Tracing

[Freezaa9]

Note

Adds anonymous, opt-out telemetry and wires it into the engine lifecycle.

• Introduces idun_agent_engine.telemetry with IdunTelemetry (PostHog-backed), non-blocking capture, stable distinct_id persisted via platformdirs, and sanitize_telemetry_config to redact secrets and truncate values; telemetry is enabled by default and can be disabled with IDUN_TELEMETRY_ENABLED=false
• Integrates telemetry in server/lifespan.py to capture engine started/engine stopped events and perform graceful shutdown
• Updates README.md with a Telemetry section and disable flag
• Adds dependencies platformdirs, posthog, PyYAML; bumps versions (idun-agent-engine 0.3.9, idun-agent-schema 0.3.9) and refreshes lockfiles

^{Written by Cursor Bugbot for commit c676d82. This will update automatically on new commits. Configure here.}

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
25048295	Triggered	Generic High Entropy Secret	6922370	libs/idun_agent_engine/src/idun_agent_engine/telemetry/telemetry.py	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

This PR is being reviewed by Cursor Bugbot

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Race condition in telemetry shutdown may skip client cleanup

Low Severity

The shutdown method captures client = self._client at call time (line 225), but _send tasks queued via capture() create the client asynchronously in the worker thread. If shutdown() is called before queued _send tasks execute, client is captured as None. The closure _shutdown_client then uses this stale None value, causing the actual PostHog client (created later by _send) to never be properly shut down. This could result in unflushed telemetry events and resource leaks.

Additional Locations (1)

• libs/idun_agent_engine/src/idun_agent_engine/telemetry/telemetry.py#L229-L237

 

[cursor]

Missing telemetry cleanup if agent cleanup fails

Low Severity

If cleanup_agent(app) at line 125 raises an exception, telemetry.shutdown() at line 127 is never called. This leaves the ThreadPoolExecutor and PostHog client without proper cleanup. Pending telemetry events won't be flushed, and the executor's worker thread could delay process termination. The shutdown sequence lacks a try/finally block to ensure telemetry cleanup regardless of agent cleanup success.