fix: normalize shipped telemetry secrets

.github/workflows/release-stable.yml

@@ -145,8 +145,13 @@ jobs:
                   value = value[1:-1].strip()
               return value
 
+          def normalize_http_like(value: str) -> str:
+              if "://" in value:
+                  return value
+              return f"https://{value}"
+
           def is_http_url(value: str) -> bool:
-              parsed = urlparse(value)
+              parsed = urlparse(normalize_http_like(value))
               return parsed.scheme in {"http", "https"} and bool(parsed.netloc)
 
           values = {

.github/workflows/release.yml

@@ -188,8 +188,13 @@ jobs:
                   value = value[1:-1].strip()
               return value
 
+          def normalize_http_like(value: str) -> str:
+              if "://" in value:
+                  return value
+              return f"https://{value}"
+
           def is_http_url(value: str) -> bool:
-              parsed = urlparse(value)
+              parsed = urlparse(normalize_http_like(value))
               return parsed.scheme in {"http", "https"} and bool(parsed.netloc)
 
           values = {

src-tauri/src/telemetry.rs

@@ -31,8 +31,17 @@ fn normalize_embedded_env(raw: Option<&str>) -> Option<String> {
     }
 }
 
+fn normalize_http_like_value(value: &str) -> String {
+    if value.contains("://") {
+        value.to_string()
+    } else {
+        format!("https://{value}")
+    }
+}
+
 fn parse_embedded_sentry_dsn(raw: Option<&str>) -> Option<sentry::types::Dsn> {
-    normalize_embedded_env(raw)?.parse().ok()
+    let normalized = normalize_embedded_env(raw)?;
+    normalize_http_like_value(&normalized).parse().ok()
 }
 
 /// Initialize Sentry if the user has opted in to crash reporting.
@@ -134,6 +143,12 @@ mod tests {
         assert!(parsed.is_some());
     }
 
+    #[test]
+    fn test_parse_embedded_sentry_dsn_accepts_scheme_less_value() {
+        let parsed = parse_embedded_sentry_dsn(Some("public@example.ingest.sentry.io/1"));
+        assert!(parsed.is_some());
+    }
+
     #[test]
     fn test_parse_embedded_sentry_dsn_rejects_invalid_value() {
         let parsed = parse_embedded_sentry_dsn(Some("not a dsn"));

src/lib/telemetryConfig.test.ts

@@ -41,6 +41,18 @@ describe('resolveFrontendTelemetryConfig', () => {
     }).posthogHost).toBe(defaultPostHogHost)
   })
 
+  it('adds https to scheme-less DSNs and PostHog hosts', () => {
+    expect(resolveFrontendTelemetryConfig({
+      VITE_SENTRY_DSN: 'public@example.ingest.sentry.io/123456',
+      VITE_POSTHOG_KEY: 'phc_test_key',
+      VITE_POSTHOG_HOST: 'eu.i.posthog.com',
+    })).toEqual({
+      sentryDsn: 'https://public@example.ingest.sentry.io/123456',
+      posthogKey: 'phc_test_key',
+      posthogHost: 'https://eu.i.posthog.com',
+    })
+  })
+
   it('drops invalid Sentry DSNs instead of passing them to the SDK', () => {
     expect(resolveFrontendTelemetryConfig({
       VITE_SENTRY_DSN: 'not a dsn',

src/lib/telemetryConfig.ts

@@ -41,13 +41,21 @@ function isHttpUrl(value: string): boolean {
   }
 }
 
+function normalizeHttpLikeValue(value: string): string {
+  if (!value) return ''
+  if (/^[a-z][a-z\d+\-.]*:\/\//i.test(value)) return value
+  return `https://${value}`
+}
+
 function normalizeSentryDsn(value: string): string {
-  return isHttpUrl(value) ? value : ''
+  const normalized = normalizeHttpLikeValue(value)
+  return isHttpUrl(normalized) ? normalized : ''
 }
 
 function normalizePostHogHost(value: string): string | null {
   if (!value) return DEFAULT_POSTHOG_HOST
-  return isHttpUrl(value) ? value : null
+  const normalized = normalizeHttpLikeValue(value)
+  return isHttpUrl(normalized) ? normalized : null
 }
 
 export function resolveFrontendTelemetryConfig(