fix(telemetry): send browser events to the configured collector and keep logs off the anonymous one by waleedlatif1 · Pull Request #9317 · simstudioai/sim

waleedlatif1 · 2026-10-22T20:57:17Z

Summary

The browser telemetry route (/api/telemetry) read only TELEMETRY_ENDPOINT. A deployment that exports to its own collector through OTEL_EXPORTER_OTLP_ENDPOINT (with auth in OTEL_EXPORTER_OTLP_HEADERS) still posted browser events to the anonymous default, without auth, and each call waited out a 5s timeout when that host was unreachable.
The route ignored NEXT_TELEMETRY_DISABLED, so Docker and Helm installs, which set it by default, still forwarded browser events.
Its spans had no traceId/spanId and used the retired instrumentationLibrarySpans field, which current collectors drop.
Server-side, an install on the anonymous default also exported all server logs and metrics there, beyond the traces the privacy notice in telemetry.config.ts describes.

Changes:

lib/monitoring/otlp.ts: resolveOtlpTarget() (OTEL_EXPORTER_OTLP_ENDPOINT → TELEMETRY_ENDPOINT → configured fallback, plus OTLP headers), isTelemetryDisabled(), the shared normalizeOtlpTracesUrl, and the ANONYMOUS_TELEMETRY_ENDPOINT constant.
Browser events are unauthenticated input, so they never travel with the operator's collector credentials: the route sends them to TELEMETRY_ENDPOINT or the configured anonymous collector (telemetry.config.ts), returns forwarded: false without sending when telemetry is disabled, and emits valid OTLP JSON (scopeSpans, 32-hex trace id, 16-hex span id).
resolveOtlpTarget() never sends OTEL_EXPORTER_OTLP_HEADERS to the anonymous collector, recognizes it by host however the URL is written, and the traces URL is built on the parsed path (query strings kept, trailing slash accepted).
instrumentation-node.ts exports logs and metrics only to a collector the operator configured; on the anonymous endpoint it exports traces only. Explicit empty metricReaders/logRecordProcessors lists, because NodeSDK otherwise builds default OTLP exporters from env.
Self-hosting docs updated for TELEMETRY_ENDPOINT.

Type of Change

Bug fix

Testing

End to end against a real OpenTelemetry Collector (0.114.0, debug exporter), driving the actual POST handler:

With TELEMETRY_ENDPOINT pointing at the collector and an operator collector + Authorization header also configured: forwarded: true, posted to /v1/traces on TELEMETRY_ENDPOINT with no Authorization header, the operator collector never contacted; the collector decoded the span (page_view.view, valid trace/span ids).
With NEXT_TELEMETRY_DISABLED=1: forwarded: false, nothing sent.
The earlier version of the script against current staging failed every enabled-path check (it sent nowhere configured).

Plus biome, check:utils, check:comment-hygiene; type-check and the full audit suite run in CI.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…eep logs off the anonymous one The browser telemetry route read only TELEMETRY_ENDPOINT, so a deployment exporting to its own collector through OTEL_EXPORTER_OTLP_ENDPOINT still posted browser events to the anonymous default, ignored NEXT_TELEMETRY_DISABLED, and built spans without trace or span ids under the retired instrumentationLibrarySpans field. It now resolves the endpoint and headers exactly like the server export, honors the disable flag, and emits valid OTLP. Server logs and metrics are no longer exported to the anonymous collector, which receives traces only.

vercel · 2026-10-22T20:57:24Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 22, 2026 9:53pm UTC

cubic-dev-ai

All reported issues were addressed across 5 files

_{Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.

Turn on auto-fix | Re-trigger cubic}

greptile-apps · 2026-10-22T21:05:52Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new actionable issues were found.

Summary

The PR separates browser and server telemetry destinations and limits what reaches the anonymous collector.

Browser telemetry reaches its configured collector as a readable span.
The server sends logs and metrics only to a collector the operator chose.

The earlier concerns about configured fallbacks, URL paths, anonymous-host detection, and browser-routing docs are addressed.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Browser[Browser event] --> Disabled{Telemetry disabled?}
  Disabled -->|Yes| Skip[Do not forward]
  Disabled -->|No| Relay[TELEMETRY_ENDPOINT or configured fallback]
  Relay --> BrowserTrace[Send trace without operator headers]
  Server[Server telemetry] --> Target[Resolve operator endpoint or fallback]
  Target --> Anonymous{Anonymous collector?}
  Anonymous -->|Yes| Traces[Export traces only without operator headers]
  Anonymous -->|No| AllSignals[Export traces, logs, and metrics with configured headers]

_{Reviews (4) · Last reviewed commit: "fix(telemetry): post browser events to T..." · Reviewed by Greptile}

…point, match it by host OTEL_EXPORTER_OTLP_HEADERS belong to the operator's collector, so they are dropped when the endpoint resolves to the anonymous one; that check now compares hosts, so any spelling of the anonymous URL gets traces only. The browser relay falls back to telemetry.config.ts like the server export, and the traces URL is built on the parsed path, keeping query strings and accepting a trailing slash.

waleedlatif1 · 2026-10-22T21:14:47Z

@greptile

waleedlatif1 · 2026-10-22T21:14:48Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-22T21:14:54Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 5 files

_{Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.

Turn on auto-fix | Re-trigger cubic}

…r events /api/telemetry relays unauthenticated input, so sending it with OTEL_EXPORTER_OTLP_HEADERS let anyone write spans into the operator's authenticated collector. Browser events now go only to TELEMETRY_ENDPOINT or the configured anonymous collector, without credentials; the server's own export keeps using the operator's collector.

waleedlatif1 · 2026-10-22T21:32:46Z

@greptile

waleedlatif1 · 2026-10-22T21:32:47Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-22T21:32:54Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 5 files

_{Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.

Turn on auto-fix | Re-trigger cubic}

…ocument routing per side

waleedlatif1 · 2026-10-22T21:47:24Z

@greptile

waleedlatif1 · 2026-10-22T21:47:25Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-22T21:47:30Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 5 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.

Turn on auto-fix | Re-trigger cubic}

cubic-dev-ai Bot reviewed Oct 22, 2026

View reviewed changes

Comment thread apps/sim/lib/monitoring/otlp.ts Outdated

Comment thread apps/sim/app/api/telemetry/route.ts Outdated

Comment thread apps/sim/lib/monitoring/otlp.ts Outdated

vercel Bot deployed to Preview October 22, 2026 21:03

View deployment

greptile-apps Bot reviewed Oct 22, 2026

View reviewed changes

Comment thread apps/sim/app/api/telemetry/route.ts Outdated

Comment thread apps/sim/app/api/telemetry/route.ts Outdated

Comment thread apps/sim/lib/monitoring/otlp.ts Outdated

vercel Bot temporarily deployed to Preview October 22, 2026 21:14 Inactive

cubic-dev-ai Bot reviewed Oct 22, 2026

View reviewed changes

Comment thread apps/sim/app/api/telemetry/route.ts Outdated

vercel Bot temporarily deployed to Preview October 22, 2026 21:32 Inactive

greptile-apps Bot reviewed Oct 22, 2026

View reviewed changes

Comment thread apps/docs/content/docs/platform/self-hosting/environment-variables.mdx Outdated

cubic-dev-ai Bot reviewed Oct 22, 2026

View reviewed changes

Comment thread apps/sim/app/api/telemetry/route.ts Outdated

fix(telemetry): post browser events to TELEMETRY_ENDPOINT as-is and d…

5610ee0

…ocument routing per side

cubic-dev-ai Bot reviewed Oct 22, 2026

View reviewed changes

vercel Bot deployed to Preview October 22, 2026 21:53

View deployment

waleedlatif1 merged commit 7fcfdf6 into staging Oct 22, 2026
122 of 124 checks passed

This was referenced Oct 22, 2026

v0.9.32: ec2 integration, nextjs minor version bump, logs perf improvements, memory pressure reduced #9320

Merged

docs(telemetry): describe the relay's disable gate and the anonymous endpoint's traces-only export #9321

Merged

waleedlatif1 deleted the fix/telemetry-endpoint branch October 23, 2026 00:24

Conversation

waleedlatif1 commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 22, 2026

Uh oh!

waleedlatif1 commented Oct 22, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 22, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Oct 22, 2026

Uh oh!

waleedlatif1 commented Oct 22, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 22, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Oct 22, 2026

Uh oh!

waleedlatif1 commented Oct 22, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 22, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Oct 22, 2026 •

edited

Loading

vercel Bot commented Oct 22, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Oct 22, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading