feat: [ENG-3035] rename user-facing analytics setting key analytics.enabled to analytics.share (#746)

The key name now reflects what it controls: local analytics tracking is always
on (regardless of auth or this setting); the flag only gates whether collected
events are shared with the remote telemetry backend.

- Rename the user-facing key value analytics.enabled -> analytics.share across
  settings set/get/list, the onboarding opt-in script, and the disclosure
  command reference. Hard rename (no alias) — the feature is unreleased.
- Behavior unchanged: tracking stays always-on locally; the flag still gates
  only remote sharing.
- Internals kept (value-only rename): GlobalConfig.analytics field, the
  globalConfig:setAnalytics transport event, in-process method names, and the
  key-constant identifier names.

Author: bao-byterover

src/oclif/commands/settings/set.ts

@@ -44,13 +44,13 @@ export default class SettingsSet extends Command {
       options: ['text', 'json'],
     }),
     // Accepts the analytics disclosure non-interactively. Only meaningful when
-    // setting `analytics.enabled true` (the one consent-gated key). Passing it
+    // setting `analytics.share true` (the one consent-gated key). Passing it
     // for any other key emits `this.warn(...)` so the user does not silently
     // rely on a flag that has no behavioural effect for their command.
     yes: Flags.boolean({
       char: 'y',
       default: false,
-      description: 'Accept the analytics disclosure non-interactively (only meaningful for analytics.enabled)',
+      description: 'Accept the analytics disclosure non-interactively (only meaningful for analytics.share)',
     }),
   }
 
@@ -120,7 +120,7 @@ export default class SettingsSet extends Command {
         return
       }
 
-      // Enable-to-true on `analytics.enabled` triggers the disclosure
+      // Enable-to-true on `analytics.share` triggers the disclosure
       // prompt. Idempotent (no prompt if already enabled), false-unchanged,
       // and other keys unaffected. `collectConsent`'s `onError` calls
       // `this.error()` which throws CLIError; we let it propagate to

src/oclif/lib/analytics-disclosure.ts

@@ -61,7 +61,7 @@ export interface CollectConsentDeps {
  * 4. Otherwise, prompt and return the user's choice.
  *
  * Extracted from the legacy `brv analytics enable` command in M16.2 so
- * `brv settings set analytics.enabled true` can reuse the exact same
+ * `brv settings set analytics.share true` can reuse the exact same
  * consent gate. M16.4 then deleted the legacy command; this lib is now
  * the sole consent surface.
  */

src/server/core/interfaces/analytics/i-analytics-client.ts

@@ -18,7 +18,7 @@ import type {AnalyticsBatch} from '../../domain/analytics/batch.js'
 export interface IAnalyticsClient {
   /**
    * Cancel any in-flight `flush()`'s HTTP request. M4.4: invoked by
-   * `GlobalConfigHandler` when `brv settings set analytics.enabled false` flips the flag
+   * `GlobalConfigHandler` when `brv settings set analytics.share false` flips the flag
    * so the daemon doesn't half-ship a batch across an enable/disable
    * boundary. No-op when no flush is in flight.
    */

src/server/core/interfaces/analytics/i-analytics-http-client.ts

@@ -63,7 +63,7 @@ export type AnalyticsHttpSendResult =
  */
 /**
  * Optional per-call controls. `signal` is the M4.4 cancellation hook
- * used by `brv settings set analytics.enabled false` (and by the daemon shutdown path) to
+ * used by `brv settings set analytics.share false` (and by the daemon shutdown path) to
  * abort an in-flight send so the daemon doesn't half-ship a batch
  * across an enable/disable boundary.
  */

