From f858cc871323450b294a572f2f480600b4a16211 Mon Sep 17 00:00:00 2001
From: Matt Miller <mattmiller@comfy.org>
Date: Sat, 1 Aug 2026 16:48:22 -0700
Subject: [PATCH 1/4] feat(telemetry): emit partner_nodes_detected + stamp
 caller_kind on every event (BE-5633)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Partner-node detection already ran on every local `comfy run` but never
reached telemetry, and caller attribution (caller.py) never reached event
props. Wire both through tracking.py so partner-API usage is measurable
and attributable.

- `comfy run` (local) fires `partner_nodes_detected` whenever the workflow
  uses partner-API nodes, before the partner_node_requires_credential
  rejection so that funnel is counted (credential_present marks it).
- `_dispatch` stamps `caller_kind` (user/pipe/agent/claude-code/custom
  COMFY_USER_AGENT label) on every event, alongside cli_version/tracing_id.

Telemetry only — no change to run semantics.
---
 comfy_cli/command/run/__init__.py   |  77 +++++++-----
 comfy_cli/tracking.py               |  13 +-
 tests/comfy_cli/command/test_run.py | 179 ++++++++++++++++++++++++++++
 tests/comfy_cli/test_tracking.py    |  46 ++++++-
 4 files changed, 285 insertions(+), 30 deletions(-)

diff --git a/comfy_cli/command/run/__init__.py b/comfy_cli/command/run/__init__.py
index ad299286..d4362ebd 100644
--- a/comfy_cli/command/run/__init__.py
+++ b/comfy_cli/command/run/__init__.py
@@ -22,7 +22,7 @@
     WebSocketTimeoutException,
 )
 
-from comfy_cli import cancellation, execution_errors, jobs_state
+from comfy_cli import cancellation, execution_errors, jobs_state, tracking
 
 # Re-exports — names patched by tests live at this namespace.
 from comfy_cli.command.run.credentials import _resolve_partner_credential as _resolve_partner_credential
@@ -291,32 +291,55 @@ def execute(
     extra_data: dict | None = None
     if api_key:
         extra_data = {"api_key_comfy_org": api_key}
-    # Only resolve an injected credential when an explicit --api-key hasn't
-    # already satisfied the partner node: the resolver may perform a network
-    # OAuth refresh, so skipping it here keeps an explicit-key run network-free.
-    if partner_nodes and not extra_data:
-        cred = _resolve_partner_credential()
-        if cred is None:
-            msg = (
-                "Workflow uses partner-API node(s) that need an `api_key_comfy_org` "
-                "credential the local server doesn't have: " + ", ".join(partner_nodes) + "."
-            )
-            renderer.error(
-                code="partner_node_requires_credential",
-                message=msg,
-                hint=(
-                    "run: comfy cloud login   (or set COMFY_API_KEY in the environment, "
-                    "or persist a key with `comfy cloud set-key --key …`; "
-                    "cloud runs auto-inject via --where cloud)"
-                ),
-                details={
-                    "partner_nodes": partner_nodes,
-                    "host": host,
-                    "port": port,
-                },
-            )
-            raise typer.Exit(code=1)
-        extra_data = {cred[0]: cred[1]}
+    if partner_nodes:
+        # Only resolve an injected credential when an explicit --api-key hasn't
+        # already satisfied the partner node: the resolver may perform a network
+        # OAuth refresh, so skipping it here keeps an explicit-key run network-free.
+        # Resolved once — the result feeds both the telemetry prop below and the
+        # credential gate that follows.
+        cred = _resolve_partner_credential() if not extra_data else None
+        # Fired BEFORE the reject-for-missing-credential branch so runs that are
+        # turned away are still counted: that funnel is exactly what the metric
+        # is for, and `credential_present: False` marks them. class_types are
+        # node names, not PII — the same data `workflow_unknown_nodes` reports.
+        # It does sit AFTER the BE-4326 spend gate, so a run refused for lack of
+        # `--allow-spend` emits no event: the gate deliberately precedes any
+        # credential resolution (a refusal must not trigger a network OAuth
+        # refresh), and `credential_present` needs that resolution. The
+        # spend-declined funnel wants its own event rather than an early
+        # resolve here.
+        tracking.track_event(
+            "partner_nodes_detected",
+            {
+                # Cap defends against pathological graphs; the count stays exact.
+                "partner_nodes": partner_nodes[:20],
+                "partner_node_count": len(partner_nodes),
+                "where": "local",
+                "credential_present": bool(api_key) or cred is not None,
+            },
+        )
+        if not extra_data:
+            if cred is None:
+                msg = (
+                    "Workflow uses partner-API node(s) that need an `api_key_comfy_org` "
+                    "credential the local server doesn't have: " + ", ".join(partner_nodes) + "."
+                )
+                renderer.error(
+                    code="partner_node_requires_credential",
+                    message=msg,
+                    hint=(
+                        "run: comfy cloud login   (or set COMFY_API_KEY in the environment, "
+                        "or persist a key with `comfy cloud set-key --key …`; "
+                        "cloud runs auto-inject via --where cloud)"
+                    ),
+                    details={
+                        "partner_nodes": partner_nodes,
+                        "host": host,
+                        "port": port,
+                    },
+                )
+                raise typer.Exit(code=1)
+            extra_data = {cred[0]: cred[1]}
 
     # Pre-submit validation via pure-Python CQL engine (checks class_types + input shapes).
     _preflight_validate(renderer, workflow, object_info, target_label="server")
diff --git a/comfy_cli/tracking.py b/comfy_cli/tracking.py
index bddb5549..a2798200 100644
--- a/comfy_cli/tracking.py
+++ b/comfy_cli/tracking.py
@@ -14,6 +14,7 @@
 import typer
 
 from comfy_cli import constants, logging, ui
+from comfy_cli.caller import detect_caller
 from comfy_cli.config_manager import ConfigManager
 from comfy_cli.workspace_manager import WorkspaceManager
 
@@ -124,6 +125,10 @@ def _scrub_value(value: object) -> object:
 user_id = config_manager.get(constants.CONFIG_KEY_USER_ID)
 # tracking all events for a single command
 tracing_id = str(uuid.uuid4())
+# Who is driving this process: "user" | "pipe" | "agent" | "claude-code" | a
+# lowercased custom COMFY_USER_AGENT label. Computed once at import, matching
+# the cli_version/tracing_id pattern above, so we don't re-run isatty per event.
+_caller_kind = detect_caller().kind
 workspace_manager = WorkspaceManager()
 
 # Process-scoped opt-in used when running non-interactively before the
@@ -350,12 +355,16 @@ def disable():
 def _dispatch(
     event_name: str, properties: dict[str, Any], *, distinct_id: str | None, mixpanel_name: str | None = None
 ):
-    """Fan an event out to every provider. Enriches with cli_version/tracing_id.
+    """Fan an event out to every provider. Enriches with cli_version/tracing_id/caller_kind.
 
     This is the shared send path; callers above own the gating (consent for
     passive telemetry, env-only for feedback).
+
+    ``caller_kind`` lands on EVERY event (execution_*, partner_nodes_detected,
+    feedback, …) — that is the point: it makes agent-vs-human analytics possible
+    across the whole stream. Purely additive, so no existing dashboard breaks.
     """
-    properties = {**properties, "cli_version": cli_version, "tracing_id": tracing_id}
+    properties = {**properties, "cli_version": cli_version, "tracing_id": tracing_id, "caller_kind": _caller_kind}
     for provider in _get_providers():
         provider_event_name = (
             mixpanel_name if (mixpanel_name is not None and isinstance(provider, MixpanelProvider)) else event_name
diff --git a/tests/comfy_cli/command/test_run.py b/tests/comfy_cli/command/test_run.py
index 5c19b9aa..bff99cac 100644
--- a/tests/comfy_cli/command/test_run.py
+++ b/tests/comfy_cli/command/test_run.py
@@ -1243,6 +1243,185 @@ def test_non_partner_workflow_skips_preflight(self, workflow_file, monkeypatch):
             MockExec.assert_called_once()
 
 
+class TestPartnerNodesDetectedTelemetry:
+    """Partner-node detection runs on every local `comfy run`; this is the
+    telemetry that makes partner-API usage measurable. It fires whenever the
+    workflow has partner nodes — including runs that are then rejected for a
+    missing credential, which is exactly the funnel the metric is for."""
+
+    PARTNER_WF = {
+        "1": {"class_type": "SomePartnerNode", "inputs": {"prompt": "x"}},
+        "2": {"class_type": "PreviewAny", "inputs": {"source": ["1", 0]}},
+    }
+    # The authoritative signal is `api_node: true` (category prefix is a fallback).
+    OBJECT_INFO = {
+        "SomePartnerNode": {
+            "category": "image",
+            "api_node": True,
+            "output": ["IMAGE"],
+            "output_name": ["IMAGE"],
+        },
+        "PreviewAny": {"category": "image", "output": [], "output_name": [], "output_node": True},
+    }
+
+    def _wf_file(self, tmp_path, workflow=None):
+        path = tmp_path / "partner-telemetry.json"
+        path.write_text(json.dumps(self.PARTNER_WF if workflow is None else workflow))
+        return str(path)
+
+    @staticmethod
+    def _partner_events(mock_track):
+        """Props of every ``partner_nodes_detected`` call on the mock."""
+        return [
+            call.args[1] for call in mock_track.call_args_list if call.args and call.args[0] == "partner_nodes_detected"
+        ]
+
+    def _no_credentials(self, monkeypatch):
+        monkeypatch.delenv("COMFY_CLOUD_API_KEY", raising=False)
+        from comfy_cli.auth import store as auth_store
+
+        monkeypatch.setattr(auth_store, "get", lambda _: None)
+        monkeypatch.setattr(auth_store, "get_cloud_session", lambda: None)
+
+    def test_fires_with_credential_present_when_api_key_supplied(self, tmp_path, monkeypatch):
+        wf_file = self._wf_file(tmp_path)
+        self._no_credentials(monkeypatch)
+
+        with (
+            patch("comfy_cli.command.run.check_comfy_server_running", return_value=True),
+            patch("comfy_cli.command.run._fetch_object_info", return_value=self.OBJECT_INFO),
+            patch("comfy_cli.command.run.ExecutionProgress"),
+            patch("comfy_cli.command.run.WorkflowExecution") as MockExec,
+            patch("comfy_cli.tracking.track_event") as mock_track,
+        ):
+            mock_exec = MagicMock()
+            MockExec.return_value = mock_exec
+            mock_exec.outputs = []
+            execute(wf_file, host="127.0.0.1", port=8188, wait=True, timeout=30, api_key="k", allow_spend=True)
+
+        events = self._partner_events(mock_track)
+        assert len(events) == 1
+        assert events[0] == {
+            "partner_nodes": ["SomePartnerNode"],
+            "partner_node_count": 1,
+            "where": "local",
+            "credential_present": True,
+        }
+
+    def test_fires_with_credential_present_when_env_key_available(self, tmp_path, monkeypatch):
+        wf_file = self._wf_file(tmp_path)
+        monkeypatch.setenv("COMFY_CLOUD_API_KEY", "test-key-abc")
+        from comfy_cli.auth import store as auth_store
+
+        monkeypatch.setattr(auth_store, "get", lambda _: None)
+
+        with (
+            patch("comfy_cli.command.run.check_comfy_server_running", return_value=True),
+            patch("comfy_cli.command.run._fetch_object_info", return_value=self.OBJECT_INFO),
+            patch("comfy_cli.command.run.ExecutionProgress"),
+            patch("comfy_cli.command.run.WorkflowExecution") as MockExec,
+            patch("comfy_cli.tracking.track_event") as mock_track,
+        ):
+            mock_exec = MagicMock()
+            MockExec.return_value = mock_exec
+            mock_exec.outputs = []
+            execute(wf_file, host="127.0.0.1", port=8188, wait=True, timeout=30, allow_spend=True)
+
+        events = self._partner_events(mock_track)
+        assert len(events) == 1
+        assert events[0]["credential_present"] is True
+        assert events[0]["partner_nodes"] == ["SomePartnerNode"]
+
+    def test_does_not_fire_for_partner_free_workflow(self, workflow_file):
+        with (
+            patch("comfy_cli.command.run.check_comfy_server_running", return_value=True),
+            patch(
+                "comfy_cli.command.run._fetch_object_info",
+                return_value={
+                    "EmptyLatentImage": {"category": "latent", "output": ["LATENT"], "output_name": ["LATENT"]},
+                    "PreviewAny": {"category": "image", "output": [], "output_name": [], "output_node": True},
+                },
+            ),
+            patch("comfy_cli.command.run.ExecutionProgress"),
+            patch("comfy_cli.command.run.WorkflowExecution") as MockExec,
+            patch("comfy_cli.tracking.track_event") as mock_track,
+        ):
+            mock_exec = MagicMock()
+            MockExec.return_value = mock_exec
+            mock_exec.outputs = []
+            execute(workflow_file, host="127.0.0.1", port=8188, wait=True, timeout=30)
+
+        assert self._partner_events(mock_track) == []
+
+    def test_fires_even_when_run_is_rejected_for_missing_credential(self, tmp_path, monkeypatch):
+        """The rejected-for-missing-credential funnel is what this metric is
+        for — the event must precede the error branch, with
+        ``credential_present: False`` marking those runs."""
+        wf_file = self._wf_file(tmp_path)
+        self._no_credentials(monkeypatch)
+
+        with (
+            patch("comfy_cli.command.run.check_comfy_server_running", return_value=True),
+            patch("comfy_cli.command.run._fetch_object_info", return_value=self.OBJECT_INFO),
+            patch("comfy_cli.command.run.WorkflowExecution") as MockExec,
+            patch("comfy_cli.tracking.track_event") as mock_track,
+        ):
+            with pytest.raises(typer.Exit) as exc_info:
+                execute(wf_file, host="127.0.0.1", port=8188, wait=True, timeout=30, allow_spend=True)
+            assert exc_info.value.exit_code == 1
+            MockExec.assert_not_called()
+
+        events = self._partner_events(mock_track)
+        assert len(events) == 1
+        assert events[0]["credential_present"] is False
+        assert events[0]["partner_node_count"] == 1
+
+    def test_does_not_fire_when_the_spend_gate_refuses(self, tmp_path, monkeypatch):
+        """Documents the one funnel this event does NOT cover: the BE-4326 spend
+        gate refuses before any credential resolution (so a refusal never
+        triggers a network OAuth refresh), and ``credential_present`` depends on
+        that resolution — so a run declined for lack of ``--allow-spend`` emits
+        nothing. That funnel needs its own event, not an early resolve here."""
+        wf_file = self._wf_file(tmp_path)
+        self._no_credentials(monkeypatch)
+        monkeypatch.setattr("comfy_cli.command.run.sys.stdin.isatty", lambda: False, raising=False)
+
+        with (
+            patch("comfy_cli.command.run.check_comfy_server_running", return_value=True),
+            patch("comfy_cli.command.run._fetch_object_info", return_value=self.OBJECT_INFO),
+            patch("comfy_cli.command.run._resolve_partner_credential") as MockCred,
+            patch("comfy_cli.command.run.WorkflowExecution"),
+            patch("comfy_cli.tracking.track_event") as mock_track,
+        ):
+            with pytest.raises(typer.Exit):
+                execute(wf_file, host="127.0.0.1", port=8188, wait=True, timeout=30)
+            MockCred.assert_not_called()
+
+        assert self._partner_events(mock_track) == []
+
+    def test_partner_nodes_list_is_capped_but_count_is_exact(self, tmp_path, monkeypatch):
+        """A pathological graph must not ship an unbounded property; the count
+        stays exact so the cap never distorts the metric."""
+        workflow = {str(i): {"class_type": f"PartnerNode{i:02d}", "inputs": {}} for i in range(30)}
+        object_info = {f"PartnerNode{i:02d}": {"category": "image", "api_node": True} for i in range(30)}
+        wf_file = self._wf_file(tmp_path, workflow)
+        self._no_credentials(monkeypatch)
+
+        with (
+            patch("comfy_cli.command.run.check_comfy_server_running", return_value=True),
+            patch("comfy_cli.command.run._fetch_object_info", return_value=object_info),
+            patch("comfy_cli.command.run.WorkflowExecution"),
+            patch("comfy_cli.tracking.track_event") as mock_track,
+        ):
+            with pytest.raises(typer.Exit):
+                execute(wf_file, host="127.0.0.1", port=8188, wait=True, timeout=30, allow_spend=True)
+
+        events = self._partner_events(mock_track)
+        assert len(events) == 1
+        assert events[0]["partner_node_count"] == 30
+        assert events[0]["partner_nodes"] == [f"PartnerNode{i:02d}" for i in range(20)]
+
+
 class TestExecuteSpendGate:
     """`comfy run` gates partner-API (paid) workflows on `--allow-spend`
     (BE-4326), mirroring `comfy run-template`'s spend gate. A partner-node
diff --git a/tests/comfy_cli/test_tracking.py b/tests/comfy_cli/test_tracking.py
index b79319ca..271556f2 100644
--- a/tests/comfy_cli/test_tracking.py
+++ b/tests/comfy_cli/test_tracking.py
@@ -1,3 +1,4 @@
+import os
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -80,7 +81,7 @@ def test_properties_default_to_empty_dict(self, tracking_module):
         tracking_module.track_event("some_event")
         tracking_module.provider.track.assert_called_once()
         _, _, properties = _last_track_call(tracking_module.provider)
-        assert set(properties.keys()) == {"cli_version", "tracing_id"}
+        assert set(properties.keys()) == {"cli_version", "tracing_id", "caller_kind"}
 
     def test_swallows_provider_errors(self, tracking_module):
         tracking_module.config_manager.set(constants.CONFIG_KEY_ENABLE_TRACKING, "True")
@@ -89,6 +90,49 @@ def test_swallows_provider_errors(self, tracking_module):
         tracking_module.provider.track.assert_called_once()
 
 
+class TestCallerKindEnrichment:
+    """``_dispatch`` stamps every event with the caller kind (human vs agent),
+    the same way it stamps cli_version/tracing_id — that is what makes
+    agent-vs-human analytics possible across the whole event stream."""
+
+    def test_track_event_carries_caller_kind(self, tracking_module):
+        tracking_module.config_manager.set(constants.CONFIG_KEY_ENABLE_TRACKING, "True")
+        tracking_module.track_event("some_event", {"k": "v"})
+        _, _, properties = _last_track_call(tracking_module.provider)
+        assert properties["caller_kind"] == tracking_module._caller_kind
+        assert isinstance(properties["caller_kind"], str) and properties["caller_kind"]
+
+    @pytest.mark.skipif(
+        bool(os.environ.get("COMFY_USER_AGENT")),
+        reason="a custom COMFY_USER_AGENT label legitimately replaces the intrinsic kinds",
+    )
+    def test_caller_kind_is_one_of_the_known_kinds_by_default(self, tracking_module):
+        # Without a COMFY_USER_AGENT override the module-scope value must be one
+        # of the four intrinsic kinds detect_caller() can return.
+        assert tracking_module._caller_kind in {"user", "pipe", "agent", "claude-code"}
+
+    def test_feedback_carries_caller_kind(self, tracking_module):
+        # Feedback rides the same _dispatch path, so it is enriched too.
+        tracking_module.submit_feedback("nice tool")
+        _, _, properties = _last_track_call(tracking_module.provider)
+        assert properties["caller_kind"] == tracking_module._caller_kind
+
+    def test_explicit_user_agent_label_flows_through(self, tracking_module):
+        """An explicit ``COMFY_USER_AGENT`` label reaches the provider verbatim
+        (lowercased by detect_caller). Patched onto the module because
+        ``_caller_kind`` is evaluated once at import, not per event."""
+        from comfy_cli.caller import detect_caller
+
+        kind = detect_caller(env={"COMFY_USER_AGENT": "My-Harness"}, is_tty=True).kind
+        assert kind == "my-harness"
+
+        tracking_module.config_manager.set(constants.CONFIG_KEY_ENABLE_TRACKING, "True")
+        with patch.object(tracking_module, "_caller_kind", kind):
+            tracking_module.track_event("some_event")
+        _, _, properties = _last_track_call(tracking_module.provider)
+        assert properties["caller_kind"] == "my-harness"
+
+
 class TestSubmitFeedback:
     def test_sends_even_when_passive_consent_disabled(self, tracking_module):
         # Feedback is explicit/user-initiated: it ignores the passive-telemetry

From 453d3e1623f739b5490703cc2d77d94c52459ef2 Mon Sep 17 00:00:00 2001
From: Matt Miller <mattmiller@comfy.org>
Date: Sat, 1 Aug 2026 17:30:40 -0700
Subject: [PATCH 2/4] fix(telemetry): guard stdout probe + bound caller_kind
 and partner-node names (BE-5633)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses the Cursor review panel findings on #647.

- caller: `detect_caller()` called `sys.stdout.isatty()` unguarded, but
  `_caller_kind` now evaluates it at `comfy_cli.tracking` import — which
  happens during CLI startup for every command. Under pythonw/detached
  processes `sys.stdout` is None (AttributeError) or already closed
  (ValueError), so a telemetry detail became an import-time crash for
  even `comfy --help` with tracking disabled. Guarded in `detect_caller`
  itself rather than at the tracking call site, so the pre-existing
  renderer path (`output/renderer.py`) is fixed by the same change.
  Falls through to kind="pipe" — a process with no usable stdout is by
  definition not a human at a terminal. Mirrors `_stdin_is_interactive`.

- tracking: `caller_kind` can be an arbitrary `COMFY_USER_AGENT` label
  that detect_caller only lowercases, and it now rides every event,
  including `feedback_submitted` which dispatches even when passive
  telemetry consent is off. Scrub URL query strings and cap to 64 chars
  before it ships, the same treatment command kwargs get.

- run: `partner_nodes[:20]` bounded the element count but not each
  element, and class_type strings come verbatim from untrusted workflow
  JSON — one multi-megabyte class name still shipped whole. Cap each
  name to 64 chars; `partner_node_count` stays exact. The same cap now
  bounds the node list echoed in the missing-credential error prose,
  with an "and N more" suffix; `details.partner_nodes` stays complete
  since that is the machine-readable field JSON consumers read.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 comfy_cli/caller.py                   | 28 +++++++++++-
 comfy_cli/command/run/__init__.py     | 24 +++++++++--
 comfy_cli/tracking.py                 | 23 +++++++++-
 tests/comfy_cli/command/test_run.py   | 62 +++++++++++++++++++++++++++
 tests/comfy_cli/output/test_caller.py | 45 +++++++++++++++++++
 tests/comfy_cli/test_tracking.py      | 34 +++++++++++++++
 6 files changed, 210 insertions(+), 6 deletions(-)

diff --git a/comfy_cli/caller.py b/comfy_cli/caller.py
index 0b8c4da9..37d6dbe5 100644
--- a/comfy_cli/caller.py
+++ b/comfy_cli/caller.py
@@ -9,7 +9,7 @@
     1. ``COMFY_USER_AGENT=<label>`` → explicit override, agentic, label preserved.
     2. ``AI_AGENT`` truthy → agentic, kind="agent".
     3. ``CLAUDECODE`` truthy → Claude Code session, kind="claude-code".
-    4. stdout is not a TTY → agentic, kind="pipe".
+    4. stdout is not a TTY (or is missing/closed) → agentic, kind="pipe".
     5. otherwise → kind="user".
 
 Claude Code is checked after AI_AGENT because AI_AGENT is the generic
@@ -42,13 +42,37 @@ def _truthy(value: str | None) -> bool:
     return value.strip().lower() not in {"", "0", "false", "no", "off"}
 
 
+def _stdout_is_tty() -> bool:
+    """True only when stdout is a live TTY.
+
+    ``sys.stdout.isatty()`` assumes stdout is a live stream, but in detached /
+    ``pythonw`` contexts ``sys.stdout`` can be ``None`` (AttributeError on
+    ``.isatty``) or an already-closed file (ValueError). A process with no
+    usable stdout is by definition not a human at a terminal, so treat both as
+    non-TTY and fall through to ``kind="pipe"`` rather than raising. Mirrors
+    ``_stdin_is_interactive`` in ``comfy_cli/command/run/__init__.py``.
+
+    This has to be fail-safe: ``detect_caller`` is called during CLI startup
+    (renderer construction, and the module-scope caller kind in
+    ``comfy_cli.tracking``), so an exception here would take down every
+    command — including ``--help`` and runs with tracking disabled.
+    """
+    stdout = getattr(sys, "stdout", None)
+    if stdout is None:
+        return False
+    try:
+        return bool(stdout.isatty())
+    except (AttributeError, ValueError):
+        return False
+
+
 def detect_caller(
     env: Mapping[str, str] | None = None,
     *,
     is_tty: bool | None = None,
 ) -> Caller:
     e = env if env is not None else os.environ
-    tty = is_tty if is_tty is not None else sys.stdout.isatty()
+    tty = is_tty if is_tty is not None else _stdout_is_tty()
 
     # 1. Explicit override — custom agent frameworks self-attribute here.
     explicit = e.get("COMFY_USER_AGENT")
diff --git a/comfy_cli/command/run/__init__.py b/comfy_cli/command/run/__init__.py
index d4362ebd..1dadc7a1 100644
--- a/comfy_cli/command/run/__init__.py
+++ b/comfy_cli/command/run/__init__.py
@@ -52,6 +52,12 @@
 
 workspace_manager = WorkspaceManager()
 
+# Bounds on the `partner_nodes` telemetry property and on the partner-node names
+# echoed in the missing-credential error. class_type strings are attacker- (or
+# just accident-) controlled workflow JSON, so cap the list length and each name.
+_TELEMETRY_NODE_LIST_CAP = 20
+_TELEMETRY_NODE_NAME_MAX_LEN = 64
+
 
 def _stdin_is_interactive() -> bool:
     """True only when stdin is a live TTY.
@@ -311,8 +317,12 @@ def execute(
         tracking.track_event(
             "partner_nodes_detected",
             {
-                # Cap defends against pathological graphs; the count stays exact.
-                "partner_nodes": partner_nodes[:20],
+                # Cap defends against pathological graphs in BOTH dimensions —
+                # element count and each name's length, since class_type strings
+                # come verbatim from untrusted workflow JSON and one
+                # multi-megabyte name would otherwise ship whole. The count
+                # below stays exact, so neither cap distorts the metric.
+                "partner_nodes": [n[:_TELEMETRY_NODE_NAME_MAX_LEN] for n in partner_nodes[:_TELEMETRY_NODE_LIST_CAP]],
                 "partner_node_count": len(partner_nodes),
                 "where": "local",
                 "credential_present": bool(api_key) or cred is not None,
@@ -320,9 +330,17 @@ def execute(
         )
         if not extra_data:
             if cred is None:
+                # Cap the names echoed in the prose the same way the telemetry
+                # property is capped — a graph with hundreds of partner nodes
+                # would otherwise render an unreadable wall of text. `details`
+                # below stays complete: it is the machine-readable field a JSON
+                # consumer reads to learn exactly which nodes need a credential.
+                shown = [n[:_TELEMETRY_NODE_NAME_MAX_LEN] for n in partner_nodes[:_TELEMETRY_NODE_LIST_CAP]]
+                overflow = len(partner_nodes) - len(shown)
+                listed = ", ".join(shown) + (f", and {overflow} more" if overflow > 0 else "")
                 msg = (
                     "Workflow uses partner-API node(s) that need an `api_key_comfy_org` "
-                    "credential the local server doesn't have: " + ", ".join(partner_nodes) + "."
+                    "credential the local server doesn't have: " + listed + "."
                 )
                 renderer.error(
                     code="partner_node_requires_credential",
diff --git a/comfy_cli/tracking.py b/comfy_cli/tracking.py
index a2798200..5f43fec6 100644
--- a/comfy_cli/tracking.py
+++ b/comfy_cli/tracking.py
@@ -117,6 +117,27 @@ def _scrub_value(value: object) -> object:
     return value
 
 
+# The four intrinsic caller kinds are short and fixed, but COMFY_USER_AGENT lets
+# a caller name itself anything and detect_caller only lowercases it. 64 chars is
+# ample for a self-attribution label ("claude-code", "my-harness/1.2").
+_CALLER_KIND_MAX_LEN = 64
+
+
+def _sanitize_caller_kind(kind: str) -> str:
+    """Make the caller label safe to ship as a telemetry property.
+
+    ``caller_kind`` rides EVERY event — including ``feedback_submitted``, which
+    is dispatched even when passive-telemetry consent is off — and a custom
+    ``COMFY_USER_AGENT`` is arbitrary user-supplied text that could hold a path,
+    a URL, or unbounded junk. Give it the same treatment command kwargs get:
+    strip credentials embedded in a URL value, then cap the length so a
+    pathological label can't ship an unbounded string to both providers.
+    """
+    scrubbed = _scrub_value(kind)
+    text = scrubbed if isinstance(scrubbed, str) else str(scrubbed)
+    return text[:_CALLER_KIND_MAX_LEN]
+
+
 # Generate a unique tracing ID per command.
 config_manager = ConfigManager()
 cli_version = config_manager.get_cli_version()
@@ -128,7 +149,7 @@ def _scrub_value(value: object) -> object:
 # Who is driving this process: "user" | "pipe" | "agent" | "claude-code" | a
 # lowercased custom COMFY_USER_AGENT label. Computed once at import, matching
 # the cli_version/tracing_id pattern above, so we don't re-run isatty per event.
-_caller_kind = detect_caller().kind
+_caller_kind = _sanitize_caller_kind(detect_caller().kind)
 workspace_manager = WorkspaceManager()
 
 # Process-scoped opt-in used when running non-interactively before the
diff --git a/tests/comfy_cli/command/test_run.py b/tests/comfy_cli/command/test_run.py
index bff99cac..73896df0 100644
--- a/tests/comfy_cli/command/test_run.py
+++ b/tests/comfy_cli/command/test_run.py
@@ -10,6 +10,7 @@
 from websocket import WebSocketException, WebSocketTimeoutException
 
 from comfy_cli.command.run import (
+    _TELEMETRY_NODE_NAME_MAX_LEN,
     WorkflowExecution,
     _count_output_nodes,
     _detect_partner_nodes,
@@ -1421,6 +1422,67 @@ def test_partner_nodes_list_is_capped_but_count_is_exact(self, tmp_path, monkeyp
         assert events[0]["partner_node_count"] == 30
         assert events[0]["partner_nodes"] == [f"PartnerNode{i:02d}" for i in range(20)]
 
+    def test_each_node_name_is_truncated_not_just_the_list(self, tmp_path, monkeypatch):
+        """The element cap alone doesn't bound the payload: class_type strings
+        come verbatim from untrusted workflow JSON, so a single multi-megabyte
+        name would still ship whole. Each name is capped too."""
+        huge = "A" * 5000
+        workflow = {"1": {"class_type": huge, "inputs": {}}}
+        object_info = {huge: {"category": "image", "api_node": True}}
+        wf_file = self._wf_file(tmp_path, workflow)
+        self._no_credentials(monkeypatch)
+
+        with (
+            patch("comfy_cli.command.run.check_comfy_server_running", return_value=True),
+            patch("comfy_cli.command.run._fetch_object_info", return_value=object_info),
+            patch("comfy_cli.command.run.WorkflowExecution"),
+            patch("comfy_cli.tracking.track_event") as mock_track,
+        ):
+            with pytest.raises(typer.Exit):
+                execute(wf_file, host="127.0.0.1", port=8188, wait=True, timeout=30, allow_spend=True)
+
+        events = self._partner_events(mock_track)
+        assert len(events) == 1
+        (shipped,) = events[0]["partner_nodes"]
+        assert shipped == "A" * _TELEMETRY_NODE_NAME_MAX_LEN
+        assert events[0]["partner_node_count"] == 1
+
+    def test_missing_credential_error_truncates_a_huge_node_list(self, tmp_path, monkeypatch):
+        """The prose error echoes the node names; a graph with hundreds of
+        partner nodes must not render an unbounded wall of text. `details` stays
+        complete — it's the machine-readable field JSON consumers read."""
+        workflow = {str(i): {"class_type": f"PartnerNode{i:02d}", "inputs": {}} for i in range(30)}
+        object_info = {f"PartnerNode{i:02d}": {"category": "image", "api_node": True} for i in range(30)}
+        wf_file = self._wf_file(tmp_path, workflow)
+        self._no_credentials(monkeypatch)
+
+        errors = []
+        from comfy_cli.output.renderer import Renderer
+
+        original_error = Renderer.error
+
+        def capture_error(self, *, code, message, hint=None, details=None, exit_code=1):
+            errors.append({"code": code, "message": message, "details": details})
+            return original_error(self, code=code, message=message, hint=hint, details=details, exit_code=exit_code)
+
+        monkeypatch.setattr(Renderer, "error", capture_error)
+
+        with (
+            patch("comfy_cli.command.run.check_comfy_server_running", return_value=True),
+            patch("comfy_cli.command.run._fetch_object_info", return_value=object_info),
+            patch("comfy_cli.command.run.WorkflowExecution"),
+            patch("comfy_cli.tracking.track_event"),
+        ):
+            with pytest.raises(typer.Exit):
+                execute(wf_file, host="127.0.0.1", port=8188, wait=True, timeout=30, allow_spend=True)
+
+        err = next(e for e in errors if e["code"] == "partner_node_requires_credential")
+        assert "PartnerNode00" in err["message"]
+        assert "and 10 more" in err["message"]
+        assert "PartnerNode29" not in err["message"]
+        # The structured field keeps every name.
+        assert len(err["details"]["partner_nodes"]) == 30
+
 
 class TestExecuteSpendGate:
     """`comfy run` gates partner-API (paid) workflows on `--allow-spend`
diff --git a/tests/comfy_cli/output/test_caller.py b/tests/comfy_cli/output/test_caller.py
index 79df1e75..a21b0ab5 100644
--- a/tests/comfy_cli/output/test_caller.py
+++ b/tests/comfy_cli/output/test_caller.py
@@ -5,6 +5,10 @@
 no banner). The ``kind`` field is for analytics/logging only.
 """
 
+import sys
+
+import pytest
+
 from comfy_cli.caller import detect_caller
 
 
@@ -70,3 +74,44 @@ def test_user_agent_override_wins_over_everything():
     c = detect_caller(env={"COMFY_USER_AGENT": "harness", "AI_AGENT": "1", "CLAUDECODE": "1"}, is_tty=True)
     assert c.kind == "harness"
     assert c.source_env == "COMFY_USER_AGENT"
+
+
+class TestStdoutProbeIsFailSafe:
+    """``detect_caller`` runs during CLI startup — renderer construction and the
+    module-scope caller kind in ``comfy_cli.tracking``, which is imported for
+    every command. Probing stdout must therefore never raise: in detached /
+    ``pythonw`` contexts ``sys.stdout`` is ``None`` or already closed, and an
+    exception here would break even ``comfy --help`` with tracking disabled.
+    """
+
+    def test_missing_stdout_is_pipe_not_attribute_error(self, monkeypatch):
+        monkeypatch.setattr(sys, "stdout", None)
+        c = detect_caller(env={})
+        assert c.kind == "pipe"
+        assert c.agentic is True
+
+    def test_closed_stdout_is_pipe_not_value_error(self, monkeypatch, tmp_path):
+        handle = open(tmp_path / "out.txt", "w")
+        handle.close()
+        monkeypatch.setattr(sys, "stdout", handle)
+        # Sanity: the raw probe really does raise on this object.
+        with pytest.raises(ValueError):
+            handle.isatty()
+        c = detect_caller(env={})
+        assert c.kind == "pipe"
+
+    def test_stdout_without_isatty_is_pipe(self, monkeypatch):
+        """A replacement stream that doesn't implement isatty at all."""
+
+        class Bare:
+            pass
+
+        monkeypatch.setattr(sys, "stdout", Bare())
+        assert detect_caller(env={}).kind == "pipe"
+
+    def test_explicit_env_signals_never_probe_stdout(self, monkeypatch):
+        """The env-var branches return before stdout is touched, so an
+        unusable stdout can't affect an explicitly-attributed caller."""
+        monkeypatch.setattr(sys, "stdout", None)
+        assert detect_caller(env={"AI_AGENT": "1"}).kind == "agent"
+        assert detect_caller(env={"COMFY_USER_AGENT": "my-bot"}).kind == "my-bot"
diff --git a/tests/comfy_cli/test_tracking.py b/tests/comfy_cli/test_tracking.py
index 271556f2..448aa419 100644
--- a/tests/comfy_cli/test_tracking.py
+++ b/tests/comfy_cli/test_tracking.py
@@ -133,6 +133,40 @@ def test_explicit_user_agent_label_flows_through(self, tracking_module):
         assert properties["caller_kind"] == "my-harness"
 
 
+class TestSanitizeCallerKind:
+    """``COMFY_USER_AGENT`` is arbitrary user-supplied text that detect_caller
+    only lowercases, and the resulting label now rides EVERY event — including
+    feedback, which dispatches even when passive-telemetry consent is off. So it
+    gets the same cap-and-scrub treatment command kwargs get before it ships."""
+
+    def test_intrinsic_kinds_pass_through_unchanged(self, tracking_module):
+        for kind in ("user", "pipe", "agent", "claude-code"):
+            assert tracking_module._sanitize_caller_kind(kind) == kind
+
+    def test_long_label_is_truncated(self, tracking_module):
+        sanitized = tracking_module._sanitize_caller_kind("x" * 5000)
+        assert len(sanitized) == tracking_module._CALLER_KIND_MAX_LEN
+
+    def test_url_label_loses_its_query_string(self, tracking_module):
+        """A label shaped like a URL can carry a token in the query string."""
+        assert (
+            tracking_module._sanitize_caller_kind("https://harness.example/agent?token=s3cret")
+            == "https://harness.example/agent"
+        )
+
+    def test_module_scope_value_is_sanitized(self, tracking_module):
+        """The value actually stamped on events is bounded, whatever the env
+        said — this is the property that matters, not the helper in isolation."""
+        assert len(tracking_module._caller_kind) <= tracking_module._CALLER_KIND_MAX_LEN
+
+    def test_oversized_label_is_capped_on_the_wire(self, tracking_module):
+        tracking_module.config_manager.set(constants.CONFIG_KEY_ENABLE_TRACKING, "True")
+        with patch.object(tracking_module, "_caller_kind", tracking_module._sanitize_caller_kind("z" * 900)):
+            tracking_module.track_event("some_event")
+        _, _, properties = _last_track_call(tracking_module.provider)
+        assert len(properties["caller_kind"]) == tracking_module._CALLER_KIND_MAX_LEN
+
+
 class TestSubmitFeedback:
     def test_sends_even_when_passive_consent_disabled(self, tracking_module):
         # Feedback is explicit/user-initiated: it ignores the passive-telemetry

From a273852a07563dc9a2505e89568d5d2ac5bf345c Mon Sep 17 00:00:00 2001
From: Matt Miller <mattmiller@comfy.org>
Date: Sat, 1 Aug 2026 19:36:47 -0700
Subject: [PATCH 3/4] fix(telemetry): centralize the fail-safe TTY probe +
 bound the error details (BE-5633)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Second Cursor panel round. Six of ten findings were valid; the four
rebutted are answered on their threads.

Startup crash-safety (2 high):
- `stream_is_tty` in caller.py is now the one fail-safe probe for every
  standard-stream TTY check on the startup path. Its handler is broad
  (`Exception`) rather than the AttributeError/ValueError pair: `isatty`
  is an arbitrary attribute on an arbitrary object, so a revoked fd
  raises OSError (EBADF / WinError 6) and a non-conforming replacement
  stream can raise anything. Every failure means the same thing.
- `Renderer.resolve` and `tracking.prompt_tracking_consent` still called
  `sys.stdout.isatty()` unguarded, both from the main Typer callback —
  so under `pythonw`/detached stdout `comfy --help` died moments after
  detect_caller succeeded. The previous round's guard only covered
  detect_caller, and the tests exercised it in isolation, which gave
  false confidence. Both now route through the shared probe, as does
  run's `_stdin_is_interactive`.
- `detect_caller` probes stdout lazily, only once every env branch has
  declined, so an explicitly-attributed caller never touches the stream.

Telemetry hygiene:
- `_scrub_value` strips URL userinfo, not just the query and fragment:
  `COMFY_USER_AGENT=https://svc:s3cret@host/agent` fit under the 64-char
  cap and shipped a basic-auth secret to both providers on every event.
  Generalized to any `<scheme>://` — the same slot carries credentials
  for ftp/ssh/redis, and the strip only ever removes those components.
- `feedback_submitted` — the one path that sends without passive consent
  — now carries the caller kind narrowed to the four intrinsic kinds
  ("custom" otherwise), instead of a free-text environment-derived label.
  Consent-gated paths keep the full label.

