improvement(analytics): attribute every request, credential, and queued run

[waleedlatif1]

Summary

• Record the auth kind where each credential is verified (getSession, API keys, OAuth access tokens, internal JWTs), so routes that call getSession() directly are attributed too. Verifier stamps never replace a principal a route builder already described. Removes the now-redundant recordingAuth wrapper in hybrid auth and the v1 auth stamp
• Every request gets a surface. Undeclared traffic starts as unknown with its User-Agent product (client_name, e.g. python-requests, browser), then is refined by the credential that authenticated it: customer credentials become api, Sim service credentials (internal_jwt, delegated, system) become internal
• Carry request attribution into queued workflow runs (like OTel baggage) and restore it in the worker; schedule and webhook runs are attributed to schedule / webhook
• CLI coding agent detection now matches the GitHub CLI's internal/agents/detect.go table (names, markers, order: adds copilot-cli, splits cursor / cursor-cli, augment-cli), leaving out only the signals that table marks low confidence (REPL_ID, GOOSE_PROVIDER, TERM_PROGRAM=kiro, PATH .pi/agent) since they fire for a person too
• CLI reports coding_agent: none (and agent/none in X-Sim-Client-Info) when no agent is detected, so an empty value only means "not reported"

Type of Change

• Improvement

Testing

• Unit tests for the resolver, credential refinement, verifier stamps, preserveExisting, job attribution capture, and the CLI none value
• Full apps/sim suite, sim-cli suite with and without SIM_CLI_TELEMETRY_KEY, type-check, lint, check:audits

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 15, 2026 1:14am UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable correctness, security, or repository-rule violations remain.

Summary

This PR expands request and workflow-run observability without changing authentication or authorization decisions.

• Stamps successfully verified sessions, API keys, OAuth tokens, and internal JWTs with their authentication kind.
• Resolves undeclared callers to bounded client names and credential-derived API or internal surfaces.
• Propagates request attribution through queued workflow execution and assigns explicit schedule and webhook surfaces.
• Reports an explicit none coding-agent value from the CLI when telemetry is enabled but no agent is detected.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Request[Incoming request] --> Resolve[Resolve declared client or User-Agent]
  Resolve --> Context[Request context]
  Credential[Credential verifier] --> Auth[Stamp authentication kind]
  Auth --> Refine[Refine unknown surface to API or internal]
  Context --> Refine
  Refine --> Events[Logs, analytics, and audit metadata]
  Refine --> Capture[Capture attribution]
  Capture --> Queue[Workflow job payload]
  Queue --> Worker[Restore worker request context]
  Schedule[Schedule trigger] --> ScheduledContext[Schedule context]
  Webhook[Webhook trigger] --> WebhookContext[Webhook context]
  ScheduledContext --> Events
  WebhookContext --> Events
  Worker --> Events

Loading

_{Reviews (1) · Last reviewed commit: "improvement(analytics): attribute every ..."}