Unexpected Telemetry Enablement in Non-Interactive Environments (comfy-cli==1.10.2)

[Eldan-Talis]

Hello Comfy team,

We identified telemetry/privacy behavior in comfy-cli==1.10.2 related to CI/CD, Docker, subprocess, or other non-interactive execution environments.
The primary concern is automatic telemetry enablement without an explicit consent prompt:

if not sys.stdin.isatty() or not sys.stdout.isatty():
    _session_only_tracking = True
    if user_id is None:
        user_id = str(uuid.uuid4())
        config_manager.set(constants.CONFIG_KEY_USER_ID, user_id)
    return

This behavior appears to:

enable tracking automatically in non-TTY environments
generate and persist a stable cross-session UUID
send telemetry events to PostHog (https://t.comfy.org/)
enable IP-derived geolocation enrichment
We also observed execution-related metadata captured through:

filter_command_kwargs(dict(locals()))

including values such as:

workflow file paths
host/port
timeout settings
verbose/json flags
execution metadata

Recommendations:

clearly document telemetry behavior in non-interactive environments
consider explicit opt-in semantics for non-TTY execution
review whether stable identifiers should persist before consent
evaluate additional redaction coverage for execution metadata
We’re sharing this as a transparency and privacy concern for review.

[coderabbitai]

🔗 Related PRs

#455 - feat(run): add --json NDJSON output mode for agents [merged]
#461 - feat(tracking): PostHog dual-send + canonical lifecycle events [closed]

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[bigcat88]

Hey @Eldan-Talis - thanks for the careful and well-structured report.

We've did a release with #463, which addresses the most actionable parts directly. With either DO_NOT_TRACK=1 (per https://consoledonottrack.com/) or COMFY_NO_TELEMETRY=1 set:

• the consent prompt is skipped entirely
• track_event() short-circuits before any provider runs
• the on-disk consent flag is left untouched, so a later run without the env var still goes through the normal consent flow

Thanks again - this is the kind of report that actually moves telemetry policy forward.