sandoichi 0.1.6 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sandoichi",
-  "version": "0.1.6",
+  "version": "0.3.0",
   "description": "Reduce repeated tool-output context in Claude Code and Codex.",
   "license": "MIT",
   "author": "yuzushi",

package/src/hook-cli.mjs

@@ -6,40 +6,51 @@ import { createReceipt, normalizeEvent, normalizePolicy, optimizeToolOutput } fr
 import { loadProjectRedactionProfile } from './redaction-config.mjs';
 import { defaultMetricsPath, recordMetrics } from './metrics.mjs';
 import {
-  closeFinishedDays, defaultTelemetryConfigPath, defaultTelemetryStatePaths, incrementCounter, readTelemetryConfig,
+  closeFinishedDays, defaultTelemetryConfigPath, defaultTelemetryStatePaths, incrementCounter, isDoNotTrack, readTelemetryConfig, recordActiveDay, recordFailure,
 } from './telemetry.mjs';
-
-const PLUGIN_VERSION = '0.1';
+import { PLUGIN_VERSION } from './version.mjs';
 
 function todayUtc() { return new Date().toISOString().slice(0, 10); }
 
-/** Only counts (never content, paths, or IDs) — see docs/plans/2026-08-25-sando-telemetry-design.md.
- *  `enforce` covers both `apply` and `dry-run`: both walk the real rewrite path, only
- *  `observe` collects without deciding anything. */
+/** Only counts (never content, paths, or IDs). */
 function recordHookTelemetry({ host, env, policy, optimization }) {
-  const configPath = defaultTelemetryConfigPath(env);
-  let config;
-  try { config = readTelemetryConfig(configPath); } catch { return; }
-  if (!config.enabled) return;
   try {
+    const configPath = defaultTelemetryConfigPath(env);
+    const config = readTelemetryConfig(configPath);
+    if (!config.enabled || isDoNotTrack(env)) return;
     const statePaths = defaultTelemetryStatePaths(env);
+    recordActiveDay({ statePaths, day: todayUtc(), pluginVersion: PLUGIN_VERSION, host });
     incrementCounter({
       statePaths,
       day: todayUtc(),
       event: 'hook_summary',
       host,
-      mode: policy.mode === 'observe' ? 'observe' : 'enforce',
+      mode: policy.mode === 'apply' ? 'enforce' : policy.mode === 'dry-run' ? 'dry_run' : 'observe',
       deltas: {
         toolCalls: 1,
         redactions: optimization.stats.redactions,
         cappedOutputs: optimization.artifact ? 1 : 0,
         bytesSaved: Math.max(0, optimization.stats.inputBytes - optimization.stats.inlineBytes),
+        inputTokensSaved: Math.max(0, optimization.stats.estimatedInputTokens - optimization.stats.estimatedInlineTokens),
       },
     });
     closeFinishedDays({ statePaths, configPath, day: todayUtc(), pluginVersion: PLUGIN_VERSION });
   } catch { /* telemetry is best-effort and must never affect hook output */ }
 }
 
+function recordHookFailure({ host, env, failureStage }) {
+  try {
+    const configPath = defaultTelemetryConfigPath(env);
+    const config = readTelemetryConfig(configPath);
+    if (!config.enabled || isDoNotTrack(env)) return;
+    const statePaths = defaultTelemetryStatePaths(env);
+    const day = todayUtc();
+    recordActiveDay({ statePaths, day, pluginVersion: PLUGIN_VERSION, host });
+    recordFailure({ statePaths, day, event: 'hook_failure_summary', host, failureStage });
+    closeFinishedDays({ statePaths, configPath, day, pluginVersion: PLUGIN_VERSION });
+  } catch { /* telemetry is best-effort and must never affect hook output */ }
+}
+
 function hookPolicy(env, host) {
   const policy = env.SANDO_POLICY
     ? JSON.parse(env.SANDO_POLICY)
@@ -79,18 +90,23 @@ export function runHookCli({ host, env = process.env } = {}) {
   try {
     policy = hookPolicy(env, host);
   } catch (error) {
+    recordHookFailure({ host, env, failureStage: 'policy' });
     process.stderr.write(`sando invalid policy: ${error instanceof Error ? error.message : 'invalid input'}\n`);
     process.exitCode = 2;
     return;
   }
+  let failureStage = 'input';
   try {
     const input = JSON.parse(fs.readFileSync(0, 'utf8') || '{}');
     const eventName = input.hook_event_name ?? input.hookEventName ?? input.event_name ?? input.eventName;
     if (eventName === 'PostToolUse') {
       const event = normalizeEvent(input);
+      failureStage = 'redaction';
       const redactionProfile = policy.redact ? loadProjectRedactionProfile(event.cwd).profile : undefined;
+      failureStage = 'optimization';
       const optimization = optimizeToolOutput({ toolName: event.toolName, toolInput: event.toolInput, output: event.output, cwd: event.cwd, policy, redactionProfile });
       let shaped;
+      failureStage = 'artifact';
       if (host === 'claude' && policy.mode === 'apply') {
         shaped = shapeForClaude({
           original: event.output,
@@ -101,6 +117,7 @@ export function runHookCli({ host, env = process.env } = {}) {
           policy,
         });
       }
+      failureStage = 'output';
       const receipt = createReceipt({ host, event, optimization, replacement: shaped });
       try {
         recordMetrics({ storagePath: defaultMetricsPath(env), host, event, optimization, receipt });
@@ -120,6 +137,7 @@ export function runHookCli({ host, env = process.env } = {}) {
       }
     }
   } catch (error) {
+    recordHookFailure({ host, env, failureStage });
     if (error?.code === 'SANDO_REDACTION_CONFIG') {
       process.stderr.write(`sando invalid redaction config: ${error.message}\n`);
       process.exitCode = 2;

package/src/mcp-server.mjs

@@ -1,6 +1,7 @@
 import readline from 'node:readline';
 
 import { optimizeToolOutput } from './core.mjs';
+import { PLUGIN_VERSION } from './version.mjs';
 
 const TOOL = {
   name: 'prepare_tool_output',
@@ -19,7 +20,7 @@ function dispatch(message) {
   if (!message || message.jsonrpc !== '2.0' || typeof message.method !== 'string') return error(message?.id, -32600, 'Invalid Request');
   if (message.id === undefined) return null;
   if (message.method === 'initialize') return response(message.id, {
-    protocolVersion: message.params?.protocolVersion || '2025-06-18', capabilities: { tools: { listChanged: false } }, serverInfo: { name: 'sando', version: '0.1.0' },
+    protocolVersion: message.params?.protocolVersion || '2025-06-18', capabilities: { tools: { listChanged: false } }, serverInfo: { name: 'sando', version: PLUGIN_VERSION },
   });
   if (message.method === 'ping') return response(message.id, {});
   if (message.method === 'tools/list') return response(message.id, { tools: [TOOL] });

package/src/postinstall.mjs

@@ -8,10 +8,10 @@ import readline from 'node:readline/promises';
 import { pathToFileURL } from 'node:url';
 
 import {
-  CONSENT_VERSION, defaultTelemetryConfigPath, enableTelemetry, readTelemetryConfig, TELEMETRY_DETAILS_URL,
+  defaultTelemetryConfigPath, enableTelemetry, isDoNotTrack, readTelemetryConfig, TELEMETRY_DETAILS_URL,
 } from './telemetry.mjs';
 
