@indigoai-us/hq-cloud 6.18.44-alpha.48 → 6.18.44-alpha.49

package/dist/telemetry.test.js

@@ -0,0 +1,1603 @@
+/**
+ * Tests for the usage telemetry collector. Mirrors the Rust test matrix at
+ * `hq-workspace/apps/hq-sync/src-tauri/src/commands/telemetry.rs::tests` so a
+ * behavioral regression in either implementation surfaces in both suites.
+ *
+ * The vault client is stubbed structurally rather than via fetch-mock so the
+ * tests stay deterministic without spinning up wiremock — the production
+ * boundary is `TelemetryClientSurface`, not the HTTP layer.
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import * as fs from "fs";
+import { promises as fsp } from "fs";
+import * as os from "os";
+import * as path from "path";
+import { collectAndSendTelemetry, sanitizeRow, extractServices, } from "./telemetry.js";
+function makeClient(opts = {}) {
+    const optInResponse = opts.optInResponse ?? { enabled: true, updatedAt: null };
+    const postResponse = opts.postResponse ?? { ok: true, written: 0, skipped: [] };
+    const posts = [];
+    const optInSets = [];
+    const optInSetOpts = [];
+    const stub = {
+        posts,
+        optInCalls: 0,
+        optInSets,
+        optInSetOpts,
+        async getTelemetryOptIn() {
+            this.optInCalls++;
+            if (optInResponse instanceof Error)
+                throw optInResponse;
+            return optInResponse;
+        },
+        async setTelemetryOptIn(enabled, setOpts) {
+            optInSets.push(enabled);
+            optInSetOpts.push(setOpts);
+            if (opts.setOptInError)
+                throw opts.setOptInError;
+            return { applied: opts.setOptInApplied ?? true };
+        },
+        async postUsage(batch) {
+            posts.push(batch);
+            if (postResponse instanceof Error)
+                throw postResponse;
+            return postResponse;
+        },
+    };
+    return stub;
+}
+function setupEnv() {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-telemetry-test-"));
+    const claudeProjects = path.join(root, ".claude", "projects");
+    const codexRoot = path.join(root, ".codex");
+    const grokRoot = path.join(root, ".grok");
+    fs.mkdirSync(claudeProjects, { recursive: true });
+    fs.mkdirSync(path.join(codexRoot, "sessions"), { recursive: true });
+    fs.mkdirSync(path.join(codexRoot, "archived_sessions"), { recursive: true });
+    fs.mkdirSync(path.join(grokRoot, "sessions"), { recursive: true });
+    fs.mkdirSync(path.join(root, ".hq"), { recursive: true });
+    return {
+        root,
+        claudeProjects,
+        codexRoot,
+        grokRoot,
+        cursorPath: path.join(root, ".hq", "telemetry-cursor.json"),
+        menubarPath: path.join(root, ".hq", "menubar.json"),
+    };
+}
+function teardownEnv(env) {
+    fs.rmSync(env.root, { recursive: true, force: true });
+}
+function writeJsonl(env, sub, name, lines) {
+    const dir = path.join(env.claudeProjects, sub);
+    fs.mkdirSync(dir, { recursive: true });
+    const p = path.join(dir, name);
+    fs.writeFileSync(p, lines.map((l) => `${l}\n`).join(""));
+    return p;
+}
+function readCursor(env) {
+    return JSON.parse(fs.readFileSync(env.cursorPath, "utf-8"));
+}
+function makeOpts(env, client) {
+    return {
+        client,
+        machineId: "test-machine",
+        installerVersion: "test-version",
+        claudeProjectsRoot: env.claudeProjects,
+        codexRoot: env.codexRoot,
+        grokRoot: env.grokRoot,
+        maxScanBytesPerSource: Number.MAX_SAFE_INTEGER,
+        maxBatchesPerRun: Number.MAX_SAFE_INTEGER,
+        cursorPath: env.cursorPath,
+        menubarPath: env.menubarPath,
+    };
+}
+// Representative Claude Code session rows. Mirror the Rust fixtures exactly so
+// drift between implementations is detectable.
+const USER_ROW = JSON.stringify({
+    type: "user",
+    timestamp: "2026-04-25T10:00:00Z",
+    sessionId: "s1",
+    uuid: "u1",
+    parentUuid: null,
+    userType: "human",
+    entrypoint: "cli",
+    cwd: "/Users/x/proj",
+    gitBranch: "main",
+    version: "1.0",
+    message: { role: "user", content: [{ type: "text", text: "hello world" }], id: "msg_1" },
+});
+const ASST_ROW = JSON.stringify({
+    type: "assistant",
+    timestamp: "2026-04-25T10:00:01Z",
+    sessionId: "s1",
+    uuid: "u2",
+    parentUuid: "u1",
+    message: {
+        role: "assistant",
+        model: "claude-opus",
+        content: [{ type: "text", text: "hi" }, { type: "thinking", thinking: "hmm" }],
+        stop_sequence: "</end>",
+        usage: { input_tokens: 42, output_tokens: 7, cache_read_input_tokens: 100 },
+        id: "msg_2",
+    },
+    toolUseIds: ["t1"],
+    toolResults: [{ id: "t1", output: "x" }],
+    requestId: "req_1",
+});
+// ── sanitizeRow ───────────────────────────────────────────────────────────────
+describe("sanitizeRow", () => {
+    it("returns null for non-objects", () => {
+        expect(sanitizeRow(null)).toBeNull();
+        expect(sanitizeRow("string")).toBeNull();
+        expect(sanitizeRow(42)).toBeNull();
+        expect(sanitizeRow([])).toBeNull();
+    });
+    it("keeps only top-level allowlist fields", () => {
+        const row = JSON.parse(USER_ROW);
+        const out = sanitizeRow(row);
+        expect(out).not.toBeNull();
+        const keys = new Set(Object.keys(out));
+        // KEEP: sessionId, timestamp, uuid, cwd, gitBranch, userType
+        for (const expected of ["sessionId", "timestamp", "uuid", "cwd", "gitBranch", "userType"]) {
+            expect(keys.has(expected)).toBe(true);
+        }
+        // Sensitive / unknown fields must be absent:
+        for (const removed of ["type", "parentUuid", "entrypoint", "version", "message", "content", "thinking", "text", "toolUseIds", "toolResults"]) {
+            expect(keys.has(removed)).toBe(false);
+        }
+    });
+    it("promotes message.model and flattens message.usage to camelCase", () => {
+        const row = JSON.parse(ASST_ROW);
+        const out = sanitizeRow(row);
+        expect(out).not.toBeNull();
+        expect(out.model).toBe("claude-opus");
+        expect(out.inputTokens).toBe(42);
+        expect(out.outputTokens).toBe(7);
+        expect(out.cacheReadInputTokens).toBe(100);
+        // cacheCreationInputTokens not present in fixture; must be absent (not 0/null).
+        expect("cacheCreationInputTokens" in out).toBe(false);
+        // `message` must not survive — its prompt/thinking/tools are exactly what
+        // we're trying to keep off the wire.
+        expect("message" in out).toBe(false);
+    });
+    it("rejects every field outside the server KEEP allowlist", () => {
+        const out = sanitizeRow(JSON.parse(ASST_ROW));
+        const allowed = new Set([
+            "sessionId", "timestamp", "uuid", "cwd", "gitBranch", "userType",
+            "model", "inputTokens", "outputTokens",
+            "cacheCreationInputTokens", "cacheReadInputTokens",
+            "companyUid",
+        ]);
+        for (const key of Object.keys(out)) {
+            expect(allowed.has(key), `field "${key}" must be in server allowlist`).toBe(true);
+        }
+    });
+    it("(US-002) stamps companyUid when provided, omits it when not", () => {
+        const withUid = sanitizeRow(JSON.parse(USER_ROW), "cmp_01INDIGO");
+        expect(withUid.companyUid).toBe("cmp_01INDIGO");
+        const withoutUid = sanitizeRow(JSON.parse(USER_ROW));
+        expect("companyUid" in withoutUid).toBe(false);
+    });
+});
+// ── extractServices + sanitizeRow services emission (US-007) ─────────────────
+// An assistant row that invoked the Slack + Figma MCP servers. The tool_use
+// block `input` deliberately carries a URL + secret so the redaction assertions
+// have something dangerous to prove is dropped.