Bounded node names:
- `details` is bounded like the prose message. Capping only the message
  bounded nothing: `error_panel` prints details as key=value rows right
  underneath it, and JSON mode serializes them. `partner_node_count`
  carries the exact total, and docs/json-output.md records the contract.
- De-duplicate after truncation, not before: two class_types sharing a
  64-char prefix collapsed to one string and listed the same name twice.

Full suite green (3783 passed, 37 skipped); ruff 0.15.15 (the CI pin)
clean on check and format.
---
 comfy_cli/caller.py                     |  58 +++++++----
 comfy_cli/command/run/__init__.py       |  75 +++++++++-----
 comfy_cli/output/renderer.py            |   8 +-
 comfy_cli/tracking.py                   |  92 +++++++++++++++--
 docs/json-output.md                     |   2 +-
 tests/comfy_cli/command/test_run.py     |  40 ++++++-
 tests/comfy_cli/output/test_caller.py   |  51 ++++++++-
 tests/comfy_cli/output/test_renderer.py |  50 +++++++++
 tests/comfy_cli/test_tracking.py        | 132 +++++++++++++++++++++++-
 9 files changed, 438 insertions(+), 70 deletions(-)

diff --git a/comfy_cli/caller.py b/comfy_cli/caller.py
index 37d6dbe5..1baf7bcb 100644
--- a/comfy_cli/caller.py
+++ b/comfy_cli/caller.py
@@ -42,37 +42,52 @@ def _truthy(value: str | None) -> bool:
     return value.strip().lower() not in {"", "0", "false", "no", "off"}
 
 
-def _stdout_is_tty() -> bool:
-    """True only when stdout is a live TTY.
-
-    ``sys.stdout.isatty()`` assumes stdout is a live stream, but in detached /
-    ``pythonw`` contexts ``sys.stdout`` can be ``None`` (AttributeError on
-    ``.isatty``) or an already-closed file (ValueError). A process with no
-    usable stdout is by definition not a human at a terminal, so treat both as
-    non-TTY and fall through to ``kind="pipe"`` rather than raising. Mirrors
-    ``_stdin_is_interactive`` in ``comfy_cli/command/run/__init__.py``.
-
-    This has to be fail-safe: ``detect_caller`` is called during CLI startup
-    (renderer construction, and the module-scope caller kind in
-    ``comfy_cli.tracking``), so an exception here would take down every
-    command — including ``--help`` and runs with tracking disabled.
+def stream_is_tty(stream: object) -> bool:
+    """True only when *stream* is a live TTY. Never raises — that is the point.
+
+    ``sys.stdout.isatty()`` assumes stdout is a live stream, but a process's
+    standard streams are not guaranteed to be one. Under ``pythonw``, a Windows
+    service, or a detached/daemonised parent they can be ``None``; after a
+    wrapper closes or replaces them they can be an already-closed file, an
+    object with no ``isatty`` at all, or one backed by a revoked file
+    descriptor. Those raise ``AttributeError``, ``ValueError``, ``OSError``
+    (``EBADF`` / ``WinError 6``) and ``TypeError`` respectively — and a
+    non-conforming replacement stream can raise anything at all, since
+    ``isatty`` is just an arbitrary attribute on an arbitrary object.
+
+    So the handler is deliberately broad rather than a list of the failures we
+    happened to think of. A process with no usable stream is by definition not
+    a human at a terminal, so every failure means the same thing: not a TTY.
+
+    This is the shared, fail-safe probe for every standard-stream TTY check on
+    the startup path — ``detect_caller`` below, ``Renderer.resolve``, and
+    ``tracking.prompt_tracking_consent``. All three run before argument
+    parsing, so an escaping exception would take down every command, including
+    ``--help`` and runs with tracking disabled.
     """
-    stdout = getattr(sys, "stdout", None)
-    if stdout is None:
+    if stream is None:
+        return False
+    isatty = getattr(stream, "isatty", None)
+    if isatty is None:
         return False
     try:
-        return bool(stdout.isatty())
-    except (AttributeError, ValueError):
+        return bool(isatty())
+    except Exception:
         return False
 
 
+def _stdout_is_tty() -> bool:
+    """``stream_is_tty`` against the live ``sys.stdout``, re-read on each call
+    so a test or wrapper that swaps the stream is honoured."""
+    return stream_is_tty(getattr(sys, "stdout", None))
+
+
 def detect_caller(
     env: Mapping[str, str] | None = None,
     *,
     is_tty: bool | None = None,
 ) -> Caller:
     e = env if env is not None else os.environ
-    tty = is_tty if is_tty is not None else _stdout_is_tty()
 
     # 1. Explicit override — custom agent frameworks self-attribute here.
     explicit = e.get("COMFY_USER_AGENT")
@@ -87,7 +102,10 @@ def detect_caller(
     if _truthy(e.get("CLAUDECODE")):
         return Caller(kind="claude-code", agentic=True, source_env="CLAUDECODE")
 
-    # 4. Non-TTY — piped, backgrounded, or CI.
+    # 4. Non-TTY — piped, backgrounded, or CI. Probed lazily, only once the
+    #    env-var branches above have all declined: an explicitly-attributed
+    #    caller is answered without ever touching stdout.
+    tty = is_tty if is_tty is not None else _stdout_is_tty()
     if not tty:
         return Caller(kind="pipe", agentic=True, source_env=None)
 
diff --git a/comfy_cli/command/run/__init__.py b/comfy_cli/command/run/__init__.py
index 1dadc7a1..22942943 100644
--- a/comfy_cli/command/run/__init__.py
+++ b/comfy_cli/command/run/__init__.py
@@ -23,6 +23,7 @@
 )
 
 from comfy_cli import cancellation, execution_errors, jobs_state, tracking
+from comfy_cli.caller import stream_is_tty
 
 # Re-exports — names patched by tests live at this namespace.
 from comfy_cli.command.run.credentials import _resolve_partner_credential as _resolve_partner_credential
@@ -59,22 +60,45 @@
 _TELEMETRY_NODE_NAME_MAX_LEN = 64
 
 
+def _bounded_node_names(names: list[str]) -> list[str]:
+    """Cap a partner-node name list in BOTH dimensions — element count and each
+    name's length — for every payload that leaves this process or reaches a
+    terminal.
+
+    Applies to the structured ``details`` of the credential error as well as to
+    the telemetry property and the prose message. Capping only the prose would
+    not actually bound anything: ``error_panel`` renders ``details`` as
+    ``key=value`` rows directly beneath the message in pretty mode, and JSON
+    mode serialises them, so an uncapped list there re-floods exactly the
+    output the caps exist to protect. The exact total is reported alongside as
+    ``partner_node_count``, so nothing is lost — a consumer still learns how
+    many nodes need a credential, and the remedy (log in) is identical whichever
+    ones they are.
+
+    De-duplicates AFTER truncation, not before: ``_detect_partner_nodes``
+    returns distinct class_types, but two that share a 64-char prefix collapse
+    to the same string once truncated, which would list one name twice. The
+    list is meant to map one-to-one onto node classes.
+    """
+    out: list[str] = []
+    for name in names[:_TELEMETRY_NODE_LIST_CAP]:
+        truncated = name[:_TELEMETRY_NODE_NAME_MAX_LEN]
+        if truncated not in out:
+            out.append(truncated)
+    return out
+
+
 def _stdin_is_interactive() -> bool:
     """True only when stdin is a live TTY.
 
     ``sys.stdin.isatty()`` assumes stdin is a live stream, but in detached /
-    ``pythonw`` contexts ``sys.stdin`` can be ``None`` (AttributeError on
-    ``.isatty``) or a closed file (ValueError). Treat both as non-interactive so
-    the spend gate falls through to the fail-closed machine-mode error instead
-    of raising an uncontrolled exception (BE-4326).
+    ``pythonw`` contexts ``sys.stdin`` can be ``None``, closed, or backed by a
+    revoked file descriptor. Treat every such case as non-interactive so the
+    spend gate falls through to the fail-closed machine-mode error instead of
+    raising an uncontrolled exception (BE-4326). Delegates to the shared
+    fail-safe probe so stdin and stdout are guarded identically.
     """
-    stdin = getattr(sys, "stdin", None)
-    if stdin is None:
-        return False
-    try:
-        return bool(stdin.isatty())
-    except (AttributeError, ValueError):
-        return False
+    return stream_is_tty(getattr(sys, "stdin", None))
 
 
 def _spend_gate(renderer, partner_nodes: list[str], allow_spend: bool, *, details: dict) -> None:
@@ -314,15 +338,14 @@ def execute(
         # refresh), and `credential_present` needs that resolution. The
         # spend-declined funnel wants its own event rather than an early
         # resolve here.
+        # class_type strings come verbatim from untrusted workflow JSON, so the
+        # names are bounded before they ship. The count stays exact, so the cap
+        # never distorts the metric.
+        bounded_nodes = _bounded_node_names(partner_nodes)
         tracking.track_event(
             "partner_nodes_detected",
             {
-                # Cap defends against pathological graphs in BOTH dimensions —
-                # element count and each name's length, since class_type strings
-                # come verbatim from untrusted workflow JSON and one
-                # multi-megabyte name would otherwise ship whole. The count
-                # below stays exact, so neither cap distorts the metric.
-                "partner_nodes": [n[:_TELEMETRY_NODE_NAME_MAX_LEN] for n in partner_nodes[:_TELEMETRY_NODE_LIST_CAP]],
+                "partner_nodes": bounded_nodes,
                 "partner_node_count": len(partner_nodes),
                 "where": "local",
                 "credential_present": bool(api_key) or cred is not None,
@@ -330,14 +353,13 @@ def execute(
         )
         if not extra_data:
             if cred is None:
-                # Cap the names echoed in the prose the same way the telemetry
-                # property is capped — a graph with hundreds of partner nodes
-                # would otherwise render an unreadable wall of text. `details`
-                # below stays complete: it is the machine-readable field a JSON
-                # consumer reads to learn exactly which nodes need a credential.
-                shown = [n[:_TELEMETRY_NODE_NAME_MAX_LEN] for n in partner_nodes[:_TELEMETRY_NODE_LIST_CAP]]
-                overflow = len(partner_nodes) - len(shown)
-                listed = ", ".join(shown) + (f", and {overflow} more" if overflow > 0 else "")
+                # Same bounded list in the prose and in `details` — a graph with
+                # hundreds of partner nodes would otherwise render an unreadable
+                # wall of text, and `details` is rendered right below the message
+                # in pretty mode, so capping only one of them bounds nothing.
+                # `partner_node_count` carries the exact total for consumers.
+                overflow = len(partner_nodes) - len(bounded_nodes)
+                listed = ", ".join(bounded_nodes) + (f", and {overflow} more" if overflow > 0 else "")
                 msg = (
                     "Workflow uses partner-API node(s) that need an `api_key_comfy_org` "
                     "credential the local server doesn't have: " + listed + "."
@@ -351,7 +373,8 @@ def execute(
                         "cloud runs auto-inject via --where cloud)"
                     ),
                     details={
-                        "partner_nodes": partner_nodes,
+                        "partner_nodes": bounded_nodes,
+                        "partner_node_count": len(partner_nodes),
                         "host": host,
                         "port": port,
                     },
diff --git a/comfy_cli/output/renderer.py b/comfy_cli/output/renderer.py
index e0a56f7e..fcb6368e 100644
--- a/comfy_cli/output/renderer.py
+++ b/comfy_cli/output/renderer.py
@@ -22,7 +22,7 @@
 
 from rich.console import Console
 
-from comfy_cli.caller import Caller, detect_caller
+from comfy_cli.caller import Caller, detect_caller, stream_is_tty
 from comfy_cli.output.sanitize import sanitize_markup
 
 # Machine-output contract versions, surfaced in every envelope/event line and
@@ -111,7 +111,11 @@ def resolve(
         env_map = env if env is not None else os.environ
         caller = caller if caller is not None else detect_caller(env_map)
         if is_stdout_tty is None:
-            is_stdout_tty = sys.stdout.isatty()
+            # Guarded probe, not a bare `sys.stdout.isatty()`: this runs from
+            # the main Typer callback before any command dispatch, so under a
+            # detached / `pythonw` stdout a raising probe would kill every
+            # invocation — `comfy --help` included. See `caller.stream_is_tty`.
+            is_stdout_tty = stream_is_tty(getattr(sys, "stdout", None))
 
         mode: OutputMode
         if json_stream_flag:
diff --git a/comfy_cli/tracking.py b/comfy_cli/tracking.py
index 5f43fec6..7a334407 100644
--- a/comfy_cli/tracking.py
+++ b/comfy_cli/tracking.py
@@ -5,6 +5,7 @@
 import json
 import logging as logginglib
 import os
+import re
 import sys
 import threading
 import time
@@ -14,7 +15,7 @@
 import typer
 
 from comfy_cli import constants, logging, ui
-from comfy_cli.caller import detect_caller
+from comfy_cli.caller import detect_caller, stream_is_tty
 from comfy_cli.config_manager import ConfigManager
 from comfy_cli.workspace_manager import WorkspaceManager
 
@@ -109,12 +110,41 @@ def _is_trackable(name: str, value: object) -> bool:
     return True
 
