humanbound 2.0.3__tar.gz → 2.0.4__tar.gz

{humanbound-2.0.3 → humanbound-2.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: humanbound
-Version: 2.0.3
+Version: 2.0.4
 Summary: Humanbound — open-source AI agent red-team engine, SDK, and CLI.
 Author-email: Humanbound <hello@humanbound.ai>
 Maintainer-email: Demetris Gerogiannis <hello@humanbound.ai>, Kostas Siabanis <hello@humanbound.ai>
@@ -34,8 +34,8 @@ Requires-Dist: rich>=13.0.0
 Requires-Dist: requests>=2.32.0
 Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: pydantic>=2.0
-Requires-Dist: msal>=1.31.0
 Requires-Dist: pyperclip>=1.8.0
+Requires-Dist: posthog>=3.0
 Provides-Extra: engine
 Requires-Dist: openai>=1.0.0; extra == "engine"
 Requires-Dist: anthropic>=0.20.0; extra == "engine"
@@ -58,6 +58,7 @@ Requires-Dist: mypy>=1.11; extra == "dev"
 Requires-Dist: build>=1.2; extra == "dev"
 Requires-Dist: twine>=5.0; extra == "dev"
 Requires-Dist: pre-commit>=3.8; extra == "dev"
+Requires-Dist: mkdocs>=1.6; extra == "dev"
 Dynamic: license-file
 
 <p align="center">
@@ -188,6 +189,12 @@ loop, release process, and CLA requirement (see [CLA.md](./CLA.md)).
 - 🔒 [Report a security issue](./SECURITY.md) — **not via public Issues**
 - 💬 [Join Discord](https://discord.gg/gQyXjVBF)
 
+## Telemetry
+
+The `hb` CLI sends anonymous usage data to help us improve it.
+Disable with `hb telemetry disable`, `HB_TELEMETRY_DISABLED=1`, or
+`DO_NOT_TRACK=1`. Full disclosure: [PRIVACY.md](./PRIVACY.md).
+
 ## License
 
 [Apache-2.0](./LICENSE). Free to use in any context — commercial or

{humanbound-2.0.3 → humanbound-2.0.4}/README.md

@@ -126,6 +126,12 @@ loop, release process, and CLA requirement (see [CLA.md](./CLA.md)).
 - 🔒 [Report a security issue](./SECURITY.md) — **not via public Issues**
 - 💬 [Join Discord](https://discord.gg/gQyXjVBF)
 
+## Telemetry
+
+The `hb` CLI sends anonymous usage data to help us improve it.
+Disable with `hb telemetry disable`, `HB_TELEMETRY_DISABLED=1`, or
+`DO_NOT_TRACK=1`. Full disclosure: [PRIVACY.md](./PRIVACY.md).
+
 ## License
 
 [Apache-2.0](./LICENSE). Free to use in any context — commercial or

{humanbound-2.0.3 → humanbound-2.0.4}/humanbound.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: humanbound
-Version: 2.0.3
+Version: 2.0.4
 Summary: Humanbound — open-source AI agent red-team engine, SDK, and CLI.
 Author-email: Humanbound <hello@humanbound.ai>
 Maintainer-email: Demetris Gerogiannis <hello@humanbound.ai>, Kostas Siabanis <hello@humanbound.ai>
@@ -34,8 +34,8 @@ Requires-Dist: rich>=13.0.0
 Requires-Dist: requests>=2.32.0
 Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: pydantic>=2.0
-Requires-Dist: msal>=1.31.0
 Requires-Dist: pyperclip>=1.8.0
+Requires-Dist: posthog>=3.0
 Provides-Extra: engine
 Requires-Dist: openai>=1.0.0; extra == "engine"
 Requires-Dist: anthropic>=0.20.0; extra == "engine"
@@ -58,6 +58,7 @@ Requires-Dist: mypy>=1.11; extra == "dev"
 Requires-Dist: build>=1.2; extra == "dev"
 Requires-Dist: twine>=5.0; extra == "dev"
 Requires-Dist: pre-commit>=3.8; extra == "dev"
+Requires-Dist: mkdocs>=1.6; extra == "dev"
 Dynamic: license-file
 
