titan-agent 6.1.0-beta.1 → 6.1.0-beta.2

package/README.md

@@ -46,7 +46,7 @@
 
 ## 🪵 NEW in v6.1 — Mission Chat + Desk view
 
-> Status: `v6.1.0-beta.1` — live on npm at `@latest` and `@beta`. Alpha series concluded with `6.1.0-alpha.57`; we promoted the schema once features stabilized.
+> Status: `v6.1.0-beta.2` — live on npm at `@latest` and `@beta`. Alpha series concluded with `6.1.0-alpha.57`; the schema promoted to beta once features stabilized.
 > Install with `npm i -g titan-agent` (or `npm update -g titan-agent`).
 > The v6.0 "Presence" feature set below still applies — v6.1.0 layers
 > a beautiful new surface on top of it.

package/dist/analytics/consent.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+const REQUIRED_CONSENT_VERSION = 2;
+export {
+  REQUIRED_CONSENT_VERSION
+};
+//# sourceMappingURL=consent.js.map

package/dist/analytics/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/analytics/consent.ts"],"sourcesContent":["/**\n * TITAN — Telemetry Consent Version\n *\n * v6.1.0 Phase B (`6.1.0-beta.2`) — re-consent flow.\n *\n * The `REQUIRED_CONSENT_VERSION` constant is bumped each time the\n * telemetry payload or destination changes in a way that a previously-\n * consenting user should be re-prompted about. When a user's stored\n * `config.telemetry.consentVersion` is **less than** this number, the\n * CLI must re-prompt them (and default to OFF on any non-affirmative\n * answer — including Ctrl-C / blank / \"no\" / anything else).\n *\n * History\n * -------\n *   1 — v5.x SetupWizard opt-in (legacy `consentedAt` / `consentedVersion`).\n *   2 — v6.0+ payload: install ID + bucketed system fingerprint + feature\n *       flags + scrubbed crash stacks. Routes to PostHog Cloud (US or EU\n *       by IANA timezone). `posthog-node` SDK used instead of hand-rolled\n *       fetch. Local 30-day TTL on `~/.titan/bug-reports.jsonl`.\n *\n * Don't bump this number lightly — every bump re-prompts every existing\n * telemetry user and defaults them to OFF if they dismiss. Only bump\n * when the change is material enough that informed consent has expired\n * (new destination, new payload shape, new retention rules, etc.).\n */\nexport const REQUIRED_CONSENT_VERSION = 2;\n"],"mappings":";AAyBO,MAAM,2BAA2B;","names":[]}

package/dist/analytics/posthog.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { loadConfig } from "../config/config.js";
 import logger from "../utils/logger.js";
+import { redactSecrets } from "../security/secretGuard.js";
+import { REQUIRED_CONSENT_VERSION } from "./consent.js";
 const COMPONENT = "PostHog";
-let cachedKey;
-let cachedHost;
 const EU_TIMEZONE_REGEX = /^Europe\//;
 const EU_ADJACENT_ZONES = /* @__PURE__ */ new Set([
   "Atlantic/Azores",
@@ -28,64 +28,108 @@ function resolvePostHogHost(now) {
   }
   return "https://us.i.posthog.com";
 }
+function isHardDisabledByEnv() {
+  const v = process.env.TITAN_TELEMETRY_DISABLED;
+  return v === "1" || v === "true";
+}
 function getPostHogConfig() {
+  if (isHardDisabledByEnv()) return void 0;
   const cfg = loadConfig();
   const tel = cfg.telemetry;
   if (!tel?.enabled) return void 0;
+  const consentVersion = typeof tel.consentVersion === "number" ? tel.consentVersion : 0;
+  if (consentVersion < REQUIRED_CONSENT_VERSION) return void 0;
   const apiKey = process.env.TITAN_POSTHOG_KEY || tel.posthogApiKey || void 0;
   if (!apiKey) return void 0;
   const host = process.env.TITAN_POSTHOG_HOST || tel.posthogHost || resolvePostHogHost();
   return { apiKey, host };
 }
-async function capture(apiKey, host, distinctId, event, properties, timestamp) {
-  const url = `${host.replace(/\/$/, "")}/capture/`;
-  const body = {
-    api_key: apiKey,
-    event,
-    distinct_id: distinctId,
-    properties: {
-      ...properties,
-      // Mark these as TITAN-generated so PostHog filters work
-      $lib: "titan-analytics",
-      $lib_version: (await import("../utils/constants.js")).TITAN_VERSION
-    },
-    timestamp: timestamp || (/* @__PURE__ */ new Date()).toISOString()
+let _client = null;
+let _shutdownHooksInstalled = false;
+function installShutdownHooks() {
+  if (_shutdownHooksInstalled) return;
+  _shutdownHooksInstalled = true;
+  const shutdown = async () => {
+    if (!_client) return;
+    try {
+      await _client.shutdown();
+    } catch {
+    }
   };
-  const res = await fetch(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(body),
-    signal: AbortSignal.timeout(8e3)
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`PostHog HTTP ${res.status}: ${text.slice(0, 200)}`);
-  }
+  process.on("SIGTERM", shutdown);
+  process.on("SIGINT", shutdown);
+  process.on("beforeExit", shutdown);
 }
-async function identify(apiKey, host, distinctId, properties, timestamp) {
-  await capture(apiKey, host, distinctId, "$identify", {
-    $set: properties
-  }, timestamp);
+async function getClient() {
+  const cfg = getPostHogConfig();
+  if (!cfg) return null;
+  if (_client) return { client: _client, apiKey: cfg.apiKey, host: cfg.host };
+  const mod = await import("posthog-node");
+  const PostHog = mod.PostHog;
+  _client = new PostHog(cfg.apiKey, {
+    host: cfg.host,
+    // CLI-tuned: TITAN commands are usually short-lived. The SDK
+    // defaults (`flushAt: 20`, `flushInterval: 10000`) would delay
+    // events past process exit.
+    flushAt: 1,
+    flushInterval: 0,
+    // Explicitly pin geoip off — the SDK default is true but we want
+    // a hard guarantee that no IP-based geolocation is happening on
+    // our anonymous events. EU/US routing is already handled via
+    // `resolvePostHogHost()` from the local IANA timezone.
