chore(telemetry): deprecate DO_NOT_TRACK env var (warn on use) — patch (#18)

DO_NOT_TRACK=1 is commonly set broadly across CI / corporate environments as
a generic privacy convention. When it is the only opt-out, many users
disable AxonFlow plugin telemetry accidentally as a side-effect of a generic
policy, not as an intentional AxonFlow-specific decision.

This patch starts a deprecation. Behavior today is unchanged: DO_NOT_TRACK=1
still disables telemetry. What's new is a one-line warning emitted the first
time the opt-out fires with DO_NOT_TRACK=1 set and AXONFLOW_TELEMETRY=off NOT
set, pointing operators at the canonical switch. If both are set, the
operator has already migrated and no warning fires.

Removal target: after 2026-05-05 in the next major release. AXONFLOW_TELEMETRY=off
remains the canonical AxonFlow-specific opt-out and its behavior is
unchanged.

Coordinated with the v7.4.0 SDK release train (sdk-go#127, sdk-typescript#180,
sdk-python#146, sdk-java#135) and the axonflow-docs telemetry page update
(#417).

Author: saurabhjain1592

.codex-plugin/marketplace.json

@@ -7,14 +7,14 @@
   },
   "metadata": {
     "description": "Runtime governance for OpenAI Codex. Policy enforcement on terminal commands, advisory governance via skills, PII detection, audit trails, and compliance-grade decision records.",
-    "version": "0.4.1"
+    "version": "0.4.2"
   },
   "plugins": [
     {
       "name": "axonflow",
       "source": "./",
       "description": "Policy enforcement, PII detection, and audit trails for OpenAI Codex. Hybrid governance — enforces policies on terminal commands (exec_command) via hooks, provides advisory governance for other tools via implicit-activation skills, and records compliance-grade audit trails. Self-hosted via Docker — all data stays on your infrastructure.",
-      "version": "0.4.1",
+      "version": "0.4.2",
       "author": {
         "name": "AxonFlow",
         "email": "hello@getaxonflow.com",

.codex-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "axonflow",
   "displayName": "AxonFlow Governance",
   "description": "Policy enforcement, PII detection, and audit trails for OpenAI Codex. Hybrid governance — enforces policies on terminal commands (exec_command) via hooks, provides advisory governance for other tools via implicit-activation skills, and records compliance-grade audit trails. Self-hosted via Docker — all data stays on your infrastructure.",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "author": {
     "name": "AxonFlow",
     "email": "hello@getaxonflow.com",

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [0.4.2] - 2026-04-22
+
+### Deprecated
+
+- `DO_NOT_TRACK=1` as an AxonFlow telemetry opt-out — scheduled for removal after 2026-05-05 in the next major release. Use `AXONFLOW_TELEMETRY=off` instead. The plugin's `telemetry-ping.sh` emits a one-time stderr warning when `DO_NOT_TRACK=1` is the active control and `AXONFLOW_TELEMETRY=off` is not also set.
+
 ## [0.4.1] - 2026-04-19
 
 ### Added

README.md

@@ -351,8 +351,8 @@ More troubleshooting in the [integration guide](https://docs.getaxonflow.com/doc
 Anonymous one-time ping on first hook invocation: plugin version, OS, architecture, bash version, AxonFlow platform version. **Never** tool arguments, message contents, or policy data.
 
 Opt out:
-- `DO_NOT_TRACK=1` (standard)
-- `AXONFLOW_TELEMETRY=off`
+- `AXONFLOW_TELEMETRY=off` (canonical)
+- `DO_NOT_TRACK=1` — still honored for backward compatibility, but **deprecated** and scheduled for removal after 2026-05-05 in the next major release. The plugin emits a one-time warning when `DO_NOT_TRACK=1` is the active control and `AXONFLOW_TELEMETRY=off` is not also set.
 
 Guarded by a stamp file at `$HOME/.cache/axonflow/codex-plugin-telemetry-sent` (delete to re-send). Details: [docs.getaxonflow.com/docs/telemetry](https://docs.getaxonflow.com/docs/telemetry/).
 

scripts/telemetry-ping.sh

@@ -5,7 +5,10 @@
 # with plugin version, platform info (OS, arch, bash version), and AxonFlow
 # platform version. No PII, no tool arguments, no policy data.
 #
-# Opt out: DO_NOT_TRACK=1 or AXONFLOW_TELEMETRY=off
+# Opt out: AXONFLOW_TELEMETRY=off (canonical)
+# Also honored for backward compatibility: DO_NOT_TRACK=1 (deprecated — removed
+# after 2026-05-05 in the next major release; warning below emits when it's the
+# active opt-out so operators can migrate)
 #
 # Guard: stamp file at $HOME/.cache/axonflow/codex-plugin-telemetry-sent
 # prevents repeat pings. Delete the stamp file to re-send on next hook invocation.
@@ -18,7 +21,15 @@ command -v curl &>/dev/null || exit 0
 command -v jq &>/dev/null || exit 0
 
 # Opt-out check (matches OpenClaw plugin's telemetry-config.ts)
-if [ "${DO_NOT_TRACK:-}" = "1" ] || [ "${AXONFLOW_TELEMETRY:-}" = "off" ]; then
+if [ "${DO_NOT_TRACK:-}" = "1" ]; then
+  # Deprecation warning — only when DO_NOT_TRACK is the active control.
+  # If AXONFLOW_TELEMETRY=off is also set, the operator has already migrated.
+  if [ "${AXONFLOW_TELEMETRY:-}" != "off" ]; then
+    echo "[AxonFlow] DO_NOT_TRACK=1 is deprecated as an AxonFlow telemetry opt-out and will be removed after 2026-05-05 in the next major release. Set AXONFLOW_TELEMETRY=off to opt out going forward. See https://docs.getaxonflow.com/docs/telemetry for details." >&2
+  fi
+  exit 0
+fi
+if [ "${AXONFLOW_TELEMETRY:-}" = "off" ]; then
   exit 0
 fi