prreviewbuddy 0.29.1 → 0.30.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.30.0
+
+**Usage telemetry is now on by default.** Non-identifying usage telemetry is now enabled by default
+on installations that have not previously made a choice. Existing opt-outs remain respected: if you
+answered no when PR Review Buddy asked, nothing is sent, and nothing about your machine changes.
+The first-run question is gone, replaced by a one-time notice in the terminal that says what is
+sent and how to stop it. That notice is shown only to installations the new default actually
+changes, so a machine that already answered sees nothing.
+
+Nothing new is collected. The same two events carry the same eight fields they did before: review
+start and finish, a random installation ID, the version, the platform, the agent, whether the
+analysis succeeded and how long it took. Never your code, diffs, file paths, repository names,
+prompts or review content. Rows are still deleted after 90 days.
+
+`prreviewbuddy config set telemetry-upload off` turns it off, as does the Privacy section of the
+workspace Settings page, and `PRB_TELEMETRY=off` still stops the local log as well. The reasoning
+for the change, and what it replaced, is written out at https://prreviewbuddy.com/privacy.
+
+**Copy says "non-identifying" rather than "anonymous".** The events carry a random installation ID
+that persists, and a stable identifier makes data pseudonymous however little else is attached to
+it. The word changed; what is sent did not.
+
 ## 0.29.1
 
 **Icons in the review sidebar.** Every item in a review's sidebar now has an icon: Review, KISS,

package/README.md

@@ -44,10 +44,11 @@ an assistant that has read the diff. The job is durable, so closing the terminal
 Your code goes to the coding agent you chose, exactly as it would if you had run that agent
 yourself. It does not pass through us, and no server of ours is in the path of a review.
 
-PR Review Buddy asks once, on first run, whether it may send anonymous usage counts: two event
-names, a random ID generated on your machine, the version, the platform, the agent and a duration.
-Never your code, diffs, file paths, repository names, prompts or review content, and never anything
-at all unless you said yes. [The full field table is published](https://prreviewbuddy.com/privacy).
+PR Review Buddy sends non-identifying usage telemetry, on by default and off with one command: two
+event names, a random ID generated on your machine, the version, the platform, the agent and a
+duration. Never your code, diffs, file paths, repository names, prompts or review content.
+`prreviewbuddy config set telemetry-upload off` stops it.
+[The full field table is published](https://prreviewbuddy.com/privacy).
 
 More at [prreviewbuddy.com](https://prreviewbuddy.com).
 
@@ -80,7 +81,7 @@ prreviewbuddy open <review>             open one review
 prreviewbuddy agents                    which coding agents you have
 prreviewbuddy config set agent <agent>  remember which to use when you do not name one
 prreviewbuddy config set telemetry-upload on|off
-                                        send anonymous usage counts, or stop
+                                        send usage telemetry, or stop. On by default
 
 prreviewbuddy uninstall                 remove everything this put on your machine
 ```
@@ -167,10 +168,10 @@ ID** and **Delete review**, and the menu on a card deletes every review of that
 </details>
 
 <details>
-<summary><b>Anonymous usage counts</b> — what is sent, and how to stop it</summary>
+<summary><b>Usage telemetry</b> — what is sent, and how to stop it</summary>
 
-Two events reach a server we run, and only if you answered yes when asked on first run:
-`review_started` and `review_finished`. Between them they carry a random UUID generated on your
+Two events reach a server we run, on by default since 0.30.0: `review_started` and
+`review_finished`. Between them they carry a random UUID generated on your
 machine, the CLI version, the platform, which agent ran the analysis, a timestamp, whether it
 succeeded and how long it took. That is the whole list, and the server refuses any field that is
 not on it rather than accepting the request and dropping what it does not recognise.

package/dist/{delete_review-DUCSC5Bc.js → delete_review-B_2J2Wn9.js}

@@ -9298,26 +9298,32 @@ async function withUsageRecorded(workspaceId, kind, env, body, runId, requestedM
 */
 var UPLOAD_KEY = "telemetryUpload";
 /**
-* The answer to the first-run question, or `null` if it has not been asked yet.
+* What this machine was told to do about transmission, or `null` if nobody ever said.
 *
-* Three states rather than two, and the third is load-bearing: an install that has never been
-* asked must be asked, and must not be treated as having declined. Collapsing `null` to `false`
-* here would make the question unaskable the moment anything read the setting.
+* Three states rather than two, and the third is load-bearing in both directions: it is what lets
+* `upload.ts` apply a default without overwriting anybody's answer, and what lets the CLI disclose
+* the default to the machines it actually applies to and nobody else.
 */
 function telemetryUploadConsent() {
 	return loadConfig().telemetryUpload;
 }
-/** Whether a subset may go over the wire. Yes only if somebody said yes. */
+/**
+* Whether a subset may go over the wire. Yes unless somebody said no.
+*
+* `!== false` rather than `=== true`, and that is the whole of the 0.30.0 change in one operator.
+* Opt in measured who answers questions rather than who uses this: one or two installations
+* reporting against hundreds of weekly downloads. What is sent did not widen by a field.
+*/
 function telemetryUploadEnabled() {
 	const config = loadConfig();
-	return config.telemetry && config.telemetryUpload === true;
+	return config.telemetry && config.telemetryUpload !== false;
 }
 /**
-* Remember the answer, so the question is asked once on a machine and never again.
+* Remember a decision somebody made, so it outlives any change to the default.
 *
 * Read-modify-write through `config_file.ts`, and refuses outright while `PRB_TELEMETRY=off` is
-* set: the kill switch means nothing is asked, so there is no answer to store, and writing one
-* would record a decision nobody made.
+* set: the kill switch means nothing is being sent and nobody is being asked anything, so there is
+* no answer to store, and writing one would record a decision nobody made.
 */
 function recordTelemetryUploadConsent(answer) {
 	if (process.env.PRB_TELEMETRY === "off") return;
@@ -9366,7 +9372,7 @@ function loadConfig() {
 	} catch {}
 	return config;
 }
-/** Anything that is not exactly `true` or `false` is nobody having answered. */
+/** Anything that is not exactly `true` or `false` is nobody having chosen. */
 function consentOf(value) {
 	return typeof value === "boolean" ? value : null;
 }
@@ -9415,7 +9421,7 @@ function project(record) {
 	} : base;
 }
 /**
-* Send one event, if there is one to send and somebody said it could be.
+* Send one event, if there is one to send and nobody has said not to.
 *
 * Returns nothing and awaits nothing. A failed send is a lost data point, which is a cost we
 * accept; a thrown error here would be a review that did not happen, which is not. The same

package/dist/main.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $t as writeAgentPreference, A as removeWorktree, B as workspaceUrl, C as recordTelemetryUploadConsent, Dt as saveWorkspace, Et as reviewedRepositories, G as DEFAULT_WORKSPACE_PORT, H as BUILD_VERSION, I as ensureServer, J as parseWorkspacePort, Jt as git, K as MAX_WORKSPACE_PORT, Kt as resolveTarget, M as relativeTime, N as readIndexToken, O as MANAGED_ROOT, Ot as summarise, P as bootstrapUrl, Q as forgeResolver, Qt as readAgentPreference, R as reviewsUrl, S as record, St as positionInLineage, U as PACKAGE_NAME, X as statedWorkspacePort, Xt as resolveModel, Yt as resolveAgent, Z as writePortPreference, a as wasBlocked, at as isTerminal, b as startJob, bt as loadWorkspace, c as updateReview, ct as PHASES, dt as purposeOf, en as CONFIG_PATH, f as UpdateAlreadyRunningError, ft as clearClaim, g as recordKissRun, ht as groupByLineage, i as liveJobsFor, in as agentById, j as modelHelpLines, k as readMarker, m as runningJobs, mt as followedRefName, n as deleteReview$1, nn as AGENT_IDS, nt as allJobs, on as detectAgents, ot as loadJob, p as liveUpdateFor, pt as isClaimed, q as MIN_WORKSPACE_PORT, qt as displayRef, rn as DEFAULT_AGENT_ID, tn as STORE_ROOT, tt as checkFreshness, ut as progressSteps, v as reanalyseReview, vt as lineageKeyFor, w as telemetryUploadConsent, wt as recentWorkspaces, xt as matchingWorkspaceIds, y as runJob, z as stopServer } from "./delete_review-DUCSC5Bc.js";