 <p align="center">
@@ -188,6 +189,12 @@ loop, release process, and CLA requirement (see [CLA.md](./CLA.md)).
 - 🔒 [Report a security issue](./SECURITY.md) — **not via public Issues**
 - 💬 [Join Discord](https://discord.gg/gQyXjVBF)
 
+## Telemetry
+
+The `hb` CLI sends anonymous usage data to help us improve it.
+Disable with `hb telemetry disable`, `HB_TELEMETRY_DISABLED=1`, or
+`DO_NOT_TRACK=1`. Full disclosure: [PRIVACY.md](./PRIVACY.md).
+
 ## License
 
 [Apache-2.0](./LICENSE). Free to use in any context — commercial or

{humanbound-2.0.3 → humanbound-2.0.4}/humanbound.egg-info/SOURCES.txt

@@ -50,13 +50,9 @@ humanbound_cli/commands/projects.py
 humanbound_cli/commands/providers.py
 humanbound_cli/commands/redteam.py
 humanbound_cli/commands/report.py
-humanbound_cli/commands/scan.py
-humanbound_cli/commands/sentinel.py
+humanbound_cli/commands/telemetry.py
 humanbound_cli/commands/test.py
-humanbound_cli/commands/upload_logs.py
 humanbound_cli/commands/webhooks.py
-humanbound_cli/connectors/__init__.py
-humanbound_cli/connectors/microsoft.py
 humanbound_cli/engine/__init__.py
 humanbound_cli/engine/bot.py
 humanbound_cli/engine/callbacks.py
@@ -97,6 +93,9 @@ humanbound_cli/extractors/repo.py
 humanbound_cli/pytest_plugin/__init__.py
 humanbound_cli/pytest_plugin/fixtures.py
 humanbound_cli/pytest_plugin/report.py
+humanbound_cli/telemetry/__init__.py
+humanbound_cli/telemetry/client.py
+humanbound_cli/telemetry/consent.py
 humanbound_cli/templates/logo.svg
 humanbound_cli/templates/report_base.html
 humanbound_cli/templates/compliance/banking.yaml

{humanbound-2.0.3 → humanbound-2.0.4}/humanbound.egg-info/requires.txt

@@ -3,8 +3,8 @@ rich>=13.0.0
 requests>=2.32.0
 pyyaml>=6.0.0
 pydantic>=2.0
-msal>=1.31.0
 pyperclip>=1.8.0
+posthog>=3.0
 
 [dev]
 pytest>=7.0.0
@@ -15,6 +15,7 @@ mypy>=1.11
 build>=1.2
 twine>=5.0
 pre-commit>=3.8
+mkdocs>=1.6
 
 [engine]
 openai>=1.0.0

{humanbound-2.0.3 → humanbound-2.0.4}/humanbound_cli/commands/__init__.py

@@ -23,9 +23,7 @@ from . import (
     projects,
     providers,
     report,
-    sentinel,
     test,
-    upload_logs,
     webhooks,
 )
 
@@ -50,8 +48,6 @@ __all__ = [
     "api_keys",
     "members",
     "campaigns",
-    "upload_logs",
-    "sentinel",
     "completion",
     "connect",
     "report",

{humanbound-2.0.3 → humanbound-2.0.4}/humanbound_cli/commands/api_keys.py

@@ -10,6 +10,7 @@ from rich.panel import Panel
 from rich.prompt import Confirm
 from rich.table import Table
 
+from .. import telemetry
 from ..client import HumanboundClient
 from ..exceptions import APIError, NotAuthenticatedError
 
@@ -38,6 +39,7 @@ def _list_keys(as_json: bool):
     client = HumanboundClient()
 
     if not client.is_authenticated():
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
 
@@ -106,6 +108,7 @@ def create_key(name: str, scopes: str):
     client = HumanboundClient()
 
     if not client.is_authenticated():
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
 
@@ -152,6 +155,7 @@ def update_key(key_id: str, name: str, scopes: str, active):
     client = HumanboundClient()
 
     if not client.is_authenticated():
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
 
@@ -198,6 +202,7 @@ def revoke_key(key_id: str, force: bool):
     client = HumanboundClient()
 
     if not client.is_authenticated():
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
 

{humanbound-2.0.3 → humanbound-2.0.4}/humanbound_cli/commands/assessments.py

@@ -9,6 +9,7 @@ from rich.console import Console
 from rich.panel import Panel
 from rich.table import Table
 
