feat: append cli_context param to altimate auth URL for PostHog session correlation

Adds a base64url-encoded cli_context query param to the browser auth URL
opened by the CLI. The blob carries { v, machine_id, cli_version } so the
frontend can call posthog.register / posthog.alias and link the CLI device
to the authenticated user without any PII traveling in the URL.

Author: saravmajestic

packages/opencode/src/altimate/plugin/altimate.ts

@@ -3,6 +3,10 @@ import { createServer } from "http"
 import { randomBytes } from "crypto"
 import open from "open"
 import { AltimateApi } from "../api/client"
+import fs from "fs"
+import os from "os"
+import path from "path"
+import { InstallationVersion } from "@opencode-ai/core/installation/version"
 
 // Loopback port range the CLI listens on for the browser to deliver the gateway
 // credential after sign-in. We prefer 7317 (mnemonic + otherwise unused in this
@@ -24,6 +28,19 @@ const DEFAULT_WEB_URL = "https://app.myaltimate.com"
 // the token exchange at a local backend when the web has no BACKEND_API_URL to
 // deliver.
 const DEFAULT_API_URL = "https://api.myaltimate.com"
+// Build a base64url-encoded context blob so the frontend can correlate this
+// browser auth session with CLI telemetry. Fields are minimal and non-PII:
+// machine_id is a random UUID stored locally, never an email or real identity.
+function buildCliContext(): string {
+  let machineId = ""
+  try {
+    machineId = fs.readFileSync(path.join(os.homedir(), ".altimate", "machine-id"), "utf8").trim()
+  } catch {
+    // machine-id not yet written — omit gracefully
+  }
+  const ctx = { v: 1, machine_id: machineId, cli_version: InstallationVersion }
+  return Buffer.from(JSON.stringify(ctx)).toString("base64url")
+}
 
 // The one-time login_token is POSTed to the callback-supplied API base, so that
 // base must be trusted — otherwise a crafted callback could exfiltrate the token
@@ -308,7 +325,8 @@ export async function AltimateAuthPlugin(_input: PluginInput): Promise<Hooks> {
             const authorizeUrl =
               `${webUrl}/register?client=altimate-code` +
               `&redirect=${encodeURIComponent(redirect)}` +
-              `&state=${state}`
+              `&state=${state}` +
+              `&cli_context=${encodeURIComponent(buildCliContext())}`
 
             // Try to open the browser. Failure is silent because the URL is
             // already surfaced elsewhere: the auth dialog in packages/tui/src/