Repository navigation
Hosted: aggregate daily launch counts, link refs, and an admin metrics page - #1398
Merged
Merged
Conversation
A dormouse_metrics_daily row is a UTC day, an event, one of that event's allowlisted labels, and a count: nothing that names an account. The relay and voice Workers write theirs on their own roles, best effort through waitUntil, so a failed write is logged and never changes or delays the answer it counts. Counted now: approvals by purpose, enrollments, speech by outcome and the call that spends the day's last, push deliveries, and Pocket sign-ins. GET /api/admin/metrics reads the last 30 days and all-time totals for the verified admin only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every link to dormouse.sh/hosted carries ?ref= from one shared list (lib/src/lib/hosted-links.ts), ahead of its fragment: the Settings plans and voice links, the home page, the Pocket tutorial and playground, the self-host page, both READMEs, and the account page's no-plan offer. The Hosted page takes it off the address bar on arrival, so a copied link never carries it; nothing counts or sends it yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
/admin/metrics (with or without the trailing slash) reads /api/admin/metrics and shows each counted event's today, 30-day, and all-time counts, its labels, and 30 days of plain-CSS bars. Signed out it links sign-in; anyone but the admin sees Not found. The header and footer move into HostedShell, which the account page now shares. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
hosted.md gains a Metrics section (the events, labels refused off-list, best-effort writes); security-hosted.md a FAIL IF (S278) on what a row may hold and who reads the admin route, with cookieAdmin on the account-boundary inspect list; pricing.md the ref every Hosted page link carries. Privacy names each kind of count and says a link's label is stripped, never counted. A canary patch takes the new migration pin as context. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deploying mouseterm with
|
| Latest commit: |
d6d7c52
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://001442e0.mouseterm.pages.dev |
| Branch Preview URL: | https://hosted-metrics-counts.mouseterm.pages.dev |
dormouse-bot
approved these changes
Oct 28, 2026
This was referenced Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First-party launch metrics: aggregate daily counts on our own servers. No identifiers are stored and no client telemetry is sent.
dormouse_metrics_dailytable (migration013) holds only the UTC day, the event, a label from that event'sMETRIC_LABELSallowlist, and the count; rows are kept forever. Events counted:enroll.approved[remote|voice],burrow.enrolled,voice.speak[ok|capped|error],voice.fallback-cap(once per account per day),push.sentandpocket.signin. Writes are best effort throughwaitUntil, so they never change or delay the response they count.?ref=fromlib/src/lib/hosted-links.ts: the Settings plans and voice links,HostedPlansLink(now takingfrom), the home page, the Pocket tutorial and playground,HostingRequirementNotice, both READMEs, and the account page's no-plan offer./hostedstrips the ref on arrival. Nothing counts it yet:takeVisitRef()is the seam the PostHog follow-up reads./admin/metricson the account app is behind a newcookieAdmingate: 401 when signed out, 404 for anyone but the verifiedADMIN_EMAIL. It shows today, the last 30 days and all-time totals, per-label tables, and plain-CSS bars. The page header and footer moved into a sharedHostedShell, with the markup unchanged.hosted.md→ "Metrics" section.security-hosted.mdgets FAIL IFS278(row shape and admin-only read),cookieAdminadded toS78, and the metric upsert excepted inS110.pricing.mdgets the ref rule.Login, account-created and billing events wait for a pgstencil hook and for checkout.
#1397 also takes
S278, and spec-lint forbids a gap, so whichever PR merges second renumbers toS279.🤖 Generated with Claude Code