fix(telemetry): carry website anonymous identity into Desktop (GTM-277)

Author: benceruleanlu

packages/comfyui-desktop-bridge-types/comfyDesktopBridge.d.ts

@@ -29,6 +29,14 @@ export interface LogsOutputMsg {
 }
 export type ComfyDesktop2TelemetryValue = string | number | boolean | null;
 export type ComfyDesktop2TelemetryProperties = Record<string, ComfyDesktop2TelemetryValue | ComfyDesktop2TelemetryValue[]>;
+export type ComfyDesktop2FirebaseAuthState = {
+    status: 'pending';
+} | {
+    status: 'signed_out';
+} | {
+    status: 'signed_in';
+    userId: string;
+};
 export interface ComfyDesktop2TerminalBridge {
     subscribe(installationId?: string): Promise<TerminalRestore>;
     unsubscribe(installationId?: string): Promise<void>;
@@ -47,6 +55,8 @@ export interface ComfyDesktop2LogsBridge {
 }
 export interface ComfyDesktop2TelemetryBridge {
     capture(event: string, properties?: ComfyDesktop2TelemetryProperties): void;
+    /** Report the hosted view's complete Firebase state for process-wide consensus. */
+    reportFirebaseAuthState?(state: ComfyDesktop2FirebaseAuthState): void;
 }
 export interface ComfyDesktop2Bridge {
     isRemote(): boolean;

packages/comfyui-desktop-bridge-types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@comfyorg/comfyui-desktop-bridge-types",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "TypeScript definitions for the Comfy Desktop hosted frontend bridge",
   "type": "module",
   "main": "./index.js",

scripts/installer.nsh

@@ -242,60 +242,61 @@
   Pop $1
 !macroend
 
-!macro persistDownloadTokenFromInstallerName
+!macro persistWebsiteAnonymousIdFromInstallerName
   Push $R0
   Push $R1
   Push $R2
   Push $R3
   Push $R4
   Push $R5
 
-  ; Windows MVP for GTM-104: the website/download proxy can serve the same
-  ; signed installer binary with a tokenized Content-Disposition filename, e.g.
-  ; Comfy-Desktop-dt_AbC123xYz789.exe. Persist only the 12-char opaque token;
-  ; the app validates the exact token shape before sending anything to telemetry.
+  ; GTM-277 direct website identity carrier. The Router serves the signed
+  ; installer as:
   ;
-  ; The "dt_" search is done inline with StrCpy rather than StrFunc's ${StrStr}:
-  ; StrFunc emits a standalone install function at include time, and electron-
-  ; builder compiles this script a second time for the uninstaller (where the
-  ; customInstall call site is not emitted). In that pass StrStr is unreferenced,
-  ; which trips NSIS warning 6010 — fatal under the release builder's -WX.
-  ${GetBaseName} "$EXEPATH" $R0
+  ;   Comfy-Desktop-Setup-phid1_<payload>.exe
+  ;
+  ; where payload is unpadded RFC 4648 base64url of the website PostHog
+  ; $device_id's exact UTF-8 bytes (1..160 bytes, therefore 2..214 chars).
+  ; Persist only the filename-safe payload. Desktop performs strict alphabet,
+  ; length, canonical base64url, and UTF-8 validation before adopting it.
+  ; Renamed/malformed installers simply have no carrier.
+  SetShellVarContext current
+  StrCpy $R2 "$APPDATA\Comfy Desktop"
+  ; The current installer filename is authoritative. A plain or malformed
+  ; installer must not leave a valid carrier from an earlier unlaunched setup.
+  Delete "$R2\pending-website-anonymous-id.txt"
+
+  ${GetFileName} "$EXEPATH" $R0
   StrLen $R5 "$R0"
-
-  StrCpy $R1 0
   StrCpy $R4 ""
-  ${Do}
-    IntOp $R3 $R1 + 3
-    ${If} $R3 > $R5
-      ${ExitDo}
-    ${EndIf}
-    StrCpy $R3 "$R0" 3 $R1
-    ; S== is case-sensitive (LogicLib == is case-insensitive StrCmp); the proxy
-    ; emits a lowercase "dt_" marker, matching StrFunc's case-sensitive StrStr.
-    ${If} $R3 S== "dt_"
-      IntOp $R3 $R1 + 3
-      StrCpy $R4 "$R0" 12 $R3
-      ${ExitDo}
+
+  ; Exact case-sensitive grammar. Prefix is 26 chars and extension is 4;
+  ; complete filenames are 32..244 chars inclusive.
+  ${If} $R5 >= 32
+  ${AndIf} $R5 <= 244
+    StrCpy $R1 "$R0" 26
+    StrCpy $R3 "$R0" 4 -4
+    ${If} $R1 S== "Comfy-Desktop-Setup-phid1_"
+    ${AndIf} $R3 S== ".exe"
+      IntOp $R3 $R5 - 30
+      StrCpy $R4 "$R0" $R3 26
     ${EndIf}
-    IntOp $R1 $R1 + 1
-  ${Loop}
+  ${EndIf}
 