-const CONSENT_PROMPT = `Enable anonymous telemetry? Full details at: ${TELEMETRY_DETAILS_URL} [y/N] `;
+const CONSENT_PROMPT = `Enable anonymous telemetry? Full details at: ${TELEMETRY_DETAILS_URL} [y/yes/N/no] `;
 
 export async function runPostinstall({
   env = process.env, stdin = process.stdin, stdout = process.stdout,
@@ -19,11 +19,12 @@ export async function runPostinstall({
 } = {}) {
   try {
     if (env.SANDO_SKIP_TELEMETRY_PROMPT) return;
+    if (isDoNotTrack(env)) return;
     if (!stdin.isTTY || !stdout.isTTY) return; // CI, --ignore-scripts consumers, piped installs, etc.
 
     const configPath = defaultTelemetryConfigPath(env);
     const current = readTelemetryConfig(configPath);
-    if (current.prompted_consent_version >= CONSENT_VERSION) return; // never re-ask on reinstall/upgrade
+    if (current.consent_state !== 'unasked') return; // never re-ask on reinstall/upgrade
 
     const rl = readlineFactory();
     let answer;

package/src/proxy.mjs

@@ -4,43 +4,56 @@ import { estimateTokens } from './core.mjs';
 import { detectProviderBody, listSemanticCandidates, transformProviderRequest } from './context-transform.mjs';
 import { recordProxyRequest } from './proxy-metrics.mjs';
 import {
-  closeFinishedDays, defaultTelemetryConfigPath, defaultTelemetryStatePaths, incrementCounter, readTelemetryConfig,
+  closeFinishedDays, defaultTelemetryConfigPath, defaultTelemetryStatePaths, incrementCounter, isDoNotTrack, readTelemetryConfig, recordFailure,
 } from './telemetry.mjs';
-
-const PLUGIN_VERSION = '0.1';
+import { PLUGIN_VERSION } from './version.mjs';
 
 function todayUtc() { return new Date().toISOString().slice(0, 10); }
 
-/** Only counts (never request/response content) — see docs/plans/2026-08-25-sando-telemetry-design.md.
- *  `host` here is the provider request shape (`anthropic`/`openai`), which does not map cleanly to
- *  Sando's `claude`/`codex` telemetry host enum; the proxy fronts both hosts equally, so it reports
- *  under a fixed `claude` label — this is the one place the design doc's host/provider split is
- *  approximate, flagged for the design doc rather than silently assumed. */
-function recordProxyTelemetry({ env, transformed, beforeText, afterText }) {
-  const configPath = defaultTelemetryConfigPath(env);
-  let config;
-  try { config = readTelemetryConfig(configPath); } catch { return; }
-  if (!config.enabled) return;
-  const cacheWarm = transformed.stats.cacheRewriteRatio !== null;
+function telemetryProvider(provider) {
+  if (provider === 'anthropic') return 'anthropic';
+  if (provider === 'openai-chat' || provider === 'openai-responses') return 'openai';
+  return 'unknown';
+}
+
+/** Only counts (never request/response content). */
+function recordProxyTelemetry({ env, provider, transformed, beforeText, afterText }) {
   try {
+    const configPath = defaultTelemetryConfigPath(env);
+    const config = readTelemetryConfig(configPath);
+    if (!config.enabled || isDoNotTrack(env)) return;
     const statePaths = defaultTelemetryStatePaths(env);
     incrementCounter({
       statePaths,
       day: todayUtc(),
       event: 'proxy_summary',
-      host: 'claude',
+      provider: telemetryProvider(provider),
+      mode: 'enforce',
       deltas: {
         rewritesApplied: transformed.changed ? 1 : 0,
         rewritesSkippedCache: transformed.stats.cacheProtectedSkips > 0 ? 1 : 0,
         inputTokensSaved: Math.max(0, estimateTokens(beforeText) - estimateTokens(afterText)),
-        cacheHitYes: cacheWarm ? 1 : 0,
-        cacheHitNo: cacheWarm ? 0 : 1,
       },
     });
     closeFinishedDays({ statePaths, configPath, day: todayUtc(), pluginVersion: PLUGIN_VERSION });
   } catch { /* telemetry is best-effort and must never affect the proxied response */ }
 }
 
+function recordProxyFailure({ env, provider, failureStage }) {
+  try {
+    const configPath = defaultTelemetryConfigPath(env);
+    const config = readTelemetryConfig(configPath);
+    if (!config.enabled || isDoNotTrack(env)) return;
+    const statePaths = defaultTelemetryStatePaths(env);
+    const day = todayUtc();
+    recordFailure({
+      statePaths, day, event: 'proxy_failure_summary',
+      provider: telemetryProvider(provider), failureStage,
+    });
+    closeFinishedDays({ statePaths, configPath, day, pluginVersion: PLUGIN_VERSION });
+  } catch { /* telemetry is best-effort and must never affect the proxied response */ }
+}
+
 const DEFAULT_MAX_BODY_BYTES = 16 * 1024 * 1024;
 const HOP_BY_HOP_HEADERS = new Set([
   'connection', 'content-length', 'keep-alive', 'proxy-authenticate',
@@ -176,53 +189,86 @@ export async function createProviderProxy({ upstream, host = '127.0.0.1', port =
   let lastRequestAt = null;
 