+from .. import telemetry
 from ..client import HumanboundClient
 from ..exceptions import APIError, NotAuthenticatedError
 
@@ -53,6 +54,7 @@ def assessments_group(ctx, page, size, as_json):
     client = HumanboundClient()
 
     if not client.is_authenticated():
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
 
@@ -132,6 +134,7 @@ def show_assessment(assessment_id: str, as_json: bool):
     client = HumanboundClient()
 
     if not client.is_authenticated():
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
 

{humanbound-2.0.3 → humanbound-2.0.4}/humanbound_cli/commands/auth.py

@@ -6,6 +6,7 @@ import click
 from rich.console import Console
 from rich.panel import Panel
 
+from .. import telemetry
 from ..client import HumanboundClient
 from ..config import DEFAULT_BASE_URL
 from ..exceptions import AuthenticationError
@@ -44,6 +45,8 @@ def login(base_url: str, port: int, force: bool):
         console.print("Starting authentication...")
         client.login(callback_port=port)
 
+        telemetry.identify_from_credentials()
+
         # Auto-select default organisation and resolve name
         org_display = "not set"
         if client.default_organisation_id:

{humanbound-2.0.3 → humanbound-2.0.4}/humanbound_cli/commands/campaigns.py

@@ -10,6 +10,7 @@ from rich.panel import Panel
 from rich.prompt import Confirm
 from rich.table import Table
 
+from .. import telemetry
 from ..client import HumanboundClient
 from ..exceptions import APIError, NotAuthenticatedError
 
@@ -40,6 +41,7 @@ def campaigns_group(ctx, as_json):
     client = HumanboundClient()
 
     if not client.is_authenticated():
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
 
@@ -136,6 +138,7 @@ def terminate_campaign(force: bool):
     client = HumanboundClient()
 
     if not client.is_authenticated():
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
 

{humanbound-2.0.3 → humanbound-2.0.4}/humanbound_cli/commands/connect.py

@@ -13,6 +13,7 @@ import click
 from rich.console import Console
 from rich.panel import Panel
 
+from .. import telemetry
 from ..client import HumanboundClient
 from ..exceptions import APIError, NotAuthenticatedError
 from .test import _load_integration, _resolve_context
@@ -226,6 +227,30 @@ def _get_source_description(prompt: str, endpoint: str, repo: str, openapi: str)
     return ", ".join(sources)
 
 
+def _resolve_init_mode(
+    endpoint: str | None,
+    prompt: str | None,
+    repo: str | None,
+    openapi: str | None,
+) -> str:
+    """Derive the `init` telemetry mode from the CLI flags."""
+    if endpoint:
+        return "endpoint"
+    if prompt:
+        return "text"
+    if repo or openapi:
+        return "agentic"
+    return "none"
+
+
+def _fire_init_event(mode: str, success: bool, duration_ms: int) -> None:
+    """Emit the `init` telemetry event. Safe to call from try/finally."""
+    telemetry.capture(
+        "init",
+        {"mode": mode, "success": success, "duration_ms": duration_ms},
+    )
+
+
 def _print_next(suggestions: list):
     """Print Next: suggestions block."""
     console.print("\n[dim]Next:[/dim]")
@@ -297,24 +322,11 @@ def _derive_agent_name(endpoint: str) -> str:
 
