feat(server): count which product features people use

[juliusmarminge]

Today analytics only counts connections, threads and turns. We can't tell which product features are used, such as checkpoint restore, fork, provider switch, the terminal, the preview browser, worktrees, git and PR actions, or scheduled tasks.

This adds one anonymous PostHog event, feature.used { feature, variant?, surface? }. It's recorded from the RPC authorization middleware, which every WebSocket request already passes through, after the request succeeds (for a stream RPC, when the stream completes). No handler changes. RpcAuthorization.layer gains an optional onAuthorized callback, and ws.ts passes one that maps the request through FeatureUsage.ts.

FeatureUsage.ts is an allowlist:

• User commands via dispatchCommand: checkpoint.rollback (with_files / conversation_only), thread.fork, thread.merge_back, provider.switch, archive, snooze, pin, settle, PR link and watch, runtime and interaction mode changes (mode as variant), interrupt, queue steer and edit. message.dispatch is left out because client.turn.requested already counts it. Housekeeping commands such as visits and reorders are left out too.
• RPCs: thread.launch (workspace strategy as variant), terminal, preview and device open, editor.open (editor id), worktree create, git.stacked_action (action), pull_request.action (action), PR review and comment, scheduled task save and run-now, agent session import, project clone, repository publish, keybinding customize.

Anonymity: variants come only from closed contract enums. No paths, ids, titles, prompts or free text, and the only client dimension is surface. Hot paths such as terminal.write don't map to a feature and return right away. T3CODE_TELEMETRY_ENABLED=false still disables everything.

Tests: FeatureUsage.test.ts checks the mapping, including that paths, prompts and ids never appear. RpcAuthorization.test.ts checks that only authorized, successful requests are reported. The existing ws tests pass.

Companion to #15913, which covers the agent side (MCP tools and delegation). The two branches are independent.

Done by Claude Opus 5.5 in Claude Code (via T3 Code).

🤖 Generated with Claude Code

---

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This PR adds a new telemetry capability across existing WebSocket RPCs by extending shared authorization middleware, creating a broad runtime and data-collection side effect. Because it also changes the server auth package, the cross-cutting behavior warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	4.9 KiB	−23 B (−0.5%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−23 B (−1.9%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.8 KiB	−41 B (−0.2%)	29.3 KiB	✅
Codex	Live turn messages	2	1	−1 (−50.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	+7 B (+0.1%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	+7 B (+0.6%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: cab362d · PR result: f0a7db7 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: pingdotgg/t3code/.coderabbit.yaml
• Review profile: CHILL
• Plan: Team
• Run ID: 054b8ec9-b74a-4fe9-9c7b-c1d3e4a3e33c

📥 Commits

Reviewing files that changed from the base of the PR and between 06e6274 and b171752.

📒 Files selected for processing (6)

• apps/server/src/auth/RpcAuthorization.test.ts
• apps/server/src/auth/RpcAuthorization.ts
• apps/server/src/telemetry/FeatureUsage.test.ts
• apps/server/src/telemetry/FeatureUsage.ts
• apps/server/src/ws.ts
• docs/internals/product-analytics.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.

📝 Walkthrough

The server classifies selected WebSocket RPC requests as feature usage. After an authorized request succeeds, the server records classified usage with the connecting client’s surface when available. Tests cover classification and callback behavior.

Changes: Feature Usage Analytics

Layer / File(s)	Summary
Feature classification apps/server/src/telemetry/FeatureUsage.ts, apps/server/src/telemetry/FeatureUsage.test.ts	Adds mappings for selected commands and RPCs. Variants use selected string values, and untracked requests return undefined. Tests cover tracked features, variants, and excluded payloads.
Post-success authorization callback apps/server/src/auth/RpcAuthorization.ts, apps/server/src/auth/RpcAuthorization.test.ts	Adds an optional callback that receives the method and payload after an authorized request succeeds. Tests confirm that a request rejected for insufficient scope is not recorded.
WebSocket analytics recording apps/server/src/ws.ts, docs/internals/product-analytics.md	Connects the callback to feature classification and feature.used recording. Documents when usage is recorded and which data is included.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant WebSocketRpcRoute
  participant rpcScopeAuthorizationLayer
  participant featureUsage
  participant FeatureUsedRecorder
  WebSocketRpcRoute->>rpcScopeAuthorizationLayer: Pass RPC method and payload
  rpcScopeAuthorizationLayer->>rpcScopeAuthorizationLayer: Authorize and run request
  rpcScopeAuthorizationLayer->>featureUsage: Classify successful request
  featureUsage-->>rpcScopeAuthorizationLayer: Return feature data or undefined
  rpcScopeAuthorizationLayer->>FeatureUsedRecorder: Record feature.used when classified

Loading

Suggested reviewers: t3dotgg

Merge Risk: ⚪ Minimal · up to b1717

No actionable issue is established for this change. Stream completion timing remains unverified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description clearly explains the problem, implementation, scope, privacy limits, and verification. It does not include the required scope and approval information, such as a triaged issue or expli…	Add a link to the triaged issue or approval discussion with the explicit maintainer approval comment. If no prior approval is required, explain why this focused change qualifies for an exemption. Add the focused test commands and their obse…

Passed checks: 4 passed

Check name	Status	Explanation
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 5 files. (1 skipped: 1 …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes the main change: adding server-side product feature usage counting.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 5 files. (1 skipped: 1 unsupported.)

Full details: Description check

Explanation

The description clearly explains the problem, implementation, scope, privacy limits, and verification. It does not include the required scope and approval information, such as a triaged issue or explicit maintainer approval, and it does not provide focused test commands with observed results.

Resolution

Add a link to the triaged issue or approval discussion with the explicit maintainer approval comment. If no prior approval is required, explain why this focused change qualifies for an exemption. Add the focused test commands and their observed results, and state any checks that were not run.

• Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}