   StrLen $R3 "$R4"
-  ${If} $R3 == 12
+  ${If} $R3 >= 2
+  ${AndIf} $R3 <= 214
     ; Matches Electron's packaged userData path documented in README:
     ; %APPDATA%\Comfy Desktop.
-    SetShellVarContext current
-    StrCpy $R2 "$APPDATA\Comfy Desktop"
     CreateDirectory "$R2"
     ClearErrors
-    FileOpen $R3 "$R2\pending-download-token.txt" w
+    FileOpen $R3 "$R2\pending-website-anonymous-id.txt" w
     ${IfNot} ${Errors}
       FileWrite $R3 "$R4$\r$\n"
       FileClose $R3
-      DetailPrint "  Download attribution token stored."
+      DetailPrint "  Website attribution identity stored."
     ${Else}
-      DetailPrint "  Download attribution token could not be stored."
+      DetailPrint "  Website attribution identity could not be stored."
     ${EndIf}
   ${EndIf}
 
@@ -322,7 +323,7 @@
   ; like an install log instead of jumping from "Step 2 — Extracting…"
   ; straight to the Finish page.
   SetDetailsPrint both
-  !insertmacro persistDownloadTokenFromInstallerName
+  !insertmacro persistWebsiteAnonymousIdFromInstallerName
   DetailPrint "  Application files installed to: $INSTDIR"
   DetailPrint "  Registered with Add or Remove Programs"
   DetailPrint "  Start Menu shortcut created"

src/main/auth/firebaseBridge/index.ts

@@ -14,54 +14,6 @@ import * as i18n from '../../lib/i18n'
 import * as mainTelemetry from '../../lib/telemetry'
 import { extractErrorClass } from '../../../shared/errorEvent'
 
-/**
- * Tie the anonymous `installation_id` to the signed-in user so PostHog
- * merges the two identities. Both auth paths (Google server-side,
- * GitHub popup) converge on the resolved Firebase `user` record, so this
- * is the single hook that covers every sign-in.
- *
- * Person properties shipped:
- *   - `email` — raw address. Industry-standard for product analytics
- *     and the only practical way to support "what did <person> do"
- *     lookups for support / debugging without a two-system round-trip
- *     through Firebase Admin. PostHog's `$email` field also lights up
- *     the person card with an avatar + email so persons-view search
- *     by email works as expected.
- *   - `email_domain` — cohort filter (e.g. comfy.org A/B targeting).
- *     Kept alongside the raw email so existing filters / experiments
- *     don't have to derive it at query time.
- *   - `signed_in_via: 'desktop_2'` — every event from this person from
- *     here on inherits this, so cloud-side events (when the user later
- *     interacts with the embedded cloud workspace) are attributable to
- *     a desktop-originated sign-in. Covers the case where the OAuth
- *     flow itself runs in the system browser (no cloud.comfy.org
- *     pageview during auth, so utm_source alone can't carry it).
- *   - `signed_in_at_ms` — epoch-ms of the most recent sign-in. Useful
- *     for "users who signed in within the last N days" cohorts.
- *
- * `bindUserId` is consent-gated downstream — a user who declined
- * telemetry binds nothing. Wrapped so a telemetry failure can never
- * break the auth flow.
- */
-function bindSignedInUser(user: Record<string, unknown>): void {
-  try {
-    const uid = typeof user.uid === 'string' && user.uid.length > 0 ? user.uid : null
-    if (!uid) return
-    const email = typeof user.email === 'string' && user.email.length > 0 ? user.email : null
-    const at = email ? email.lastIndexOf('@') : -1
-    const emailDomain = at >= 0 ? email!.slice(at + 1).toLowerCase() : null
-    const properties: Record<string, string | number> = {
-      signed_in_via: 'desktop_2',
-      signed_in_at_ms: Date.now()
-    }
-    if (email) properties.email = email
-    if (emailDomain) properties.email_domain = emailDomain
-    mainTelemetry.bindUserId(uid, properties)
-  } catch {
-    // telemetry must never break the auth flow
-  }
-}
-
 export { extractProviderId, isFirebaseAuthHandlerUrl } from './intercept'
 
