Record and send one cli.command telemetry event per run

Each run builds one cli.command event from the run record, under the
privacy rules reviewed in mapbox/event-schema#300: a value only for
flags, fixed choices, numbers and language, country or feature-type
codes; coordinates and tile addresses by name only; free strings as
lengths; --data by the keys its spec declares; a userId replaced daily;
no request ids.

A detached child sends it to production Mapbox Events, so the command
never waits. cli_token::send tries tokens in the order its caller
declares: the user's --token or MAPBOX_ACCESS_TOKEN, then the login
(refreshed only when about to expire), then the CLI's own token
(MAPBOX_CLI_TOKEN, then a pk. token compiled in from
MAPBOX_CLI_BUNDLED_TOKEN; build.rs refuses anything else). With no
token the event is dropped. MAPBOX_CLI_NO_TELEMETRY=1 turns it off, and
runs under sudo record nothing.

MAPBOX_INTERNAL_TELEMETRY_URL redirects the send in builds that are not
a production release, and MAPBOX_INTERNAL_TELEMETRY_LOG logs each
delivery. On Windows, detached children no longer hold the caller's
stdout pipe open.

Author: zmofei

CHANGELOG.md

@@ -260,6 +260,15 @@ that may never merge. They are not releases and are not listed here.
   code; it does find a `~/.mapbox/history` directory it didn't before, and
   `mapbox config list` now reports a second key, `history`.
 
+- Each run sends one `cli.command` telemetry event to Mapbox, from a
+  background process the command doesn't wait for, with your own token
+  (`--token`, `MAPBOX_ACCESS_TOKEN` or your login) or, when you have none,
+  one built into the CLI. A build from source has no built-in token, so with
+  no token of your own the event is dropped. It never touches stdout, the
+  exit code or how long a command takes, so a script sees no difference; a
+  machine that already has `~/.mapbox` finds a `.telemetry` directory in it.
+  `MAPBOX_CLI_NO_TELEMETRY=1` turns it off.
+
 - `MAPBOX_CLI_EXTRA_QUERY` appends raw query parameters to every request, in
   the same `k1=v1&k2=v2` shape as a URL's own query string — for an API
   parameter this CLI's specs don't declare a flag for.

Cargo.lock

@@ -37,8 +37,9 @@ path = "src/main.rs"
 # until somebody writes the obvious thing at two in the morning.
 [lints.rust]
 # There is no `unsafe` in this crate outside a couple of `env::set_var` calls
-# in tests, and there is no reason for there to be: nothing here does FFI,
-# manual memory management or lock-free anything. Denying it means adding some
+# in tests and two Win32 calls in `src/detach.rs` (the reason is there), and
+# there is no reason for more: nothing else here does FFI, manual memory
+# management or lock-free anything. Denying it means adding some
 # is a deliberate `#[allow]` with a reason next to it rather than a diff nobody
 # looks twice at.
 unsafe_code = "deny"
@@ -111,6 +112,11 @@ jsonc-parser = { version = "0.34.0", features = ["serde", "serde_json"] }
 # that shows help; see src/output/theme.rs.
 terminal-colorsaurus = "1"
 
+[target.'cfg(windows)'.dependencies]
+# For `src/detach.rs`: keeping the parent's standard handles out of a detached
+# child. Already in the graph through tokio and others; the same version.
+windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_System_Console"] }
+
 [dev-dependencies]
 # Integration tests build fake Mapbox tokens; same crate the CLI already uses.
 base64 = "0.22"

Cargo.toml

@@ -285,6 +285,18 @@ Every request sends `User-Agent: mapbox-cli/<version>` and nothing else
 about you or your machine. `MAPBOX_CLI_NO_TELEMETRY=1` keeps even future
 markers out of that header.
 
+Each run also sends one event to Mapbox: the command's name, its options
+(a value only when it comes from a fixed list, otherwise just its length or
+size, and for a JSON body only the field names the API defines), how it
+ended, and how long it took — never a token, a file path or free text you
+typed. It carries a random ID that is replaced on the first run a day after
+it was created. It is sent in the background, so a command never waits for
+it, and dropped if it can't be delivered. It is sent with your own token
+(`--token`, `MAPBOX_ACCESS_TOKEN` or your login) when you have one, and with
+a token built into the CLI otherwise. A build from source has no built-in
+token, so with no token of your own the event is dropped.
+`MAPBOX_CLI_NO_TELEMETRY=1` turns it off.
+
 ### Diagnostics and settings
 
 ```sh
@@ -451,6 +463,14 @@ process sends, in the same `k1=v1&k2=v2` shape as a URL's own query string —
 for an API parameter this CLI's specs don't declare a flag for. `--debug`
 and `--dry-run` show it alongside everything else on the request.
 
+### The CLI's own requests
+
+Requests the CLI makes for itself rather than for your commands use your own
+token whenever you have one: `--token` or `MAPBOX_ACCESS_TOKEN`, then your
+login. Only when you have none does it use the CLI's token:
+`MAPBOX_CLI_TOKEN`, or one built into the binary. The CLI's token is only
+used for what `src/cli_token.rs` lists for it, today just telemetry.
+
 ### Proxies
 
 `HTTPS_PROXY`, `HTTP_PROXY`, `ALL_PROXY` and `NO_PROXY` are all honored, so

README.md

@@ -41,6 +41,8 @@
 use std::path::Path;
 
 fn main() {
+    check_bundled_token();
+
     let manifest = Path::new("../internal/openapi-command-config/PINNED_SOURCE");
 
     // The vendored specs and their provenance are ordinary build inputs now,
@@ -91,6 +93,20 @@ fn main() {
     warn_if_stale(committed_at);
 }
 
+/// `src/cli_token.rs` compiles `MAPBOX_CLI_BUNDLED_TOKEN` into the binary,
+/// where `strings` can read it. Only a public `pk.` token may go there, so
+/// anything else fails the build rather than shipping a secret.
+fn check_bundled_token() {
+    println!("cargo:rerun-if-env-changed=MAPBOX_CLI_BUNDLED_TOKEN");
+    let Ok(token) = std::env::var("MAPBOX_CLI_BUNDLED_TOKEN") else {
+        return;
+    };
+    let token = token.trim();
+    if !token.is_empty() && !token.starts_with("pk.") {
+        panic!("MAPBOX_CLI_BUNDLED_TOKEN must be a public pk. token");
+    }
+}
+
 /// New API surface lands in `openapi-specs` at something closer to a monthly
 /// rate, and the maintainer-only sync that regenerates `openapi/` from it
 /// runs weekly, so two weeks without one is already long enough to be worth a

build.rs

@@ -479,8 +479,9 @@ fn credentials_path_readonly(profile: Option<&str>) -> Option<PathBuf> {
 /// directory as a side effect of reading it — see
 /// [`credentials_path_readonly`]. What [`profiles`] reads each stored
 /// profile through, since listing what exists must not be the reason a
-/// directory starts to exist or its permissions change.
-fn load_credentials_readonly(profile: Option<&str>) -> Option<Credentials> {
+/// directory starts to exist or its permissions change, and what
+/// [`crate::cli_token`] reads the login through for the same reason.
+pub(crate) fn load_credentials_readonly(profile: Option<&str>) -> Option<Credentials> {
     let data = std::fs::read_to_string(credentials_path_readonly(profile)?).ok()?;
     serde_json::from_str(&data).ok()
 }
@@ -717,7 +718,7 @@ pub fn warn_if_environment_token_shadows_login(profile: Option<&str>, remedy: &s
     }
 }
 
-fn token_needs_refresh(token: &str) -> bool {
+pub(crate) fn token_needs_refresh(token: &str) -> bool {
     match token_expires_at(token) {
         Some(exp) => {
             let now = std::time::SystemTime::now()