 
+# Any `<scheme>://` prefix, not just http(s): a credential can ride the userinfo
+# slot of ftp/ssh/redis/etc. just as easily, and the scrub below is safe for all
+# of them (it only ever removes the query, fragment, and userinfo components).
+_URL_SCHEME_RE = re.compile(r"^[a-z][a-z0-9+.\-]*://", re.IGNORECASE)
+
+
 def _scrub_value(value: object) -> object:
-    """Strip the query string and fragment from URL values; CivitAI download
-    links carry the token as ?token=. Only top-level http(s) strings are touched."""
-    if isinstance(value, str) and value.startswith(("http://", "https://")):
-        return value.partition("?")[0].partition("#")[0]
-    return value
+    """Strip the credential-bearing components out of a top-level URL string.
+
+    Two of them, both observed in the wild:
+
+    - **query string and fragment** — CivitAI download links carry the API
+      token as ``?token=``.
+    - **userinfo** — ``scheme://user:secret@host/path`` puts a basic-auth
+      password in the authority. Reachable through ``COMFY_USER_AGENT``, whose
+      value becomes the ``caller_kind`` stamped on every event, so a harness
+      that self-attributes with a service URL would otherwise ship its own
+      credential to both providers on every command.
+
+    Non-URL strings are returned verbatim. That leaves a bare filesystem path
+    (or a ``file://`` one) carrying a username untouched — deliberately: there
+    is no general way to tell a private path segment from a public one, and
+    such a value is not a credential. Redacting the whole value is the job of
+    ``_is_sensitive``, keyed on the property name.
+    """
+    if not isinstance(value, str) or not _URL_SCHEME_RE.match(value):
+        return value
+    stripped = value.partition("?")[0].partition("#")[0]
+    scheme, sep, rest = stripped.partition("://")
+    authority, slash, path = rest.partition("/")
+    if "@" in authority:
+        # rpartition: an `@` may legally appear inside the userinfo itself, so
+        # the LAST one is the true delimiter before the host.
+        authority = authority.rpartition("@")[2]
+    return f"{scheme}{sep}{authority}{slash}{path}"
 
 
 # The four intrinsic caller kinds are short and fixed, but COMFY_USER_AGENT lets
@@ -122,6 +152,10 @@ def _scrub_value(value: object) -> object:
 # ample for a self-attribution label ("claude-code", "my-harness/1.2").
 _CALLER_KIND_MAX_LEN = 64
 
+# The kinds detect_caller derives on its own, with no free text from the
+# environment. Anything else came from a COMFY_USER_AGENT label.
+_INTRINSIC_CALLER_KINDS = frozenset({"user", "pipe", "agent", "claude-code"})
+
 
 def _sanitize_caller_kind(kind: str) -> str:
     """Make the caller label safe to ship as a telemetry property.
@@ -150,6 +184,21 @@ def _sanitize_caller_kind(kind: str) -> str:
 # lowercased custom COMFY_USER_AGENT label. Computed once at import, matching
 # the cli_version/tracing_id pattern above, so we don't re-run isatty per event.
 _caller_kind = _sanitize_caller_kind(detect_caller().kind)
+
+
+def _intrinsic_caller_kind() -> str:
+    """``_caller_kind`` collapsed to one of the four kinds the CLI derives itself.
+
+    For the one send path the user has NOT consented to passively — feedback,
+    which ships on an explicit user action and is suppressed only by the hard
+    env opt-out — a free-text, environment-derived label is more than the
+    analytics question needs. "Was this a human or an agent?" is answered just
+    as well by the closed set, so a custom ``COMFY_USER_AGENT`` collapses to
+    the literal ``"custom"`` there rather than riding along verbatim.
+    """
+    return _caller_kind if _caller_kind in _INTRINSIC_CALLER_KINDS else "custom"
+
+
 workspace_manager = WorkspaceManager()
 
 # Process-scoped opt-in used when running non-interactively before the
@@ -374,7 +423,12 @@ def disable():
 
 
 def _dispatch(
-    event_name: str, properties: dict[str, Any], *, distinct_id: str | None, mixpanel_name: str | None = None
+    event_name: str,
+    properties: dict[str, Any],
+    *,
+    distinct_id: str | None,
+    mixpanel_name: str | None = None,
+    caller_kind: str | None = None,
 ):
     """Fan an event out to every provider. Enriches with cli_version/tracing_id/caller_kind.
 
@@ -384,8 +438,15 @@ def _dispatch(
     ``caller_kind`` lands on EVERY event (execution_*, partner_nodes_detected,
     feedback, …) — that is the point: it makes agent-vs-human analytics possible
     across the whole stream. Purely additive, so no existing dashboard breaks.
+    Defaults to the full label; a caller that ships on a weaker consent basis
+    passes the narrowed one (see ``_intrinsic_caller_kind``).
     """
-    properties = {**properties, "cli_version": cli_version, "tracing_id": tracing_id, "caller_kind": _caller_kind}
+    properties = {
+        **properties,
+        "cli_version": cli_version,
+        "tracing_id": tracing_id,
+        "caller_kind": caller_kind if caller_kind is not None else _caller_kind,
+    }
     for provider in _get_providers():
         provider_event_name = (
             mixpanel_name if (mixpanel_name is not None and isinstance(provider, MixpanelProvider)) else event_name
@@ -456,7 +517,15 @@ def submit_feedback(message: str = "", *, scores: dict[str, str | None] | None =
     if not properties:
         return False
     consented = config_manager.get_bool(constants.CONFIG_KEY_ENABLE_TRACKING)
-    _dispatch("feedback_submitted", properties, distinct_id=_ensure_user_id(persist=bool(consented)))
+    # Narrowed caller_kind: this is the one path that sends without passive
+    # consent, so it carries the closed set of intrinsic kinds rather than a
+    # free-text COMFY_USER_AGENT label.
+    _dispatch(
+        "feedback_submitted",
+        properties,
+        distinct_id=_ensure_user_id(persist=bool(consented)),
+        caller_kind=_intrinsic_caller_kind(),
+    )
     return True
 
 
@@ -538,7 +607,10 @@ def prompt_tracking_consent(skip_prompt: bool = False, default_value: bool = Fal
     # Persist a stable anonymous user_id so a later interactive consent
     # prompt can reuse it, but do NOT auto-enable telemetry — that would
     # violate the DO_NOT_TRACK convention spirit for OSS tooling.
-    if not sys.stdin.isatty() or not sys.stdout.isatty():
+    # Guarded probes: this runs from the main Typer callback, so a detached /
+    # `pythonw` stdio pair must degrade to "non-interactive" rather than raise
+    # and take the command down. See `caller.stream_is_tty`.
+    if not stream_is_tty(getattr(sys, "stdin", None)) or not stream_is_tty(getattr(sys, "stdout", None)):
         if user_id is None:
             user_id = str(uuid.uuid4())
             try:
diff --git a/docs/json-output.md b/docs/json-output.md
index 5e512ce5..72805b44 100644
--- a/docs/json-output.md
+++ b/docs/json-output.md
@@ -372,7 +372,7 @@ registry test enforces this) and surfaced by `comfy discover`.
 | `object_info_unavailable` | `/object_info` returned an HTTP error, or HTTP 200 with an unparseable body     | `status` (int), `body` (str)                       | 1 |
 | `connection_error`        | Server unreachable mid-flow: `URLError`, `TimeoutError`, or other `OSError` (including on `/object_info`) | —                       | 1 |
 | `workflow_unknown_nodes`  | Pre-submit validation found unknown class_types / shape mismatches              | `errors` (array), `warnings` (array)               | 1 |
-| `partner_node_requires_credential` | Workflow uses a partner-API node and no `api_key_comfy_org` credential is available | `partner_nodes` (array of str), `host`, `port` | 1 |
+| `partner_node_requires_credential` | Workflow uses a partner-API node and no `api_key_comfy_org` credential is available | `partner_nodes` (array of str, capped at 20 entries × 64 chars each), `partner_node_count` (int, the exact total — read this, not `len(partner_nodes)`), `host`, `port` | 1 |
 | `spend_consent_required`  | Workflow embeds partner-API (paid) nodes and `--allow-spend` was not passed (machine mode) or interactive consent was declined; re-run with `--allow-spend`. Free (non-partner) workflows are unaffected. | `partner_nodes` (array of str); local path also carries `host`, `port`, the cloud path carries `where: "cloud"` | 1 |
 | `prompt_rejected`         | Server returned HTTP 400 with `node_errors`                                     | `status` (400), `node_errors` (array — [shape](#node_errors-shape)) | 1 |
 | `client_error`            | Server returned another HTTP 4xx response                                       | `status` (int, 4xx), `body` (str)                  | 1 |
diff --git a/tests/comfy_cli/command/test_run.py b/tests/comfy_cli/command/test_run.py
index 73896df0..710d43d0 100644
--- a/tests/comfy_cli/command/test_run.py
+++ b/tests/comfy_cli/command/test_run.py
@@ -1449,8 +1449,10 @@ def test_each_node_name_is_truncated_not_just_the_list(self, tmp_path, monkeypat
 
     def test_missing_credential_error_truncates_a_huge_node_list(self, tmp_path, monkeypatch):
         """The prose error echoes the node names; a graph with hundreds of
-        partner nodes must not render an unbounded wall of text. `details` stays
-        complete — it's the machine-readable field JSON consumers read."""
+        partner nodes must not render an unbounded wall of text. `details` is
+        bounded the same way — `error_panel` prints it as key=value rows right
+        under the message in pretty mode, so capping only the prose would bound
+        nothing. `partner_node_count` carries the exact total instead."""
         workflow = {str(i): {"class_type": f"PartnerNode{i:02d}", "inputs": {}} for i in range(30)}
         object_info = {f"PartnerNode{i:02d}": {"category": "image", "api_node": True} for i in range(30)}
         wf_file = self._wf_file(tmp_path, workflow)
@@ -1480,8 +1482,38 @@ def capture_error(self, *, code, message, hint=None, details=None, exit_code=1):
         assert "PartnerNode00" in err["message"]
         assert "and 10 more" in err["message"]
         assert "PartnerNode29" not in err["message"]
-        # The structured field keeps every name.
-        assert len(err["details"]["partner_nodes"]) == 30
+        # The structured field is bounded identically, with the exact total
+        # alongside it so no information is actually lost.
+        assert err["details"]["partner_nodes"] == [f"PartnerNode{i:02d}" for i in range(20)]
+        assert err["details"]["partner_node_count"] == 30
+
+    def test_names_are_deduplicated_after_truncation_not_before(self, tmp_path, monkeypatch):
+        """Truncating to 64 chars can collapse two distinct class_types that
+        share a prefix into the same string. De-duplicating before the cap (the
+        order `_detect_partner_nodes` gives us) would then list one name twice
+        while the count called them distinct."""
+        prefix = "P" * _TELEMETRY_NODE_NAME_MAX_LEN
+        names = [prefix + "alpha", prefix + "beta"]
+        workflow = {str(i): {"class_type": n, "inputs": {}} for i, n in enumerate(names)}
+        object_info = {n: {"category": "image", "api_node": True} for n in names}
+        wf_file = self._wf_file(tmp_path, workflow)
+        self._no_credentials(monkeypatch)
+
+        with (
+            patch("comfy_cli.command.run.check_comfy_server_running", return_value=True),
+            patch("comfy_cli.command.run._fetch_object_info", return_value=object_info),
+            patch("comfy_cli.command.run.WorkflowExecution"),
+            patch("comfy_cli.tracking.track_event") as mock_track,
+        ):
+            with pytest.raises(typer.Exit):
+                execute(wf_file, host="127.0.0.1", port=8188, wait=True, timeout=30, allow_spend=True)
+
+        events = self._partner_events(mock_track)
+        assert len(events) == 1
+        # Both truncate to the same string — it appears once, not twice.
+        assert events[0]["partner_nodes"] == [prefix]
+        # The count is over the real class_types, so it still says two.
+        assert events[0]["partner_node_count"] == 2
 
 
 class TestExecuteSpendGate:
diff --git a/tests/comfy_cli/output/test_caller.py b/tests/comfy_cli/output/test_caller.py
index a21b0ab5..9ecd25f3 100644
--- a/tests/comfy_cli/output/test_caller.py
+++ b/tests/comfy_cli/output/test_caller.py
@@ -109,9 +109,54 @@ class Bare:
         monkeypatch.setattr(sys, "stdout", Bare())
         assert detect_caller(env={}).kind == "pipe"
 