src/server/infra/analytics/analytics-client.ts

@@ -128,7 +128,7 @@ export class AnalyticsClient implements IAnalyticsClient {
    * which classifies aborted requests as `network` failures — JSONL
    * records stay `pending` (so they ship on the next enabled flush).
    *
-   * Called from `GlobalConfigHandler` when `brv settings set analytics.enabled false`
+   * Called from `GlobalConfigHandler` when `brv settings set analytics.share false`
    * flips the flag, so the daemon doesn't half-ship a batch across an
    * enable/disable boundary. No-op when no flush is in flight.
    */
@@ -156,7 +156,7 @@ export class AnalyticsClient implements IAnalyticsClient {
    * `flush()` is a thin caller — it does not inspect attempts.
    */
   public async flush(): Promise<AnalyticsBatch> {
-    // M4.4: `brv settings set analytics.enabled false` semantically means "stop shipping to
+    // M4.4: `brv settings set analytics.share false` semantically means "stop shipping to
     // remote" — local tracking (JSONL + queue) continues unconditionally.
     // Gate here, NOT in `track()`. Records stay at `status='pending'` in
     // JSONL; the next flush after re-enable picks them up automatically.
@@ -378,7 +378,7 @@ export class AnalyticsClient implements IAnalyticsClient {
 
     await this.deps.jsonlStore.updateStatus(result.succeeded, 'sent')
     // M4.4 N3 fix: when we cancelled the send ourselves (`abort()` fired
-    // because `brv settings set analytics.enabled false` flipped the flag), DO NOT mark the
+    // because `brv settings set analytics.share false` flipped the flag), DO NOT mark the
     // failed records as 'failed' — that bumps the M9.2 retry-cap
     // `attempts` counter on every cancel, and a few disable/enable
     // toggles during shipping could terminate records as `'failed'`

src/server/infra/analytics/analytics-flush-scheduler.ts

@@ -10,7 +10,7 @@ export interface AnalyticsFlushSchedulerDeps {
   flush: () => Promise<unknown>
   /**
    * Lazy analytics-enabled gate. Re-checked on every trigger so a runtime
-   * `brv settings set analytics.enabled false` (M1.4) immediately suspends scheduled flushes
+   * `brv settings set analytics.share false` (M1.4) immediately suspends scheduled flushes
    * without restarting the daemon.
    */
   isEnabled: () => boolean

src/server/infra/analytics/http-analytics-sender.ts

@@ -80,7 +80,7 @@ export class HttpAnalyticsSender implements IAnalyticsSender {
           ...(sessionKey !== undefined && sessionKey !== '' ? {sessionId: sessionKey} : {}),
           userAgent: this.deps.userAgent,
         },
-        // M4.4: forward the cancellation signal so `brv settings set analytics.enabled false`
+        // M4.4: forward the cancellation signal so `brv settings set analytics.share false`
         // (or shutdown) can abort an in-flight POST. The http client
         // classifies aborted requests as `network`, which maps here to
         // an all-failed result — same as any other transport failure.

src/server/infra/process/feature-handlers.ts

@@ -277,7 +277,7 @@ export async function setupFeatureHandlers({
   // M4.4: close the global-config-handler ↔ analyticsClient cycle.
   // The handler was constructed earlier (so its sync cache was
   // populated before the client read it); now that the client
-  // exists, register it so `brv settings set analytics.enabled false` can call
+  // exists, register it so `brv settings set analytics.share false` can call
   // `abort()` to cancel any in-flight HTTP.
   globalConfigHandler.setAnalyticsClient(analyticsClient)
 
@@ -302,7 +302,7 @@ export async function setupFeatureHandlers({
   }
   new SettingsHandler({
     analyticsClient,
-    // Route `analytics.enabled` GET/SET/RESET/LIST through the
+    // Route `analytics.share` GET/SET/RESET/LIST through the
     // global-config handler so the canonical storage in config.json, the
     // device-id seeding race fix, the analytics cache, and the
     // abort-on-disable side-effect all stay unchanged.

