fix: [AI] address review round 3 on cli_context auth

- machine-id: move mkdirSync inside the try/catch so a read-only $HOME /
  restricted container returns "" instead of throwing (was breaking sign-in
  via buildCliContext -> buildAuthorizeUrl -> authorize)
- buildCliContext: fail CLOSED when Config.get() throws (the plugin can run in
  the server worker where it does) so a config-opted-out user's id is never sent
- welcome.ts: stop minting the machine-id; delegate creation to Telemetry.doInit
  (which resolves env + config); keep existsSync as the upgrade probe
- buildAuthorizeUrl: accept an optional machineIdPath forwarded to
  buildCliContext; encode the state param
- docs: name both opt-out mechanisms (env var AND telemetry.disabled config) and
  reconcile the PostHog vs App Insights destinations
- tests: use the repo tmpdir() fixture (no $HOME writes), real wx/EEXIST race and
  mkdir-EACCES branches via spyOn, config-opt-out + fail-closed cases, non-vacuous
  assertions, and guard against a developer's exported ALTIMATE_TELEMETRY_DISABLED
- remove the dead getOrCreateMachineId re-export; import from util/machine-id

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: saravmajestic

docs/docs/reference/security-faq.md

@@ -130,9 +130,9 @@ export ALTIMATE_TELEMETRY_DISABLED=true
 
 - **Logged-in users:** Your email is SHA-256 hashed before sending. We never see your raw email.
 - **Anonymous users:** A random UUID (`crypto.randomUUID()`) is generated on first run and stored at `~/.altimate/machine-id`. This is NOT tied to your hardware, OS, or identity — it's purely random.
-- **Both identifiers** are only sent when telemetry is enabled. Disable with `ALTIMATE_TELEMETRY_DISABLED=true`.
+- **Both identifiers** are only sent when telemetry is enabled. Disable via `ALTIMATE_TELEMETRY_DISABLED=true` or the `telemetry.disabled` config option.
 - **No fingerprinting:** We do not use browser fingerprinting, hardware IDs, MAC addresses, or IP-based tracking.
-- **CLI auth flow:** When you sign in via `altimate auth login`, the anonymous machine ID is included in the authorization URL and associated with your account in product analytics for funnel analysis. This is suppressed when `ALTIMATE_TELEMETRY_DISABLED=true` is set — the machine ID is omitted from the URL entirely.
+- **CLI auth flow:** When you sign in via `altimate auth login`, the anonymous machine ID is included in the authorization URL and associated with your account in product analytics for funnel analysis. This is suppressed when you disable telemetry — via `ALTIMATE_TELEMETRY_DISABLED=true` or the `telemetry.disabled` config option — and the machine ID is omitted from the URL entirely.
 
 ### What happens on first launch?
 

docs/docs/reference/telemetry.md

@@ -151,7 +151,7 @@ Both identifiers are only sent when telemetry is enabled. Disable telemetry enti
 
 ### CLI Authentication Flow
 
-When you sign in using the CLI browser auth flow (`altimate auth login`), an anonymized session identifier (the `machine-id` UUID) is included in the authorization URL and associated with your account in product analytics. This is used solely to correlate CLI install events with authenticated accounts in aggregate funnel analytics — it is never used for tracking, advertising, or cross-site identification. Respecting `ALTIMATE_TELEMETRY_DISABLED=true` suppresses this: when telemetry opt-out is set, the machine ID is omitted from the authorization URL entirely.
+When you sign in using the CLI browser auth flow (`altimate auth login`), an anonymized session identifier (the `machine-id` UUID) is included in the authorization URL and associated with your account in product analytics. This is used solely to correlate CLI install events with authenticated accounts in aggregate funnel analytics — it is never used for tracking, advertising, or cross-site identification. Your telemetry opt-out suppresses this: when you disable telemetry — via `ALTIMATE_TELEMETRY_DISABLED=true` **or** the `telemetry.disabled` config option — the machine ID is omitted from the authorization URL entirely. The machine ID is associated with your account in PostHog for this funnel analysis, separate from the Azure Application Insights pipeline used for other CLI telemetry events.
 
 ### Data Retention
 

packages/opencode/src/altimate/plugin/altimate.ts

@@ -54,37 +54,43 @@ const DEFAULT_API_URL = "https://api.myaltimate.com"
 
 const log = Log.create({ service: "altimate-plugin" })
 
-// altimate_change — getOrCreateMachineId is now in util/machine-id.ts (re-exported
-// from there so existing test imports that reference this module continue to work).
-export { getOrCreateMachineId } from "../util/machine-id"
-
 // Builds a base64url-encoded context blob for correlating this browser auth
 // session with CLI telemetry in PostHog. The machine_id is a random UUID
 // stored at ~/.altimate/machine-id — not tied to hardware, OS, or user identity.
-// After sign-in, the frontend calls posthog.alias(email, machine_id) to associate
-// the device with the authenticated account in product analytics.
+// After sign-in the frontend registers it as the `cli_machine_id` PostHog
+// super-property so the CLI device is attributed to the authenticated account
+// in aggregate funnel analytics.
 //
 // Privacy note: cli_context is sent in the URL *fragment* (#cli_context=...),
 // not the query string. The browser never transmits a fragment to the server,
 // so the machine_id — though a non-PII crypto.randomUUID() — stays out of
 // app.myaltimate.com's access logs, any fronting CDN/WAF, and the Referer
 // header, while remaining readable by the /register page via location.hash.
-// The frontend reads it from the fragment (see useCliContext.ts). The fragment
-// must be the last URL segment, after all query params.
+//
+// Frontend decode contract (implemented in monorepo useCliContext.ts /
+// cliContext.ts): the value is base64url (not standard base64); the consumer
+// must catch decode/JSON errors, require `v === 1`, validate that `machine_id`
+// and `cli_version` are strings, treat `cli_version: "local"` as a valid dev
+// build, and treat the payload as untrusted (anyone can craft a URL). An absent
+// `machine_id` means "do not attribute" — it must never be aliased on.
 export async function buildCliContext(machineIdPath?: string): Promise<string> {
   // altimate_change start — honour both telemetry opt-out gates, mirroring
-  // telemetry/index.ts::doInit exactly:
-  //   1. ALTIMATE_TELEMETRY_DISABLED=true env var (early, always-works escape hatch)
+  // telemetry/index.ts::doInit:
+  //   1. ALTIMATE_TELEMETRY_DISABLED=true env var (always-works hard opt-out)
   //   2. config.telemetry.disabled (resolved via the async Config.get())
-  // Config.get() may throw outside an Instance context; treat a config failure as
-  // "not disabled" (same as doInit) — the env var above is the hard opt-out.
   let disabled = process.env.ALTIMATE_TELEMETRY_DISABLED === "true"
   if (!disabled) {
     try {
       const userConfig = (await Config.get()) as any
       disabled = Boolean(userConfig.telemetry?.disabled)
     } catch {
-      // Config unavailable — proceed with telemetry enabled.
+      // Config unreadable here — this plugin can run in the server worker where
+      // Config.get() throws "InstanceRef not provided". Fail CLOSED: omit the
+      // durable machine_id. A missed correlation is preferable to transmitting a
+      // stable cross-session device identifier for a user who may have opted out
+      // via config. (Intentionally stricter than doInit's fail-open, which
+      // governs single events rather than a persistent identifier.)
+      disabled = true
     }
   }
   let machineId = ""
@@ -94,25 +100,32 @@ export async function buildCliContext(machineIdPath?: string): Promise<string> {
     machineId = getOrCreateMachineId(machineIdPath)
   }
   // altimate_change end
-  // altimate_change start — omit machine_id key when empty (matches telemetry
-  // module pattern: `...(machineId && { machine_id: machineId })`). Sending ""
-  // is meaningless for posthog.alias() and misleads downstream consumers.
+  // altimate_change start — omit machine_id when empty (matches the telemetry
+  // module's `...(machineId && { machine_id })`). An empty value is meaningless
+  // to the frontend super-property registration and must not be sent.
   const ctx: Record<string, unknown> = { v: 1, cli_version: InstallationVersion }
   if (machineId) ctx.machine_id = machineId
   // altimate_change end
   return Buffer.from(JSON.stringify(ctx)).toString("base64url")
 }
 
