fix: skip telemetry on localhost and filter 0s ghost sessions

[emmanuelvulk]

Summary

Two related issues affecting session data quality:

1. SDK sends telemetry on localhost

init() starts heartbeats, error capture, and session replay regardless of hostname. When builders or agents run the app locally (localhost, 127.0.0.1), all telemetry hits the production API — polluting real session data with dev sessions.

Where: src/index.ts:111-174 — no hostname guard before startHeartbeat(), startErrorCapture(), startNetworkCapture(), startReplayModule().

Fix: Add a localhost check early in init():

const host = window.location.hostname;
const isLocal = host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
if (isLocal) {
  // Return a no-op instance — don't send any telemetry
  return { check, getGateUrl, stop: () => {}, identify: () => {} };
}

The isSandboxed() guard already skips replay in editor iframes — this is the same pattern for localhost.

2. Numerous "0s" sessions in builder dashboards

Maxime's build (paradigmeflow-lovable) shows many 0-second sessions. These are likely caused by:

• Local dev sessions that send a single chunk before the page closes
• Automated browser sessions (agents, CI, Lovable preview builds) that load the page briefly
• The idle timeout (4 min) assembling a session from a single chunk with no activity delta

These ghost sessions clutter the session list and make it harder to find real user sessions.

Fix options:

• SDK-side (preferred): the localhost guard above eliminates the dev source entirely
• API-side: filter out sessions with duration_ms < 1000 (or a configurable threshold) from the session list endpoint, or mark them as is_ghost: true
• UI-side: hide 0s sessions by default with a "Show all" toggle

Impact

Discovered while auditing paradigmeflow-lovable. The builder sees dozens of 0-second ghost sessions mixed with real client sessions, making the session replay feature unreliable for its intended purpose (watching real user behavior).