fix(server): Make telemetry opt in

[mwolson]

Summary

• Make PostHog telemetry opt-in from both server configuration and the Settings UI.
• Keep the existing T3CODE_TELEMETRY_ENABLED=true environment override for explicit opt-in.
• Add a Telemetry switch in Settings near Diagnostics.
• Avoid resolving telemetry identifiers, creating fallback anonymous IDs, buffering events, or sending batches while telemetry is disabled.
• Downgrade telemetry flush failures from error logging to debug logging so blocked PostHog endpoints do not spam application logs.

Addresses #1397.

Problem and Fix

Problem and Why it Happened	Fix
The marketing page says "No telemetry" and "Unless you opt in", but the server default enabled telemetry unless users knew to set T3CODE_TELEMETRY_ENABLED=false.	Default telemetry to disabled and only enable it when the environment override is true or the persisted Settings value is true.
Disabling telemetry after startup still needed to avoid event buffering, identifier lookup, and batch sending.	Gate both record and flush through the current telemetry setting and clear buffered events when telemetry is disabled.
Users had no visible app setting for telemetry.	Add a Telemetry switch in the General Settings About section near Diagnostics.
Blocked or unreachable PostHog endpoints could repeatedly log ERROR: Failed to flush telemetry.	Log telemetry flush failures at debug level.

UI Changes

The new Telemetry setting appears in Settings near Diagnostics.

Screenshot is also available in this PR comment.

Validation

• pnpm exec vp test run packages/contracts/src/settings.test.ts apps/server/src/serverSettings.test.ts apps/server/src/telemetry/Layers/AnalyticsService.test.ts
• pnpm --filter @t3tools/web test:browser -- src/components/settings/SettingsPanels.browser.tsx
• pnpm exec vp run typecheck
• pnpm exec vp check (passed with existing unrelated lint warnings)
• Built Linux AppImage with pnpm run dist:desktop:linux.
• Ran release/T3-Code-0.0.27-x86_64.AppImage and confirmed the Telemetry setting appears near Diagnostics with default value off.
• With Telemetry off, triggered a trivial General mode response and confirmed the app had no telemetryEnabled persisted override, no fallback anonymous-id, no sendBatch spans, and no current-run PostHog or telemetry flush log entries.
• Turned Telemetry on, sent more messages, switched to Plan mode, triggered a choice picker, and selected an option. Confirmed telemetryEnabled: true was persisted and successful sendBatch spans were emitted.
• Turned Telemetry off again, triggered one more Plan mode chooser and one more trivial General mode response. Confirmed new record spans reached the telemetry gate but no new sendBatch spans were emitted after disabling telemetry again.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes (not applicable, no animation or interaction changes)

Note

Make telemetry opt-in via server settings and environment flag

• Adds telemetryEnabled to the ServerSettings and ServerSettingsPatch schemas, defaulting to false.
• Changes TelemetryEnvConfig default from enabled to disabled; telemetry is now only active when the env flag is set or the user enables it via settings.
• Integrates ServerSettingsService into makeAnalyticsService so the analytics layer reads telemetryEnabled at flush/record time; when disabled, recording is a no-op and flush clears buffered events without sending.
• Adds a Telemetry toggle to the General settings UI panel that calls updateSettings({ telemetryEnabled }) on change.
• Behavioral Change: any existing deployments with telemetry previously on by default will have it disabled until explicitly opted in.

^{Macroscope summarized 8a8bf45.}

---

Note

Medium Risk
Changes default telemetry behavior for all deployments (privacy-sensitive) and alters when events and anonymous IDs are created, though gating is covered by new tests.

Overview
Makes anonymous PostHog telemetry opt-in instead of on by default, aligned with product messaging and a new Settings control.

Server & contracts: Adds persisted telemetryEnabled to ServerSettings / patches (defaults false, including legacy empty configs). T3CODE_TELEMETRY_ENABLED now defaults to false but still forces telemetry on when set true. The analytics layer depends on ServerSettingsService, starts its settings watcher, and gates record and flush on env override or telemetryEnabled; when off it skips buffering/sending, clears the buffer on flush, resolves the anonymous id only when sending, and logs flush failures at debug instead of error. Runtime wiring moves ServerSettingsLive alongside AnalyticsServiceLayerLive so analytics can read settings.

UI: General Settings → About gets a Telemetry switch (“Share anonymous telemetry”), wired to updateSettings, restore-defaults, and browser tests.

Note: Existing installs that relied on the old default-on behavior will stop sending telemetry until users opt in or set the env flag.

^{Reviewed by Cursor Bugbot for commit 8a8bf45. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 1ea33a5a-10e1-4d16-afbc-7f071fc9de6c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mwolson]

Screenshot of new setting

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR changes telemetry from opt-out to opt-in, fundamentally altering the default behavior for all users. While privacy-positive, the runtime behavior change and layer initialization ordering adjustments warrant human review to confirm intended product behavior.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9f24d09. Configure here.}