feat(gui): optional PostHog EU analytics (CHE-785)

[OnlineChef]

Summary

• Optional PostHog EU analytics for the OpenCodex GUI (VITE_POSTHOG_KEY / VITE_POSTHOG_HOST, default https://eu.i.posthog.com).
• No-op when the key is unset; no identify / no PII person profiles (person_profiles: identified_only).
• Manual $pageview on hashroute changes.

Parent: CHE-782 · Implements: CHE-785

Test plan

• bun install / lockfile resolves posthog-js in gui/
• Without VITE_POSTHOG_KEY, GUI loads and network has no PostHog requests
• With key + EU host, init succeeds; hash changes emit $pageview only
• Confirm no posthog.identify and no hardcoded project keys in source
• CI green on this PR

Made with Cursor

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

Greptile Summary

This PR adds optional PostHog EU analytics to the GUI. The main changes are:

• Environment variables for the project key and ingestion host.
• PostHog initialization with local persistence and anonymous profiles.
• Manual pageviews for initial loads and hash-route changes.
• The PostHog dependency and Vite environment types.

Confidence Score: 4/5

The analytics URL payload needs to be minimized before merging.

Analytics remains disabled when no key is configured. The dependency and client build surfaces are consistent with the GUI setup.

Enabled analytics can transmit sensitive query or hash values to PostHog.

T-Rex Logs

What T-Rex did

• T-Rex launched the Playwright harness to intercept PostHog traffic while analytics were enabled in the real Vite GUI, but the maximum steps limit was reached.
• The attempt rendered the Providers UI and intercepted PostHog configuration and feature-flag requests, but no pageview was observed because the initial capture occurred before PostHog loaded.
• The harness was adjusted to trigger a hash change after initialization, but the step limit prevented executing that final attempt.
• With analytics enabled, the trace recorded exactly two pageview calls: the initial #api and the later #codex-auth.
• With analytics disabled, the GUI produced no external PostHog requests and no PostHog local-storage entry, while the local PostHog source remains present due to static import.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
gui/src/posthog.ts	Adds optional analytics initialization and hash-route pageviews, but sends the complete browser URL.
gui/src/main.tsx	Initializes analytics before rendering the React application.
gui/package.json	Adds posthog-js as a runtime dependency.
gui/bun.lock	Locks posthog-js and its transitive dependencies.
gui/src/vite-env.d.ts	Declares the optional PostHog environment variables.
gui/.env.example	Documents optional PostHog configuration and the EU host default.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
gui/src/posthog.ts:42
**Full URL Leaks Sensitive Values**

When an analytics-enabled deployment receives a URL containing an auth code, invitation token, email address, or other sensitive query/hash value, `window.location.href` sends that value to PostHog as `$current_url`. `person_profiles: "identified_only"` does not sanitize event properties, so pageviews should instead report a minimized URL containing only the known hash route.

_{Reviews (1): Last reviewed commit: "feat(gui): add optional PostHog EU analy..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[linear-code]

CHE-785

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

Warning

Review limit reached

@OnlineChef, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 20 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a4b823af-7769-45c2-bdbb-47122ff5c0cc

📥 Commits

Reviewing files that changed from the base of the PR and between 6d6bef8 and 82cfac4.

⛔ Files ignored due to path filters (1)

• gui/bun.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• gui/.env.example
• gui/package.json
• gui/src/main.tsx
• gui/src/posthog.ts
• gui/src/vite-env.d.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch CHE-785-posthog-opencodex

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}