fix(telemetry): reduce PostHog event volume, fix consent dark pattern

[edelauna]

Related GitHub Issue

Closes: #830

Description

PostHog's Product Analytics quota was 2.7x over its free-tier limit (2.7M/1M events in the June 6 - July 6 cycle), driven mainly by a CODE_INDEX_ERROR retry-storm bug (309 people generating 254,786 events) and per-turn Conversation Message/Tool Used events. Separately, a telemetry gap analysis found the consent banner treated dismissal (and the default "unset" state) as opt-in rather than a real choice.

Volume reduction:

• Circuit-breaker for CODE_INDEX_ERROR: sliding 10-minute window, trips after 50 occurrences, independent of any other telemetry the same install sends (so unrelated events can't mask or reset a burst).
• Conversation Message/Tool Used are no longer emitted per-turn/per-tool-call. Instead, Task.messageCounts and Task.toolUsage are summarized once into toolsUsed/messageCount on the Task Completed event, fired only when a task actually completes (single emission per task, not per attempt/feedback round).
• Model Cache Empty Response throttled to once per distinct provider+endpoint (matching the same compound cache-key identity the model cache itself uses) until a non-empty response is seen.

Consent / privacy:

• Added isTelemetryOptedIn() (packages/types) requiring an explicit "enabled" setting. Replaces the previous telemetrySetting !== "disabled" check used in 5 places, which silently treated the default "unset" state as consent.
• Telemetry banner: the "×" is now a neutral dismiss (sends no message, leaves the setting "unset"); added explicit Accept/Decline buttons. Localized across all 18 supported locales.
• Extension now reacts live to vscode.env.onDidChangeTelemetryEnabled in addition to the existing (deprecated) telemetry.telemetryLevel check.
• TelemetryService.shutdown() is now properly awaited on deactivation, tracks in-flight capture()/captureException() promises and drains them before flushing/closing clients, and is wrapped so a shutdown failure can't skip terminal cleanup.
• PRIVACY.md clarified: the "does not collect code or prompts" telemetry bullet now notes this applies to the PostHog path only — the separate Cloud task-sync pipeline does transmit task messages when enabled.
• Tool usage is now recorded for analytics only after the tool name passes validation, so a model-supplied name can never reach PostHog as an arbitrary toolsUsed property key.

Explicitly out of scope for this PR:

• Hashing vscode.env.machineId — assessed and dropped; it's already a random per-install UUID, not a hostname/username-derived identifier, so hashing it would pseudonymize an already-non-identifying value while losing existing PostHog person continuity.
• Error-tracking-specific fixes (redacting captureException payloads, potentially moving CODE_INDEX_ERROR from Product Analytics to Error Tracking) — Error Tracking was only 6% over quota vs. Product Analytics' 2.7x, so it wasn't the priority; flagged for a follow-up.
• PostHog project-level config (autocapture/session-recording/heatmaps opt-out) — needs PostHog UI access, not a code change.

Test Procedure

• pnpm check-types and pnpm lint clean across all 14 packages.
• Full test suite: 6671 tests in src, 1439 in webview-ui, 42 in @roo-code/telemetry, 238 in @roo-code/types — all passing.
• New/updated tests cover: the circuit breaker's sliding window and independence from unrelated events, Task Completed payload aggregation, per-endpoint empty-model throttling, the banner's Accept/Decline/neutral-dismiss behavior, isTelemetryOptedIn() semantics, the onDidChangeTelemetryEnabled listener, shutdown draining/error-handling, and the tool-name validation gate.
• Manual verification recommended: fresh profile shows Accept/Decline banner; "×" dismisses without enabling; a completed task emits exactly one Task Completed event with toolsUsed/messageCount and zero Conversation Message/Tool Used events.

Pre-Submission Checklist

• Issue Linked: This PR is linked to an approved GitHub Issue (see "Related GitHub Issue" above).
• Scope: My changes are focused on the linked issue (one major feature/fix per PR).
• Self-Review: I have performed a thorough self-review of my code.
• Testing: New and/or updated tests have been added to cover my changes (if applicable).
• Documentation Impact: I have considered if my changes require documentation updates (see "Documentation Updates" section below).
• Contribution Guidelines: I have read and agree to the Contributor Guidelines.

Documentation Updates

• No documentation updates are required.
• Yes, documentation updates are required. PRIVACY.md updated to clarify the Cloud task-sync pipeline's scope relative to PostHog telemetry.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 49eaaab4-c425-4269-8221-a922dce7c8fb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch issue/830

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 10 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
.../core/assistant-message/presentAssistantMessage.ts	57.14%	2 Missing and 1 partial ⚠️
src/core/task/Task.ts	25.00%	3 Missing ⚠️
packages/telemetry/src/TelemetryService.ts	94.73%	2 Missing ⚠️
src/core/webview/webviewMessageHandler.ts	33.33%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!