protect session id and mint before first window

Author: charlesvien

apps/code/src/main/services/posthog-analytics.test.ts

@@ -97,4 +97,13 @@ describe("posthog-analytics", () => {
       }),
     );
   });
+
+  it("stamps the main-owned session id and ignores a caller override", () => {
+    captureException(new Error("boom"), { $session_id: "spoofed" });
+
+    const props = mockCaptureException.mock.calls.at(-1)?.[2];
+    expect(props.$session_id).toMatch(
+      /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,
+    );
+  });
 });

apps/code/src/main/services/posthog-analytics.ts

@@ -23,6 +23,11 @@ export function initializePostHog() {
     enableExceptionAutocapture: true,
   });
 
+  // Mint the main-owned session id now, before the first window, so crash
+  // handlers can stamp $session_id even when the renderer crashes during
+  // startup (before it fetches the id to bootstrap posthog-js).
+  getOrCreateSessionId();
+
   return posthogClient;
 }
 
@@ -121,8 +126,10 @@ export function captureException(
   const distinctId = currentUserId || "anonymous-app-event";
   posthogClient.captureException(error, distinctId, {
     team: "posthog-code",
-    ...(sessionId ? { $session_id: sessionId } : {}),
     ...additionalProperties,
+    // System-owned fields last so callers can't overwrite them: main owns the
+    // session id used for crash->replay linking.
+    ...(sessionId ? { $session_id: sessionId } : {}),
     app_version: getAppVersion(),
   });
 }