refactor(telemetry): address remaining PR #1035 review feedback

Three follow-ups from @miguel-heygen's review:

1. HERMES_QUIET — switch to existence check.
   `env["HERMES_QUIET"] === "1"` was brittle vs. future Hermes changes
   (e.g. if cli.py ever sets it to "true"). The var name itself is
   specific enough that existence is the right signal.

2. CI_PROVIDERS — convert to a discriminated union.
   `mode: "truthy" | "presence"` is stricter than the previous pair of
   optional boolean flags (which allowed entries with neither set).

3. Sandbox detection tests — add coverage.
   - Docker positive: /.dockerenv present → docker.
   - Negative case: plain Linux laptop with no markers → null.

Together with the gVisor 4.4.0 fix in the previous commit, that addresses
all three actionable callouts (the discriminated-union nit was non-blocking
but worth doing while in the file).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/cli/src/telemetry/agent_runtime.test.ts

@@ -172,6 +172,57 @@ describe("detectAgentRuntime — Jules / Replit / Devin / Hermes / openclaw", ()
   });
 });
 
+describe("detectSandboxRuntime — file-system path", () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    vi.resetModules();
+    vi.restoreAllMocks();
+  });
+
+  it("reports docker when /.dockerenv exists", async () => {
+    vi.doMock("node:os", async () => {
+      const actual = await vi.importActual<typeof import("node:os")>("node:os");
+      return { ...actual, release: () => "6.8.0-100-generic", platform: () => "linux" };
+    });
+    vi.doMock("node:fs", async () => {
+      const actual = await vi.importActual<typeof import("node:fs")>("node:fs");
+      return {
+        ...actual,
+        existsSync: (path: string) => path === "/.dockerenv" || actual.existsSync(path),
+        readFileSync: (path: string) =>
+          path === "/proc/version" ? "Linux version 6.8.0-100-generic" : actual.readFileSync(path),
+      };
+    });
+    const { detectSandboxRuntime } = await import("./agent_runtime.js");
+    expect(detectSandboxRuntime()).toBe("docker");
+  });
+
+  it("returns null on a plain non-sandboxed Linux laptop", async () => {
+    vi.doMock("node:os", async () => {
+      const actual = await vi.importActual<typeof import("node:os")>("node:os");
+      return { ...actual, release: () => "6.8.0-100-generic", platform: () => "linux" };
+    });
+    vi.doMock("node:fs", async () => {
+      const actual = await vi.importActual<typeof import("node:fs")>("node:fs");
+      return {
+        ...actual,
+        existsSync: () => false,
+        readFileSync: (path: string) =>
+          path === "/proc/version"
+            ? "Linux version 6.8.0-100-generic (buildd@lcy01)"
+            : path === "/proc/1/cgroup"
+              ? "0::/user.slice/user-1000.slice"
+              : actual.readFileSync(path),
+      };
+    });
+    const { detectSandboxRuntime } = await import("./agent_runtime.js");
+    expect(detectSandboxRuntime()).toBeNull();
+  });
+});
+
 describe("detectSandboxRuntime — kernel-string path", () => {
   beforeEach(() => {
     vi.resetModules();

packages/cli/src/telemetry/agent_runtime.ts

@@ -106,11 +106,12 @@ const VENDOR_RULES: VendorRule[] = [
   // Nous Research Hermes Agent — cli.py:50 unconditionally executes
   //   os.environ["HERMES_QUIET"] = "1"
   // at module load, so the marker propagates via os.environ to every
-  // subprocess spawned by Hermes.
+  // subprocess spawned by Hermes. Keying on existence (not the literal
+  // "1") so we still match if Hermes ever changes the value.
   // Source: https://github.com/NousResearch/hermes-agent (cli.py:50)
   {
     name: "hermes",
-    check: (env) => env["HERMES_QUIET"] === "1",
+    check: (env) => typeof env["HERMES_QUIET"] === "string",
   },
   // openclaw — multi-channel AI gateway. When openclaw spawns a CLI
   // subprocess it builds the child env with OPENCLAW_STATE_DIR /

packages/cli/src/telemetry/system.ts

@@ -93,24 +93,26 @@ function detectDocker(): boolean {
   return false;
 }
 
-// Each entry: env var name, optional named CI provider, predicate.
 // Named providers come first so getCIName() picks the most specific match.
-// `truthy` accepts 'true' or '1' to cover both common conventions.
-const CI_PROVIDERS: Array<{ name: string | null; envVar: string; truthy?: true; presence?: true }> =
-  [
-    { name: "github_actions", envVar: "GITHUB_ACTIONS", truthy: true },
-    { name: "gitlab_ci", envVar: "GITLAB_CI", truthy: true },
-    { name: "circleci", envVar: "CIRCLECI", truthy: true },
-    { name: "jenkins", envVar: "JENKINS_URL", presence: true },
-    { name: "buildkite", envVar: "BUILDKITE", truthy: true },
-    { name: "travis", envVar: "TRAVIS", truthy: true },
-    { name: null, envVar: "CONTINUOUS_INTEGRATION", truthy: true },
-    { name: null, envVar: "CI", truthy: true },
-  ];
+// `truthy` accepts 'true' or '1'; `presence` matches any non-null value.
+type CIProvider =
+  | { name: string | null; envVar: string; mode: "truthy" }
+  | { name: string | null; envVar: string; mode: "presence" };
 
-function matchesProvider(p: (typeof CI_PROVIDERS)[number]): boolean {
+const CI_PROVIDERS: CIProvider[] = [
+  { name: "github_actions", envVar: "GITHUB_ACTIONS", mode: "truthy" },
+  { name: "gitlab_ci", envVar: "GITLAB_CI", mode: "truthy" },
+  { name: "circleci", envVar: "CIRCLECI", mode: "truthy" },
+  { name: "jenkins", envVar: "JENKINS_URL", mode: "presence" },
+  { name: "buildkite", envVar: "BUILDKITE", mode: "truthy" },
+  { name: "travis", envVar: "TRAVIS", mode: "truthy" },
+  { name: null, envVar: "CONTINUOUS_INTEGRATION", mode: "truthy" },
+  { name: null, envVar: "CI", mode: "truthy" },
+];
+
+function matchesProvider(p: CIProvider): boolean {
   const v = process.env[p.envVar];
-  if (p.presence) return v != null;
+  if (p.mode === "presence") return v != null;
   return v === "true" || v === "1";
 }