fix(audit): report the onboarding auto-audit to PostHog

[chhhee10]

The gap

runPostSetupAudit() — the audit that runs automatically at the end of first-run setup, and therefore the first audit any new user ever runs — emitted no telemetry at all. An explicit failproofai audit reported normally.

Path	trackHookEvent calls
runAuditCli — explicit failproofai audit	4 (cli_audit_started / completed / failed)
runPostSetupAudit — onboarding auto-audit	0 — fired nothing

So the audit funnel silently undercounted exactly the activation moment it exists to measure.

Confirmed live. On a fresh install (clean machine, no ~/.failproofai), onboarding ran the auto-audit and PostHog saw nothing:

15:28:38  last-version          ← install recorded
15:28:51  .launcher-configured  ← wizard completed
15:29:41  audit-dashboard.json  ← auto-audit finished — and reported nothing

The fix

runPostSetupAudit now emits the same three events, tagged source: "onboarding" against the existing source: "cli", so the two paths stay distinguishable in PostHog.

Three details worth reviewing:

• cli_audit_completed fires before the empty-history return, matching runAuditCli — a fresh user with no agent history yet is exactly who we want counted.
• cli_audit_failed is awaited. This function returns straight into the dashboard boot, which would race a fire-and-forget send. (started stays fire-and-forget: the multi-second scan keeps the process alive, same reasoning as runAuditCli.)
• The completed-event properties now come from one shared helper, so the two entry points can't drift apart.

Onboarding stays best-effort: never throws, never exits. Opt-out via FAILPROOFAI_NO_AUTO_AUDIT=1 is unchanged (and emits nothing, since no audit runs).

Verification

Unit tests mock telemetry, so I also drove the real, unmocked runPostSetupAudit against a local capture server:

EVENT: cli_audit_started   | source=onboarding | $lib=failproofai-hooks
EVENT: cli_audit_completed | source=onboarding | events_scanned=7468 | sessions=210 | hits=1627

Real scan: 7,468 tool calls across 210 sessions / 38 projects. The function returned without throwing or exiting.

Gate: 2098 tests / 122 files pass, 0 lint errors, clean tsc. 6 new tests cover both paths, source tagging, the failure path, the empty-history path, the opt-out, and the never-exits guarantee.

Notes

• Events go to $lib: failproofai-hooks (CLI/hook telemetry), not failproofai-web — filtering the dashboard by the web lib hides them.
• Independent of fix: npm install warning, onboarding audit telemetry, and dashboard error noise #560 (npm lifecycle scripts); branched from main.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d1d7afe4-374b-459c-835e-1df83c2e8099

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chhhee10]

Folded into #560 — same commit, unchanged. One PR is easier for a small team to review; the three fixes are kept as separate commits there so they can still be reviewed one at a time.