemcilroy commented Jul 12, 2026

Uh oh!

tembo Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

tembo Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

tembo Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

tembo Bot Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot commented Jul 24, 2026

Uh oh!

richiemcilroy commented Jul 24, 2026

Uh oh!

richiemcilroy commented Jul 24, 2026

Uh oh!

tembo Bot Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

tembo Bot Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

tembo Bot Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

richiemcilroy commented Jul 12, 2026 •

edited

Loading