add amplitude SDK to extension by leofelix077 · Pull Request #2659 · stellar/freighter

leofelix077 · 2026-03-23T15:06:06Z

Screen.Recording.2026-03-23.at.12.07.09.mov

Screen.Recording.2026-03-23.at.12.08.00.mov

socket-security · 2026-03-23T15:06:53Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@amplitude/analytics-browser@2.37.0

View full report

socket-security · 2026-03-23T15:06:54Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@amplitude/plugin-custom-enrichment-browser` is 98.0% likely obfuscated Confidence: 0.98 Location: Package overview From: `?` → `npm/@amplitude/analytics-browser@2.37.0` → `npm/@amplitude/plugin-custom-enrichment-browser@0.1.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@amplitude/plugin-custom-enrichment-browser@0.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

extension/src/helpers/metrics.ts

Copilot

Pull request overview

This PR integrates the Amplitude browser SDK into the extension’s analytics pipeline, refactors metric emission to use the SDK (with opt-out support), and adds a development-only analytics debug panel to inspect recent events/state.

Changes:

Add @amplitude/analytics-browser and migrate emitMetric to Amplitude SDK-based tracking with common context, opt-out syncing, and popup-close flushing.
Introduce an Analytics Debug section on the Debug page that displays SDK state plus a dev-only localStorage-backed recent-events buffer.
Adjust webpack env wiring to centralize DefinePlugin values and inject APP_VERSION / BUILD_TYPE for analytics context.

Reviewed changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
yarn.lock	Locks Amplitude SDK and transitive deps.
extension/package.json	Adds `@amplitude/analytics-browser` dependency.
extension/webpack.common.js	Centralizes DefinePlugin values; injects `APP_VERSION` and `BUILD_TYPE`.
extension/webpack.extension.js	Routes `DEV_SERVER` / `DEV_EXTENSION` into common config via merged env.
extension/webpack.dev.js	Passes `.env` AMPLITUDE_KEY into common config env and converts dev config to a factory.
extension/src/constants/env.ts	Adds typed `APP_VERSION` and `BUILD_TYPE` globals exported for analytics.
extension/src/constants/localStorageTypes.ts	Adds `DEBUG_ANALYTICS_EVENTS` localStorage key constant.
extension/src/helpers/metrics.ts	Replaces manual HTTP upload with Amplitude SDK; adds debug snapshots/subscriptions and recent-event buffer.
extension/src/popup/App.tsx	Initializes Amplitude at popup startup.
extension/src/popup/views/Debug.tsx	Adds Analytics Debug UI (SDK status + recent events) using `useSyncExternalStore`.
extension/src/popup/views/Debug/styles.scss	Styles for analytics debug status + events list.
extension/src/popup/views/Swap/index.tsx	Emits screen-view metrics once per step transition.
extension/src/popup/views/Send/index.tsx	Emits screen-view metrics once per step transition.
extension/src/popup/views/FullscreenSuccessMessage/index.tsx	Moves metric emission into a mount-only effect.
extension/src/popup/components/manageAssets/TrustlineError/index.tsx	Prevents repeated metric emission by adding empty deps array.
extension/src/popup/components/ErrorTracking/index.tsx	Broadens Sentry denyUrls to suppress Amplitude SDK network noise.
extension/src/popup/constants/metricsNames.ts	Adds `swapAmountReview` metric name.
extension/src/popup/locales/en/translation.json	Adds strings for analytics debug UI.
extension/src/popup/locales/pt/translation.json	Adds Portuguese strings for analytics debug UI.
extension/src/popup/views/tests/SignTransaction.test.tsx	Updates metrics helper mocks for new exports.
extension/src/popup/views/tests/Account.test.tsx	Updates metrics helper mocks for new exports.
config/jest/setupTests.tsx	Adds Amplitude SDK mock and expands metrics helper mock surface.
extension/README.md	Documents the dev-only Analytics Debug panel and behavior.
extension/.env.example	Adds example env file and notes for AMPLITUDE_KEY usage.
.github/workflows/submitBeta.yml	Attempts to pass AMPLITUDE_KEY/SENTRY_KEY at build time (currently broken YAML).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.github/workflows/submitBeta.yml

extension/src/helpers/metrics.ts

Copilot

Pull request overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-23T15:24:17Z

extension/src/helpers/metrics.ts

+let recentEventsSnapshot: DebugEvent[] = [];
+let debugListeners: Array<() => void> = [];
+


getRecentEvents() returns recentEventsSnapshot, but that snapshot is initialized as [] and never populated from localStorage on startup. As a result, the Analytics Debug panel won't show persisted events after a refresh/reopen until a new event is emitted (or a storage event fires from another tab), which contradicts the README behavior. Consider initializing recentEventsSnapshot from readPersistedEvents() at module load (dev-only), or calling invalidateSnapshot() when the first subscriber registers / on first getRecentEvents() call.

extension/src/helpers/metrics.ts

extension/webpack.common.js

piyalbasu · 2026-03-24T16:44:43Z

extension/src/helpers/metrics.ts

+ * Returns first 8 + last 4 chars (e.g. "GABCDEFG…WXYZ"), which is enough
+ * for session correlation without storing the full address.
+ */
+const truncatePublicKey = (publicKey: string): string =>


we actually already have a helper for this one in freighter/extension/src/helpers/stellar.ts called truncatedPublicKey

piyalbasu · 2026-03-24T16:57:54Z

extension/src/helpers/metrics.ts

+
+// Initialize the snapshot from localStorage so the debug panel shows
+// persisted events immediately after a page refresh (dev only).
+let recentEventsSnapshot: DebugEvent[] = isDev ? readPersistedEvents() : [];