 
 @click.command("connect")
-@click.option("--endpoint", "-e", help="Agent config JSON or file path (agent path)")
-@click.option(
-    "--vendor",
-    "-v",
-    type=click.Choice(["microsoft"]),
-    help="Cloud vendor to scan (platform path)",
-)
+@click.option("--endpoint", "-e", help="Agent config JSON or file path")
 @click.option("--name", "-n", help="Project name (optional, auto-generated)")
-@click.option(
-    "--prompt", "-p", type=click.Path(exists=True), help="System prompt file (agent path)"
-)
-@click.option("--repo", "-r", type=click.Path(exists=True), help="Repository path (agent path)")
-@click.option(
-    "--openapi", "-o", type=click.Path(exists=True), help="OpenAPI spec file (agent path)"
-)
-@click.option("--tenant", help="Azure tenant ID (platform path, bypasses browser)")
-@click.option("--client-id", "client_id", help="Service principal client ID (platform path)")
-@click.option("--client-secret", "client_secret", help="Service principal secret (platform path)")
+@click.option("--prompt", "-p", type=click.Path(exists=True), help="System prompt file")
+@click.option("--repo", "-r", type=click.Path(exists=True), help="Repository path")
+@click.option("--openapi", "-o", type=click.Path(exists=True), help="OpenAPI spec file")
 @click.option(
     "--context",
     "-c",
@@ -331,63 +343,47 @@ def _derive_agent_name(endpoint: str) -> str:
 @click.option("--timeout", "-t", type=int, default=SCAN_TIMEOUT, help="Request timeout in seconds")
 def connect_command(
     endpoint,
-    vendor,
     name,
     prompt,
     repo,
     openapi,
-    tenant,
-    client_id,
-    client_secret,
     context,
     level,
     yes,
     timeout,
 ):
-    """Connect your AI agent or scan your cloud platform.
+    """Connect your AI agent.
 
-    Two paths, one command:
-
-    \b
-    Agent path (--endpoint):
-      hb connect --endpoint ./bot-config.json
-      Probes your agent, extracts scope, creates project, runs first test.
-
-    \b
-    Platform path (--vendor):
-      hb connect --vendor microsoft
-      Scans cloud for shadow AI, evaluates 39 signals, saves to inventory.
+    Probes your agent, extracts scope, creates a project, and runs the first test.
 
     \b
     Examples:
       hb connect --endpoint ./config.json
       hb connect --endpoint ./config.json --prompt ./system.txt
-      hb connect --vendor microsoft
-      hb connect --vendor microsoft --tenant abc-123 --client-id x --client-secret y
     """
-    has_agent_flags = any([endpoint, prompt, repo, openapi])
-    has_platform_flags = any([vendor, tenant, client_id, client_secret])
+    import time
 
-    if has_agent_flags and has_platform_flags:
-        console.print(
-            "[red]Cannot combine agent flags (--endpoint/--prompt/--repo/--openapi) with platform flags (--vendor/--tenant).[/red]"
-        )
-        raise SystemExit(1)
+    start = time.monotonic()
+    mode = _resolve_init_mode(endpoint, prompt, repo, openapi)
+    success = False
 
-    if has_platform_flags:
-        _connect_platform(vendor, name, tenant, client_id, client_secret, yes, timeout)
-    elif has_agent_flags:
-        _connect_agent(endpoint, name, prompt, repo, openapi, context, level, yes, timeout)
-    else:
-        console.print("[yellow]Specify a path:[/yellow]")
-        console.print()
-        console.print("  [bold]Agent:[/bold]      hb connect --endpoint ./bot-config.json")
-        console.print("  [bold]Platform:[/bold]  hb connect --vendor microsoft")
-        console.print()
-        console.print(
-            "[dim]Use --endpoint to connect your AI agent, or --vendor to scan your cloud.[/dim]"
-        )
-        raise SystemExit(1)
+    try:
+        has_agent_flags = any([endpoint, prompt, repo, openapi])
+
+        if has_agent_flags:
+            _connect_agent(endpoint, name, prompt, repo, openapi, context, level, yes, timeout)
+        else:
+            console.print("[yellow]Specify a source:[/yellow]")
+            console.print()
+            console.print("  hb connect --endpoint ./bot-config.json")
+            console.print()
+            console.print("[dim]Use --endpoint, --prompt, --repo, or --openapi.[/dim]")
+            raise SystemExit(1)
+
+        success = True
+    finally:
+        duration_ms = int((time.monotonic() - start) * 1000)
+        _fire_init_event(mode=mode, success=success, duration_ms=duration_ms)
 
 
 # -- Agent path ----------------------------------------------------------------
@@ -593,6 +589,7 @@ def _connect_agent_platform(
         )
 
     except NotAuthenticatedError:
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
     except APIError as e:
@@ -738,196 +735,6 @@ def _print_platform_note():
     )
 
