Merge latest bkt3 (bkmain b7af1e60) into stage

apps/server/src/auth/McpOAuth.test.ts

@@ -595,3 +595,32 @@ it("matches loopback redirects on everything but the port, and https redirects e
   expect(matches("https://bot.example/cb", "https://bot.example/cb?x=1")).toBe(false);
   expect(matches("https://bot.example/cb", "https://evil.example/cb")).toBe(false);
 });
+
+// T3-CUSTOM(expbkt3): BEGIN — hosted connectors such as Google's register many redirect URIs.
+it.live("registers a hosted client with up to 20 https redirect URIs", () =>
+  withRoutes((handler) =>
+    Effect.gen(function* () {
+      const registerMany = (count: number) =>
+        handler(
+          at("/oauth/mcp/register", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: encodeJson({
+              client_name: "Google",
+              redirect_uris: Array.from(
+                { length: count },
+                (_, index) => `https://connector${index}.example/oauth-redirect`,
+              ),
+            }),
+          }),
+        );
+
+      expect((yield* registerMany(8)).status).toBe(201);
+      expect((yield* registerMany(20)).status).toBe(201);
+      const tooMany = yield* registerMany(21);
+      expect(tooMany.status).toBe(400);
+      expect(yield* json<unknown>(tooMany)).toMatchObject({ error: "invalid_redirect_uri" });
+    }),
+  ),
+);
+// T3-CUSTOM(expbkt3): END

apps/server/src/auth/McpOAuth.ts

@@ -63,7 +63,8 @@ import {
 const SIGNING_SECRET_NAME = "mcp-oauth-signing-key";
 const AUTHORIZATION_CODE_TTL_MS = 60_000;
 const MAX_CLIENT_NAME_LENGTH = 100;
-const MAX_REDIRECT_URIS = 5;
+// T3-CUSTOM(expbkt3): Google's MCP connector registers more than upstream's 5 redirect URIs.
+const MAX_REDIRECT_URIS = 20;
 const MAX_REDIRECT_URI_LENGTH = 512;
 const DEFAULT_CLIENT_NAME = "MCP client";
 const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);

apps/server/src/environment/ServerEnvironment.ts

@@ -22,6 +22,8 @@ import { resolveServiceLauncherMode } from "../cloud/serviceLauncherClient.ts";
 import * as ServerConfig from "../config.ts";
 import * as ProcessRunner from "../processRunner.ts";
 import { resolveServerEnvironmentLabel } from "./ServerEnvironmentLabel.ts";
+// T3-CUSTOM(expbkt3): product analytics config for clients (TEC-1631).
+import { loadClientAnalyticsConfig } from "./clientAnalyticsConfig.ts";
 import { detectServerEnvironmentMachineKind } from "./ServerEnvironmentMachine.ts";
 
 export class ServerEnvironmentIdPersistenceError extends Schema.TaggedError<ServerEnvironmentIdPersistenceError>()(
@@ -204,6 +206,8 @@ export const make = Effect.gen(function* () {
   // the fd and correctly do not advertise.
   const desktopAppUpdate =
     serverSelfUpdate === "desktop-managed" && serverConfig.desktopTelemetryControlFd !== undefined;
+  // T3-CUSTOM(expbkt3): read once at startup, like the rest of the descriptor.
+  const analytics = yield* loadClientAnalyticsConfig;
 
   const descriptor: ExecutionEnvironmentDescriptor = {
     environmentId,
@@ -282,6 +286,8 @@ export const make = Effect.gen(function* () {
       ...(desktopAppUpdate ? { desktopAppUpdate: true } : {}),
       serverBrowser: true,
     },
+    // T3-CUSTOM(expbkt3): absent unless an explicit company PostHog key is set.
+    ...(analytics === null ? {} : { analytics }),
   };
 
   return ServerEnvironment.of({

apps/server/src/environment/clientAnalyticsConfig.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, it } from "@effect/vitest";
+import * as Option from "effect/Option";
+
+import { resolveClientAnalyticsConfig } from "./clientAnalyticsConfig.ts";
+
+const base = {
+  posthogKey: Option.some("phc_company"),
+  posthogHost: Option.none<string>(),
+  enabled: true,
+  instance: Option.some("bkt3"),
+};
+
+describe("resolveClientAnalyticsConfig", () => {
+  it("advertises an explicit key with the default host and the instance", () => {
+    expect(resolveClientAnalyticsConfig(base)).toEqual({
+      enabled: true,
+      posthogKey: "phc_company",
+      posthogHost: "https://us.i.posthog.com",
+      instance: "bkt3",
+    });
+  });
+
+  it("stays absent without an explicit key, so clients never use upstream's project", () => {
+    expect(resolveClientAnalyticsConfig({ ...base, posthogKey: Option.none() })).toBeNull();
+    expect(resolveClientAnalyticsConfig({ ...base, posthogKey: Option.some("  ") })).toBeNull();
+  });
+
+  it("stays absent when telemetry is off", () => {
+    expect(resolveClientAnalyticsConfig({ ...base, enabled: false })).toBeNull();
+  });
+
+  it("omits a blank instance and honours a custom host", () => {
+    expect(
+      resolveClientAnalyticsConfig({
+        ...base,
+        instance: Option.some(""),
+        posthogHost: Option.some("https://eu.i.posthog.com"),
+      }),
+    ).toEqual({
+      enabled: true,
+      posthogKey: "phc_company",
+      posthogHost: "https://eu.i.posthog.com",
+    });
+  });
+});

