. opt_out_capturing_by_default: false }; // ---- Stitch the SESSION too, not just the identity ---- // The edge derives $session_id from the same anon cookie and a 30-minute // window, so the browser has to agree or the same visit is counted as two // sessions. This path matters most: it is the one a returning consented // visitor takes. // // Duplicated from lib/analytics/session-id.ts because this is an inline // string and cannot import. A server-computed literal is NOT an // option — prerendered HTML is shared between visitors, so baking one // visitor's session id into the markup would hand it to everyone. The two // implementations are held in step by __tests__/unit/posthog-snippet-session.test.ts, // which evaluates this very snippet and asserts it agrees with the module // across a range of inputs. Change one, change both, or that test fails. function taocSessionId(id, nowMs) { var WINDOW = 1800000; var windowStart = Math.floor(nowMs / WINDOW) * WINDOW; var seedInput = id + ':' + windowStart; var hash = 0x811c9dc5; for (var i = 0; i < seedInput.length; i++) { hash ^= seedInput.charCodeAt(i); hash = (hash + (hash << 1) + (hash << 4) + (hash << 7) + (hash << 8) + (hash << 24)) >>> 0; } var state = hash === 0 ? 0x9e3779b9 : hash; var hex = ''; while (hex.length < 18) { state = state >>> 0; state ^= state << 13; state >>>= 0; state ^= state >>> 17; state ^= state << 5; state >>>= 0; hex += state.toString(16).padStart(8, '0'); } hex = hex.slice(0, 18); var tsHex = windowStart.toString(16).padStart(12, '0').slice(-12); var variant = ((parseInt(hex[3], 16) & 0x3) | 0x8).toString(16); return tsHex.slice(0, 8) + '-' + tsHex.slice(8, 12) + '-7' + hex.slice(0, 3) + '-' + variant + hex.slice(4, 7) + '-' + hex.slice(7, 19).padEnd(12, '0'); } if (anonId) { opts.bootstrap = { distinctID: anonId, isIdentifiedID: false, sessionID: taocSessionId(anonId, Date.now()) }; } window.posthog.init("phc_mw955pmzZPS2e6DXCwtErgJEjboqL7XsvJR7PfXU4HCQ", opts); // Mirror the edge worker's taoc_client_class. Reaching this line means // JavaScript ran, which is the strongest human signal we have — so the // snippet path registers the same super property the npm path does // (lib/analytics/posthog.ts), keeping the project-level crawler filter // meaningful on client events too. try { window.posthog.register({ taoc_client_class: 'human-candidate' }); } catch (e) { /* non-fatal */ } // ---- TTFB + server-timing breakdown (Navigation Timing API) ---- // posthog-js only collects LCP/CLS/FCP/INP web vitals — it has no TTFB // collector. TTFB is the missing signal needed to split server response // time from client render when triaging slow FCP/LCP pages (see the // PostHog web-vitals analysis, 2026-06: homepage FCP p50 ~2s / p90 ~5.5s, // unattributable without TTFB). We emit one custom 'web_vitals_navigation' // event per initial document load. $current_url / $pathname are attached // automatically by posthog, so it joins the same per-path analysis as the // native $web_vitals events. Consent is already granted at this point. try { var emitNav = function(){ try { var nav = (performance && performance.getEntriesByType && performance.getEntriesByType('navigation')[0]) || null; if (!nav || !nav.responseStart) return; window.posthog.capture('web_vitals_navigation', { // Match the $web_vitals__value convention so TTFB sits // alongside the native metrics in HogQL. $web_vitals_TTFB_value: Math.round(nav.responseStart), ttfb_ms: Math.round(nav.responseStart), request_wait_ms: Math.round(nav.responseStart - nav.requestStart), response_download_ms: Math.round(nav.responseEnd - nav.responseStart), dom_interactive_ms: Math.round(nav.domInteractive), dom_content_loaded_ms: Math.round(nav.domContentLoadedEventEnd), lo

Agent Systems

Daily Sync: August 16, 2026

Want to contribute?