fix(media-use): honor telemetryEnabled: false from shared config in optedOut

[iamcipherdev]

What

Media-use telemetry now honors the CLI opt-out: optedOut() in telemetry.mjs also returns true when the shared config (~/.hyperframes/config.json) has telemetryEnabled: false.

Why

hyperframes telemetry disable writes telemetryEnabled: false to the shared config, but the media-use scripts' optedOut() only checked env vars (HYPERFRAMES_NO_TELEMETRY, DO_NOT_TRACK, CI, NODE_ENV). So transcribe.mjs, transcript-cut.mjs, and audio-duck.mjs kept posting PostHog events for a user who had opted out through the CLI — and when ~/.heygen/credentials exists, identifyAccount() additionally sends the account email as the distinct id.

Related work

Fixes #5465

Checked for overlap before starting (per TRIAGE.md): no comments, assignees, or open PRs on this issue; the open telemetry PRs (#5425 onnxruntime telemetry, #5460 prefs serialization) touch different behavior.

How

• optedOut() now checks readSharedConfig().telemetryEnabled === false first, reusing the helper already present in the same file (it never throws; an unreadable/malformed config is treated as empty, so tracking behavior is unchanged in that case).
• Applied byte-identically to both copies of telemetry.mjs — skills/media-use/scripts/lib/ and packages/cli/src/media-use/lib/ — per the media-use copy-parity rule (scripts/check-media-use-copy-parity.test.mjs); verified the two files are identical after the change.
• The one added comment says why (one opt-out must cover CLI + skills), per the Comments guidance.

Test plan

• Unit tests added/updated
• Manual testing performed
• Documentation updated (if applicable)
• Comments follow CONTRIBUTING.md "Comments": they say why, not what, and a bug fix says what the code must do and how to reproduce the bug

New test in packages/cli/src/media-use/lib/telemetry.test.mjs (sandboxed HOME: no config → allowed; telemetryEnabled: false → opted out; true → allowed; malformed JSON → allowed) and a new skills/media-use/scripts/lib/telemetry.test.mjs covering the same config cases plus the env opt-out on the standalone copy.

Ran with the repo's test-home harness (node --import ./packages/cli/scripts/test-home.mjs --test <files>): CLI telemetry suite 15/15 pass, skills telemetry suite 5/5 pass. oxfmt --check and oxlint are clean on all four changed files. I worked from a sparse checkout, so I did not run the full bun run test suite.

[jrusso1020]

Reviewed at 836619ca. The fix itself is right, but two things in this PR need changing before it can merge.

The fix is correct.

• readSharedConfig().telemetryEnabled === false reads the file the CLI writes. packages/cli/src/telemetry/config.ts writes ~/.hyperframes/config.json, and client.ts reads the same telemetryEnabled key.
• readSharedConfig never throws: an unreadable or non-object file reads as {}.
• All three senders check optedOut() before doing anything (the batch flush, identifyAccount and track), so hyperframes telemetry disable now also stops the account-email identify.
• Both copies of telemetry.mjs are still byte-identical.

Changes needed

1. skills-manifest.json isn't regenerated. bun packages/cli/scripts/gen-skills-manifest.ts --check at this head reports ~ media-use (d0875c7f8bc28d51 → …), so the required "Skills: manifest in sync" job will fail. Run bun run --cwd packages/cli gen:skills-manifest after the change below and commit the result. The hash depends on the test file too.
2. skills/media-use/scripts/lib/telemetry.test.mjs writes the real ~/.hyperframes/config.json. It builds configPath from homedir() and restores the saved contents in test.after.
   • In CI this happens to be safe, because Test: skills runs with --import ./packages/cli/scripts/test-home.mjs, which points HOME at a temp folder.
   • A developer running node --test on this file directly overwrites their own config. If the run dies before after, they lose it, or end up with telemetryEnabled set to whatever the last case wrote.
   • The packages/cli test in this same PR does it the safe way with sandbox(). Do the same here: set HOME/USERPROFILE to a mkdtempSync folder in before, build configPath from that folder, and delete it in after. os.homedir() reads HOME on every call, so readSharedConfig() follows.

With both done, the 5 skills cases and the 15 packages/cli cases pass, --check is in sync, and the real config isn't touched. I checked this locally with exactly those two changes.

— Rames

[jrusso1020]

Approving at 0b07e51c. It's 836619ca plus two maintainer commits, pushed with your "allow edits" permission. 649aef15 makes the two changes from my review, and 0b07e51c merges main (86ff462d), which conflicted only in skills-manifest.json. The diff against main is the 5 files of this fix and nothing else.

• telemetry.test.mjs no longer touches the real config. before points HOME/USERPROFILE at a mkdtempSync folder, configPath is built from that folder, and after restores the environment and deletes the folder. The test no longer reads, saves or rewrites ~/.hyperframes/config.json.
• skills-manifest.json is regenerated on the merged tree: media-use is now 0fc5a05cc62ef03b.

Locally:

• All 5 skills cases and 15 packages/cli telemetry cases pass.
• gen-skills-manifest.ts --check is in sync.
• oxfmt --check with the repo config is clean.
• A real ~/.hyperframes/config.json was left untouched.

The fix itself is unchanged from my earlier review and correct: hyperframes telemetry disable now also stops media-use's track, flush and account identify. Thanks for the fix, @iamcipherdev.

— Rames