+    def test_revoked_fd_stdout_is_pipe_not_os_error(self, monkeypatch):
+        """A stream over a closed/revoked file descriptor raises OSError
+        (EBADF, or WinError 6 on Windows), not ValueError."""
+
+        class Revoked:
+            def isatty(self):
+                raise OSError(9, "Bad file descriptor")
+
+        monkeypatch.setattr(sys, "stdout", Revoked())
+        assert detect_caller(env={}).kind == "pipe"
+
+    def test_non_conforming_stdout_is_pipe_not_type_error(self, monkeypatch):
+        """`isatty` is just an attribute on an arbitrary object, so a
+        replacement stream can raise anything at all — including from a
+        non-callable `isatty`. The handler is broad on purpose."""
+
+        class Weird:
+            isatty = "not callable"
+
+        monkeypatch.setattr(sys, "stdout", Weird())
+        assert detect_caller(env={}).kind == "pipe"
+
+        class Hostile:
+            def isatty(self):
+                raise RuntimeError("boom")
+
+        monkeypatch.setattr(sys, "stdout", Hostile())
+        assert detect_caller(env={}).kind == "pipe"
+
     def test_explicit_env_signals_never_probe_stdout(self, monkeypatch):
-        """The env-var branches return before stdout is touched, so an
-        unusable stdout can't affect an explicitly-attributed caller."""
-        monkeypatch.setattr(sys, "stdout", None)
+        """The env-var branches return before stdout is probed at all, so an
+        explicitly-attributed caller is answered without touching the stream.
+
+        Asserted by counting probes rather than by outcome: a fail-safe probe
+        would make the outcome right even if it were called eagerly, so only
+        the count actually pins the short-circuit."""
+        probes = []
+
+        class Counting:
+            def isatty(self):
+                probes.append(1)
+                return False
+
+        monkeypatch.setattr(sys, "stdout", Counting())
         assert detect_caller(env={"AI_AGENT": "1"}).kind == "agent"
         assert detect_caller(env={"COMFY_USER_AGENT": "my-bot"}).kind == "my-bot"
+        assert detect_caller(env={"CLAUDECODE": "1"}).kind == "claude-code"
+        assert probes == []
+        # Sanity: the probe IS reached once no env signal matches.
+        assert detect_caller(env={}).kind == "pipe"
+        assert probes == [1]
diff --git a/tests/comfy_cli/output/test_renderer.py b/tests/comfy_cli/output/test_renderer.py
index 7bfe4c48..d3511d3b 100644
--- a/tests/comfy_cli/output/test_renderer.py
+++ b/tests/comfy_cli/output/test_renderer.py
@@ -395,3 +395,53 @@ def test_pretty_helpers_tolerate_non_string_messages():
     assert "42" in _pretty_output(lambda r: r.warn(42))
     assert "42" in _pretty_output(lambda r: r.info(42))
     assert "42" in _pretty_output(lambda r: r.success(42))
+
+
+class TestResolveSurvivesAnUnusableStdout:
+    """``Renderer.resolve`` runs from the main Typer callback (``cmdline.py``)
+    before any command dispatch, and every call site there omits
+    ``is_stdout_tty``, so it probes ``sys.stdout`` itself.
+
+    Under ``pythonw``, a Windows service, or a detached parent, ``sys.stdout``
+    is ``None`` or an already-closed file. A bare ``sys.stdout.isatty()`` there
+    raises before argument parsing, which takes down EVERY command — including
+    ``comfy --help`` and runs with tracking disabled. The probe is routed
+    through ``caller.stream_is_tty``, so it degrades to "not a TTY" (→ JSON
+    mode, the correct read of a process with no terminal) instead.
+    """
+
+    def test_missing_stdout_resolves_to_json_not_attribute_error(self, monkeypatch):
+        import comfy_cli.output.renderer as renderer_mod
+
+        monkeypatch.setattr(renderer_mod.sys, "stdout", None)
+        r = Renderer.resolve(env={})
+        assert r.mode is OutputMode.JSON
+
+    def test_closed_stdout_resolves_to_json_not_value_error(self, monkeypatch, tmp_path):
+        import comfy_cli.output.renderer as renderer_mod
+
+        handle = open(tmp_path / "out.txt", "w")
+        handle.close()
+        monkeypatch.setattr(renderer_mod.sys, "stdout", handle)
+        assert Renderer.resolve(env={}).mode is OutputMode.JSON
+
+    def test_revoked_fd_stdout_resolves_to_json_not_os_error(self, monkeypatch):
+        import comfy_cli.output.renderer as renderer_mod
+
+        class Revoked:
+            def isatty(self):
+                raise OSError(9, "Bad file descriptor")
+
+        monkeypatch.setattr(renderer_mod.sys, "stdout", Revoked())
+        assert Renderer.resolve(env={}).mode is OutputMode.JSON
+
+    def test_a_live_tty_still_resolves_to_pretty(self, monkeypatch):
+        """The guard must not flip healthy terminals to JSON."""
+        import comfy_cli.output.renderer as renderer_mod
+
+        class Tty:
+            def isatty(self):
+                return True
+
+        monkeypatch.setattr(renderer_mod.sys, "stdout", Tty())
+        assert Renderer.resolve(env={}).mode is OutputMode.PRETTY
diff --git a/tests/comfy_cli/test_tracking.py b/tests/comfy_cli/test_tracking.py
index 448aa419..18aad161 100644
--- a/tests/comfy_cli/test_tracking.py
+++ b/tests/comfy_cli/test_tracking.py
@@ -112,10 +112,11 @@ def test_caller_kind_is_one_of_the_known_kinds_by_default(self, tracking_module)
         assert tracking_module._caller_kind in {"user", "pipe", "agent", "claude-code"}
 
     def test_feedback_carries_caller_kind(self, tracking_module):
-        # Feedback rides the same _dispatch path, so it is enriched too.
+        # Feedback rides the same _dispatch path, so it is enriched too — but
+        # with the narrowed label (see TestFeedbackCallerKindIsNarrowed).
         tracking_module.submit_feedback("nice tool")
         _, _, properties = _last_track_call(tracking_module.provider)
-        assert properties["caller_kind"] == tracking_module._caller_kind
+        assert properties["caller_kind"] == tracking_module._intrinsic_caller_kind()
 
     def test_explicit_user_agent_label_flows_through(self, tracking_module):
         """An explicit ``COMFY_USER_AGENT`` label reaches the provider verbatim
@@ -167,6 +168,88 @@ def test_oversized_label_is_capped_on_the_wire(self, tracking_module):
         assert len(properties["caller_kind"]) == tracking_module._CALLER_KIND_MAX_LEN
 
 
+class TestFeedbackCallerKindIsNarrowed:
+    """``feedback_submitted`` is the one send path that is NOT gated on passive
+    consent — an explicit user action, suppressed only by the hard env opt-out.
+    Attaching an arbitrary, environment-derived free-text label to the very path
+    where a user has declined passive telemetry is more than the analytics
+    question needs, so a custom ``COMFY_USER_AGENT`` collapses to ``"custom"``
+    there. The four intrinsic kinds still answer "human or agent?" exactly.
+    """
+
+    def test_custom_label_becomes_custom_on_the_feedback_path(self, tracking_module):
+        with patch.object(tracking_module, "_caller_kind", "acme-harness/2.1"):
+            tracking_module.submit_feedback("nice tool")
+        _, _, properties = _last_track_call(tracking_module.provider)
+        assert properties["caller_kind"] == "custom"
+        assert "acme-harness" not in str(properties)
+
+    def test_intrinsic_kinds_survive_on_the_feedback_path(self, tracking_module):
+        for kind in ("user", "pipe", "agent", "claude-code"):
+            with patch.object(tracking_module, "_caller_kind", kind):
+                tracking_module.submit_feedback("nice tool")
+            _, _, properties = _last_track_call(tracking_module.provider)
+            assert properties["caller_kind"] == kind
+
+    def test_consent_gated_paths_keep_the_full_label(self, tracking_module):
+        """The narrowing is scoped to the unconsented path: passive telemetry
+        (which the user opted into) keeps the self-attribution label, which is
+        the whole point of COMFY_USER_AGENT."""
+        tracking_module.config_manager.set(constants.CONFIG_KEY_ENABLE_TRACKING, "True")
+        with patch.object(tracking_module, "_caller_kind", "acme-harness/2.1"):
+            tracking_module.track_event("some_event")
+            _, _, properties = _last_track_call(tracking_module.provider)
+            assert properties["caller_kind"] == "acme-harness/2.1"
+
+            tracking_module.submit_agent_review("went fine")
+            _, _, properties = _last_track_call(tracking_module.provider)
+            assert properties["caller_kind"] == "acme-harness/2.1"
+
+
+class TestScrubValueStripsUrlCredentials:
+    """``_scrub_value`` is the shared credential strip for anything shipped as a
+    telemetry property — command kwargs and, via ``_sanitize_caller_kind``, the
+    ``caller_kind`` on every event."""
+
+    def test_query_string_and_fragment_go(self, tracking_module):
+        assert tracking_module._scrub_value("https://civitai.com/api/x?token=s3cret") == "https://civitai.com/api/x"
+        assert tracking_module._scrub_value("https://h.example/a#tok") == "https://h.example/a"
+
+    def test_userinfo_goes(self, tracking_module):
+        """`scheme://user:pass@host` puts a basic-auth password in the
+        authority, which stripping the query alone leaves entirely intact."""
+        assert (
+            tracking_module._scrub_value("https://svc:s3cret@harness.example/agent") == "https://harness.example/agent"
+        )
+        assert tracking_module._scrub_value("http://tok@h.example") == "http://h.example"
+
+    def test_userinfo_goes_for_non_http_schemes_too(self, tracking_module):
+        """A credential rides the userinfo slot of ftp/ssh/redis just as easily
+        as http's; the strip only ever removes those components, so it is safe
+        to apply to any `<scheme>://` value."""
+        assert tracking_module._scrub_value("ssh://git:key@github.com/o/r") == "ssh://github.com/o/r"
+        assert tracking_module._scrub_value("redis://u:p@localhost:6379/0") == "redis://localhost:6379/0"
+
+    def test_at_inside_userinfo_uses_the_last_delimiter(self, tracking_module):
+        assert tracking_module._scrub_value("https://a@b:c@host.example/p") == "https://host.example/p"
+
+    def test_a_custom_user_agent_url_ships_no_secret(self, tracking_module):
+        """The end-to-end property: a harness that self-attributes with a
+        service URL must not ship its own basic-auth password to the providers
+        on every single event."""
+        sanitized = tracking_module._sanitize_caller_kind("https://svc:s3cret@harness.example/agent")
+        assert "s3cret" not in sanitized
+        assert sanitized == "https://harness.example/agent"
+
+    def test_non_url_values_are_untouched(self, tracking_module):
+        for value in ("claude-code", "my-harness/1.2", "/home/alice/wf.json", "C:\\Users\\alice", "", "a?b#c"):
+            assert tracking_module._scrub_value(value) == value
+
+    def test_non_string_values_are_untouched(self, tracking_module):
+        for value in (None, 7, True, ["https://a?b"], {"k": "v"}):
+            assert tracking_module._scrub_value(value) == value
+
+
 class TestSubmitFeedback:
     def test_sends_even_when_passive_consent_disabled(self, tracking_module):
         # Feedback is explicit/user-initiated: it ignores the passive-telemetry
@@ -269,7 +352,7 @@ def test_feedback_does_not_persist_user_id_without_consent(monkeypatch):
 
     sent = {}
     monkeypatch.setattr(tracking, "_telemetry_disabled_by_env", lambda: False)
-    monkeypatch.setattr(tracking, "_dispatch", lambda name, props, *, distinct_id: sent.update(id=distinct_id))
+    monkeypatch.setattr(tracking, "_dispatch", lambda name, props, *, distinct_id, **kw: sent.update(id=distinct_id))
     # Consent declined; no persisted user_id; in-memory user_id empty.
     monkeypatch.setattr(tracking.config_manager, "get_bool", lambda k: False)
     persisted = {}
@@ -287,7 +370,7 @@ def test_feedback_persists_user_id_with_consent(monkeypatch):
 
     sent = {}
     monkeypatch.setattr(tracking, "_telemetry_disabled_by_env", lambda: False)
-    monkeypatch.setattr(tracking, "_dispatch", lambda name, props, *, distinct_id: sent.update(id=distinct_id))
+    monkeypatch.setattr(tracking, "_dispatch", lambda name, props, *, distinct_id, **kw: sent.update(id=distinct_id))
     monkeypatch.setattr(tracking.config_manager, "get_bool", lambda k: True)  # consent ON
     persisted = {}
     monkeypatch.setattr(tracking.config_manager, "set", lambda k, v: persisted.update({k: v}))
@@ -827,3 +910,44 @@ def test_either_var_alone_is_sufficient(self, tracking_module, monkeypatch):
         monkeypatch.delenv("COMFY_NO_TELEMETRY")
         monkeypatch.setenv("DO_NOT_TRACK", "1")
         assert tm._telemetry_disabled_by_env() is True
+
+
+class TestConsentPromptSurvivesUnusableStdio:
+    """``prompt_tracking_consent`` runs from the main Typer callback
+    (``cmdline.py``) on every invocation. Under ``pythonw`` / a detached parent,
+    ``sys.stdin`` or ``sys.stdout`` is ``None`` or closed, and a bare
+    ``.isatty()`` there raises before argument parsing — killing every command,
+    including ``--help``. Both probes go through ``caller.stream_is_tty``, so an
+    unusable stream reads as "non-interactive" (the correct answer: nobody is
+    there to consent) instead of raising.
+    """
+
+    def test_missing_stdout_does_not_raise(self, tracking_module):
+        with (
+            patch.object(tracking_module.sys, "stdout", None),
+            patch.object(tracking_module.ui, "prompt_confirm_action") as mock_prompt,
+        ):
+            tracking_module.prompt_tracking_consent()
+        mock_prompt.assert_not_called()
+        assert tracking_module.config_manager.get_bool(constants.CONFIG_KEY_ENABLE_TRACKING) is None
+
+    def test_missing_stdin_does_not_raise(self, tracking_module):
+        with (
+            patch.object(tracking_module.sys, "stdin", None),
+            patch.object(tracking_module.ui, "prompt_confirm_action") as mock_prompt,
+        ):
+            tracking_module.prompt_tracking_consent()
+        mock_prompt.assert_not_called()
+
+    def test_revoked_fd_stdio_does_not_raise(self, tracking_module):
+        class Revoked:
+            def isatty(self):
+                raise OSError(9, "Bad file descriptor")
+
+        with (
+            patch.object(tracking_module.sys, "stdin", Revoked()),
+            patch.object(tracking_module.sys, "stdout", Revoked()),
+            patch.object(tracking_module.ui, "prompt_confirm_action") as mock_prompt,
+        ):
+            tracking_module.prompt_tracking_consent()
+        mock_prompt.assert_not_called()

From 9fb821814692ef2660b37d9d80ac835c88c2f992 Mon Sep 17 00:00:00 2001
From: Matt Miller <mattmiller@comfy.org>
Date: Sat, 1 Aug 2026 20:21:18 -0700
Subject: [PATCH 4/4] fix(telemetry): close the scrub-ordering leak + bound the
 spend gate (BE-5633)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Third Cursor panel round, on the previous commit's own fixes. All eight
findings were valid — four of them defects this branch introduced.