apps/server/src/environment/clientAnalyticsConfig.ts

@@ -0,0 +1,57 @@
+/**
+ * T3-CUSTOM(expbkt3): product analytics config handed to clients (TEC-1631).
+ *
+ * The web and desktop clients send their own PostHog events, to the same
+ * company project the server reports to. They learn the key from the
+ * environment descriptor at runtime, so no key is baked into the bundle and
+ * each environment decides for itself.
+ *
+ * Only an explicitly set `T3CODE_POSTHOG_KEY` is advertised. The server's own
+ * telemetry falls back to upstream's project key; clients must never send
+ * Beknown usage there, so with no explicit key the field is absent and the
+ * client stays off.
+ *
+ * @module clientAnalyticsConfig
+ */
+import type { ExecutionEnvironmentAnalytics } from "@t3tools/contracts";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+
+const DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
+
+const ClientAnalyticsEnvConfig = Config.all({
+  posthogKey: Config.String("T3CODE_POSTHOG_KEY").pipe(Config.option),
+  posthogHost: Config.String("T3CODE_POSTHOG_HOST").pipe(Config.option),
+  enabled: Config.Boolean("T3CODE_TELEMETRY_ENABLED").pipe(Config.withDefault(true)),
+  instance: Config.String("T3CODE_ANALYTICS_INSTANCE").pipe(Config.option),
+});
+
+function nonEmpty(value: Option.Option<string>): string | null {
+  const trimmed = Option.getOrNull(value)?.trim() ?? "";
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+/** Pure mapping from env values to the descriptor field; `null` means omit it. */
+export function resolveClientAnalyticsConfig(input: {
+  readonly posthogKey: Option.Option<string>;
+  readonly posthogHost: Option.Option<string>;
+  readonly enabled: boolean;
+  readonly instance: Option.Option<string>;
+}): ExecutionEnvironmentAnalytics | null {
+  const posthogKey = nonEmpty(input.posthogKey);
+  if (!input.enabled || posthogKey === null) return null;
+  const instance = nonEmpty(input.instance);
+  return {
+    enabled: true,
+    posthogKey,
+    posthogHost: nonEmpty(input.posthogHost) ?? DEFAULT_POSTHOG_HOST,
+    ...(instance === null ? {} : { instance }),
+  };
+}
+
+/** Reads the env once; a bad value disables client analytics, never the server. */
+export const loadClientAnalyticsConfig: Effect.Effect<ExecutionEnvironmentAnalytics | null> =
+  Effect.gen(function* () {
+    return resolveClientAnalyticsConfig(yield* ClientAnalyticsEnvConfig);
+  }).pipe(Effect.orElseSucceed(() => null));

apps/server/src/mcp/McpToolAccess.ts

@@ -16,6 +16,7 @@ import {
   type DispatchModeRefusal,
 } from "../orchestration-v2/DispatchModeLimit.ts";
 import * as McpInvocationContext from "./McpInvocationContext.ts";
+import { withMcpToolCallAnalytics } from "./mcpToolAnalytics.expbkt3.ts"; // T3-CUSTOM(expbkt3)
 import { resolveInteractionMode, resolveRuntimeMode } from "./OrchestratorMcpService.ts";
 import {
   assertFullAccess,
@@ -300,7 +301,8 @@ export class HandlersLayer<Tools extends Record<string, Tool.Any>, EX = never, R
 }
 
 const checkedHandlers = <Handlers>(declarations: Declarations<Handlers>): Handlers =>
-  Struct.map(declarations, checkedHandler);
+  // T3-CUSTOM(expbkt3): count every tool call by name (TEC-1631).
+  withMcpToolCallAnalytics(Struct.map(declarations, checkedHandler));
 
 /** `Toolkit.toLayer` for handlers that all declare their access. */
 export const toLayer = <Tools extends Record<string, Tool.Any>, EX = never, RX = never>(

apps/server/src/mcp/mcpToolAnalytics.expbkt3.ts

@@ -0,0 +1,40 @@
+/**
+ * T3-CUSTOM(expbkt3): counts every T3 MCP tool call by name (TEC-1631).
+ *
+ * `McpToolAccess.toLayer` is the one place every `/mcp` toolkit's handlers are
+ * built, keyed by tool name, so wrapping them there covers every tool. Only
+ * the name, caller kind, outcome and duration are recorded, never arguments.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+
+import { type McpToolCaller, withMcpToolAnalytics } from "../telemetry/serverEvents.ts";
+import * as McpInvocationContext from "./McpInvocationContext.ts";
+
+const currentCaller: Effect.Effect<McpToolCaller | undefined> = Effect.serviceOption(
+  McpInvocationContext.McpInvocationContext,
+).pipe(
+  Effect.map((scope) =>
+    Option.isNone(scope)
+      ? undefined
+      : { principal: scope.value.principal, actorUserId: scope.value.actorUserId },
+  ),
+);
+
+/** `handlers` with each Effect-returning handler timed and recorded under its key. */
+export function withMcpToolCallAnalytics<Handlers>(handlers: Handlers): Handlers {
+  const wrapped: Record<string, unknown> = {};
+  for (const [toolName, handler] of Object.entries(handlers as Record<string, unknown>)) {
+    wrapped[toolName] =
+      typeof handler === "function"
+        ? (...args: ReadonlyArray<unknown>) => {
+            const result = (handler as (...params: ReadonlyArray<unknown>) => unknown)(...args);
+            return Effect.isEffect(result)
+              ? // @effect-diagnostics-next-line anyUnknownInErrorContext:off -- handlers are heterogeneous; types pass through unchanged.
+                withMcpToolAnalytics(toolName, currentCaller, result)
+              : result;
+          }
+        : handler;
+  }
+  return wrapped as Handlers;
+}

apps/server/src/mcp/toolkits/control/handlers.ts

@@ -78,6 +78,8 @@ import { hasUserWideScope, resolveMcpSessionTarget } from "../../mcpSessionTarge
 import { boundSessionDetail } from "./sessionDetail.ts";
 import { T3ControlToolkit, T3ControlToolError, type T3CreateSessionTool } from "./tools.ts";
 import type { Tool } from "effect/ai";
+import { recordLinearLinked } from "../../../telemetry/serverEvents.ts";
+import { CurrentOrchestrationActorUserId } from "../../../orchestration-v2/forkActor.expbkt3.ts";
 
 const nowIso = Effect.map(DateTime.now, DateTime.formatIso);
 const decodeOrchestrationCommand = Schema.decodeUnknownEffect(OrchestrationCommandSchema);
@@ -1662,10 +1664,17 @@ const handlers = {
     const after = yield* readLinearLinks(operation, sessionId);
     const urls = links.map((link) => link.url);
     const has = (list: typeof before, url: string) => list.some((entry) => entry.url === url);
+    const added = urls.filter((url) => !has(before, url) && has(after, url));
+    // Product analytics: how many items were linked, never which (TEC-1631).
+    yield* recordLinearLinked({
+      threadId: sessionId,
+      count: added.length,
+      userId: yield* CurrentOrchestrationActorUserId,
+    });
     return {
       sessionId,
       linearLinks: after,
-      added: urls.filter((url) => !has(before, url) && has(after, url)),
+      added,
       alreadyLinked: urls.filter((url) => has(before, url)),
       // Left out because the session already holds the maximum number of tags.
       notAdded: urls.filter((url) => !has(before, url) && !has(after, url)),

apps/server/src/orchestration-v2/ProviderRuntimeRecoveryService.ts

@@ -27,6 +27,8 @@ import {
   settledBackgroundWakeRequest,
   settledBackgroundWakeRun,
 } from "./restartBackgroundResume.expbkt3.ts";
+// T3-CUSTOM(expbkt3): session.recovery.* product analytics (TEC-1631).
+import { withSessionRecoveryAnalytics } from "../telemetry/serverEvents.ts";
 import {
   cancelledRosterTaskWork,
   cancelledTurnItemWork,
@@ -834,9 +836,12 @@ export const make = Effect.gen(function* () {
     Effect.mapError((cause) => new ProviderRuntimeRecoveryError({ operation: "reconcile", cause })),
   );
 
-  const recover = Effect.gen(function* () {
-    return (yield* reconcile("startup")) satisfies ProviderRuntimeRecoverySummary;
-  });
+  // T3-CUSTOM(expbkt3): session.recovery.* product analytics (TEC-1631).
+  const recover = withSessionRecoveryAnalytics(
+    Effect.gen(function* () {
+      return (yield* reconcile("startup")) satisfies ProviderRuntimeRecoverySummary;
+    }),
+  );
 
   return ProviderRuntimeRecoveryService.of({ reconcile, prepareForShutdown, recover });
 });

apps/server/src/provider/ProviderInstanceEnvironment.ts

@@ -1,13 +1,15 @@
 import type { ProviderInstanceEnvironment } from "@t3tools/contracts";
 
 import { expandHomePath } from "../pathExpansion.ts";
+// T3-CUSTOM(expbkt3): agents never inherit the server's analytics settings (TEC-1631).
+import { withoutAnalyticsEnvironment } from "../telemetry/analyticsEnvironment.ts";
 
 export function mergeProviderInstanceEnvironment(
   environment: ProviderInstanceEnvironment | undefined,
   baseEnv: NodeJS.ProcessEnv = process.env,
 ): NodeJS.ProcessEnv {
   if (!environment || environment.length === 0) {
-    return baseEnv;
+    return withoutAnalyticsEnvironment(baseEnv); // T3-CUSTOM(expbkt3): TEC-1631.
   }
 
   const next: NodeJS.ProcessEnv = { ...baseEnv };
@@ -18,5 +20,5 @@ export function mergeProviderInstanceEnvironment(
         ? expandHomePath(variable.value)
         : variable.value;
   }
-  return next;
+  return withoutAnalyticsEnvironment(next); // T3-CUSTOM(expbkt3): TEC-1631.
 }

apps/server/src/scheduledTasks/ScheduledTaskService.ts

@@ -53,6 +53,7 @@ import {
   type WebhookRequest,
 } from "./webhookTemplate.ts";
 import { constantTimeEquals, verifyWebhookSignature } from "./webhookVerification.ts";
+import { recordScheduledTaskRan } from "../telemetry/serverEvents.ts"; // T3-CUSTOM(expbkt3)
 // T3-CUSTOM(expbkt3): BK sidebar custom group of the threads a task launches (XFN-59).
 import {
   deleteScheduledTaskCustomGroup,
@@ -904,6 +905,16 @@ export const layer = Layer.effect(
           lastRunError,
           runCount: scheduleSource.runCount + 1,
         };
+        // T3-CUSTOM(expbkt3): product analytics for each finished run (TEC-1631).
+        yield* recordScheduledTaskRan({
+          taskId: task.id,
+          scheduleType: scheduleSource.schedule.type,
+          trigger,
+          creationSource: active.creationSource,
+          status: lastRunStatus,
+          durationMs: DateTime.toEpochMillis(completedAt) - DateTime.toEpochMillis(startedAt),
+          ownerUserId: forkOwner,
+        });
         if (current !== null) {
           // startedAtIso in the guard ensures this writes only to the row this
           // run marked as running — a task deleted mid-run and recreated with

apps/server/src/scheduledTasks/webhookRoute.ts

@@ -13,6 +13,7 @@ import * as HttpApiBuilder from "effect/http-api/HttpApiBuilder";
 import * as Metrics from "../observability/Metrics.ts";
 import * as RelayDeliveryProof from "./RelayDeliveryProof.ts";
 import * as ScheduledTaskService from "./ScheduledTaskService.ts";
+import { recordWebhookDelivered } from "../telemetry/serverEvents.ts"; // T3-CUSTOM(expbkt3)
 
 /** Largest request body a webhook accepts. The relay enforces the same cap. */
 export const WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
@@ -111,6 +112,8 @@ export const layer = HttpApiBuilder.group(
                 Effect.as({ _tag: "error" as const }),
               ),
             ),
+            // T3-CUSTOM(expbkt3): product analytics, outcome tag only (TEC-1631).
+            Effect.tap((delivery) => recordWebhookDelivered("scheduled_task", delivery._tag)),
           );
 
         switch (result._tag) {

apps/server/src/server.ts

@@ -89,6 +89,7 @@ import * as SqlitePersistence from "./persistence/Sqlite.ts";
 import * as PullRequestFilesViewed from "./persistence/PullRequestFilesViewed.ts";
 import * as ServerLifecycleEvents from "./serverLifecycleEvents.ts";
 import * as AnalyticsService from "./telemetry/AnalyticsService.ts";
+import * as SessionActivityReactor from "./telemetry/sessionActivity/SessionActivityReactor.ts"; // T3-CUSTOM(expbkt3): TEC-1631.
 import * as ProviderEventIngestor from "./orchestration-v2/ProviderEventIngestor.ts";
 import * as ModelManifest from "./provider/ModelManifest.ts";
 import * as ResetCreditCoordinator from "./provider/resetCreditCoordinator.ts";
@@ -656,6 +657,7 @@ const layerRuntimeCoreDependenciesBase = Layer.mergeAll(
   ProviderUsageLimitsIngestion.layer,
   layerProviderInstallationRefresh,
   ReplayMarkers.layer,
+  SessionActivityReactor.layer, // T3-CUSTOM(expbkt3): session time-in-state metrics (TEC-1631).
 ).pipe(
   // Core Services
   Layer.provideMerge(layerOrchestrationApplication),