Repository navigation
Conversation
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 577769f. Configure here.
masnwilliams
left a comment
masnwilliams
left a comment
There was a problem hiding this comment.
requesting changes. the passthrough itself is small and the behavior matches the website side for keys, first touch, hand-tagged links and the dashboard host. the problem is privacy: kernel_utm gets written and used with no Do Not Track or consent check.
before merge
- check DNT and marketing consent before writing or using the cookie.
privacy.mdx:85says attribution cookies don't load when DNT is set, and the website side writeskernel_utmonly withmarketingconsent. right now a visitor who declined on www.kernel.sh, or has DNT on, gets the cookie as soon as they open a docs page. the easiest fix is to move this intoconceptual.js: itsdoNotTrackEnabled()/storedConsent()/ jurisdiction-lookup checks already cover the same visitors, and its click handler already rewrites dashboard links. that also gets rid of the second capture-phase click listener, andca_device_idpicks up theauxclickhandling this PR adds. if you'd rather keeputm.jsseparate, it needs the same checks either way. - delete the cookie when consent is denied. if stored c15t consent is present and marketing isn't granted (
storedConsent() === false), writekernel_utmwithMax-Age=0and the samePath/Domainattributes. do it at page load and when consent is withdrawn mid-session (undecorateLinks), so a cookie written before the decline doesn't stick around. kernel/website#343 is adding the same rule. - store the value as a query string, not JSON. store
URLSearchParams.toString()as is, with no extraencodeURIComponent, and read it with the same function that parses the landing URL: filter to the 5 keys, trim, skip empty values. that removes theJSON.parse/ object-shape checks inreadStored, and both repos parse the cookie the same way. both PRs have to make this change at the same time: if one side encodes and the other doesn't, the params are dropped silently. this also adds the.trim()the website side already does.
if you fold it into conceptual.js: read location.search at the top of the script, before the consent check. when there's no stored decision, start() waits on the jurisdiction fetch, and a client-side navigation during that wait loses the landing params.
non-blocking
- mark decorated links (the website side uses
data-utm-passthrough) so withdrawal removes only our params and leaves hand-taggedutm_*alone. - consider deleting the cookie under DNT too, not just skipping it, so one written before DNT was turned on doesn't stay.
- a comment pointing at the website's
src/lib/utm.tsas the other half of the cookie format, so the two sides stay in sync.
This branch was successfully deployed
2 participants
Adds first-touch UTM passthrough to
conceptual.js: the campaign is saved to thekernel_utmcookie and appended todashboard.onkernel.comlinks on click. Launch posts link straight to docs pages, so the params were lost before sign-up. It runs under the same Do Not Track and marketing consent checks as the pixel, and declining clears the cookie.To test, grant marketing consent, open
/browsers/code-mode-webmcp?utm_source=x&utm_medium=social&utm_campaign=code-modeand click Sign up: the params are on the URL. Without params or consent, links are unchanged.Pairs with kernel/website#343, which writes the same cookie.
Note
Medium Risk
Touches marketing attribution cookies and link rewriting under consent/DNT rules; mis-handling could leak campaign data or fail to honor opt-out, but scope is limited to docs → dashboard links.
Overview
Extends the docs Conceptual Analytics pixel (
conceptual.js) so first-touch UTM params survive the hop from docs to dashboard sign-up, using the samekernel_utmcookie contract askernel/website.On landing, UTMs from the query string are stored (first touch wins, 30-day cookie on
.kernel.sh). On click/auxclick, links todashboard.onkernel.comget those params appended unless the URL already hasutm_*keys; script-added params are marked withdata-utm-passthroughso consent withdrawal can strip only automated decoration. This runs alongside the existingca_device_idhandoff in onehandOffOnNavigationpath.Do Not Track, declined marketing consent, and consent withdrawal now also clear the UTM cookie and undo device-id and UTM rewrites in the DOM (
withdraw()), matching the pixel’s privacy rules.Reviewed by Cursor Bugbot for commit 3ca980c. Bugbot is set up for automated code reviews on this repo. Configure here.