fix(analytics): stop PostHog delivery from failing a deploy

`deliverOutboxServerEvent` awaited `client.flush()` before letting the
deployment outbox checkpoint advance, so an unreachable PostHog failed the
event, retried it, and eventually dead-lettered it — while holding the socket
notification, the workspace event, and retired-subscription cleanup behind a
third party. `flush()` also drains the whole shared client queue, so an
unrelated event's network error surfaced here as a failed deploy.

It bought no durability the process did not already have: the outbox handler
runs in the long-lived app container, where the client flushes on its own
10s interval and again from the `SIGTERM`/`SIGINT` hook in
`instrumentation-node.ts`. The helper had one caller and arrived inside an
unrelated squashed PR (#5273) with no rationale, against 161 fire-and-forget
`captureServerEvent` call sites.

Deleted it and restored `captureServerEvent`, whose contract is already
"never throws". `insertId` still collapses retried captures. That contract
was untested, which is why this regressed unnoticed, so `server.test.ts` now
pins it — spying on the real client, since the lazy `require` defeats
`vi.mock` and a disabled client would pass every assertion vacuously.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/lib/posthog/server.test.ts

@@ -0,0 +1,79 @@
+/**
+ * @vitest-environment node
+ */
+import type { MockInstance } from 'vitest'
+import { beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { captureServerEvent, getPostHogClient } from '@/lib/posthog/server'
+
+/**
+ * This is the guarantee that keeps analytics off every critical path: callers
+ * treat `captureServerEvent` as something that cannot fail, and several — the
+ * deployment outbox among them — would turn a PostHog outage into failed work
+ * if it ever started throwing.
+ *
+ * The client is built through a lazy `require`, which `vi.mock` cannot
+ * intercept, so this spies on the real one. Its readiness latches at module
+ * level, hence stubbing the env before the first read and asserting a client
+ * exists — without that the whole suite would pass on a disabled no-op.
+ */
+describe('captureServerEvent', () => {
+  let captureSpy: MockInstance
+
+  beforeAll(() => {
+    vi.stubEnv('NEXT_PUBLIC_POSTHOG_KEY', 'phc_test')
+    vi.stubEnv('NEXT_PUBLIC_POSTHOG_ENABLED', 'true')
+
+    const client = getPostHogClient()
+    if (!client) throw new Error('expected an enabled PostHog client to spy on')
+    captureSpy = vi.spyOn(client, 'capture').mockImplementation(() => {})
+  })
+
+  beforeEach(() => {
+    captureSpy.mockClear()
+    captureSpy.mockImplementation(() => {})
+  })
+
+  it('swallows a failing client instead of propagating to the caller', () => {
+    captureSpy.mockImplementation(() => {
+      throw new Error('PostHog unreachable')
+    })
+
+    expect(() =>
+      captureServerEvent('user-1', 'workflow_deployed', {
+        workflow_id: 'workflow-1',
+        workspace_id: 'workspace-1',
+      })
+    ).not.toThrow()
+    expect(captureSpy).toHaveBeenCalledTimes(1)
+  })
+
+  it('captures synchronously, so a caller cannot await delivery', () => {
+    const result = captureServerEvent('user-1', 'workflow_deployed', {
+      workflow_id: 'workflow-1',
+      workspace_id: 'workspace-1',
+    })
+
+    expect(result).toBeUndefined()
+    expect(captureSpy).toHaveBeenCalledTimes(1)
+  })
+
+  it('forwards insertId as $insert_id so outbox retries collapse', () => {
+    captureServerEvent(
+      'user-1',
+      'workflow_deployed',
+      { workflow_id: 'workflow-1', workspace_id: 'workspace-1' },
+      { insertId: 'event-1', groups: { workspace: 'workspace-1' } }
+    )
+
+    expect(captureSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        distinctId: 'user-1',
+        event: 'workflow_deployed',
+        properties: expect.objectContaining({
+          $insert_id: 'event-1',
+          $groups: { workspace: 'workspace-1' },
+        }),
+      })
+    )
+  })
+})

apps/sim/lib/posthog/server.ts

@@ -98,22 +98,3 @@ export function captureServerEvent<E extends PostHogEventName>(
     logger.warn('Failed to capture PostHog server event', { event, error })
   }
 }
-
-/** Captures and flushes one outbox event before its durable checkpoint advances. */
-export async function deliverOutboxServerEvent<E extends PostHogEventName>(
-  distinctId: string,
-  event: E,
-  properties: PostHogEventMap[E],
-  options?: CaptureOptions
-): Promise<'delivered' | 'skipped'> {
-  const client = getClient()
-  if (!client) return 'skipped'
-
-  client.capture({
-    distinctId,
-    event,
-    properties: buildCaptureProperties(properties, options),
-  })
-  await client.flush()
-  return 'delivered'
-}

apps/sim/lib/workflows/deployment-outbox.test.ts

@@ -75,7 +75,7 @@ vi.mock('@/lib/mcp/server-locks', () => ({
 }))
 
 vi.mock('@/lib/posthog/server', () => ({
-  deliverOutboxServerEvent: mockCaptureServerEvent,
+  captureServerEvent: mockCaptureServerEvent,
 }))
 
 vi.mock('@/lib/mcp/workflow-mcp-sync', () => ({
@@ -212,7 +212,7 @@ describe('versioned deployment preparation outbox', () => {
     mockSyncMcpToolsForWorkflow.mockResolvedValue([{ serverId: 'mcp-server-1' }])
     mockSetWorkflowMcpTransactionLockTimeout.mockResolvedValue(undefined)
     mockEmitWorkflowDeployedEvent.mockResolvedValue(undefined)
-    mockCaptureServerEvent.mockResolvedValue('delivered')
+    mockCaptureServerEvent.mockReturnValue(undefined)
     mockMarkDeploymentOperationFailed.mockResolvedValue({
       success: true,
       operation: operation({ status: 'failed' }),
@@ -354,15 +354,20 @@ describe('versioned deployment preparation outbox', () => {
     expect(mockActivateDeploymentOperation).not.toHaveBeenCalled()
   })
 
-  it('does not checkpoint analytics until durable PostHog delivery resolves', async () => {
+  /**
+   * Analytics was briefly flushed durably here, which put a deploy's audit
+   * trail, socket notification, and subscription cleanup behind PostHog and
+   * retried the event until it dead-lettered. Capture is fire-and-forget
+   * again: the checkpoint advances on capture, and everything the cutover
+   * actually owes still runs. `captureServerEvent` swallowing its own
+   * failures is pinned in `lib/posthog/server.test.ts`.
+   */
+  it('checkpoints analytics on capture and still finishes the deploy', async () => {
     mockIsDeploymentOperationCurrent.mockResolvedValue(true)
-    const active = operation({ status: 'active', completedAt: NOW })
-    mockGetDeploymentOperation.mockResolvedValue(active)
+    mockGetDeploymentOperation.mockResolvedValue(operation({ status: 'active', completedAt: NOW }))
     queueTableRows(schemaMock.workflow, [
       { id: 'workflow-1', name: 'Workflow', workspaceId: 'workspace-1' },
     ])
-    const deliveryFailure = new Error('PostHog flush failed')
-    mockCaptureServerEvent.mockRejectedValueOnce(deliveryFailure)
     const outboxContext = context()
 
     await expect(
@@ -373,13 +378,16 @@ describe('versioned deployment preparation outbox', () => {
         },
         outboxContext
       )
-    ).rejects.toBe(deliveryFailure)
+    ).resolves.toBeUndefined()
 
-    expect(outboxContext.checkpointPayload).not.toHaveBeenCalledWith(
+    expect(mockCaptureServerEvent).toHaveBeenCalledTimes(1)
+    expect(outboxContext.checkpointPayload).toHaveBeenCalledWith(
       expect.objectContaining({
         checkpoints: expect.objectContaining({ analyticsCaptured: true }),
       })
     )
+    expect(mockEmitWorkflowDeployedEvent).toHaveBeenCalledTimes(1)
+    expect(mockCleanupRetiredWebhookRegistrations).toHaveBeenCalledTimes(1)
   })
 
   it('honors an aborted signal before starting any side effect', async () => {

apps/sim/lib/workflows/deployment-outbox.ts

@@ -22,7 +22,7 @@ import {
   removeMcpToolsForWorkflow,
   syncMcpToolsForWorkflow,
 } from '@/lib/mcp/workflow-mcp-sync'
-import { deliverOutboxServerEvent } from '@/lib/posthog/server'
+import { captureServerEvent } from '@/lib/posthog/server'
 import {
   cleanupWebhooksForWorkflow,
   prepareStableTriggerWebhooksForDeploy,
@@ -681,12 +681,23 @@ async function emitPostActivationSideEffects(params: {
     await params.checkpoint({ auditEmitted: true })
   }
 
+  /**
+   * Analytics is fire-and-forget by contract: PostHog being unreachable must
+   * never fail an activation that is already durable. Awaiting a flush here
+   * bought no delivery the process does not already have — the client flushes
+   * on its own interval and again from the `SIGTERM`/`SIGINT` hook in
+   * `instrumentation-node.ts` — while holding the socket notification, the
+   * workspace event, and subscription cleanup behind a third party, and
+   * failing the outbox event until it dead-lettered when that party was down.
+   * `flush()` also drains the whole shared client queue, so an unrelated
+   * event's network error surfaced here as a failed deploy.
+   */
   if (!params.checkpoints.analyticsCaptured) {
     params.context.signal.throwIfAborted()
     if (params.payload.captureAnalytics !== false) {
       const workspaceId = (params.workflow.workspaceId as string) || ''
       const isVersionActivation = params.operation.action === 'activate'
-      await deliverOutboxServerEvent(
+      captureServerEvent(
         params.payload.userId,
         isVersionActivation ? 'deployment_version_activated' : 'workflow_deployed',
         {