[jayleaton]

Problem

Ada still shipped code that could report to upstream (T3 Tools) or depend on upstream-controlled hosts. That included the server's PostHog analytics (ingest.t3.codes and an embedded key) with identity built from Codex and Claude logins, a per-device hash that clients sent for analytics, and pairing links that put the pairing token on app.t3.codes. It also fetched the model manifest live from pingdotgg/t3code, and the npm launcher downloaded upstream's binaries. Analytics being "off by default" left the sender, key and identity code in the binary.

Change

 server
-  telemetry/ (AnalyticsService → ingest.t3.codes → PostHog, Identify reads ~/.codex/auth.json id_token + ~/.claude.json account)
-  every analytics.record / recordOwners call (ws, startup heartbeat, MCP tools, provider turns, Codex sign-in, delegated tasks)
-  managed policy "telemetry" key   (old policy files still load: the retired key is dropped before the strict decode)
-  T3CODE_HOSTED_APP_URL default app.t3.codes   → opt-in only
~  ModelManifest  raw.githubusercontent.com/pingdotgg/t3code → jayleaton/ada
 clients (web, mobile, client-runtime)
-  AnalyticsDevice capability + clientDevice=<hash> on every socket URL (+ t3code:analytics-device-id in localStorage)
-  DEFAULT_HOSTED_APP_URL (packages/shared/hostedApp.ts): pairing links, thread copy links, prompt links, channel picker
     copy thread → t3-thread://v2/<env>/<thread>; pairing → direct server URL; prompt-link copy hidden unless a hosted app is configured
-  app.t3.codes OAuth return-origin allowlist, mobile Android App Links claim + linking prefix, native composer app.t3.codes check
-  expo-observe SDK (crash reporting; dispatch was off and its endpoint was observe.invalid)
 scripts / CI
~  npm launcher downloads + native-client dispatch → jayleaton/ada; EAS preview links → jayleaton account
-  @clerk/electron-passkeys bundler leftovers
+  check-removed-connect: also fails on banned deps (posthog, @sentry, expo-observe, @clerk) and on
   upstream hosts/keys in shipped source (phc_ keys, posthog.com, ingest.t3.codes, sentry.io, app.t3.codes,
   raw.githubusercontent.com/pingdotgg, pingdotgg release downloads); manifest lists the deleted paths

Docs: docs/user/telemetry.md now says Ada collects no usage data and keeps the OTLP export section. docs/internals/product-analytics.md is deleted. Docs that described app.t3.codes as the default are updated.

Audit

Destination	Where	What it sent	Owner	Action
ingest.t3.codes → PostHog, key phc_XOW…	apps/server/src/telemetry/*	usage events, hashed OpenAI and Claude account ids, device hashes, OS and version	upstream	Deleted
clientDevice=<sha256> socket param	client-runtime/authorization/remote.ts, web and mobile platform.ts	per-device id hash, sent to own server for analytics	upstream (via above)	Deleted
app.t3.codes (+ latest/nightly/preview)	shared/hostedApp.ts, hostedPairing.ts, threadLinks.ts, promptLinks.ts, hostedAppUrl.ts, McpOAuth.ts	pairing token in link fragment; loading upstream JS that connects to your server	upstream	Default removed; hosted app is opt-in via VITE_HOSTED_APP_URL / T3CODE_HOSTED_APP_URL
app.t3.codes OAuth return origin	shared/providerAuthReturnUrl.ts	Codex sign-in handoff	upstream	Removed
Android App Links app.t3.codes/threads	apps/mobile/app.config.ts, App.tsx	link claim	upstream	Removed (native config: needs a new native build)
raw.githubusercontent.com/pingdotgg/t3code/.../model-manifest.json	ModelManifest.ts	hourly GET; upstream controlled model/adapter content	upstream	→ jayleaton/ada
github.com/pingdotgg/t3code/releases/download	scripts/npm-launcher/t3.mjs	downloaded and ran upstream binaries	upstream	→ jayleaton/ada
gh workflow dispatch on pingdotgg/t3code	scripts/mobile-native-client.ts	dev build dispatch	upstream	→ jayleaton/ada
expo-observe	apps/mobile	crash/perf (disabled, observe.invalid)	Expo	Package and code deleted
EAS project 263247b1-…, owner jayleaton, u.expo.dev updates	apps/mobile/app.config.ts	update checks	JJ	Kept
Expo push, Tailscale	mobile, server	own notifications, connectivity	JJ / neutral	Kept
Desktop auto-update feed	build-desktop-artifact.ts	GitHub Releases of the building repo	JJ (jayleaton/ada)	Kept
OTLP export	server/desktop observability	only to a receiver you configure	user	Kept
$schema: https://t3.codes/schema/t3.json	contracts/t3ProjectFile.ts, t3.json	nothing at runtime; editors may fetch it	upstream	Kept (string only; listed)
Native composer t3-thread:// check	mobile modules	none	–	app.t3.codes check removed
AUR PKGBUILDs → pingdotgg releases	packaging/aur	–	upstream	Kept: fork never publishes AUR (workflow gated to pingdotgg)
Marketing legal pages, vercel.ts routers	apps/marketing, apps/web/vercel.ts	–	upstream	Kept: not shipped in the app, never deployed by the fork
Axiom in infra/task-cache	CI build cache	CI traces	upstream infra	Kept: dev/CI only, install guarded to pingdotgg
T3 Connect teardown (ConnectTeardown, Connect-only notice)	server, web, mobile	none: deletes old local Connect secrets	–	Kept (the way out for former Connect users)
LiteLLM pricing, ACP registry, npm registry, favicons	server/shared	plain GETs	neutral	Kept

