feat(telemetry): fix command/exit-code tracking and enrich events

[rhuanbarreto]

Summary

Three bugs made the PostHog data close to unusable, and we had no way to tell which repos are actually running archgate. This PR fixes the bugs, enriches every event, and plumbs repo identification through — gated on confirmed-public visibility so we never leak private repos.

Bugs fixed

• command_completed.command always "root" — the Commander preAction / postAction callback's first arg is the hookedCommand (root program), not the invoked command. Switched to the second arg (actionCommand). Verified in PostHog: 202/202 command_completed events in the last 14d had command=root.
• command_completed.exit_code always 0 — hard-coded 0 in the postAction hook, AND ~50 direct process.exit(N) call sites bypass the hook and the main() flush entirely. Introduced helpers/exit.ts (exitWith / beginCommand / finalizeCommand) that records the real exit code + outcome tag, flushes PostHog + Sentry, then exits. All command call sites migrated to await exitWith(code). Verified in PostHog: 474/474 command_completed events had exit_code=0.
• adr_count / has_project stale after archgate init — the project context was cached on first call (before init created .archgate/adrs/), so post-init events reported 0. Dropped the cache — the readdirSync is cheap enough to re-run per event.

Event enrichments

Common props (every event):

• ci_provider — GitHub Actions / GitLab CI / CircleCI / Jenkins / Azure Pipelines / Buildkite / TeamCity / AWS CodeBuild / Bitbucket Pipelines / Travis / other
• shell (bash / zsh / pwsh / ...), locale
• adr_domains_count
• Repo context (non-identifying): repo_is_git, repo_host (github / gitlab / bitbucket / azure-devops / other), repo_id (sha256(normalized remote URL)[0:16]), git_default_branch

Per-event additions:

• command_executed: command_depth, options_used
• command_completed: outcome (success / user_error / internal_error / cancelled), error_kind bucket
• check_completed: files_scanned, load_duration_ms, check_duration_ms
• login_completed: failure_reason (network / tls / denied / other)

New events:

• project_initialized — one-time event on archgate init. Always carries repo_host, repo_is_git, repo_id, and repo_public (true / false / null). For repos confirmed public via their host's unauthenticated API, it additionally carries remote_url, repo_owner, repo_name.
• telemetry_preference_changed — fires once on enable/disable.

Repo identity: confirmed-public only

The rule is intentionally simple:

Share identity iff the host confirms the repo is public. Otherwise don't.

No identity-specific flag, no identity-specific env var. Users who want zero events use the existing telemetry opt-out (ARCHGATE_TELEMETRY=0 or archgate telemetry disable), which suppresses the event entirely — a dedicated identity knob would be redundant and create two-source-of-truth drift.

Public-visibility probes (unauthenticated, 3s timeout, cached per process):

• GitHub: api.github.com/repos/{o}/{r} → private: false
• GitLab: gitlab.com/api/v4/projects/{p} → visibility: public
• Bitbucket: api.bitbucket.org/2.0/repositories/{o}/{r} → is_private: false
• Azure DevOps: dev.azure.com/{org}/_apis/projects/{project} → visibility: public

Timeouts, 401/403/429 responses, network errors, and self-hosted hosts all return null (= "unknown") rather than falling through to share.

Azure DevOps URL parsing handles three forms — modern HTTPS (dev.azure.com/{org}/{project}/_git/{repo}), legacy ({org}.visualstudio.com/{project}/_git/{repo}), and SSH (ssh.dev.azure.com:v3/{org}/{project}/{repo}) — and normalises all three to the same repo_id so it's stable regardless of how origin is set.

Privacy docs rewritten in both en and pt-br (ADR GEN-002 i18n parity).

Test hygiene

tests/helpers/telemetry.test.ts was sending real events to the production PostHog project — this is why we saw check, adr create, login_completed etc. with install_method=global-pm, has_project=true in the data. Tests now set NODE_ENV=test in beforeEach, and trackEvent() is a no-op under that env. Matches the Sentry convention in ARCH-005.

Commits

1. feat(telemetry): fix command/exit-code tracking and enrich events — the three core bug fixes + common-prop/per-event enrichment + hashed repo_id on every event
2. feat(telemetry): gate repo identity on confirmed-public repos + Azure DevOps — the public-visibility probe across four hosts; Azure DevOps added
3. refactor(telemetry): drop ARCHGATE_SHARE_REPO_IDENTITY env + --no-share-repo-identity flag — simplification: one rule, share iff confirmed public; rely on the existing telemetry opt-out for "no events at all"

Test plan

• bun run validate (lint + typecheck + format + 639 tests + 21 ADR rules + build:check) passes
• New tests cover parseRemoteUrl for all four hosts (including Azure DevOps HTTPS / SSH / legacy URL shapes all hashing to the same repo_id), isPublicRepo for every host's success/404/401/403/error branches, and the shouldShareRepoIdentity public-only rule
• Manually dry-run archgate init on a public GitHub repo → confirm project_initialized carries owner/name, identity_shared=true, repo_public=true (follow-up once merged)
• Manually dry-run archgate init on a private GitHub repo → confirm identity_shared=false, repo_public=false, no owner/name fields (follow-up)
• Manually dry-run archgate init on a public Azure DevOps repo → confirm same behaviour (follow-up)
• With ARCHGATE_TELEMETRY=0 set, confirm project_initialized is not sent at all (follow-up)

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying archgate-cli with    Cloudflare Pages

Latest commit:	2c2d07d
Status:	✅  Deploy successful!
Preview URL:	https://6b435675.archgate-cli.pages.dev
Branch Preview URL:	https://feat-telemetry-improvements.archgate-cli.pages.dev

View logs