Repository navigation
feat(telemetry): opt-in public profile and personal usage rank - #8393
Conversation
Roadmap unit for a six-layer stack: client telemetry core, GUI consent popup, Cloudflare Worker collector, telemetry guide, and the public /dashboard page. Docs only.
…rve declined config on agent import
…nd cover failure paths
…, mandatory salt, and stats caching
…ferences, README, and structure
…lls, and raise rate limit
# Conflicts: # README.md # docs-site/src/content/docs/reference/code-signing.md # docs-site/src/content/docs/tr/reference/code-signing.md # readme/README.fr.md # readme/README.ja.md # readme/README.ko.md # readme/README.ru.md # readme/README.tr.md # readme/README.zh-CN.md # readme/README.zh-TW.md # readme/i18n-manifest.json # structure/telemetry.md
…ut docs-site deps The root docs-telemetry-dashboard test imports client.ts; the root CI job does not install docs-site dependencies, so the static echarts import failed to resolve. ECharts now loads on first chart render as its own chunk.
…ever sent A proxy started under OCX_TELEMETRY=0 reads the env once and runs no ticks, so it records ineligibleThroughDay only for its start day. These tests drive the real background lifecycle with a mocked clock for an opt-out period of several days, ended by a crash and by a clean stop. They fail on this commit: the first normal tick sends 2026-11-03, a day the proxy ran opted out.
…il it ends Observing OCX_TELEMETRY=0 or DO_NOT_TRACK=1 now also persists an envOptOutActiveSince marker in telemetry-state.json. While it is set no day is eligible. The opted-out proxy's clean stop, or the first tick that runs without the opt-out, closes the period: every day through the closing day stays ineligible and the marker is cleared. A crashed opted-out proxy therefore costs at most the restart day and never leaks its opt-out days. SPONSORS.md no longer says opencodex collects no telemetry.
…rank API with limits and abuse controls
…rboard mount test
…vacy statements, install rules and structure doc
…ded during its send
…used days aside, and let disconnect clear an unreadable profile file
…le remains; clarify status and indexing wording
lidge-jun
added
the
ci:full
|
Caution Review failedThe pull request is closed.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
✅ Deterministic PR hygiene checks passed. |
…ending deletion from the reply, and tighten preview and loop start
…d read; refuse connect before prompting when telemetry is off
…th telemetry on or off
…board # Conflicts: # devlog/_plan/261107_telemetry_dashboard/060_review_round.md # docs-site/src/content/docs/guides/telemetry.md # readme/i18n-manifest.json # scripts/test-layout/layout-usage.json # src/telemetry/consent.ts # src/telemetry/routes.ts # src/telemetry/sender.ts # src/telemetry/state.ts # structure/manifest.json # structure/telemetry.md # tests/config/telemetry-live-save.test.ts # tests/fixtures/test-layout-expected.json # tests/server/server-telemetry-routes.test.ts # tests/usage/usage-telemetry-client.test.ts
…o goat/telemetry-07-personal-rank # Conflicts: # readme/i18n-manifest.json
|
Maintainer judgment — head 1. Value. This implements #8372: an opt-in public profile and personal usage rank built on the anonymous telemetry now on 2. UX change — intentional and documented. Everything user-visible is new and opt-in:
Existing flows, defaults, config semantics, the anonymous telemetry payload ( 3. No regression for existing users. Nothing happens until a person connects:
Evidence on this exact head.
Pre-deploy follow-ups (P3, not blocking):
Nothing is deployed. |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 632f59b0a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "INSERT OR IGNORE INTO profile_days (profile_id, day, requests, input, cache_read, cache_write, output, reasoning, tokens) " + | ||
| "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)", |
There was a problem hiding this comment.
If a submission authenticates before a concurrent disconnect but finishes reading its body afterward, this batch inserts usage for an already-deleted profile. The new tables have no foreign keys, and neither insert checks that the profile still exists. I reproduced this with the collector's SQLite harness: DELETE returned 200, the delayed submission then returned 200, and both usage tables retained rows despite profiles being empty. Subsequent deletion attempts return 401, leaving these rows until retention pruning. Guard both inserts with profile existence inside the atomic batch, or enforce referential integrity, so a completed disconnect cannot be followed by orphaned usage.
Useful? React with 👍 / 👎.
| const result = await deleteProfile(state.secret, options); | ||
| if (result.deleted) { | ||
| if (deleteTelemetryProfileFile(configDir)) return { status: "deleted" }; |
There was a problem hiding this comment.
When two disconnect requests overlap, one can finish and remove the old file while the other is still awaiting the collector. If the user reconnects before the delayed request completes, this unconditional removal deletes the new profile's file and its only bearer secret, although that new public profile remains on the collector. This also occurs when a disconnect overlaps the scheduler's pending-deletion retry. Re-read the file and compare its secret with state.secret before unlinking, as retryPendingDelete already does.
Useful? React with 👍 / 👎.
| button.addEventListener("click", () => { | ||
| metric = parseLeaderboardMetric(button.dataset.tlMetric); | ||
| void load(); | ||
| }); |
There was a problem hiding this comment.
