fix(telemetry): address cubic review

- Move applyTelemetryKey() invocation into the telemetry module itself
  as an import side effect. ESM evaluates module-import side-effects
  before any subsequent module-load code in the importing file, so this
  is unambiguously ordered before the rest of opencode's imports —
  sidestepping the static-import-hoisting concern.
- Use `!== undefined` for LMNR_PROJECT_API_KEY presence check so an
  explicitly-set empty string is respected as 'no key please' instead
  of being clobbered by the embedded default.
- DO_NOT_TRACK truthiness check is intentional and unchanged: the
  de-facto standard (consoledonottrack.com) defines opt-out as
  presence with any non-empty value.

Author: bcode

packages/bcode-browser/src/telemetry.ts

@@ -8,25 +8,38 @@
 //
 // At runtime we set `LMNR_PROJECT_API_KEY` from the embedded default if and
 // only if:
-//   - DO_NOT_TRACK is not set, AND
-//   - the user has not already set LMNR_PROJECT_API_KEY (BYO key wins), AND
+//   - DO_NOT_TRACK is not set (any non-empty value opts out — DO_NOT_TRACK
+//     standard convention), AND
+//   - LMNR_PROJECT_API_KEY is not already set in the environment (BYO key
+//     wins; explicit empty string is respected as "no key please"), AND
 //   - the embedded default is non-empty.
 //
-// No `if (telemetryEnabled)` branches downstream — the future Laminar wiring
-// reads `LMNR_PROJECT_API_KEY` and initializes only when present, so the gate
-// here decides everything.
-//
-// Must run before any code that loads Laminar / reads LMNR_PROJECT_API_KEY.
+// `applyTelemetryKey()` is invoked as a side effect on module import (last
+// statement of this file). Because `packages/opencode/src/index.ts` imports
+// this module before any other module that might consume the env var, the
+// gate is guaranteed to run before any downstream module-load code can
+// observe `LMNR_PROJECT_API_KEY` — sidestepping ESM static-import hoisting
+// entirely.
 
 declare const BCODE_DEFAULT_LMNR_KEY: string
 
 export const applyTelemetryKey = () => {
+  // DO_NOT_TRACK: presence with any non-empty value opts out, per the
+  // de-facto standard (consoledonottrack.com, Astro, Homebrew, npm).
   if (process.env.DO_NOT_TRACK) return
-  if (process.env.LMNR_PROJECT_API_KEY) return
+  // LMNR_PROJECT_API_KEY: presence (not truthiness) wins so users who
+  // explicitly set it to an empty string get exactly that — no key.
+  if (process.env.LMNR_PROJECT_API_KEY !== undefined) return
   // `typeof` first: in dev (no Bun `define` substitution) the identifier is
   // undeclared and a direct read throws ReferenceError.
   if (typeof BCODE_DEFAULT_LMNR_KEY === "undefined" || !BCODE_DEFAULT_LMNR_KEY) return
   process.env.LMNR_PROJECT_API_KEY = BCODE_DEFAULT_LMNR_KEY
 }
 
+// Run as an import side effect: this module is imported as the very first
+// import of `packages/opencode/src/index.ts`, so by the time any other
+// module's top-level code reads `LMNR_PROJECT_API_KEY` the gate has already
+// resolved.
+applyTelemetryKey()
+
 export * as Telemetry from "./telemetry"

packages/opencode/src/index.ts

@@ -1,8 +1,8 @@
-// Telemetry import sits above all others so the key gate runs before any
-// downstream code reads LMNR_PROJECT_API_KEY. ESM hoists imports, but the
-// `applyTelemetryKey()` call is the first non-import statement to execute.
-import { Telemetry } from "@browser-use/bcode-browser/telemetry"
-Telemetry.applyTelemetryKey()
+// Telemetry key injection runs as an import side effect of this module,
+// before any subsequent import is evaluated. Keep this as the FIRST import
+// so the LMNR_PROJECT_API_KEY env var is settled before any downstream
+// module-load code reads it.
+import "@browser-use/bcode-browser/telemetry"
 
 import yargs from "yargs"
 import { hideBin } from "yargs/helpers"