+import { $t as writeAgentPreference, A as removeWorktree, B as workspaceUrl, C as recordTelemetryUploadConsent, Dt as saveWorkspace, Et as reviewedRepositories, G as DEFAULT_WORKSPACE_PORT, H as BUILD_VERSION, I as ensureServer, J as parseWorkspacePort, Jt as git, K as MAX_WORKSPACE_PORT, Kt as resolveTarget, M as relativeTime, N as readIndexToken, O as MANAGED_ROOT, Ot as summarise, P as bootstrapUrl, Q as forgeResolver, Qt as readAgentPreference, R as reviewsUrl, S as record$1, St as positionInLineage, U as PACKAGE_NAME, X as statedWorkspacePort, Xt as resolveModel, Yt as resolveAgent, Z as writePortPreference, a as wasBlocked, at as isTerminal, b as startJob, bt as loadWorkspace, c as updateReview, ct as PHASES, dt as purposeOf, en as CONFIG_PATH, f as UpdateAlreadyRunningError, ft as clearClaim, g as recordKissRun, ht as groupByLineage, i as liveJobsFor, in as agentById, j as modelHelpLines, k as readMarker, m as runningJobs, mt as followedRefName, n as deleteReview$1, nn as AGENT_IDS, nt as allJobs, on as detectAgents, ot as loadJob, p as liveUpdateFor, pt as isClaimed, q as MIN_WORKSPACE_PORT, qt as displayRef, rn as DEFAULT_AGENT_ID, tn as STORE_ROOT, tt as checkFreshness, ut as progressSteps, v as reanalyseReview, vt as lineageKeyFor, w as telemetryUploadConsent, wt as recentWorkspaces, xt as matchingWorkspaceIds, y as runJob, z as stopServer } from "./delete_review-B_2J2Wn9.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -987,9 +987,9 @@ your own checkout is never read or written while it works.
   prreviewbuddy config get agent          the coding agent used when you do not name one
   prreviewbuddy config set agent <agent>  remember ${AGENT_NAMES}
   prreviewbuddy config get telemetry-upload
-                                          whether anonymous usage counts are sent
+                                          whether usage telemetry is sent. On by default
   prreviewbuddy config set telemetry-upload on|off
-                                          send them, or stop
+                                          send it, or stop
   prreviewbuddy config get port           the port the workspace runs on
   prreviewbuddy config set port <port>    move it, from the next start onwards
   prreviewbuddy config path               where these settings are kept, to edit by hand
@@ -1119,48 +1119,46 @@ function unknownSetting(key, known) {
 	return `There is no setting called \`${key}\`. This can read and set: ${known.join(", ")}.`;
 }
 /**
-* The first-run question about transmission, in three lines.
+* The one-time disclosure, in four lines.
 *
-* Three because a first run is not the place for a privacy policy, and the policy is one line
-* away. What it names is what a person would otherwise have to assume: the list of things that are
-* never sent is longer than the list of things that are, and printing the longer one is the honest
-* way round.
+* Four because a first run is not the place for a privacy policy, and the policy is one line away.
+* It names both lists, and the one that is never sent is the longer of the two: printing the longer
+* one is the honest way round when the thing being disclosed is on without anybody asking.
+*
+* "Non-identifying" rather than "anonymous", which this copy said until 0.30.0. The payload carries
+* a random installation UUID that persists, and a stable identifier makes data pseudonymous however
+* little else is attached to it. "Anonymous" is a word with a technical meaning strong enough to be
+* challenged on, and the claim below does not need it to be true.