+    disableGeoip: true
+  });
+  installShutdownHooks();
+  return { client: _client, apiKey: cfg.apiKey, host: cfg.host };
 }
 const status = { enabled: false, sentCount: 0, failedCount: 0 };
 function getPostHogStatus() {
   return { ...status };
 }
+function scrubProps(props) {
+  const out = {};
+  for (const [k, v] of Object.entries(props)) {
+    if (typeof v === "string") {
+      out[k] = redactSecrets(v);
+    } else if (Array.isArray(v)) {
+      out[k] = v.map((item) => typeof item === "string" ? redactSecrets(item) : item);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
 async function sendPostHogEvent(payload) {
-  const cfg = getPostHogConfig();
-  if (!cfg) {
+  const handle = await getClient();
+  if (!handle) {
     status.enabled = false;
     return;
   }
   status.enabled = true;
-  const { apiKey, host } = cfg;
+  const { client } = handle;
   const distinctId = typeof payload.installId === "string" ? payload.installId : "unknown";
   const type = typeof payload.type === "string" ? payload.type : "unknown";
   const timestamp = typeof payload.timestamp === "string" ? payload.timestamp : typeof payload.collectedAt === "string" ? payload.collectedAt : void 0;
-  const ts = timestamp || (/* @__PURE__ */ new Date()).toISOString();
+  const tsDate = timestamp ? new Date(timestamp) : /* @__PURE__ */ new Date();
   try {
+    const { TITAN_VERSION } = await import("../utils/constants.js");
+    const baseProps = {
+      // Anonymous-by-default — no person profile created.
+      // Switch to identified capture (with `$set` / `$set_once`)
+      // only after an explicit `titan login` flow.
+      $process_person_profile: false,
+      $lib: "titan-analytics",
+      $lib_version: TITAN_VERSION
+    };
+    const send = (event, props) => {
+      client.capture({
+        distinctId,
+        event,
+        properties: scrubProps({ ...baseProps, ...props }),
+        timestamp: tsDate
+      });
+    };
     if (type === "system_profile") {
-      const personProps = {};
       const allowlist = [
         "os",
         "osRelease",
@@ -99,14 +143,11 @@ async function sendPostHogEvent(payload) {
         "version",
         "nodeVersion"
       ];
+      const props = {};
       for (const key of allowlist) {
-        if (key in payload) personProps[key] = payload[key];
+        if (key in payload) props[key] = payload[key];
       }
-      await identify(apiKey, host, distinctId, personProps, ts);
-      await capture(apiKey, host, distinctId, "system_profile", {
-        version: payload.version,
-        installMethod: payload.installMethod
-      }, ts);
+      send("system_profile", props);
     } else if (type === "heartbeat") {
       const props = {
         uptime_seconds: payload.uptimeSeconds,
@@ -119,22 +160,26 @@ async function sendPostHogEvent(payload) {
           props[`feature_${k}`] = v;
         }
       }
-      await capture(apiKey, host, distinctId, "heartbeat", props, ts);
+      send("heartbeat", props);
     } else if (type === "install" || type === "update") {
-      await capture(apiKey, host, distinctId, type, {
+      send(type, {
         version: payload.version,
         from_version: payload.fromVersion,
         install_method: payload.installMethod
-      }, ts);
+      });
     } else if (type === "error") {
-      await capture(apiKey, host, distinctId, "error", {
+      send("error", {
         error_type: payload.errorType,
         message: payload.message,
         version: payload.version
-      }, ts);
+      });
     } else {
       const { type: _type, installId: _installId, ...rest } = payload;
-      await capture(apiKey, host, distinctId, type, rest, ts);
+      send(type, rest);
+    }
+    try {
+      await client.flush?.();
+    } catch {
     }
     status.sentCount += 1;
     status.lastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -145,7 +190,12 @@ async function sendPostHogEvent(payload) {
     logger.debug(COMPONENT, `PostHog send failed: ${status.lastError}`);
   }
 }
+function _resetPostHogClientForTests() {
+  _client = null;
+  _shutdownHooksInstalled = false;
+}
 export {
+  _resetPostHogClientForTests,
   getPostHogStatus,
   resolvePostHogHost,
   sendPostHogEvent

package/dist/analytics/posthog.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/analytics/posthog.ts"],"sourcesContent":["/**\n * TITAN — PostHog Analytics Bridge\n * Sends opt-in telemetry events to PostHog Cloud (or self-hosted).\n * Only active when telemetry.enabled=true AND posthogApiKey is configured.\n */\nimport { loadConfig } from '../config/config.js';\nimport logger from '../utils/logger.js';\n\nconst COMPONENT = 'PostHog';\n\n// In-memory cache for config-derived client state\nlet cachedKey: string | undefined;\nlet cachedHost: string | undefined;\n\n/**\n * v6.1.0-beta.1 — env-var override + EU/US auto-detection.\n *\n * Precedence (highest first):\n *   1. `process.env.TITAN_POSTHOG_KEY`  → overrides project key\n *   2. `process.env.TITAN_POSTHOG_HOST` → overrides ingest host\n *   3. `telemetry.posthogApiKey` / `telemetry.posthogHost` from config\n *   4. EU/US auto-detection via IANA timezone (NO network / NO IP lookup —\n *      privacy-safe + offline-safe)\n *   5. US default\n *\n * EU detection (GDPR data-residency):\n *   `Intl.DateTimeFormat().resolvedOptions().timeZone` is consulted; if it\n *   starts with `Europe/`, or matches one of the EU-adjacent Atlantic /\n *   Africa zones (Azores, Canary, Faroe, Madeira, Reykjavik, Ceuta) the\n *   host resolves to `https://eu.i.posthog.com` (PostHog Cloud Frankfurt).