fix(telemetry): materialize resolved telemetry.enabled in /api/v1/config (#681)

Telemetry is opt-out (default enabled), but DefaultConfig leaves the
Telemetry field nil and Enabled is a pointer with omitempty. On a fresh
install the /api/v1/config response omitted the telemetry key entirely,
so the web UI (SettingField !!modelValue) and macOS (?? false) coerced
the missing bool to false and displayed telemetry as DISABLED — even
though Config.IsTelemetryEnabled() and the CLI correctly reported it
enabled.

Fix at the contract/response boundary: mirror IsTelemetryEnabled() into
a copy of the config before marshaling so telemetry.enabled is always
present, without mutating the shared config or changing the Go
default-true logic. One server-side fix covers both UI clients.

Related #MCP-2477

Author: Dumbris

internal/contracts/converters.go

@@ -530,6 +530,25 @@ func ConvertConfigToContract(cfg *config.Config) interface{} {
 		return nil
 	}
 
+	// Materialize the resolved telemetry.enabled value before marshaling.
+	// Telemetry is opt-out (default enabled), but DefaultConfig leaves the
+	// Telemetry field nil and Enabled is a pointer with `omitempty`, so a fresh
+	// install would omit the `telemetry` key entirely. Both the web UI and macOS
+	// clients coerce the missing bool to false, displaying telemetry as DISABLED
+	// even though Config.IsTelemetryEnabled() reports true (MCP-2477). Mirror that
+	// resolution into the serialized response without mutating the shared config.
+	if cfg.Telemetry == nil || cfg.Telemetry.Enabled == nil {
+		cfgCopy := *cfg
+		var tel config.TelemetryConfig
+		if cfg.Telemetry != nil {
+			tel = *cfg.Telemetry
+		}
+		enabled := cfg.IsTelemetryEnabled()
+		tel.Enabled = &enabled
+		cfgCopy.Telemetry = &tel
+		return &cfgCopy
+	}
+
 	// Return the config as-is for JSON marshaling
 	// The JSON tags on config.Config will handle serialization
 	return cfg

internal/contracts/converters_test.go

@@ -1,6 +1,7 @@
 package contracts
 
 import (
+	"encoding/json"
 	"testing"
 	"time"
 
@@ -9,6 +10,68 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// telemetryEnabledFromContract marshals the contract representation of cfg and
+// extracts the resolved telemetry.enabled value (or reports it absent).
+func telemetryEnabledFromContract(t *testing.T, cfg *config.Config) (enabled, present bool) {
+	t.Helper()
+	raw, err := json.Marshal(ConvertConfigToContract(cfg))
+	require.NoError(t, err)
+
+	var decoded struct {
+		Telemetry *struct {
+			Enabled *bool `json:"enabled"`
+		} `json:"telemetry"`
+	}
+	require.NoError(t, json.Unmarshal(raw, &decoded))
+	if decoded.Telemetry == nil || decoded.Telemetry.Enabled == nil {
+		return false, false
+	}
+	return *decoded.Telemetry.Enabled, true
+}
+
+// TestConvertConfigToContract_TelemetryMaterializedOnFreshDefault asserts that
+// /api/v1/config exposes the resolved telemetry.enabled value (true) on a fresh
+// install where Telemetry is nil, instead of omitting the key (which clients
+// coerce to false). Regression test for MCP-2477.
+func TestConvertConfigToContract_TelemetryMaterializedOnFreshDefault(t *testing.T) {
+	t.Setenv("MCPPROXY_TELEMETRY", "") // ensure no env override
+	cfg := config.DefaultConfig()
+	require.Nil(t, cfg.Telemetry, "precondition: DefaultConfig leaves Telemetry nil")
+
+	enabled, present := telemetryEnabledFromContract(t, cfg)
+	assert.True(t, present, "telemetry.enabled must be present in the API response")
+	assert.True(t, enabled, "telemetry.enabled must serialize as true on a fresh default install")
+
+	// Materialization must not mutate the shared config.
+	assert.Nil(t, cfg.Telemetry, "ConvertConfigToContract must not mutate the source config")
+}
+
+// TestConvertConfigToContract_TelemetryEnabledNilMaterialized covers the case
+// where a TelemetryConfig exists but Enabled is nil — it must resolve to true.
+func TestConvertConfigToContract_TelemetryEnabledNilMaterialized(t *testing.T) {
+	t.Setenv("MCPPROXY_TELEMETRY", "")
+	cfg := config.DefaultConfig()
+	cfg.Telemetry = &config.TelemetryConfig{AnonymousID: "abc"} // Enabled nil
+
+	enabled, present := telemetryEnabledFromContract(t, cfg)
+	assert.True(t, present, "telemetry.enabled must be present when Enabled is nil")
+	assert.True(t, enabled, "telemetry.enabled must resolve to true when Enabled is nil")
+	assert.Nil(t, cfg.Telemetry.Enabled, "source TelemetryConfig.Enabled must remain nil")
+}
+
+// TestConvertConfigToContract_TelemetryExplicitFalsePreserved asserts an
+// explicit opt-out is faithfully serialized (not overwritten by the default).
+func TestConvertConfigToContract_TelemetryExplicitFalsePreserved(t *testing.T) {
+	t.Setenv("MCPPROXY_TELEMETRY", "")
+	disabled := false
+	cfg := config.DefaultConfig()
+	cfg.Telemetry = &config.TelemetryConfig{Enabled: &disabled}
+
+	enabled, present := telemetryEnabledFromContract(t, cfg)
+	assert.True(t, present, "telemetry.enabled must be present when explicitly set")
+	assert.False(t, enabled, "explicit telemetry opt-out must be preserved")
+}
+
 // TestConvertGenericServersToTyped_OAuth verifies OAuth config is properly extracted
 func TestConvertGenericServersToTyped_OAuth(t *testing.T) {
 	// Simulate the map structure returned from the management service