   const server = http.createServer(async (request, outgoing) => {
+    let failureProvider = null;
     try {
       if (request.method === 'GET' && new URL(request.url, 'http://sando.invalid').pathname === '/health') {
         jsonResponse(outgoing, 200, { schema: 'sando-provider-proxy/v1', status: 'ok', lastStats });
         return;
       }
-      const rawBody = await readBody(request, maxBodyBytes);
+      let rawBody;
+      try {
+        rawBody = await readBody(request, maxBodyBytes);
+      } catch (error) {
+        recordProxyFailure({ env, provider: null, failureStage: 'input' });
+        if (!outgoing.headersSent) jsonResponse(outgoing, error.message === 'request body exceeds proxy limit' ? 413 : 502, { error: 'sando proxy upstream failure' });
+        else outgoing.destroy();
+        return;
+      }
       let body = rawBody;
       let recordProvider = null;
       let recordModel = null;
       let recordStats = null;
       if (rawBody.length > 0 && /application\/json/i.test(request.headers['content-type'] ?? '')) {
+        let parsed;
         try {
-          const parsed = JSON.parse(rawBody.toString('utf8'));
+          parsed = JSON.parse(rawBody.toString('utf8'));
+        } catch {
+          recordProxyFailure({ env, provider: null, failureStage: 'input' });
+        }
+        if (parsed) {
           const provider = detectProviderBody(parsed, request.headers);
-          if (provider) {
-            const now = Date.now();
-            const idleMs = lastRequestAt === null ? null : now - lastRequestAt;
-            lastRequestAt = now;
-            const transformed = transformProviderRequest({ provider, body: parsed, policy, idleMs });
-            if (transformed.changed) body = Buffer.from(JSON.stringify(transformed.body));
-            recordProxyTelemetry({
-              env, transformed,
-              beforeText: rawBody.toString('utf8'), afterText: body.toString('utf8'),
-            });
-            lastStats = { provider, ...transformed.stats, changed: transformed.changed, reasons: transformed.reasons };
-            recordProvider = provider;
-            recordModel = typeof parsed?.model === 'string' ? parsed.model : null;
-            recordStats = transformed.stats;
-            if (typeof semanticCompactor === 'function') {
-              const candidates = listSemanticCandidates({ provider, body: transformed.body });
-              const stats = createSemanticStats(candidates);
-              lastStats.semantic = stats;
-              setImmediate(() => observeSemanticCandidates({ provider, candidates, semanticCompactor, stats }));
+          failureProvider = provider;
+          try {
+            if (provider) {
+              const now = Date.now();
+              const idleMs = lastRequestAt === null ? null : now - lastRequestAt;
+              lastRequestAt = now;
+              const transformed = transformProviderRequest({ provider, body: parsed, policy, idleMs });
+              if (transformed.changed) body = Buffer.from(JSON.stringify(transformed.body));
+              recordProxyTelemetry({
+                env, provider, transformed,
+                beforeText: rawBody.toString('utf8'), afterText: body.toString('utf8'),
+              });
+              lastStats = { provider, ...transformed.stats, changed: transformed.changed, reasons: transformed.reasons };
+              recordProvider = provider;
+              recordModel = typeof parsed?.model === 'string' ? parsed.model : null;
+              recordStats = transformed.stats;
+              if (typeof semanticCompactor === 'function') {
+                const candidates = listSemanticCandidates({ provider, body: transformed.body });
+                const stats = createSemanticStats(candidates);
+                lastStats.semantic = stats;
+                setImmediate(() => observeSemanticCandidates({ provider, candidates, semanticCompactor, stats }));
+              }
             }
+          } catch {
+            recordProxyFailure({ env, provider, failureStage: 'optimization' });
+            body = rawBody;
           }
-        } catch {
-          body = rawBody;
         }
       }
-      const response = await fetch(targetUrl(upstreamUrl, request.url), {
-        method: request.method,
-        headers: forwardedHeaders(request),
-        body: ['GET', 'HEAD'].includes(request.method) ? undefined : body,
-        redirect: 'manual',
-      });
+      let response;
+      try {
+        response = await fetch(targetUrl(upstreamUrl, request.url), {
+          method: request.method,
+          headers: forwardedHeaders(request),
+          body: ['GET', 'HEAD'].includes(request.method) ? undefined : body,
+          redirect: 'manual',
+        });
+      } catch {
+        recordProxyFailure({ env, provider: failureProvider, failureStage: 'upstream' });
+        if (!outgoing.headersSent) jsonResponse(outgoing, 502, { error: 'sando proxy upstream failure' });
+        else outgoing.destroy();
+        return;
+      }
       let responseText = '';
-      await pipeResponse(response, outgoing, metricsPath ? (chunk) => { responseText += chunk; } : undefined);
+      try {
+        await pipeResponse(response, outgoing, metricsPath ? (chunk) => { responseText += chunk; } : undefined);
+      } catch {
+        recordProxyFailure({ env, provider: failureProvider, failureStage: 'response' });
+        if (!outgoing.headersSent) jsonResponse(outgoing, 502, { error: 'sando proxy upstream failure' });
+        else outgoing.destroy();
+        return;
+      }
       if (metricsPath && recordProvider) {
         try {
           recordProxyRequest({
@@ -232,6 +278,7 @@ export async function createProviderProxy({ upstream, host = '127.0.0.1', port =
         } catch { /* metrics are best-effort and must never affect the proxied response */ }
       }
     } catch (error) {
+      recordProxyFailure({ env, provider: failureProvider, failureStage: 'response' });
       if (!outgoing.headersSent) jsonResponse(outgoing, error.message === 'request body exceeds proxy limit' ? 413 : 502, { error: 'sando proxy upstream failure' });
       else outgoing.destroy();
     }

package/src/session-start.mjs

@@ -1,25 +1,45 @@
 import path from 'node:path';
 
-import { defaultTelemetryConfigPath, readTelemetryConfig, TELEMETRY_DETAILS_URL } from './telemetry.mjs';
+import {
+  closeFinishedDays, defaultTelemetryConfigPath, defaultTelemetryStatePaths, isDoNotTrack, markTelemetryAsked,
+  readTelemetryConfig, TELEMETRY_DETAILS_URL,
+} from './telemetry.mjs';
+import { PLUGIN_VERSION } from './version.mjs';
 
 export function runSessionStart({
   env = process.env,
   stdout = process.stdout,
   rootEnv = 'PLUGIN_ROOT',
+  spawnImpl,
+  configPath,
+  statePaths,
 } = {}) {
   try {
-    const config = readTelemetryConfig(defaultTelemetryConfigPath(env));
-    if (config.prompted_consent_version > 0) {
+    if (isDoNotTrack(env)) {
+      stdout.write('{}\n');
+      return;
+    }
+    const telemetryConfigPath = configPath ?? defaultTelemetryConfigPath(env);
+    const telemetryStatePaths = statePaths ?? defaultTelemetryStatePaths(env);
+    const config = readTelemetryConfig(telemetryConfigPath);
+    if (config.enabled) {
+      closeFinishedDays({
+        statePaths: telemetryStatePaths, configPath: telemetryConfigPath, day: new Date().toISOString().slice(0, 10),
+        pluginVersion: PLUGIN_VERSION, ...(spawnImpl ? { spawnImpl } : {}),
+      });
+    }
+    if (config.consent_state !== 'unasked' || !markTelemetryAsked(telemetryConfigPath)) {
       stdout.write('{}\n');
       return;
     }
     const pluginRoot = env[rootEnv] || path.resolve(import.meta.dirname, '..');
     const cli = path.join(pluginRoot, 'lib', 'telemetry-cli.mjs');
     stdout.write(`${JSON.stringify({
+      systemMessage: 'Sando can send anonymous aggregate telemetry (opt-in, off by default). '
+        + 'Reply with exactly `sando telemetry yes` or `sando telemetry no`, '
+        + `or run \`node "${cli}" enable\`. Details: ${TELEMETRY_DETAILS_URL}`,
       hookSpecificOutput: {
         hookEventName: 'SessionStart',
-        systemMessage: 'Sando can send anonymous aggregate telemetry (opt-in, off by default). '
-          + `Run \`node "${cli}" enable\` to turn it on. Details: ${TELEMETRY_DETAILS_URL}`,
       },
     })}\n`);
   } catch {

package/src/telemetry-cli.mjs

@@ -6,11 +6,11 @@ import { pathToFileURL } from 'node:url';
 
 import {
   defaultTelemetryConfigPath, defaultTelemetryStatePaths,
-  disableTelemetry, enableTelemetry, flushQueue, previewNextUpload, statusTelemetry, TELEMETRY_DETAILS_URL,
+  disableTelemetry, enableTelemetry, flushQueue, isDoNotTrack, previewNextUpload, statusTelemetry, TELEMETRY_DETAILS_URL,
 } from './telemetry.mjs';
 
 const USAGE = 'Usage: sando telemetry <status|enable|disable [--purge]|preview|flush>\n';
-const CONSENT_PROMPT = `Enable anonymous telemetry? Full details at: ${TELEMETRY_DETAILS_URL} [y/N] `;
+const CONSENT_PROMPT = `Enable anonymous telemetry? Full details at: ${TELEMETRY_DETAILS_URL} [y/yes/N/no] `;
 
 async function defaultPrompt(message) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -26,18 +26,34 @@ export async function runTelemetryCli({
   try {
     if (command === 'status') {
       const config = statusTelemetry(configPath);
+      if (isDoNotTrack(env)) {
+        stdout.write('telemetry: disabled by DO_NOT_TRACK\n');
+        return { ...config, enabled: false };
+      }
       stdout.write(`telemetry: ${config.enabled ? 'enabled' : 'disabled'}\n`);
       return config;
     }
     if (command === 'enable') {
+      if (isDoNotTrack(env)) {
+        stderr.write('sando telemetry: DO_NOT_TRACK is set; telemetry remains disabled\n');
+        return { ...statusTelemetry(configPath), enabled: false, exitCode: 1 };
+      }
       if (!interactive) {
         stderr.write('sando telemetry: enable requires an interactive session\n');
-        return enableTelemetry({ configPath, interactive: false });
+        return { ...statusTelemetry(configPath), exitCode: 1 };
+      }
+      const current = statusTelemetry(configPath);
+      if (current.enabled) {
+        stdout.write('telemetry already enabled.\n');
+        return current;
+      }
+      if (current.consent_state === 'declined') {
+        stdout.write('telemetry not enabled.\n');
+        return current;
       }
       const answer = await prompt(CONSENT_PROMPT);
       const result = enableTelemetry({
-        configPath, interactive: true,
-        answer: /^(y|yes)$/i.test((answer ?? '').trim()) ? 'yes' : answer,
+        configPath, interactive: true, answer,
       });
       stdout.write(result.enabled ? 'telemetry enabled.\n' : 'telemetry not enabled.\n');
       return result;
@@ -54,6 +70,10 @@ export async function runTelemetryCli({
       return preview;
     }
     if (command === 'flush') {
+      if (isDoNotTrack(env)) {
+        stdout.write('telemetry disabled by DO_NOT_TRACK; nothing to flush.\n');
+        return { sent: 0 };
+      }
       const config = statusTelemetry(configPath);
       if (!config.enabled) {
         stdout.write('telemetry is disabled; nothing to flush.\n');
@@ -72,5 +92,6 @@ export async function runTelemetryCli({
 }
 
 if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
-  await runTelemetryCli();
+  const result = await runTelemetryCli();
+  if (result?.exitCode) process.exitCode = result.exitCode;
 }

package/src/telemetry-flush-entry.mjs

@@ -5,19 +5,19 @@
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 
-import { flushQueue, readTelemetryConfig } from './telemetry.mjs';
+import { flushQueue, isDoNotTrack, readTelemetryConfig } from './telemetry.mjs';
 
 function option(argv, name) {
   const index = argv.indexOf(`--${name}`);
   return index === -1 ? undefined : argv[index + 1];
 }
 
-export async function runTelemetryFlushEntry({ argv = process.argv.slice(2) } = {}) {
+export async function runTelemetryFlushEntry({ argv = process.argv.slice(2), env = process.env } = {}) {
   const queuePath = option(argv, 'queue');
   const configPath = option(argv, 'config');
   if (!queuePath || !configPath) throw new Error('telemetry-flush-entry requires --queue and --config');
   const config = readTelemetryConfig(configPath);
-  if (!config.enabled) return { sent: 0 };
+  if (!config.enabled || isDoNotTrack(env)) return { sent: 0 };
   return flushQueue({ statePaths: { queue: queuePath }, endpoint: config.endpoint });
 }
 

package/src/telemetry.mjs

@@ -13,34 +13,54 @@ const MAX_EVENT_BYTES = 2048;
 const COUNT_BUCKETS = ['zero', 'one', '2_to_5', '6_to_20', 'gt_20'];
 const BYTE_BUCKETS = ['lt_4k', '4_to_16k', '16_to_64k', 'gte_64k'];
 const HOSTS = ['claude', 'codex'];
-const MODES = ['enforce', 'observe'];
-const YES_NO_UNKNOWN = ['yes', 'no', 'unknown'];
+const PROVIDERS = ['anthropic', 'openai', 'unknown'];
+const MODES = ['enforce', 'observe', 'dry_run'];
+export const FAILURE_STAGES = [
+  'policy', 'input', 'redaction', 'optimization', 'artifact', 'output', 'upstream', 'response',
+];
 
 const SHARED_FIELDS = {
   schema_version: (value) => value === SCHEMA_VERSION,
-  event: (value) => value === 'hook_summary' || value === 'proxy_summary',
+  event: (value) => [
+    'hook_summary', 'proxy_summary', 'active_day', 'hook_failure_summary', 'proxy_failure_summary',
+  ].includes(value),
   day_utc: (value) => typeof value === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(value),
-  plugin_version: (value) => typeof value === 'string' && /^\d+\.\d+$/.test(value) && value.length <= MAX_STRING_LENGTH,
-  host: (value) => HOSTS.includes(value),
+  plugin_version: (value) => typeof value === 'string' && /^\d+\.\d+(?:\.\d+)?$/.test(value) && value.length <= MAX_STRING_LENGTH,
 };
 
 const HOOK_FIELDS = {
+  host: (value) => HOSTS.includes(value),
   mode: (value) => MODES.includes(value),
   tool_calls_bucket: (value) => COUNT_BUCKETS.includes(value),
-  redactions_bucket: (value) => COUNT_BUCKETS.includes(value),
   capped_outputs_bucket: (value) => COUNT_BUCKETS.includes(value),
   bytes_saved_bucket: (value) => BYTE_BUCKETS.includes(value),
+  input_tokens_saved_bucket: (value) => BYTE_BUCKETS.includes(value),
 };
 
 const PROXY_FIELDS = {
+  provider: (value) => PROVIDERS.includes(value),
+  mode: (value) => MODES.includes(value),
   rewrites_applied_bucket: (value) => COUNT_BUCKETS.includes(value),
   rewrites_skipped_cache_bucket: (value) => COUNT_BUCKETS.includes(value),
   input_tokens_saved_bucket: (value) => BYTE_BUCKETS.includes(value),
-  prompt_cache_hit: (value) => YES_NO_UNKNOWN.includes(value),
+};
+
+const ACTIVE_DAY_FIELDS = { host: (value) => HOSTS.includes(value) };
+const HOOK_FAILURE_FIELDS = {
+  host: (value) => HOSTS.includes(value),
+  failure_stage: (value) => FAILURE_STAGES.includes(value),
+};
+const PROXY_FAILURE_FIELDS = {
+  provider: (value) => PROVIDERS.includes(value),
+  failure_stage: (value) => FAILURE_STAGES.includes(value),
 };
 
 function fieldsForEvent(eventType) {
-  return eventType === 'hook_summary' ? HOOK_FIELDS : PROXY_FIELDS;
+  if (eventType === 'hook_summary') return HOOK_FIELDS;
+  if (eventType === 'proxy_summary') return PROXY_FIELDS;
+  if (eventType === 'active_day') return ACTIVE_DAY_FIELDS;
+  if (eventType === 'hook_failure_summary') return HOOK_FAILURE_FIELDS;
+  return PROXY_FAILURE_FIELDS;
 }
 
 export function countBucket(count) {
@@ -85,6 +105,7 @@ export function serializeEvent(payload) {
 export const TELEMETRY_CONFIG_VERSION = 1;
 export const CONSENT_VERSION = 1;
 export const TELEMETRY_DETAILS_URL = 'https://github.com/yuzushi-dev/Sando/blob/main/TELEMETRY.md';
+export const CONSENT_STATES = ['unasked', 'asked', 'enabled', 'declined'];
 // Canary phase: shared backend, fronted by a Cloudflare Tunnel so it's
 // reachable from any of the owner's machines (see
 // session-handoff/deploy/telemetry/). Rate-limited at nginx (30 req/min/IP).
@@ -92,15 +113,22 @@ export const TELEMETRY_DETAILS_URL = 'https://github.com/yuzushi-dev/Sando/blob/
 // session-handoff/docs/telemetry-canary-report.md.
 export const TELEMETRY_ENDPOINT = 'https://telemetry.yuzushi.party/v1/logs';
 
+export function isDoNotTrack(env = process.env) {
+  return env.DO_NOT_TRACK !== undefined && env.DO_NOT_TRACK !== '' && env.DO_NOT_TRACK !== '0';
+}
+
 function record(value) { return value !== null && typeof value === 'object' && !Array.isArray(value); }
 
 function emptyTelemetryConfig() {
-  return { schema_version: TELEMETRY_CONFIG_VERSION, enabled: false, prompted_consent_version: 0 };
+  return {
+    schema_version: TELEMETRY_CONFIG_VERSION, enabled: false, prompted_consent_version: 0, consent_state: 'unasked',
+  };
 }
 
 function validateTelemetryConfig(value) {
   if (!record(value) || value.schema_version !== TELEMETRY_CONFIG_VERSION || typeof value.enabled !== 'boolean'
-    || !Number.isInteger(value.prompted_consent_version) || value.prompted_consent_version < 0) {
+    || !Number.isInteger(value.prompted_consent_version) || value.prompted_consent_version < 0
+    || !CONSENT_STATES.includes(value.consent_state)) {
     throw new Error('telemetry config is invalid');
   }
   if (value.enabled) {
@@ -126,7 +154,14 @@ export function defaultTelemetryStatePaths(env = process.env) {
 
 export function readTelemetryConfig(configPath = defaultTelemetryConfigPath()) {
   if (!fs.existsSync(configPath)) return emptyTelemetryConfig();
-  return validateTelemetryConfig(JSON.parse(fs.readFileSync(configPath, 'utf8')));
+  const value = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+  // Legacy files cannot distinguish an explicit no from blank input or the old
+  // y-as-no bug. Keep that ambiguous decision as asked, not as a decline.
+  const migrated = Object.hasOwn(value, 'consent_state') ? value : {
+    ...value,
+    consent_state: value.enabled ? 'enabled' : value.prompted_consent_version > 0 ? 'asked' : 'unasked',
+  };
+  return validateTelemetryConfig(migrated);
 }
 
 function writeTelemetryConfig(configPath, config) {
@@ -140,31 +175,66 @@ export function statusTelemetry(configPath = defaultTelemetryConfigPath()) {
   return readTelemetryConfig(configPath);
 }
 
-/** Only an explicit `yes` in an interactive session enables collection; anything else
- *  (blank, `no`, EOF, or a non-interactive caller) writes the disabled prompt marker so
- *  upgrades and reinstalls never re-prompt or silently opt a user in. */
+export function normalizeConsentAnswer(answer) {
+  if (typeof answer !== 'string') return undefined;
+  const normalized = answer.trim().toLowerCase();
+  if (normalized === 'y' || normalized === 'yes') return 'yes';
+  if (normalized === 'n' || normalized === 'no') return 'no';
+  return undefined;
+}
+
+export function markTelemetryAsked(configPath = defaultTelemetryConfigPath()) {
+  ensureDirectory(path.dirname(configPath));
+  return withLock(`${configPath}.lock`, () => {
+    const current = readTelemetryConfig(configPath);
+    if (current.consent_state !== 'unasked') return false;
+    const next = {
+      ...current, enabled: false, prompted_consent_version: CONSENT_VERSION, consent_state: 'asked',
+    };
+    validateTelemetryConfig(next);
+    atomicWrite(configPath, next);
+    return true;
+  });
+}
+
+/** Only an explicit yes enables collection; explicit no declines, other input stays asked/off. */
 export function enableTelemetry({ configPath = defaultTelemetryConfigPath(), answer, interactive = true, now = () => new Date() } = {}) {
-  if (!interactive || typeof answer !== 'string' || answer.trim().toLowerCase() !== 'yes') {
-    return writeTelemetryConfig(configPath, { schema_version: TELEMETRY_CONFIG_VERSION, enabled: false, prompted_consent_version: CONSENT_VERSION });
+  if (!interactive) return { ...readTelemetryConfig(configPath), exitCode: 1 };
+  const normalized = normalizeConsentAnswer(answer);
+  if (normalized === 'yes') {
+    return writeTelemetryConfig(configPath, {
+      schema_version: TELEMETRY_CONFIG_VERSION,
+      enabled: true,
+      prompted_consent_version: CONSENT_VERSION,
+      consent_state: 'enabled',
+      consent_version: CONSENT_VERSION,
+      consented_at: now().toISOString(),
+      endpoint: TELEMETRY_ENDPOINT,
+    });
   }
   return writeTelemetryConfig(configPath, {
     schema_version: TELEMETRY_CONFIG_VERSION,
-    enabled: true,
+    enabled: false,
     prompted_consent_version: CONSENT_VERSION,
-    consent_version: CONSENT_VERSION,
-    consented_at: now().toISOString(),
-    endpoint: TELEMETRY_ENDPOINT,
+    consent_state: normalized === 'no' ? 'declined' : 'asked',
   });
 }
 
-const QUEUE_MAX_ROWS = 256;
-const QUEUE_MAX_BYTES = 256 * 1024;
+// 30 days of daily aggregates plus activity markers for both supported hosts,
+// with headroom for concurrent event dimensions and temporary outages.
+const QUEUE_MAX_ROWS = 4096;
+const QUEUE_MAX_BYTES = 4 * 1024 * 1024;
+const ACTIVE_DAY_RETENTION_DAYS = 30;
 const DEFAULT_BATCH_MAX = 32;
+const LEASE_MS = 5 * 60 * 1000;
+const RETRY_DELAYS_MS = [60_000, 300_000, 1_800_000, 7_200_000, 21_600_000];
+const CHILD_ENV_KEYS = ['HTTPS_PROXY', 'HTTP_PROXY', 'NO_PROXY', 'NODE_EXTRA_CA_CERTS', 'SSL_CERT_FILE'];
 