On the public dashboard, opening a profile and then switching from Tokens to Requests refreshes only the leaderboard. The profile panel retains the ranks fetched with the previous metric, so it can show a different position from that same person's row under the now-selected metric. An in-flight profile lookup can likewise render old-metric ranks after the toggle. Track the currently displayed handle and reload its profile on metric changes, invalidating any previous lookup.
Useful? React with 👍 / 👎.
Builds on the telemetry stack now on
dev(#8300, #8348, #8303, #8304, #8305, #8308).Closes #8372
Summary
People who keep anonymous telemetry on can now choose to appear on a public usage leaderboard and see their own rank. The design follows the tokscale leaderboard (explicit join, dry-run preview, server-side checks, full deletion), but publishes far less: no devices, session timing, MCP names or e-mail.
ocx telemetry profile connect|disconnect|status. Connecting needs a human dashboard session and an unchecked-by-default "this is public" acknowledgement, or an interactive terminal with a default-no prompt; agents getagent_consent_required/tty_required. Connecting never touches the telemetry decision, and turning telemetry off only pauses sending.telemetry-profile.json(0600) and is never shown; the collector stores only its SHA-256. GitHub sign-in needs a maintainer-created OAuth app and is left as a follow-up.services/telemetry-collector):POST /v1/profiles,POST /v1/profiles/me/days,GET|DELETE /v1/profiles/me,GET /v1/leaderboard,GET /v1/profiles/by-handle/<h>. Profile tables never join the anonymous ones. Abuse controls: domain-separated rate-limit hashes, reserved handles, consistency and daily caps, first-write-wins per day, no backfill,RANK()ranking, ahiddenmoderation flag, squatting prune,noindex, and no CORS preflight for bearer routes. Nothing is deployed.?profile=<handle>personal-rank view in 8 locales, rendered withtextContentonly.AGENTS_INSTALL.mdconsent rule,SPONSORS.md,structure/telemetry.md, collector README. No installer change, since the profile is opt-in.Design and audit record:
devlog/_plan/261109_telemetry_personal_rank/.Screenshots (dashboard Home, isolated proxy; the connected view shows "Rank is unavailable" because no collector is deployed yet):
Verification
All commands ran in isolated homes (
env -i, tempHOME/OPENCODEX_HOME/CODEX_HOME/CLAUDE_CONFIG_DIR).tests/usage/usage-telemetry-profile-{contract,sync,collector}.test.ts,tests/server/server-telemetry-profile-routes.test.ts,tests/cli/cli-telemetry-profile.test.ts,tests/ci-workflows/docs-telemetry-leaderboard.test.tsandgui/tests/telemetry-profile-card.test.tsx. All pass. Each review fix has a test that failed before it. Collector mutation checks (ROW_NUMBERforRANK, allowing backfill, dropping the hidden filter) were each caught.bun run typecheck,bun run lint:gui,bun run build:gui, docs-siteastro build(internal link and fragment check),bun run privacy:scan,bun run structure:check,bun run skill:surface:check: pass. GUI suite: 4109 pass. Test-layout, file-size ratchet and core/Lab boundary tests pass, and no file-size cap was raised.bun run test(before the review fixes): passes except four tests, all unrelated to this branch:codex-cli-update-applycases, which fail because this machine has live Codex sessions (blocked_active_session);release-version-line, which fails because the stack base'spackage.json(2.99.0) equals an already-released tag. This PR does not touchpackage.json.devlog/_plan/261109_telemetry_personal_rank/, decisions recorded per finding):hyds/deepseek-v4.1-flash-free): REQUEST-CHANGES, 1 P1 + 2 P2, all fixed with failing-first tests (b42784e33c,11f62c7acc).mistral/deepseek-v4-1-flash-1017): PASS-WITH-NITS; the P2 (disconnect reported done while the secret file remained) is fixed in31ed41f70b; 4 of 5 P3s folded.8d42472900, one P2 rebutted with a passing test.ca51591a38.ca51591a38: APPROVE-WITH-NITS, no P0/P1, its single P2 rebutted (a no-usage day has no family rows to lose, and only completed UTC days are read); 3 P3s deferred.command-codeDeepSeek route answered HTTP 401 on every attempt, so reviews ran on the hyds and mistral routes.react-doctorflagged a response read before its status check, fixed in1a1d36f8d7.test 5/5fails onlyrelease-version-line, which is inherited from the stack base: itspackage.jsonis 2.99.0, already a released tag, whiledevis at 2.100.0. It clears once the stack takesdev.devas632f59b0a6, takingdevfor every file and re-applying only this PR's changes. The diff againstdevmatches the original layer exactly (78 files, +5695/−27). Re-verified in isolated homes: typecheck, 291 focused and guard tests, 37 GUI telemetry tests, GUI lint and build, docs-site build,privacy:scan,structure:checkandskill:surface:checkall pass.tests/usage/usage-telemetry-profile-lifecycle.test.ts(added in5ede3c63bf) proves that installs without a profile start no profile loop, with telemetry on or off; removing the guard makes it fail.bun:sqlitethrough the existing D1 harness); macOS/Windows CI (left to hosted CI). The branch was pushed with--no-verify.Checklist