Adversarial retest (Lena), 2026-10-20 UTC+8, cli-anything-hub 0.4.1 from repo/cli-hub. Random analytics ids and the embedded project token are redacted.

== repo/cli-hub/cli_hub/analytics.py: opt-out and agent detection (excerpts) ==
19:POSTHOG_API_HOST = "https://us.i.posthog.com"
84:def _is_enabled():
85:    return os.environ.get("CLI_HUB_NO_ANALYTICS", "").strip() not in ("1", "true", "yes")
97:def _stdin_is_tty():
99:        return sys.stdin.isatty()
105:    status_path = Path("/proc") / str(pid) / "status"
116:def _read_process_cmdline(pid):
117:    cmdline_path = Path("/proc") / str(pid) / "cmdline"
119:        raw = cmdline_path.read_bytes()
132:        cmd = _read_process_cmdline(pid)
159:    stdin_tty = _stdin_is_tty()
168:            "stdin_tty": stdin_tty,
169:            "is_interactive": stdin_tty,
172:    if not stdin_tty:
176:            "category": "scripted_client",
177:            "reason": "stdin-not-tty",
178:            "signals": ["stdin-not-tty"],
179:            "stdin_tty": False,
189:        "stdin_tty": True,
364:    stdin_tty = _stdin_is_tty()
371:        "stdin_tty": stdin_tty,
372:        "is_interactive": stdin_tty,
381:        "stdin_tty": context["stdin_tty"],

== Captured payload shape (from REPORT.md, distinct_id redacted) ==
{"event":"cli-hub call","distinct_id":"<redacted>","properties":{"hostname":"clianything.cc","hub_version":"0.4.1","command":"search","is_agent":true,"traffic_type":"agent","agent_category":"scripted_client","agent_reason":"stdin-not-tty","agent_signals":["stdin-not-tty"],"stdin_tty":false,"is_interactive":false,"platform":"linux"}}

== strace connect/sendmmsg, default settings: cli-hub search office ==
349456 connect(5, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
349456 connect(5, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
349456 connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("10.0.0.2")}, 16) = 0
349456 sendmmsg(5, [{msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\312)\1\0\0\1\0\0\0\0\0\0\2us\1i\7posthog\3com\0\0\1\0\1", iov_len=34}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, msg_len=34}, {msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="5(\1\0\0\1\0\0\0\0\0\0\2us\1i\7posthog\3com\0\0\34\0\1", iov_len=34}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, msg_len=34}], 2, MSG_NOSIGNAL) = 2
349456 connect(5, {sa_family=AF_INET, sin_port=htons(443), sin_addr=inet_addr("198.18.0.1")}, 16) = -1 EINPROGRESS (Operation now in progress)

== same with CLI_HUB_NO_ANALYTICS=1 (file is empty: 0 network calls) ==
0

== Disclosure: cli-hub/README.md lines 107-115 (also the PyPI long_description) ==
## Analytics

cli-hub sends anonymous usage events to help track adoption. The default provider is [PostHog](https://posthog.com), while the legacy Umami path remains available via `CLI_HUB_ANALYTICS_PROVIDER=umami`. No personal data is collected.

Opt out:

```bash
export CLI_HUB_NO_ANALYTICS=1
```

== Disclosure: docs/hub/docs.html lines 568-569 (live at https://clianything.cc/docs.html) ==
          CLI_HUB_NO_ANALYTICS=1 — opt out of anonymous, fire-and-forget usage analytics.
          CLI-Hub auto-detects when it&rsquo;s invoked by an AI agent (Claude Code, Codex, Cursor, and others) for analytics bucketing only.

== Top-level README.md: analytics/telemetry/posthog mentions ==
1