[codyde]

Problem

caller_from_process_name substring-matches agent names (cody, copilot, gemini, qwen, cursor, codex, ...) anywhere in each ancestor's full command line. That includes text that says nothing about which program is running:

• macOS Terminal's login -pf <username> and sshd: <user>@pts/0 sit above every shell, so the username is matched.
• Home and project folders (/Users/cody/..., ~/code/copilot-dashboard/server.js).
• Arguments: model ids like --model qwen3-coder, flags, unrelated paths.

Data (warehouse, Oct 8–14)

• cody: 60 users/wk (43 macOS, 17 Linux). Only 3 have a cody-like email, and 28 of the 60 are also tagged qwen_code, a rare slug at 109 users/wk total. Their other callers include hermes/openclaw residues. That points to argument and path text, not Sourcegraph Cody.
• Other substring-only slugs with similar exposure: copilot_cli 423, gemini_cli 403, qwen_code 109, replit_agent 43, goose 31, junie 14, aider 8.

Change

Substring arms now match only the program's identity surface:

• argv0, plus, for interpreters and launchers (node, python*, bun, deno, npx, npm/pnpm/yarn exec|dlx, uv run, pipx run, shells), the first operand, i.e. the script or module that actually runs.
• Paths under a home directory keep only tooling segments: everything from the first hidden dir on (~/.nvm/..., ~/.hermes/...), node_modules package names (with scope), and the basename. The username segment is always dropped.
• Paths outside home (/opt, /usr/local, /Applications/X.app) are kept whole.

Exact-basename arms are unchanged.

Effect

This reclassifies some users from a named agent to agent_unknown (or tty:*) when the only evidence was path or argument text. A trade-off: agents run from a plain, non-hidden checkout under home (e.g. node ~/src/openclaw/gateway.js) lose the path match. Installed agents (global npm, nvm, brew, ~/.local, app bundles, /opt) still match.

Tests

New negative cases: login -pf cody, sshd, home dirs on macOS/Linux/Windows, copilot-dashboard and cursor-clone project folders, agent names in arguments. New positive cases: nvm/npm-global/local node_modules installs, python -m aider, npx/npm exec/uv run. All 54 telemetry tests pass; clippy has the same 61 warnings as master.

Do not merge without review: this reclassifies users.

🤖 Generated with Claude Code