From f80771b0c248e2eec9ce1d29713268ee2b9279e8 Mon Sep 17 00:00:00 2001 From: Miguel Martinez Trivino Date: Fri, 28 Aug 2026 17:45:53 +0200 Subject: [PATCH] chore(devel): enable CLI telemetry in the traced sandbox kit Drop DO_NOT_TRACK=1 from the sandbox kit environment and allow egress to crb.chainloop.dev, the endpoint the CLI reports usage telemetry to, so sessions run through the kit are counted like any other CLI usage. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino Chainloop-Trace-Sessions: 6a463356-6105-4697-a537-fd08c713afa2 Signed-off-by: Miguel Martinez Trivino --- devel/sandbox-kit/spec.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devel/sandbox-kit/spec.yaml b/devel/sandbox-kit/spec.yaml index f9d148ff3..2780c2d9f 100644 --- a/devel/sandbox-kit/spec.yaml +++ b/devel/sandbox-kit/spec.yaml @@ -258,7 +258,6 @@ environment: # MUST share it (transcript discovery is os.UserHomeDir()-based; a mismatch # silently loses usage/cost/tools), but sbx already sets HOME=/home/agent on # PID 1, so every child inherits it - verified in a plain `claude` sandbox. - DO_NOT_TRACK: "1" # silence PostHog telemetry under restricted egress # Mode selection - see the traceMode arg above for what each value does. CHAINLOOP_TRACE_MODE: ${{ kit.args.traceMode }} # `trace run` identity ONLY. Empty in persistent mode, where the identity @@ -365,6 +364,7 @@ permissions: # v1: `network.allowedDomains:` - "api.cp.chainloop.dev:443" # control plane - ALWAYS (attest + keyless signing CSR) - "api.cas.chainloop.dev:443" # CAS - only if the org CAS backend is external - "api.app.chainloop.dev:443" # platform backend - the EE CLI also dials this + - "crb.chainloop.dev:443" # CLI usage telemetry (PostHog) - "timestamp.digicert.com:80" # RFC 3161 timestamp authority (plain HTTP, signed response) # used during attestation signing; host comes from the # control plane's signing options