fix(telemetry): redact aliased flags, gate rebind, fix categorization

Addresses code-review findings:

1. redact.go (HIGH): `createos login -t <token>` leaked the raw
   token because LocalFlagNames returned the alias "t" and
   RedactFlagValue's substring match did not catch it.
   FlagsFromContext now resolves the cli.Flag via Lineage and
   redacts when ANY of its Names() (canonical or alias) matches
   the denylist.

2. login.go (MEDIUM): If GetUser or SaveIdentity failed,
   RebindIdentity could load a stale .identity from a previous
   user and mis-attribute login telemetry. Now we only rebind
   when SaveIdentity succeeds for the current account; otherwise
   delete any stale identity file and skip rebind.

3. errors.go (LOW): "non-interactive mode: use --token flag to
   sign in" was bucketed as auth because the auth needles ran
   first. Re-ordered: user_input substrings now check first.

4. README.md (LOW): Telemetry disclosure no longer claims data is
   anonymous unconditionally; clarifies that events are anonymous
   pre-login and tied to account_id (and project_id when
   applicable) post-login.

Author: pratikbin

README.md

@@ -470,6 +470,9 @@ createos environments list --project <id> -o json
 
 ## Telemetry
 
-The CLI sends anonymous usage data (commands run, version, OS, error categories)
-to help us improve the product. No file paths, command output, or secrets are
+The CLI sends usage telemetry (commands run, version, OS, error categories)
+to help us improve the product. Before you run `createos login`, events are
+anonymous and tied only to a one-way machine hash. After login, events are
+associated with your account ID and may include the project ID for
+project-scoped commands. No file paths, command output, or secrets are
 collected. To disable, set `CREATEOS_DO_NOT_TRACK=1` in your environment.

cmd/auth/login.go

@@ -43,20 +43,35 @@ func captureLoginFailure(method string, err error) {
 // fetch /me, persist Identity (preserving AliasedForUserID for same user),
 // rebind telemetry distinct_id to user_id, then emit success auth_event.
 // All identity fetching is best-effort — a failure here must NOT fail login.
+//
+// If /me fails OR SaveIdentity fails, we DELETE any pre-existing .identity
+// file and skip RebindIdentity — otherwise stale identity from a previous
+// account on this machine would mis-attribute the new login's telemetry.
 func bindIdentityAndCapture(apiClient *api.APIClient, method string) {
+	identityFresh := false
 	if apiClient != nil {
 		if u, err := apiClient.GetUser(); err == nil && u != nil && u.ID != "" {
 			id := config.Identity{UserID: u.ID}
 			if existing, _ := config.LoadIdentity(); existing != nil && existing.UserID == u.ID {
 				id.AliasedForUserID = existing.AliasedForUserID
 			}
-			_ = config.SaveIdentity(id)
+			if saveErr := config.SaveIdentity(id); saveErr == nil {
+				identityFresh = true
+			}
 		}
 		// Silent on /me failure — login still succeeds without user_id.
 	}
 
+	if !identityFresh {
+		// /me or SaveIdentity failed; drop any stale identity so that a later
+		// command does not attribute events to a previous user_id.
+		_ = config.DeleteIdentity()
+	}
+
 	if telemetry.Default != nil {
-		telemetry.Default.RebindIdentity()
+		if identityFresh {
+			telemetry.Default.RebindIdentity()
+		}
 		telemetry.Default.Capture("auth_event", map[string]any{
 			"action":  "login",
 			"method":  method,

internal/telemetry/errors.go

@@ -9,7 +9,9 @@
 // Order of checks (first match wins):
 //  1. *api.APIError → category by HTTP status.
 //  2. context.DeadlineExceeded / net.Error → "network".
-//  3. local sentinel substrings → "auth" or "user_input".
+//  3. local sentinel substrings → "user_input" first, then "auth".
+//     user_input is checked first because some validation messages contain
+//     auth-shaped phrases (e.g. "use --token flag to sign in").
 //  4. default → "unknown".
 package telemetry
 
@@ -57,15 +59,17 @@ func CategorizeError(err error) (category string, apiStatusCode int) {
 	}
 
 	// 3. Locally-raised sentinels — string match on err.Error().
+	// user_input first: some validation messages embed "sign in" wording
+	// (e.g. "non-interactive mode: use --token flag to sign in").
 	msg := err.Error()
-	for _, needle := range authNeedles {
+	for _, needle := range userInputNeedles {
 		if strings.Contains(msg, needle) {
-			return "auth", 0
+			return "user_input", 0
 		}
 	}
-	for _, needle := range userInputNeedles {
+	for _, needle := range authNeedles {
 		if strings.Contains(msg, needle) {
-			return "user_input", 0
+			return "auth", 0
 		}
 	}
 

internal/telemetry/redact.go

@@ -19,13 +19,65 @@ const redactedSentinel = "[REDACTED]"
 // RedactFlagValue returns the original value or the sentinel when the flag
 // name matches any deny keyword (case-insensitive substring match).
 func RedactFlagValue(name string, value any) any {
+	if isSensitiveName(name) {
+		return redactedSentinel
+	}
+	return value
+}
+
+// isSensitiveName reports whether a flag name (canonical or alias) matches
+// any deny keyword via case-insensitive substring match.
+func isSensitiveName(name string) bool {
 	lower := strings.ToLower(name)
 	for _, kw := range denyKeywords {
 		if strings.Contains(lower, kw) {
-			return redactedSentinel
+			return true
 		}
 	}
-	return value
+	return false
+}
+
+// findFlagByName walks c.Lineage() (child→root) and returns the cli.Flag whose
+// Names() include name (canonical or alias). Returns nil when not found.
+func findFlagByName(c *cli.Context, name string) cli.Flag {
+	if c == nil {
+		return nil
+	}
+	for _, ctx := range c.Lineage() {
+		if ctx.Command != nil {
+			for _, f := range ctx.Command.Flags {
+				for _, n := range f.Names() {
+					if n == name {
+						return f
+					}
+				}
+			}
+		}
+		if ctx.App != nil {
+			for _, f := range ctx.App.Flags {
+				for _, n := range f.Names() {
+					if n == name {
+						return f
+					}
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// anyAliasSensitive returns true when any of the flag's Names()
+// (canonical + aliases) matches the denylist.
+func anyAliasSensitive(f cli.Flag) bool {
+	if f == nil {
+		return false
+	}
+	for _, n := range f.Names() {
+		if isSensitiveName(n) {
+			return true
+		}
+	}
+	return false
 }
 
 // NormalizeAPIURL strips path/query/fragment, returning "scheme://host" only.
@@ -60,6 +112,13 @@ func FlagsFromContext(c *cli.Context) map[string]any {
 				continue
 			}
 		}
+		// Canonicalize: redact when ANY alias of this flag matches the
+		// denylist, not just the user-supplied alias. Example: `login -t <T>`
+		// reports name="t" via LocalFlagNames; the canonical "token" matches.
+		if anyAliasSensitive(findFlagByName(c, name)) {
+			out[name] = redactedSentinel
+			continue
+		}
 		out[name] = RedactFlagValue(name, v)
 	}
 	return out