Credential scrub (real leak, introduced in a273852):
- `_scrub_value` split the query/fragment off BEFORE the userinfo, and
  bounded the authority at the first `/`. Both assume a well-formed URL,
  and the values that worry us are the malformed ones: a password
  containing `?` stranded its first half in the output, and one
  containing `/` was returned verbatim, intact. base64-ish tokens
  routinely contain both. Userinfo now comes off first, on the last `@`
  in the whole remainder, so the credential's own contents can't move
  the cut point.

Startup crash-safety:
- The `getattr(stream, "isatty", None)` lookup sat OUTSIDE the try, and
  `getattr` with a default only swallows AttributeError — a proxy stream
  whose `isatty` is a property or `__getattr__` raising ValueError/OSError
  escaped a function contracted to never raise. Lookup moved inside.
- Resolving to JSON against a dead stdout only DEFERRED the crash to the
  first emit, after the command's side effects had landed. `_write_json_line`
  now no-ops on AttributeError/ValueError (stdout None or closed).
  `OSError` is deliberately still propagated: `comfy cloud login` depends
  on BrokenPipeError escaping the `login_url` emit to fail fast rather
  than block 300s, which the existing test pins. Guarding "no usable
  stream" must not become "ignore all I/O errors".
- `_maybe_nudge_setup` still had a bare `sys.stderr.isatty()`; stderr can
  be closed independently of stdout (`comfy install 2>&-`).

Caller kind:
- Narrowing the feedback label keyed on membership in the intrinsic set,
  but `COMFY_USER_AGENT=user` produces exactly that string — an agentic
  caller could pass itself off as a human. Now keyed on `source_env`,
  which is authoritative.

Node-name bounding:
- The spend gate (the more commonly hit branch, and `execute_cloud` with
  it) still passed raw names. Bounding moved inside `_spend_gate` so both
  call sites are covered, rather than leaving the docstring overclaiming.
- The 20-item cap was applied before de-duplication, so prefix-colliding
  names burned output slots and dropped later distinct ones. The cap is
  now on distinct truncated names.
- `and N more` conflated cap-drops with dedup-collapses, promising
  unlisted nodes that didn't exist. It now counts only what the cap omitted.

docs/json-output.md records the `spend_consent_required` contract change.
Full suite green (3793 passed, 37 skipped); ruff 0.15.15 clean.
---
 comfy_cli/caller.py                     | 11 +++-
 comfy_cli/cmdline.py                    |  7 ++-
 comfy_cli/command/run/__init__.py       | 68 +++++++++++++--------
 comfy_cli/output/renderer.py            | 27 ++++++++-
 comfy_cli/tracking.py                   | 43 +++++++++-----
 docs/json-output.md                     |  2 +-
 tests/comfy_cli/command/test_run.py     | 64 ++++++++++++++++++++
 tests/comfy_cli/output/test_caller.py   | 24 ++++++++
 tests/comfy_cli/output/test_renderer.py | 79 +++++++++++++++++++++++++
 tests/comfy_cli/test_tracking.py        | 59 ++++++++++++++++--
 10 files changed, 332 insertions(+), 52 deletions(-)

diff --git a/comfy_cli/caller.py b/comfy_cli/caller.py
index 1baf7bcb..de8ced46 100644
--- a/comfy_cli/caller.py
+++ b/comfy_cli/caller.py
@@ -67,10 +67,15 @@ def stream_is_tty(stream: object) -> bool:
     """
     if stream is None:
         return False
-    isatty = getattr(stream, "isatty", None)
-    if isatty is None:
-        return False
     try:
+        # The attribute LOOKUP is inside the try, not just the call: on a proxy
+        # or lazy wrapper stream, `isatty` can be a property or come from a
+        # `__getattr__`, either of which can raise. `getattr(..., None)` only
+        # swallows AttributeError, so a lookup that raised ValueError/OSError
+        # would escape a function whose whole contract is "never raises".
+        isatty = getattr(stream, "isatty", None)
+        if isatty is None:
+            return False
         return bool(isatty())
     except Exception:
         return False
diff --git a/comfy_cli/cmdline.py b/comfy_cli/cmdline.py
index 0eccad95..5b515bc0 100644
--- a/comfy_cli/cmdline.py
+++ b/comfy_cli/cmdline.py
@@ -12,6 +12,7 @@
 from comfy_cli import cancellation, constants, env_checker, logging, tracking, ui, utils
 from comfy_cli import where as where_module
 from comfy_cli.auth import command as auth_command
+from comfy_cli.caller import stream_is_tty
 from comfy_cli.cloud import command as cloud_command
 from comfy_cli.command import (
     code_search,
@@ -138,7 +139,11 @@ def _maybe_nudge_setup(ctx: typer.Context, renderer) -> None:
     install. Onboarding must never break a command — failures are swallowed.
     """
     sub = ctx.invoked_subcommand
-    if sub in (None, "setup") or not renderer.is_pretty() or not sys.stderr.isatty():
+    # Guarded stderr probe: this runs from the main Typer callback, and stderr
+    # can be closed independently of stdout (`comfy install 2>&-`, where CPython
+    # sets `sys.stderr = None`). A bare `.isatty()` there would kill the command
+    # from the onboarding nudge of all places. See `caller.stream_is_tty`.
+    if sub in (None, "setup") or not renderer.is_pretty() or not stream_is_tty(getattr(sys, "stderr", None)):
         return
     try:
         from comfy_cli.credentials import get_session
diff --git a/comfy_cli/command/run/__init__.py b/comfy_cli/command/run/__init__.py
index 22942943..88228c23 100644
--- a/comfy_cli/command/run/__init__.py
+++ b/comfy_cli/command/run/__init__.py
@@ -60,32 +60,41 @@
 _TELEMETRY_NODE_NAME_MAX_LEN = 64
 
 
-def _bounded_node_names(names: list[str]) -> list[str]:
+def _bounded_node_names(names: list[str]) -> tuple[list[str], int]:
     """Cap a partner-node name list in BOTH dimensions — element count and each
-    name's length — for every payload that leaves this process or reaches a
-    terminal.
-
-    Applies to the structured ``details`` of the credential error as well as to
-    the telemetry property and the prose message. Capping only the prose would
-    not actually bound anything: ``error_panel`` renders ``details`` as
-    ``key=value`` rows directly beneath the message in pretty mode, and JSON
-    mode serialises them, so an uncapped list there re-floods exactly the
-    output the caps exist to protect. The exact total is reported alongside as
-    ``partner_node_count``, so nothing is lost — a consumer still learns how
-    many nodes need a credential, and the remedy (log in) is identical whichever
-    ones they are.
+    name's length. Returns ``(shown, omitted)``.
+
+    Applies to every payload built from these names: the telemetry property,
+    the prose message, and the structured ``details`` of both the credential
+    error and the spend gate. Capping only the prose would bound nothing —
+    ``error_panel`` renders ``details`` as ``key=value`` rows directly beneath
+    the message in pretty mode, and JSON mode serialises them. The exact total
+    travels alongside as ``partner_node_count``, so nothing is lost: a consumer
+    still learns how many nodes are involved, and the remedy is identical
+    whichever ones they are.
 
     De-duplicates AFTER truncation, not before: ``_detect_partner_nodes``
-    returns distinct class_types, but two that share a 64-char prefix collapse
-    to the same string once truncated, which would list one name twice. The
-    list is meant to map one-to-one onto node classes.
+    returns distinct class_types, but two sharing a 64-char prefix collapse to
+    the same string once truncated, which would list one name twice.
+
+    Consumes input until the cap is filled with DISTINCT truncated names rather
+    than slicing the first 20 up front — otherwise a run of prefix-colliding
+    names burns output slots and silently drops later, genuinely distinct ones.
+
+    ``omitted`` counts only what the cap actually left behind, never what
+    de-duplication collapsed: a caller appending "and N more" must not claim
+    unlisted nodes that don't exist.
     """
-    out: list[str] = []
-    for name in names[:_TELEMETRY_NODE_LIST_CAP]:
+    shown: list[str] = []
+    consumed = 0
+    for name in names:
+        if len(shown) >= _TELEMETRY_NODE_LIST_CAP:
+            break
+        consumed += 1
         truncated = name[:_TELEMETRY_NODE_NAME_MAX_LEN]
-        if truncated not in out:
-            out.append(truncated)
-    return out
+        if truncated not in shown:
+            shown.append(truncated)
+    return shown, len(names) - consumed
 
 
 def _stdin_is_interactive() -> bool:
@@ -116,11 +125,18 @@ def _spend_gate(renderer, partner_nodes: list[str], allow_spend: bool, *, detail
     """
     if not partner_nodes or allow_spend:
         return
+    # Bound the names here rather than at each call site, so both `execute` and
+    # `execute_cloud` are covered: this gate runs on the same untrusted
+    # class_type strings and is the MORE commonly hit branch (it fires before
+    # any credential resolution), so leaving it unbounded would let a
+    # pathological graph flood the terminal and the JSON envelope anyway.
+    shown, omitted = _bounded_node_names(partner_nodes)
+    details = {**details, "partner_nodes": shown, "partner_node_count": len(partner_nodes)}
     if renderer.is_pretty() and _stdin_is_interactive():
         # Escape class_type names before interpolating into Rich markup: a name
         # containing markup like ``[bold]`` would otherwise be parsed as a tag
         # (MarkupError/StyleSyntaxError, or injected formatting).
-        names = ", ".join(_rich_escape(n) for n in partner_nodes)
+        names = ", ".join(_rich_escape(n) for n in shown) + (f", and {omitted} more" if omitted > 0 else "")
         pprint(f"[yellow]⚠ This workflow uses partner-API nodes that spend Comfy credits: {names}.[/yellow]")
         if not typer.confirm("Run anyway and spend credits?", default=False):
             renderer.error(
@@ -341,7 +357,7 @@ def execute(
         # class_type strings come verbatim from untrusted workflow JSON, so the
         # names are bounded before they ship. The count stays exact, so the cap
         # never distorts the metric.
-        bounded_nodes = _bounded_node_names(partner_nodes)
+        bounded_nodes, omitted_nodes = _bounded_node_names(partner_nodes)
         tracking.track_event(
             "partner_nodes_detected",
             {
@@ -358,8 +374,10 @@ def execute(
                 # wall of text, and `details` is rendered right below the message
                 # in pretty mode, so capping only one of them bounds nothing.
                 # `partner_node_count` carries the exact total for consumers.
-                overflow = len(partner_nodes) - len(bounded_nodes)
-                listed = ", ".join(bounded_nodes) + (f", and {overflow} more" if overflow > 0 else "")
+                # The suffix counts only what the CAP omitted — names collapsed
+                # by de-duplication are still listed, so counting them would
+                # promise unlisted nodes that don't exist.
+                listed = ", ".join(bounded_nodes) + (f", and {omitted_nodes} more" if omitted_nodes > 0 else "")
                 msg = (
                     "Workflow uses partner-API node(s) that need an `api_key_comfy_org` "
                     "credential the local server doesn't have: " + listed + "."
diff --git a/comfy_cli/output/renderer.py b/comfy_cli/output/renderer.py
index fcb6368e..25becea6 100644
--- a/comfy_cli/output/renderer.py
+++ b/comfy_cli/output/renderer.py
@@ -380,8 +380,31 @@ def _envelope(
 
     def _write_json_line(self, payload: Mapping[str, Any]) -> None:
         line = json.dumps(payload, default=_json_default, ensure_ascii=False)
-        self.machine_stream.write(line + "\n")
-        self.machine_stream.flush()
+        stream = self.machine_stream
+        try:
+            stream.write(line + "\n")
+            stream.flush()
+        except (AttributeError, ValueError):
+            # Resolving to JSON mode against an unusable stdout must not merely
+            # DEFER the crash to the first emit — by then the command has
+            # already run and its side effects have landed, so dying here is
+            # strictly worse than dying at startup. `machine_stream` falls back
+            # to `sys.stdout`, which under pythonw / a detached parent is
+            # `None` (AttributeError on `.write`) or an already-closed file
+            # (ValueError). Neither can ever receive output, so the write is a
+            # no-op and the process still exits with the right code.
+            #
+            # `OSError` is deliberately NOT caught, even though it looks like it
+            # belongs. A `BrokenPipeError` here means the stream was real and the
+            # reader hung up, which is load-bearing: `comfy cloud login` relies
+            # on it propagating out of the `login_url` emit so the command fails
+            # fast instead of blocking the full 300s on a browser callback nobody
+            # will read (see test_json_login_fails_fast_when_login_url_write_breaks).
+            # Swallowing it would turn that into a silent hang.
+            #
+            # `TypeError` is likewise not caught: it would mean the payload is
+            # malformed, which is our bug and must stay visible.
+            return
 
