You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The categories page described the pre-split contract and treated the default telemetry set as metadata-only. The shipped behavior records submitted Playwright source under default-on control, can include the solved page's host and path under default-on captcha, and moves VM-management traffic to opt-in platform.
This update follows the current producers and public API. It also distinguishes configured CDP exclusions from telemetry_dropped, which should be treated as a loss signal rather than a precise reconstruction of missing events.
Rollout state
The producer and public-contract dependencies are shipped: kernel-images#322 and kernel-images#323 implement the split and CDP classification, kernel#3086 exposes the contract, kernel#3501 forwards the new settings to browser VMs, and kernel#3451 adds dashboard summaries.
Open follow-ups are not documented as available: kernel/cli#231 restores the CLI flags, and kernel#3418 expands the public captcha event union.
Testing
GitHub broken-links check — pass
Mintlify deployment — pass
git diff --check origin/main...HEAD — clean
parsed the updated MDX with Prettier
compared category mappings, CDP phases, redaction, exclusions, loss behavior, and captcha fields against the current producers and public schema
checked the TypeScript and Python examples against the released SDK request types
Not run: interactive mint dev visual validation. The local Mint CLI exits before executing commands in this environment.
Documentation-only MDX update: revises the control category description, documents a new platform category, and corrects the data-sensitivity table / guidance around Playwright code capture and CDP command redaction
No application logic, APIs, auth, infra, config, or schema changes
No CODEOWNERS file present
Risk factors
Factor
Assessment
Codepaths modified
Docs content only
Blast radius
Readers of telemetry category docs
Complexity
Low — prose/table updates
Infrastructure impact
None
Operational / security risk
None in code; content clarifies sensitivity semantics
Decision
Still meets Very Low criteria (documentation-only, small scoped diff, no production logic or shared-system changes). Risk is unchanged from the prior approval, so approval is not revoked and the PR is not re-approved.
Documentation-only MDX update: revises the control category description, documents a new platform category, and corrects the data-sensitivity table / guidance around Playwright code capture and CDP command redaction
No application logic, APIs, auth, infra, config, or schema changes
No CODEOWNERS file present
Risk factors
Factor
Assessment
Codepaths modified
Docs content only
Blast radius
Readers of telemetry category docs
Complexity
Low — prose/table updates
Infrastructure impact
None
Operational / security risk
None in code; content clarifies sensitivity semantics
Decision
Still meets Very Low criteria (documentation-only, small scoped diff, no production logic or shared-system changes). Risk is unchanged from the prior approval, so approval is not revoked and the PR is not re-approved.
#322)
## Summary
- every operation in `openapi.yaml` declares `x-telemetry-category`;
`categorygen` emits the operation → category map next to the event-type
map, so a new endpoint without a classification fails generation instead
of landing somewhere silently
- browser-control operations (computer actions, `executePlaywrightCode`,
screenshot, clipboard) keep emitting `api_call` under `control`;
VM-management operations emit a new `platform_api_call` under a new
`platform` category
- `platform` is opt-in: in `UserCategories`, not `DefaultCategories`, so
enabling telemetry without per-category settings now captures strictly
less than before
- `BrowserApiCallEventData` gains `code`, recorded for
`executePlaywrightCode` and capped by the same helper and constant as
every other captured string
- `operation_id` description corrected — the value on the wire is the
generated handler name (`ProcessExec`), and `categorygen` rejects any
operationId that isn't lowerCamelCase, since that assumption is what
makes the mapping safe
## Why
`api_call` fired for every documented operation and always landed in
`control`. Most of that traffic is the platform acting on the VM, not an
agent acting on the browser: `listRecorders` polling, profile save and
restore (`downloadDirZstd`, `deleteDirectory`, `processExec`), replay
lifecycle, telemetry publishing itself. Reading `control` to see what an
agent did meant paging past all of it, and the one event worth reading —
`executePlaywrightCode` — didn't include the code that ran.
## Classification calls worth a second look
`takeScreenshot` and `readClipboard`/`writeClipboard` are `control`: an
agent uses them to see and to move data. `patchDisplay`,
`chromiumConfigure`, `patchChromiumFlags` and
`uploadExtensionsAndRestart` are `platform` — browser configuration
issued at session setup. `processExec` is `platform` even though a
customer can call it directly, because it isn't browser control. An
operation the generated map doesn't know falls back to `platform`, so an
unclassified route can't dilute the stream callers read to see agent
behavior.
## Sequencing
`control` narrows here with no opt-in path back until the control-plane
half lands (kernel#3086), so anyone reading `control` for profile-save
or replay calls needs `platform` after this release. CDP-level control
events are #323, stacked on this branch and shipping in the same
release. Docs are kernel/docs#474.
