fix(web): declare posthog-js as direct dep, surface build env to turbo

[ohong]

Summary

Production has been broken since afff896 ("feat: add PostHog web analytics...") with Turbopack error:

./apps/web/components/providers/PostHogProvider.tsx:4:1
Module not found: Can't resolve 'posthog-js'
./apps/web/components/providers/PostHogProvider.tsx:5:1
Module not found: Can't resolve 'posthog-js/react'

• posthog-js is imported directly in PostHogProvider.tsx but only installed transitively via @posthog/next. Turbopack rejects phantom deps — add it explicitly, pinned to 1.359.1 to match @posthog/next@0.1.0's peer.
• turbo.json was missing 7 server-only env vars (CLERK_SECRET_KEY, CLI_JWT_SECRET, ANTHROPIC_API_KEY, RESEND_API_KEY, RESEND_FROM_EMAIL, UNSUBSCRIBE_SECRET, ADMIN_USER_IDS); turbo strips them from the build env and emits a [warn] block on every Vercel build.

Last green prod deploy: 9ca6b45. After this merges, prod should go green again.

Test plan

• bun run build at repo root passes locally with placeholder env vars
• Vercel preview build green
• Production redeploy on main green

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Fixed row-level security issue preventing company suggestion inserts
  • Hardened direct message attachment access controls

• New Features

  • Added admin analytics function for tracking model usage by day

• Chores

  • Updated analytics integration dependencies
  • Optimized database queries and function definitions
  • Enhanced build configuration with additional environment variables

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 62d6029f-07eb-4d60-8745-4ec91d3dec81

📥 Commits

Reviewing files that changed from the base of the PR and between 0665ef6 and 5144d24.

⛔ Files ignored due to path filters (2)

• bun.lock is excluded by !**/*.lock
• supabase/.temp/cli-latest is excluded by !**/.temp/**

📒 Files selected for processing (15)

• apps/web/package.json
• docs/CHANGELOG.md
• supabase/migrations/20260301000000_get_following_feed.sql
• supabase/migrations/20260306150625_create_bao_schema.sql
• supabase/migrations/20260310065245_add_dm_attachments.sql
• supabase/migrations/20260401194500_create_open_stats_snapshots.sql
• supabase/migrations/20260403073000_add_get_user_usage_totals_rpc.sql
• supabase/migrations/20260403110000_harden_get_feed_rpc_auth.sql
• supabase/migrations/20260403120001_harden_dm_attachment_storage.sql
• supabase/migrations/20260404190147_usage_totals_total_tokens.sql
• supabase/migrations/20260406074500_fix_get_user_usage_totals_output_tokens.sql
• supabase/migrations/20260408200001_admin_model_share_by_day.sql
• supabase/migrations/20260408232117_admin_model_share_exclude_retro_syncs.sql
• supabase/migrations/20260416120000_fix_company_suggestions_rls.sql
• turbo.json

---

📝 Walkthrough

Walkthrough

Multiple Supabase migrations addressing RLS policies, authentication logic, and admin functionality; PostHog telemetry dependency addition to web app; and build environment configuration expansion to expose additional secrets.

Changes

Cohort / File(s)	Summary
PostHog Telemetry apps/web/package.json	Adds posthog-js package dependency for client-side event tracking alongside existing @posthog/next integration.
Documentation docs/CHANGELOG.md	Documents production fix for /token-rich company-suggestion inserts: recreates missing INSERT RLS policy and adds SELECT policy for authenticated user access.
RLS & Storage Security supabase/migrations/20260310065245_add_dm_attachments.sql, supabase/migrations/20260416120000_fix_company_suggestions_rls.sql, supabase/migrations/20260403120001_harden_dm_attachment_storage.sql	Hardens storage bucket access and row-level security: makes dm-attachments public initially then reverts to private with tighter participant-based policies; enables RLS and creates insert/select policies for company_suggestions table restricted to authenticated user ownership.
Feed & User Handler Logic supabase/migrations/20260301000000_get_following_feed.sql, supabase/migrations/20260306150625_create_bao_schema.sql	Removes authentication enforcement from get_following_feed() and simplifies control flow; removes user table insertion from handle_new_user() trigger to only populate profiles table.
Usage Analytics & Admin Functions supabase/migrations/20260408232117_admin_model_share_exclude_retro_syncs.sql, supabase/migrations/20260408200001_admin_model_share_by_day.sql, supabase/migrations/20260406074500_fix_get_user_usage_totals_output_tokens.sql, supabase/migrations/20260403073000_add_get_user_usage_totals_rpc.sql, supabase/migrations/20260404190147_usage_totals_total_tokens.sql	Introduces new admin_model_share_by_day() SECURITY DEFINER function for per-day model spend aggregation with retroactive sync exclusions; removes user join from existing admin function; maintains output-token semantics in usage totals function.
Formatting Cleanup supabase/migrations/20260401194500_create_open_stats_snapshots.sql, supabase/migrations/20260403110000_harden_get_feed_rpc_auth.sql	Removes extraneous blank lines and comments with no functional impact.
Build Configuration turbo.json	Expands build task environment variables to include CLERK_SECRET_KEY, CLI_JWT_SECRET, ANTHROPIC_API_KEY, RESEND_API_KEY, RESEND_FROM_EMAIL, UNSUBSCRIBE_SECRET, and ADMIN_USER_IDS alongside existing NEXT_PUBLIC_POSTHOG_KEY.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Possibly related PRs

• fix(web): restore output-token semantics for all-time totals #78: Modifies the same get_user_usage_totals migration to maintain output-token compatibility semantics.
• fix(security): lock down dm attachment storage reads #63: Implements the actual privacy and policy changes for dm-attachments storage hardening referenced in this PR.

Suggested labels

aardvark, codex

Poem

🐰 PostHog hops in, migrations leap and bound,
RLS guards the garden, keeping secrets sound,
Admin functions bloom with daily spend so bright,
While feeds lose their guards and soar in open flight.
Thump-thump-thump! ✨

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch oh-fix-posthog-js-dep

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}