 */
-function telemetryUploadQuestion() {
+function telemetryNotice() {
 	return [
 		"",
-		"Help improve PR Review Buddy by sending anonymous usage counts?",
-		"Never your code, diffs, file paths, repository names, prompts or review content.",
-		"https://prreviewbuddy.com/privacy lists every field, exactly.",
+		"Non-identifying usage telemetry is on by default: review start and finish, version,",
+		"platform, agent, success and duration. Never your code, diffs, repository names or",
+		"review content.",
+		"Turn it off: `prreviewbuddy config set telemetry-upload off`",
+		"Details: https://prreviewbuddy.com/privacy",
 		""
 	].join("\n");
 }
-function telemetryUploadUnclear() {
-	return "Please answer y or n.\n";
-}
-function telemetryUploadGranted() {
-	return "Thank you. Turn it off whenever you like with `prreviewbuddy config set telemetry-upload off`.";
-}
-function telemetryUploadDeclined() {
-	return "Nothing will be sent. Turn it on with `prreviewbuddy config set telemetry-upload on`.";
-}
 /**
-* What `config get telemetry-upload` says, including for the machine that has not been asked.
+* What `config get telemetry-upload` says, including for the machine that never chose.
 *
-* Three answers rather than two, because "off" and "never asked" are different facts and only one
-* of them is a decision somebody made.
+* Three answers rather than two, and the third survives the move to a default because it still
+* names a different fact: "on because that is the default" and "on because you turned it on" are
+* the same behaviour arrived at two ways, and only one of them is a decision somebody made. The
+* same distinction `noAgentPreference` keeps next door.
 */
 function telemetryUploadIs(consent) {
 	if (consent === null) return [
-		"Anonymous usage counts are not being sent, and nobody has been asked yet.",
+		"Non-identifying usage telemetry is on by default, and you have not changed it.",
 		"",
-		"The question is asked the first time you run PR Review Buddy in a terminal.",
-		"Answer it now with `prreviewbuddy config set telemetry-upload on` or `off`."
+		"Turn it off with `prreviewbuddy config set telemetry-upload off`."
 	].join("\n");
-	return consent ? "Anonymous usage counts are being sent. Turn them off with `prreviewbuddy config set telemetry-upload off`." : "Anonymous usage counts are not being sent.";
+	return consent ? "Non-identifying usage telemetry is being sent, because you turned it on. Turn it off with `prreviewbuddy config set telemetry-upload off`." : "Usage telemetry is not being sent, because you turned it off.";
 }
 function telemetryUploadSet(on) {
-	return on ? "Anonymous usage counts will be sent. Never your code, diffs, file paths, repository names, prompts or review content." : "Nothing will be sent. The usage log on this machine is unchanged; `PRB_TELEMETRY=off` turns that off too.";
+	return on ? "Non-identifying usage telemetry will be sent. Never your code, diffs, file paths, repository names, prompts or review content." : "Nothing will be sent. The usage log on this machine is unchanged; `PRB_TELEMETRY=off` turns that off too.";
 }
 /**
 * The workspace port as it stands, and how it is changed.
@@ -2384,7 +2382,7 @@ async function operate(command, workspace) {
 	}
 	workspace.lastUpdate = outcome;
 	saveWorkspace(workspace);
-	record({
+	record$1({
 		event: "review_updated",
 		reviewId: workspace.id,
 		ok: outcome.ok,
@@ -3214,7 +3212,11 @@ async function uninstall(command, deps = REAL) {
 //#endregion
 //#region src/first_run.ts
 /**
-* The two lines somebody needs the first time they run this, and never again.
+* The things somebody is told once on a machine, and never again.
+*
+* Two of them now: the two lines of hello, and the disclosure that usage telemetry is on. They are
+* the same kind of fact and are kept the same way, so they share the marker helper at the bottom
+* rather than each growing their own copy of it.
 *
 * This began as a `postinstall` script, which is the obvious place for it and the wrong one: npm 11
 * does not run install scripts unless they are allow-listed, so the banner would have reached
@@ -3231,84 +3233,78 @@ async function uninstall(command, deps = REAL) {
 * as the telemetry notice next to it. A home directory that cannot be written to costs somebody a
 * repeated banner and never a review, which is why nothing here throws.
