Fix telemetry security and reliability issues from PR #2 review

[Copilot]

Addresses 8 review comments on PostHog telemetry implementation covering privacy, error handling, and session tracking.

Privacy & Security

• Site DNT support: No-op telemetry when navigator.doNotTrack is enabled
• Sensitive data sanitization: Query strings filtered to UTM params only, referrers reduced to origin

  // Before: full URL + referrer sent
  { referrer: "https://internal.corp/secret?token=xyz", query: "?token=abc&utm_source=github" }
  
  // After: sanitized
  { referrer: "https://internal.corp", query_params: "?utm_source=github" }

Error Handling

• Filesystem operations: CLI and MCP telemetry wrapped in try/catch, falls back to ephemeral anonymous IDs in read-only environments
• Malformed state: Gracefully handles corrupted ~/.relay/telemetry.json

Session Tracking

• HTTP transport: Single telemetry instance per MCP session (was creating duplicate clients)
• Property collision: Renamed MCP transport's session_id → mcp_transport_session_id to avoid overwriting base telemetry session

Testing

• MCP telemetry module: 12 tests covering opt-out precedence, host trimming, error tolerance, flush behavior

Misc

• CLI version: Updated hardcoded CLI_VERSION from 0.1.0 to 0.1.2 (matches package.json)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• posthog.example.com
  • Triggering command: /opt/hostedtoolcache/node/24.13.0/x64/bin/node /opt/hostedtoolcache/node/24.13.0/x64/bin/node --conditions node --conditions development --experimental-import-meta-resolve --require /home/REDACTED/work/relaycast/relaycast/packages/mcp/node_modules/vitest/suppress-warnings.cjs /home/REDACTED/work/relaycast/relaycast/packages/mcp/node_modules/vitest/dist/workers/forks.js (dns block)
• relay.posthog.com
  • Triggering command: /opt/hostedtoolcache/node/24.13.0/x64/bin/node /opt/hostedtoolcache/node/24.13.0/x64/bin/node --conditions node --conditions development --experimental-import-meta-resolve --require /home/REDACTED/work/relaycast/relaycast/packages/mcp/node_modules/vitest/suppress-warnings.cjs /home/REDACTED/work/relaycast/relaycast/packages/mcp/node_modules/vitest/dist/workers/forks.js (dns block)
• us.i.posthog.com
  • Triggering command: /opt/hostedtoolcache/node/24.13.0/x64/bin/node /opt/hostedtoolcache/node/24.13.0/x64/bin/node --conditions node --conditions development --experimental-import-meta-resolve --require /home/REDACTED/work/relaycast/relaycast/packages/mcp/node_modules/vitest/suppress-warnings.cjs /home/REDACTED/work/relaycast/relaycast/packages/mcp/node_modules/vitest/dist/workers/forks.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)