I see that we're adding a debug screen for dev environments that records the last 50 analytics calls. Can I ask what problem we're solving by implementing this? I don't necessarily think it's wrong! It just seems like we're adding a lot of code for a feature that we haven't discussed or prioritized as a team

piyalbasu · 2026-03-24T17:03:10Z

extension/src/helpers/metrics.ts

+      // We manage the user ID ourselves via `getUserId()` + localStorage so that
+      // we control the identifier format and lifecycle. Amplitude's default
+      // identity storage would create a second, SDK-managed identifier that could
+      // conflict with ours and is unnecessary given we call setUserId() manually.


hm, what is the benefit to us handling this ourselves rather than letting the SDK do it for us?

piyalbasu · 2026-03-24T17:12:16Z

extension/src/helpers/metrics.ts

+
+  // Firefox extensions (browser.* API)
+  const browserVersion = g?.browser?.runtime?.getManifest?.()?.version;
+  if (browserVersion) return browserVersion;


the browser lib should work for all browsers (including Chrome). You shouldn't need to distinguish between Chrome and Firefox

piyalbasu · 2026-03-24T17:12:53Z

extension/src/helpers/metrics.ts

+  if (browserVersion) return browserVersion;
+
+  // Dev server or unknown environment — use build-time constant
+  return APP_VERSION;


Why not try this first? There should be an APP_VERSION in almost all scenarios

piyalbasu · 2026-03-24T17:14:20Z

extension/src/popup/views/Swap/index.tsx

+      [STEPS.AMOUNT]: METRIC_NAMES.swapAmount,
+      [STEPS.CONFIRM_AMOUNT]: METRIC_NAMES.swapAmountReview,
+      [STEPS.SET_FROM_ASSET]: METRIC_NAMES.swapFrom,
+    };


piyalbasu · 2026-03-24T17:17:15Z

.github/workflows/submitBeta.yml

+      - run: >
+          yarn && yarn build:freighter-api && yarn build:extension:production
+          --env AMPLITUDE_KEY="${{ secrets.AMPLITUDE_KEY }}" SENTRY_KEY="${{
+          secrets.SENTRY_KEY }}"


If we were going to add analytics/Sentry to Beta, I don't think we should use the Prod keys here.

IMO, I don't think we need Sentry tracking at all in Beta.

I can see an argument for being able to test Amplitude in Beta, but we should use a key specific to the beta environment for this so we don't pollute Production data

piyalbasu · 2026-03-24T17:19:06Z

extension/src/constants/env.ts

+/**
+ * Build type derived from webpack flags at compile time.
+ * - "development" — `yarn start` (dev server)
+ * - "beta" — `yarn build` (non-production extension build)


this actually isn't accurate. You'll see that submitBeta uses the yarn:build:production command. The reason for this is that we want the build to be as close as possible to the production build when we're QA'ing

add amplitude SDK to extension

7a7e481

leofelix077 self-assigned this Mar 23, 2026

Copilot AI review requested due to automatic review settings March 23, 2026 15:06

leofelix077 added the don't review yet wip / tests in progress / missing videos or screenshots / pending self code-review label Mar 23, 2026

Copilot started reviewing on behalf of leofelix077 March 23, 2026 15:06 View session

github-advanced-security bot found potential problems Mar 23, 2026

View reviewed changes

extension/src/helpers/metrics.ts Dismissed Show dismissed Hide dismissed

extension/src/helpers/metrics.ts Fixed Show fixed Hide fixed

Copilot AI reviewed Mar 23, 2026

View reviewed changes

.github/workflows/submitBeta.yml Outdated Show resolved Hide resolved

extension/src/helpers/metrics.ts Outdated Show resolved Hide resolved

extension/src/helpers/metrics.ts Show resolved Hide resolved

leofelix077 added 2 commits March 23, 2026 12:13

fix codeql warnings

cd56f2a

adjust yaml syntax

83e1c39

leofelix077 requested a review from Copilot March 23, 2026 15:16

Copilot started reviewing on behalf of leofelix077 March 23, 2026 15:17 View session

Copilot AI reviewed Mar 23, 2026

View reviewed changes

fix random uuid generation

e89e797

leofelix077 requested review from CassioMG, aristidesstaffieri and piyalbasu March 23, 2026 16:33

leofelix077 added 2 commits March 23, 2026 16:43

adjust metrics build error

09bd9f5

fix flag setting for dev server and build type

918de53

leofelix077 added enhancement New feature or request and removed don't review yet wip / tests in progress / missing videos or screenshots / pending self code-review labels Mar 23, 2026

piyalbasu reviewed Mar 24, 2026

View reviewed changes

leofelix077 mentioned this pull request Mar 25, 2026

Refactor metrics to use Amplitude SDK #2464

Closed

		let recentEventsSnapshot: DebugEvent[] = [];
		let debugListeners: Array<() => void> = [];

Conversation

leofelix077 commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

leofelix077 commented Mar 23, 2026 •

edited

Loading

socket-security bot commented Mar 23, 2026 •

edited

Loading

socket-security bot commented Mar 23, 2026 •

edited

Loading