-function emptyCounters() { return { schema_version: TELEMETRY_CONFIG_VERSION, counters: {} }; }
+function emptyCounters() { return { schema_version: TELEMETRY_CONFIG_VERSION, counters: {}, active_days: {} }; }
 function readCounters(countersPath) {
   if (!fs.existsSync(countersPath)) return emptyCounters();
-  return JSON.parse(fs.readFileSync(countersPath, 'utf8'));
+  const state = JSON.parse(fs.readFileSync(countersPath, 'utf8'));
+  return { ...state, counters: state.counters ?? {}, active_days: state.active_days ?? {} };
 }
 
 function readQueueRows(queuePath) {
@@ -181,24 +251,29 @@ function writeQueueRows(queuePath, rows) {
   fs.chmodSync(queuePath, 0o600);
 }
 
-/** Enforces the bounded queue (256 rows / 256 KiB), dropping the oldest rows first —
+/** Enforces the bounded queue (4096 rows / 4 MiB), dropping the oldest rows first —
  *  a telemetry backlog must never grow without bound or block product behavior. */
 function appendQueueRows(queuePath, newRows) {
+  ensureDirectory(path.dirname(queuePath));
   withLock(`${queuePath}.lock`, () => {
-    let rows = [...readQueueRows(queuePath), ...newRows];
+    let rows = readQueueRows(queuePath);
+    const keys = new Set(rows.map((row) => queueKey(row)));
+    for (const row of newRows) {
+      if (!keys.has(queueKey(row))) { rows.push(row); keys.add(queueKey(row)); }
+    }
     if (rows.length > QUEUE_MAX_ROWS) rows = rows.slice(rows.length - QUEUE_MAX_ROWS);
     while (rows.length > 0 && Buffer.byteLength(rows.map((row) => JSON.stringify(row)).join('\n')) > QUEUE_MAX_BYTES) rows.shift();
     writeQueueRows(queuePath, rows);
   });
 }
 
-function majorityCacheHit(entry) {
-  const yes = entry.cacheHitYes ?? 0;
-  const no = entry.cacheHitNo ?? 0;
-  const unknown = entry.cacheHitUnknown ?? 0;
-  if (yes > no && yes >= unknown) return 'yes';
-  if (no > yes && no >= unknown) return 'no';
-  return 'unknown';
+function queueKey(row) {
+  return [row.event, row.day_utc, row.plugin_version, row.host ?? row.provider ?? '', row.mode ?? '', row.failureStage ?? row.failure_stage ?? ''].join('|');
+}
+
+function publicRow(row) {
+  const allowed = { ...SHARED_FIELDS, ...fieldsForEvent(row.event) };
+  return Object.fromEntries(Object.entries(row).filter(([key]) => Object.hasOwn(allowed, key)));
 }
 
 function bucketEntry(entry, pluginVersion) {
@@ -207,30 +282,47 @@ function bucketEntry(entry, pluginVersion) {
       schema_version: TELEMETRY_CONFIG_VERSION, event: 'hook_summary', day_utc: entry.day, plugin_version: pluginVersion,
       host: entry.host, mode: entry.mode,
       tool_calls_bucket: countBucket(entry.toolCalls ?? 0),
-      redactions_bucket: countBucket(entry.redactions ?? 0),
       capped_outputs_bucket: countBucket(entry.cappedOutputs ?? 0),
       bytes_saved_bucket: byteBucket(entry.bytesSaved ?? 0),
+      input_tokens_saved_bucket: byteBucket(entry.inputTokensSaved ?? 0),
     };
   }
-  return {
+  if (entry.event === 'proxy_summary') return {
     schema_version: TELEMETRY_CONFIG_VERSION, event: 'proxy_summary', day_utc: entry.day, plugin_version: pluginVersion,
-    host: entry.host,
+    provider: entry.provider ?? 'unknown', mode: entry.mode ?? 'enforce',
     rewrites_applied_bucket: countBucket(entry.rewritesApplied ?? 0),
     rewrites_skipped_cache_bucket: countBucket(entry.rewritesSkippedCache ?? 0),
     input_tokens_saved_bucket: byteBucket(entry.inputTokensSaved ?? 0),
-    prompt_cache_hit: majorityCacheHit(entry),
+  };
+  if (entry.event === 'hook_failure_summary') return {
+    schema_version: TELEMETRY_CONFIG_VERSION, event: 'hook_failure_summary', day_utc: entry.day, plugin_version: pluginVersion,
+    host: entry.host, failure_stage: entry.failureStage,
+  };
+  return {
+    schema_version: TELEMETRY_CONFIG_VERSION, event: 'proxy_failure_summary', day_utc: entry.day, plugin_version: pluginVersion,
+    provider: entry.provider, failure_stage: entry.failureStage,
   };
 }
 
 /** Accumulates raw per-day counts in memory/on disk; values are only bucketed (and thus
  *  only ever leave the machine) once `closeDay` closes a finished UTC day. */
-export function incrementCounter({ statePaths, day, event, host, mode, deltas = {} }) {
-  if (!['hook_summary', 'proxy_summary'].includes(event)) throw new Error('incrementCounter: invalid event');
-  const key = `${day}|${event}|${host}|${mode ?? ''}`;
+export function incrementCounter({ statePaths, day, event, host, provider, mode, failureStage, deltas = {} }) {
+  if (!['hook_summary', 'proxy_summary', 'hook_failure_summary', 'proxy_failure_summary'].includes(event)) {
+    throw new Error('incrementCounter: invalid event');
+  }
+  const isProxy = event.startsWith('proxy_');
+  const dimension = isProxy ? provider : host;
+  const key = event.includes('failure')
+    ? [day, event, dimension, failureStage ?? ''].join('|')
+    : [day, event, dimension, mode ?? ''].join('|');
   ensureDirectory(path.dirname(statePaths.counters));
   withLock(`${statePaths.counters}.lock`, () => {
     const state = readCounters(statePaths.counters);
-    const existing = state.counters[key] ?? { day, event, host, mode: mode ?? null };
+    const existing = state.counters[key] ?? {
+      day, event, ...(isProxy ? { provider: dimension } : { host: dimension }),
+      ...(event.endsWith('_summary') && !event.includes('failure') ? { mode: mode ?? null } : {}),
+      ...(event.includes('failure') ? { failureStage } : {}),
+    };
     for (const [field, value] of Object.entries(deltas)) {
       if (!Number.isInteger(value) || value < 0) throw new Error(`incrementCounter: invalid delta ${field}`);
       existing[field] = (existing[field] ?? 0) + value;
@@ -240,6 +332,37 @@ export function incrementCounter({ statePaths, day, event, host, mode, deltas =
   });
 }
 
+export function recordFailure({ statePaths, day, event, host, provider, failureStage }) {
+  incrementCounter({
+    statePaths, day, event, host, provider, failureStage, deltas: { count: 1 },
+  });
+}
+
+/** Queues a single non-aggregate activity marker for this UTC day and host. */
+export function recordActiveDay({ statePaths, day, pluginVersion, host }) {
+  const marker = {
+    schema_version: SCHEMA_VERSION, event: 'active_day', day_utc: day, plugin_version: pluginVersion, host,
+  };
+  const validatedMarker = validateEvent(marker);
+  const activeDayKey = `${day}|${host}`;
+  ensureDirectory(path.dirname(statePaths.counters));
+  withLock(`${statePaths.counters}.lock`, () => {
+    const state = readCounters(statePaths.counters);
+    const activeDays = state.active_days;
+    const cutoff = Date.parse(`${day}T00:00:00Z`) - (ACTIVE_DAY_RETENTION_DAYS - 1) * 86_400_000;
+    for (const [key, recordedDay] of Object.entries(activeDays)) {
+      if (Date.parse(`${recordedDay}T00:00:00Z`) < cutoff) delete activeDays[key];
+    }
+    if (Object.hasOwn(activeDays, activeDayKey)) {
+      atomicWrite(statePaths.counters, state);
+      return;
+    }
+    appendQueueRows(statePaths.queue, [validatedMarker]);
+    activeDays[activeDayKey] = day;
+    atomicWrite(statePaths.counters, state);
+  });
+}
+
 /** Closes a finished UTC day: buckets its raw counters into daily_aggregate rows,
  *  appends them to the upload queue, and clears them from the raw counter file so a
  *  day is never counted twice. */
@@ -252,11 +375,11 @@ export function closeDay({ statePaths, day, pluginVersion }) {
       if (entry.day !== day) { remaining[key] = entry; continue; }
       closedRows.push(validateEvent(bucketEntry(entry, pluginVersion)));
     }
+    if (closedRows.length) appendQueueRows(statePaths.queue, closedRows);
     state.counters = remaining;
     ensureDirectory(path.dirname(statePaths.counters));
     atomicWrite(statePaths.counters, state);
   });
-  if (closedRows.length) appendQueueRows(statePaths.queue, closedRows);
   return closedRows;
 }
 
@@ -264,14 +387,16 @@ function launchDetachedFlush({ statePaths, configPath, spawnImpl }) {
   try {
     const entryPath = fileURLToPath(new URL('./telemetry-flush-entry.mjs', import.meta.url));
     const child = spawnImpl(process.execPath, [entryPath, '--queue', statePaths.queue, '--config', configPath], {
-      detached: true, env: {}, stdio: 'ignore', windowsHide: true,
+      detached: true,
+      env: Object.fromEntries(CHILD_ENV_KEYS.filter((key) => process.env[key] !== undefined).map((key) => [key, process.env[key]])),
+      stdio: 'ignore', windowsHide: true,
     });
     child.unref();
   } catch { /* telemetry must never affect the caller */ }
 }
 
-/** Closes every raw counter day before `day` and starts one detached uploader.
- * The child receives only local state paths and an empty environment. */
+/** Closes every raw counter day before `day` and starts one detached uploader
+ * whenever any queue row remains, including a queue from a previous session. */
 export function closeFinishedDays({
   statePaths, configPath = defaultTelemetryConfigPath(), day, pluginVersion,
   spawnImpl = spawn,
@@ -287,18 +412,44 @@ export function closeFinishedDays({
   for (const closedDay of [...days].sort()) {
     closedRows.push(...closeDay({ statePaths, day: closedDay, pluginVersion }));
   }
-  if (closedRows.length) launchDetachedFlush({ statePaths, configPath, spawnImpl });
+  if (fs.existsSync(statePaths.queue) && readQueueRows(statePaths.queue).length) {
+    launchDetachedFlush({ statePaths, configPath, spawnImpl });
+  }
   return closedRows;
 }
 
-export function loadBatch({ statePaths, max = DEFAULT_BATCH_MAX } = {}) {
-  return readQueueRows(statePaths.queue).slice(0, max);
+function claimBatch({ statePaths, max, now = Date.now, leaseMs = LEASE_MS }) {
+  let claimed = [];
+  withLock(`${statePaths.queue}.lock`, () => {
+    const rows = readQueueRows(statePaths.queue);
+    const timestamp = now();
+    const available = rows.filter((row) => !row._permanent && (!row._nextAttemptAt || row._nextAttemptAt <= timestamp));
+    if (!available.length) return;
+    if (available.some((row) => row._leaseUntil > timestamp)) return;
+    const leaseId = `${process.pid}-${timestamp}-${Math.random().toString(36).slice(2)}`;
+    const selected = available.slice(0, max);
+    const selectedKeys = new Set(selected.map(queueKey));
+    for (const row of rows) {
+      if (selectedKeys.has(queueKey(row))) { row._leaseId = leaseId; row._leaseUntil = timestamp + leaseMs; }
+    }
+    writeQueueRows(statePaths.queue, rows);
+    claimed = selected.map((row) => ({ ...row, _leaseId: leaseId, _leaseUntil: timestamp + leaseMs }));
+  });
+  return claimed;
+}
+
+export function loadBatch({ statePaths, max = DEFAULT_BATCH_MAX, lease = true, now = Date.now } = {}) {
+  if (lease) return claimBatch({ statePaths, max, now });
+  return readQueueRows(statePaths.queue).filter((row) => !row._permanent && (!row._nextAttemptAt || row._nextAttemptAt <= now())).slice(0, max).map(publicRow);
 }
 
-export function ackBatch({ statePaths, count }) {
+export function ackBatch({ statePaths, count, leaseId } = {}) {
   withLock(`${statePaths.queue}.lock`, () => {
     const rows = readQueueRows(statePaths.queue);
-    writeQueueRows(statePaths.queue, rows.slice(count));
+    if (!leaseId) { writeQueueRows(statePaths.queue, rows.slice(count)); return; }
+    const leased = rows.filter((row) => row._leaseId === leaseId).slice(0, count);
+    const keys = new Set(leased.map(queueKey));
+    writeQueueRows(statePaths.queue, rows.filter((row) => !keys.has(queueKey(row))));
   });
 }
 
@@ -309,7 +460,7 @@ export function toOtlpLogs(rows) {
       scopeLogs: [{
         logRecords: rows.map((row) => ({
           body: { stringValue: 'sando.daily_aggregate' },
-          attributes: Object.entries(row).map(([key, value]) => ({ key, value: { stringValue: String(value) } })),
+          attributes: Object.entries(publicRow(row)).map(([key, value]) => ({ key, value: { stringValue: String(value) } })),
         })),
       }],
     }],
@@ -317,30 +468,78 @@ export function toOtlpLogs(rows) {
 }
 
 export function previewNextUpload({ statePaths, endpoint = TELEMETRY_ENDPOINT, max = DEFAULT_BATCH_MAX } = {}) {
-  const rows = loadBatch({ statePaths, max });
+  const rows = loadBatch({ statePaths, max, lease: false });
   return { url: endpoint, headers: { 'content-type': 'application/json' }, body: toOtlpLogs(rows) };
 }
 
-/** Uploads at most one batch. Every failure mode (timeout, network error, non-2xx) is
- *  swallowed and reported as `sent: 0` — telemetry must never throw into, or change the
- *  outcome of, the hook or proxy call that triggered a day close. */
-export async function flushQueue({ statePaths, endpoint = TELEMETRY_ENDPOINT, max = DEFAULT_BATCH_MAX, timeoutMs = 3000 } = {}) {
-  const rows = loadBatch({ statePaths, max });
-  if (rows.length === 0) return { sent: 0 };
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const response = await fetch(endpoint, {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify(toOtlpLogs(rows)), signal: controller.signal,
-    });
-    if (!response.ok) return { sent: 0 };
-    ackBatch({ statePaths, count: rows.length });
-    return { sent: rows.length };
-  } catch {
-    return { sent: 0 };
-  } finally {
-    clearTimeout(timer);
+/** Drains eligible batches. Every failure mode is swallowed and reported without
+ * changing the outcome of the hook or proxy call that triggered the flush. */
+function retryAfterMs(response, now) {
+  const value = response.headers?.get?.('retry-after');
+  if (!value) return 0;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1000);
+  const timestamp = Date.parse(value);
+  return Number.isNaN(timestamp) ? 0 : Math.max(0, timestamp - now);
+}
+
+function updateClaimedRows({ statePaths, leaseId, update }) {
+  withLock(`${statePaths.queue}.lock`, () => {
+    const rows = readQueueRows(statePaths.queue);
+    for (const row of rows) if (row._leaseId === leaseId) update(row);
+    writeQueueRows(statePaths.queue, rows);
+  });
+}
+
+function isRetryableStatus(status) { return [429, 502, 503, 504].includes(status); }
+
+export async function flushQueue({
+  statePaths, endpoint = TELEMETRY_ENDPOINT, max = DEFAULT_BATCH_MAX, timeoutMs = 3000,
+  fetchImpl = fetch, now = Date.now, random = Math.random, sleep = async () => {},
+} = {}) {
+  const result = { sent: 0, rejectedLogRecords: 0 };
+  while (true) {
+    const rows = claimBatch({ statePaths, max, now });
+    if (rows.length === 0) return result;
+    const leaseId = rows[0]._leaseId;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const response = await fetchImpl(endpoint, {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(toOtlpLogs(rows)), signal: controller.signal,
+      });
+      if (response.ok) {
+        let body = {};
+        try { body = await response.json(); } catch { /* empty 2xx body */ }
+        result.rejectedLogRecords += Number(body?.partialSuccess?.rejectedLogRecords || 0);
+        ackBatch({ statePaths, count: rows.length, leaseId });
+        result.sent += rows.length;
+      } else if (isRetryableStatus(response.status)) {
+        updateClaimedRows({ statePaths, leaseId, update: (row) => {
+          const attempt = (row._attemptCount ?? 0) + 1;
+          const base = RETRY_DELAYS_MS[Math.min(attempt - 1, RETRY_DELAYS_MS.length - 1)];
+          row._attemptCount = attempt;
+          row._nextAttemptAt = now() + Math.max(base * random(), retryAfterMs(response, now()));
+          delete row._leaseId; delete row._leaseUntil;
+        }});
+        return result;
+      } else {
+        ackBatch({ statePaths, count: rows.length, leaseId });
+      }
+    } catch {
+      updateClaimedRows({ statePaths, leaseId, update: (row) => {
+        const attempt = (row._attemptCount ?? 0) + 1;
+        const base = RETRY_DELAYS_MS[Math.min(attempt - 1, RETRY_DELAYS_MS.length - 1)];
+        row._attemptCount = attempt;
+        row._nextAttemptAt = now() + base * random();
+        delete row._leaseId; delete row._leaseUntil;
+      }});
+      return result;
+    } finally {
+      clearTimeout(timer);
+    }
+    await sleep(0);
   }
 }
 
@@ -350,6 +549,7 @@ export function disableTelemetry({ configPath = defaultTelemetryConfigPath(), pu
     schema_version: TELEMETRY_CONFIG_VERSION,
     enabled: false,
     prompted_consent_version: previous.prompted_consent_version || CONSENT_VERSION,
+    consent_state: 'declined',
   });
   if (purge) {
     for (const target of [statePaths.counters, statePaths.queue]) fs.rmSync(target, { force: true });

package/src/user-prompt-submit.mjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+import {
+  defaultTelemetryConfigPath, enableTelemetry, isDoNotTrack, readTelemetryConfig,
+} from './telemetry.mjs';
+
+const CONSENT_COMMANDS = new Map([
+  ['sando telemetry yes', 'yes'],
+  ['sando telemetry no', 'no'],
+]);
+
+function pass(stdout) { stdout.write('{}\n'); }
+
+export function runUserPromptSubmit({
+  env = process.env, input, stdout = process.stdout, configPath,
+} = {}) {
+  try {
+    if (isDoNotTrack(env)) {
+      pass(stdout);
+      return;
+    }
+    const telemetryConfigPath = configPath ?? defaultTelemetryConfigPath(env);
+    const rawInput = input === undefined ? fs.readFileSync(0, 'utf8') : input;
+    const prompt = JSON.parse(rawInput || '{}').prompt;
+    // Normalizza solo gli spazi ai bordi: non introduce ambiguita' (la stringa
+    // resta esatta) ed evita di perdere risposte genuine incollate con spazi.
+    const answer = typeof prompt === 'string' ? CONSENT_COMMANDS.get(prompt.trim()) : undefined;
+    if (!answer) {
+      pass(stdout);
+      return;
+    }
+    const current = readTelemetryConfig(telemetryConfigPath);
+    if (current.consent_state === 'declined' && answer === 'yes') {
+      pass(stdout);
+      return;
+    }
+    const result = enableTelemetry({ configPath: telemetryConfigPath, interactive: true, answer });
+    stdout.write(`${JSON.stringify({
+      systemMessage: result.enabled ? 'Sando telemetry enabled.' : 'Sando telemetry disabled.',
+    })}\n`);
+  } catch {
+    pass(stdout);
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+  runUserPromptSubmit();
+}

package/src/version.mjs

@@ -0,0 +1,29 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+const VERSION_PATTERN = /^\d+\.\d+(?:\.\d+)?$/;
+const STANDALONE_VERSION = '0.3.0';
+const METADATA_FILES = ['package.json', '.claude-plugin/plugin.json', '.codex-plugin/plugin.json'];
+
+function findMetadataFile() {
+  let directory = path.resolve(import.meta.dirname, '..');
+  while (true) {
+    for (const relativePath of METADATA_FILES) {
+      const file = path.join(directory, relativePath);
+      if (fs.existsSync(file)) return file;
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory) break;
+    directory = parent;
+  }
+  return null;
+}
+
+const metadataPath = findMetadataFile();
+const metadata = metadataPath ? JSON.parse(fs.readFileSync(metadataPath, 'utf8')) : { version: STANDALONE_VERSION };
+if (typeof metadata.version !== 'string' || !VERSION_PATTERN.test(metadata.version)) {
+  throw new Error(`Invalid Sando version in ${metadataPath}`);
+}
+
+// Evaluated once per process: no repeated filesystem reads in telemetry paths.
+export const PLUGIN_VERSION = metadata.version;