[tigh-latte]

Usage telemetry stack, part 3 of 6. Builds on #569. Next: #571.

Description

This PR adds the sender and the rules for whether a run sends. Nothing calls them yet.

• sender.py sends one event with a plain POST on its own session. It never reuses the API session, so user headers, the API key, client certificates and .netrc credentials can't reach PostHog. It keeps the CLI's proxy and CA settings, so it works behind TLS-intercepting proxies. It never retries or follows a redirect. It follows the command's --without-ssl-verify-strict (certificates are always verified). It runs in a background thread inside the 1 s exit budget from refactor(ENG-15367): share telemetry opt-outs and the exit wait budget #568; building the session counts against that budget too, and failures are silent.
• run.py decides whether a run sends at all. The checks run cheapest first and stop at the first "no", so excluded commands such as credential helpers pay almost nothing. It never raises.

We use a plain POST rather than the PostHog SDK because it adds no dependency, is faster to start, and the SDK ignores the CLI's --proxy and CA settings.

When a run sends nothing

Rule	Why
Any opt-out: DO_NOT_TRACK, CLOUDSMITH_NO_TELEMETRY, telemetry = false	User choice
Credential helper calls (docker, cargo, generic, pnpm, terraform), mcp start, the telemetry group	Helpers are invoked by other tools on every pull. mcp start is long-running. telemetry manages telemetry itself. install, uninstall and list under credential-helper do send
API host is not cloudsmith.io or cloudsmith.com	Self-hosted and proxied setups aren't ours to measure
SSL verification off	Telemetry is never sent without certificate checks
Development build (source checkout or editable install) without a test key	Keeps development noise out of the data
No project key (the default in this stack)	Released builds send nothing until a key is added
A send failed in the last 24 h	A blocked network costs at most one 1 s wait a day
CI sampling (CLOUDSMITH_TELEMETRY_CI_SAMPLE_RATE, default 100; CI runs only, not containers)	Volume control. Events carry sample_rate so counts can be scaled back up
First interactive run: the notice is shown instead	Users can opt out before anything is sent

Turning telemetry off also deletes the stored install ID, so opting back in starts a new, unlinked one. A config.ini that can't be read blocks sending but deletes nothing.

CLOUDSMITH_TELEMETRY=log prints the event to stderr and sends nothing.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

The test suite's conftest.py replaces the POST with one that fails the test, so unit tests can never send; a test that tries to send fails at teardown. Tests that check sending use the usage_events fixture.

🤖 Generated with Claude Code