Surviving upstream syncs

Deleted paths are listed in scripts/removed-connect-paths.json, so a sync that restores one fails check-removed-connect (CI and check:changed). New code that names an upstream analytics host, key or the hosted app also fails it. Removing the telemetry/ directory makes any upstream call site that imports it a typecheck error instead of a silent sender.

Merged with main (#229–#231, #241–#244)

• fix: ada command hints follow PATH, escape paths, and fall back to t3 #241 had the server report telemetryEnabled so the usage notice could be honest. The field stays, and this server always reports false. The web notice still warns when an older server reports true or omits the field. The managed-policy branch of the notice is gone along with the policy key.
• Expo push (feat(server): phones register Expo push tokens with each server #229–feat(mobile): direct push notifications from each server #231) is kept. Registration sends a random install id from secure storage plus the Expo push token, and only to our own servers. It never used the deleted hashTelemetryId, which no longer exists.

Scope and approval

Requested directly by the fork owner (JJ): remove analytics and everything that reports to or can be monitored by the upstream T3 project.

Verification

• vp run check:changed (TMPDIR=/private/tmp, Node 26): all green. Format, lint, knip, typecheck of 41 packages, 51 test files and the React compiler pass.
• The guard works on the real tree: I restored the old apps/server/src/telemetry/AnalyticsService.ts from main and node scripts/check-removed-connect.ts exited 1 with four problems (removed path is back, PostHog key, T3CODE_POSTHOG_, ingest.t3.codes). After deleting it again, it exits 0.
• Focused suites from the helpers: server, 32 files / 478 tests. Shared, 88. Web hosted pairing, 7. Mobile linking, 65. Desktop launch links, 20.
• Real web client, Settings > About > Legal. Before is main and after is this branch, both in dev:

Before	After

• Not checked: a mobile native build. Dropping expo-observe and the App Links intent filter changes the native fingerprint, so the next mobile install rebuilds the dev client. The triage prompt wording changed from "the website (app.t3.codes)" to "a web browser", but I did not run its evals.

Merge Danger

Door: two-way. It's a revert away, and nothing migrates persisted data. Old managed policy files with telemetry still load.

Blast Radius: cross-surface. Copied thread links are now t3-thread:// instead of https links that opened from anywhere. Pairing links always point at the server itself. The "Copy prompt link" action is hidden unless a hosted app is configured. Hosted https thread links pasted into a composer no longer become chips.

Claude Opus 5.5 via Claude Code (Ada), with Opus helper subagents.

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.5 KiB	21.5 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	1	1	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	1	1	0 (0.0%)	8	✅

Baseline: 1d94b77 · PR result: b8bd18a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.