 
-# -- Platform path -------------------------------------------------------------
-
-
-def _connect_platform(vendor, name, tenant, client_id, client_secret, yes, timeout):
-    """Platform path: scan -> assess -> auto-save -> show posture."""
-    from .discover import (
-        _display_auth_error,
-        _display_device_code,
-        _display_evaluations,
-        _display_persist_summary,
-        _display_results,
-        _get_connector,
-    )
-
-    client = HumanboundClient()
-
-    if not client.is_authenticated():
-        console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
-        raise SystemExit(1)
-
-    if not client.organisation_id:
-        console.print("[yellow]No organisation selected.[/yellow]")
-        console.print("Use 'hb switch <id>' to select an organisation first.")
-        raise SystemExit(1)
-
-    # Default vendor
-    if not vendor:
-        if any([tenant, client_id, client_secret]):
-            vendor = "microsoft"
-        else:
-            console.print("[red]--vendor is required for platform path.[/red]")
-            console.print("[dim]Example: hb connect --vendor microsoft[/dim]")
-            raise SystemExit(1)
-
-    # Validate service principal flags (all-or-none)
-    sp_flags = [tenant, client_id, client_secret]
-    if any(sp_flags) and not all(sp_flags):
-        console.print(
-            "[red]Service principal auth requires all three: --tenant, --client-id, --client-secret[/red]"
-        )
-        raise SystemExit(1)
-
-    console.print()
-    console.print(
-        Panel(
-            "[bold]AI Service Discovery[/bold]\n\n"
-            f"Vendor:  [bold]{vendor}[/bold]\n"
-            "Mode:    [bold]connect[/bold] (scan + assess + save)\n\n"
-            "This will:\n"
-            "  1. Sign in to your cloud tenant\n"
-            "  2. Scan for AI services [dim](read-only)[/dim]\n"
-            "  3. Assess against 38 security signals\n"
-            "  4. Save results to your AI inventory",
-            border_style="blue",
-        )
-    )
-    console.print()
-
-    if not yes:
-        if not click.confirm("Proceed with discovery?", default=True):
-            console.print("[dim]Cancelled.[/dim]")
-            return
-
-    console.print()
-
-    try:
-        # -- Authenticate ------------------------------------------------------
-        connector = _get_connector(vendor, verbose=False)
-
-        if all(sp_flags):
-            # Service principal auth (non-interactive)
-            console.print("[dim]Authenticating with service principal...[/dim]")
-            try:
-                connector.authenticate_sp(
-                    tenant_id=tenant,
-                    client_id=client_id,
-                    client_secret=client_secret,
-                )
-            except AttributeError:
-                console.print(
-                    "[yellow]Service principal auth not yet supported for this vendor.[/yellow]"
-                )
-                console.print("[dim]Use browser auth instead: hb connect --vendor microsoft[/dim]")
-                raise SystemExit(1)
-            except PermissionError as e:
-                console.print(f"[red]Authentication failed:[/red] {e}")
-                raise SystemExit(1)
-            console.print("[green]Authenticated via service principal.[/green]\n")
-        else:
-            # Browser device-code flow
-            try:
-                connector.authenticate(callback=_display_device_code)
-            except PermissionError as e:
-                _display_auth_error(str(e))
-                raise SystemExit(1)
-            console.print("[green]Signed in successfully.[/green]\n")
-
-        # -- Scan --------------------------------------------------------------
-        with console.status("[bold blue]Scanning for AI services..."):
-            services, metadata = connector.discover()
-
-        if not services:
-            status = metadata.get("status", "unknown")
-            if status == "failed":
-                console.print("[red]Discovery failed.[/red] Could not query any APIs.")
-            else:
-                console.print("[yellow]No AI services found.[/yellow]")
-            return
-
-        console.print(f"Found [bold]{len(services)}[/bold] AI services. Analysing...\n")
-
-        # -- Analyse -----------------------------------------------------------
-        org_id = client.organisation_id
-        payload = {
-            "vendor": vendor,
-            "services": services,
-            "sources_metadata": {
-                "status": metadata.get("status", "unknown"),
-                "apis_queried": metadata.get("apis_queried", []),
-                "apis_failed": metadata.get("apis_failed", []),
-                "permissions_missing": metadata.get("permissions_missing", []),
-            },
-            "topology": metadata.get("topology", {}),
-        }
-
-        with console.status("[bold blue]Analysing discovered services..."):
-            analysis = client.post(
-                f"organisations/{org_id}/analyse",
-                data=payload,
-                include_org=False,
-                timeout=timeout,
-            )
-
-        # -- Overlay evaluator risk onto services for consistent display -------
-        evals = analysis.get("evaluations", [])
-        if evals:
-            eval_risk_map = {
-                ev["service_name"]: ev["risk_level"]
-                for ev in evals
-                if "service_name" in ev and "risk_level" in ev
-            }
-            for svc in analysis.get("services", []):
-                eval_rl = eval_risk_map.get(svc.get("name"))
-                if eval_rl:
-                    svc["risk"] = eval_rl
-
-            new_by_risk = {}
-            for svc in analysis.get("services", []):
-                r = svc.get("risk", "unknown")
-                new_by_risk[r] = new_by_risk.get(r, 0) + 1
-            if "summary" in analysis:
-                analysis["summary"]["by_risk"] = new_by_risk
-
-        # -- Display -----------------------------------------------------------
-        _display_results(analysis, metadata)
-
-        evaluations = analysis.get("evaluations", [])
-        posture_estimate = analysis.get("posture_estimate")
-        if evaluations:
-            _display_evaluations(evaluations, posture_estimate)
-
-        # -- Auto-save (always persist in connect mode) ------------------------
-        nonce = analysis.get("nonce")
-        if nonce:
-            with console.status("[bold blue]Saving to inventory..."):
-                persist_result = client.persist_discovery(nonce)
-            _display_persist_summary(persist_result)
-        else:
-            console.print(
-                "\n[yellow]Cannot persist:[/yellow] server did not return a session token."
-            )
-
-        # -- Next suggestions --------------------------------------------------
-        _print_next(
-            [
-                ("hb inventory", "Browse all assets"),
-                ("hb posture --org", "Full org posture (3 dimensions)"),
-                ("hb report --org", "Org-wide report"),
-                ("hb discover --report", "Export HTML report"),
-            ]
-        )
-
-    except NotAuthenticatedError:
-        console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
-        raise SystemExit(1)
-    except APIError as e:
-        console.print(f"[red]Error:[/red] {e}")
-        raise SystemExit(1)
-
-
 # -- Monitoring recommendation -------------------------------------------------
 