src/server/infra/transport/handlers/global-config-handler.ts

@@ -19,7 +19,7 @@ import {processLog} from '../../../utils/process-logger.js'
 export interface GlobalConfigHandlerDeps {
   /**
    * M4.4: optional analytics client used to cancel any in-flight HTTP
-   * send when `brv settings set analytics.enabled false` flips the flag.
+   * send when `brv settings set analytics.share false` flips the flag.
    * Disable does NOT drop the queue or clear JSONL — those stay so a
    * future re-enable ships the backlog. Optional for back-compat with
    * test harnesses that don't construct a real analytics client.
@@ -93,7 +93,7 @@ export class GlobalConfigHandler implements IGlobalConfigRotator {
 
   /**
    * Public async read of the persisted analytics flag. Surfaced for
-   * the SettingsHandler facade so `brv settings get analytics.enabled`
+   * the SettingsHandler facade so `brv settings get analytics.share`
    * resolves through the SAME `globalConfigStore.read()` path that
    * `globalConfig:get` uses. Returns the on-disk value (or `false`
    * when no config file exists).
@@ -162,7 +162,7 @@ export class GlobalConfigHandler implements IGlobalConfigRotator {
 
   /**
    * Public write of the analytics flag. Surfaced for the SettingsHandler
-   * facade so `brv settings set analytics.enabled <value>` goes through
+   * facade so `brv settings set analytics.share <value>` goes through
    * the SAME write path as `globalConfig:setAnalytics` — concurrent-safe
    * via `writeChain`, refreshes the cache, emits `analytics_disabled`,
    * triggers the abort-on-disable on the analytics client.

src/server/infra/transport/handlers/settings-handler.ts

@@ -46,7 +46,7 @@ export type ReadonlyInfoSnapshot = boolean | number | Readonly<Record<string, un
 export type ReadonlyInfoProvider = () => Promise<ReadonlyInfoSnapshot> | ReadonlyInfoSnapshot
 
 /**
- * Facade over `GlobalConfigHandler` for the `analytics.enabled` setting.
+ * Facade over `GlobalConfigHandler` for the `analytics.share` setting.
  * The settings handler routes GET/SET/RESET/LIST for that key through
  * this facade instead of `FileSettingsStore`, so the canonical storage
  * in `config.json`, the device-id seeding race fix, the sync analytics
@@ -63,8 +63,8 @@ export interface AnalyticsEnabledFacade {
 export interface SettingsHandlerDeps {
   readonly analyticsClient?: IAnalyticsClient
   /**
-   * Facade for the `analytics.enabled` writable key. When set,
-   * GET/SET/RESET/LIST for `analytics.enabled` route through this facade
+   * Facade for the `analytics.share` writable key. When set,
+   * GET/SET/RESET/LIST for `analytics.share` route through this facade
    * instead of the file store. When unset, the key surfaces with
    * `current: undefined`.
    */
@@ -187,7 +187,7 @@ export class SettingsHandler {
           return {error: readOnlyError(data.key), ok: false}
         }
 
-        // Global-config writables (analytics.enabled and any future ones)
+        // Global-config writables (analytics.share and any future ones)
         // route through the injected facade. The file store stays
         // untouched. Type check still applies (boolean for the only
         // current case), so reuse `checkValueType` before delegating.
@@ -299,7 +299,7 @@ export class SettingsHandler {
         }
 
         // Reset on a global-config writable means "back to descriptor.default".
-        // For analytics.enabled the default is `false`, so we flip via the facade.
+        // For analytics.share the default is `false`, so we flip via the facade.
         if (descriptor?.storage === 'global-config') {
           if (this.globalConfigHandler === undefined) {
             return {
@@ -414,7 +414,7 @@ export class SettingsHandler {
     }
 
     if (descriptor.storage === 'global-config') {
-      // Global-config-stored values (analytics.enabled) live in
+      // Global-config-stored values (analytics.share) live in
       // config.json, not settings.json. Without an injected facade we
       // cannot resolve — surface `undefined` so the row still renders
       // rather than crashing.