 // altimate_change start — exported so tests can assert on the full URL shape
-// without duplicating the construction logic.
-export async function buildAuthorizeUrl(webUrl: string, redirect: string, state: string): Promise<string> {
+// without duplicating the construction logic. `machineIdPath` is forwarded to
+// buildCliContext so tests can point at a temp file instead of writing a real
+// id into the runner's $HOME.
+export async function buildAuthorizeUrl(
+  webUrl: string,
+  redirect: string,
+  state: string,
+  machineIdPath?: string,
+): Promise<string> {
   return (
     `${webUrl}/register?client=altimate-code` +
     `&redirect=${encodeURIComponent(redirect)}` +
-    `&state=${state}` +
+    `&state=${encodeURIComponent(state)}` +
     // Fragment (#), not a query param — keeps the durable machine_id out of
     // server access logs / Referer. Must stay last, after all query params.
-    `#cli_context=${encodeURIComponent(await buildCliContext())}`
+    `#cli_context=${encodeURIComponent(await buildCliContext(machineIdPath))}`
   )
 }
 // altimate_change end

packages/opencode/src/altimate/util/machine-id.ts

@@ -75,9 +75,14 @@ export function getOrCreateMachineId(machineIdPath?: string): string {
   // --- Create path (ENOENT) ---
   // `flag: "wx"` is atomic exclusive-create: the OS guarantees only one writer
   // succeeds. The loser re-reads what the winner wrote.
+  //
+  // mkdirSync MUST be inside this try: on a read-only $HOME, a restricted
+  // container, or a full disk it throws (EACCES/EROFS/ENOSPC), and the module's
+  // contract is to return "" on every error — never propagate. The auth path
+  // (buildCliContext) relies on this and no longer wraps the call itself.
   const candidate = randomUUID()
-  fs.mkdirSync(path.dirname(idPath), { recursive: true })
   try {
+    fs.mkdirSync(path.dirname(idPath), { recursive: true })
     fs.writeFileSync(idPath, candidate, { encoding: "utf8", flag: "wx" })
     return candidate
   } catch (writeErr) {

packages/opencode/src/cli/welcome.ts

@@ -6,8 +6,6 @@ import { EOL } from "os"
 // altimate_change start — import Telemetry for first_launch event
 import { Telemetry } from "../altimate/telemetry"
 // altimate_change end
-// altimate_change — import shared machine-id utility so the path is canonical across all call sites
-import { getOrCreateMachineId } from "../altimate/util/machine-id"
 
 const APP_NAME = "altimate-code"
 const MARKER_FILE = ".installed-version"
@@ -42,13 +40,13 @@ export function showWelcomeBannerIfNeeded(): void {
     fs.unlinkSync(markerPath)
 
     // altimate_change start — "upgrade" means the machine-id file already existed before this
-    // launch. Probe existence with existsSync FIRST — do NOT use getOrCreateMachineId() as the
-    // probe, because it mints the file on a fresh install and would then report every new user
-    // as an upgrade. After probing, mint the id (unless telemetry is opted out via env) so
-    // telemetry.doInit() finds it ready — welcome.ts runs before doInit().
+    // launch. Probe existence with existsSync only — do NOT mint here. Minting is owned by
+    // Telemetry.doInit(), which resolves the full opt-out policy (env var AND config) before
+    // creating the file; minting here would duplicate that decision under a weaker gate and
+    // create the id for a config-opted-out user. The first_launch machine_id is attached at
+    // flush time from telemetry module state, so it does not depend on minting here.
     const machineIdPath = path.join(os.homedir(), ".altimate", "machine-id")
     const isUpgrade = fs.existsSync(machineIdPath)
-    if (process.env.ALTIMATE_TELEMETRY_DISABLED !== "true") getOrCreateMachineId()
     // altimate_change end
 
     // altimate_change start — track first launch for new user counting (privacy-safe: only version + machine_id)