Skip to content

Adopt OpenCode plugin as @posthog/opencode (rebrand, repackage, e2e fixes)#1

Merged
andrewm4894 merged 5 commits into
mainfrom
chore/rebrand-and-scrub
Jun 4, 2026
Merged

Adopt OpenCode plugin as @posthog/opencode (rebrand, repackage, e2e fixes)#1
andrewm4894 merged 5 commits into
mainfrom
chore/rebrand-and-scrub

Conversation

@andrewm4894

@andrewm4894 andrewm4894 commented Jun 4, 2026

Copy link
Copy Markdown
Member

Adopts the community plugin Quantumlyy/opencode-posthog (MIT, by Nejc Drobnič) as the official PostHog LLM Analytics plugin for OpenCode — @posthog/opencode, alongside @posthog/pi and @posthog/openclaw. main preserves Nejc's full git history; this PR is the rebrand + repackage + fixes on top.

Security audit (adopted third-party code) — clean

  • No install-time scripts (no pre/post-install/prepare). Single runtime dep posthog-node@posthog/core (both PostHog).
  • No network/exec/fs/eval beyond posthog-node → the configured POSTHOG_HOST; reads only POSTHOG_* env. No secrets ever committed.
  • Privacy-conscious by design (privacy mode + multi-layer secret redaction; never-crash-host).

Changes

  • Rebrand: opencode-posthog@posthog/opencode; author: PostHog, Nejc credited (contributors + README); repo URLs → PostHog org; LICENSE keeps Nejc + adds PostHog; removed personal FUNDING.yml; $ai_libposthog-opencode.
  • Packaging/publishing (PostHog standard): bun → pnpm; build dist with tsc (posthog-node external); CI + setup → pnpm; release workflow = the pi/openclaw template (label-triggered, Release approval env, GitHub App token, npm OIDC trusted publishing + provenance). Kept the compiled dist because OpenCode resolves a compiled package entrypoint (verified via its loader + real plugins).
  • Fixes found via real end-to-end testing against a live PostHog project:
    • dispose hook → client.shutdown() so short-lived opencode run reliably delivers tail events (posthog-node flush() resolves before the HTTP send completes).
    • Don't reset the trace on repeated user message.updated (OpenCode fires it 3×/turn) — fixes $ai_model/$ai_provider unknown and was wiping accumulated state. Generation now resolves model by the step's messageID. Regression test added.
  • CI compliance: all Actions pinned to commit SHAs; pnpm minimumReleaseAge set.

Verified end-to-end (live PostHog project)

✅ Events deliver on exit (dispose) · ✅ $ai_generation/$ai_span/$ai_trace land tagged framework=opencode · ✅ model/provider correct (gpt-5.4-mini/openai) · ✅ tool spans + generation→span parenting · ✅ cost: 0 confirmed real (OpenAI via oauth). 42 unit tests pass; all CI green.

Known follow-up (not blocking — pre-existing, can iterate later)

  • $ai_input / $ai_output_choices content capture is still incomplete in real multi-step/tool sessions (model/spans/structure are correct; the prompt/response content fields can be null). Tracked for a fast-follow.

Org-admin setup required before the first release

See the pinned checklist comment (GitHub App, Release environment, env secrets, ruleset bypasses, org secret grants, npx setup-npm-trusted-publish @posthog/opencode).

- Rename package opencode-posthog -> @posthog/opencode
- author: PostHog; credit Nejc Drobnič via contributors + README
- Point repository/bugs/homepage at PostHog/posthog-opencode
- LICENSE: keep Nejc copyright, add PostHog, Inc.
- $ai_lib: opencode-posthog -> posthog-opencode (matches @posthog/openclaw convention)
- Remove personal .github/FUNDING.yml
- Update tests, README, CHANGELOG accordingly

Adopted from github.com/Quantumlyy/opencode-posthog (MIT). Full history preserved.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cfe00d5d99

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread package.json
- Migrate toolchain bun -> pnpm (pnpm-lock.yaml, pnpm-workspace.yaml, .nvmrc=24, engines)
- Build dist with tsc (posthog-node external, not bundled) via tsconfig.build.json
- CI + setup action -> pnpm (typecheck/lint/test/build)
- Replace release workflow with the PostHog template used by @posthog/pi and
  @posthog/openclaw: label-triggered, Release approval environment, GitHub App
  token, npm OIDC trusted publishing (--provenance), Slack + PostHog notifications
- version.ts -> literal synced by the release workflow
- Add vitest.config.ts; add changeset for the initial @posthog/opencode release

Keeps the dist build (idiomatic for OpenCode plugins, which resolve a compiled
package entrypoint), while adopting PostHog's pnpm + publishing conventions.

