fix: remove upstream telemetry entirely from managed Sessions

[BramVR]

Summary

Upstream BlenderMCP ships default-on telemetry that reports usage data to the maintainer's hosted backend, and — when it believes consent was given — user prompts, executed code, and viewport screenshots. Its consent handler falls back to consent-granted whenever the addon is not registered through Blender's Preferences, which is exactly how managed Sessions load the addon (direct register() under --factory-startup). blendersessiond does not want that telemetry, so this PR deletes it entirely instead of relying on the broken fallback.

Changes

• Vendored addon: delete the whole telemetry surface — the get_telemetry_consent socket handler, the telemetry_consent preference, and the telemetry preferences UI. Zero telemetry/consent/supabase references remain (verified by re-diffing against pristine upstream at da4e16d). A stock blender-mcp client asking for consent now receives an unknown-command error and fails closed on its own side.
• mcp-serve: run the validated server with DISABLE_TELEMETRY=true, which disables its telemetry client completely, baseline tier included. Managed Sessions send no telemetry at all.
• vendor/addon.patch: regenerated as the complete delta against pinned upstream, now including the telemetry removal.
• Docs: README vendoring paragraph, docs/compat.md patch summary + security posture + re-pin procedure, and THIRD_PARTY_NOTICES.md all state that we vendored from upstream but deleted its telemetry. Changelog entry under Unreleased.
• Tests: the fake-uvx e2e asserts DISABLE_TELEMETRY=true reaches the server environment; new tests/test_vendor_addon.py pins the vendored file as telemetry-free so a future re-pin cannot silently reintroduce it.

Verification

• uv run ruff check . — clean
• uv run pytest — 94 passed, 4 skipped (real-Blender opt-ins)
• Vendored file diffed against upstream addon.py at da4e16d: delta is exactly the hunks in addon.patch

[Copilot]

Pull request overview

This PR removes upstream BlenderMCP telemetry from managed Sessions by deleting the vendored addon’s telemetry/consent surface and forcing the validated blender-mcp stdio server to run with telemetry disabled via environment.

Changes:

• Vendored addon: removes the get_telemetry_consent command handler and the related addon preference/UI.
• mcp-serve: sets DISABLE_TELEMETRY=true in the launched server environment for managed Sessions.
• Adds/tests/docs: new policy tests to prevent reintroducing telemetry, plus documentation/attribution and changelog updates reflecting the security posture.

Reviewed changes

Copilot reviewed 7 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
THIRD_PARTY_NOTICES.md	Documents that the vendored addon is modified and telemetry is removed.
tests/test_vendor_addon.py	Adds policy pins to prevent telemetry/consent code from reappearing in the vendored addon/patch.
tests/test_mcp_serve.py	Extends fake uvx e2e record to assert DISABLE_TELEMETRY reaches the server environment.
src/blendersessiond/vendor/addon.py	Deletes telemetry consent handler and telemetry-related preference/UI from vendored addon.
src/blendersessiond/vendor/addon.patch	Regenerates patch to include telemetry removal hunks as part of the vendor delta.
src/blendersessiond/mcp_serve.py	Forces DISABLE_TELEMETRY=true when exec’ing the validated blender-mcp server.
README.md	Updates vendoring paragraph to clearly state telemetry is removed/disabled for managed Sessions.
docs/compat.md	Records telemetry removal rationale and re-pin requirements (including env var behavior).
CHANGELOG.md	Notes removal of upstream telemetry from managed Sessions under Unreleased.

Comments suppressed due to low confidence (1)

tests/test_vendor_addon.py:21

• The patch assertion currently matches an exact removed line with specific indentation, which is likely to break on upstream formatting/context changes even if telemetry removal is still correctly represented in the patch. Consider asserting more generally that get_telemetry_consent appears on removed lines and does not appear on added lines.

    patch = _VENDOR.joinpath("addon.patch").read_text(encoding="utf-8")
    assert '-            "get_telemetry_consent": self.get_telemetry_consent,' in patch
    assert "+    def get_telemetry_consent" not in patch

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.