## Captured-string cap
`code` reuses what already existed rather than adding a second
convention. `truncateBody` and the 8 KB structured-body cap moved out of
`lib/cdpmonitor` into `lib/events` as `TruncateCaptured` and
`CapturedFieldCap`, so response bodies and submitted source now share
one helper, one constant and one marker (`...[truncated]`), and the
constant carries the reason for its value: three orders of magnitude
below `maxS2RecordBytes`, so no single field can push an envelope past
the record limit and null the whole payload. A clipped value is marked
in the string, so `truncated` on the envelope keeps meaning only what
`truncateIfNeeded` sets it to. The helper had no tests before; it has
them now.
## Generated handler names
`categorygen` no longer derives the handler name from the operationId by
uppercasing the first letter, which assumed how oapi-codegen spells a
name and needed a lowerCamelCase guard to be safe. It now reads the
generated `ServerInterface`, whose methods each document the route they
serve, and joins that to the spec on method and path. Nothing about
naming is assumed, and generation fails if a classified route has no
handler, if a handler has no classification, or if the two counts
disagree. The regenerated map is byte-identical to the derived one.
## Testing
- `make test-unit` — `go vet ./...` clean, unit suite green
- `test-server-unit` green on this commit in CI
- new: unit coverage for `TruncateCaptured` (cap, rune boundary, marker,
sub-marker caps), for the operation → category map, and for the `code`
cap end to end through the middleware
- `categorygen` failure modes exercised by hand: a spec route with no
generated handler, an operation with no `x-telemetry-category`, and a
missing handlers file each exit non-zero with the route named
- e2e not run — needs Docker
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Changes telemetry event shapes, default capture scope, and how API
routes are classified—callers relying on all HTTP calls in `control`
must opt into `platform`; misclassified routes would skew observability
but unclassified routes safely fall back to platform.
>
> **Overview**
> **Splits VM-management HTTP traffic out of the `control` telemetry
stream** so `control` reflects browser-driving calls (computer actions,
Playwright, screenshots, clipboard) while a new **`platform`** category
carries **`platform_api_call`** for recording, FS, process, telemetry
config, Chromium setup, and similar.
>
> Each OpenAPI operation now declares **`x-telemetry-category`**.
**`categorygen`** builds both event-type and operation→category maps by
joining the spec to the generated **`ServerInterface`** route comments
(not derived operationId spelling). CI runs **`go generate`** and fails
if **`category_gen.go`** is stale. Unmapped operations **default to
platform** so they cannot pollute `control`.
>
> **`ExecutePlaywrightCode`** calls **`RecordTelemetryCode`**; submitted
source appears on **`api_call`** as optional **`code`**, capped via
shared **`events.TruncateCaptured`** / **`CapturedFieldCap`** (CDP body
capture uses the same helper). Telemetry middleware stays enabled when
**either** `control` or **`platform`** is captured.
>
> Default telemetry categories **exclude `platform`** (opt-in). OpenAPI
and generated types add **`BrowserPlatformApiCallEvent`** and config
knobs for **`platform`**.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
0a64ebd. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk assessment: Very Low
Verdict: No action needed — prior approval remains valid (risk did not increase).
Re-evaluation after synchronize
Previous automation approval was on 778a23a9. Current head is bdfb874 (merge of main into the PR branch). Re-assessed the updated three-dot diff against main.
Documentation-only MDX update: revises the control category description, documents a new platform category, and corrects the data-sensitivity table / guidance around Playwright code capture and CDP command redaction
The latest synchronize is a merge of main; it does not add further files or production logic beyond the existing docs change
No application logic, APIs, auth, infra, config, or schema changes
No CODEOWNERS file present
Risk factors
Factor
Assessment
Codepaths modified
Docs content only
Blast radius
Readers of telemetry category docs
Complexity
Low — prose/table updates
Infrastructure impact
None
Operational / security risk
None in code; content clarifies sensitivity semantics
Decision
Still meets Very Low criteria (documentation-only, small scoped diff, no production logic or shared-system changes). Risk is unchanged from the prior approval, so approval is not revoked and the PR is not re-approved.
archandatta
changed the title
Document the platform category and correct control's sensitivity
Document current browser telemetry categories
Aug 25, 2026
Documentation-only MDX update: documents the control / platform category split, CDP command phases and control.cdp.excluded_methods examples, proxy_error / page_crashed event types, and corrected sensitivity guidance for Playwright source and sanitized CDP arguments
The added TypeScript and Python snippets are docs examples only; they do not change product code, APIs, auth, infra, config, or schema
No CODEOWNERS file present
Risk factors
Factor
Assessment
Codepaths modified
Docs content only
Blast radius
Readers of telemetry category docs
Complexity
Low — prose, table, and example updates
Infrastructure impact
None
Operational / security risk
None in code; content documents existing telemetry sensitivity
Decision
Still meets Very Low criteria (documentation-only, scoped to a single MDX page, no production logic or shared-system changes). The diff is larger than the previously approved revision, but the change type is unchanged. Risk did not increase, so approval is not revoked and the PR is not re-approved.