 # Regulations that require or strongly recommend continuous AI monitoring

{humanbound-2.0.3 → humanbound-2.0.4}/humanbound_cli/commands/experiments.py

@@ -11,6 +11,7 @@ from rich.progress import Progress, SpinnerColumn, TextColumn
 from rich.prompt import Confirm
 from rich.table import Table
 
+from .. import telemetry
 from ..client import HumanboundClient
 from ..exceptions import APIError, NotAuthenticatedError
 
@@ -84,6 +85,7 @@ def _list_experiments(page: int, size: int):
             console.print(f"\n[dim]Page {page} of more. Use --page to navigate.[/dim]")
 
     except NotAuthenticatedError:
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
     except APIError as e:
@@ -149,6 +151,7 @@ def show_experiment(experiment_id: str):
                         console.print(f"    {i}. {insight.get('explanation', '')[:80]}...")
 
     except NotAuthenticatedError:
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
     except APIError as e:
@@ -227,6 +230,7 @@ def experiment_status(experiment_id: str, watch: bool, interval: int, show_all:
             _show_failure_details(client, experiment_id)
 
     except NotAuthenticatedError:
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
     except APIError as e:
@@ -315,6 +319,7 @@ def _poll_all_experiments(client: HumanboundClient):
             cycle += 1
 
     except NotAuthenticatedError:
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
     except APIError as e:
@@ -424,6 +429,7 @@ def experiment_wait(experiment_id: str, timeout: int):
             poll_interval = min(poll_interval * 2, max_interval)
 
     except NotAuthenticatedError:
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
     except APIError as e:
@@ -467,6 +473,7 @@ def terminate_experiment(experiment_id: str):
         console.print(f"[dim]ID: {experiment_id}[/dim]")
 
     except NotAuthenticatedError:
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
     except APIError as e:
@@ -508,6 +515,7 @@ def delete_experiment(experiment_id: str, force: bool):
         console.print(f"[dim]{exp_name} ({experiment_id})[/dim]")
 
     except NotAuthenticatedError:
+        telemetry.fire_gated_command_hit()
         console.print("[red]Not authenticated.[/red] Run 'hb login' first.")
         raise SystemExit(1)
     except APIError as e: