feat(telemetry): org attribution, agent user-agent, and working opt-out

[claude]

Requested by Andrew Huang · Slack thread

Description 📣

Before:

• CLI telemetry events carry no organization attribution: resolveOrganizationId only covered the agent-proxy/env-token paths, and even then the org was attached only as a PostHog group, never as a property, so events from logged-in users and most machine-identity runs cannot be attributed to an organization.
• The Infisical Agent sends the same "cli" user-agent as interactive CLI usage, so agent traffic is indistinguishable from humans running commands.
• --telemetry=false silently does nothing: the flag was read in init() before cobra parsed argv, so it always returned the registered default and telemetry stayed on.

After:

• Every captured event carries a flat organizationId property (plus the existing PostHog group attach), resolved fully offline from either the logged-in user's session JWT (organizationId claim, read from the system keyring) or a machine-identity access token in the environment (orgId claim). Resolution priority mirrors the existing distinct-id resolution. No server lookups; fails silently to empty, like the existing claim parsing. Nothing from the token itself is kept.
• The agent identifies itself as infisical-agent/<version> (reusing the CLI's ldflags-injected version variable). Interactive CLI keeps the "cli" user-agent.
• The telemetry opt-out actually works: --telemetry=false is now applied in PersistentPreRun after flag parsing, and a new INFISICAL_TELEMETRY_ENABLED environment variable is honored as well (an explicitly set flag wins over the env var; default remains enabled).

Privacy note for reviewers: the opt-out fix deserves attention on its own. Users who passed --telemetry=false have been opted in anyway because the flag was silently inert. That is a trust issue, not just a bug, and it is fixed here along with adding the env-var opt-out for CI and container use.

Paired backend PR: a companion backend change maps the infisical-agent user-agent prefix to its own channel server-side so agent traffic is split out of the cli channel. This PR and that one are independent to ship, but attribution of agent traffic only improves once both land.

How

• packages/telemetry/telemetry.go: CaptureEvent sets the flat organizationId property; resolveOrganizationId gains a logged-in-user step (new loggedInUserOrganizationId helper reading the keyring credentials and decoding claims with the existing IdentityClaimsFromToken); new SetEnabled method so opt-out surfaces can be applied after flag parsing.
• packages/cmd/root.go: telemetry enablement resolved after argv parsing (resolveTelemetryEnabled in PersistentPreRun), env-var evaluation at construction time (telemetryEnabledFromEnv), flag help text updated.
• packages/cmd/agent.go: new AGENT_USER_AGENT = "infisical-agent/" + util.CLI_VERSION, used at all five agent SDK-client construction sites (replaces api.USER_AGENT and resolves the existing TODO asking for a distinct agent user-agent).
• packages/util/constants.go: INFISICAL_TELEMETRY_ENABLED_NAME constant, following the existing INFISICAL_* naming convention.

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

• go build ./... passes.
• go vet clean for the touched packages (packages/telemetry, packages/util); the remaining vet findings (packages/cmd/run.go, packages/gateway-v2, packages/pam/handlers/kubernetes) pre-exist on main, verified against the unmodified baseline.
• go test ./packages/util/... ./packages/cmd/... passes (packages/cmd requires -vet=off due to the pre-existing run.go vet findings; packages/telemetry has no test files).
• Manual sanity of the claims decoder with fabricated JWTs: machine token (orgId claim), user session token (organizationId claim), st. service token, and garbage input all resolve as expected.

# machine: identityId="mi-123" orgId="org-abc"
# user:    identityId=""       orgId="org-user"
# svc tok: identityId=""       orgId=""
# garbage: identityId=""       orgId=""

• Built binary smoke test: infisical --telemetry=false --version and INFISICAL_TELEMETRY_ENABLED=false infisical --version both run clean.

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

---

Generated by Claude Code