feat: carry the signed-in user and tenant on telemetry, and send a final event on opt-out by ralphstodomingo · Pull Request #1501 · AltimateAI/altimate-code

ralphstodomingo · 2026-10-15T05:20:51Z

Issue for this PR

Closes #1498
Closes #1499

Type of change

New feature

What does this PR do?

Identity. When the machine is signed in to Altimate, every row carries user_id and tenant, and the user uuid becomes the App Insights user id. Anonymous rows keep the machine id. The identity is resolved once per stored credential through the users/me call and cached owner-only under a fingerprint of the credential. A changed credential, a sign-out or a 401/403 drops it. A failed lookup is retried after 60 s, and a stale answer is discarded. No email, hashed or not, leaves the client. Backend calls name the CLI version in a header.
Opt-out. When telemetry is disabled by environment or config, a machine that already has a machine id sends one final telemetry_opted_out event, then nothing. It carries the opt-out source and the cached identity. A marker next to the machine id is written only after the ingest endpoint accepts the event, so an offline launch tries again. Turning telemetry back on clears the marker.

Why

Web events are keyed by the backend user uuid and CLI events only by machine, so nothing joined a CLI session to its account. An opted-out machine also looks exactly like a client that stopped emitting. With the opt-out as its last event, the dashboards can count opt-outs and explain the silence after them.

How did you verify your code works?

Identity suite: resolution, caching, invalidation, retry backoff, stale-answer fences and cache file mode against stubbed endpoints. No email in any property.
Opt-out suite: the single event and its properties, nothing afterwards, no event without a machine id, the marker only after a 2xx, and the marker cleared on a normal init.
After merging main: typecheck clean, and the telemetry suites pass.

Cost side effects

None. The rows gain fixed-size properties, and an opted-out machine sends at most one more event. No model calls, queries or cloud resources grow with user data.

Checklist

I have tested my changes locally
I have not included unrelated changes in this PR
I checked for cost side effects (model calls, queries or cloud resources that grow with user data) and described them, or wrote "none"

Supersedes #1500.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YNasdD5tQMNtzXsuMEy82X

Resolve the signed-in user once per credential (GET /users/me, cached at ~/.altimate/telemetry-identity.json) and stamp user_id and tenant on every event; the hashed account email is gone. Backend calls send x-altimate-client. Closes #1498 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011AhtJPr3nmT1Po92ZQk4VE

coderabbitai · 2026-10-15T05:21:00Z

Walkthrough

The changes add client-identification headers to Altimate requests and resolve telemetry identity from stored credentials. Telemetry events use the resolved user ID and tenant when available. When telemetry is disabled, the code can send one final opt-out event and record a local marker.

Changes: Telemetry identity and opt-out

Layer / File(s)	Summary
Client headers and identity resolution `packages/opencode/src/altimate/api/client.ts`, `packages/opencode/src/altimate/telemetry/identity.ts`, `packages/opencode/src/altimate/workspace/api-client.ts`, `packages/opencode/src/auth/index.ts`, `packages/opencode/src/altimate/util/machine-id.ts`, `packages/opencode/test/altimate/telemetry/identity.test.ts`	Altimate requests include a client-identification header. Telemetry identity loads credentials, requests and validates user identity, and caches results. Tests cover credential sources, cache behavior, and request outcomes.
Telemetry identity lifecycle `packages/opencode/src/altimate/telemetry/index.ts`, `packages/opencode/src/altimate/plugin/altimate.ts`, `packages/opencode/test/altimate/telemetry/identity.test.ts`, `packages/opencode/test/telemetry/automated-run.test.ts`, `packages/opencode/test/upstream/*`	Telemetry event properties and user tags use the resolved user ID and tenant when available. Identity refreshes track credential changes, and flushes retain the identity captured for each batch.
Opt-out event and marker `packages/opencode/src/altimate/telemetry/index.ts`, `packages/opencode/src/altimate/telemetry/opt-out.ts`, `packages/opencode/src/altimate/util/machine-id.ts`, `packages/opencode/test/altimate/telemetry/opt-out.test.ts`	When telemetry is disabled, the code can send a final event if a valid machine ID already exists. An accepted response creates a marker; enabling telemetry clears it. Tests cover send conditions, response handling, and marker lifecycle.

Priority: Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Telemetry
  participant TelemetryIdentity
  participant AltimateUsersMe
  participant IdentityCache
  Telemetry->>TelemetryIdentity: resolve using stored credentials
  TelemetryIdentity->>IdentityCache: check credential fingerprint
  TelemetryIdentity->>AltimateUsersMe: request user identity
  AltimateUsersMe-->>TelemetryIdentity: return user ID and tenant
  TelemetryIdentity->>IdentityCache: store validated identity

sequenceDiagram
  participant Telemetry
  participant OptOutMarker
  participant MachineIdFile
  participant TrackEndpoint
  Telemetry->>OptOutMarker: check marker and read existing machine ID
  OptOutMarker->>MachineIdFile: read and validate ID
  Telemetry->>TrackEndpoint: send final opt-out event
  TrackEndpoint-->>Telemetry: return response
  Telemetry->>OptOutMarker: write marker after accepted response

Suggested reviewers: anandgupta42, sahrizvi

Merge Risk: Low · up to 3b412

A quick exit can delay the final opt-out event until a later launch. The event is not permanently lost, but draining the pending task during shutdown would make delivery more reliable.

Pre-merge checks: 3 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Linked Issues check		`#1498` meets its coding requirements. The PR resolves `user_id` and `tenant`, keeps `machine_id` for anonymous events, removes email attribution, and adds `x-altimate-client` headers. `#1499` remains inc…	Add an atomic cross-process claim before the opt-out POST. Release the claim after a non-2xx response or request failure so a later launch can retry. Keep the final marker after a successful response. Add a concurrent-launch test that prove…

Passed checks: 3 passed

Check name	Status	Explanation
Out of Scope Changes check		The reviewed changes support `#1498` or `#1499`. Identity caching and lifecycle handling support backend identity telemetry. Opt-out marker, event, and machine-ID handling support the final opt-out event.…
Description check		The pull request description follows the required template. It identifies the issues, selects the change type, explains the implementation and rationale, documents verification, addresses cost side ef…
Title check		The title clearly and concisely describes the two primary changes: adding the signed-in user and tenant to telemetry, and sending a final event when telemetry is disabled.

Full details: Out of Scope Changes check

Explanation

The reviewed changes support #1498 or #1499. Identity caching and lifecycle handling support backend identity telemetry. Opt-out marker, event, and machine-ID handling support the final opt-out event. Request headers support the client-header requirement in #1498. The related tests support these implementations. No unrelated change is demonstrated by the reviewed evidence.

Full details: Description check

Explanation

The pull request description follows the required template. It identifies the issues, selects the change type, explains the implementation and rationale, documents verification, addresses cost side effects, and completes the checklist. The screenshots section is not needed because this is not a UI change.

Full details: Linked Issues check

Explanation

#1498 meets its coding requirements. The PR resolves user_id and tenant, keeps machine_id for anonymous events, removes email attribution, and adds x-altimate-client headers. #1499 remains incomplete. recordOptOut() checks for the marker before the POST, but it writes the marker only after a 2xx response. Two processes can both observe no marker and both send telemetry_opted_out. OptOutMarker.write() uses exclusive creation, but that occurs after both sends and does not prevent duplicate events. The opt-out tests do not cover concurrent launches.

Resolution

Add an atomic cross-process claim before the opt-out POST. Release the claim after a non-2xx response or request failure so a later launch can retry. Keep the final marker after a successful response. Add a concurrent-launch test that proves only one opt-out event is sent.

Finishing Touches: 💡 1

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the headers in the morning light
A UUID joins the telemetry flight
A marker waits when opt-out is done
Then quiet follows, soft as a run
The rabbit hops; the records stay right}

_{Comment @coderabbitai help to get the list of available commands.}

The two source guards expected the awaited call that the identity change removed; they now assert the call is gone and identity comes from the stored credential. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011AhtJPr3nmT1Po92ZQk4VE

ralphstodomingo · 2026-10-15T07:33:02Z

Codex review log

Stacked on #1500; review the last commit only. Review runs against these claims. Report only a reproducible trace that violates a numbered claim; instances of the disclosed residuals are not findings. A round with no claim violation ends review.

Claims

C1 With telemetry disabled by ALTIMATE_TELEMETRY_DISABLED, OPENCODE_DISABLE_TELEMETRY or telemetry.disabled, Telemetry.init() sends at most one telemetry_opted_out envelope per machine across processes, and nothing else: track() drops every event, and after the marker ~/.altimate/telemetry-opted-out exists no request is made on any later init.
C2 The event is sent only when ~/.altimate/machine-id already holds a UUID; recordOptOut() never mints a machine id, never creates the .altimate directory before the send succeeded, and never calls the backend (identity comes from TelemetryIdentity.cached(), which is file-only).
C3 The marker is written only after the ingest endpoint answered 2xx; a non-2xx, a thrown fetch or the 3 s abort leaves no marker, so the next init tries once more.
C4 The envelope's baseData.name is telemetry_opted_out; its properties carry machine_id, cli_version, source, launch_id, opt_out_source (env or config), and user_id plus tenant only when a cached identity matches the credential on disk; tags["ai.user.id"] is the uuid when cached, else the machine id.
C5 After recordOptOut() returns, by any path, the module's machineId and identity are empty again, and enabled stays false.
C6 A normal (enabled) init removes the marker, so a later opt-out is recorded again; nothing else reads or writes the marker.
C7 Under a test runner (NODE_ENV=test, BUN_TEST, VITEST, JEST_WORKER_ID) recordOptOut() returns before touching any file unless Telemetry.allowOptOutUnderTestRunner(true) was called, and it returns whenever ALTIMATE_TELEMETRY_FORCE=true, regardless of the sink.
C8 OptOutMarker paths resolve through Global.Path.home, so OPENCODE_TEST_HOME redirects both the marker and the machine-id read; in a real session that is the same directory getOrCreateMachineId() uses.
C9 recordOptOut() is not awaited by doInit(); an opted-out launch never waits on the network.

Residuals

R1 A short-lived process may exit before the 3 s send completes; the event is then sent by a later launch (C3). Accepted.
R2 An opt-out set before the machine ever ran with telemetry on produces no event and no marker; the dashboard states that remainder as unknowable.
R3 Two concurrent processes on one machine starting while opted out and unmarked can both send the event once; the marker then stops both. Accepted as a rare double count.
R4 The automated-run.test.ts isolation helper now also sets OPENCODE_TEST_HOME; that is a test-only change so code keyed on Global.Path.home sees the temp home under Bun, whose os.homedir() does not follow HOME.

ralphstodomingo · 2026-10-15T07:33:06Z

@codex review against the numbered claims and the disclosed residuals in the review-log comment on this PR: report only a reproducible trace that violates a numbered claim. Instances of the disclosed residuals are not findings. A round with no claim violation ends review. This PR is stacked on #1500: review only the last commit (the opt-out marker), not the identity change beneath it.

chatgpt-codex-connector · 2026-10-15T07:33:22Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T16:28:48.304146Z	`3b412e0`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

kilo-code-bot · 2026-10-15T07:33:43Z

+      const explicit = process.env.APPLICATIONINSIGHTS_CONNECTION_STRING
+      const cfg = parseConnectionString(explicit ?? DEFAULT_CONNECTION_STRING)
+      if (!cfg) return
+      machineId = id


WARNING: Mutating module-level machineId across await TelemetryIdentity.cached() leaks or resets machineId on concurrent init() cycles

recordOptOut() is fired without await (void recordOptOut(...)), so a shutdown() followed by a new init() in the same process (such as across session loops or in test suites) can run concurrently with an in-flight recordOptOut() paused at await TelemetryIdentity.cached() (line 2179). During that window, the new doInit() shares the mutated machineId, and when recordOptOut() resumes at lines 2184–2185 (or in catch at lines 2201–2202), it overwrites machineId = "" and identity = undefined, clobbering the active session's state. Resolve const cachedIdentity = await TelemetryIdentity.cached() before mutating module state so machineId and identity are only set and restored synchronously around toAppInsightsEnvelopes(...).

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

Fixed in 3032626: toAppInsightsEnvelopes() takes the machine id and identity as arguments, so recordOptOut() never writes module state; a later fix (6e425e4) also fences the whole send on the lifecycle generation.

kilo-code-bot · 2026-10-15T07:33:43Z

+   * that never sent telemetry has nothing to mark. */
+  export function readMachineId(): string | undefined {
+    try {
+      const raw = fs.readFileSync(path.join(dir(), "machine-id"), "utf8").trim()


WARNING: readMachineId() uses unbounded readFileSync instead of lstatSync and size-capped reading like getOrCreateMachineId()

In src/altimate/util/machine-id.ts, reading ~/.altimate/machine-id explicitly checks lstatSync(idPath).isFile() and caps reads at 512 bytes via a file descriptor to avoid following symlinks or slurping multi-MB files into memory before regex validation. Here, fs.readFileSync(path.join(dir(), "machine-id"), "utf8") follows symlinks and reads the entire file into memory unrestricted.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

Fixed in 3032626: readMachineId() now uses readExistingMachineId() from util/machine-id.ts (lstat regular-file check, 512-byte cap, UUID validation), with a test for a corrupt or oversized file.

kilo-code-bot · 2026-10-15T07:34:11Z