 */
-var MARKER = join(STORE_ROOT, "onboarding-shown");
+var GREETING = "onboarding-shown";
+var TELEMETRY_NOTICE = "telemetry-notice-shown";
+/** Whether this machine has been greeted. */
+function greeted() {
+	return shown(GREETING);
+}
+function recordGreeting() {
+	record(GREETING);
+}
 /**
-* Whether this machine has been greeted.
+* Whether this machine has been told that usage telemetry is on.
 *
-* Unreadable reads as greeted. Getting this wrong in one direction repeats a banner, and in the
-* other it prints one over somebody's output every single time, so the failure goes quiet.
+* A second marker rather than a reuse of the greeting: every machine installed before 0.30.0 was
+* greeted long ago and has still never been told about the default, so reading one from the other
+* would silence the disclosure for exactly the population it exists for.
 */
-function greeted() {
+function telemetryNoticed() {
+	return shown(TELEMETRY_NOTICE);
+}
+function recordTelemetryNotice() {
+	record(TELEMETRY_NOTICE);
+}
+/**
+* Unreadable reads as already shown.
+*
+* Failing closed on repetition: the cost of this being wrong is a disclosure or a hello that never
+* arrives on a machine whose home cannot be read, and the cost of the other direction is one of
+* them printed over somebody's output every single time they run a command.
+*/
+function shown(name) {
 	try {
-		return existsSync(MARKER);
+		return existsSync(join(STORE_ROOT, name));
 	} catch {
 		return true;
 	}
 }
-function recordGreeting() {
+function record(name) {
 	try {
 		mkdirSync(STORE_ROOT, { recursive: true });
-		writeFileSync(MARKER, `${(/* @__PURE__ */ new Date()).toISOString()}\n`, { mode: 384 });
+		writeFileSync(join(STORE_ROOT, name), `${(/* @__PURE__ */ new Date()).toISOString()}\n`, { mode: 384 });
 	} catch {}
 }
 //#endregion
-//#region src/telemetry_consent.ts
-/**
-* The one question this product asks about itself, asked once per machine.
-*
-* `packages/review-harness/src/telemetry/` has recorded usage events to a local file since it
-* existed, disclosed and on by default. Sending a subset of them to a server we run is a different
-* act, and `apps/website/src/pages/Privacy.tsx` promised in as many words that if it ever happened
-* it would be opt in and off by default. This is how that promise is kept.
-*
-* Hand-rolled on `node:readline` beside `select.ts` and `confirm.ts`, for the reason they both
-* give: this binary has no runtime dependencies and one question is not worth acquiring one. The io
-* is injected for the same reason theirs is, so what the answer means is testable without a shell.
-*
-* **A bare Return re-asks rather than declining.** `confirm.ts` next door defaults to no on Return,
-* which is right there because every one of its callers is about to delete something. Here it would
-* be wrong in a subtler way: "no default" was the decision, and a capitalised `N` in the brackets
-* turns it into opt-out-by-keystroke, which is a different thing wearing the same words. Somebody
-* who has not read the question has not answered it.
-*
-* **No terminal means no question and no answer.** A durable job, a CI run and a piped invocation
-* must not block on a question nobody can see, and must not be recorded as having declined one:
-* the setting stays unset, nothing is sent, and the same machine is asked properly the first time
-* a person runs this interactively.
-*/
-async function askTelemetryUpload(options) {
-	const stored = telemetryUploadConsent();
-	if (stored !== null) return { kind: stored ? "granted" : "declined" };
-	if (!options.isTTY) return { kind: "unanswered" };
-	const reader = createInterface({ input: options.input });
-	const lines = reader[Symbol.asyncIterator]();
-	try {
-		options.write(`${telemetryUploadQuestion()}\n`);
-		for (let attempt = 0; attempt < 3; attempt += 1) {
-			options.write("[y/n] ");
-			const next = await lines.next();
-			if (next.done) return { kind: "unanswered" };
-			const answer = next.value.trim().toLowerCase();
-			if (answer === "y" || answer === "yes") return settle(options, true);
-			if (answer === "n" || answer === "no") return settle(options, false);
-			options.write(telemetryUploadUnclear());
-		}
-		return { kind: "unanswered" };
-	} finally {
-		reader.close();
-	}
-}
+//#region src/telemetry_notice.ts
 /**
-* Store the answer, and say what was stored.