Documentation-only MDX update: documents the control / platform category split, CDP command phases and control.cdp.excluded_methods examples, proxy_error / page_crashed event types, and corrected sensitivity guidance for Playwright source and sanitized CDP arguments
The TypeScript and Python snippets are docs examples only; they do not change product code, APIs, auth, infra, config, or schema
No CODEOWNERS file present
Risk factors
Factor
Assessment
Codepaths modified
Docs content only
Blast radius
Readers of telemetry category docs
Complexity
Low — prose, table, and example updates
Infrastructure impact
None
Operational / security risk
None in code; content documents existing telemetry sensitivity
Decision
Still meets Very Low criteria (documentation-only, scoped to a single MDX page, no production logic or shared-system changes). Head is fc4786d8; GitHub already records an approval from this automation. Risk did not increase, so approval is not revoked and the PR is not re-approved.
The reason will be displayed to describe this comment to others. Learn more.
p1 "The default set avoids page content" is inaccurate. captcha is default-on and captcha_solve_result carries website_host and website_path, the host and path of the page the captcha was solved on. The sensitivity table still lists captcha under "Session metadata only ... No page content". Pre-existing, restated by this rewrite.
p2 The telemetry_dropped sentence contradicts the API reference this page links to, which describes the field as "an upper bound on lost commands rather than a count ... which may be library traffic that would have produced no event". The producer filters unsupported and excluded methods before the queue check, so this page matches the implementation and the reference text is stale.
p2 The platform row omits extension upload (UploadExtensions, UploadExtensionsAndRestart) and display configuration (PatchDisplay), both mapped to platform.
`control` previously included every in-VM API call. It now covers actions that drive the browser and supported commands sent over the CDP proxy, while VM-management calls emit `platform_api_call` under the opt-in `platform` category.
Document the current command phases, configurable exclusions and loss signal; cover extension uploads and display configuration; add the public `proxy_error` and `page_crashed` event types; and correct the sensitivity guidance for Playwright source, sanitized CDP arguments and captcha page locations.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Documentation-only MDX update: documents the control / platform category split, CDP command phases and control.cdp.excluded_methods examples, proxy_error / page_crashed event types, and corrected sensitivity guidance for Playwright source, sanitized CDP arguments, and captcha host/path
The TypeScript and Python snippets are docs examples only; they do not change product code, APIs, auth, infra, config, or schema
Incremental change vs last assessed head is prose-only on the same page (platform/display/extension wording, telemetry_dropped guidance, captcha sensitivity row)
No CODEOWNERS file present
Risk factors
Factor
Assessment
Codepaths modified
Docs content only
Blast radius
Readers of telemetry category docs
Complexity
Low — prose, table, and example updates
Infrastructure impact
None
Operational / security risk
None in code; content documents existing telemetry sensitivity
Decision
Still meets Very Low criteria (documentation-only, scoped to a single MDX page, no production logic or shared-system changes). Head is f2bafd5; GitHub already records an approval from this automation. Risk did not increase, so approval is not revoked and the PR is not re-approved.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Sayan-
left a comment
Summary
control/platformtelemetry split, including display configuration and extension uploadscdp_commandcoverage, method exclusions, and telemetry-loss signalsproxy_errorandpage_crashedevents while preserving the 30-day retention guidance from Document 30-day retention for telemetry events #509Why
The categories page described the pre-split contract and treated the default telemetry set as metadata-only. The shipped behavior records submitted Playwright source under default-on
control, can include the solved page's host and path under default-oncaptcha, and moves VM-management traffic to opt-inplatform.This update follows the current producers and public API. It also distinguishes configured CDP exclusions from
telemetry_dropped, which should be treated as a loss signal rather than a precise reconstruction of missing events.Rollout state
The producer and public-contract dependencies are shipped: kernel-images#322 and kernel-images#323 implement the split and CDP classification, kernel#3086 exposes the contract, kernel#3501 forwards the new settings to browser VMs, and kernel#3451 adds dashboard summaries.
Open follow-ups are not documented as available: kernel/cli#231 restores the CLI flags, and kernel#3418 expands the public captcha event union.
Testing
broken-linkscheck — passgit diff --check origin/main...HEAD— cleanNot run: interactive
mint devvisual validation. The local Mint CLI exits before executing commands in this environment.