impel-cli 0.20.45 → 0.20.46-beta.2

package/src/bugReport.js

@@ -0,0 +1,499 @@
+// The bug-report core: everything that decides *what* gets sent and *where*,
+// with no opinion about who asked.
+//
+// Two front-ends import this module and they differ in exactly one way — who
+// pressed send. `src/commands/report.js` is a person typing `impel report`;
+// `src/autoReport.js` is a failed `impel setup` or `impel update` reporting
+// itself. Both build the same envelope, both are bound by the same destination
+// check, and both spool the same way when delivery fails. Keeping that here
+// rather than in either caller is what makes "the automatic path cannot send
+// something the manual path would not" a property of the code instead of a
+// convention.
+//
+// The envelope's field list is the server's `bugReportEnvelopeSchema`, which is
+// `.strict()`: an extra key is a 400, so anything contextual — the tenant, the
+// report id, attached `impel doctor --json` output — travels inside
+// `diagnostics` rather than as a new top-level field.
+//
+// Nothing here prints, prompts, or sets an exit code. Callers own their own
+// voice; this module throws `BugReportError` and returns data.
+
+import fs from "node:fs";
+import path from "node:path";
+
+import { CONFIG_DIR, normalizeGatewayUrl } from "./config.js";
+import {
+  installRecoveryFingerprint,
+  redactInstallRecoveryText,
+} from "./installRecovery/redact.js";
+import { platformLabel, TELEMETRY_CONTRACT } from "./posthog.js";
+import { RUNTIME_BRAND } from "./runtimeBrand.js";
+import { installedVersion, updateTagForVersion } from "./updates.js";
+import { renameWithWindowsRetry } from "./windowsFs.js";
+
+/** The route both front-ends post to. */
+export const REPORT_ENDPOINT_PATH = "/api/cli/report";
+
+/** Beside `flags.json` and `telemetry/`, and erased by the same `impel nuke`. */
+export const REPORT_SPOOL_DIR = path.join(CONFIG_DIR, "reports");
+
+// Mirrors `bugReportEnvelopeSchema` in the server repo. The CLI ships without
+// runtime dependencies and cannot import that schema; sending a field the
+// server would truncate or reject is a 400 the user discovers instead of us.
+export const MAX_MESSAGE_LENGTH = 4_000;
+export const MAX_VERSION_LENGTH = 32;
+export const MAX_COMMAND_LENGTH = 64;
+export const MAX_ERROR_CODE_LENGTH = 64;
+export const MAX_LOG_LENGTH = 12_000;
+export const MAX_DIAGNOSTIC_KEYS = 24;
+export const MAX_DIAGNOSTIC_VALUE_LENGTH = 2_000;
+
+/** Ids are echoed to a terminal, so the shape is checked rather than trusted. */
+const TASK_ID_RE = /^[A-Za-z0-9_.-]{1,128}$/u;
+const RETRY_AFTER_RE = /^\d{1,6}$/u;
+
+const BUG_REPORT_REASONS = new Set(TELEMETRY_CONTRACT.bugReportReasons);
+
+/**
+ * Our own sentence for each allowlisted reason; server text is never echoed.
+ * Exported so a test can hold it against `TELEMETRY_CONTRACT.bugReportReasons`
+ * — the two lists have to move together and nothing else forces that.
+ */
+export const REASON_NOTES = Object.freeze({
+  scope_required: "this token does not carry the tasks scope",
+  task_creation_failed: "the task board could not be reached",
+  workspace_required: "this account is not a workspace member",
+});
+
+/**
+ * A refusal from the core, carrying a `code` so a caller can choose its own
+ * wording. The manual command maps these back to the sentences it has always
+ * printed; the automatic path swallows them.
+ */
+export class BugReportError extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+}
+
+/* -------------------------------------------------------------------------- */
+/* Destination                                                                */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * The only thing standing between a tampered destination and a PAT-bearing
+ * POST.
+ *
+ * `loadConfig` normalizes `gatewayUrl` and nothing else, so a hand-edited
+ * `appUrl` in the config file reaches a sender unchecked. That was survivable
+ * while the only sender was a person who had just been shown the payload and
+ * the destination; it is not survivable for a sender that runs on its own. So
+ * the predicate lives here, where both front-ends inherit it, rather than in
+ * the command that happened to need it first.
+ *
+ * Rejects non-HTTP(S) schemes, embedded credentials, and any path, query, or
+ * fragment — a bare origin is the only shape a report is sent to.
+ */
+export function resolveReportOrigin(candidate) {
+  const appUrl = normalizeGatewayUrl(candidate);
+  let parsed;
+  try {
+    parsed = new URL(appUrl);
+  } catch {
+    throw new BugReportError(`${appUrl} is not an HTTP or HTTPS URL.`, "invalid_url");
+  }
+  if (
+    (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    || parsed.username
+    || parsed.password
+    || parsed.pathname !== "/"
+    || parsed.search
+    || parsed.hash
+  ) {
+    throw new BugReportError(
+      `${appUrl} is not a bare HTTP or HTTPS origin without credentials, a path, query, or fragment.`,
+      "unsafe_origin",
+    );
+  }
+  return appUrl;
+}
+
+/* -------------------------------------------------------------------------- */
+/* Envelope                                                                   */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * Redact, trim, and bound one free-text field.
+ *
+ * `redactInstallRecoveryText` is the envelope sanitizer: it removes home paths,
+ * emails, bearer tokens, and vendor credentials. `redactCredentialText` /
+ * `redactSecretText` are narrower (Impel credentials and control bytes) and
+ * serve as the test's tripwire, not as this path's sanitizer.
+ */
+export function boundedText(value, max, homeDir) {
+  if (value === undefined || value === null) return "";
+  return redactInstallRecoveryText(String(value), { homeDir }).trim().slice(0, max);
+}
+
+/**
+ * Build the wire envelope, then stamp it with a fingerprint of itself.
+ *
+ * The id is derived rather than random so the same failure reported twice
+ * carries the same identifier, and so a spooled copy and the sent copy are
+ * provably the same report. The automatic path leans on that further: the
+ * fingerprint is what a repeat of the same failure is suppressed against.
+ *
+ * `fields` is already normalized — parsed exit code, file contents read. Flag
+ * parsing and file reads belong to whichever front-end has flags and files.
+ */
+export function buildEnvelope({ fields = {}, config, io }) {
+  const { homeDir } = io;
+  const version = installedVersion();
+  // `installedVersion` returns null when package.json cannot be read — exactly
+  // the broken install someone would be reporting. The server requires a
+  // non-empty string, so the honest placeholder ships instead of a 400.
+  const cliVersion = typeof version === "string" && version
+    ? version.slice(0, MAX_VERSION_LENGTH)
+    : "unknown";
+
+  const message = boundedText(fields.message, MAX_MESSAGE_LENGTH, homeDir);
+  const command = boundedText(fields.command, MAX_COMMAND_LENGTH, homeDir);
+  const errorCode = boundedText(fields.errorCode, MAX_ERROR_CODE_LENGTH, homeDir);
+  const log = boundedText(fields.log, MAX_LOG_LENGTH, homeDir);
+  const doctor = boundedText(fields.doctor, MAX_DIAGNOSTIC_VALUE_LENGTH, homeDir);
+  const { exitCode } = fields;
+
+  const diagnostics = {};
+  const tenant = boundedText(config?.tenantId, MAX_DIAGNOSTIC_VALUE_LENGTH, homeDir);
+  if (tenant) diagnostics.tenant = tenant;
+  if (doctor) diagnostics.doctor = doctor;
+  for (const [key, value] of Object.entries(fields.diagnostics || {})) {
+    const bounded = boundedText(value, MAX_DIAGNOSTIC_VALUE_LENGTH, homeDir);
+    if (bounded) diagnostics[key] = bounded;
+  }
+
+  const envelope = {
+    ...(message ? { message } : {}),
+    cliVersion,
+    nodeVersion: String(process.version).slice(0, MAX_VERSION_LENGTH),
+    platform: platformLabel(io.platform),
+    architecture: String(process.arch).slice(0, MAX_VERSION_LENGTH),
+    channel: updateTagForVersion(cliVersion),
+    ...(command ? { command } : {}),
+    ...(exitCode === undefined || exitCode === null ? {} : { exitCode }),
+    ...(errorCode ? { errorCode } : {}),
+    ...(log ? { stderr: log } : {}),
+    ...(Object.keys(diagnostics).length ? { diagnostics } : {}),
+  };
+
+  const reportId = installRecoveryFingerprint(envelope).slice(0, 16);
+  envelope.diagnostics = { ...diagnostics, reportId };
+  if (Object.keys(envelope.diagnostics).length > MAX_DIAGNOSTIC_KEYS) {
+    throw new BugReportError("too many diagnostic fields to send.", "too_many_diagnostics");
+  }
+  return { envelope, reportId };
+}
+
+/* -------------------------------------------------------------------------- */
+/* Spool                                                                      */
+/* -------------------------------------------------------------------------- */
+
+export function spoolFileName(reportId, now) {
+  const stamp = new Date(now).toISOString().replace(/[:.]/gu, "-");
+  return `${stamp}-${reportId}.json`;
+}
+
+/** How many spooled reports to keep, and for how long. */
+export const SPOOL_MAX_FILES = 50;
+export const SPOOL_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1_000;
+
+/**
+ * Recover the write time from a spool filename.
+ *
+ * `spoolFileName` flattens an ISO timestamp by replacing `:` and `.` with `-`,
+ * so the inverse is positional rather than a parse: four fields of the date,
+ * three of the time, then the milliseconds. Anything that does not match that
+ * shape returns null and the caller falls back to `mtime` — a file this module
+ * did not name is still a file taking up space.
+ */
+function spoolFileTimestamp(name) {
+  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z-/u.exec(name);
+  if (!match) return null;
+  const [, year, month, day, hour, minute, second, ms] = match;
+  const parsed = Date.parse(`${year}-${month}-${day}T${hour}:${minute}:${second}.${ms}Z`);
+  return Number.isNaN(parsed) ? null : parsed;
+}
+
+/**
+ * Keep the spool from growing without bound.
+ *
+ * The spool exists so a report survives an outage, not so a machine accumulates
+ * every failure it has ever had. Two limits, applied in that order: anything
+ * older than `maxAgeMs` goes because nobody is going to act on a month-old
+ * failure, and then the oldest go until at most `maxFiles` remain.
+ *
+ * Two names are never touched. `.last-auto-report.json` is the suppression
+ * marker, not a report — deleting it would make a machine re-report a failure it
+ * had already reported — and it does not count toward the cap. A `.tmp-<pid>`
+ * file belongs to a write that may still be in flight in another process.
+ *
+ * Every failure is swallowed. A spool that cannot be pruned is a disk-hygiene
+ * problem; a report lost to a housekeeping error is a bug that never gets fixed.
+ */
+export function pruneSpool(
+  spoolDir,
+  { now = Date.now(), maxFiles = SPOOL_MAX_FILES, maxAgeMs = SPOOL_MAX_AGE_MS } = {},
+) {
+  const removed = [];
+  try {
+    const entries = [];
+    for (const name of fs.readdirSync(spoolDir)) {
+      // The marker is state, not a report, and a temp file is someone else's
+      // half-finished write. Neither is prunable and neither counts.
+      if (name.startsWith(".")) continue;
+      if (name.includes(".tmp-")) continue;
+      let stamp = spoolFileTimestamp(name);
+      if (stamp === null) {
+        try {
+          stamp = fs.statSync(path.join(spoolDir, name)).mtimeMs;
+        } catch {
+          // Vanished under us — already gone is the outcome pruning wanted.
+          continue;
+        }
+      }
+      entries.push({ name, stamp });
+    }
+
+    entries.sort((left, right) => left.stamp - right.stamp);
+
+    const doomed = new Set();
+    for (const entry of entries) {
+      if (now - entry.stamp > maxAgeMs) doomed.add(entry.name);
+    }
+    // Oldest first, and only as many as the cap actually requires.
+    const surviving = entries.filter((entry) => !doomed.has(entry.name));
+    for (const entry of surviving.slice(0, Math.max(0, surviving.length - maxFiles))) {
+      doomed.add(entry.name);
+    }
+
+    for (const name of doomed) {
+      try {
+        fs.rmSync(path.join(spoolDir, name), { force: true });
+        removed.push(name);
+      } catch {
+        // One unremovable file must not stop the rest of the sweep.
+      }
+    }
+  } catch {
+    // An unreadable spool directory is nothing to report and nothing to fix.
+  }
+  return removed;
+}
+
+/**
+ * Write JSON to a predictable path without following a symlink planted there.
+ *
+ * The install-recovery checkpoint's discipline: private directory, `wx` temp
+ * file — so a pre-planted symlink is a create-time failure rather than a write
+ * through to wherever it pointed — then rename. Both writers under this roof
+ * put attacker-adjacent data at a path an attacker can guess, so both need it.
+ *
+ * Throws what the write threw. Each caller decides what a failed write costs.
+ */
+export function writeJsonAtomically(filePath, value) {
+  const temporaryPath = `${filePath}.tmp-${process.pid}`;
+  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+  try {
+    fs.rmSync(temporaryPath, { force: true });
+    fs.writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, {
+      mode: 0o600,
+      flag: "wx",
+    });
+    renameWithWindowsRetry(temporaryPath, filePath);
+  } finally {
+    try {
+      fs.rmSync(temporaryPath, { force: true });
+    } catch {
+      // A successful rename already removed it; cleanup must not mask the write.
+    }
+  }
+}
+
+/**
+ * Write the undelivered report to disk.
+ */
+export function spoolReport({ envelope, reportId, appUrl, io }) {
+  const filePath = path.join(io.spoolDir, spoolFileName(reportId, io.now));
+  writeJsonAtomically(filePath, {
+    schema: "impel.cli-bug-report.v1",
+    reportId,
+    createdAt: new Date(io.now).toISOString(),
+    appUrl,
+    report: envelope,
+  });
+  try {
+    fs.chmodSync(filePath, 0o600);
+  } catch {
+    // Windows inherits ACLs and has no POSIX mode to set.
+  }
+  // After the rename, never before: the report just written is the one thing
+  // this function exists to keep, and a prune that ran first could fail in a way
+  // that cost it. Pruning last means the worst case is a spool one file over.
+  pruneSpool(io.spoolDir, { now: io.now });
+  return filePath;
+}
+
+/* -------------------------------------------------------------------------- */
+/* Delivery                                                                   */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * Validate a response into the two shapes a caller can print, or null.
+ *
+ * `recorded: true` with an unusable body is a failure rather than a shrug: the
+ * user is owed a task id or a named reason, and "probably fine" is the one
+ * answer a bug report must never give.
+ */
+export function normalizeReportResponse(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;
+  if (payload.recorded !== true || typeof payload.taskCreated !== "boolean") return null;
+  if (payload.taskCreated) {
+    return typeof payload.taskId === "string" && TASK_ID_RE.test(payload.taskId)
+      ? { taskCreated: true, taskId: payload.taskId }
+      : null;
+  }
+  const reason = typeof payload.reason === "string" && BUG_REPORT_REASONS.has(payload.reason)
+    ? payload.reason
+    : null;
+  return { taskCreated: false, reason };
+}
+
+export function retryAfterNote(response) {
+  const header = response?.headers?.["retry-after"];
+  const value = Array.isArray(header) ? header[0] : header;
+  if (typeof value !== "string" || !RETRY_AFTER_RE.test(value.trim())) {
+    return "try again in a few minutes";
+  }
+  const seconds = Number(value.trim());
+  const minutes = Math.ceil(seconds / 60);
+  return seconds < 60
+    ? `try again in ${seconds} second${seconds === 1 ? "" : "s"}`
+    : `try again in ${minutes} minute${minutes === 1 ? "" : "s"}`;
+}
+
+async function jsonBody(response) {
+  try {
+    const text = await response.text();
+    return text ? JSON.parse(text) : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * One delivery attempt.
+ *
+ * Returns the accepted outcome, or a `failure` sentence written here. Like the
+ * feature-flag fetch, server-supplied text is never echoed — only status codes
+ * and our own sentences — so nothing carried back needs redacting.
+ *
+ * `retryable` says whether trying again could plausibly change the answer, and
+ * it is deliberately true on one branch only. A timeout or a refused connection
+ * is a network having a bad moment. Everything else is the server having
+ * answered: a 404 means this deployment has no report route and the remedy is a
+ * deployment, a 429 already carries the server's own idea of when to come back,
+ * and a body this CLI cannot read will be equally unreadable in 500 ms.
+ * Retrying those spends the user's time to arrive at the same place.
+ */
+export async function deliver({ envelope, appUrl, currentPat, io }) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), io.timeoutMs);
+  let response;
+  try {
+    response = await io.fetchImpl(new URL(REPORT_ENDPOINT_PATH, appUrl), {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${currentPat}`,
+        "content-type": "application/json",
+      },
+      body: JSON.stringify(envelope),
+      signal: controller.signal,
+    });
+  } catch (error) {
+    const detail = error?.name === "AbortError" ? "the request timed out" : "the connection failed";
+    return {
+      failure: `could not reach ${appUrl} to send the report; ${detail}.`,
+      retryable: true,
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+
+  if (!response.ok) {
+    if (response.status === 404) {
+      // R16: a `next` deployment that predates the route. Named separately from
+      // every other failure because the remedy is a deployment, not a retry.
+      return {
+        failure: `${appUrl} does not accept bug reports yet; update the ${RUNTIME_BRAND.product.displayName} control plane and try again.`,
+        retryable: false,
+      };
+    }
+    if (response.status === 429) {
+      return {
+        failure: `${appUrl} is rate limiting bug reports; ${retryAfterNote(response)}.`,
+        retryable: false,
+      };
+    }
+    return { failure: `${appUrl} refused the report (HTTP ${response.status}).`, retryable: false };
+  }
+
+  const outcome = normalizeReportResponse(await jsonBody(response));
+  if (!outcome) {
+    return {
+      failure: `${appUrl} returned a response this CLI cannot read; update the CLI and try again.`,
+      retryable: false,
+    };
+  }
+  return { outcome };
+}
+
+/** Attempt delays, in order. Three attempts worst case; see `deliverWithRetry`. */
+export const DEFAULT_BACKOFF_MS = Object.freeze([500, 1_500]);
+
+/**
+ * The default `io.sleep`. Both senders inject their own in tests, so the real
+ * one lives beside the retry loop that is its only caller rather than being
+ * spelled out again in each `io` bag.
+ */
+export function sleep(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+/**
+ * Deliver, retrying only what retrying can fix.
+ *
+ * Stops on an accepted outcome, on a non-retryable failure, or when attempts
+ * run out — and returns the *last* failure, because that is the one describing
+ * the state the caller is now in. `io.sleep` is injectable so tests do not wait
+ * out the backoff.
+ */
+export async function deliverWithRetry({
+  envelope,
+  appUrl,
+  currentPat,
+  io,
+  attempts = 3,
+  backoffMs = DEFAULT_BACKOFF_MS,
+}) {
+  let last = { failure: "the report was never attempted.", retryable: false };
+  for (let attempt = 0; attempt < Math.max(1, attempts); attempt += 1) {
+    last = await deliver({ envelope, appUrl, currentPat, io });
+    if (last.outcome || !last.retryable) return last;
+    if (attempt === Math.max(1, attempts) - 1) return last;
+    const delay = backoffMs[Math.min(attempt, backoffMs.length - 1)];
+    if (delay > 0) await io.sleep(delay);
+  }
+  return last;
+}

package/src/cli.js

@@ -14,6 +14,7 @@ import { cmdSkills } from "./commands/skills.js";
 import { cmdAgents } from "./commands/agents.js";
 import { cmdTenant } from "./commands/tenant.js";
 import { cmdDoctor } from "./commands/doctor.js";
+import { cmdReport } from "./commands/report.js";
 import { cmdSetup } from "./commands/setup.js";
 import { cmdSessions } from "./commands/sessions.js";
 import { cmdUpdate } from "./commands/update.js";
@@ -24,6 +25,13 @@ import { cmdRemote } from "./commands/remote.js";
 import { cmdNative } from "./commands/native.js";
 import { ensureMacDeveloperTools } from "./macDeveloperTools.js";
 import { refuseElevatedMacExecution } from "./privileges.js";
+import {
+  captureCommandRun,
+  cmdTelemetry,
+  maybeSpawnTelemetryFlush,
+  TELEMETRY_FLUSH_COMMAND,
+} from "./posthog.js";
+import { maybePrintTelemetryNotice } from "./telemetryNotice.js";
 
 const HELP = `impel — isolated Impel workspaces for every tenant
 
@@ -58,6 +66,7 @@ Account:
 Diagnostics:
   impel status                                Authentication, current tenant, and local readiness
   impel doctor [--tenant <org>|--all-tenants] Synthetic provider, routing, and latency checks
+  impel report --message "<text>"             Send a bug report; you approve the exact payload
 
 Reset:
   impel nuke [--yes]                          Erase ALL Impel-managed local state (apps, profiles,
@@ -69,6 +78,8 @@ Reset:
 Env:
   IMPEL_SKIP_UPDATE_CHECK=1   Silence launch-time update notices.
   IMPEL_DISABLE_INSTALL_RECOVERY=1   Disable local and hosted install recovery.
+  IMPEL_DISABLE_TELEMETRY=1   Never send usage analytics (DO_NOT_TRACK=1 and any CI value also apply).
+                              Analytics are off until you opt in; see the README privacy section.
 
 Config file:
   ~/.config/impel/config.json (mode 0600)
@@ -90,11 +101,15 @@ function normalizeTarget(token) {
   return null;
 }
 
-export async function main(argv) {
-  if (refuseElevatedMacExecution(argv)) return;
-  if (!ensureMacDeveloperTools(argv)) return;
-  const [cmd, ...rest] = argv;
-
+/**
+ * Run one command.
+ *
+ * Split out of `main` so there is a single place a command's completion can be
+ * observed. Every `case` below returns directly, so code placed after the
+ * switch runs only on the unknown-command path — a `finally` around the call
+ * is the only construct that sees every exit, including the throwing ones.
+ */
+async function dispatch(cmd, rest) {
   switch (cmd) {
     case undefined:
     case "help":
@@ -141,6 +156,9 @@ export async function main(argv) {
     case "doctor":
       return cmdDoctor(rest);
 
+    case "report":
+      return cmdReport(rest);
+
     case "tasks":
     case "task":
     case "tickets":
@@ -205,6 +223,10 @@ export async function main(argv) {
       return cmdApps(["open", target, ...args]);
     }
 
+    // Hidden detached telemetry sender, spawned by `main`'s finally below.
+    case TELEMETRY_FLUSH_COMMAND:
+      return cmdTelemetry(rest);
+
     // Intentionally omitted from the public help while the contract is gated
     // server-side and limited to Impel-managed desktop apps.
     case "experimental":
@@ -217,6 +239,40 @@ export async function main(argv) {
   }
 }
 
+export async function main(argv) {
+  if (refuseElevatedMacExecution(argv)) return;
+  if (!ensureMacDeveloperTools(argv)) return;
+  const [cmd, ...rest] = argv;
+
+  // Before the command, not after: an install that predates the consent prompt
+  // should hear what this CLI can now do before it does anything, and a notice
+  // printed after `impel claude` hands the terminal to Claude Code would scroll
+  // past unread. Self-suppressing and never throwing.
+  maybePrintTelemetryNotice({ argv });
+
+  const startedAt = Date.now();
+  let threw = false;
+  try {
+    return await dispatch(cmd, rest);
+  } catch (error) {
+    threw = true;
+    throw error;
+  } finally {
+    // Observational only. `captureEvent` and `maybeSpawnTelemetryFlush` both
+    // swallow their own failures, and the extra guard here states the contract
+    // at the seam: whatever happens on this line, the command's outcome and
+    // exit code are already decided and must survive unchanged. A `finally`
+    // that threw would replace a real error with a telemetry one.
+    try {
+      captureCommandRun({ command: cmd, durationMs: Date.now() - startedAt, threw });
+      maybeSpawnTelemetryFlush(cmd);
+    } catch {
+      // Unreachable by design; kept so a future edit inside either call cannot
+      // turn a metric into a failed command.
+    }
+  }
+}
+
 function runUse(mode, targetToken) {
   const target = normalizeTarget(targetToken);
   if (target === null) {

package/src/codexSecurity.js

@@ -148,24 +148,6 @@ export function hardenManagedCodexToml(toml, configPath = "managed Codex config"
   return applyManagedCodexSandboxPolicy(withoutCredentialSnapshots, configPath);
 }
 
-/**
- * Enable the standard MCP Apps renderer only in the exact pinned desktop
- * profile. CLI profiles deliberately stay headless, and vendor-pin contract
- * tests must prove that the embedded Codex binary still recognizes this flag.
- */
-export function enableManagedCodexDesktopMcpApps(
-  toml,
-  configPath = "managed Codex desktop config",
-) {
-  return upsertManagedScalar(
-    toml,
-    "features",
-    "enable_mcp_apps",
-    "true",
-    configPath,
-  );
-}
-
 /**
  * Enable the Code Mode execution host in the exact pinned desktop profile.
  * Pinned Codex fails closed when a code_mode_only model is selected while