\n *   Everything else routes to the US.\n *\n * Rationale: timezone is offline-resolvable, requires zero pre-consent\n * network calls, and is good-enough for \"is this user EU?\" at the\n * data-residency level. IP-based geolocation would be more precise but\n * costs a privacy hit + a network round-trip BEFORE consent is granted\n * — exactly what GDPR is trying to prevent.\n */\nconst EU_TIMEZONE_REGEX = /^Europe\\//;\nconst EU_ADJACENT_ZONES = new Set([\n    'Atlantic/Azores',\n    'Atlantic/Canary',\n    'Atlantic/Faroe',\n    'Atlantic/Madeira',\n    'Atlantic/Reykjavik',\n    'Africa/Ceuta',\n]);\n\nexport function resolvePostHogHost(now?: { timeZone?: string }): string {\n    if (process.env.TITAN_POSTHOG_HOST) return process.env.TITAN_POSTHOG_HOST;\n    const tz = (() => {\n        if (now?.timeZone) return now.timeZone;\n        try { return Intl.DateTimeFormat().resolvedOptions().timeZone; }\n        catch { return ''; }\n    })();\n    if (EU_TIMEZONE_REGEX.test(tz) || EU_ADJACENT_ZONES.has(tz)) {\n        return 'https://eu.i.posthog.com';\n    }\n    return 'https://us.i.posthog.com';\n}\n\nfunction getPostHogConfig(): { apiKey: string; host: string } | undefined {\n    const cfg = loadConfig();\n    const tel = cfg.telemetry as Record<string, unknown> | undefined;\n    if (!tel?.enabled) return undefined;\n    const apiKey = process.env.TITAN_POSTHOG_KEY || (tel.posthogApiKey as string) || undefined;\n    if (!apiKey) return undefined;\n    // env > config-explicit > auto-detected (EU vs US via timezone) > US default\n    // NOTE: env var must be checked here too — the test \"TITAN_POSTHOG_HOST\n    // overrides the schema host\" exercises the case where config has a\n    // non-empty default (which would otherwise short-circuit before\n    // resolvePostHogHost() is reached).\n    const host = process.env.TITAN_POSTHOG_HOST\n        || (tel.posthogHost as string)\n        || resolvePostHogHost();\n    return { apiKey, host };\n}\n\n/** Fire a single event to PostHog's /capture endpoint via fetch. */\nasync function capture(\n    apiKey: string,\n    host: string,\n    distinctId: string,\n    event: string,\n    properties: Record<string, unknown>,\n    timestamp?: string\n): Promise<void> {\n    const url = `${host.replace(/\\/$/, '')}/capture/`;\n    const body = {\n        api_key: apiKey,\n        event,\n        distinct_id: distinctId,\n        properties: {\n            ...properties,\n            // Mark these as TITAN-generated so PostHog filters work\n            $lib: 'titan-analytics',\n            $lib_version: (await import('../utils/constants.js')).TITAN_VERSION,\n        },\n        timestamp: timestamp || new Date().toISOString(),\n    };\n\n    const res = await fetch(url, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(body),\n        signal: AbortSignal.timeout(8000),\n    });\n\n    if (!res.ok) {\n        const text = await res.text().catch(() => '');\n        throw new Error(`PostHog HTTP ${res.status}: ${text.slice(0, 200)}`);\n    }\n}\n\n/** Send a $identify call with person properties (hardware profile). */\nasync function identify(\n    apiKey: string,\n    host: string,\n    distinctId: string,\n    properties: Record<string, unknown>,\n    timestamp?: string\n): Promise<void> {\n    await capture(apiKey, host, distinctId, '$identify', {\n        $set: properties,\n    }, timestamp);\n}\n\nexport interface PostHogSendStatus {\n    enabled: boolean;\n    sentCount: number;\n    failedCount: number;\n    lastError?: string;\n    lastSuccessAt?: string;\n}\n\nconst status: PostHogSendStatus = { enabled: false, sentCount: 0, failedCount: 0 };\n\nexport function getPostHogStatus(): PostHogSendStatus {\n    return { ...status };\n}\n\n/**\n * Map a TITAN analytics payload to PostHog event(s) and send.\n * This is best-effort: failures are logged but not thrown.\n */\nexport async function sendPostHogEvent(payload: Record<string, unknown>): Promise<void> {\n    const cfg = getPostHogConfig();\n    if (!cfg) {\n        status.enabled = false;\n        return;\n    }\n\n    status.enabled = true;\n    const { apiKey, host } = cfg;\n    const distinctId = typeof payload.installId === 'string' ? payload.installId : 'unknown';\n    const type = typeof payload.type === 'string' ? payload.type : 'unknown';\n    const timestamp = typeof payload.timestamp === 'string'\n        ? payload.timestamp\n        : typeof payload.collectedAt === 'string'\n            ? payload.collectedAt\n            : undefined;\n\n    const ts = timestamp || new Date().toISOString();\n    try {\n        if (type === 'system_profile') {\n            // Hardware specs become person properties so we can segment by GPU, OS, etc.\n            const personProps: Record<string, unknown> = {};\n            const allowlist = [\n                'os', 'osRelease', 'arch', 'cpuCores',\n                'ramTotalGB', 'gpuVendor', 'gpuVramGB',\n                'installMethod', 'diskTotalGB', 'version', 'nodeVersion',\n            ];\n            for (const key of allowlist) {\n                if (key in payload) personProps[key] = payload[key];\n            }\n            await identify(apiKey, host, distinctId, personProps, ts);\n\n            // Also fire a lightweight system_profile event for funnels\n            await capture(apiKey, host, distinctId, 'system_profile', {\n                version: payload.version,\n                installMethod: payload.installMethod,\n            }, ts);\n        } else if (type === 'heartbeat') {\n            const props: Record<string, unknown> = {\n                uptime_seconds: payload.uptimeSeconds,\n                active_sessions: payload.activeSessions,\n                version: payload.version,\n            };\n            if (payload.features) {\n                const f = payload.features as Record<string, unknown>;\n                for (const [k, v] of Object.entries(f)) {\n                    props[`feature_${k}`] = v;\n                }\n            }\n            await capture(apiKey, host, distinctId, 'heartbeat', props, ts);\n        } else if (type === 'install' || type === 'update') {\n            await capture(apiKey, host, distinctId, type, {\n                version: payload.version,\n                from_version: payload.fromVersion,\n                install_method: payload.installMethod,\n            }, ts);\n        } else if (type === 'error') {\n            await capture(apiKey, host, distinctId, 'error', {\n                error_type: payload.errorType,\n                message: payload.message,\n                version: payload.version,\n            }, ts);\n        } else {\n            // Passthrough for any future event types\n            const { type: _type, installId: _installId, ...rest } = payload;\n            await capture(apiKey, host, distinctId, type, rest, ts);\n        }\n\n        status.sentCount += 1;\n        status.lastSuccessAt = new Date().toISOString();\n        status.lastError = undefined;\n    } catch (err) {\n        status.failedCount += 1;\n        status.lastError = (err as Error).message || String(err);\n        logger.debug(COMPONENT, `PostHog send failed: ${status.lastError}`);\n    }\n}\n"],"mappings":";AAKA,SAAS,kBAAkB;AAC3B,OAAO,YAAY;AAEnB,MAAM,YAAY;AAGlB,IAAI;AACJ,IAAI;AA0BJ,MAAM,oBAAoB;AAC1B,MAAM,oBAAoB,oBAAI,IAAI;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;AAEM,SAAS,mBAAmB,KAAqC;AACpE,MAAI,QAAQ,IAAI,mBAAoB,QAAO,QAAQ,IAAI;AACvD,QAAM,MAAM,MAAM;AACd,QAAI,KAAK,SAAU,QAAO,IAAI;AAC9B,QAAI;AAAE,aAAO,KAAK,eAAe,EAAE,gBAAgB,EAAE;AAAA,IAAU,QACzD;AAAE,aAAO;AAAA,IAAI;AAAA,EACvB,GAAG;AACH,MAAI,kBAAkB,KAAK,EAAE,KAAK,kBAAkB,IAAI,EAAE,GAAG;AACzD,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAEA,SAAS,mBAAiE;AACtE,QAAM,MAAM,WAAW;AACvB,QAAM,MAAM,IAAI;AAChB,MAAI,CAAC,KAAK,QAAS,QAAO;AAC1B,QAAM,SAAS,QAAQ,IAAI,qBAAsB,IAAI,iBAA4B;AACjF,MAAI,CAAC,OAAQ,QAAO;AAMpB,QAAM,OAAO,QAAQ,IAAI,sBACjB,IAAI,eACL,mBAAmB;AAC1B,SAAO,EAAE,QAAQ,KAAK;AAC1B;AAGA,eAAe,QACX,QACA,MACA,YACA,OACA,YACA,WACa;AACb,QAAM,MAAM,GAAG,KAAK,QAAQ,OAAO,EAAE,CAAC;AACtC,QAAM,OAAO;AAAA,IACT,SAAS;AAAA,IACT;AAAA,IACA,aAAa;AAAA,IACb,YAAY;AAAA,MACR,GAAG;AAAA;AAAA,MAEH,MAAM;AAAA,MACN,eAAe,MAAM,OAAO,uBAAuB,GAAG;AAAA,IAC1D;AAAA,IACA,WAAW,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnD;AAEA,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IACzB,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB,QAAQ,YAAY,QAAQ,GAAI;AAAA,EACpC,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACT,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,UAAM,IAAI,MAAM,gBAAgB,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,EAAE;AAAA,EACvE;AACJ;AAGA,eAAe,SACX,QACA,MACA,YACA,YACA,WACa;AACb,QAAM,QAAQ,QAAQ,MAAM,YAAY,aAAa;AAAA,IACjD,MAAM;AAAA,EACV,GAAG,SAAS;AAChB;AAUA,MAAM,SAA4B,EAAE,SAAS,OAAO,WAAW,GAAG,aAAa,EAAE;AAE1E,SAAS,mBAAsC;AAClD,SAAO,EAAE,GAAG,OAAO;AACvB;AAMA,eAAsB,iBAAiB,SAAiD;AACpF,QAAM,MAAM,iBAAiB;AAC7B,MAAI,CAAC,KAAK;AACN,WAAO,UAAU;AACjB;AAAA,EACJ;AAEA,SAAO,UAAU;AACjB,QAAM,EAAE,QAAQ,KAAK,IAAI;AACzB,QAAM,aAAa,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY;AAC/E,QAAM,OAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAC/D,QAAM,YAAY,OAAO,QAAQ,cAAc,WACzC,QAAQ,YACR,OAAO,QAAQ,gBAAgB,WAC3B,QAAQ,cACR;AAEV,QAAM,KAAK,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC/C,MAAI;AACA,QAAI,SAAS,kBAAkB;AAE3B,YAAM,cAAuC,CAAC;AAC9C,YAAM,YAAY;AAAA,QACd;AAAA,QAAM;AAAA,QAAa;AAAA,QAAQ;AAAA,QAC3B;AAAA,QAAc;AAAA,QAAa;AAAA,QAC3B;AAAA,QAAiB;AAAA,QAAe;AAAA,QAAW;AAAA,MAC/C;AACA,iBAAW,OAAO,WAAW;AACzB,YAAI,OAAO,QAAS,aAAY,GAAG,IAAI,QAAQ,GAAG;AAAA,MACtD;AACA,YAAM,SAAS,QAAQ,MAAM,YAAY,aAAa,EAAE;AAGxD,YAAM,QAAQ,QAAQ,MAAM,YAAY,kBAAkB;AAAA,QACtD,SAAS,QAAQ;AAAA,QACjB,eAAe,QAAQ;AAAA,MAC3B,GAAG,EAAE;AAAA,IACT,WAAW,SAAS,aAAa;AAC7B,YAAM,QAAiC;AAAA,QACnC,gBAAgB,QAAQ;AAAA,QACxB,iBAAiB,QAAQ;AAAA,QACzB,SAAS,QAAQ;AAAA,MACrB;AACA,UAAI,QAAQ,UAAU;AAClB,cAAM,IAAI,QAAQ;AAClB,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,CAAC,GAAG;AACpC,gBAAM,WAAW,CAAC,EAAE,IAAI;AAAA,QAC5B;AAAA,MACJ;AACA,YAAM,QAAQ,QAAQ,MAAM,YAAY,aAAa,OAAO,EAAE;AAAA,IAClE,WAAW,SAAS,aAAa,SAAS,UAAU;AAChD,YAAM,QAAQ,QAAQ,MAAM,YAAY,MAAM;AAAA,QAC1C,SAAS,QAAQ;AAAA,QACjB,cAAc,QAAQ;AAAA,QACtB,gBAAgB,QAAQ;AAAA,MAC5B,GAAG,EAAE;AAAA,IACT,WAAW,SAAS,SAAS;AACzB,YAAM,QAAQ,QAAQ,MAAM,YAAY,SAAS;AAAA,QAC7C,YAAY,QAAQ;AAAA,QACpB,SAAS,QAAQ;AAAA,QACjB,SAAS,QAAQ;AAAA,MACrB,GAAG,EAAE;AAAA,IACT,OAAO;AAEH,YAAM,EAAE,MAAM,OAAO,WAAW,YAAY,GAAG,KAAK,IAAI;AACxD,YAAM,QAAQ,QAAQ,MAAM,YAAY,MAAM,MAAM,EAAE;AAAA,IAC1D;AAEA,WAAO,aAAa;AACpB,WAAO,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAC9C,WAAO,YAAY;AAAA,EACvB,SAAS,KAAK;AACV,WAAO,eAAe;AACtB,WAAO,YAAa,IAAc,WAAW,OAAO,GAAG;AACvD,WAAO,MAAM,WAAW,wBAAwB,OAAO,SAAS,EAAE;AAAA,EACtE;AACJ;","names":[]}
