Tag clickhouse.com requests with detected AI agent#134
Merged
Conversation
Closes #133. Uses the is-ai-agent crate to detect when the CLI is invoked under a known agent (Claude Code, Cursor, Gemini CLI, Codex, Goose, Devin, etc.) and appends an agent=<id> query param to outbound requests to ClickHouse-owned hosts (builds.clickhouse.com, packages.clickhouse.com, api.clickhouse.cloud). GitHub and other third-party hosts are not annotated. The cloud library gains a generic Client::with_extra_query_params builder so the CLI can attach the tag to every request.
Three of the four credential branches in CloudClient::new differed only in which (key, secret) pair they pulled and which AuthSource label to attach. Introduce ResolvedAuth + resolve_auth() to walk the precedence ladder once, then build the lib client and tag it with the agent param at a single site. resolve_active_auth_source becomes a thin wrapper that preserves its lenient half-set CLI-flag behavior for cloud auth status.
The helper is only called from cloud auth status, which never has --api-key/--api-secret to pass (the subcommand doesn't accept them). The half-set lenient branch and its test were protecting a contract no production caller exercises. Inlining the only sensible call removes the dead parameters and the dead branch, leaving a one-line wrapper that documents its actual purpose: peek at credential precedence without erroring on the empty case (which auth status needs to render no-creds-configured correctly).
The local AgentId -> kebab-case match arm was duplicating a mapping the crate already maintains for its AGENT= env var parser. is-ai-agent 0.2.1 exposes AgentId::as_str returning the canonical kebab-case id (claude-code, gemini-cli, etc.) — the inverse of the parser. Switch to it. Replaces our 12-arm match plus exhaustive variant test with a single delegation and a contract test against the upstream lookup. New agents added upstream automatically flow through without code changes here.
…arams Rather than thread an agent search param through every clickhouse.com request (with a URL-domain gate, two helpers, and a generic extra-query-params feature on the cloud library), fold the signal into the User-Agent header that every outbound request already carries: clickhousectl/0.1.18 (agent=claude-code). RFC 7231 allows parenthesised comments in User-Agent, and this matches conventional shapes (Mozilla/5.0 etc). Detection still uses is-ai-agent. The change deletes the agent_signal module, the cloud library extra_query_params API + tests, the URL-host parser, and the per-call-site wrappers in version_manager — net -146 lines vs the previous implementation. Every reqwest::Client::builder() in the codebase already calls user_agent::user_agent(), so the new attribution flows through with zero per-call-site wiring.
It's now a one-line implementation detail of an analytics signal — not user-facing functionality, not configurable, not surprising for a future reader to understand from the user_agent.rs source. Doesn't earn a documentation entry.
Pull in upstream security fixes flagged by Dependabot. Both are transitive dependencies; lockfile-only update, no API or behaviour changes. Build and full workspace tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
iskakaushik
approved these changes
May 5, 2026
Bump clickhousectl to 0.2.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #133. Detects when
clickhousectlis invoked under an AI coding agent (Claude Code, Cursor, Gemini CLI, OpenAI Codex, Goose, Devin, etc.) and surfaces that signal in the User-Agent header on every outbound HTTP request, so server-side analytics can attribute usage.When an agent is detected, requests carry:
Human-driven invocations send the bare
clickhousectl/0.1.18. Detection is via theis-ai-agentcrate (AgentId::as_strreturns the canonical kebab-case id). RFC 7231 allows parenthesised comments in User-Agent — this matches conventional shapes (Mozilla/5.0 (Windows NT 10.0; ...)).The change folds entirely into
crates/clickhousectl/src/user_agent.rs. Every outboundreqwest::Clientalready routes throughuser_agent::user_agent(), so the new attribution flows through cloud, builds, packages, GitHub, and OAuth requests with zero per-call-site wiring.Drive-by cleanups in
cloud/client.rsWhile auditing the call sites I noticed
CloudClient::newhad ~100 lines of duplicated credential branches. The PR also includes:CloudClient::newinto a singleresolve_authhelper returningResolvedAuth { creds, source, base_url }.CloudClient::newshrinks to ~25 lines, the lib client is constructed once in a 2-arm match, and the "no credentials" error message lives in one place.api_key/api_secretparameters fromresolve_active_auth_source. The only production caller (cloud auth status) always passed(None, None); the lenient half-set CLI-flag branch and its test were protecting a contract no caller exercised.Stacked on #128 (
issue-126-markdown-tables).Test plan
cargo buildworkspacecargo test --workspace— 442 pass (3 newuser_agenttests, 1 trimmed test that was protecting dead code)cargo clippy -p clickhousectl --all-targets— cleancargo clippy -p clickhouse-cloud-api— clean