Originally created by: adityaharishch
meridian-oauth already uses for the Jira client secret (meridian-oauth/src/jira.rs's DEFAULT_CLIENT_SECRET).option_env!("MERIDIAN_POSTHOG_API_KEY") in tray/src-tauri/src/analytics.rs, sourced from the POSTHOG_API_KEY GitHub Actions repo secret in both release.yml (production) and release-staging.yml (staging) — same wiring style as JIRA_OAUTH_CLIENT_SECRET/GH_OAUTH_CLIENT_ID.POSTHOG_API_KEY runtime env override for source/dev builds (settable in ~/.meridian/.env, already loaded via dotenvy).capture() now checks for that and skips sending entirely instead of firing a doomed unauthenticated request.tray/src-tauri/build.rs declares cargo:rerun-if-env-changed=MERIDIAN_POSTHOG_API_KEY so a CI cache can't bake a stale key after rotation (mirrors the root build.rs's handling of the Jira/GitHub secrets).Follow-up to [#427] — the key was previously a literal string constant in analytics.rs. It's a public write-only capture token (safe to embed, unlike a personal API key) so this was never an actual vulnerability, but keeping secrets out of source/git history entirely is the established convention in this codebase and is worth matching.
cargo fmt --check / cargo clippy -- -D warnings / cargo test (pre-commit + pre-push hooks)cargo test with MERIDIAN_POSTHOG_API_KEY unset vs set both recompile and passPOSTHOG_API_KEY repo secret (see PR comment) before the next release build, or analytics silently compiles disabledAdded anonymous product usage analytics for packaged builds, including installation and daily usage events.
Improvements
Input Monitoring permission prompts are no longer requested automatically.
Documentation
Originally posted by: coderabbitai[bot]
📝 Walkthrough
## Walkthrough The changes add PostHog telemetry and DMG generation, replace Input Monitoring onboarding with notification permissions, revise the setup wizard UI and model labels, update macOS packaging, and add documentation and design standards. ### Changes **Analytics and macOS packaging** |Layer / File(s)|Summary| |---|---| |**PostHog analytics pipeline**`.github/workflows/*`, `tray/src-tauri/...`|Release workflows provide the compile-time PostHog key; the tray persists analytics state, sends install and daily usage events, and runs analytics asynchronously from health ticks.| |**DMG artwork and bundle configuration**
`scripts/make-dmg-background.py`, `tray/src-tauri/tauri.conf.json`|A Pillow script generates the macOS DMG background, while bundle settings configure its placement and icon positions.| |**Setup window presentation**
`tray/src-tauri/src/tray.rs`|The setup window becomes larger, resizable, transparent-title-bar styled, and macOS full-screen capable.| **Permissions onboarding** |Layer / File(s)|Summary| |---|---| |**Notification permission commands**
`tray/src-tauri/src/commands/*`, `tray/src-tauri/src/lib.rs`, `tray/src-tauri/src/sys.rs`|Notification permission probe/request commands and settings navigation replace Input Monitoring commands.| |**Wizard permission contract**
`ui/app/setup/data.ts`, `ui/app/setup/steps.tsx`, `ui/app/setup/atoms.tsx`|Wizard contracts now represent notification authorization states, optional permissions, notification icons, and formatted model labels.| |**Wizard polling and permission actions**
`ui/app/setup/page.tsx`, `ui/app/setup/steps.tsx`|The wizard polls and requests notifications, opens settings after denial, and gates progression only on required permissions.| |**Input Monitoring capture behavior**
`tray/src-tauri/src/capture/ui_events.rs`|Recorder startup no longer requests Input Monitoring permission.| |**Wizard presentation and completion**
`ui/app/setup/page.tsx`, `ui/app/setup/steps.tsx`|Setup scaling, gradients, copy, completion counts, and local model display are updated.| |**Wizard helper tests**
`ui/__tests__/setup-data.test.ts`|Model-label formatting cases are covered by tests.| **Documentation and design standards** |Layer / File(s)|Summary| |---|---| |**Operational documentation**
`CLAUDE.md`, `NOTIFICATIONS.md`|UI hyphenation guidance and RFC-3339 notification expiry seed instructions are added.| |**UI design standards**
`ui/STYLESHEET.md`|Color budgets, gradient rules, and data-visualization mappings are documented.| **Estimated code review effort:** 4 (Complex) | ~60 minutes ### Sequence Diagram(s) :::mermaid sequenceDiagram participant SetupWizard participant TrayCommands participant NotificationPlugin participant macOSSettings SetupWizard->>TrayCommands: request_notifications TrayCommands->>NotificationPlugin: request authorization NotificationPlugin-->>TrayCommands: permission state TrayCommands-->>SetupWizard: granted, denied, prompt, or unavailable SetupWizard->>macOSSettings: open notifications pane when denied :::mermaid sequenceDiagram participant HealthTick participant Analytics participant LocalDatabase participant PostHog HealthTick->>Analytics: start daily analytics task Analytics->>LocalDatabase: read completed-day usage LocalDatabase-->>Analytics: focus and worklog counts Analytics->>PostHog: send daily_usage event PostHog-->>Analytics: capture result **Possibly related PRs** - [[Meridiona/meridian#324](https://github.com/Meridiona/meridian/issues/324)](https://github.com/Meridiona/meridian/pull/324): Both changes modify the macOS setup-wizard permission command surface around Input Monitoring. - [[Meridiona/meridian#347](https://github.com/Meridiona/meridian/issues/347)](https://github.com/Meridiona/meridian/pull/347): Both changes modify the shared onboarding wizard contracts and setup UI. **Poem** > I’m a bunny with a bell in the breeze, > Hopping through gradients and DMG trees. > PostHog events softly take flight, > Permissions now guide the setup right. > Hyphens march neatly, labels glow— > New wizard paths are ready to go!
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name | Status | Explanation | | :------------------------: | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------ | | Docstring Coverage | ✅ Passed | Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. | | Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | | Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | | Title check | ✅ Passed | The title accurately summarizes the main change: baking the PostHog key at build time instead of hardcoding it. | | Description check | ✅ Passed | The PR covers the change, rationale, and testing, but it doesn't follow the template's exact headings or include checklist and related-issues sections. |✨ Finishing Touches
🧪 Generate unit tests (beta)
- [ ] Create PR with unit tests - [ ] Commit unit tests in branch `fix/posthog-key-build-secret`Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)Comment
@coderabbitai helpto get the list of available commands.Ticket changed by: adityaharishch