+{"version":3,"sources":["../../src/analytics/posthog.ts"],"sourcesContent":["/**\n * TITAN — PostHog Analytics Bridge\n *\n * v6.1.0 Phase B (`6.1.0-beta.2`):\n *   - Migrated from hand-rolled `fetch()` to the official `posthog-node` SDK.\n *   - SDK is **lazy-imported** — `posthog-node` never enters memory until\n *     telemetry is enabled AND the user has consented to the current\n *     `REQUIRED_CONSENT_VERSION`. This is the GDPR \"no pre-consent network\n *     calls\" guarantee.\n *   - CLI-tuned init: `flushAt: 1`, `flushInterval: 0`, `disableGeoip: true`\n *     so events flush immediately on short-lived CLI invocations.\n *   - Graceful shutdown on `SIGTERM`, `SIGINT`, `beforeExit`.\n *   - `$process_person_profile: false` on every event by default — anonymous\n *     capture, no person profile is created. Identified capture (with\n *     `$set` / `$set_once`) will land in a later phase once `titan login`\n *     ships.\n *   - Preserves Phase A: env-var override (`TITAN_POSTHOG_KEY`,\n *     `TITAN_POSTHOG_HOST`), EU/US timezone-based resolver, secret scrubber\n *     on outbound payloads.\n *   - Honors `TITAN_TELEMETRY_DISABLED=1` (or `'true'`) — runtime kill switch\n *     that overrides any config state and short-circuits before any\n *     `posthog-node` import.\n */\nimport { loadConfig } from '../config/config.js';\nimport logger from '../utils/logger.js';\nimport { redactSecrets } from '../security/secretGuard.js';\nimport { REQUIRED_CONSENT_VERSION } from './consent.js';\n\nconst COMPONENT = 'PostHog';\n\n/**\n * v6.1.0-beta.1 — env-var override + EU/US auto-detection.\n *\n * Precedence (highest first):\n *   1. `process.env.TITAN_POSTHOG_KEY`  → overrides project key\n *   2. `process.env.TITAN_POSTHOG_HOST` → overrides ingest host\n *   3. `telemetry.posthogApiKey` / `telemetry.posthogHost` from config\n *   4. EU/US auto-detection via IANA timezone (NO network / NO IP lookup —\n *      privacy-safe + offline-safe)\n *   5. US default\n *\n * EU detection (GDPR data-residency):\n *   `Intl.DateTimeFormat().resolvedOptions().timeZone` is consulted; if it\n *   starts with `Europe/`, or matches one of the EU-adjacent Atlantic /\n *   Africa zones (Azores, Canary, Faroe, Madeira, Reykjavik, Ceuta) the\n *   host resolves to `https://eu.i.posthog.com` (PostHog Cloud Frankfurt).\n *   Everything else routes to the US.\n */\nconst EU_TIMEZONE_REGEX = /^Europe\\//;\nconst EU_ADJACENT_ZONES = new Set([\n    'Atlantic/Azores',\n    'Atlantic/Canary',\n    'Atlantic/Faroe',\n    'Atlantic/Madeira',\n    'Atlantic/Reykjavik',\n    'Africa/Ceuta',\n]);\n\nexport function resolvePostHogHost(now?: { timeZone?: string }): string {\n    if (process.env.TITAN_POSTHOG_HOST) return process.env.TITAN_POSTHOG_HOST;\n    const tz = (() => {\n        if (now?.timeZone) return now.timeZone;\n        try { return Intl.DateTimeFormat().resolvedOptions().timeZone; }\n        catch { return ''; }\n    })();\n    if (EU_TIMEZONE_REGEX.test(tz) || EU_ADJACENT_ZONES.has(tz)) {\n        return 'https://eu.i.posthog.com';\n    }\n    return 'https://us.i.posthog.com';\n}\n\n/**\n * Runtime kill switch. Honored before any consent / config check so an\n * operator can hard-disable telemetry without touching config files (CI,\n * sandboxes, ephemeral container runs, paranoid users).\n */\nfunction isHardDisabledByEnv(): boolean {\n    const v = process.env.TITAN_TELEMETRY_DISABLED;\n    return v === '1' || v === 'true';\n}\n\n/**\n * Read consent + config. Returns `undefined` if telemetry isn't supposed\n * to fire (disabled, no key, no consent for current version, hard env\n * kill). Caller MUST treat undefined as \"do nothing\" — no network, no\n * `posthog-node` import.\n */\nfunction getPostHogConfig(): { apiKey: string; host: string } | undefined {\n    if (isHardDisabledByEnv()) return undefined;\n    const cfg = loadConfig();\n    const tel = cfg.telemetry as Record<string, unknown> | undefined;\n    if (!tel?.enabled) return undefined;\n    // v6.1.0 Phase B — re-consent gate. If the user hasn't agreed to the\n    // current payload generation, treat as opted-out until the CLI\n    // re-prompts and bumps consentVersion.\n    const consentVersion = typeof tel.consentVersion === 'number' ? tel.consentVersion : 0;\n    if (consentVersion < REQUIRED_CONSENT_VERSION) return undefined;\n    const apiKey = process.env.TITAN_POSTHOG_KEY || (tel.posthogApiKey as string) || undefined;\n    if (!apiKey) return undefined;\n    const host = process.env.TITAN_POSTHOG_HOST\n        || (tel.posthogHost as string)\n        || resolvePostHogHost();\n    return { apiKey, host };\n}\n\n// ── Lazy SDK client ────────────────────────────────────────────────\n//\n// `posthog-node` must NOT be imported at module load. It's only pulled in\n// the first time a send is attempted AND only after consent + enabled\n// checks pass. Once instantiated the client is reused for the lifetime\n// of the process.\n\n// Use a structural type so we don't import `PostHog` at module load. The\n// real type comes in via dynamic `await import('posthog-node')`.\ninterface MinimalPostHogClient {\n    capture(props: {\n        distinctId: string;\n        event: string;\n        properties?: Record<string, unknown>;\n        timestamp?: Date;\n    }): unknown;\n    shutdown(): Promise<void> | unknown;\n    flush?(): Promise<void> | unknown;\n}\n\nlet _client: MinimalPostHogClient | null = null;\nlet _shutdownHooksInstalled = false;\n\n/**\n * Install graceful-shutdown hooks once per process so queued events\n * aren't dropped on `SIGTERM` / `SIGINT` / `beforeExit`. PostHog docs\n * explicitly require `await posthog.shutdown()` before process exit.\n */\nfunction installShutdownHooks(): void {\n    if (_shutdownHooksInstalled) return;\n    _shutdownHooksInstalled = true;\n    const shutdown = async () => {\n        if (!_client) return;\n        try {\n            await _client.shutdown();\n        } catch {\n            /* never let telemetry shutdown itself crash exit */\n        }\n    };\n    process.on('SIGTERM', shutdown);\n    process.on('SIGINT', shutdown);\n    process.on('beforeExit', shutdown);\n}\n\n/**\n * Lazy SDK accessor. Returns `null` if telemetry is off or unconfigured.\n * The `posthog-node` module is only `import()`-ed inside the success\n * branch, so a user who never opts in has the module out of their\n * `require.cache` entirely.\n */\nasync function getClient(): Promise<{\n    client: MinimalPostHogClient;\n    apiKey: string;\n    host: string;\n} | null> {\n    const cfg = getPostHogConfig();\n    if (!cfg) return null;\n    if (_client) return { client: _client, apiKey: cfg.apiKey, host: cfg.host };\n\n    // Lazy import — first place `posthog-node` enters memory.\n    const mod = await import('posthog-node');\n    const PostHog = (mod as unknown as { PostHog: new (key: string, opts: Record<string, unknown>) => MinimalPostHogClient }).PostHog;\n    _client = new PostHog(cfg.apiKey, {\n        host: cfg.host,\n        // CLI-tuned: TITAN commands are usually short-lived. The SDK\n        // defaults (`flushAt: 20`, `flushInterval: 10000`) would delay\n        // events past process exit.\n        flushAt: 1,\n        flushInterval: 0,\n        // Explicitly pin geoip off — the SDK default is true but we want\n        // a hard guarantee that no IP-based geolocation is happening on\n        // our anonymous events. EU/US routing is already handled via\n        // `resolvePostHogHost()` from the local IANA timezone.\n        disableGeoip: true,\n    });\n    installShutdownHooks();\n    return { client: _client, apiKey: cfg.apiKey, host: cfg.host };\n}\n\n// ── Status surface ─────────────────────────────────────────────────\n\nexport interface PostHogSendStatus {\n    enabled: boolean;\n    sentCount: number;\n    failedCount: number;\n    lastError?: string;\n    lastSuccessAt?: string;\n}\n\nconst status: PostHogSendStatus = { enabled: false, sentCount: 0, failedCount: 0 };\n\nexport function getPostHogStatus(): PostHogSendStatus {\n    return { ...status };\n}\n\n// ── Payload scrubbing ──────────────────────────────────────────────\n//\n// Defense-in-depth: callers (bugReports.ts, featureTracker.ts) already\n// scrub before handing payloads here, but anything string-shaped that\n// slips through gets caught here too. The local jsonl keeps the\n// un-scrubbed copy for operator review.\n\nfunction scrubProps(props: Record<string, unknown>): Record<string, unknown> {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(props)) {\n        if (typeof v === 'string') {\n            out[k] = redactSecrets(v);\n        } else if (Array.isArray(v)) {\n            out[k] = v.map(item => (typeof item === 'string' ? redactSecrets(item) : item));\n        } else {\n            out[k] = v;\n        }\n    }\n    return out;\n}\n\n/**\n * Map a TITAN analytics payload to PostHog event(s) and send.\n * Best-effort: failures are logged but never thrown.\n *\n * Anonymous capture default — every event sets `$process_person_profile:\n * false` so PostHog does NOT create a person profile. Events remain\n * queryable by `distinct_id` (the anonymous install UUID) for funnels /\n * retention, but no `$set` person properties accumulate. The hardware\n * fingerprint that used to flow through `$identify` is now sent as\n * regular event properties on a `system_profile` event.\n */\nexport async function sendPostHogEvent(payload: Record<string, unknown>): Promise<void> {\n    const handle = await getClient();\n    if (!handle) {\n        status.enabled = false;\n        return;\n    }\n\n    status.enabled = true;\n    const { client } = handle;\n    const distinctId = typeof payload.installId === 'string' ? payload.installId : 'unknown';\n    const type = typeof payload.type === 'string' ? payload.type : 'unknown';\n    const timestamp = typeof payload.timestamp === 'string'\n        ? payload.timestamp\n        : typeof payload.collectedAt === 'string'\n            ? payload.collectedAt\n            : undefined;\n\n    const tsDate = timestamp ? new Date(timestamp) : new Date();\n\n    try {\n        const { TITAN_VERSION } = await import('../utils/constants.js');\n        // Common properties stamped on every event so downstream PostHog\n        // filters can pivot by library + version without re-checking\n        // each event type.\n        const baseProps: Record<string, unknown> = {\n            // Anonymous-by-default — no person profile created.\n            // Switch to identified capture (with `$set` / `$set_once`)\n            // only after an explicit `titan login` flow.\n            $process_person_profile: false,\n            $lib: 'titan-analytics',\n            $lib_version: TITAN_VERSION,\n        };\n\n        const send = (event: string, props: Record<string, unknown>) => {\n            client.capture({\n                distinctId,\n                event,\n                properties: scrubProps({ ...baseProps, ...props }),\n                timestamp: tsDate,\n            });\n        };\n\n        if (type === 'system_profile') {\n            const allowlist = [\n                'os', 'osRelease', 'arch', 'cpuCores',\n                'ramTotalGB', 'gpuVendor', 'gpuVramGB',\n                'installMethod', 'diskTotalGB', 'version', 'nodeVersion',\n            ];\n            const props: Record<string, unknown> = {};\n            for (const key of allowlist) {\n                if (key in payload) props[key] = payload[key];\n            }\n            send('system_profile', props);\n        } else if (type === 'heartbeat') {\n            const props: Record<string, unknown> = {\n                uptime_seconds: payload.uptimeSeconds,\n                active_sessions: payload.activeSessions,\n                version: payload.version,\n            };\n            if (payload.features) {\n                const f = payload.features as Record<string, unknown>;\n                for (const [k, v] of Object.entries(f)) {\n                    props[`feature_${k}`] = v;\n                }\n            }\n            send('heartbeat', props);\n        } else if (type === 'install' || type === 'update') {\n            send(type, {\n                version: payload.version,\n                from_version: payload.fromVersion,\n                install_method: payload.installMethod,\n            });\n        } else if (type === 'error') {\n            send('error', {\n                error_type: payload.errorType,\n                message: payload.message,\n                version: payload.version,\n            });\n        } else {\n            // Passthrough for any future event types\n            const { type: _type, installId: _installId, ...rest } = payload;\n            send(type, rest);\n        }\n\n        // flushAt=1 means each capture flushes immediately, but call\n        // flush() defensively in case the user is on a gateway runtime\n        // that overrode the CLI defaults.\n        try { await client.flush?.(); } catch { /* ignore */ }\n\n        status.sentCount += 1;\n        status.lastSuccessAt = new Date().toISOString();\n        status.lastError = undefined;\n    } catch (err) {\n        status.failedCount += 1;\n        status.lastError = (err as Error).message || String(err);\n        logger.debug(COMPONENT, `PostHog send failed: ${status.lastError}`);\n    }\n}\n\n/**\n * Test-only: reset the lazy client + shutdown-hook installation flag.\n * Real CLI flow keeps the client alive for the process lifetime. Used by\n * `tests/v610-posthog-lazy-require.test.ts` to verify the module isn't\n * imported until consent + enabled gates pass.\n */\nexport function _resetPostHogClientForTests(): void {\n    _client = null;\n    _shutdownHooksInstalled = false;\n}\n"],"mappings":";AAuBA,SAAS,kBAAkB;AAC3B,OAAO,YAAY;AACnB,SAAS,qBAAqB;AAC9B,SAAS,gCAAgC;AAEzC,MAAM,YAAY;AAoBlB,MAAM,oBAAoB;AAC1B,MAAM,oBAAoB,oBAAI,IAAI;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,CAAC;AAEM,SAAS,mBAAmB,KAAqC;AACpE,MAAI,QAAQ,IAAI,mBAAoB,QAAO,QAAQ,IAAI;AACvD,QAAM,MAAM,MAAM;AACd,QAAI,KAAK,SAAU,QAAO,IAAI;AAC9B,QAAI;AAAE,aAAO,KAAK,eAAe,EAAE,gBAAgB,EAAE;AAAA,IAAU,QACzD;AAAE,aAAO;AAAA,IAAI;AAAA,EACvB,GAAG;AACH,MAAI,kBAAkB,KAAK,EAAE,KAAK,kBAAkB,IAAI,EAAE,GAAG;AACzD,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAOA,SAAS,sBAA+B;AACpC,QAAM,IAAI,QAAQ,IAAI;AACtB,SAAO,MAAM,OAAO,MAAM;AAC9B;AAQA,SAAS,mBAAiE;AACtE,MAAI,oBAAoB,EAAG,QAAO;AAClC,QAAM,MAAM,WAAW;AACvB,QAAM,MAAM,IAAI;AAChB,MAAI,CAAC,KAAK,QAAS,QAAO;AAI1B,QAAM,iBAAiB,OAAO,IAAI,mBAAmB,WAAW,IAAI,iBAAiB;AACrF,MAAI,iBAAiB,yBAA0B,QAAO;AACtD,QAAM,SAAS,QAAQ,IAAI,qBAAsB,IAAI,iBAA4B;AACjF,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,OAAO,QAAQ,IAAI,sBACjB,IAAI,eACL,mBAAmB;AAC1B,SAAO,EAAE,QAAQ,KAAK;AAC1B;AAsBA,IAAI,UAAuC;AAC3C,IAAI,0BAA0B;AAO9B,SAAS,uBAA6B;AAClC,MAAI,wBAAyB;AAC7B,4BAA0B;AAC1B,QAAM,WAAW,YAAY;AACzB,QAAI,CAAC,QAAS;AACd,QAAI;AACA,YAAM,QAAQ,SAAS;AAAA,IAC3B,QAAQ;AAAA,IAER;AAAA,EACJ;AACA,UAAQ,GAAG,WAAW,QAAQ;AAC9B,UAAQ,GAAG,UAAU,QAAQ;AAC7B,UAAQ,GAAG,cAAc,QAAQ;AACrC;AAQA,eAAe,YAIL;AACN,QAAM,MAAM,iBAAiB;AAC7B,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,QAAS,QAAO,EAAE,QAAQ,SAAS,QAAQ,IAAI,QAAQ,MAAM,IAAI,KAAK;AAG1E,QAAM,MAAM,MAAM,OAAO,cAAc;AACvC,QAAM,UAAW,IAAyG;AAC1H,YAAU,IAAI,QAAQ,IAAI,QAAQ;AAAA,IAC9B,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA,IAIV,SAAS;AAAA,IACT,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA,IAKf,cAAc;AAAA,EAClB,CAAC;AACD,uBAAqB;AACrB,SAAO,EAAE,QAAQ,SAAS,QAAQ,IAAI,QAAQ,MAAM,IAAI,KAAK;AACjE;AAYA,MAAM,SAA4B,EAAE,SAAS,OAAO,WAAW,GAAG,aAAa,EAAE;AAE1E,SAAS,mBAAsC;AAClD,SAAO,EAAE,GAAG,OAAO;AACvB;AASA,SAAS,WAAW,OAAyD;AACzE,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AACxC,QAAI,OAAO,MAAM,UAAU;AACvB,UAAI,CAAC,IAAI,cAAc,CAAC;AAAA,IAC5B,WAAW,MAAM,QAAQ,CAAC,GAAG;AACzB,UAAI,CAAC,IAAI,EAAE,IAAI,UAAS,OAAO,SAAS,WAAW,cAAc,IAAI,IAAI,IAAK;AAAA,IAClF,OAAO;AACH,UAAI,CAAC,IAAI;AAAA,IACb;AAAA,EACJ;AACA,SAAO;AACX;AAaA,eAAsB,iBAAiB,SAAiD;AACpF,QAAM,SAAS,MAAM,UAAU;AAC/B,MAAI,CAAC,QAAQ;AACT,WAAO,UAAU;AACjB;AAAA,EACJ;AAEA,SAAO,UAAU;AACjB,QAAM,EAAE,OAAO,IAAI;AACnB,QAAM,aAAa,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY;AAC/E,QAAM,OAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAC/D,QAAM,YAAY,OAAO,QAAQ,cAAc,WACzC,QAAQ,YACR,OAAO,QAAQ,gBAAgB,WAC3B,QAAQ,cACR;AAEV,QAAM,SAAS,YAAY,IAAI,KAAK,SAAS,IAAI,oBAAI,KAAK;AAE1D,MAAI;AACA,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAuB;AAI9D,UAAM,YAAqC;AAAA;AAAA;AAAA;AAAA,MAIvC,yBAAyB;AAAA,MACzB,MAAM;AAAA,MACN,cAAc;AAAA,IAClB;AAEA,UAAM,OAAO,CAAC,OAAe,UAAmC;AAC5D,aAAO,QAAQ;AAAA,QACX;AAAA,QACA;AAAA,QACA,YAAY,WAAW,EAAE,GAAG,WAAW,GAAG,MAAM,CAAC;AAAA,QACjD,WAAW;AAAA,MACf,CAAC;AAAA,IACL;AAEA,QAAI,SAAS,kBAAkB;AAC3B,YAAM,YAAY;AAAA,QACd;AAAA,QAAM;AAAA,QAAa;AAAA,QAAQ;AAAA,QAC3B;AAAA,QAAc;AAAA,QAAa;AAAA,QAC3B;AAAA,QAAiB;AAAA,QAAe;AAAA,QAAW;AAAA,MAC/C;AACA,YAAM,QAAiC,CAAC;AACxC,iBAAW,OAAO,WAAW;AACzB,YAAI,OAAO,QAAS,OAAM,GAAG,IAAI,QAAQ,GAAG;AAAA,MAChD;AACA,WAAK,kBAAkB,KAAK;AAAA,IAChC,WAAW,SAAS,aAAa;AAC7B,YAAM,QAAiC;AAAA,QACnC,gBAAgB,QAAQ;AAAA,QACxB,iBAAiB,QAAQ;AAAA,QACzB,SAAS,QAAQ;AAAA,MACrB;AACA,UAAI,QAAQ,UAAU;AAClB,cAAM,IAAI,QAAQ;AAClB,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,CAAC,GAAG;AACpC,gBAAM,WAAW,CAAC,EAAE,IAAI;AAAA,QAC5B;AAAA,MACJ;AACA,WAAK,aAAa,KAAK;AAAA,IAC3B,WAAW,SAAS,aAAa,SAAS,UAAU;AAChD,WAAK,MAAM;AAAA,QACP,SAAS,QAAQ;AAAA,QACjB,cAAc,QAAQ;AAAA,QACtB,gBAAgB,QAAQ;AAAA,MAC5B,CAAC;AAAA,IACL,WAAW,SAAS,SAAS;AACzB,WAAK,SAAS;AAAA,QACV,YAAY,QAAQ;AAAA,QACpB,SAAS,QAAQ;AAAA,QACjB,SAAS,QAAQ;AAAA,MACrB,CAAC;AAAA,IACL,OAAO;AAEH,YAAM,EAAE,MAAM,OAAO,WAAW,YAAY,GAAG,KAAK,IAAI;AACxD,WAAK,MAAM,IAAI;AAAA,IACnB;AAKA,QAAI;AAAE,YAAM,OAAO,QAAQ;AAAA,IAAG,QAAQ;AAAA,IAAe;AAErD,WAAO,aAAa;AACpB,WAAO,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAC9C,WAAO,YAAY;AAAA,EACvB,SAAS,KAAK;AACV,WAAO,eAAe;AACtB,WAAO,YAAa,IAAc,WAAW,OAAO,GAAG;AACvD,WAAO,MAAM,WAAW,wBAAwB,OAAO,SAAS,EAAE;AAAA,EACtE;AACJ;AAQO,SAAS,8BAAoC;AAChD,YAAU;AACV,4BAA0B;AAC9B;","names":[]}

package/dist/cli/index.js

@@ -25,6 +25,9 @@ import { searchSkills, installSkill, installFromUrl } from "../skills/marketplac
 import { scaffoldSkill, testSkill } from "../skills/scaffold.js";
 import { createTeam, listTeams, getTeam, deleteTeam, addMember, removeMember, createInvite, acceptInvite, getTeamStats, updateMemberRole } from "../security/teams.js";
 import { checkForUpdates } from "../utils/updater.js";
+import { reconsentIfNeeded, runReconsent } from "./reconsent.js";
+import { REQUIRED_CONSENT_VERSION } from "../analytics/consent.js";
+import { resolvePostHogHost } from "../analytics/posthog.js";
 const program = new Command();
 program.name("titan").description(`${TITAN_FULL_NAME} \u2014 Your autonomous AI assistant`).version(TITAN_VERSION);
 program.command("onboard").description("Run the interactive setup wizard").option("--install-daemon", "Install as a system daemon (systemd/launchd)").action(async (options) => {
@@ -1176,6 +1179,54 @@ program.command("vault").description("Manage encrypted secrets vault").option("-
   }
   process.exit(0);
 });
+const telemetry = program.command("telemetry").description("Manage TITAN anonymous usage telemetry");
+telemetry.command("status").description("Show current telemetry state (enabled flag, host, consent version, install ID)").action(async () => {
+  const config = loadConfig();
+  const tel = config.telemetry || {};
+  const enabled = tel.enabled === true;
+  const consentVersion = typeof tel.consentVersion === "number" ? tel.consentVersion : 0;
+  const envKill = process.env.TITAN_TELEMETRY_DISABLED === "1" || process.env.TITAN_TELEMETRY_DISABLED === "true";
+  const effectiveEnabled = enabled && !envKill && consentVersion >= REQUIRED_CONSENT_VERSION;
+  const host = process.env.TITAN_POSTHOG_HOST || tel.posthogHost || resolvePostHogHost();
+  let installId = "unknown";
+  try {
+    const { getOrCreateNodeId } = await import("../mesh/identity.js");
+    installId = getOrCreateNodeId();
+  } catch {
+  }
+  console.log(chalk.cyan("\nTITAN Telemetry Status\n"));
+  console.log(`  enabled (config):     ${enabled ? chalk.green("true") : chalk.gray("false")}`);
+  console.log(`  effective:            ${effectiveEnabled ? chalk.green("ON") : chalk.gray("OFF")}`);
+  console.log(`  consent version:      ${consentVersion} / ${REQUIRED_CONSENT_VERSION} required`);
+  console.log(`  host:                 ${host}`);
+  console.log(`  install id:           ${installId}`);
+  if (envKill) {
+    console.log(chalk.yellow("\n  TITAN_TELEMETRY_DISABLED is set \u2014 telemetry is hard-disabled regardless of config."));
+  }
+  if (enabled && consentVersion < REQUIRED_CONSENT_VERSION) {
+    console.log(chalk.yellow(`
+  Re-consent required for v6 \u2014 run: ${chalk.cyan("titan telemetry enable")}`));
+  }
+  console.log("");
+  process.exit(0);
+});
+telemetry.command("enable").description("Opt in to anonymous telemetry (runs the v6 consent prompt)").action(async () => {
+  await runReconsent();
+  process.exit(0);
+});
+telemetry.command("disable").description("Opt out of anonymous telemetry").action(() => {
+  const config = loadConfig();
+  const nextTel = {
+    ...config.telemetry,
+    enabled: false,
+    // Stamp current version so we don't re-prompt them after they
+    // explicitly disabled — that would be obnoxious.
+    consentVersion: REQUIRED_CONSENT_VERSION
+  };
+  updateConfig({ telemetry: nextTel });
+  console.log(chalk.green("Telemetry disabled. No data leaves your machine."));
+  process.exit(0);
+});
 program.command("autopilot").description("Manage TITAN autopilot \u2014 hands-free scheduled agent runs").option("--init", "Create default AUTOPILOT.md checklist").option("--run", "Trigger an autopilot run immediately").option("--status", "Show autopilot schedule, last run, next run").option("--history", "Show recent autopilot run history").option("--limit <n>", "Number of history entries to show", "10").option("--enable", "Enable autopilot in config").option("--disable", "Disable autopilot in config").action(async (options) => {
   if (options.init) {
     const { initChecklist } = await import("../agent/autopilot.js");
@@ -1255,6 +1306,13 @@ Autopilot History (last ${runs.length} runs)
 (async () => {
   initFileLogger(TITAN_LOGS_DIR);
   await checkForUpdates();
+  const skipReconsent = process.env.TITAN_TELEMETRY_DISABLED === "1" || process.env.TITAN_TELEMETRY_DISABLED === "true" || process.argv[2] === "telemetry";
+  if (!skipReconsent) {
+    try {
+      await reconsentIfNeeded();
+    } catch {
+    }
+  }
   await program.parseAsync();
 })().catch((err) => {
   console.error(err);