Verified: pnpm typecheck/lint clean, 41/41 tests, build emits dist, dist loads.
@andrewm4894

Copy link
Copy Markdown
Member Author

Update: packaging + publishing aligned to PostHog standard (commit 35efee1)

Following the SDK release runbook and the @posthog/pi / @posthog/openclaw templates:

  • Toolchain bun → pnpm (pnpm-lock.yaml, pnpm-workspace.yaml, .nvmrc=24, engines.node>=22)
  • Build dist with tsc (tsconfig.build.json), posthog-node external (declared dependency, not bundled). Kept the dist build because OpenCode resolves a compiled package entrypoint — verified via its loader (await import(entry) from main/exports) and real plugins (opencode-gemini-auth, opencode-notification both ship dist/index.js). pi/openclaw ship raw TS only because their hosts load via a manifest field, which OpenCode doesn't have.
  • CI + setup action → pnpm; release workflow = the PostHog template: label-triggered, Release approval environment, GitHub App token, npm OIDC trusted publishing (pnpm publish --provenance), Slack + PostHog notifications.

Verified locally: pnpm typecheck/lint clean, 41/41 tests, pnpm build emits dist, dist loads with external posthog-node.

⚠️ Org-admin setup required before the first release (only admins can do these)

Per the runbook, before the release workflow can run:

  1. GitHub App Releaser (posthog-opencode)Contents: read/write, installed on PostHog restricted to this repo. Save App ID + private key.
  2. Release environment with required reviewers PostHog/client-libraries-approvers + PostHog/team-client-libraries, prevent self-review, no admin bypass.
  3. Environment secrets: GH_APP_POSTHOG_OPENCODE_RELEASER_APP_ID, GH_APP_POSTHOG_OPENCODE_RELEASER_PRIVATE_KEY.
  4. GitHub App bypass on the CodeQL ruleset + repo PR ruleset.
  5. Grant org secrets/vars to this repo: SLACK_CLIENT_LIBRARIES_BOT_TOKEN, POSTHOG_PROJECT_API_KEY, GROUP_CLIENT_LIBRARIES_SLACK_GROUP_ID, SLACK_APPROVALS_CLIENT_LIBRARIES_CHANNEL_ID.
  6. Add teams client-libraries-approvers + team-client-libraries as collaborators (write).
  7. npm trusted publishing (needs @posthog npm access): npx setup-npm-trusted-publish @posthog/opencode — use casing PostHog exactly.
  8. Ruleset requiring PRs + signed commits.

posthog-node's flush() resolves before the HTTP send completes, so a
short-lived `opencode run` invocation would exit and drop its final
$ai_generation/$ai_span/$ai_trace events. Add a dispose hook (awaited by
OpenCode during plugin teardown) that calls client.shutdown(), which drains
all pending events and awaits the network round-trip. The session.idle
flush is kept for prompt delivery during long-lived interactive sessions.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e64cb410ba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/workflows/release.yml
Comment thread .github/workflows/release.yml
OpenCode emits message.updated for the same user message multiple times per
turn. The plugin created a new trace on every one, wiping the accumulated
prompt ($ai_input) and assistant model info before the generation was built
on step-finish — so real sessions showed 'No input' and model 'unknown'
(synthetic single-fire harness missed this).

- Only start a new trace for a genuinely new user message id; ignore repeat
  updates of the same message.
- Resolve generation model/provider from the assistant message the step
  belongs to (assistantMessages[part.messageID]) instead of a lagging pointer.
- Add src/index.test.ts regression test reproducing the real event ordering.

Verified against the captured real event stream: model=gpt-5.4-mini,
provider=openai, $ai_input + trace input_state now populated. 42 tests pass.
Satisfy PostHog org security checks:
- Pin all GitHub Actions to full-length commit SHAs (org ruleset requirement).
- Add pnpm minimumReleaseAge=10080 (7d) with our own packages excluded, matching
  the monorepo (semgrep-package-managers supply-chain rule).
@andrewm4894 andrewm4894 changed the title chore: adopt as @posthog/opencode — rebrand, scrub personal metadata, security audit Adopt OpenCode plugin as @posthog/opencode (rebrand, repackage, e2e fixes) Jun 4, 2026
@andrewm4894

Copy link
Copy Markdown
Member Author

@codex review

@andrewm4894 andrewm4894 merged commit f5da292 into main Jun 4, 2026
10 checks passed
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. What shall we delve into next?

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant