impel-cli 0.20.45 → 0.20.46-beta.2

package/src/commands/setup.js

@@ -11,7 +11,7 @@ import {
   redactSecretText,
 } from "../config.js";
 import { promptSecret, promptText } from "../prompt.js";
-import { fetchTenants, normalizeTenantId, tenantCredential } from "../tenants.js";
+import { applyCliUser, fetchTenants, normalizeTenantId, tenantCredential } from "../tenants.js";
 import {
   printReconciliationSummary,
   reconcileAllTenants,
@@ -19,9 +19,11 @@ import {
 } from "../provisioning.js";
 import { describeCliFailure, preparePlatformClis } from "../platformSetup.js";
 import { runInstallRecovery } from "../installRecovery/engine.js";
+import { reportInstallFailure } from "../autoReport.js";
 import { refreshUpdateCache, updateNoticeLine } from "../updates.js";
 import { restoreNativeProfiles } from "./use.js";
 import { brandedEnvironmentName, brandedText, RUNTIME_BRAND } from "../runtimeBrand.js";
+import { markTelemetryNoticeShown } from "../telemetryNotice.js";
 import {
   cacheProviderReadiness,
   probeGatewayProviderReadiness,
@@ -44,6 +46,11 @@ Usage:
   impel setup --skip-apps           Skip desktop apps
   impel setup --skip-clis           Do not install missing vendor CLIs
   impel setup --no-recovery         Disable automatic install recovery
+  impel setup --analytics on|off    Turn anonymous usage analytics on or off
+
+Analytics are off unless you turn them on. Separately, when setup or update
+fails, Impel files a bug report so the failure can be fixed; see \`impel report
+--help\`.
 `);
 
 /** Kept as a pure compatibility helper for callers/tests. */
@@ -119,10 +126,66 @@ function recomputeReport(report) {
   return report;
 }
 
+/**
+ * The message for an automatic report about a tenant-convergence failure.
+ *
+ * Every failed tenant contributes, because a setup that fails two tenants for
+ * two different reasons and reports only the first has reported the wrong
+ * thing. The tenant id prefixes each error since the ids are otherwise absent
+ * from the joined string. `sanitizeInstallFailureEnvelope` bounds the result.
+ */
+function failedTenantMessage(report) {
+  const failed = report.tenants.filter((tenant) => tenant.status === "failed");
+  const described = failed
+    .map((tenant) => `${tenant.tenantId}: ${tenant.errors.join("; ")}`)
+    .filter((line) => !line.endsWith(": "));
+  return described.join(" | ") || "Tenant readiness verification failed.";
+}
+
 function confirmed(answer) {
   return /^(?:y|yes)$/iu.test(String(answer || "").trim());
 }
 
+/**
+ * Record the analytics preference `--analytics` names, and normalize the key.
+ *
+ * Setup no longer asks. A question with a default answer is not much of a
+ * question, and the one thing `impel setup` must do — get a broken machine
+ * working — is not the moment to interrupt with an unrelated one. Analytics
+ * stay opt-in and stay switchable: `--analytics on` turns them on, and
+ * `--analytics off` (or nothing at all) leaves them off.
+ *
+ * Every path that is not an explicit `on` removes the key rather than storing
+ * `false`, which keeps one meaning for "absent" across the whole codebase —
+ * `analyticsConsentGranted` tests for exactly `true`.
+ *
+ * A branded extension runs its own product and must not inherit Impel's
+ * phone-home (KTD11), so `--analytics on` is a no-op there.
+ */
+function applyAnalyticsPreference(config, io, preference) {
+  if (RUNTIME_BRAND.cli.packageName !== "impel-cli") return;
+  if (preference === "on") {
+    config.telemetry = { ...(config.telemetry || {}), enabled: true };
+    io.saveConfig(config);
+    console.log("✓ Analytics on. Turn them off any time with `impel setup --analytics off`.");
+    io.markTelemetryNoticeShown();
+    return;
+  }
+
+  // Only an explicit `off` revokes a stored yes. A plain `impel setup` — which
+  // is also the repair command — must not silently undo a decision on file.
+  if (preference === "off" || config.telemetry?.enabled !== true) {
+    if (config.telemetry) {
+      delete config.telemetry.enabled;
+      if (Object.keys(config.telemetry).length === 0) delete config.telemetry;
+      io.saveConfig(config);
+    }
+  }
+  // Written on every path, including the ones that print nothing: having run
+  // setup at all is what the first-run notice exists to announce.
+  io.markTelemetryNoticeShown();
+}
+
 export async function cmdSetup(argv, overrides = {}) {
   const io = {
     loadConfig,
@@ -134,12 +197,14 @@ export async function cmdSetup(argv, overrides = {}) {
     reconcile: reconcileAllTenants,
     probe: probeGateway,
     recoverInstall: runInstallRecovery,
+    reportInstallFailure,
     restoreNativeProfiles,
     isTTY: process.stdin.isTTY,
     platform: process.platform,
     environment: process.env,
     refreshUpdateCache,
     updateNoticeLine,
+    markTelemetryNoticeShown,
     ...overrides,
   };
   if (overrides.prepareWindowsClis && !overrides.preparePlatformClis) {
@@ -154,6 +219,7 @@ export async function cmdSetup(argv, overrides = {}) {
     "skip-clis": { type: "boolean" },
     repair: { type: "boolean" }, // deprecated compatibility no-op
     "no-recovery": { type: "boolean" },
+    analytics: { type: "string" },
     help: { type: "boolean" },
   });
   if (flags.help) {
@@ -165,6 +231,15 @@ export async function cmdSetup(argv, overrides = {}) {
     process.exitCode = 1;
     return;
   }
+  // Rejected before the token prompt and any network call: a typo in a flag
+  // about analytics must not cost the user a setup run to discover.
+  // `in`, not `!== undefined`: a trailing bare `--analytics` parses to
+  // `undefined`, and silently ignoring it would look like it took effect.
+  if ("analytics" in flags && !["on", "off"].includes(flags.analytics)) {
+    console.error(`impel setup: --analytics accepts "on" or "off", not "${redactSecretText(flags.analytics)}".`);
+    process.exitCode = 1;
+    return;
+  }
 
   const existing = io.loadConfig();
   const gatewayUrl = normalizeGatewayUrl(flags.gateway || existing?.gatewayUrl || resolveDefaultGateway());
@@ -203,6 +278,7 @@ export async function cmdSetup(argv, overrides = {}) {
   config.tenantName = selected.name;
   if (listing.productAccess) config.productAccess = listing.productAccess;
   if (listing.scopes) config.scopes = listing.scopes;
+  applyCliUser(config, listing);
   config.tenantsUpdatedAt = new Date().toISOString();
   io.saveConfig(config);
 
@@ -212,6 +288,11 @@ export async function cmdSetup(argv, overrides = {}) {
     console.log(`  ${tenant.id}${tenant.id === selected.id ? " (CLI default)" : ""} — ${tenant.name}`);
   }
 
+  // After the credential is stored and the tenant chosen, so the preference is
+  // written into a config that already exists, and before convergence starts
+  // printing per-tenant progress the confirmation would be buried in.
+  applyAnalyticsPreference(config, io, flags.analytics);
+
   // Setup is where a stale CLI hurts most (it re-hits installer bugs newer
   // releases already fixed), and on a first run the launch-time notice cache
   // is still empty — so check synchronously here. The token was just verified
@@ -503,6 +584,58 @@ export async function cmdSetup(argv, overrides = {}) {
     if (sharedFailure) console.error(`Shared setup failure: ${sharedFailure}`);
     const setupCommand = io.platform === "win32" ? "impel.cmd setup" : "impel setup";
     console.error(`Setup is incomplete. Fix the reported issue or rerun \`${setupCommand}\`.`);
+    const failedTenantIds = report.tenants
+      .filter((tenant) => tenant.status === "failed")
+      .map((tenant) => tenant.tenantId);
+    // The one dispatch point for this command (R1). It sits here rather than
+    // in either recovery block above because a failure recovery repaired is
+    // not a failure (KTD2) — this branch is reached only by a setup that ran
+    // out of ways to fix itself. One report per run, whatever the tenant count.
+    //
+    // After the two `console.error`s so the actionable "rerun `impel setup`"
+    // stays the last thing a reader scrolls back to, and before
+    // `process.exitCode` because the report must not depend on the exit path.
+    //
+    // `reportInstallFailure` swallows its own errors, but it is an injection
+    // seam: this `catch` is the promise that whatever is behind it, a setup
+    // that failed with a clear message never becomes a setup that crashed.
+    try {
+      await io.reportInstallFailure({
+        failure: sharedFailure
+          ? {
+            scope: "shared",
+            platform: io.platform,
+            architecture: process.arch,
+            step: "setup.shared_vendor_clis",
+            message: sharedFailure,
+            diagnostics: { tenantId: selected.id },
+          }
+          : {
+            // Attribute the report to a tenant that actually failed, not to
+            // the CLI default: `selected.id` is whichever tenant this machine
+            // points at, which may well have converged fine. With more than one
+            // failure there is no single owner, so the report is `shared` and
+            // the ids ride along in diagnostics — the message already names
+            // every one of them.
+            ...(failedTenantIds.length === 1
+              ? { scope: "tenant", tenantId: failedTenantIds[0] }
+              : { scope: "shared" }),
+            platform: io.platform,
+            architecture: process.arch,
+            step: "setup.tenant_convergence",
+            message: failedTenantMessage(report),
+            diagnostics: {
+              cliTenantId: selected.id,
+              failedTenantIds: failedTenantIds.join(","),
+              failedTenants: String(failedTenantIds.length),
+            },
+          },
+        config,
+        io,
+      });
+    } catch {
+      // R10: one error message, and it is the one above.
+    }
     process.exitCode = 1;
     return report;
   }

package/src/commands/status.js

@@ -10,10 +10,12 @@ import { findReviewedVendorCliBinary } from "../vendorCliBinaries.js";
 import { windowsTenantShortcutName } from "../shellEntries.js";
 import {
   ensureTenantSelection,
+  normalizeCliUser,
   PAT_SCOPE_CLAUDE,
   PAT_SCOPE_CODEX,
   productAccessLabel,
 } from "../tenants.js";
+import { telemetryNoticeLine } from "../posthog.js";
 import { installedVersion, maybePrintUpdateNotice } from "../updates.js";
 import { findManagedWindowsChatGPTApp, windowsClaudeUserData } from "../windowsApps.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
@@ -85,6 +87,24 @@ function cliState({ supported, available = true, profileReady, binaryReady }) {
   return profileReady && binaryReady ? "ready" : "missing";
 }
 
+/**
+ * Everything `impel status` prints on its way out, from every exit.
+ *
+ * There are three: no PAT, an authentication check that did not come back, and
+ * the full report. The first two are precisely the states a broken install is
+ * in — a notice wired only to the tail would be invisible exactly when someone
+ * runs `status` to find out what is wrong.
+ *
+ * `doctor` deliberately does not carry this. It runs synthetic, billable
+ * end-to-end gateway checks; a local drop notice should not cost a request.
+ */
+function printLocalNotices(io) {
+  if (RUNTIME_BRAND.cli.packageName !== "impel-cli") return;
+  const telemetry = io.telemetryNoticeLine();
+  if (telemetry) console.log(telemetry);
+  io.maybePrintUpdateNotice();
+}
+
 export async function cmdStatus(overrides = {}) {
   const io = {
     loadConfig,
@@ -94,6 +114,7 @@ export async function cmdStatus(overrides = {}) {
     installedVersion,
     findNativeBinary: findReviewedVendorCliBinary,
     maybePrintUpdateNotice,
+    telemetryNoticeLine,
     platform: process.platform,
     environment: process.env,
     ...overrides,
@@ -102,8 +123,12 @@ export async function cmdStatus(overrides = {}) {
   const version = process.env.IMPEL_CLI_EXTENSION_VERSION || io.installedVersion() || "?";
   console.log(`${RUNTIME_BRAND.cli.command}-cli: v${version}`);
   console.log(`Authentication: ${config?.pat ? `configured (${maskSecret(config.pat)})` : "not configured - run `impel setup`"}`);
+  // Read back through the same normalizer that wrote it: config.json is a file
+  // on disk, so what it holds is untrusted input by the time it is printed.
+  const user = normalizeCliUser(config?.user, { allowMissing: true });
+  if (user) console.log(`Signed in as: ${user.displayName || user.id}`);
   if (!config?.pat) {
-    if (RUNTIME_BRAND.cli.packageName === "impel-cli") io.maybePrintUpdateNotice();
+    printLocalNotices(io);
     return;
   }
 
@@ -117,7 +142,7 @@ export async function cmdStatus(overrides = {}) {
     console.log(RUNTIME_BRAND.tenant.defaultId
       ? `Run \`${RUNTIME_BRAND.cli.command} setup\` to refresh authentication and repair the local tenant.`
       : "Run `impel setup` to refresh authentication, then `impel update` to repair local tenants.");
-    if (RUNTIME_BRAND.cli.packageName === "impel-cli") io.maybePrintUpdateNotice();
+    printLocalNotices(io);
     return;
   }
 
@@ -162,5 +187,5 @@ export async function cmdStatus(overrides = {}) {
       ? `Repair or finish missing tenant surfaces with: ${RUNTIME_BRAND.cli.command} setup`
       : "Repair or finish missing tenant surfaces with: impel update");
   }
-  if (RUNTIME_BRAND.cli.packageName === "impel-cli") io.maybePrintUpdateNotice();
+  printLocalNotices(io);
 }

package/src/commands/update.js

@@ -10,6 +10,7 @@ import { loadConfig, redactSecretText } from "../config.js";
 import { nativeCommandInvocation } from "../nativeProcess.js";
 import { withProgress } from "../progress.js";
 import { runInstallRecovery } from "../installRecovery/engine.js";
+import { reportInstallFailure } from "../autoReport.js";
 import { brandedEnvironmentName, brandedText, RUNTIME_BRAND } from "../runtimeBrand.js";
 import { IMPEL_CLI_ENTRYPOINT } from "../selfInvocation.js";
 import {
@@ -252,6 +253,7 @@ export async function cmdUpdate(argv, overrides = {}) {
     environment: process.env,
     progress: withProgress,
     recoverInstall: runInstallRecovery,
+    reportInstallFailure,
     postInstallVersion: postInstallCliVersion,
     postInstallRunnable: postInstallCliRunnable,
     resolveFreshInstall: resolveFreshGlobalEntrypoint,
@@ -315,6 +317,36 @@ export async function cmdUpdate(argv, overrides = {}) {
     return;
   }
 
+  // Read at most once, and only when something actually needs it. All three
+  // terminal failures do, which is why this is not still buried in the npm
+  // branch — but an `impel update` that succeeds must not pay a config read it
+  // has no use for, and this whole feature is supposed to cost the success
+  // path nothing.
+  let configLoaded = false;
+  let configValue;
+  const currentConfig = () => {
+    if (!configLoaded) {
+      configValue = io.loadConfig();
+      configLoaded = true;
+    }
+    return configValue;
+  };
+
+  /**
+   * File one automatic report for a terminal `impel update` failure.
+   *
+   * Each caller has already printed the message the user needs to act on, so
+   * this must not add a second one: `reportInstallFailure` swallows its own
+   * errors and the `catch` covers whatever an injected reporter does (R10).
+   */
+  const reportUpdateFailure = async (failure) => {
+    try {
+      await io.reportInstallFailure({ failure, config: currentConfig(), io });
+    } catch {
+      // R10: one error message, and it is the one the caller already printed.
+    }
+  };
+
   // ── CLI ────────────────────────────────────────────────────────────────
   let cascadeEntrypoint = null;
   if (!remote) {
@@ -340,8 +372,8 @@ export async function cmdUpdate(argv, overrides = {}) {
         console.error("  Verify `npm --version` in PowerShell, then retry `impel update`.");
         console.error(`  Manual recovery: \`npm install --global ${installSpec}\`.`);
       }
-      const config = io.loadConfig();
       let recovered = false;
+      const config = currentConfig();
       if (config?.pat && config?.tenantId) {
         // The goal passes on the most recent reviewed retry of the npm
         // install OR on a live disk probe of the package that owns the
@@ -399,6 +431,19 @@ export async function cmdUpdate(argv, overrides = {}) {
         }
       }
       if (!recovered) {
+        // Past recovery, so this is a failure that ran out of fixes (KTD2).
+        await reportUpdateFailure({
+          scope: "shared",
+          platform: io.platform,
+          architecture: process.arch,
+          step: "install.impel_cli",
+          command: `npm install --global ${installSpec}`,
+          message: `The npm-verified global ${RUNTIME_BRAND.cli.packageName} update failed.`,
+          diagnostics: {
+            installedVersion: String(current ?? "unknown"),
+            remoteVersion: String(remote ?? "unknown"),
+          },
+        });
         process.exitCode = 1;
         return;
       }
@@ -426,6 +471,22 @@ export async function cmdUpdate(argv, overrides = {}) {
         console.error(`  Running CLI: ${CLI_BIN}`);
         console.error("  This usually means the `impel` on PATH belongs to a different npm prefix than `npm prefix -g`.");
         console.error(`  Fix: run \`npm prefix -g\`, confirm it owns the \`impel\` shim on PATH, then \`npm install --global ${installSpec}\` there.`);
+        // Its own step, not `install.impel_cli`: npm succeeded and the update
+        // landed somewhere real. The reportable fact is the prefix skew, and
+        // the two versions below are what makes a report of it actionable.
+        await reportUpdateFailure({
+          scope: "shared",
+          platform: io.platform,
+          architecture: process.arch,
+          step: "install.impel_cli_prefix_skew",
+          command: `npm install --global ${installSpec}`,
+          message: `npm reported success but the running CLI still resolves v${postInstall ?? "?"} (expected v${remote}), and the freshly installed build could not be located.`,
+          diagnostics: {
+            runningVersion: String(postInstall ?? "unknown"),
+            expectedVersion: String(remote),
+            cliBin: CLI_BIN,
+          },
+        });
         process.exitCode = 1;
         return;
       }
@@ -449,6 +510,26 @@ export async function cmdUpdate(argv, overrides = {}) {
   };
   if (!await io.runConvergence(convergenceArgs)) {
     console.error("impel update: tenant convergence failed; rerun `impel update` after addressing the reported issue.");
+    // The child is `impel _converge`, which files no report of its own — and
+    // this parent only sees its exit status, because the child inherits stdio
+    // so its progress reaches the terminal live. So this report carries what
+    // the parent does know: that it was an update cascade, and which flags
+    // shaped the run it failed under. Which tenants failed is visible on the
+    // user's screen but not in the report; closing that gap needs a channel
+    // between the two processes, which R2 (one report per invocation) says must
+    // not simply be a second report from the child.
+    await reportUpdateFailure({
+      scope: "shared",
+      platform: io.platform,
+      architecture: process.arch,
+      step: "update.tenant_convergence",
+      message: "Tenant convergence failed during `impel update`.",
+      diagnostics: {
+        skipApps: String(Boolean(flags["skip-apps"])),
+        skipClis: String(Boolean(flags["skip-clis"])),
+        cascadedEntrypoint: String(Boolean(cascadeEntrypoint)),
+      },
+    });
     process.exitCode = 1;
     return;
   }

package/src/cursorLocal.js

@@ -1473,6 +1473,14 @@ export function cursorLaunchSpec({
   }
   const env = { ...environment };
   for (const key of [...DIRECT_PROVIDER_ENV_KEYS, ...RUNTIME_OVERRIDE_ENV_KEYS]) delete env[key];
+  // The positive managed marker `telemetryConsent.js` denies on. It has to be
+  // stamped here rather than inferred: the delete loop above removes
+  // CLAUDE_CONFIG_DIR and CODEX_HOME, and `HOME` below points at the managed
+  // profile, so every path the guard could otherwise key on either disappears
+  // or stops looking managed. Without it a terminal inside managed Cursor —
+  // holding CURSOR_LOCAL_AGENT_API_KEY — would capture and flush telemetry to a
+  // host other than the gateway, which is the P1-8 egress boundary.
+  env[brandedEnvironmentName("MANAGED_CURSOR")] = "1";
   env.HOME = paths.home;
   env.XDG_CACHE_HOME = path.join(paths.home, ".cache");
   env.XDG_CONFIG_HOME = path.join(paths.home, ".config");