+const MCP_ROW = JSON.stringify({
+    type: "assistant",
+    timestamp: "2026-04-25T10:00:02Z",
+    sessionId: "s1",
+    uuid: "u3",
+    message: {
+        role: "assistant",
+        model: "claude-opus",
+        usage: { input_tokens: 10, output_tokens: 5 },
+        content: [
+            { type: "text", text: "calling tools" },
+            {
+                type: "tool_use",
+                id: "t1",
+                name: "mcp__slack__slack_send_message",
+                input: { channel: "#secret-ops", token: "xoxb-SECRET-TOKEN", text: "hi" },
+            },
+            {
+                type: "tool_use",
+                id: "t2",
+                name: "mcp__slack__slack_read_channel",
+                input: { url: "https://hooks.slack.com/leak", channel: "C123" },
+            },
+            {
+                type: "tool_use",
+                id: "t3",
+                name: "mcp__figma__get_screenshot",
+                input: { fileKey: "https://figma.com/file/PRIVATE" },
+            },
+            // A non-MCP builtin tool must NOT count as a service.
+            { type: "tool_use", id: "t4", name: "Bash", input: { command: "rm -rf /" } },
+        ],
+        id: "msg_3",
+    },
+});
+describe("extractServices (US-007)", () => {
+    it("counts MCP servers by name from tool_use block names", () => {
+        const services = extractServices(JSON.parse(MCP_ROW).message);
+        // Slack invoked twice, Figma once; Bash (builtin) excluded.
+        expect(services).toEqual({ slack: 2, figma: 1 });
+    });
+    it("returns undefined when the row touched no MCP server", () => {
+        expect(extractServices(JSON.parse(ASST_ROW).message)).toBeUndefined();
+        expect(extractServices(JSON.parse(USER_ROW).message)).toBeUndefined();
+        expect(extractServices(undefined)).toBeUndefined();
+        expect(extractServices({ content: "not an array" })).toBeUndefined();
+    });
+    it("preserves multi-underscore server names (mcp__claude_ai_Slack__…)", () => {
+        const msg = {
+            content: [
+                { type: "tool_use", id: "a", name: "mcp__claude_ai_Slack__slack_send_message", input: {} },
+                { type: "tool_use", id: "b", name: "mcp__claude_ai_Figma__get_screenshot", input: {} },
+            ],
+        };
+        // The server segment is everything between the first and the LAST `__`.
+        expect(extractServices(msg)).toEqual({
+            claude_ai_Slack: 1,
+            claude_ai_Figma: 1,
+        });
+    });
+    it("preserves a double-underscore in the server name (mcp__foo__bar__run)", () => {
+        const msg = {
+            content: [
+                { type: "tool_use", id: "a", name: "mcp__foo__bar__run", input: {} },
+            ],
+        };
+        // Delimiter is the LAST `__`, so server = `foo__bar`, tool = `run`.
+        expect(extractServices(msg)).toEqual({ "foo__bar": 1 });
+    });
+    it("counts servers whose names collide with Object.prototype members", () => {
+        const msg = {
+            content: [
+                { type: "tool_use", id: "a", name: "mcp__constructor__x", input: {} },
+                { type: "tool_use", id: "b", name: "mcp__constructor__y", input: {} },
+                { type: "tool_use", id: "c", name: "mcp__toString__z", input: {} },
+            ],
+        };
+        // A plain-object counter would read these off the prototype and produce a
+        // non-numeric count; the null-prototype map keeps them honest integers.
+        const out = extractServices(msg);
+        expect(out).toEqual({ constructor: 2, toString: 1 });
+        expect(typeof out.constructor).toBe("number");
+    });
+    // SECURITY-CRITICAL: names + counts ONLY. No args / URLs / payloads / secrets.
+    it("emits NAMES + COUNTS only — no args, URLs, payloads, or secrets", () => {
+        const out = sanitizeRow(JSON.parse(MCP_ROW));
+        expect(out.services).toEqual({ slack: 2, figma: 1 });
+        // The full serialized wire row must contain NONE of the dangerous input data.
+        const serialized = JSON.stringify(out);
+        expect(serialized).not.toContain("xoxb-SECRET-TOKEN");
+        expect(serialized).not.toContain("hooks.slack.com");
+        expect(serialized).not.toContain("figma.com/file/PRIVATE");
+        expect(serialized).not.toContain("#secret-ops");
+        expect(serialized).not.toContain("rm -rf");
+        // No tool names or input keys leaked — only the server names + counts.
+        expect(serialized).not.toContain("slack_send_message");
+        expect(serialized).not.toContain("get_screenshot");
+        expect(serialized).not.toContain("channel");
+        expect(serialized).not.toContain("token");
+        expect(serialized).not.toContain("url");
+        // The services VALUE is a map of string → number (counts) — never objects
+        // or strings that could smuggle structured data.
+        for (const [name, count] of Object.entries(out.services)) {
+            expect(typeof name).toBe("string");
+            expect(typeof count).toBe("number");
+        }
+    });
+    it("omits services entirely for a row with no MCP calls (backward-compatible)", () => {
+        const out = sanitizeRow(JSON.parse(ASST_ROW));
+        expect("services" in out).toBe(false);
+    });
+});
+// ── collectAndSendTelemetry ───────────────────────────────────────────────────
+describe("collectAndSendTelemetry", () => {
+    let env;
+    beforeEach(() => { env = setupEnv(); });
+    afterEach(() => { teardownEnv(env); });
+    it("(a) opt-in=false → sends nothing and does not write cursor", async () => {
+        const client = makeClient({ optInResponse: { enabled: false, updatedAt: null } });
+        writeJsonl(env, "proj", "s.jsonl", [USER_ROW, ASST_ROW]);
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.enabled).toBe(false);
+        expect(result.optInSource).toBe("server");
+        expect(client.posts).toHaveLength(0);
+        expect(fs.existsSync(env.cursorPath)).toBe(false);
+    });
+    it("forceCollect ships unattributed rows even when personal opt-in is false", async () => {
+        const client = makeClient({ optInResponse: { enabled: false, updatedAt: null } });
+        writeJsonl(env, "proj", "s.jsonl", [USER_ROW, ASST_ROW]);
+        const result = await collectAndSendTelemetry({
+            ...makeOpts(env, client),
+            forceCollect: true,
+        });
+        expect(result.enabled).toBe(true);
+        expect(result.optInSource).toBe("agent-required");
+        expect(result.eventsSent).toBe(2);
+        expect(client.posts).toHaveLength(1);
+    });
+    it("(b) missing cursor → reads all rows from offset 0, advances to EOF", async () => {
+        const client = makeClient();
+        const jsonlPath = writeJsonl(env, "proj", "s.jsonl", [USER_ROW, ASST_ROW]);
+        const fileSize = fs.statSync(jsonlPath).size;
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.enabled).toBe(true);
+        expect(result.eventsSent).toBe(2);
+        expect(client.posts).toHaveLength(1);
+        expect(client.posts[0].events).toHaveLength(2);
+        expect(client.posts[0].machineId).toBe("test-machine");
+        expect(client.posts[0].installerVersion).toBe("test-version");
+        const cursor = readCursor(env);
+        expect(cursor.files[jsonlPath].offset).toBe(fileSize);
+    });
+    it("automatically combines activity from standard and named Claude profiles", async () => {
+        const originalProjectsDir = process.env.CLAUDE_PROJECTS_DIR;
+        const originalConfigDir = process.env.CLAUDE_CONFIG_DIR;
+        delete process.env.CLAUDE_PROJECTS_DIR;
+        delete process.env.CLAUDE_CONFIG_DIR;
+        const client = makeClient();
+        const standardSessionDir = path.join(env.claudeProjects, "standard-project");
+        fs.mkdirSync(standardSessionDir, { recursive: true });
+        const standardJsonlPath = path.join(standardSessionDir, "standard-session.jsonl");
+        fs.writeFileSync(standardJsonlPath, `${ASST_ROW}\n`);
+        const customProjects = path.join(env.root, ".claude-ridge", "projects");
+        const sessionDir = path.join(customProjects, "ridge-project");
+        fs.mkdirSync(sessionDir, { recursive: true });
+        const jsonlPath = path.join(sessionDir, "ridge-session.jsonl");
+        fs.writeFileSync(jsonlPath, `${ASST_ROW}\n`);
+        fs.writeFileSync(env.menubarPath, JSON.stringify({ telemetryEnabled: true }));
+        const opts = makeOpts(env, client);
+        delete opts.claudeProjectsRoot;
+        opts.homeDir = env.root;
+        try {
+            const result = await collectAndSendTelemetry(opts);
+            expect(result.eventsSent).toBe(2);
+            expect(client.posts).toHaveLength(1);
+            expect(readCursor(env).files[standardJsonlPath]?.offset).toBe(fs.statSync(standardJsonlPath).size);
+            expect(readCursor(env).files[jsonlPath]?.offset).toBe(fs.statSync(jsonlPath).size);
+        }
+        finally {
+            if (originalProjectsDir === undefined)
+                delete process.env.CLAUDE_PROJECTS_DIR;
+            else
+                process.env.CLAUDE_PROJECTS_DIR = originalProjectsDir;
+            if (originalConfigDir === undefined)
+                delete process.env.CLAUDE_CONFIG_DIR;
+            else
+                process.env.CLAUDE_CONFIG_DIR = originalConfigDir;
+        }
+    });
+    it("keeps a saved nonstandard activity folder as a hidden fallback", async () => {
+        const originalProjectsDir = process.env.CLAUDE_PROJECTS_DIR;
+        const originalConfigDir = process.env.CLAUDE_CONFIG_DIR;
+        delete process.env.CLAUDE_PROJECTS_DIR;
+        delete process.env.CLAUDE_CONFIG_DIR;
+        const client = makeClient();
+        const savedProjects = path.join(env.root, ".profiles", "ridge", "projects");
+        const sessionDir = path.join(savedProjects, "ridge-project");
+        fs.mkdirSync(sessionDir, { recursive: true });
+        const jsonlPath = path.join(sessionDir, "saved-session.jsonl");
+        fs.writeFileSync(jsonlPath, `${ASST_ROW}\n`);
+        fs.writeFileSync(env.menubarPath, JSON.stringify({ telemetryEnabled: true, claudeProjectsDir: savedProjects }));
+        const opts = makeOpts(env, client);
+        delete opts.claudeProjectsRoot;
+        opts.homeDir = env.root;
+        try {
+            const result = await collectAndSendTelemetry(opts);
+            expect(result.eventsSent).toBe(1);
+            expect(readCursor(env).files[jsonlPath]).toBeDefined();
+        }
+        finally {
+            if (originalProjectsDir === undefined)
+                delete process.env.CLAUDE_PROJECTS_DIR;
+            else
+                process.env.CLAUDE_PROJECTS_DIR = originalProjectsDir;
+            if (originalConfigDir === undefined)
+                delete process.env.CLAUDE_CONFIG_DIR;
+            else
+                process.env.CLAUDE_CONFIG_DIR = originalConfigDir;
+        }
+    });
+    it("treats CLAUDE_CONFIG_DIR as an exact runtime override", async () => {
+        const originalProjectsDir = process.env.CLAUDE_PROJECTS_DIR;
+        const originalConfigDir = process.env.CLAUDE_CONFIG_DIR;
+        delete process.env.CLAUDE_PROJECTS_DIR;
+        const client = makeClient();
+        const configRoot = path.join(env.root, "runtime-config");
+        const projectsRoot = path.join(configRoot, "projects");
+        const sessionDir = path.join(projectsRoot, "runtime-project");
+        fs.mkdirSync(sessionDir, { recursive: true });
+        const jsonlPath = path.join(sessionDir, "runtime-session.jsonl");
+        fs.writeFileSync(jsonlPath, `${ASST_ROW}\n`);
+        process.env.CLAUDE_CONFIG_DIR = configRoot;
+        const opts = makeOpts(env, client);
+        delete opts.claudeProjectsRoot;
+        opts.homeDir = env.root;
+        try {
+            const result = await collectAndSendTelemetry(opts);
+            expect(result.eventsSent).toBe(1);
+            expect(readCursor(env).files[jsonlPath]).toBeDefined();
+        }
+        finally {
+            if (originalProjectsDir === undefined)
+                delete process.env.CLAUDE_PROJECTS_DIR;
+            else
+                process.env.CLAUDE_PROJECTS_DIR = originalProjectsDir;
+            if (originalConfigDir === undefined)
+                delete process.env.CLAUDE_CONFIG_DIR;
+            else
+                process.env.CLAUDE_CONFIG_DIR = originalConfigDir;
+        }
+    });
+    it("(c) sanitizer strips REMOVE fields — only allowlisted fields reach wire", async () => {
+        const client = makeClient();
+        writeJsonl(env, "proj", "full.jsonl", [USER_ROW, ASST_ROW]);
+        await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.posts).toHaveLength(1);
+        const allowed = new Set([
+            "sessionId", "timestamp", "uuid", "cwd", "gitBranch", "userType",
+            "model", "inputTokens", "outputTokens",
+            "cacheCreationInputTokens", "cacheReadInputTokens",
+        ]);
+        for (const ev of client.posts[0].events) {
+            for (const key of Object.keys(ev)) {
+                expect(allowed.has(key), `field "${key}" must be in allowlist`).toBe(true);
+            }
+            expect("message" in ev).toBe(false);
+            for (const banned of ["content", "thinking", "text", "toolUseIds", "toolResults"]) {
+                expect(banned in ev).toBe(false);
+            }
+        }
+    });
+    it("(d) 1 MiB cap forces ≥2 batches when rows are large", async () => {
+        const client = makeClient();
+        // ~25 KiB per row × 50 rows ≈ 1.25 MiB → ≥2 batches.
+        const longBranch = "x".repeat(25_000);
+        const lines = [];
+        for (let i = 0; i < 50; i++) {
+            lines.push(JSON.stringify({
+                type: "user",
+                timestamp: `2026-04-25T10:00:${String(i % 60).padStart(2, "0")}Z`,
+                sessionId: "s1",
+                uuid: `u${i}`,
+                cwd: "/Users/x",
+                gitBranch: longBranch,
+                userType: "human",
+                message: { role: "user", content: [{ type: "text", text: "hi" }], id: "m" },
+            }));
+        }
+        writeJsonl(env, "proj", "large.jsonl", lines);
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.batchesSent).toBeGreaterThanOrEqual(2);
+        expect(result.eventsSent).toBe(50);
+        // Final batch must be < 1 MiB on the wire.
+        const lastWire = Buffer.byteLength(JSON.stringify(client.posts.at(-1)), "utf-8");
+        expect(lastWire).toBeLessThan(1_000_000);
+    });
+    it("F19: caps usage telemetry batches at 100 events", async () => {
+        const client = makeClient();
+        const lines = Array.from({ length: 101 }, (_, i) => JSON.stringify({
+            type: "user",
+            timestamp: `2026-04-25T10:${String(Math.floor(i / 60)).padStart(2, "0")}:${String(i % 60).padStart(2, "0")}Z`,
+            sessionId: "s-f19-row-cap",
+            uuid: `u-f19-row-${i}`,
+            cwd: "/Users/x",
+            gitBranch: "main",
+            userType: "human",
+            message: { role: "user", content: [{ type: "text", text: "hi" }], id: `m${i}` },
+        }));
+        writeJsonl(env, "proj", "f19-row-cap.jsonl", lines);
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.eventsSent).toBe(101);
+        expect(result.batchesSent).toBe(2);
+        expect(client.posts.map((post) => post.events.length)).toEqual([100, 1]);
+        for (const post of client.posts) {
+            expect(post.events.length).toBeLessThanOrEqual(100);
+        }
+    });
+    it("F19: caps usage telemetry POST bodies at 240 KiB", async () => {
+        const client = makeClient();
+        const branch = "x".repeat(9_000);
+        const lines = Array.from({ length: 30 }, (_, i) => JSON.stringify({
+            type: "user",
+            timestamp: `2026-04-25T11:${String(Math.floor(i / 60)).padStart(2, "0")}:${String(i % 60).padStart(2, "0")}Z`,
+            sessionId: "s-f19-byte-cap",
+            uuid: `u-f19-byte-${i}`,
+            cwd: "/Users/x",
+            gitBranch: branch,
+            userType: "human",
+            message: { role: "user", content: [{ type: "text", text: "hi" }], id: `m${i}` },
+        }));
+        writeJsonl(env, "proj", "f19-byte-cap.jsonl", lines);
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        const wireSizes = client.posts.map((post) => Buffer.byteLength(JSON.stringify(post), "utf-8"));
+        expect(result.eventsSent).toBe(30);
+        expect(result.batchesSent).toBeGreaterThan(1);
+        for (const wireSize of wireSizes) {
+            expect(wireSize).toBeLessThanOrEqual(240 * 1024);
+        }
+    });
+    it("R-F19: bounds a single oversized sanitized usage row before POST", async () => {
+        const client = makeClient();
+        const logs = [];
+        const hugeBranch = "x".repeat(400_000);
+        writeJsonl(env, "proj", "r-f19-singleton.jsonl", [
+            JSON.stringify({
+                type: "user",
+                timestamp: "2026-06-19T10:00:00.000Z",
+                sessionId: "s-r-f19-singleton",
+                uuid: "u-r-f19-singleton",
+                cwd: "/Users/x",
+                gitBranch: hugeBranch,
+                userType: "human",
+                message: {
+                    role: "user",
+                    content: [{ type: "text", text: "hi" }],
+                    id: "m-r-f19-singleton",
+                },
+            }),
+        ]);
+        const result = await collectAndSendTelemetry({
+            ...makeOpts(env, client),
+            log: (msg) => logs.push(msg),
+        });
+        expect(result.eventsSent).toBe(1);
+        expect(client.posts).toHaveLength(1);
+        const wireSize = Buffer.byteLength(JSON.stringify(client.posts[0]), "utf-8");
+        expect(wireSize).toBeLessThanOrEqual(240 * 1024);
+        expect(client.posts[0].events[0].gitBranch).not.toBe(hugeBranch);
+        expect(logs.some((line) => line.includes("oversized row truncated"))).toBe(true);
+    });
+    it("(e) POST 500 → cursor NOT advanced", async () => {
+        const client = makeClient({ postResponse: new Error("server 500") });
+        writeJsonl(env, "proj", "s.jsonl", [USER_ROW, ASST_ROW, USER_ROW]);
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.eventsSent).toBe(0);
+        expect(result.batchesSent).toBe(0);
+        expect(client.posts).toHaveLength(1); // we still tried
+        // Cursor file is written (with rotation/empty resets), but the file's
+        // entry must NOT carry a non-zero offset.
+        if (fs.existsSync(env.cursorPath)) {
+            const cursor = readCursor(env);
+            const allOffsets = Object.values(cursor.files).map((e) => e.offset);
+            expect(allOffsets.every((off) => off === 0)).toBe(true);
+        }
+    });
+    it("(f) atomic cursor write — no .tmp leftover", async () => {
+        const client = makeClient();
+        writeJsonl(env, "proj", "s.jsonl", [USER_ROW]);
+        await collectAndSendTelemetry(makeOpts(env, client));
+        expect(fs.existsSync(env.cursorPath)).toBe(true);
+        expect(fs.existsSync(`${env.cursorPath}.tmp`)).toBe(false);
+    });
+    it("(g) new file between runs starts at offset 0", async () => {
+        const client = makeClient();
+        writeJsonl(env, "proj-a", "a.jsonl", [USER_ROW]);
+        await collectAndSendTelemetry(makeOpts(env, client));
+        const postsAfterRun1 = client.posts.length;
+        expect(postsAfterRun1).toBeGreaterThanOrEqual(1);
+        // Add a new fixture between runs.
+        const pathB = writeJsonl(env, "proj-b", "b.jsonl", [ASST_ROW]);
+        await collectAndSendTelemetry(makeOpts(env, client));
+        const cursor = readCursor(env);
+        const sizeB = fs.statSync(pathB).size;
+        expect(cursor.files[pathB].offset).toBe(sizeB);
+    });
+    it("(h) truncated/rotated file resets cursor to 0", async () => {
+        const client = makeClient();
+        const pathA = writeJsonl(env, "proj", "a.jsonl", [USER_ROW, ASST_ROW, USER_ROW]);
+        const originalSize = fs.statSync(pathA).size;
+        await collectAndSendTelemetry(makeOpts(env, client));
+        let cursor = readCursor(env);
+        expect(cursor.files[pathA].offset).toBe(originalSize);
+        // Truncate to 0 → next run must detect rotation and reset.
+        fs.truncateSync(pathA, 0);
+        await collectAndSendTelemetry(makeOpts(env, client));
+        cursor = readCursor(env);
+        expect(cursor.files[pathA].offset).toBe(0);
+    });
+    it("(i) opt-in GET fails → falls back to menubar.json (telemetryEnabled=true → runs)", async () => {
+        const client = makeClient({ optInResponse: new Error("server 500") });
+        fs.writeFileSync(env.menubarPath, JSON.stringify({ telemetryEnabled: true }));
+        writeJsonl(env, "proj", "s.jsonl", [USER_ROW]);
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.enabled).toBe(true);
+        expect(result.optInSource).toBe("menubar-fallback");
+        expect(client.posts).toHaveLength(1);
+    });
+    it("(i') opt-in GET fails AND menubar.json says false → skips", async () => {
+        const client = makeClient({ optInResponse: new Error("server 500") });
+        fs.writeFileSync(env.menubarPath, JSON.stringify({ telemetryEnabled: false }));
+        writeJsonl(env, "proj", "s.jsonl", [USER_ROW]);
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.enabled).toBe(false);
+        expect(result.optInSource).toBe("menubar-fallback");
+        expect(client.posts).toHaveLength(0);
+    });
+    it("(j) missing claude/projects directory → no crash, no posts", async () => {
+        fs.rmSync(env.claudeProjects, { recursive: true });
+        const client = makeClient();
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.enabled).toBe(true);
+        expect(result.filesScanned).toBe(0);
+        expect(client.posts).toHaveLength(0);
+    });
+    it("(k) second run with no new content sends nothing", async () => {
+        const client = makeClient();
+        writeJsonl(env, "proj", "s.jsonl", [USER_ROW, ASST_ROW]);
+        await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.posts).toHaveLength(1);
+        await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.posts).toHaveLength(1); // no second POST
+    });
+});
+// ── Codex rollout collection ────────────────────────────────────────────────
+function codexLine(value) {
+    return JSON.stringify(value);
+}
+function writeCodexRollout(env, location, name, lines) {
+    const dir = location === "sessions"
+        ? path.join(env.codexRoot, location, "2026", "07", "30")
+        : path.join(env.codexRoot, location);
+    fs.mkdirSync(dir, { recursive: true });
+    const file = path.join(dir, name);
+    fs.writeFileSync(file, lines.map(codexLine).join("\n") + "\n", "utf-8");
+    return file;
+}
+function codexToken(timestamp, uuid, input, output, reasoning = 0, cached = 0) {
+    return {
+        timestamp,
+        uuid,
+        type: "event_msg",
+        payload: {
+            type: "token_count",
+            info: {
+                last_token_usage: {
+                    input_tokens: input,
+                    output_tokens: output,
+                    reasoning_output_tokens: reasoning,
+                    cached_input_tokens: cached,
+                },
+                total_token_usage: {
+                    input_tokens: 999_999,
+                    output_tokens: 999_999,
+                },
+            },
+            raw_content: "must never leave the machine",
+        },
+    };
+}
+describe("collectAndSendTelemetry — Codex rollouts", () => {
+    let env;
+    beforeEach(() => {
+        env = setupEnv();
+    });
+    afterEach(() => teardownEnv(env));
+    it("collects token deltas from live and archived Linux rollouts", async () => {
+        writeCodexRollout(env, "sessions", "rollout-live.jsonl", [
+            {
+                timestamp: "2026-07-30T10:00:00Z",
+                type: "session_meta",
+                payload: {
+                    id: "codex-live",
+                    cwd: "/home/yousuf/hq/repos/private/hq-cloud",
+                    git: { branch: "feature/live" },
+                    model: "session-model",
+                    instructions: "private prompt",
+                },
+            },
+            {
+                timestamp: "2026-07-30T10:00:01Z",
+                type: "turn_context",
+                payload: { model: "codex-auto-review" },
+            },
+            codexToken("2026-07-30T10:00:02Z", "codex-event-live", 11, 7, 5, 3),
+        ]);
+        writeCodexRollout(env, "archived_sessions", "rollout-archived.jsonl", [
+            {
+                timestamp: "2026-07-29T10:00:00Z",
+                type: "session_meta",
+                payload: { id: "codex-archived", cwd: "/repo", model: "gpt-5-codex" },
+            },
+            codexToken("2026-07-29T10:00:01Z", "codex-event-archived", 2, 3, 1, 1),
+        ]);
+        const client = makeClient();
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        const events = client.posts.flatMap((post) => post.events);
+        expect(result.filesScanned).toBe(2);
+        expect(result.eventsSent).toBe(2);
+        expect(events).toEqual(expect.arrayContaining([
+            {
+                sessionId: "codex-live",
+                timestamp: "2026-07-30T10:00:02Z",
+                uuid: "codex-event-live",
+                cwd: "/home/yousuf/hq/repos/private/hq-cloud",
+                gitBranch: "feature/live",
+                model: "codex-auto-review",
+                inputTokens: 11,
+                outputTokens: 12,
+                cacheReadInputTokens: 3,
+            },
+            expect.objectContaining({
+                sessionId: "codex-archived",
+                model: "gpt-5-codex",
+                inputTokens: 2,
+                outputTokens: 4,
+                cacheReadInputTokens: 1,
+            }),
+        ]));
+        expect(JSON.stringify(events)).not.toContain("private prompt");
+        expect(JSON.stringify(events)).not.toContain("raw_content");
+        expect(JSON.stringify(events)).not.toContain("999999");
+        await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.posts.flatMap((post) => post.events)).toHaveLength(2);
+    });
+    it("persists model context for incremental rollouts and generates stable IDs", async () => {
+        const file = writeCodexRollout(env, "sessions", "rollout-incremental.jsonl", [
+            {
+                type: "session_meta",
+                payload: { id: "incremental", cwd: "/repo", model: "session-model" },
+            },
+            { type: "turn_context", payload: { model: "model-a" } },
+            codexToken("2026-07-30T13:00:00Z", "first-event", 1, 2),
+        ]);
+        fs.writeFileSync(env.cursorPath, JSON.stringify({ version: "1", files: {}, codex_next_rollout: file }));
+        const client = makeClient();
+        await collectAndSendTelemetry(makeOpts(env, client));
+        fs.appendFileSync(file, [
+            codexLine({ type: "turn_context", payload: { model: "model-b" } }),
+            codexLine({
+                ...codexToken("2026-07-30T13:01:00Z", "temporary", 3, 4),
+                uuid: undefined,
+            }),
+        ].join("\n") + "\n");
+        await collectAndSendTelemetry(makeOpts(env, client));
+        const events = client.posts.flatMap((post) => post.events);
+        expect(events).toHaveLength(2);
+        expect(events[1]).toMatchObject({
+            sessionId: "incremental",
+            cwd: "/repo",
+            model: "model-b",
+            inputTokens: 3,
+            outputTokens: 4,
+        });
+        expect(events[1].uuid).toMatch(/^codex-[a-f0-9]{64}$/);
+        const cursor = JSON.parse(fs.readFileSync(env.cursorPath, "utf-8"));
+        expect(cursor.files[file].context).toMatchObject({
+            session_id: "incremental",
+            cwd: "/repo",
+            session_model: "session-model",
+            turn_model: "model-b",
+        });
+        expect(cursor.codex_next_rollout).toBe(file);
+    });
+    it("bounds a quiet first backfill and resumes until the token event", async () => {
+        const file = writeCodexRollout(env, "sessions", "rollout-bounded.jsonl", [
+            { type: "session_meta", payload: { id: "bounded", model: "gpt-5-codex" } },
+            ...Array.from({ length: 8 }, (_, index) => ({
+                type: "response_item",
+                payload: { type: "message", content: "x".repeat(140), index },
+            })),
+            codexToken("2026-07-30T14:00:00Z", "bounded-event", 5, 7),
+        ]);
+        const client = makeClient();
+        const opts = {
+            ...makeOpts(env, client),
+            maxScanBytesPerSource: 350,
+        };
+        const first = await collectAndSendTelemetry(opts);
+        expect(first.eventsSent).toBe(0);
+        const firstOffset = readCursor(env).files[file]?.offset ?? 0;
+        expect(firstOffset).toBeGreaterThan(0);
+        expect(firstOffset).toBeLessThan(fs.statSync(file).size);
+        for (let run = 0; run < 10 && client.posts.length === 0; run++) {
+            await collectAndSendTelemetry(opts);
+        }
+        expect(client.posts.flatMap((post) => post.events)).toEqual([
+            expect.objectContaining({
+                sessionId: "bounded",
+                uuid: "bounded-event",
+                model: "gpt-5-codex",
+            }),
+        ]);
+    });
+    it("discards an oversized UTF-8 row without corrupting resume offsets", async () => {
+        const file = writeCodexRollout(env, "sessions", "rollout-utf8.jsonl", [
+            { type: "session_meta", payload: { id: "utf8", model: "gpt-5-codex" } },
+            {
+                type: "response_item",
+                payload: { type: "message", content: "😀".repeat(20_000) },
+            },
+            codexToken("2026-07-30T14:00:01Z", "utf8-event", 2, 3),
+        ]);
+        const client = makeClient();
+        const opts = {
+            ...makeOpts(env, client),
+            maxScanBytesPerSource: 64 * 1024,
+        };
+        for (let run = 0; run < 5 && client.posts.length === 0; run++) {
+            await collectAndSendTelemetry(opts);
+        }
+        const events = client.posts.flatMap((post) => post.events);
+        expect(events).toEqual([
+            expect.objectContaining({ uuid: "utf8-event", sessionId: "utf8" }),
+        ]);
+        expect(readCursor(env).files[file].offset).toBeLessThanOrEqual(fs.statSync(file).size);
+    });
+    it("caps upload batches and resumes remaining token events", async () => {
+        writeCodexRollout(env, "sessions", "rollout-batch-cap.jsonl", [
+            { type: "session_meta", payload: { id: "batch-cap", model: "gpt-5-codex" } },
+            ...Array.from({ length: 201 }, (_, index) => codexToken("2026-07-30T14:01:" + String(index % 60).padStart(2, "0") + "Z", "batch-cap-" + index, 1, 1)),
+        ]);
+        const client = makeClient();
+        const opts = {
+            ...makeOpts(env, client),
+            maxScanBytesPerSource: 1_000_000,
+            maxBatchesPerRun: 2,
+        };
+        const first = await collectAndSendTelemetry(opts);
+        expect(first.batchesSent).toBe(2);
+        expect(first.eventsSent).toBe(200);
+        const second = await collectAndSendTelemetry(opts);
+        expect(second.eventsSent).toBe(1);
+        expect(client.posts.flatMap((post) => post.events)).toHaveLength(201);
+    });
+    it("does not advance a Codex rollout cursor when upload fails", async () => {
+        const file = writeCodexRollout(env, "sessions", "rollout-retry.jsonl", [
+            { type: "session_meta", payload: { id: "retry", model: "gpt-5-codex" } },
+            codexToken("2026-07-30T12:00:00Z", "retry-event", 1, 2),
+        ]);
+        const client = makeClient({ postResponse: new Error("server 500") });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.eventsSent).toBe(0);
+        const cursor = readCursor(env);
+        expect(cursor.files[file]?.offset ?? 0).toBe(0);
+    });
+});
+// ── Grok session collection ──────────────────────────────────────────────────
+function writeGrokSession(env, opts) {
+    const encodedCwd = opts.encodedCwd ?? encodeURIComponent("/Users/x/proj");
+    const dir = path.join(env.grokRoot, "sessions", encodedCwd, opts.sessionId);
+    fs.mkdirSync(dir, { recursive: true });
+    if (opts.summary) {
+        fs.writeFileSync(path.join(dir, "summary.json"), JSON.stringify(opts.summary), "utf-8");
+    }
+    const file = path.join(dir, "updates.jsonl");
+    fs.writeFileSync(file, opts.lines.map((line) => JSON.stringify(line)).join("\n") + "\n", "utf-8");
+    return file;
+}
+function grokTurnCompleted(opts) {
+    const update = {
+        sessionUpdate: "turn_completed",
+        prompt_id: opts.promptId,
+        stop_reason: "end_turn",
+        usage: opts.usage,
+        ...opts.extraUpdate,
+    };
+    const params = {
+        sessionId: opts.sessionId,
+        update,
+    };
+    if (opts.eventId) {
+        params._meta = { eventId: opts.eventId };
+    }
+    return {
+        timestamp: opts.timestamp ?? 1_786_507_623,
+        method: opts.method ?? "_x.ai/session/update",
+        params,
+    };
+}
+describe("collectAndSendTelemetry — Grok sessions", () => {
+    let env;
+    beforeEach(() => {
+        env = setupEnv();
+    });
+    afterEach(() => teardownEnv(env));
+    it("collects turn_completed usage with reasoning folded into outputTokens", async () => {
+        const sessionId = "grok-session-1";
+        writeGrokSession(env, {
+            sessionId,
+            summary: {
+                info: { id: sessionId, cwd: "/Users/x/proj" },
+                current_model_id: "grok-4.5-build",
+                head_branch: "feat/grok-usage",
+            },
+            lines: [
+                {
+                    timestamp: 1_786_507_620,
+                    method: "session/update",
+                    params: {
+                        sessionId,
+                        update: {
+                            sessionUpdate: "agent_message_chunk",
+                            content: { type: "text", text: "secret prompt body" },
+                            _meta: { totalTokens: 999_999 },
+                        },
+                    },
+                },
+                grokTurnCompleted({
+                    sessionId,
+                    promptId: "prompt-1",
+                    eventId: "evt-turn-1",
+                    usage: {
+                        inputTokens: 2552850,
+                        outputTokens: 29428,
+                        cachedReadTokens: 2414208,
+                        cacheCreationTokens: 0,
+                        reasoningTokens: 14654,
+                        modelUsage: {
+                            "grok-4.5-build": {
+                                inputTokens: 2552850,
+                                outputTokens: 29428,
+                                cachedReadTokens: 2414208,
+                                cacheCreationTokens: 0,
+                                reasoningTokens: 14654,
+                            },
+                        },
+                    },
+                }),
+            ],
+        });
+        const client = makeClient();
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        const events = client.posts.flatMap((post) => post.events);
+        expect(result.filesScanned).toBe(1);
+        expect(result.eventsSent).toBe(1);
+        expect(events).toEqual([
+            {
+                sessionId,
+                timestamp: new Date(1_786_507_623 * 1000).toISOString(),
+                uuid: "evt-turn-1",
+                cwd: "/Users/x/proj",
+                gitBranch: "feat/grok-usage",
+                model: "grok-4.5-build",
+                inputTokens: 2552850,
+                outputTokens: 29428 + 14654,
+                cacheReadInputTokens: 2414208,
+                cacheCreationInputTokens: 0,
+            },
+        ]);
+        expect(JSON.stringify(events)).not.toContain("secret prompt body");
+        expect(JSON.stringify(events)).not.toContain("999999");
+    });
+    it("advances the cursor incrementally and only posts new turn_completed rows", async () => {
+        const sessionId = "grok-incremental";
+        const file = writeGrokSession(env, {
+            sessionId,
+            summary: {
+                info: { cwd: "/repo" },
+                current_model_id: "grok-4.5-build",
+            },
+            lines: [
+                grokTurnCompleted({
+                    sessionId,
+                    promptId: "p1",
+                    eventId: "evt-1",
+                    usage: {
+                        inputTokens: 10,
+                        outputTokens: 2,
+                        reasoningTokens: 1,
+                        cachedReadTokens: 0,
+                        cacheCreationTokens: 0,
+                        modelUsage: {
+                            "grok-4.5-build": {
+                                inputTokens: 10,
+                                outputTokens: 2,
+                                reasoningTokens: 1,
+                                cachedReadTokens: 0,
+                                cacheCreationTokens: 0,
+                            },
+                        },
+                    },
+                }),
+            ],
+        });
+        const client = makeClient();
+        await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.posts.flatMap((post) => post.events)).toHaveLength(1);
+        const offsetAfterFirst = readCursor(env).files[file].offset;
+        await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.posts.flatMap((post) => post.events)).toHaveLength(1);
+        expect(readCursor(env).files[file].offset).toBe(offsetAfterFirst);
+        fs.appendFileSync(file, JSON.stringify(grokTurnCompleted({
+            timestamp: 1_786_507_700,
+            sessionId,
+            promptId: "p2",
+            eventId: "evt-2",
+            usage: {
+                inputTokens: 20,
+                outputTokens: 4,
+                reasoningTokens: 0,
+                cachedReadTokens: 5,
+                cacheCreationTokens: 1,
+                modelUsage: {
+                    "grok-4.5-build": {
+                        inputTokens: 20,
+                        outputTokens: 4,
+                        reasoningTokens: 0,
+                        cachedReadTokens: 5,
+                        cacheCreationTokens: 1,
+                    },
+                },
+            },
+        })) + "\n");
+        await collectAndSendTelemetry(makeOpts(env, client));
+        const events = client.posts.flatMap((post) => post.events);
+        expect(events).toHaveLength(2);
+        expect(events[1]).toMatchObject({
+            uuid: "evt-2",
+            inputTokens: 20,
+            outputTokens: 4,
+            cacheReadInputTokens: 5,
+            cacheCreationInputTokens: 1,
+        });
+    });
+    it("opt-out with no company skips the grok scan entirely", async () => {
+        writeGrokSession(env, {
+            sessionId: "grok-optout",
+            summary: { info: { cwd: "/repo" }, current_model_id: "grok-4.5-build" },
+            lines: [
+                grokTurnCompleted({
+                    sessionId: "grok-optout",
+                    promptId: "p1",
+                    eventId: "evt-optout",
+                    usage: {
+                        inputTokens: 1,
+                        outputTokens: 1,
+                        reasoningTokens: 0,
+                        modelUsage: {
+                            "grok-4.5-build": {
+                                inputTokens: 1,
+                                outputTokens: 1,
+                                reasoningTokens: 0,
+                            },
+                        },
+                    },
+                }),
+            ],
+        });
+        const client = makeClient({
+            optInResponse: { enabled: false, updatedAt: null },
+        });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.enabled).toBe(false);
+        expect(result.filesScanned).toBe(0);
+        expect(client.posts).toHaveLength(0);
+        expect(fs.existsSync(env.cursorPath)).toBe(false);
+    });
+    it("ignores streaming _meta.totalTokens chunks but still advances the cursor", async () => {
+        const sessionId = "grok-stream-only";
+        const file = writeGrokSession(env, {
+            sessionId,
+            summary: { info: { cwd: "/repo" }, current_model_id: "grok-4.5-build" },
+            lines: [
+                {
+                    timestamp: 1_786_507_600,
+                    method: "session/update",
+                    params: {
+                        sessionId,
+                        update: {
+                            sessionUpdate: "agent_thought_chunk",
+                            content: { type: "text", text: "thinking" },
+                            _meta: { totalTokens: 20447, eventId: "chunk-1" },
+                        },
+                    },
+                },
+                {
+                    timestamp: 1_786_507_601,
+                    method: "_x.ai/session/update",
+                    params: {
+                        sessionId,
+                        update: {
+                            sessionUpdate: "tool_call",
+                            title: "read_file",
+                            _meta: { totalTokens: 31430 },
+                        },
+                    },
+                },
+            ],
+        });
+        const client = makeClient();
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.eventsSent).toBe(0);
+        expect(client.posts).toHaveLength(0);
+        expect(readCursor(env).files[file].offset).toBe(fs.statSync(file).size);
+    });
+    it("missing ~/.grok is a silent success", async () => {
+        fs.rmSync(env.grokRoot, { recursive: true, force: true });
+        const client = makeClient();
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.filesScanned).toBe(0);
+        expect(result.eventsSent).toBe(0);
+        expect(client.posts).toHaveLength(0);
+    });
+    it("emits one event per model in modelUsage", async () => {
+        const sessionId = "grok-multi";
+        writeGrokSession(env, {
+            sessionId,
+            summary: { info: { cwd: "/repo" }, current_model_id: "grok-4.5-build" },
+            lines: [
+                grokTurnCompleted({
+                    sessionId,
+                    promptId: "multi-prompt",
+                    eventId: "evt-multi",
+                    usage: {
+                        inputTokens: 100,
+                        outputTokens: 10,
+                        reasoningTokens: 5,
+                        cachedReadTokens: 20,
+                        cacheCreationTokens: 0,
+                        modelUsage: {
+                            "grok-4.5-build": {
+                                inputTokens: 60,
+                                outputTokens: 6,
+                                reasoningTokens: 3,
+                                cachedReadTokens: 10,
+                                cacheCreationTokens: 0,
+                            },
+                            "grok-code-fast-1": {
+                                inputTokens: 40,
+                                outputTokens: 4,
+                                reasoningTokens: 2,
+                                cachedReadTokens: 10,
+                                cacheCreationTokens: 0,
+                            },
+                        },
+                    },
+                }),
+            ],
+        });
+        const client = makeClient();
+        await collectAndSendTelemetry(makeOpts(env, client));
+        const events = client.posts.flatMap((post) => post.events);
+        expect(events).toHaveLength(2);
+        expect(events).toEqual(expect.arrayContaining([
+            expect.objectContaining({
+                model: "grok-4.5-build",
+                inputTokens: 60,
+                outputTokens: 9,
+                cacheReadInputTokens: 10,
+            }),
+            expect.objectContaining({
+                model: "grok-code-fast-1",
+                inputTokens: 40,
+                outputTokens: 6,
+                cacheReadInputTokens: 10,
+            }),
+        ]));
+        // Multi-model rows must not share a single eventId (would collapse on ingest).
+        expect(events[0].uuid).not.toBe(events[1].uuid);
+        expect(String(events[0].uuid)).toMatch(/^grok-[a-f0-9]{64}$/);
+        expect(String(events[1].uuid)).toMatch(/^grok-[a-f0-9]{64}$/);
+    });
+    it("never POSTs raw prompt or tool text from grok updates", async () => {
+        const sessionId = "grok-redact";
+        writeGrokSession(env, {
+            sessionId,
+            summary: {
+                info: { cwd: "/repo" },
+                current_model_id: "grok-4.5-build",
+                session_summary: "private summary text",
+            },
+            lines: [
+                {
+                    timestamp: 1_786_507_610,
+                    method: "session/update",
+                    params: {
+                        sessionId,
+                        update: {
+                            sessionUpdate: "user_message_chunk",
+                            content: {
+                                type: "text",
+                                text: "SUPER_SECRET_USER_PROMPT_XYZ",
+                            },
+                        },
+                    },
+                },
+                {
+                    timestamp: 1_786_507_611,
+                    method: "session/update",
+                    params: {
+                        sessionId,
+                        update: {
+                            sessionUpdate: "tool_call",
+                            title: "read_file",
+                            rawInput: { target_file: "/secret/path.ts" },
+                        },
+                    },
+                },
+                grokTurnCompleted({
+                    method: "session/update",
+                    sessionId,
+                    promptId: "redact-prompt",
+                    eventId: "evt-redact",
+                    usage: {
+                        inputTokens: 3,
+                        outputTokens: 1,
+                        reasoningTokens: 1,
+                        cachedReadTokens: 0,
+                        cacheCreationTokens: 0,
+                        modelUsage: {
+                            "grok-4.5-build": {
+                                inputTokens: 3,
+                                outputTokens: 1,
+                                reasoningTokens: 1,
+                                cachedReadTokens: 0,
+                                cacheCreationTokens: 0,
+                            },
+                        },
+                    },
+                }),
+            ],
+        });
+        const client = makeClient();
+        await collectAndSendTelemetry(makeOpts(env, client));
+        const wire = JSON.stringify(client.posts);
+        expect(client.posts.flatMap((post) => post.events)).toHaveLength(1);
+        expect(wire).not.toContain("SUPER_SECRET_USER_PROMPT_XYZ");
+        expect(wire).not.toContain("/secret/path.ts");
+        expect(wire).not.toContain("private summary text");
+        expect(wire).not.toContain("rawInput");
+        expect(wire).not.toContain("user_message_chunk");
+    });
+});
+// ── companyUid edge attribution (US-002) ────────────────────────────────────────
+describe("collectAndSendTelemetry — companyUid attribution", () => {
+    const COMPANY_UID = "cmp_01INDIGOTEST";
+    let env;
+    let hqRoot;
+    // The manifest lives at <hqRoot>/companies/manifest.yaml; the repo it maps is
+    // a real subdir of hqRoot so the resolver's absolute-path math lines up.
+    function writeManifest() {
+        fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
+        fs.writeFileSync(path.join(hqRoot, "companies", "manifest.yaml"), `companies:\n  indigo:\n    repos:\n      - repos/private/hq-cloud\n    cloud_uid: ${COMPANY_UID}\n`);
+    }
+    function rowWithCwd(uuid, cwd) {
+        return JSON.stringify({
+            type: "user",
+            timestamp: "2026-06-10T10:00:00Z",
+            sessionId: "s1",
+            uuid,
+            userType: "human",
+            cwd,
+            message: { role: "user", content: [{ type: "text", text: "hi" }] },
+        });
+    }
+    beforeEach(() => {
+        env = setupEnv();
+        // Use the same tmp root as hqRoot so the repo path resolves under it.
+        hqRoot = env.root;
+        writeManifest();
+    });
+    afterEach(() => { teardownEnv(env); });
+    it("stamps companyUid on events whose cwd is inside a company repo", async () => {
+        const client = makeClient();
+        const inRepo = path.join(hqRoot, "repos/private/hq-cloud/src");
+        writeJsonl(env, "proj", "s.jsonl", [rowWithCwd("u1", inRepo)]);
+        await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
+        expect(client.posts).toHaveLength(1);
+        expect(client.posts[0].events[0].companyUid).toBe(COMPANY_UID);
+    });
+    it("omits companyUid when the cwd maps to no company repo", async () => {
+        const client = makeClient();
+        writeJsonl(env, "proj", "s.jsonl", [rowWithCwd("u1", "/Users/x/some-other-repo")]);
+        await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
+        expect(client.posts).toHaveLength(1);
+        expect("companyUid" in client.posts[0].events[0]).toBe(false);
+    });
+    it("uses the explicit single-company fallback when cwd is the shared HQ root", async () => {
+        const client = makeClient();
+        writeJsonl(env, "proj", "s.jsonl", [rowWithCwd("u1", hqRoot)]);
+        await collectAndSendTelemetry({
+            ...makeOpts(env, client),
+            hqRoot,
+            fallbackCompany: "indigo",
+        });
+        expect(client.posts).toHaveLength(1);
+        expect(client.posts[0].events[0].companyUid).toBe(COMPANY_UID);
+    });
+    it("prefers the cwd-resolved company over the single-company fallback", async () => {
+        const client = makeClient();
+        const inRepo = path.join(hqRoot, "repos/private/hq-cloud");
+        writeJsonl(env, "proj", "s.jsonl", [rowWithCwd("u1", inRepo)]);
+        await collectAndSendTelemetry({
+            ...makeOpts(env, client),
+            hqRoot,
+            fallbackCompany: "cmp_01OTHER",
+        });
+        expect(client.posts).toHaveLength(1);
+        expect(client.posts[0].events[0].companyUid).toBe(COMPANY_UID);
+    });
+    it("never sends the reserved 'unattributed' value", async () => {
+        const client = makeClient();
+        writeJsonl(env, "proj", "s.jsonl", [
+            rowWithCwd("u1", path.join(hqRoot, "repos/private/hq-cloud")),
+            rowWithCwd("u2", "/elsewhere"),
+        ]);
+        await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
+        for (const ev of client.posts.flatMap((p) => p.events)) {
+            expect(ev.companyUid).not.toBe("unattributed");
+        }
+    });
+    it("parses the manifest once per run (cache), not per event", async () => {
+        const client = makeClient();
+        const inRepo = path.join(hqRoot, "repos/private/hq-cloud");
+        // 5 events in one run; assert the manifest file is read exactly once.
+        writeJsonl(env, "proj", "s.jsonl", Array.from({ length: 5 }, (_, i) => rowWithCwd(`u${i}`, inRepo)));
+        const manifestPath = path.join(hqRoot, "companies", "manifest.yaml");
+        const realReadFile = fsp.readFile;
+        let manifestReads = 0;
+        const spy = vi
+            .spyOn(fsp, "readFile")
+            .mockImplementation((async (p, ...rest) => {
+            if (typeof p === "string" && p === manifestPath)
+                manifestReads++;
+            // @ts-expect-error pass-through to the real implementation
+            return realReadFile(p, ...rest);
+        }));
+        try {
+            await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
+        }
+        finally {
+            spy.mockRestore();
+        }
+        expect(manifestReads).toBe(1); // one parse for all 5 events
+        const events = client.posts.flatMap((p) => p.events);
+        expect(events).toHaveLength(5);
+        for (const ev of events)
+            expect(ev.companyUid).toBe(COMPANY_UID);
+    });
+});
+const CALLER = "prs_01CALLER";
+// ── Consent self-heal ────────────────────────────────────────────────────────
+//
+// Regression for the opt-in race: the installer writes the user's answer to
+// `~/.hq/menubar.json` (always succeeds) AND posts it to `/v1/usage/opt-in` —
+// but that post fires before the person entity exists, so it 404s and the
+// server attribute is never written. Absence read as `false`, the emitter went
+// silent, and the person showed as "not opted in" forever. Measured in prod:
+// 22 of 33 active Indigo members had NO attribute at all, against 2 genuine
+// opt-outs.
+//
+// The heal replays the answer the user already gave. It must fire ONLY on the
+// server's `unset` state, and must never invent or overwrite consent.
+describe("collectAndSendTelemetry — consent self-heal", () => {
+    let env;
+    beforeEach(() => {
+        env = setupEnv();
+    });
+    afterEach(() => teardownEnv(env));
+    // The cached answer must name the account it belongs to; an unbound record is
+    // deliberately not replayable (see the cross-account test below).
+    function writeMenubar(value, personUid = CALLER) {
+        fs.writeFileSync(env.menubarPath, JSON.stringify({
+            telemetryEnabled: value,
+            ...(personUid ? { telemetryOptInPersonUid: personUid } : {}),
+        }));
+    }
+    it("re-asserts a local opt-IN when the server has no recorded consent", async () => {
+        writeMenubar(true);
+        const client = makeClient({
+            optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
+        });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.optInSets).toEqual([true]);
+        expect(result.enabled).toBe(true);
+        expect(result.optInSource).toBe("menubar-reasserted");
+    });
+    it("re-asserts a local opt-OUT so the server records the real answer", async () => {
+        writeMenubar(false);
+        const client = makeClient({
+            optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
+        });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.optInSets).toEqual([false]);
+        expect(result.enabled).toBe(false);
+    });
+    it("NEVER overwrites an explicit server opt-out", async () => {
+        // The user opted in on this machine at some point, then explicitly opted
+        // out account-wide. The account-wide answer must win.
+        writeMenubar(true);
+        const client = makeClient({
+            optInResponse: { enabled: false, updatedAt: "2026-06-19T16:11:09.939Z", unset: false },
+        });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.optInSets).toEqual([]);
+        expect(result.enabled).toBe(false);
+        expect(result.optInSource).toBe("server");
+    });
+    it("does not invent consent when no local answer exists", async () => {
+        // No menubar.json at all — we hold no answer, so we assert nothing.
+        const client = makeClient({
+            optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
+        });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.optInSets).toEqual([]);
+        expect(result.enabled).toBe(false);
+    });
+    it("does not invent consent when the local value is not a boolean", async () => {
+        writeMenubar("yes");
+        const client = makeClient({
+            optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
+        });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.optInSets).toEqual([]);
+        expect(result.enabled).toBe(false);
+    });
+    it("falls back to the server answer when the re-assert POST fails", async () => {
+        writeMenubar(true);
+        const client = makeClient({
+            optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
+            setOptInError: new Error("network down"),
+        });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.optInSets).toEqual([true]);
+        // Non-fatal: the run completes on the server's answer and retries next time.
+        expect(result.enabled).toBe(false);
+        expect(result.optInSource).toBe("server");
+    });
+    it("skips the heal entirely against an older server that omits `unset`", async () => {
+        writeMenubar(true);
+        const client = makeClient({ optInResponse: { enabled: false, updatedAt: null } });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.optInSets).toEqual([]);
+        expect(result.optInSource).toBe("server");
+    });
+});
+// The self-heal must be ATOMIC. Reading `unset` and replaying the local answer
+// are two requests; without a server-side condition another device could record
+// a real opt-out in between and the replay would clobber it.
+describe("collectAndSendTelemetry — self-heal is conditional", () => {
+    let env;
+    beforeEach(() => {
+        env = setupEnv();
+    });
+    afterEach(() => teardownEnv(env));
+    it("asks the server to write ONLY if the consent is still unset", async () => {
+        fs.writeFileSync(env.menubarPath, JSON.stringify({ telemetryEnabled: true, telemetryOptInPersonUid: CALLER }));
+        const client = makeClient({
+            optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
+        });
+        await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.optInSetOpts[0]).toMatchObject({ onlyIfUnset: true });
+    });
+    it("defers to the server when the conditional write loses the race", async () => {
+        // A real answer was recorded elsewhere between our GET and our POST.
+        fs.writeFileSync(env.menubarPath, JSON.stringify({ telemetryEnabled: true, telemetryOptInPersonUid: CALLER }));
+        const client = makeClient({
+            optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
+            setOptInApplied: false,
+        });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        // The stale local `true` must NOT win over the answer that landed first.
+        expect(result.enabled).toBe(false);
+        expect(result.optInSource).toBe("server");
+    });
+});
+// The cached consent lives in a per-MACHINE file. If two people sign in under
+// the same OS user it holds whoever answered LAST, so replaying it for a
+// different account would opt in someone who never consented.
+describe("collectAndSendTelemetry — consent replay is account-scoped", () => {
+    let env;
+    beforeEach(() => {
+        env = setupEnv();
+    });
+    afterEach(() => teardownEnv(env));
+    it("does NOT replay a cached answer belonging to a different account", async () => {
+        fs.writeFileSync(env.menubarPath, JSON.stringify({ telemetryEnabled: true, telemetryOptInPersonUid: "prs_01SOMEONE_ELSE" }));
+        const client = makeClient({
+            optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
+        });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.optInSets).toEqual([]);
+        expect(result.enabled).toBe(false);
+    });
+    it("does NOT replay a legacy record with no account binding", async () => {
+        // Written before consent was bound to an account — we cannot prove whose
+        // answer it is, so the installer's post-sign-in upload is the recovery path.
+        fs.writeFileSync(env.menubarPath, JSON.stringify({ telemetryEnabled: true }));
+        const client = makeClient({
+            optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
+        });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.optInSets).toEqual([]);
+        expect(result.enabled).toBe(false);
+    });
+    it("does NOT replay when the server cannot say who the caller is", async () => {
+        fs.writeFileSync(env.menubarPath, JSON.stringify({ telemetryEnabled: true, telemetryOptInPersonUid: CALLER }));
+        // Older server: no `personUid`, so the match cannot be proven.
+        const client = makeClient({
+            optInResponse: { enabled: false, updatedAt: null, unset: true },
+        });
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(client.optInSets).toEqual([]);
+        expect(result.enabled).toBe(false);
+    });
+});
+// ── Consent split — company-scope mandatory capture ──────────────────────────
+// Personal opt-in governs personal/unattributed rows ONLY. Rows produced
+// inside a cloud-backed company's folders ship regardless of the personal
+// answer (the read side already counts them for opted-out members).
+describe("collectAndSendTelemetry — company-scope capture for opted-out people", () => {
+    const COMPANY_UID = "cmp_01INDIGOTEST";
+    let env;
+    let hqRoot;
+    function writeManifest() {
+        fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
+        fs.writeFileSync(path.join(hqRoot, "companies", "manifest.yaml"), `companies:\n  indigo:\n    repos:\n      - repos/private/hq-cloud\n    cloud_uid: ${COMPANY_UID}\n`);
+    }
+    function rowWithCwd(uuid, cwd) {
+        return JSON.stringify({
+            type: "user",
+            timestamp: "2026-06-10T10:00:00Z",
+            sessionId: "s1",
+            uuid,
+            userType: "human",
+            cwd,
+            message: { role: "user", content: [{ type: "text", text: "hi" }] },
+        });
+    }
+    beforeEach(() => {
+        env = setupEnv();
+        hqRoot = env.root;
+        writeManifest();
+    });
+    afterEach(() => { teardownEnv(env); });
+    it("opted-out: ships ONLY company-attributed rows, skips personal ones, advances cursor", async () => {
+        const client = makeClient({ optInResponse: { enabled: false, updatedAt: "2026-06-19T00:00:00Z", unset: false } });
+        const inRepo = path.join(hqRoot, "repos/private/hq-cloud/src");
+        const jsonlPath = writeJsonl(env, "proj", "s.jsonl", [
+            rowWithCwd("personal-1", "/Users/x/unrelated"),
+            rowWithCwd("company-1", inRepo),
+        ]);
+        const fileSize = fs.statSync(jsonlPath).size;
+        const result = await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
+        expect(result.enabled).toBe(false);
+        expect(result.companyScopeOnly).toBe(true);
+        expect(result.eventsSent).toBe(1);
+        expect(client.posts).toHaveLength(1);
+        expect(client.posts[0].events).toHaveLength(1);
+        expect(client.posts[0].events[0].uuid).toBe("company-1");
+        expect(client.posts[0].events[0].companyUid).toBe(COMPANY_UID);
+        // The skipped personal row is cursor-advanced too — not re-read next run.
+        expect(readCursor(env).files[jsonlPath].offset).toBe(fileSize);
+    });
+    it("opted-out: an all-personal backlog ships nothing", async () => {
+        const client = makeClient({ optInResponse: { enabled: false, updatedAt: "2026-06-19T00:00:00Z", unset: false } });
+        writeJsonl(env, "proj", "s.jsonl", [rowWithCwd("personal-1", "/Users/x/unrelated")]);
+        const result = await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
+        expect(result.companyScopeOnly).toBe(true);
+        expect(result.eventsSent).toBe(0);
+        expect(client.posts).toHaveLength(0);
+    });
+    it("opted-out with NO cloud-backed companies: short-circuits like before (no scan, no cursor)", async () => {
+        const client = makeClient({ optInResponse: { enabled: false, updatedAt: null } });
+        writeJsonl(env, "proj", "s.jsonl", [USER_ROW, ASST_ROW]);
+        // No hqRoot → empty company map → nothing could ever ship.
+        const result = await collectAndSendTelemetry(makeOpts(env, client));
+        expect(result.enabled).toBe(false);
+        expect(result.companyScopeOnly).toBeUndefined();
+        expect(result.filesScanned).toBe(0);
+        expect(client.posts).toHaveLength(0);
+        expect(fs.existsSync(env.cursorPath)).toBe(false);
+    });
+    it("opted-IN runs are unchanged: everything ships, no companyScopeOnly flag", async () => {
+        const client = makeClient();
+        const inRepo = path.join(hqRoot, "repos/private/hq-cloud/src");
+        writeJsonl(env, "proj", "s.jsonl", [
+            rowWithCwd("personal-1", "/Users/x/unrelated"),
+            rowWithCwd("company-1", inRepo),
+        ]);
+        const result = await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
+        expect(result.enabled).toBe(true);
+        expect(result.companyScopeOnly).toBeUndefined();
+        expect(result.eventsSent).toBe(2);
+    });
+});
+//# sourceMappingURL=telemetry.test.js.map