feat: [AI] add cli_context to browser auth URL for PostHog session correlation

- Append base64url-encoded cli_context param to the register URL opened
  by AltimateAuthPlugin. Context blob: { v, machine_id, cli_version }.
- machine_id is the existing stable UUID from ~/.altimate/machine-id
  (already in every App Insights event). If the file is missing, log a
  debug message instead of silently omitting.
- Export buildCliContext() and add 3 unit tests covering: valid context,
  missing machine-id file, and whitespace trimming.

Author: saravmajestic

packages/opencode/src/altimate/plugin/altimate.ts

@@ -5,6 +5,11 @@ import open from "open"
 import { AltimateApi } from "../api/client"
 // altimate_change — onboarding telemetry for the gateway sign-in funnel
 import * as OnboardingTelemetry from "../telemetry/onboarding"
+import fs from "fs"
+import os from "os"
+import path from "path"
+import { InstallationVersion } from "@opencode-ai/core/installation/version"
+import { Log } from "@/altimate/util/log"
 
 /**
  * Why a failure reason is attached at the rejection site rather than inferred from the message:
@@ -47,6 +52,23 @@ const DEFAULT_WEB_URL = "https://app.myaltimate.com"
 // deliver.
 const DEFAULT_API_URL = "https://api.myaltimate.com"
 
+const log = Log.create({ service: "altimate-plugin" })
+
+// Build a base64url-encoded context blob so the frontend can correlate this
+// browser auth session with CLI telemetry. Fields are minimal and non-PII:
+// machine_id is a random UUID stored locally, never an email or real identity.
+export function buildCliContext(machineIdPath?: string): string {
+  const idPath = machineIdPath ?? path.join(os.homedir(), ".altimate", "machine-id")
+  let machineId = ""
+  try {
+    machineId = fs.readFileSync(idPath, "utf8").trim()
+  } catch {
+    log.debug("machine-id file not found — cli_context will omit machine_id")
+  }
+  const ctx = { v: 1, machine_id: machineId, cli_version: InstallationVersion }
+  return Buffer.from(JSON.stringify(ctx)).toString("base64url")
+}
+
 // The one-time login_token is POSTed to the callback-supplied API base, so that
 // base must be trusted — otherwise a crafted callback could exfiltrate the token
 // to an attacker's server. Allow only HTTPS Altimate-owned hosts, an explicitly
@@ -344,7 +366,8 @@ export async function AltimateAuthPlugin(_input: PluginInput): Promise<Hooks> {
             const authorizeUrl =
               `${webUrl}/register?client=altimate-code` +
               `&redirect=${encodeURIComponent(redirect)}` +
-              `&state=${state}`
+              `&state=${state}` +
+              `&cli_context=${encodeURIComponent(buildCliContext())}`
 
             // Try to open the browser. Failure is silent because the URL is
             // already surfaced elsewhere: the auth dialog in packages/tui/src/

packages/opencode/test/altimate/altimate-plugin.test.ts

@@ -0,0 +1,51 @@
+// altimate_change — tests for cli_context auth URL parameter
+import { describe, expect, test } from "bun:test"
+import * as fs from "fs"
+import * as os from "os"
+import * as path from "path"
+import { buildCliContext } from "../../src/altimate/plugin/altimate"
+
+describe("buildCliContext", () => {
+  test("returns a valid base64url-encoded JSON blob with machine_id", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "altimate-ctx-"))
+    const idPath = path.join(tmpDir, "machine-id")
+    fs.writeFileSync(idPath, "test-uuid-1234", "utf8")
+
+    const encoded = buildCliContext(idPath)
+
+    // base64url: only A-Z a-z 0-9 - _ (no +/=)
+    expect(encoded).toMatch(/^[A-Za-z0-9\-_]+$/)
+
+    const ctx = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8")) as Record<string, unknown>
+    expect(ctx["v"]).toBe(1)
+    expect(ctx["machine_id"]).toBe("test-uuid-1234")
+    expect(typeof ctx["cli_version"]).toBe("string")
+
+    fs.rmSync(tmpDir, { recursive: true, force: true })
+  })
+
+  test("omits machine_id value when file does not exist", () => {
+    const nonExistentPath = path.join(os.tmpdir(), `altimate-no-such-${Date.now()}`, "machine-id")
+
+    const encoded = buildCliContext(nonExistentPath)
+    const ctx = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8")) as Record<string, unknown>
+
+    expect(ctx["v"]).toBe(1)
+    // machine_id is empty string, not omitted — frontend can tell "error reading" from "no key"
+    expect(ctx["machine_id"]).toBe("")
+  })
+
+  test("trims whitespace from machine-id file", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "altimate-ctx-ws-"))
+    const idPath = path.join(tmpDir, "machine-id")
+    // Many editors/tools write a trailing newline
+    fs.writeFileSync(idPath, "  trimmed-uuid  \n", "utf8")
+
+    const encoded = buildCliContext(idPath)
+    const ctx = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8")) as Record<string, unknown>
+
+    expect(ctx["machine_id"]).toBe("trimmed-uuid")
+
+    fs.rmSync(tmpDir, { recursive: true, force: true })
+  })
+})