PR #1086 - AltimateAI/altimate-code

Issue for this PR

Deferred items tracker: #1087 (not "closes" — kept separately as a stub for ongoing work).

Type of change

Bug fix
New feature
Refactor / code improvement
Documentation

(Bundle of test/docs improvements + one small env-var fix — no user-facing feature change.)

What does this PR do?

Fixes surfaced by the v0.9.5 pre-release multi-persona review (CTO, PM, End-user, Tech Lead, Chaos Gremlin) and then by a second review pass from codex + coderabbit + cubic on the PR itself. All persona verdicts came back SHIP or SHIP WITH NOTES; zero P0s. This PR lands the actionable findings before we tag v0.9.5.

Round 1 — persona review (commits 1-6):

Commit	Fix	Source
`233bb0e9`	fix(telemetry) — accept `1`/case-insensitive `true` on `ALTIMATE_TELEMETRY_DISABLED` + honor `OPENCODE_DISABLE_TELEMETRY` fallback (v0.9.4 CHANGELOG promised this env var but it was only wired in test fixtures)	Chaos + End-user
`078876be`	docs(configure) — document `Ctrl+Y` YOLO mid-session toggle in `permissions.md` + `keybinds.md`	PM
`28fb4766`	test(telemetry) — cover `classifyProvider` allowlist + prototype-pollution defense against `constructor`/`toString`/`valueOf`	Tech Lead
`66fb1658`	test(sample-setup) — cover `redactPaths` + `countSampleContents` docstring claims (José, O'Connor, sentence-swallow)	Tech Lead
`4759a751`	test(onboarding) — assert `claimEnvironmentScan` idempotency + session isolation	Tech Lead
`388f41bc`	chore(welcome) — replace vague "(tracked separately)" claim with explicit `FIXME(telemetry-init-config-opt-out)` anchor + honest description of the pre-existing gap	PM

Round 2 — bot review follow-ups (commits 7-10):

Commit	Fix	Source
`2407ededa`	docs(permissions) — include `OPENCODE_YOLO` in the YOLO mid-session toggle restart-state sentence	coderabbit
`37430a5c`	test(telemetry) — drop redundant `not.toContain` before `toBe("other")` in the prototype-defense test	cubic
`a5c1ca7e`	test(sample-setup) — switch to per-test `tmpdir()` fixture per repo convention + assert whitespace-in-path documented gap	coderabbit + cubic + codex
`3bd7f647`	test(telemetry) — cover `OPENCODE_DISABLE_TELEMETRY` fallback + gate-site source anchor (proves both call sites retain the OR-composition, not just the shared helper)	codex + coderabbit + cubic

How did you verify your code works?

Typecheck: 13/13 workspace packages green (bun turbo typecheck)
Full altimate suite: 4042 pass, 637 skip, 0 fail across 4679 tests, 136s wall-clock
Touched suites (test/telemetry/, test/altimate/sample-setup-helpers.test.ts, test/altimate/altimate-plugin.test.ts): 258/258 green
New tests in this PR: 74 (23 telemetry-opt-out with the added fallback+source-anchor coverage · 28 classifyProvider · 17 sample-setup helpers with per-test tmpdir + space-in-path · 6 environment-scan claim)
Marker guard vs origin/main: clean — no upstream-shared files touched
Codex independent review (see PR review section below): no must-fix findings; class-level gaps codex named were addressed in Round 2

Screenshots / recordings

Not applicable — no UI change.

Checklist

I have tested my changes locally
I have not included unrelated changes in this PR

Deferred items

Deferred (design/process/monitoring work) is tracked in #1087:

Windows CI flake surface (windows-ripgrep-e2e + one ERR_STREAM_PREMATURE_CLOSE flake on merge commit 092567a8d2)
The telemetry-init config-opt-out gap flagged in welcome.ts (pre-existing; would require moving doInit() behind Instance.provide() — not a v0.9.5 hotfix)

Coderabbit's Major finding on telemetry/index.ts::doInit is the same gap — see #1087.

Not action-needed: @zip.js/zip.js supply-chain concern is already exact-pinned at 2.7.62 in both packages/core/package.json and packages/opencode/package.json.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Q8FGy89Qpr39k8nCSpCcK2

Summary by CodeRabbit

New Features
- Added Ctrl+Y to toggle YOLO mode during a session.
- Enabling YOLO mode requires confirmation; disabling it takes effect immediately.
- The setting applies to the current session and subagents, resets after restart, and continues honoring explicit deny rules.
Privacy
- Telemetry can now be disabled through either supported environment variable using case-insensitive true or 1 values.
Documentation
- Updated keybinding and permissions documentation to explain session YOLO mode behavior.