Crate codewhale_telemetry 

Default-on, user-disableable anonymous product usage counting for Codewhale.

The whole of what this crate may ever send is event. The whole of what decides whether it may send anything is decision. Nothing else in the tree is permitted to construct a payload or to reach the wire, and nothing in here reads a prompt, a completion, a tool argument, a file, a path, a git remote, a branch, a model id, a provider table name, an MCP server name, an approval rule, an error body, a panic message, or a credential.

The shape of the guarantee

Permission is a value, not a convention. decide is the only constructor of TelemetryConsent; init takes one by value and there is no bool-taking sibling. Six init sites cannot each drift from the predicate, because they never see the predicate.

Arming is a OnceLock, consulted by every write path including record_blocking. This matters because the process panic hook is installed before the command line is even parsed, long before any config resolution: it cannot consult a resolved value, but it can consult a lock that is by construction empty until resolution completes. A disabled user’s panic therefore writes nothing and creates no directory.

Arming also truncates any stale buffer before a newly permitted process begins recording.

Failure posture

Fail-open is absolute. Every fallible step ends in .ok()? or let _ =. Nothing here returns an error to a caller, blocks a turn, blocks a tool, or blocks process exit. Telemetry that costs a user their session is worse than no telemetry.

Re-exports

pub use counters::Counter;

pub use counters::ErrorCounter;

pub use counters::SessionCounters;

pub use decision::EndpointError;

pub use decision::TELEMETRY_DIR;

pub use decision::TelemetryConsent;

pub use decision::TelemetryDecision;

pub use decision::decide;

pub use decision::decide_in_home;

pub use decision::load_setup_state_for_decision;

pub use decision::load_setup_state_for_decision_at;

pub use decision::re_decide;

pub use decision::validate_endpoint;

pub use envelope::reduce_panic_site;

pub use event::Arch;

pub use event::Batch;

pub use event::ColdStartBucket;

pub use event::Counters;

pub use event::DurationBucket;

pub use event::Errors;

pub use event::Event;

pub use event::ExitClass;

pub use event::InstallKind;

pub use event::Libc;

pub use event::Os;

pub use event::SCHEMA_VERSION;

pub use event::SessionSource;

pub use event::Surface;

pub use event::TurnWall;

Modules

buffer

The on-disk ring buffer, the tombstone, and the wipe.

client

Transport. One POST, or — with no endpoint — a local file.

counters

Process-wide session accumulators.

decision

The one place that decides whether anonymous usage counting may run, and the token that makes that decision unforgeable.

envelope

Install identity and the constant half of the batch envelope.

event

The wire schema. This module is the whole of what may leave the machine.

notice

The first-run notice copy.

Enums

FlushOutcome

What a flush attempt did.

Constants

BATCH_MAX_BYTES

Byte ceiling per batch body.

BATCH_MAX_EVENTS

Events per batch.

SHUTDOWN_FLUSH_TIMEOUT

How long the shutdown flush may hold the process.

Functions

exit_class

The exit class recorded so far. Clean when unarmed or unset.

init

Arm telemetry for this process.

is_armed

Whether this process is armed. Every write path checks this first.

record

Queue an event for the writer thread.

record_blocking

Write an event synchronously, without the writer thread.

session_counters

This process’s session accumulators.

set_exit_class

Record how this process is ending.

shutdown_blocking

Final flush, then stop the writer thread.