 export interface HandleFirebasePopupOpts {
@@ -183,8 +135,8 @@ export async function handleFirebasePopup(
     return
   }
   // Sign-in funnel: started -> (app:user_logged_in | auth.sign_in_failed).
-  // `provider` splits Google vs GitHub conversion + failure rates. The
-  // success leg is emitted by bindSignedInUser's app:user_logged_in.
+  // `provider` splits Google vs GitHub conversion + failure rates. The success
+  // leg fires after the reloaded hosted view reports Firebase consensus.
   mainTelemetry.capture('comfy.desktop.auth.sign_in_started', { provider: providerId })
   const env = detectFirebaseEnv(url)
 
@@ -223,10 +175,6 @@ export async function handleFirebasePopup(
     // the Cloud view so users can finish sign-in in a non-default browser.
     showCopyLinkBanner(comfyContents, loginUrl)
     const { user, apiKey } = await handle.signInPromise
-    // Bind PostHog identity as soon as we have the user — independent of
-    // the embedded-view reload below, so the merge happens even if the
-    // window is torn down before the reload completes.
-    bindSignedInUser(user)
     if (comfyContents.isDestroyed()) return
     // Hold for a beat so the user actually sees the "You're signed in"
     // page (with its synchronised countdown) before we yank focus back

src/main/host/attach.ts

@@ -12,6 +12,10 @@ import { noteCloudEntered } from '../lib/cloudEntry'
 import { noteCanvasRendered } from '../lib/canvasEntry'
 import { forwardDatadogError } from '../lib/processErrorHandlers'
 import { recordInstanceSurface } from '../lib/lastSession'
+import {
+  activateFirebaseAuthReporter,
+  deactivateFirebaseAuthReporter
+} from '../lib/firebaseAuthIdentity'
 import { convertLevelToZoomPercent } from '../lib/zoom'
 import { clearPendingTemplateOpen, installationEvents, type InstallationRecord } from '../installations'
 import { buildTemplateDeeplink } from '../sources/standalone/curatedTemplates'
@@ -139,6 +143,7 @@ export function attachInstall(entry: ComfyWindowEntry, opts: AttachInstallOpts):
   const comfyContents = entry.comfyView.webContents
   const comfyWindow = entry.window
   const titleBarView = entry.titleBarView
+  activateFirebaseAuthReporter(comfyContents)
 
   // Seed entry install state. The secondary index is the source of
   // truth for `getEntryByInstallationId(id)` — keep it in lockstep
@@ -626,6 +631,7 @@ export function attachInstall(entry: ComfyWindowEntry, opts: AttachInstallOpts):
   entry._installCleanup = (): void => {
     if (entry._installCleanup === null) return
     entry._installCleanup = null
+    deactivateFirebaseAuthReporter(comfyContents)
     installationEvents.off('updated', onInstallationUpdated)
     cancelFailRetry()
     if (!comfyContents.isDestroyed()) {

src/main/host/createHostWindow.ts

@@ -28,6 +28,7 @@ import {
 } from '../lib/ipc/shared'
 import * as mainTelemetry from '../lib/telemetry'
 import { getUserTier } from '../lib/userTier'
+import { trackFirebaseAuthReporter } from '../lib/firebaseAuthIdentity'
 import { forwardDatadogError } from '../lib/processErrorHandlers'
 import { recordDashboardSurface, recordInstanceSurface } from '../lib/lastSession'
 import * as settings from '../settings'
@@ -1136,6 +1137,7 @@ export function buildComfyView(
   comfyView.setBackgroundColor(COMFY_BG)
 
   const comfyContents = comfyView.webContents
+  trackFirebaseAuthReporter(comfyContents)
   // Eagerly attach the will-download handler to the comfy view's
   // session so any `session.downloadURL(...)` call below — or a server-
   // initiated `Content-Disposition: attachment` response — flows

src/main/index.ts

@@ -82,18 +82,14 @@ import { AUTO_LAUNCH_NONE } from './settings'
 import { lookupInstallUpdateOverride, recordIpcInvocation } from './lib/e2eOverrides'
 import * as mainTelemetry from './lib/telemetry'
 import {
-  clearPendingDownloadToken,
-  markDownloadTokenAttributed,
-  readPendingDownloadToken
-} from './lib/downloadAttribution'
-import {
-  clearPendingAlias,
+  clearLegacyIdentityRetryMarker,
   consumeFirstLaunch,
   getDeviceId,
   getIdClass,
   initDeviceId,
   markIdentityMigrationCompleted
 } from './lib/deviceId'
+import { getInitialAnonymousDistinctId } from './lib/websiteAnonymousIdentity'
 import { initExperiments } from './lib/experiments'
 import { initCloudCapacity } from './lib/cloudCapacity'
 import { initUserTier } from './lib/userTier'
@@ -1414,21 +1410,21 @@ if (app.isPackaged && !app.requestSingleInstanceLock()) {
     mainTelemetry.setConsentState(initialConsent)
     mainTelemetry.installAppHooks()
 
-    // Initialize the deterministic device identity. Replaces the legacy
-    // random-UUID device-id.txt with SHA-256(machine_id + salt) so the id
-    // survives a clean reinstall and can be matched against the same hash
-    // computed by other Comfy products on the same machine. The legacy id,
-    // if any, is persisted in pending-identity-alias.txt by initDeviceId
-    // so a denied / undecided consent state at first boot does not lose
-    // the migration — it ships on the next consent-grant transition.
+    // Initialize installation metadata, then bind a separate persisted random
+    // PostHog anonymous id. installation_id is never used as an identity.
     const { legacyId } = await initDeviceId()
+    // Desktop no longer performs legacy PostHog aliases. Remove any retry
+    // marker left by an older build, including when its migration guard exists.
+    clearLegacyIdentityRetryMarker()
     const installationId = getDeviceId()
-
-    // Bind the anonymous distinct id before any capture runs. Does NOT
-    // `$identify` the installation_id (that would block the login stitch —
-    // see identity model in lib/telemetry.ts); the props below ship as a
-    // capture-`$set`.
-    mainTelemetry.identify(installationId, {
+    // A fresh Windows install can inherit the exact anonymous PostHog
+    // $device_id W carried in the Router's Content-Disposition filename. The
+    // installer stores only its filename-safe payload; this resolves and
+    // durably persists W before any capture. Existing Desktop state wins, and
+    // missing/invalid carriers fall back to a persisted/generated random D.
+    const anonymousDistinctId = getInitialAnonymousDistinctId()
+
+    mainTelemetry.bindAnonymousId(anonymousDistinctId, installationId, {
       app_version: APP_VERSION,
       platform: process.platform,
       arch: process.arch,
@@ -1442,42 +1438,18 @@ if (app.isPackaged && !app.requestSingleInstanceLock()) {
     mainTelemetry.registerPersonProperties(settings.getTrackedSettingsTelemetryProperties())
 
     const isFirstLaunch = consumeFirstLaunch()
-    const pendingDownloadToken = readPendingDownloadToken()
-    if (pendingDownloadToken) {
-      mainTelemetry.deferDownloadTokenAlias({
-        downloadToken: pendingDownloadToken.token,
-        installationId,
-        source: pendingDownloadToken.source,
-        attachToFirstLaunch: isFirstLaunch,
-        onAliased: () => {
-          clearPendingDownloadToken()
-          markDownloadTokenAttributed()
-        }
-      })
-    }
-
     if (legacyId) {
-      // Queue the alias instead of awaiting it on the boot critical path.
-      // - Fires as soon as consent is granted (synchronously if already so,
-      //   on the next setConsentState('granted') transition otherwise).
-      // - Persisted pending-alias file (in deviceId.ts) is the source of
-      //   truth across boots — clear it AND mark migration complete only
-      //   inside the onAliased callback so a denied user does not skip the
-      //   alias permanently.
-      mainTelemetry.deferMigrationAlias({
-        legacyId,
-        installationId,
-        idClass: getIdClass(),
-        onAliased: () => {
-          clearPendingAlias()
-          markIdentityMigrationCompleted()
-        }
-      })
+      // Historical random installation ids are reconciled directly in
+      // PostHog, not by Desktop alias writes. Complete only the local migration.
+      markIdentityMigrationCompleted()
     }
 
     // Boot the experiments cache. Synchronously loads the on-disk flag
     // values for `getFlag()`, then kicks off a background refresh whose
     // result lands on disk for the NEXT boot. Does not block boot.
+    // Flag evaluation uses the installation-stable property key only. It never
+    // captures or identifies this value, so W/D rotation cannot change an
+    // experiment arm or create a PostHog person.
     void initExperiments({
       distinctId: installationId,
       personProperties: {