+* What this product says about itself, said once per machine.
+*
+* Until 0.30.0 this file's predecessor asked a question: nothing was transmitted until somebody
+* typed y, and `apps/website/src/pages/Privacy.tsx` promised in as many words that it would work
+* that way. The sample that produced was not a sample of users, it was a sample of people who
+* answer questions, and one or two installations reporting against hundreds of weekly downloads
+* answers none of the four questions the telemetry exists for. So the default changed, the promise
+* was rewritten rather than quietly edited, and the question became this.
+*
+* **A disclosure, not a question wearing different words.** No prompt, no keystroke, no default in
+* brackets. Asking anything at all, however phrased, goes back to measuring who answers.
+*
+* **Shown only where the new default is doing the work.** A machine that answered yes on an earlier
+* version learns nothing from being told; a machine that answered no would be told something false.
+* Both are left alone, which is why the claim everywhere else is "every installation whose
+* behaviour changes is told once" rather than "every machine is told".
 *
-* Said out loud in both directions, because a setting written to a file the person did not open is
-* a change they need to know how to undo, and because "yes" and "nothing happened" look identical
-* from a terminal otherwise.
+* **No terminal check.** The old question could not be asked without one. A disclosure has nobody
+* to wait for, and a headless install that transmits is exactly the install that must not be the
+* one nobody ever told. It costs a CI log three lines on a persisted home, once.
 */
-function settle(options, answer) {
-	recordTelemetryUploadConsent(answer);
-	options.write(`${answer ? telemetryUploadGranted() : telemetryUploadDeclined()}\n`);
-	return { kind: answer ? "granted" : "declined" };
+function noticeTelemetry(write) {
+	if (process.env.PRB_TELEMETRY === "off") return;
+	if (telemetryUploadConsent() !== null) return;
+	if (telemetryNoticed()) return;
+	write(telemetryNotice());
+	recordTelemetryNotice();
 }
 //#endregion
 //#region src/main.ts
@@ -3344,32 +3340,30 @@ function greet(command) {
 	recordGreeting();
 }
 /**
-* The one question, asked after the hello and before the work.
+* The one-time telemetry disclosure, printed after the hello and before the work.
 *
-* The greeting's commands minus `config`, which is where the answer is changed: somebody typing
-* `config set telemetry-upload off` is answering the question, and prompting them for it first
-* would be this binary interrupting the answer in order to ask.
+* The greeting's commands minus `config`, which is where the setting is changed: somebody typing
+* `config set telemetry-upload off` should be able to turn it off without being told first that it
+* is on. That was true when this was a question and it is still true now it is a notice.
 *
-* On stderr with its input from stdin, like every other question here, so a piped stdout still
-* carries only the result and a piped stdin is a run with nobody to ask.
+* On stderr, like every other line here that is not a result, so `prreviewbuddy review | pbcopy`
+* still copies a URL. Unlike the question it replaced it takes no input and checks for no terminal:
+* there is nobody to wait for, and a headless install that transmits is the one that most needs
+* telling.
