@dosu/cli 0.44.0 → 0.45.0

package/bin/dosu.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+
 import { createRequire } from "node:module";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
@@ -2113,6 +2114,9 @@ function getAccessTokenClaim(accessToken, claim) {
 function getAccessTokenUserID(accessToken) {
   return getAccessTokenClaim(accessToken, "sub");
 }
+function getAccessTokenEmail(accessToken) {
+  return getAccessTokenClaim(accessToken, "email");
+}
 function getAccessTokenOAuthClientID(accessToken) {
   return getAccessTokenClaim(accessToken, "client_id");
 }
@@ -2219,15 +2223,22 @@ function loadConfig() {
   } catch {
     return emptyConfig();
   }
+  const parsed = parseConfig(raw);
   if (isConfigV2(raw))
-    return normalizeV2(raw);
+    return parsed;
   if (isRecord2(raw) && "schema_version" in raw)
-    return emptyConfig();
-  const migrated = migrateLegacyConfig(raw);
+    return parsed;
   try {
-    writeConfig(path2, migrated);
+    writeConfig(path2, parsed);
   } catch {}
-  return migrated;
+  return parsed;
+}
+function parseConfig(raw) {
+  if (isConfigV2(raw))
+    return normalizeV2(raw);
+  if (isRecord2(raw) && "schema_version" in raw)
+    return emptyConfig();
+  return migrateLegacyConfig(raw);
 }
 function saveConfig(cfg) {
   writeConfig(getConfigPath(), cfg);
@@ -4762,7 +4773,7 @@ function isNpxInvocation(channel = INSTALL_CHANNEL, env = process.env) {
 function getVersionString() {
   return `v${VERSION}`;
 }
-var VERSION = "0.44.0", INSTALL_CHANNEL = "npm";
+var VERSION = "0.45.0", INSTALL_CHANNEL = "npm";
 
 // src/debug/logger.ts
 import {
@@ -10386,6 +10397,34 @@ var init_insights2 = __esm(() => {
   init_insights();
 });
 
+// src/auth/errors.ts
+var exports_errors = {};
+__export(exports_errors, {
+  OAuthCallbackError: () => OAuthCallbackError
+});
+var OAuthCallbackError;
+var init_errors = __esm(() => {
+  OAuthCallbackError = class OAuthCallbackError extends Error {
+    error;
+    errorCode;
+    errorDescription;
+    constructor(message, details = {}) {
+      super(message);
+      this.name = "OAuthCallbackError";
+      this.error = details.error;
+      this.errorCode = details.errorCode;
+      this.errorDescription = details.errorDescription;
+    }
+    get userMessage() {
+      const desc = this.errorDescription ?? this.message;
+      if (this.errorCode === "bad_oauth_state" || /state/i.test(desc)) {
+        return `Authentication failed: ${desc}. Run \`dosu login\` again.`;
+      }
+      return `Authentication failed: ${desc}`;
+    }
+  };
+});
+
 // src/version/skill-update-check.ts
 import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join10 } from "node:path";
@@ -11553,56 +11592,1013 @@ var init_agents_md_step = __esm(() => {
   SECTION_START_RE = /<!-- dosu:mcp:start(?: v(\d+))? -->/;
 });
 
+// src/telemetry/settings.ts
+import { randomUUID } from "node:crypto";
+import {
+  existsSync as existsSync18,
+  lstatSync,
+  mkdirSync as mkdirSync9,
+  readFileSync as readFileSync16,
+  renameSync as renameSync3,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync9
+} from "node:fs";
+import { join as join29 } from "node:path";
+function getTelemetrySettingsPath() {
+  return join29(getConfigDir(), TELEMETRY_SETTINGS_FILENAME);
+}
+function loadTelemetrySettings() {
+  return readTelemetrySettings().settings;
+}
+function setTelemetryEnabled(enabled) {
+  if (typeof enabled !== "boolean")
+    return false;
+  const current = readTelemetrySettings();
+  if (current.status === "unsupported" || current.status === "error")
+    return false;
+  const settings2 = current.status === "current" ? current.settings : emptyTelemetrySettings();
+  if (enabled)
+    delete settings2.disabled;
+  else
+    settings2.disabled = true;
+  return writeTelemetrySettings(settings2);
+}
+function telemetryDisabledByEnvironment() {
+  if (isEnabledEnvironmentFlag(process.env.DO_NOT_TRACK))
+    return "DO_NOT_TRACK";
+  if (isEnabledEnvironmentFlag(process.env.DOSU_TELEMETRY_DISABLED)) {
+    return "DOSU_TELEMETRY_DISABLED";
+  }
+  return;
+}
+function isTelemetryEnabled(settings2 = loadTelemetrySettings()) {
+  if (telemetryDisabledByEnvironment() !== undefined)
+    return false;
+  return settings2.disabled !== true;
+}
+function getOrCreateInstallID() {
+  const current = readTelemetrySettings();
+  if (current.status === "current" && current.settings.install_id) {
+    return current.settings.install_id;
+  }
+  if (current.status !== "current" && current.status !== "missing")
+    return;
+  const installID = randomUUID();
+  const settings2 = current.status === "current" ? current.settings : emptyTelemetrySettings();
+  settings2.install_id = installID;
+  return writeTelemetrySettings(settings2) ? installID : undefined;
+}
+function resetInstallID() {
+  const current = readTelemetrySettings();
+  if (current.status !== "current" && current.status !== "missing")
+    return;
+  const settings2 = current.status === "current" ? current.settings : emptyTelemetrySettings();
+  const installID = randomUUID();
+  settings2.install_id = installID;
+  return writeTelemetrySettings(settings2) ? installID : undefined;
+}
+function readTelemetrySettings() {
+  const path3 = getTelemetrySettingsPath();
+  let file;
+  try {
+    file = lstatSync(path3);
+  } catch (error) {
+    if (isErrorCode(error, "ENOENT")) {
+      return { status: "missing", settings: emptyTelemetrySettings() };
+    }
+    return { status: "error", settings: disabledTelemetrySettings() };
+  }
+  if (!file.isFile() || file.size > MAX_TELEMETRY_SETTINGS_BYTES) {
+    return { status: "invalid", settings: disabledTelemetrySettings() };
+  }
+  let content;
+  try {
+    content = readFileSync16(path3, "utf-8");
+  } catch {
+    return { status: "error", settings: disabledTelemetrySettings() };
+  }
+  let raw;
+  try {
+    raw = JSON.parse(content);
+  } catch {
+    return { status: "invalid", settings: disabledTelemetrySettings() };
+  }
+  if (!isRecord3(raw))
+    return { status: "invalid", settings: disabledTelemetrySettings() };
+  if (raw.schema_version !== TELEMETRY_SCHEMA_VERSION) {
+    const status = "schema_version" in raw ? "unsupported" : "invalid";
+    return { status, settings: disabledTelemetrySettings() };
+  }
+  if ("disabled" in raw && typeof raw.disabled !== "boolean") {
+    return { status: "invalid", settings: disabledTelemetrySettings() };
+  }
+  const settings2 = emptyTelemetrySettings();
+  if (raw.disabled === true)
+    settings2.disabled = true;
+  if (typeof raw.install_id === "string" && isUUID(raw.install_id)) {
+    settings2.install_id = raw.install_id;
+  }
+  return { status: "current", settings: settings2 };
+}
+function writeTelemetrySettings(settings2) {
+  const path3 = getTelemetrySettingsPath();
+  const dir = getConfigDir();
+  const temporaryPath = `${path3}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    if (!existsSync18(dir))
+      mkdirSync9(dir, { recursive: true, mode: 448 });
+    writeFileSync9(temporaryPath, `${JSON.stringify(settings2, null, 2)}
+`, {
+      flag: "wx",
+      mode: 384
+    });
+    renameSync3(temporaryPath, path3);
+    return true;
+  } catch {
+    try {
+      unlinkSync2(temporaryPath);
+    } catch {}
+    return false;
+  }
+}
+function emptyTelemetrySettings() {
+  return { schema_version: TELEMETRY_SCHEMA_VERSION };
+}
+function disabledTelemetrySettings() {
+  return { schema_version: TELEMETRY_SCHEMA_VERSION, disabled: true };
+}
+function isEnabledEnvironmentFlag(value) {
+  if (value === undefined)
+    return false;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "")
+    return false;
+  return !["0", "false", "no", "off"].includes(normalized);
+}
+function isUUID(value) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isErrorCode(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+var TELEMETRY_SCHEMA_VERSION = 1, TELEMETRY_SETTINGS_FILENAME = "telemetry.json", MAX_TELEMETRY_SETTINGS_BYTES;
+var init_settings = __esm(() => {
+  init_config();
+  MAX_TELEMETRY_SETTINGS_BYTES = 16 * 1024;
+});
+
+// src/telemetry/debug-id.ts
+var BUNDLE_DEBUG_ID_PLACEHOLDER = "df4adcb4-addf-31e4-6475-6e2164756e21";
+
+// src/telemetry/telemetry.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { existsSync as existsSync19 } from "node:fs";
+import { request as httpRequest2 } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function safeString(value, pattern, fallback) {
+  if (typeof value !== "string" || !pattern.test(value))
+    return fallback;
+  return value;
+}
+function canonicalCommand(value) {
+  if (typeof value !== "string")
+    return UNKNOWN_COMMAND;
+  const command = value.trim();
+  if (command.length > 80)
+    return UNKNOWN_COMMAND;
+  if (!/^[a-z][a-z0-9-]*(?: [a-z][a-z0-9-]*){0,3}$/.test(command)) {
+    return UNKNOWN_COMMAND;
+  }
+  return command;
+}
+function normalizeContext(context) {
+  const isAuthenticated2 = context?.isAuthenticated === true;
+  const id = safeRead(context?.user, "id");
+  const email = safeRead(context?.user, "email");
+  const user = isAuthenticated2 && validUserId(id) ? { id, ...validEmail(email) ? { email } : {} } : undefined;
+  return {
+    mode: context?.mode === "oss" ? "oss" : "cloud",
+    isAuthenticated: isAuthenticated2,
+    ...user ? { user } : {}
+  };
+}
+function normalizeExitCode(value, fallback = 1) {
+  if (typeof value !== "number" || !Number.isFinite(value))
+    return fallback;
+  return Math.min(255, Math.max(0, Math.trunc(value)));
+}
+function normalizeRuntime(runtime) {
+  return {
+    version: safeString(runtime.version, /^[A-Za-z0-9.+_-]{1,32}$/, "unknown"),
+    installChannel: safeString(runtime.installChannel, /^[A-Za-z][A-Za-z0-9_-]{0,31}$/, "unknown"),
+    platform: safeString(runtime.platform, /^[A-Za-z0-9_-]{1,24}$/, "unknown"),
+    arch: safeString(runtime.arch, /^[A-Za-z0-9_-]{1,24}$/, "unknown"),
+    runtime: safeString(runtime.runtime, /^[A-Za-z][A-Za-z0-9_-]{0,23}$/, "unknown"),
+    runtimeMajor: Math.min(9999, Math.max(0, Math.trunc(runtime.runtimeMajor) || 0)),
+    isCi: runtime.isCi === true,
+    isTty: runtime.isTty === true
+  };
+}
+function validInstallId(value) {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+function validUserId(value) {
+  return validInstallId(value);
+}
+function validEmail(value) {
+  return typeof value === "string" && value.length <= 254 && /^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$/.test(value);
+}
+function validEventId(value) {
+  return typeof value === "string" && /^[0-9a-f]{32}$/i.test(value);
+}
+function validDebugId(value) {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}
+function validErrorType(value) {
+  return typeof value === "string" && SAFE_ERROR_TYPES.has(value);
+}
+function validErrorCode(value) {
+  return typeof value === "string" && SAFE_ERROR_CODES.has(value);
+}
+function validStatus(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 100 && value <= 599;
+}
+function objectLike(value) {
+  return typeof value === "object" && value !== null || typeof value === "function";
+}
+function safeRead(value, key) {
+  if (!objectLike(value))
+    return;
+  try {
+    return Reflect.get(value, key);
+  } catch {
+    return;
+  }
+}
+function parseStack(stack) {
+  if (typeof stack !== "string" || !CLI_PACKAGE_ROOT)
+    return [];
+  const frames = [];
+  const lines = stack.slice(0, 1e5).split(`
+`, 200);
+  for (const originalLine of lines) {
+    if (frames.length >= MAX_STACK_FRAMES)
+      break;
+    const parsed = parseOwnedStackLine(originalLine, CLI_PACKAGE_ROOT);
+    if (!parsed)
+      continue;
+    const { filename, lineno, colno } = parsed;
+    if (!Number.isSafeInteger(lineno) || !Number.isSafeInteger(colno) || lineno < 1 || colno < 1 || lineno > 1e7 || colno > 1e7) {
+      continue;
+    }
+    frames.push({ filename, lineno, colno, in_app: true });
+  }
+  return frames;
+}
+function detectCliPackageRoot() {
+  try {
+    const modulePath = fileURLToPath2(import.meta.url).replaceAll("\\", "/");
+    for (const suffix of ["/src/telemetry/telemetry.ts", "/bin/dosu.js"]) {
+      if (modulePath.endsWith(suffix))
+        return modulePath.slice(0, -suffix.length);
+    }
+  } catch {}
+  return;
+}
+function parseOwnedStackLine(originalLine, packageRoot) {
+  const line = originalLine.replaceAll("\\", "/");
+  const match = line.match(/^\s*at\s+.*\s+\((.+):(\d+):(\d+)\)\s*$/) ?? line.match(/^\s*at\s+(.+):(\d+):(\d+)\s*$/);
+  if (!match?.[1] || !match[2] || !match[3])
+    return;
+  let absolutePath = match[1];
+  try {
+    if (absolutePath.startsWith("file://"))
+      absolutePath = fileURLToPath2(absolutePath);
+  } catch {
+    return;
+  }
+  if (!isAbsolute(absolutePath))
+    return;
+  const resolvedPath = resolve(absolutePath);
+  const relativePath = relative(packageRoot, resolvedPath);
+  if (relativePath === "" || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) {
+    return;
+  }
+  const filename = relativePath.replaceAll("\\", "/");
+  if (!/^(?:src\/(?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_.-]+\.(?:[cm]?[jt]sx?)|bin\/dosu\.js)$/.test(filename)) {
+    return;
+  }
+  try {
+    if (!existsSync19(resolvedPath))
+      return;
+  } catch {
+    return;
+  }
+  return { filename, lineno: Number(match[2]), colno: Number(match[3]) };
+}
+function sanitizeError(error) {
+  const data = safeRead(error, "data");
+  const typeCandidate = safeRead(error, "name");
+  const codeCandidates = [safeRead(data, "code"), safeRead(error, "code")];
+  const statusCandidates = [
+    safeRead(data, "httpStatus"),
+    safeRead(error, "status"),
+    safeRead(error, "statusCode")
+  ];
+  const exitCodeCandidate = safeRead(error, "exitCode");
+  const code = codeCandidates.find(validErrorCode);
+  const status = statusCandidates.find(validStatus);
+  const exitCode = typeof exitCodeCandidate === "number" && Number.isFinite(exitCodeCandidate) ? normalizeExitCode(exitCodeCandidate) : undefined;
+  return {
+    type: validErrorType(typeCandidate) ? typeCandidate : "Error",
+    ...code ? { code } : {},
+    ...status ? { status } : {},
+    frames: parseStack(safeRead(error, "stack")),
+    ...exitCode === undefined ? {} : { exitCode }
+  };
+}
+function durationBucket(durationMs) {
+  const duration = Number.isFinite(durationMs) ? Math.max(0, durationMs) : 0;
+  if (duration < 100)
+    return "<100ms";
+  if (duration < 500)
+    return "100-499ms";
+  if (duration < 2000)
+    return "500ms-1.9s";
+  if (duration < 1e4)
+    return "2-9.9s";
+  if (duration < 60000)
+    return "10-59s";
+  return "60s+";
+}
+function buildPostHogPayload(input) {
+  const context = normalizeContext(input.context);
+  const runtime = normalizeRuntime(input.runtime);
+  const errorCode = validErrorCode(input.errorCode) ? input.errorCode : undefined;
+  const result = input.result === "success" || input.result === "validation_error" ? input.result : "failure";
+  return {
+    api_key: input.apiKey,
+    distinct_id: context.user?.id ?? (validInstallId(input.installId) ? input.installId : FALLBACK_INSTALL_ID),
+    event: "cli_command_completed",
+    properties: {
+      $geoip_disable: true,
+      ...context.user ? {} : { $process_person_profile: false },
+      schema_version: 1,
+      command: canonicalCommand(input.command),
+      result,
+      duration_bucket: durationBucket(input.durationMs),
+      cli_version: runtime.version,
+      install_channel: runtime.installChannel,
+      platform: runtime.platform,
+      arch: runtime.arch,
+      runtime: runtime.runtime,
+      runtime_major: runtime.runtimeMajor,
+      is_ci: runtime.isCi,
+      is_tty: runtime.isTty,
+      mode: context.mode,
+      is_authenticated: context.isAuthenticated,
+      exit_code: normalizeExitCode(input.exitCode),
+      ...errorCode ? { error_code: errorCode } : {}
+    }
+  };
+}
+function parsePostHogProjectToken(value) {
+  if (typeof value !== "string")
+    return null;
+  const token = value.trim();
+  return /^phc_[A-Za-z0-9_-]{3,252}$/.test(token) ? token : null;
+}
+function parseTelemetryWebAppURL(value, allowInsecureLoopback = false) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 2048)
+    return null;
+  try {
+    const url = new URL(value.trim());
+    if (!url.hostname || url.username || url.password || url.search || url.hash)
+      return null;
+    const loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+    const secure = url.protocol === "https:";
+    const allowedDevelopmentOrigin = allowInsecureLoopback && url.protocol === "http:" && loopbackHosts.has(url.hostname);
+    if (!secure && !allowedDevelopmentOrigin)
+      return null;
+    return url.toString().replace(/\/$/, "");
+  } catch {
+    return null;
+  }
+}
+function parseSentryDsn(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 2048)
+    return null;
+  const dsn = value.trim();
+  try {
+    const url = new URL(dsn);
+    if (url.protocol !== "https:" || !url.hostname || !url.username || url.password || url.search || url.hash || !/^[A-Za-z0-9_.-]{1,128}$/.test(url.username) || url.username.toLowerCase().startsWith("sntry")) {
+      return null;
+    }
+    const segments = url.pathname.split("/").filter(Boolean);
+    const projectId = segments.pop();
+    if (!projectId || !/^[A-Za-z0-9_-]{1,128}$/.test(projectId))
+      return null;
+    if (segments.some((segment) => !/^[A-Za-z0-9._~-]{1,128}$/.test(segment)))
+      return null;
+    const prefix = segments.length > 0 ? `/${segments.join("/")}` : "";
+    return {
+      dsn,
+      endpoint: `${url.protocol}//${url.host}${prefix}/api/${projectId}/envelope/`,
+      projectId,
+      publicKey: url.username
+    };
+  } catch {
+    return null;
+  }
+}
+function sentryTags(command, context, runtime, error) {
+  return {
+    schema_version: "1",
+    command,
+    cli_version: runtime.version,
+    install_channel: runtime.installChannel,
+    os: runtime.platform,
+    arch: runtime.arch,
+    runtime: runtime.runtime,
+    runtime_major: String(runtime.runtimeMajor),
+    is_ci: String(runtime.isCi),
+    is_tty: String(runtime.isTty),
+    mode: context.mode,
+    is_authenticated: String(context.isAuthenticated),
+    ...error.code ? { error_code: error.code } : {},
+    ...error.status ? { http_status: String(error.status) } : {},
+    ...error.exitCode === undefined ? {} : { exit_code: String(error.exitCode) }
+  };
+}
+function buildSentryEnvelope(input) {
+  const parsedDsn = parseSentryDsn(input.dsn);
+  if (!parsedDsn || !validEventId(input.eventId))
+    return null;
+  const context = normalizeContext(input.context);
+  const runtime = normalizeRuntime(input.runtime);
+  const command = canonicalCommand(input.command);
+  const debugId = validDebugId(input.debugId) ? input.debugId.toLowerCase() : undefined;
+  const error = {
+    type: validErrorType(input.error.type) ? input.error.type : "Error",
+    ...validErrorCode(input.error.code) ? { code: input.error.code } : {},
+    ...validStatus(input.error.status) ? { status: input.error.status } : {},
+    ...typeof input.error.exitCode === "number" && Number.isFinite(input.error.exitCode) ? { exitCode: normalizeExitCode(input.error.exitCode) } : {},
+    frames: input.error.frames.slice(0, MAX_STACK_FRAMES).map((frame) => {
+      const filename = /^(?:src\/(?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_.-]+\.(?:[cm]?[jt]sx?)|bin\/dosu\.js)$/.test(frame.filename) ? frame.filename : "src/unknown.ts";
+      return {
+        filename,
+        ...debugId && filename === "bin/dosu.js" ? { abs_path: BUNDLE_CODE_FILE } : {},
+        lineno: Math.min(1e7, Math.max(1, Math.trunc(frame.lineno) || 1)),
+        colno: Math.min(1e7, Math.max(1, Math.trunc(frame.colno) || 1)),
+        in_app: true
+      };
+    }).reverse()
+  };
+  const exceptionValue = {
+    type: error.type,
+    value: error.code ?? error.type,
+    ...error.frames.length > 0 ? { stacktrace: { frames: error.frames } } : {}
+  };
+  const newestFrame = error.frames.at(-1);
+  const safeCallsite = newestFrame ? `${newestFrame.filename}:${newestFrame.lineno}` : "unknown";
+  const timestampMs = Number.isFinite(input.timestampMs) ? Math.max(0, input.timestampMs) : 0;
+  const mappedBundle = debugId && error.frames.some((frame) => frame.abs_path === BUNDLE_CODE_FILE);
+  const event = {
+    event_id: input.eventId.toLowerCase(),
+    timestamp: timestampMs / 1000,
+    platform: "node",
+    level: "error",
+    release: `dosu-cli@${runtime.version}`,
+    tags: sentryTags(command, context, runtime, error),
+    ...context.user ? { user: context.user } : {},
+    ...mappedBundle ? {
+      debug_meta: {
+        images: [{ type: "sourcemap", code_file: BUNDLE_CODE_FILE, debug_id: debugId }]
+      }
+    } : {},
+    fingerprint: ["dosu-cli", command, error.type, error.code ?? "unknown", safeCallsite],
+    exception: { values: [exceptionValue] }
+  };
+  const envelopeHeader = {
+    event_id: input.eventId.toLowerCase(),
+    dsn: parsedDsn.dsn,
+    sent_at: new Date(timestampMs).toISOString()
+  };
+  return {
+    endpoint: parsedDsn.endpoint,
+    body: `${JSON.stringify(envelopeHeader)}
+${JSON.stringify({ type: "event" })}
+${JSON.stringify(event)}`
+  };
+}
+function fetchWithoutRedirect(url, init = {}) {
+  let parsedURL;
+  try {
+    parsedURL = new URL(url);
+    if (parsedURL.protocol !== "http:" && parsedURL.protocol !== "https:") {
+      return Promise.reject(new Error("unsupported telemetry protocol"));
+    }
+  } catch (error) {
+    return Promise.reject(error);
+  }
+  return new Promise((resolve2, reject) => {
+    let request;
+    let response;
+    let settled = false;
+    const signal = init.signal;
+    const cleanup = () => signal?.removeEventListener("abort", onAbort);
+    const fail = (error) => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      response?.destroy();
+      request?.socket?.destroy();
+      request?.destroy();
+      reject(error);
+    };
+    const succeed = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      response?.destroy();
+      request?.socket?.destroy();
+      request?.destroy();
+      resolve2(value);
+    };
+    const onAbort = () => {
+      const error = new Error("telemetry request aborted");
+      error.name = "AbortError";
+      fail(error);
+    };
+    try {
+      if (signal?.aborted) {
+        onAbort();
+        return;
+      }
+      const body = init.body;
+      if (body !== undefined && body !== null && typeof body !== "string") {
+        fail(new Error("unsupported telemetry request body"));
+        return;
+      }
+      const headers = Object.fromEntries(new Headers(init.headers).entries());
+      const transport = parsedURL.protocol === "https:" ? httpsRequest : httpRequest2;
+      request = transport(parsedURL, {
+        method: init.method ?? "GET",
+        headers,
+        agent: false
+      }, (incoming) => {
+        response = incoming;
+        const chunks = [];
+        let totalBytes = 0;
+        incoming.on("data", (chunk) => {
+          const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+          totalBytes += bytes.byteLength;
+          if (totalBytes > MAX_RESPONSE_BYTES) {
+            fail(new Error("telemetry response too large"));
+            return;
+          }
+          chunks.push(bytes);
+        });
+        incoming.once("error", fail);
+        incoming.once("end", () => {
+          try {
+            const responseHeaders = new Headers;
+            for (let index = 0;index < incoming.rawHeaders.length; index += 2) {
+              const name = incoming.rawHeaders[index];
+              const value = incoming.rawHeaders[index + 1];
+              if (name && value)
+                responseHeaders.append(name, value);
+            }
+            const status = incoming.statusCode;
+            if (!status)
+              throw new Error("telemetry response missing status");
+            succeed(new Response(chunks.length > 0 ? Buffer.concat(chunks) : null, {
+              status,
+              statusText: incoming.statusMessage,
+              headers: responseHeaders
+            }));
+          } catch (error) {
+            fail(error);
+          }
+        });
+      });
+      request.once("error", fail);
+      signal?.addEventListener("abort", onAbort, { once: true });
+      request.end(body);
+    } catch (error) {
+      fail(error);
+    }
+  });
+}
+async function sendHttpsRequest(url, init, fetcher = fetchWithoutRedirect) {
+  try {
+    if (new URL(url).protocol !== "https:")
+      return false;
+  } catch {
+    return false;
+  }
+  const controller = new AbortController;
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(new Error("telemetry request timed out"));
+    }, REQUEST_TIMEOUT_MS);
+  });
+  try {
+    const request = fetcher(url, { ...init, redirect: "error", signal: controller.signal });
+    const result = await Promise.race([request, timeout]);
+    return result.ok;
+  } catch {
+    return false;
+  } finally {
+    controller.abort();
+    if (timer !== undefined)
+      clearTimeout(timer);
+  }
+}
+function environmentFlag(value) {
+  if (value === undefined)
+    return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized !== "" && !["0", "false", "no", "off"].includes(normalized);
+}
+function runtimeNameAndMajor() {
+  const versions = process.versions;
+  const runtime = versions.bun ? "bun" : "node";
+  const version = versions.bun ?? versions.node;
+  return { runtime, runtimeMajor: Number.parseInt(version.split(".")[0] ?? "0", 10) || 0 };
+}
+function resolveRuntime(dependencies, env) {
+  const detected = runtimeNameAndMajor();
+  return normalizeRuntime({
+    version: dependencies.version ?? VERSION,
+    installChannel: dependencies.installChannel ?? INSTALL_CHANNEL,
+    platform: dependencies.platform ?? process.platform,
+    arch: dependencies.arch ?? process.arch,
+    runtime: dependencies.runtime ?? detected.runtime,
+    runtimeMajor: dependencies.runtimeMajor ?? detected.runtimeMajor,
+    isCi: dependencies.isCi ?? environmentFlag(env.CI),
+    isTty: dependencies.isTty ?? process.stdout.isTTY === true
+  });
+}
+function validationFailure(exitCode, error) {
+  if (exitCode === 2)
+    return true;
+  if (error?.type === "CliUsageError")
+    return true;
+  if (!error?.code)
+    return false;
+  return error.code.startsWith("commander.") || ["BAD_REQUEST", "INVALID_ARGUMENT", "UNPROCESSABLE_CONTENT", "VALIDATION_ERROR"].includes(error.code);
+}
+function safeNow(now) {
+  try {
+    const value = now();
+    return Number.isFinite(value) ? Math.max(0, value) : 0;
+  } catch {
+    return 0;
+  }
+}
+function safeUuid(generate) {
+  try {
+    const value = generate();
+    return validInstallId(value) ? value : undefined;
+  } catch {
+    return;
+  }
+}
+function eventId(generate) {
+  const uuid = safeUuid(generate);
+  return uuid?.replaceAll("-", "");
+}
+function createCommandTelemetry(settings2, dependencies = {}) {
+  const env = dependencies.env ?? process.env;
+  const fetcher = dependencies.fetch;
+  const now = dependencies.now ?? Date.now;
+  const generateUuid = dependencies.randomUUID ?? randomUUID2;
+  const writeStderr = dependencies.stderr ?? ((payload) => process.stderr.write(`${payload}
+`));
+  const webAppURL = dependencies.webAppURL ?? getWebAppURL;
+  const runtime = resolveRuntime(dependencies, env);
+  const debug = env.DOSU_TELEMETRY_DEBUG === "1";
+  const disabled = settings2.disabled === true || environmentFlag(env.DO_NOT_TRACK) || environmentFlag(env.DOSU_TELEMETRY_DISABLED);
+  const rawAnalyticsToken = dependencies.env ? env.DOSU_POSTHOG_PROJECT_TOKEN_OVERRIDE ?? env.DOSU_POSTHOG_PROJECT_TOKEN : process.env.DOSU_POSTHOG_PROJECT_TOKEN_OVERRIDE ?? "phc_Uo9RxhN0HRk8gZkPlT18BCr7eqsM0MPWVW88HZB95V5";
+  const rawSentryDsn = dependencies.env ? env.DOSU_CLI_SENTRY_DSN_OVERRIDE ?? env.DOSU_CLI_SENTRY_DSN : process.env.DOSU_CLI_SENTRY_DSN_OVERRIDE ?? "https://f6b3e51dea6f50746316aa1896df76e0@o4505364738670592.ingest.us.sentry.io/4511883653283840";
+  const analyticsToken = parsePostHogProjectToken(rawAnalyticsToken) ?? undefined;
+  const sentryDsn = parseSentryDsn(rawSentryDsn)?.dsn;
+  let started = false;
+  let terminal = false;
+  let startedAt = 0;
+  let command = UNKNOWN_COMMAND;
+  let context = normalizeContext(undefined);
+  let installIdResolved = false;
+  let resolvedInstallId = settings2.install_id;
+  function installId() {
+    if (validInstallId(resolvedInstallId))
+      return resolvedInstallId;
+    if (installIdResolved)
+      return;
+    installIdResolved = true;
+    try {
+      resolvedInstallId = dependencies.resolveInstallId?.();
+    } catch {
+      resolvedInstallId = undefined;
+    }
+    return validInstallId(resolvedInstallId) ? resolvedInstallId : undefined;
+  }
+  function debugPayload(payload) {
+    try {
+      writeStderr(payload);
+    } catch {}
+  }
+  async function dispatch(result, exitCode, error) {
+    try {
+      const tasks = [];
+      if (!disabled && analyticsToken) {
+        const id = context.user?.id ?? installId();
+        if (id) {
+          const payload = buildPostHogPayload({
+            apiKey: analyticsToken,
+            ...context.user ? {} : { installId: id },
+            command,
+            result,
+            durationMs: safeNow(now) - startedAt,
+            exitCode,
+            errorCode: error?.code,
+            context,
+            runtime
+          });
+          const body = JSON.stringify(payload);
+          if (debug) {
+            debugPayload(body);
+          } else {
+            const base = parseTelemetryWebAppURL(webAppURL());
+            if (base) {
+              tasks.push(sendHttpsRequest(`${base}/ph-api/i/v0/e/`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body
+              }, fetcher));
+            }
+          }
+        }
+      }
+      if (!disabled && result === "failure" && error && sentryDsn) {
+        const id = eventId(generateUuid);
+        const envelope = id ? buildSentryEnvelope({
+          dsn: sentryDsn,
+          command,
+          context,
+          runtime,
+          error,
+          eventId: id,
+          timestampMs: safeNow(now),
+          debugId: BUNDLE_DEBUG_ID_PLACEHOLDER
+        }) : null;
+        if (envelope) {
+          if (debug) {
+            debugPayload(envelope.body);
+          } else {
+            tasks.push(sendHttpsRequest(envelope.endpoint, {
+              method: "POST",
+              headers: { "content-type": "application/x-sentry-envelope" },
+              body: envelope.body
+            }, fetcher));
+          }
+        }
+      }
+      await Promise.all(tasks);
+    } catch {}
+  }
+  return {
+    start(commandName, commandContext) {
+      if (started || terminal)
+        return;
+      started = true;
+      command = canonicalCommand(commandName);
+      context = normalizeContext(commandContext);
+      startedAt = safeNow(now);
+    },
+    async complete(exitCode = 0) {
+      if (!started || terminal)
+        return;
+      terminal = true;
+      const normalizedExitCode = normalizeExitCode(exitCode, 0);
+      const result = normalizedExitCode === 0 ? "success" : validationFailure(normalizedExitCode, undefined) ? "validation_error" : "failure";
+      const error = result === "failure" ? { type: "CommandExitError", frames: [], exitCode: normalizedExitCode } : undefined;
+      await dispatch(result, normalizedExitCode, error);
+    },
+    async fail(rawError) {
+      if (!started || terminal)
+        return;
+      terminal = true;
+      const error = sanitizeError(rawError);
+      const exitCode = error.exitCode ?? 1;
+      const result = validationFailure(exitCode, error) ? "validation_error" : "failure";
+      await dispatch(result, exitCode, error);
+    }
+  };
+}
+var REQUEST_TIMEOUT_MS = 500, MAX_RESPONSE_BYTES, MAX_STACK_FRAMES = 20, UNKNOWN_COMMAND = "unknown", FALLBACK_INSTALL_ID = "00000000-0000-4000-8000-000000000000", BUNDLE_CODE_FILE = "app:///bin/dosu.js", CLI_PACKAGE_ROOT, SAFE_ERROR_TYPES, SAFE_ERROR_CODES;
+var init_telemetry = __esm(() => {
+  MAX_RESPONSE_BYTES = 1024 * 1024;
+  CLI_PACKAGE_ROOT = detectCliPackageRoot();
+  SAFE_ERROR_TYPES = new Set([
+    "AbortError",
+    "AggregateError",
+    "CommanderError",
+    "CliUsageError",
+    "CommandExitError",
+    "Error",
+    "OAuthCallbackError",
+    "RangeError",
+    "ReferenceError",
+    "SessionExpiredError",
+    "SyntaxError",
+    "TicketHttpError",
+    "TRPCClientError",
+    "TypeError"
+  ]);
+  SAFE_ERROR_CODES = new Set([
+    "ABORT_ERR",
+    "BAD_GATEWAY",
+    "BAD_REQUEST",
+    "CLIENT_CLOSED_REQUEST",
+    "CONFLICT",
+    "EACCES",
+    "EAI_AGAIN",
+    "EBUSY",
+    "ECONNREFUSED",
+    "ECONNRESET",
+    "EEXIST",
+    "EHOSTUNREACH",
+    "EINVAL",
+    "EISDIR",
+    "ELOOP",
+    "EMFILE",
+    "ENAMETOOLONG",
+    "ENETUNREACH",
+    "ENFILE",
+    "ENOENT",
+    "ENOMEM",
+    "ENOSPC",
+    "ENOTFOUND",
+    "ENOTDIR",
+    "EPIPE",
+    "EPERM",
+    "EROFS",
+    "ETIMEDOUT",
+    "FORBIDDEN",
+    "GATEWAY_TIMEOUT",
+    "IMPORT_ALREADY_IN_PROGRESS",
+    "INTERNAL_SERVER_ERROR",
+    "INVALID_ARGUMENT",
+    "METHOD_NOT_SUPPORTED",
+    "NOT_FOUND",
+    "NOT_IMPLEMENTED",
+    "PARSE_ERROR",
+    "PAYLOAD_TOO_LARGE",
+    "PAYMENT_REQUIRED",
+    "PRECONDITION_FAILED",
+    "SERVICE_UNAVAILABLE",
+    "TIMEOUT",
+    "TOO_MANY_REQUESTS",
+    "UNAUTHORIZED",
+    "UNPROCESSABLE_CONTENT",
+    "UNSUPPORTED_MEDIA_TYPE",
+    "VALIDATION_ERROR",
+    "commander.conflictingOption",
+    "commander.error",
+    "commander.excessArguments",
+    "commander.invalidArgument",
+    "commander.missingArgument",
+    "commander.missingMandatoryOptionValue",
+    "commander.optionMissingArgument",
+    "commander.unknownCommand",
+    "commander.unknownOption"
+  ]);
+});
+
 // src/setup/analytics.ts
 async function trackCliOnboardingEvent(cfg, onboardingRunID, event, properties = {}) {
-  if (!cfg.active_account?.session.access_token)
-    return;
   try {
-    const trpc = createTypedClient(cfg);
-    await withTimeout(trpc.user.trackCliOnboardingEvent.mutate({
+    if (!isTelemetryEnabled())
+      return;
+    if (!analyticsReleaseEnabled())
+      return;
+    if (!cfg.active_account?.session.access_token)
+      return;
+    if (!isUUID2(onboardingRunID))
+      return;
+    const input = {
       event,
       properties: {
         ...baseProperties(cfg),
         onboarding_run_id: onboardingRunID,
-        ...properties
+        ...allowlistedWorkflowProperties(properties)
       }
-    }), TRACKING_TIMEOUT_MS);
+    };
+    if (printDebugPayload(input))
+      return;
+    await withTimeout((signal) => createAnalyticsClient(cfg.active_account?.session.access_token, signal).user.trackCliOnboardingEvent.mutate(input), TRACKING_TIMEOUT_MS);
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    logger.debug("setup", `CLI onboarding analytics failed: ${event}: ${msg}`);
+    logTrackingFailure("analytics", event, err);
   }
 }
 async function trackCliOnboardingPreAuthEvent(onboardingRunID, event, properties = {}) {
   try {
-    const trpc = createAnonymousClient();
-    await withTimeout(trpc.user.trackCliOnboardingPreAuthEvent.mutate({
+    if (!isTelemetryEnabled())
+      return;
+    if (!analyticsReleaseEnabled())
+      return;
+    if (!isUUID2(onboardingRunID))
+      return;
+    const input = {
       event,
       onboarding_run_id: onboardingRunID,
       properties: {
         ...baseProperties(emptyConfig()),
-        ...properties
+        ...allowlistedWorkflowProperties(properties)
       }
-    }), TRACKING_TIMEOUT_MS);
+    };
+    if (printDebugPayload(input))
+      return;
+    await withTimeout((signal) => createAnalyticsClient(undefined, signal).user.trackCliOnboardingPreAuthEvent.mutate(input), TRACKING_TIMEOUT_MS);
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    logger.debug("setup", `CLI onboarding pre-auth analytics failed: ${event}: ${msg}`);
+    logTrackingFailure("pre-auth analytics", event, err);
   }
 }
+function logTrackingFailure(kind, event, error) {
+  try {
+    const message = error instanceof Error ? error.message : String(error);
+    logger.debug("setup", `CLI onboarding ${kind} failed: ${event}: ${message}`);
+  } catch {}
+}
+function printDebugPayload(payload) {
+  if (process.env.DOSU_TELEMETRY_DEBUG !== "1")
+    return false;
+  console.error(`[dosu telemetry:posthog] ${JSON.stringify(payload)}`);
+  return true;
+}
+function analyticsReleaseEnabled() {
+  return Boolean(parsePostHogProjectToken(process.env.DOSU_POSTHOG_PROJECT_TOKEN_OVERRIDE ?? "phc_Uo9RxhN0HRk8gZkPlT18BCr7eqsM0MPWVW88HZB95V5"));
+}
 function baseProperties(cfg) {
   return {
-    cli_version: VERSION,
-    platform: process.platform,
-    arch: process.arch,
+    cli_version: safeIdentifier(VERSION, 32),
+    install_channel: safeIdentifier(INSTALL_CHANNEL, 32),
+    platform: safeIdentifier(process.platform, 24),
+    arch: safeIdentifier(process.arch, 24),
     mode: cfg.mode ?? "cloud",
-    org_id: cfg.active_account?.target?.org_id,
-    deployment_id: cfg.active_account?.target?.deployment_id,
-    space_id: cfg.active_account?.target?.space_id
+    org_id: safeIdentifier(cfg.active_account?.target?.org_id, 128),
+    deployment_id: safeIdentifier(cfg.active_account?.target?.deployment_id, 128),
+    space_id: safeIdentifier(cfg.active_account?.target?.space_id, 128)
   };
 }
-function createAnonymousClient() {
-  const webAppURL = getWebAppURL();
+function allowlistedWorkflowProperties(properties) {
+  const input = properties;
+  const safe = {};
+  if (typeof input.has_deployment_option === "boolean") {
+    safe.has_deployment_option = input.has_deployment_option;
+  }
+  if (input.mode_option === "cloud" || input.mode_option === "oss") {
+    safe.mode_option = input.mode_option;
+  }
+  if (input.flow_kind === "onboarding" || input.flow_kind === "oss" || input.flow_kind === "setup") {
+    safe.flow_kind = input.flow_kind;
+  }
+  if (typeof input.reason === "string" && SETUP_FAILURE_REASONS.has(input.reason)) {
+    safe.reason = input.reason;
+  }
+  if (typeof input.provider_count === "number" && Number.isInteger(input.provider_count) && input.provider_count >= 0 && input.provider_count <= 50) {
+    safe.provider_count = input.provider_count;
+  }
+  if (Array.isArray(input.providers)) {
+    safe.providers = input.providers.filter((provider) => typeof provider === "string" && /^[a-z][a-z0-9-]{0,31}$/.test(provider)).slice(0, 50);
+  }
+  for (const key of ["completed_mcp", "completed_skill", "completed_agents_md"]) {
+    if (typeof input[key] === "boolean")
+      safe[key] = input[key];
+  }
+  return safe;
+}
+function safeIdentifier(value, maxLength) {
+  return typeof value === "string" && value.length <= maxLength && /^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(value) ? value : undefined;
+}
+function isUUID2(value) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+function createAnalyticsClient(accessToken, requestSignal) {
+  const webAppURL = parseTelemetryWebAppURL(getWebAppURL(), process.env.DOSU_DEV === "true");
   if (!webAppURL) {
-    throw new Error("Web app URL not configured");
+    throw new Error("Secure web app URL not configured");
   }
   return createTRPCClient({
     links: [
@@ -11610,19 +12606,32 @@ function createAnonymousClient() {
         url: `${webAppURL}/api/cli-trpc`,
         transformer: dist_default,
         headers: {
-          "x-dosu-cli-contract": CLI_CONTRACT_HASH
+          "x-dosu-cli-contract": CLI_CONTRACT_HASH,
+          ...accessToken ? { "Supabase-Access-Token": accessToken } : {}
+        },
+        fetch: (url, options) => {
+          const target = typeof url === "string" ? url : url instanceof URL ? url.toString() : url.url;
+          return fetchWithoutRedirect(target, {
+            ...options,
+            redirect: "error",
+            ...requestSignal ? { signal: requestSignal } : {}
+          });
         }
       })
     ]
   });
 }
-async function withTimeout(promise, timeoutMs) {
+async function withTimeout(operation, timeoutMs) {
+  const controller = new AbortController;
   let timeout;
   try {
     return await Promise.race([
-      promise,
+      operation(controller.signal),
       new Promise((_2, reject) => {
-        timeout = setTimeout(() => reject(new Error("tracking timeout")), timeoutMs);
+        timeout = setTimeout(() => {
+          controller.abort();
+          reject(new Error("tracking timeout"));
+        }, timeoutMs);
       })
     ]);
   } finally {
@@ -11630,13 +12639,32 @@ async function withTimeout(promise, timeoutMs) {
       clearTimeout(timeout);
   }
 }
-var TRACKING_TIMEOUT_MS = 1500;
+var SETUP_FAILURE_REASONS, TRACKING_TIMEOUT_MS = 500;
 var init_analytics = __esm(() => {
   init_dist();
   init_dist4();
-  init_trpc();
   init_config();
   init_logger();
+  init_settings();
+  init_telemetry();
+  SETUP_FAILURE_REASONS = new Set([
+    "access_denied",
+    "api_key_failed",
+    "bad_oauth_state",
+    "cloud_setup_context_failed",
+    "deployment_resolution_failed",
+    "invalid_request",
+    "invalid_scope",
+    "mcp_selection_cancelled",
+    "oauth_callback_error",
+    "onboarding_incomplete_after_handshake",
+    "server_error",
+    "temporarily_unavailable",
+    "unauthorized_client",
+    "unexpected_auth_error",
+    "unsupported_response_type",
+    "web_onboarding_incomplete"
+  ]);
 });
 
 // src/setup/audit-handoff.ts
@@ -11778,34 +12806,6 @@ var init_rules_step = __esm(() => {
   init_styles();
 });
 
-// src/auth/errors.ts
-var exports_errors = {};
-__export(exports_errors, {
-  OAuthCallbackError: () => OAuthCallbackError
-});
-var OAuthCallbackError;
-var init_errors = __esm(() => {
-  OAuthCallbackError = class OAuthCallbackError extends Error {
-    error;
-    errorCode;
-    errorDescription;
-    constructor(message, details = {}) {
-      super(message);
-      this.name = "OAuthCallbackError";
-      this.error = details.error;
-      this.errorCode = details.errorCode;
-      this.errorDescription = details.errorDescription;
-    }
-    get userMessage() {
-      const desc = this.errorDescription ?? this.message;
-      if (this.errorCode === "bad_oauth_state" || /state/i.test(desc)) {
-        return `Authentication failed: ${desc}. Run \`dosu login\` again.`;
-      }
-      return `Authentication failed: ${desc}`;
-    }
-  };
-});
-
 // src/auth/server.ts
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
@@ -11983,8 +12983,8 @@ h1 {
 async function startCallbackServer(opts = {}) {
   let resolveToken;
   let rejectToken;
-  const tokenPromise = new Promise((resolve, reject) => {
-    resolveToken = resolve;
+  const tokenPromise = new Promise((resolve2, reject) => {
+    resolveToken = resolve2;
     rejectToken = reject;
   });
   const http = __require("node:http");
@@ -12042,8 +13042,8 @@ async function startCallbackServer(opts = {}) {
     res.writeHead(200, { "Content-Type": "text/html" });
     res.end(buildSuccessHtml(email ?? undefined, opts.successVariant ?? "auth"));
   });
-  await new Promise((resolve) => {
-    httpServer.listen(0, "localhost", () => resolve());
+  await new Promise((resolve2) => {
+    httpServer.listen(0, "localhost", () => resolve2());
   });
   httpServer.unref();
   const addr = httpServer.address();
@@ -12213,17 +13213,21 @@ __export(exports_flow2, {
   stepDetectTools: () => stepDetectTools,
   stepConfigureTools: () => stepConfigureTools,
   runSetup: () => runSetup,
-  runInstallSkill: () => runInstallSkill
+  runInstallSkill: () => runInstallSkill,
+  cliAuthFailureReason: () => cliAuthFailureReason
 });
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
+function trackInBackground(tracking) {
+  tracking.catch(() => {});
+}
 async function runSetup(opts = {}) {
-  const onboardingRunID = randomUUID();
+  const onboardingRunID = randomUUID3();
   logger.info("setup", `Setup flow started${opts.deploymentID ? ` deployment=${opts.deploymentID}` : ""}${opts.mode ? ` mode=${opts.mode}` : ""}`);
   intro("Dosu CLI Setup");
-  await trackCliOnboardingPreAuthEvent(onboardingRunID, "cli_onboarding_launch_attempted", {
+  trackInBackground(trackCliOnboardingPreAuthEvent(onboardingRunID, "cli_onboarding_launch_attempted", {
     has_deployment_option: Boolean(opts.deploymentID),
     mode_option: opts.mode
-  });
+  }));
   let cfg = loadConfig();
   applyModeOverride(cfg, opts);
   if (opts.deploymentID) {
@@ -12234,7 +13238,7 @@ async function runSetup(opts = {}) {
   if (!authed)
     return;
   cfg = authed.cfg;
-  await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_auth_completed");
+  trackInBackground(trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_auth_completed"));
   let apiClient = new Client(cfg);
   let cloudSetupContext = null;
   if (cfg.mode !== MODE_OSS) {
@@ -12242,39 +13246,39 @@ async function runSetup(opts = {}) {
     s.start("Loading your workspace...");
     cloudSetupContext = await resolveCloudSetupContext(cfg);
     if (!cloudSetupContext) {
-      await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
+      trackInBackground(trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
         reason: "cloud_setup_context_failed"
-      });
+      }));
       s.stop("Workspace load failed");
       return;
     }
     s.stop("Workspace loaded");
   }
-  await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_started", {
+  trackInBackground(trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_started", {
     flow_kind: cloudSetupContext ? cloudSetupContext.finishedOnboarding ? "setup" : "onboarding" : "oss"
-  });
+  }));
   const needsHandshake = cfg.mode !== MODE_OSS && cloudSetupContext !== null && !cloudSetupContext.finishedOnboarding && !opts.deploymentID;
   if (needsHandshake) {
     const handshook = await stepSetupHandshake(cfg, onboardingRunID);
     if (!handshook) {
-      await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
+      trackInBackground(trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
         reason: "web_onboarding_incomplete"
-      });
+      }));
       return;
     }
     apiClient = new Client(cfg);
     const refreshed = await resolveCloudSetupContext(cfg);
     if (refreshed === null) {
-      await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
+      trackInBackground(trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
         reason: "cloud_setup_context_failed"
-      });
+      }));
       return;
     }
     if (!refreshed.finishedOnboarding) {
       log.warn("Your account still needs onboarding. Finish it in the browser at the Dosu app, then re-run `dosu setup`.");
-      await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
+      trackInBackground(trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
         reason: "onboarding_incomplete_after_handshake"
-      });
+      }));
       process.exitCode = 1;
       return;
     }
@@ -12283,43 +13287,43 @@ async function runSetup(opts = {}) {
   if (!cfg.active_account?.target?.deployment_id || opts.deploymentID) {
     const ok = await resolveDeployment(apiClient, cfg, opts);
     if (!ok) {
-      await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
+      trackInBackground(trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
         reason: "deployment_resolution_failed"
-      });
+      }));
       return;
     }
   }
   const apiKey = await stepMintAPIKey(apiClient, cfg);
   if (!apiKey) {
-    await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
+    trackInBackground(trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
       reason: "api_key_failed"
-    });
+    }));
     return;
   }
   updateTarget(cfg, { api_key: apiKey });
   saveConfig(cfg);
   const configured = await stepConfigureMcpTools(cfg);
   if (configured === null) {
-    await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_cancelled", {
+    trackInBackground(trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_cancelled", {
       reason: "mcp_selection_cancelled"
-    });
+    }));
     return;
   }
   const mcpConfiguredThisRun = configured.some((result) => result.action === "install" || result.action === "skip");
   const configuredProviders = configured.filter((result) => (result.action === "install" || result.action === "skip") && !result.error);
   const mcpCompleted = configuredProviders.length > 0;
   if (mcpCompleted) {
-    await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_mcp_configured", {
+    trackInBackground(trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_mcp_configured", {
       provider_count: configuredProviders.length,
       providers: configuredProviders.map((result) => result.provider.id())
-    });
+    }));
   }
   let skillCompleted = false;
   const skillProviders = configuredProviders.map((result) => result.provider).filter((provider) => skillInstallTargetForProvider(provider.id()) !== null);
   if (skillProviders.length > 0) {
     skillCompleted = await runInstallSkill(skillProviders);
     if (skillCompleted) {
-      await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_skill_installed");
+      trackInBackground(trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_skill_installed"));
     }
   }
   let agentsMdCompleted = false;
@@ -12331,11 +13335,11 @@ async function runSetup(opts = {}) {
     handoffToAudit = await offerAuditHandoff();
   }
   if (mcpCompleted || skillCompleted || agentsMdCompleted) {
-    await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_completed", {
+    trackInBackground(trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_completed", {
       completed_mcp: mcpCompleted,
       completed_skill: skillCompleted,
       completed_agents_md: agentsMdCompleted
-    });
+    }));
   }
   if (cfg.mode === MODE_OSS) {
     outro("Setup complete! Using open-source libraries only.\n\nTips: Run `dosu setup --mode cloud` to connect your own repos.");
@@ -12447,7 +13451,7 @@ async function stepAuthenticate(existingCfg, onboardingRunID) {
     }
   }
   if (onboardingRunID) {
-    await trackCliOnboardingPreAuthEvent(onboardingRunID, "cli_onboarding_auth_started");
+    trackInBackground(trackCliOnboardingPreAuthEvent(onboardingRunID, "cli_onboarding_auth_started"));
   }
   return await openBrowserForSetup(cfg, onboardingRunID);
 }
@@ -12484,25 +13488,30 @@ async function openBrowserForSetup(cfg, onboardingRunID) {
   } catch (err) {
     const msg = err instanceof Error ? err.stack ?? err.message : String(err);
     logger.error("setup", `Auth failed: ${msg}`);
-    const { OAuthCallbackError: OAuthCallbackError2 } = await Promise.resolve().then(() => (init_errors(), exports_errors));
-    if (err instanceof OAuthCallbackError2) {
+    if (err instanceof OAuthCallbackError) {
       log.error(err.userMessage);
       if (onboardingRunID) {
-        await trackCliOnboardingPreAuthEvent(onboardingRunID, "cli_onboarding_auth_failed", {
-          reason: err.errorCode ?? err.errorDescription ?? "oauth_callback_error"
-        });
+        trackInBackground(trackCliOnboardingPreAuthEvent(onboardingRunID, "cli_onboarding_auth_failed", {
+          reason: cliAuthFailureReason(err)
+        }));
       }
       return null;
     }
     log.error(`Authentication failed: ${err instanceof Error ? err.message : String(err)}`);
     if (onboardingRunID) {
-      await trackCliOnboardingPreAuthEvent(onboardingRunID, "cli_onboarding_auth_failed", {
-        reason: err instanceof Error ? err.message : String(err)
-      });
+      trackInBackground(trackCliOnboardingPreAuthEvent(onboardingRunID, "cli_onboarding_auth_failed", {
+        reason: cliAuthFailureReason(err)
+      }));
     }
     return null;
   }
 }
+function cliAuthFailureReason(err) {
+  if (!(err instanceof OAuthCallbackError))
+    return "unexpected_auth_error";
+  const code = err.errorCode;
+  return code && OAUTH_ANALYTICS_REASONS.has(code) ? code : "oauth_callback_error";
+}
 async function stepSetupHandshake(cfg, onboardingRunID) {
   logger.info("setup", "Step: setup handshake");
   log.info("Almost there — finish setting up in the browser and we'll pick up from here.");
@@ -12800,9 +13809,10 @@ function stepShowSummary(results) {
     log.success("All agents already configured. No changes needed.");
   }
 }
-var SETUP_HANDSHAKE_TIMEOUT_MS = 1800000;
+var OAUTH_ANALYTICS_REASONS, SETUP_HANDSHAKE_TIMEOUT_MS = 1800000;
 var init_flow2 = __esm(() => {
   init_dist8();
+  init_errors();
   init_client();
   init_skill();
   init_config();
@@ -12813,11 +13823,21 @@ var init_flow2 = __esm(() => {
   init_audit_handoff();
   init_rules_step();
   init_styles();
+  OAUTH_ANALYTICS_REASONS = new Set([
+    "access_denied",
+    "bad_oauth_state",
+    "invalid_request",
+    "invalid_scope",
+    "server_error",
+    "temporarily_unavailable",
+    "unauthorized_client",
+    "unsupported_response_type"
+  ]);
 });
 
 // src/commands/insights.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, readdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname7, join as join29 } from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync10, readdirSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
+import { dirname as dirname7, join as join30 } from "node:path";
 function shuffled(arr) {
   const copy2 = [...arr];
   for (let i2 = copy2.length - 1;i2 > 0; i2--) {
@@ -12921,17 +13941,17 @@ function makeAskFn(cfg) {
   };
 }
 function insightsDir() {
-  return join29(getConfigDir(), "insights");
+  return join30(getConfigDir(), "insights");
 }
 function reportPath(timestamp) {
   const dir = insightsDir();
   if (!timestamp)
-    return join29(dir, "latest.html");
+    return join30(dir, "latest.html");
   const iso = timestamp.toISOString().slice(0, 19).replace(/:/g, "-");
-  return join29(dir, `report-${iso}Z.html`);
+  return join30(dir, `report-${iso}Z.html`);
 }
 function pruneOldReports(dir, keepN) {
-  if (!existsSync18(dir))
+  if (!existsSync20(dir))
     return;
   let entries;
   try {
@@ -12943,7 +13963,7 @@ function pruneOldReports(dir, keepN) {
   const reports = entries.filter((f2) => REPORT_FILE_PATTERN.test(f2)).sort().reverse();
   for (const f2 of reports.slice(keepN)) {
     try {
-      unlinkSync2(join29(dir, f2));
+      unlinkSync3(join30(dir, f2));
     } catch (err) {
       logger.debug("insights", `failed to prune ${f2}: ${err instanceof Error ? err.message : err}`);
     }
@@ -13016,9 +14036,9 @@ function defaultRunner(cfg) {
     render: renderHTML,
     writeFile: (path3, content) => {
       const dir = dirname7(path3);
-      if (!existsSync18(dir))
-        mkdirSync9(dir, { recursive: true, mode: 448 });
-      writeFileSync9(path3, content, { mode: 384 });
+      if (!existsSync20(dir))
+        mkdirSync10(dir, { recursive: true, mode: 448 });
+      writeFileSync10(path3, content, { mode: 384 });
     },
     prune: pruneOldReports,
     openInBrowser: async (path3) => {
@@ -13442,7 +14462,7 @@ Could not open a browser automatically.`);
   throw new Error("Authentication timed out. Run 'dosu login' to try again.");
 }
 function sleep5(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 var POLL_INTERVAL_MS = 5000;
 var init_device = __esm(() => {
@@ -13811,7 +14831,15 @@ var init_flow3 = __esm(() => {
 // src/cli/cli.ts
 init_commander();
 init_client();
-import { readFileSync as readFileSync18, unlinkSync as unlinkSync3 } from "node:fs";
+import {
+  closeSync,
+  constants,
+  fstatSync,
+  openSync,
+  readFileSync as readFileSync19,
+  readSync,
+  unlinkSync as unlinkSync4
+} from "node:fs";
 
 // src/commands/analytics.ts
 init_commander();
@@ -15986,7 +17014,7 @@ init_dist();
 init_commander();
 init_trpc();
 var import_picocolors19 = __toESM(require_picocolors(), 1);
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 function requireConfig10() {
   return requireLoginConfig();
 }
@@ -16162,7 +17190,7 @@ function reviewCommand() {
     let body = opts.body;
     if (opts.bodyFile) {
       try {
-        body = readFileSync16(opts.bodyFile, "utf-8");
+        body = readFileSync17(opts.bodyFile, "utf-8");
       } catch (err) {
         console.error(import_picocolors19.default.red(`Failed to read --body-file: ${err.message}`));
         process.exit(1);
@@ -16480,6 +17508,71 @@ function suggestCommand() {
   return cmd;
 }
 
+// src/commands/telemetry.ts
+init_commander();
+init_settings();
+init_telemetry();
+function statusPayload() {
+  const settings2 = loadTelemetrySettings();
+  const environmentOverride = telemetryDisabledByEnvironment();
+  const webAppURL = getWebAppURL();
+  const commandWebAppURL = parseTelemetryWebAppURL(webAppURL);
+  const setupWebAppURL = parseTelemetryWebAppURL(webAppURL, process.env.DOSU_DEV === "true");
+  const analyticsReleaseToken = parsePostHogProjectToken(process.env.DOSU_POSTHOG_PROJECT_TOKEN_OVERRIDE ?? "phc_Uo9RxhN0HRk8gZkPlT18BCr7eqsM0MPWVW88HZB95V5");
+  return {
+    schema_version: settings2.schema_version,
+    enabled: isTelemetryEnabled(settings2),
+    destinations: {
+      command_analytics: Boolean(commandWebAppURL && analyticsReleaseToken),
+      setup_analytics: Boolean(setupWebAppURL && analyticsReleaseToken),
+      error_diagnostics: Boolean(parseSentryDsn(process.env.DOSU_CLI_SENTRY_DSN_OVERRIDE ?? "https://f6b3e51dea6f50746316aa1896df76e0@o4505364738670592.ingest.us.sentry.io/4511883653283840"))
+    },
+    environment_override: environmentOverride ?? null,
+    debug_mode: process.env.DOSU_TELEMETRY_DEBUG === "1",
+    telemetry_id: settings2.install_id ?? null
+  };
+}
+function printHumanStatus() {
+  const status = statusPayload();
+  console.log(`Telemetry: ${status.enabled ? "enabled" : "disabled"}`);
+  console.log(`Destinations: command analytics PostHog ${status.destinations.command_analytics ? "configured" : "not configured"}, setup analytics Dosu API ${status.destinations.setup_analytics ? "configured" : "not configured"}, error diagnostics Sentry ${status.destinations.error_diagnostics ? "configured" : "not configured"}`);
+  if (status.environment_override) {
+    console.log(`Environment override: ${status.environment_override}`);
+  }
+  if (status.debug_mode)
+    console.log("Debug mode: on (payloads are printed to stderr, not sent)");
+  if (status.telemetry_id)
+    console.log(`Telemetry ID: ${status.telemetry_id}`);
+  console.log("Telemetry fields never include raw command lines, free-form arguments or option values, user source files, local paths, credentials, error messages, or debug.log; setup analytics uses only documented coarse fields and its existing Dosu session header only for API authorization.");
+}
+function updateTelemetry(enabled) {
+  if (!setTelemetryEnabled(enabled)) {
+    throw new Error("Could not save telemetry settings");
+  }
+  console.log(`Telemetry ${enabled ? "enabled" : "disabled"}.`);
+}
+function telemetryCommand() {
+  const command = new Command("telemetry").description("Manage privacy-preserving telemetry");
+  command.command("status").description("Show telemetry state and destination configuration").option("--json", "Output as JSON").action((opts) => {
+    if (opts.json) {
+      console.log(JSON.stringify(statusPayload(), null, 2));
+      return;
+    }
+    printHumanStatus();
+  });
+  command.command("enable").description("Enable telemetry").action(() => updateTelemetry(true));
+  command.command("disable").description("Disable telemetry").action(() => updateTelemetry(false));
+  command.command("reset").description("Rotate the local pseudonymous telemetry ID (does not delete prior events)").action(() => {
+    const previous = loadTelemetrySettings().install_id;
+    const next = previous ? resetInstallID() : getOrCreateInstallID();
+    if (!next)
+      throw new Error("Could not save telemetry settings");
+    console.log(`Telemetry ID ${previous ? "rotated" : "created"}: ${next}`);
+    console.log("This does not delete events already retained by telemetry providers.");
+  });
+  return command;
+}
+
 // src/commands/threads.ts
 init_commander();
 init_trpc();
@@ -16765,8 +17858,8 @@ function owningPackageManager(entrypoint, platform4, comSpec, env = process.env,
   }
   const owners = Object.keys(PACKAGE_MANAGERS).filter((manager) => packageRoots(manager, platform4, comSpec, env, cwd).some((root) => {
     try {
-      const relative = path3.relative(realpathSync(root), realEntrypoint);
-      return relative !== ".." && !relative.startsWith(`..${path3.sep}`) && !path3.isAbsolute(relative);
+      const relative2 = path3.relative(realpathSync(root), realEntrypoint);
+      return relative2 !== ".." && !relative2.startsWith(`..${path3.sep}`) && !path3.isAbsolute(relative2);
     } catch {
       return false;
     }
@@ -16860,14 +17953,16 @@ init_config();
 init_logger();
 init_providers();
 init_styles();
+init_settings();
+init_telemetry();
 init_skill_update_check();
 
 // src/version/update-check.ts
 init_config();
 init_logger();
 var import_picocolors25 = __toESM(require_picocolors(), 1);
-import { existsSync as existsSync19, mkdirSync as mkdirSync10, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync11, readFileSync as readFileSync18, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join31 } from "node:path";
 var CACHE_FILENAME3 = "update-check.json";
 var CHECK_INTERVAL_MS3 = 6 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS3 = 1000;
@@ -16894,14 +17989,14 @@ function isNewerVersion(latest, current) {
   return false;
 }
 function getCachePath3() {
-  return join30(getConfigDir(), CACHE_FILENAME3);
+  return join31(getConfigDir(), CACHE_FILENAME3);
 }
 function readCache() {
   try {
     const path3 = getCachePath3();
-    if (!existsSync19(path3))
+    if (!existsSync21(path3))
       return null;
-    const data = JSON.parse(readFileSync17(path3, "utf-8"));
+    const data = JSON.parse(readFileSync18(path3, "utf-8"));
     if (typeof data.lastCheck === "number" && isValidVersion(data.latestVersion)) {
       return data;
     }
@@ -16913,10 +18008,10 @@ function readCache() {
 function writeCache(cache) {
   try {
     const dir = getConfigDir();
-    if (!existsSync19(dir)) {
-      mkdirSync10(dir, { recursive: true, mode: 448 });
+    if (!existsSync21(dir)) {
+      mkdirSync11(dir, { recursive: true, mode: 448 });
     }
-    writeFileSync10(getCachePath3(), JSON.stringify(cache), { mode: 384 });
+    writeFileSync11(getCachePath3(), JSON.stringify(cache), { mode: 384 });
   } catch {}
 }
 async function fetchLatestVersion() {
@@ -17008,6 +18103,104 @@ function isHookEntrypointInvocation(argv) {
 function shouldRunBackgroundChecks(actionName, argv) {
   return actionName !== "upgrade" && !isHookEntrypointInvocation(argv);
 }
+var TELEMETRY_EXCLUDED_COMMANDS = new Set([
+  "hooks user-prompt-submit",
+  "hooks post-tool-use",
+  "hooks stop"
+]);
+var TELEMETRY_FLUSH_TIMEOUT_MS = 750;
+var MAX_TELEMETRY_CONFIG_BYTES = 64 * 1024;
+
+class CliUsageError extends Error {
+  exitCode = 1;
+  constructor(message) {
+    super(message);
+    this.name = "CliUsageError";
+  }
+}
+function commandTelemetryName(actionCommand) {
+  const segments = [];
+  let current = actionCommand;
+  while (current.parent) {
+    segments.unshift(current.name());
+    current = current.parent;
+  }
+  if (segments.length > 0)
+    return segments.join(" ");
+  return actionCommand.args.length > 0 ? "unknown" : "tui";
+}
+function shouldTrackCommand(command) {
+  if (command === "telemetry" || command.startsWith("telemetry "))
+    return false;
+  return !TELEMETRY_EXCLUDED_COMMANDS.has(command);
+}
+function commandTelemetryContext() {
+  try {
+    const cfg = loadConfigForTelemetry();
+    if (!cfg)
+      return { mode: "cloud", isAuthenticated: false };
+    const authenticated = isAuthenticated(cfg);
+    const accessToken = authenticated ? cfg.active_account.session.access_token : "";
+    const configUserID = getConfigUserID(cfg);
+    const tokenUserID = getAccessTokenUserID(accessToken);
+    const userID = configUserID && configUserID === tokenUserID ? configUserID : undefined;
+    const email = userID ? getAccessTokenEmail(accessToken) : undefined;
+    return {
+      mode: cfg.mode === MODE_OSS ? "oss" : "cloud",
+      isAuthenticated: authenticated,
+      ...userID ? { user: { id: userID, ...email ? { email } : {} } } : {}
+    };
+  } catch {
+    return { mode: "cloud", isAuthenticated: false };
+  }
+}
+function loadConfigForTelemetry() {
+  let fd;
+  try {
+    const nonblocking = typeof constants.O_NONBLOCK === "number" ? constants.O_NONBLOCK : 0;
+    fd = openSync(getConfigPath(), constants.O_RDONLY | nonblocking);
+    const file = fstatSync(fd);
+    if (!file.isFile() || file.size > MAX_TELEMETRY_CONFIG_BYTES)
+      return;
+    const content = Buffer.alloc(MAX_TELEMETRY_CONFIG_BYTES + 1);
+    const bytesRead = readSync(fd, content, 0, content.byteLength, 0);
+    if (bytesRead > MAX_TELEMETRY_CONFIG_BYTES)
+      return;
+    return parseConfig(JSON.parse(content.subarray(0, bytesRead).toString("utf8")));
+  } catch {
+    return;
+  } finally {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {}
+    }
+  }
+}
+function startTelemetry(telemetry, command, context) {
+  if (!telemetry)
+    return false;
+  try {
+    telemetry.start(command, context);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function finishTelemetry(operation) {
+  let timeout;
+  try {
+    await Promise.race([
+      Promise.resolve().then(operation),
+      new Promise((resolve2) => {
+        timeout = setTimeout(resolve2, TELEMETRY_FLUSH_TIMEOUT_MS);
+      })
+    ]);
+  } catch {} finally {
+    if (timeout)
+      clearTimeout(timeout);
+  }
+}
 function suggestClosestCommand(input, program2) {
   let best;
   let bestDistance = Infinity;
@@ -17034,8 +18227,10 @@ function editDistance2(a3, b2) {
   }
   return prev[b2.length];
 }
-function createProgram() {
+function createProgram(options = {}) {
   const program2 = new Command;
+  let telemetryStarted = false;
+  let telemetryValidationFailure = false;
   program2.name("dosu").description("Dosu CLI - Manage MCP servers for AI tools").version(getVersionString(), "-v, --version").helpCommand("help [command]", "Show help for a command").option("--debug", "Enable debug logging to stderr", false).hook("preAction", async (thisCommand, actionCommand) => {
     const opts = thisCommand.optsWithGlobals();
     logger.init({ debug: opts.debug });
@@ -17046,6 +18241,20 @@ function createProgram() {
       checkForSkillUpdates();
       checkForReadyTasks();
     }
+    const command = commandTelemetryName(actionCommand);
+    if (options.telemetry && shouldTrackCommand(command)) {
+      telemetryStarted = startTelemetry(options.telemetry, command, commandTelemetryContext());
+    }
+  }).hook("postAction", async () => {
+    const exitCode = Number(process.exitCode ?? 0);
+    const telemetry = options.telemetry;
+    if (telemetryStarted && telemetry) {
+      if (telemetryValidationFailure) {
+        await finishTelemetry(() => telemetry.fail(new CliUsageError("expected CLI usage error")));
+      } else {
+        await finishTelemetry(() => telemetry.complete(Number.isFinite(exitCode) ? exitCode : 1));
+      }
+    }
   }).allowExcessArguments(true).action(async () => {
     const command = program2.args[0];
     if (command !== undefined) {
@@ -17057,6 +18266,7 @@ function createProgram() {
       message += `
 Run 'dosu --help' to see available commands.`;
       console.error(message);
+      telemetryValidationFailure = true;
       process.exitCode = 1;
       return;
     }
@@ -17218,20 +18428,20 @@ Run 'dosu --help' to see available commands.`;
     try {
       provider = getProvider(toolId.toLowerCase());
     } catch {
-      throw new Error(`unknown tool '${toolId}'. Use 'dosu mcp list' to see available tools`);
+      throw new CliUsageError(`unknown tool '${toolId}'. Use 'dosu mcp list' to see available tools`);
     }
     const cfg = loadConfig();
     if (!isAuthenticated(cfg)) {
-      throw new Error("not logged in. Run 'dosu login' first");
+      throw new CliUsageError("not logged in. Run 'dosu login' first");
     }
     if (isTokenExpired(cfg) && !await ensureFreshSession(cfg)) {
-      throw new Error("session expired. Run 'dosu login' to re-authenticate");
+      throw new CliUsageError("session expired. Run 'dosu login' to re-authenticate");
     }
     if (cfg.mode !== MODE_OSS && !cfg.active_account?.target?.deployment_id) {
-      throw new Error("no MCP selected. Run 'dosu' to open the TUI and select an MCP");
+      throw new CliUsageError("no MCP selected. Run 'dosu' to open the TUI and select an MCP");
     }
     if (!cfg.active_account?.target?.api_key) {
-      throw new Error("no API key available. Run 'dosu setup' to create one");
+      throw new CliUsageError("no API key available. Run 'dosu setup' to create one");
     }
     if (provider.id() === "manual") {
       provider.install(cfg, false, { showSecret: opts.showSecret });
@@ -17284,6 +18494,7 @@ Use 'dosu mcp add <agent>' to add Dosu MCP to a tool.`);
   program2.addCommand(reviewCommand());
   program2.addCommand(sourcesCommand());
   program2.addCommand(suggestCommand());
+  program2.addCommand(telemetryCommand());
   program2.addCommand(topicsCommand());
   program2.addCommand(threadsCommand());
   program2.addCommand(skillCommand());
@@ -17310,14 +18521,14 @@ Use 'dosu mcp add <agent>' to add Dosu MCP to a tool.`);
       return;
     }
     if (opts.tool || opts.loginTicket) {
-      throw new Error("--tool and --login-ticket require --agent");
+      throw new CliUsageError("--tool and --login-ticket require --agent");
     }
     const { runSetup: runSetup2 } = await Promise.resolve().then(() => (init_flow2(), exports_flow2));
     let mode;
     if (opts.mode !== undefined) {
       const normalized = opts.mode.toLowerCase();
       if (normalized !== "oss" && normalized !== "cloud") {
-        throw new Error(`invalid --mode value '${opts.mode}' (expected 'oss' or 'cloud')`);
+        throw new CliUsageError(`invalid --mode value '${opts.mode}' (expected 'oss' or 'cloud')`);
       }
       mode = normalized;
     }
@@ -17327,7 +18538,7 @@ Use 'dosu mcp add <agent>' to add Dosu MCP to a tool.`);
     const logPath = logger.getLogPath();
     if (opts.clear) {
       try {
-        unlinkSync3(logPath);
+        unlinkSync4(logPath);
         console.log("Log file deleted.");
       } catch {
         console.log("No log file to delete.");
@@ -17337,7 +18548,7 @@ Use 'dosu mcp add <agent>' to add Dosu MCP to a tool.`);
     if (opts.tail !== undefined) {
       const n2 = typeof opts.tail === "string" ? parseInt(opts.tail, 10) || 50 : 50;
       try {
-        const content = readFileSync18(logPath, "utf-8");
+        const content = readFileSync19(logPath, "utf-8");
         const lines = content.split(`
 `);
         console.log(lines.slice(-n2).join(`
@@ -17364,8 +18575,27 @@ async function ensureFreshSession(cfg) {
   }
 }
 async function execute() {
-  const program2 = createProgram();
-  await program2.parseAsync(process.argv);
+  const telemetry = isHookEntrypointInvocation(process.argv) ? undefined : processCommandTelemetry();
+  const program2 = createProgram({ telemetry });
+  try {
+    await program2.parseAsync(process.argv);
+  } catch (err) {
+    if (telemetry)
+      await finishTelemetry(() => telemetry.fail(err));
+    throw err;
+  }
+}
+function processCommandTelemetry() {
+  try {
+    const settings2 = loadTelemetrySettings();
+    if (!isTelemetryEnabled(settings2))
+      return;
+    return createCommandTelemetry({}, {
+      resolveInstallId: () => settings2.install_id ?? getOrCreateInstallID()
+    });
+  } catch {
+    return;
+  }
 }
 
 // src/index.ts
@@ -17383,3 +18613,5 @@ execute().catch((err) => {
   }
   process.exit(1);
 });
+
+//# debugId=df4adcb4-addf-31e4-6475-6e2164756e21