 */
-var ASKED = [
+var NOTIFIED = [
 	"review",
 	"open",
 	"agents"
 ];
-async function ask(command) {
-	if (!ASKED.includes(command.name)) return;
-	await askTelemetryUpload({
-		isTTY: Boolean(process.stdin.isTTY && process.stderr.isTTY),
-		input: process.stdin,
-		write: (chunk) => void process.stderr.write(chunk)
-	});
+function notify(command) {
+	if (!NOTIFIED.includes(command.name)) return;
+	noticeTelemetry((chunk) => void process.stderr.write(chunk));
 }
 async function main(argv) {
 	const command = parse(argv);
 	greet(command);
-	await ask(command);
+	notify(command);
 	switch (command.name) {
 		case "help":
 			out(HELP);

package/dist/server.js

@@ -1,4 +1,4 @@
-import { $ as fillFileUrlTemplate, $t as writeAgentPreference, A as removeWorktree, At as workspaceRevision, Bt as isQuestionOutstanding, C as recordTelemetryUploadConsent, Ct as previousKissResult, D as ReviewBeingDeletedError, Dt as saveWorkspace, E as EXPLAIN_SIMPLY_PROMPT, F as clearServerRecord, Ft as queueStamp, G as DEFAULT_WORKSPACE_PORT, Gt as describeAuthorship, H as BUILD_VERSION, Ht as questionsOutstanding, It as readQueue, J as parseWorkspacePort, Jt as git, K as MAX_WORKSPACE_PORT, L as readServerRecord, Lt as writeQueue, M as relativeTime$1, Mt as dequeueOnComplete, N as readIndexToken, Nt as queueAdd, O as MANAGED_ROOT, Pt as queueRemove, Qt as readAgentPreference, Rt as doneVerb, S as record, T as withUsageRecorded, Tt as reviewedCommit, Ut as reviewerDispositions, V as writeServerRecord, Vt as issuesOutstanding, W as feedbackUrl, Wt as processDiscussion, X as statedWorkspacePort, Xt as resolveModel, Y as resolveWorkspacePort, Z as writePortPreference, Zt as clearAgentPreference, _ as startKissJob, _t as latestKissRun, a as wasBlocked, an as agentFor, at as isTerminal, bt as loadWorkspace, c as updateReview, cn as AgentUnavailableError, d as askCheckout, dt as purposeOf, et as checkCodeFreshness, f as UpdateAlreadyRunningError, gt as indexReviewGroups, h as agentEnvOf, i as liveJobsFor, it as fail, jt as workspaceStamps, k as readMarker, kt as touchWorkspace, l as refreshPrContext, lt as phasesFor, mt as followedRefName, n as deleteReview, nn as AGENT_IDS, nt as allJobs, o as discardJob, ot as loadJob, p as liveUpdateFor, pt as isClaimed, q as MIN_WORKSPACE_PORT, r as lineageIds, rt as endedAt, s as RefreshUnavailableError, sn as AgentCancelledError, st as saveJob, t as deleteLineage, tn as STORE_ROOT, tt as checkFreshness, u as isUnchanged, ut as progressSteps, w as telemetryUploadConsent, wt as recentWorkspaces, x as readEvents, y as runJob, yt as lineagePosition, zt as isIssueOutstanding } from "./delete_review-DUCSC5Bc.js";
+import { $ as fillFileUrlTemplate, $t as writeAgentPreference, A as removeWorktree, At as workspaceRevision, Bt as isQuestionOutstanding, C as recordTelemetryUploadConsent, Ct as previousKissResult, D as ReviewBeingDeletedError, Dt as saveWorkspace, E as EXPLAIN_SIMPLY_PROMPT, F as clearServerRecord, Ft as queueStamp, G as DEFAULT_WORKSPACE_PORT, Gt as describeAuthorship, H as BUILD_VERSION, Ht as questionsOutstanding, It as readQueue, J as parseWorkspacePort, Jt as git, K as MAX_WORKSPACE_PORT, L as readServerRecord, Lt as writeQueue, M as relativeTime$1, Mt as dequeueOnComplete, N as readIndexToken, Nt as queueAdd, O as MANAGED_ROOT, Pt as queueRemove, Qt as readAgentPreference, Rt as doneVerb, S as record, T as withUsageRecorded, Tt as reviewedCommit, Ut as reviewerDispositions, V as writeServerRecord, Vt as issuesOutstanding, W as feedbackUrl, Wt as processDiscussion, X as statedWorkspacePort, Xt as resolveModel, Y as resolveWorkspacePort, Z as writePortPreference, Zt as clearAgentPreference, _ as startKissJob, _t as latestKissRun, a as wasBlocked, an as agentFor, at as isTerminal, bt as loadWorkspace, c as updateReview, cn as AgentUnavailableError, d as askCheckout, dt as purposeOf, et as checkCodeFreshness, f as UpdateAlreadyRunningError, gt as indexReviewGroups, h as agentEnvOf, i as liveJobsFor, it as fail, jt as workspaceStamps, k as readMarker, kt as touchWorkspace, l as refreshPrContext, lt as phasesFor, mt as followedRefName, n as deleteReview, nn as AGENT_IDS, nt as allJobs, o as discardJob, ot as loadJob, p as liveUpdateFor, pt as isClaimed, q as MIN_WORKSPACE_PORT, r as lineageIds, rt as endedAt, s as RefreshUnavailableError, sn as AgentCancelledError, st as saveJob, t as deleteLineage, tn as STORE_ROOT, tt as checkFreshness, u as isUnchanged, ut as progressSteps, w as telemetryUploadConsent, wt as recentWorkspaces, x as readEvents, y as runJob, yt as lineagePosition, zt as isIssueOutstanding } from "./delete_review-B_2J2Wn9.js";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { createHash, timingSafeEqual } from "node:crypto";
@@ -5058,27 +5058,31 @@ function renderReviewsSection(settings) {
   </section>`;
 }
 /**
-* The telemetry answer, visible.
+* The telemetry setting, visible.
 *
 * It has always been changeable, and only from the command line, which is a poor place for the one
-* setting a person is most likely to want to check rather than to set. Three states rather than
-* two: never having answered is not the same as having said no, and a page that showed it as "off"
-* would be answering a question on somebody's behalf.
+* setting a person is most likely to want to check rather than to set.
+*
+* Two radios over three stored states. Until 0.30.0 the third state meant nothing was being sent,
+* so neither radio could be checked without answering on somebody's behalf. Now it means the
+* default is applying and the default is on, so Send it is checked and the help line says which of
+* the two reasons it is on for. The storage keeps all three, because a stored no has to outrank any
+* future change of default.
 */
 function renderPrivacySection(settings) {
-	const on = settings.usageCounts === true;
 	const off = settings.usageCounts === false;
 	return `<section class="prb-settings-section">
     <h2>Privacy</h2>
     <div class="prb-field prb-settings-field" role="group" aria-labelledby="prb-usage-label" aria-describedby="prb-usage-help">
-      <span id="prb-usage-label">Anonymous usage counts</span>
+      <span id="prb-usage-label">Non-identifying usage telemetry</span>
       <div class="prb-settings-choice">
-        <label><input type="radio" name="prb-usage" value="on" data-settings-usage${on ? " checked" : ""}> Send them</label>
-        <label><input type="radio" name="prb-usage" value="off" data-settings-usage${off ? " checked" : ""}> Do not send them</label>
+        <label><input type="radio" name="prb-usage" value="on" data-settings-usage${off ? "" : " checked"}> Send it</label>
+        <label><input type="radio" name="prb-usage" value="off" data-settings-usage${off ? " checked" : ""}> Do not send it</label>
       </div>
     </div>
-    <p class="prb-settings-help" id="prb-usage-help">Counts only, never your code, your diffs, your
-    questions or the names of anything you review.${settings.usageCounts === null ? " You have not answered this yet, so nothing is being sent." : ""}</p>
+    <p class="prb-settings-help" id="prb-usage-help">When a review starts and finishes, with the
+    version, platform, agent, whether it succeeded and how long it took. Never your code, your diffs,
+    your questions or the names of anything you review.${settings.usageCounts === null ? " It is on by default; you have not changed it." : ""}</p>
   </section>`;
 }
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prreviewbuddy",
-  "version": "0.29.1",
+  "version": "0.30.0",
   "description": "Review a branch or pull request in an isolated checkout, from your terminal, with the coding agent you already have installed.",
   "license": "UNLICENSED",
   "homepage": "https://prreviewbuddy.com",