     @property
     def exit_code(self) -> int:
diff --git a/comfy_cli/tracking.py b/comfy_cli/tracking.py
index 7a334407..4a8d7508 100644
--- a/comfy_cli/tracking.py
+++ b/comfy_cli/tracking.py
@@ -137,14 +137,24 @@ def _scrub_value(value: object) -> object:
     """
     if not isinstance(value, str) or not _URL_SCHEME_RE.match(value):
         return value
-    stripped = value.partition("?")[0].partition("#")[0]
-    scheme, sep, rest = stripped.partition("://")
-    authority, slash, path = rest.partition("/")
-    if "@" in authority:
-        # rpartition: an `@` may legally appear inside the userinfo itself, so
-        # the LAST one is the true delimiter before the host.
-        authority = authority.rpartition("@")[2]
-    return f"{scheme}{sep}{authority}{slash}{path}"
+    scheme, sep, rest = value.partition("://")
+    # ORDER MATTERS: userinfo comes off FIRST, and on the last `@` in the whole
+    # remainder — before any path/query/fragment split.
+    #
+    # Splitting the query off first (or bounding the authority at the first
+    # `/`) assumes a well-formed URL, and the values that worry us are exactly
+    # the malformed ones. `https://svc:s3cr?et@host/agent` would strand the
+    # first half of the password in the result, and `https://svc:ab/cd@host/p`
+    # would return verbatim with the password intact — base64-ish tokens
+    # routinely contain `/` and `?`. Cutting at the last `@` first makes the
+    # credential's own contents irrelevant to where the cut lands.
+    #
+    # This errs toward removing too much: a legal-but-unusual path containing
+    # an unencoded `@` loses its leading segments. That is the correct bias for
+    # a scrub — the cost is analytics detail, the alternative is a leak.
+    rest = rest.rpartition("@")[2]
+    rest = rest.partition("?")[0].partition("#")[0]
+    return f"{scheme}{sep}{rest}"
 
 
 # The four intrinsic caller kinds are short and fixed, but COMFY_USER_AGENT lets
@@ -152,10 +162,6 @@ def _scrub_value(value: object) -> object:
 # ample for a self-attribution label ("claude-code", "my-harness/1.2").
 _CALLER_KIND_MAX_LEN = 64
 
-# The kinds detect_caller derives on its own, with no free text from the
-# environment. Anything else came from a COMFY_USER_AGENT label.
-_INTRINSIC_CALLER_KINDS = frozenset({"user", "pipe", "agent", "claude-code"})
-
 
 def _sanitize_caller_kind(kind: str) -> str:
     """Make the caller label safe to ship as a telemetry property.
@@ -183,11 +189,18 @@ def _sanitize_caller_kind(kind: str) -> str:
 # Who is driving this process: "user" | "pipe" | "agent" | "claude-code" | a
 # lowercased custom COMFY_USER_AGENT label. Computed once at import, matching
 # the cli_version/tracing_id pattern above, so we don't re-run isatty per event.
-_caller_kind = _sanitize_caller_kind(detect_caller().kind)
+_caller = detect_caller()
+_caller_kind = _sanitize_caller_kind(_caller.kind)
+# Whether that label is self-attributed free text rather than a kind the CLI
+# derived itself. Taken from `source_env`, which is authoritative, NOT from
+# membership in _INTRINSIC_CALLER_KINDS: `COMFY_USER_AGENT=user` produces the
+# string "user" while being exactly the self-attributed case, so a set-membership
+# test would let an agentic caller pass itself off as a human.
+_caller_kind_is_custom = _caller.source_env == "COMFY_USER_AGENT"
 
 
 def _intrinsic_caller_kind() -> str:
-    """``_caller_kind`` collapsed to one of the four kinds the CLI derives itself.
+    """``_caller_kind``, or ``"custom"`` when it is a self-attributed label.
 
     For the one send path the user has NOT consented to passively — feedback,
     which ships on an explicit user action and is suppressed only by the hard
@@ -196,7 +209,7 @@ def _intrinsic_caller_kind() -> str:
     as well by the closed set, so a custom ``COMFY_USER_AGENT`` collapses to
     the literal ``"custom"`` there rather than riding along verbatim.
     """
-    return _caller_kind if _caller_kind in _INTRINSIC_CALLER_KINDS else "custom"
+    return "custom" if _caller_kind_is_custom else _caller_kind
 
 
 workspace_manager = WorkspaceManager()
diff --git a/docs/json-output.md b/docs/json-output.md
index 72805b44..e7517682 100644
--- a/docs/json-output.md
+++ b/docs/json-output.md
@@ -373,7 +373,7 @@ registry test enforces this) and surfaced by `comfy discover`.
 | `connection_error`        | Server unreachable mid-flow: `URLError`, `TimeoutError`, or other `OSError` (including on `/object_info`) | —                       | 1 |
 | `workflow_unknown_nodes`  | Pre-submit validation found unknown class_types / shape mismatches              | `errors` (array), `warnings` (array)               | 1 |
 | `partner_node_requires_credential` | Workflow uses a partner-API node and no `api_key_comfy_org` credential is available | `partner_nodes` (array of str, capped at 20 entries × 64 chars each), `partner_node_count` (int, the exact total — read this, not `len(partner_nodes)`), `host`, `port` | 1 |
-| `spend_consent_required`  | Workflow embeds partner-API (paid) nodes and `--allow-spend` was not passed (machine mode) or interactive consent was declined; re-run with `--allow-spend`. Free (non-partner) workflows are unaffected. | `partner_nodes` (array of str); local path also carries `host`, `port`, the cloud path carries `where: "cloud"` | 1 |
+| `spend_consent_required`  | Workflow embeds partner-API (paid) nodes and `--allow-spend` was not passed (machine mode) or interactive consent was declined; re-run with `--allow-spend`. Free (non-partner) workflows are unaffected. | `partner_nodes` (array of str, capped at 20 entries × 64 chars each), `partner_node_count` (int, the exact total — read this, not `len(partner_nodes)`); local path also carries `host`, `port`, the cloud path carries `where: "cloud"` | 1 |
 | `prompt_rejected`         | Server returned HTTP 400 with `node_errors`                                     | `status` (400), `node_errors` (array — [shape](#node_errors-shape)) | 1 |
 | `client_error`            | Server returned another HTTP 4xx response                                       | `status` (int, 4xx), `body` (str)                  | 1 |
 | `server_error`            | Server returned an HTTP 5xx response                                            | `status` (int, 5xx), `body` (str)                  | 1 |
diff --git a/tests/comfy_cli/command/test_run.py b/tests/comfy_cli/command/test_run.py
index 710d43d0..6db2f53f 100644
--- a/tests/comfy_cli/command/test_run.py
+++ b/tests/comfy_cli/command/test_run.py
@@ -1515,6 +1515,70 @@ def test_names_are_deduplicated_after_truncation_not_before(self, tmp_path, monk
         # The count is over the real class_types, so it still says two.
         assert events[0]["partner_node_count"] == 2
 
+    def test_prefix_collisions_do_not_burn_output_slots(self, tmp_path, monkeypatch):
+        """Slicing the first 20 names up front would let a run of prefix-colliding
+        names consume the cap and silently drop later, genuinely distinct ones.
+        The cap is on DISTINCT truncated names, so all 20 slots carry signal."""
+        prefix = "C" * _TELEMETRY_NODE_NAME_MAX_LEN
+        # 25 names collapsing to one, then 20 distinct short ones.
+        names = [f"{prefix}{i:02d}" for i in range(25)] + [f"Distinct{i:02d}" for i in range(20)]
+        workflow = {str(i): {"class_type": n, "inputs": {}} for i, n in enumerate(names)}
+        object_info = {n: {"category": "image", "api_node": True} for n in names}
+        wf_file = self._wf_file(tmp_path, workflow)
+        self._no_credentials(monkeypatch)
+
+        with (
+            patch("comfy_cli.command.run.check_comfy_server_running", return_value=True),
+            patch("comfy_cli.command.run._fetch_object_info", return_value=object_info),
+            patch("comfy_cli.command.run.WorkflowExecution"),
+            patch("comfy_cli.tracking.track_event") as mock_track,
+        ):
+            with pytest.raises(typer.Exit):
+                execute(wf_file, host="127.0.0.1", port=8188, wait=True, timeout=30, allow_spend=True)
+
+        shipped = self._partner_events(mock_track)[0]["partner_nodes"]
+        assert len(shipped) == 20
+        assert len(set(shipped)) == 20
+        # The collapsed prefix takes exactly one slot; the other 19 are distinct
+        # names that a naive `names[:20]` slice would have thrown away.
+        assert shipped.count(prefix) == 1
+
+    def test_overflow_suffix_counts_only_what_the_cap_omitted(self, tmp_path, monkeypatch):
+        """`and N more` must not conflate entries dropped by the 20-item cap with
+        entries collapsed by de-duplication — with 20 or fewer nodes sharing a
+        prefix, nothing was omitted, so promising more nodes would be a lie."""
+        prefix = "D" * _TELEMETRY_NODE_NAME_MAX_LEN
+        names = [f"{prefix}{i:02d}" for i in range(5)]
+        workflow = {str(i): {"class_type": n, "inputs": {}} for i, n in enumerate(names)}
+        object_info = {n: {"category": "image", "api_node": True} for n in names}
+        wf_file = self._wf_file(tmp_path, workflow)
+        self._no_credentials(monkeypatch)
+
+        errors = []
+        from comfy_cli.output.renderer import Renderer
+
+        original_error = Renderer.error
+
+        def capture_error(self, *, code, message, hint=None, details=None, exit_code=1):
+            errors.append({"code": code, "message": message, "details": details})
+            return original_error(self, code=code, message=message, hint=hint, details=details, exit_code=exit_code)
+
+        monkeypatch.setattr(Renderer, "error", capture_error)
+
+        with (
+            patch("comfy_cli.command.run.check_comfy_server_running", return_value=True),
+            patch("comfy_cli.command.run._fetch_object_info", return_value=object_info),
+            patch("comfy_cli.command.run.WorkflowExecution"),
+            patch("comfy_cli.tracking.track_event"),
+        ):
+            with pytest.raises(typer.Exit):
+                execute(wf_file, host="127.0.0.1", port=8188, wait=True, timeout=30, allow_spend=True)
+
+        err = next(e for e in errors if e["code"] == "partner_node_requires_credential")
+        assert "more" not in err["message"]
+        assert err["details"]["partner_nodes"] == [prefix]
+        assert err["details"]["partner_node_count"] == 5
+
 
 class TestExecuteSpendGate:
     """`comfy run` gates partner-API (paid) workflows on `--allow-spend`
diff --git a/tests/comfy_cli/output/test_caller.py b/tests/comfy_cli/output/test_caller.py
index 9ecd25f3..48be89d3 100644
--- a/tests/comfy_cli/output/test_caller.py
+++ b/tests/comfy_cli/output/test_caller.py
@@ -160,3 +160,27 @@ def isatty(self):
         # Sanity: the probe IS reached once no env signal matches.
         assert detect_caller(env={}).kind == "pipe"
         assert probes == [1]
+
+    def test_a_raising_attribute_lookup_is_pipe(self, monkeypatch):
+        """The attribute LOOKUP can raise too, not just the call: on a proxy or
+        lazy wrapper `isatty` may be a property or come from `__getattr__`.
+        `getattr(..., None)` only swallows AttributeError, so the lookup has to
+        sit inside the try — otherwise a ValueError/OSError there escapes a
+        function whose entire contract is "never raises", and because
+        `comfy_cli.tracking` evaluates `detect_caller()` at import, that is an
+        import-time crash for every command."""
+
+        class RaisingProperty:
+            @property
+            def isatty(self):
+                raise ValueError("I/O operation on closed file")
+
+        monkeypatch.setattr(sys, "stdout", RaisingProperty())
+        assert detect_caller(env={}).kind == "pipe"
+
+        class RaisingGetattr:
+            def __getattr__(self, name):
+                raise OSError(9, "Bad file descriptor")
+
+        monkeypatch.setattr(sys, "stdout", RaisingGetattr())
+        assert detect_caller(env={}).kind == "pipe"
diff --git a/tests/comfy_cli/output/test_renderer.py b/tests/comfy_cli/output/test_renderer.py
index d3511d3b..12e53ed0 100644
--- a/tests/comfy_cli/output/test_renderer.py
+++ b/tests/comfy_cli/output/test_renderer.py
@@ -445,3 +445,82 @@ def isatty(self):
 
         monkeypatch.setattr(renderer_mod.sys, "stdout", Tty())
         assert Renderer.resolve(env={}).mode is OutputMode.PRETTY
+
+
+class TestWritesTolerateADeadMachineStream:
+    """Resolving to JSON mode against an unusable stdout must not merely DEFER
+    the crash to the first emit.
+
+    `machine_stream` falls back to `sys.stdout`, so surviving `resolve` only to
+    die inside `_write_json_line` is strictly worse than dying at startup: by
+    then the command has run and its side effects have landed. A stream that
+    cannot be written to cannot receive output, so the write is a no-op and the
+    process still exits with the right code.
+    """
+
+    def _dead_stdout_renderer(self, monkeypatch, stream):
+        import comfy_cli.output.renderer as renderer_mod
+
+        monkeypatch.setattr(renderer_mod.sys, "stdout", stream)
+        r = Renderer.resolve(env={})
+        assert r.mode is OutputMode.JSON
+        return r
+
+    def test_missing_stdout_emit_is_a_noop(self, monkeypatch):
+        r = self._dead_stdout_renderer(monkeypatch, None)
+        r.emit({"hello": "world"})  # must not raise
+        assert r.exit_code == 0
+
+    def test_missing_stdout_error_still_sets_the_exit_code(self, monkeypatch):
+        r = self._dead_stdout_renderer(monkeypatch, None)
+        r.error(code="server_not_running", message="nope", exit_code=1)
+        assert r.exit_code == 1
+
+    def test_closed_stdout_emit_is_a_noop(self, monkeypatch, tmp_path):
+        handle = open(tmp_path / "out.txt", "w")
+        handle.close()
+        r = self._dead_stdout_renderer(monkeypatch, handle)
+        r.error(code="server_not_running", message="nope", exit_code=1)
+        assert r.exit_code == 1
+
+    def test_broken_pipe_still_propagates(self, monkeypatch):
+        """`OSError` is deliberately excluded from the guard. A BrokenPipeError
+        means the stream was real and the reader hung up, and that has to keep
+        propagating: `comfy cloud login` depends on it escaping the `login_url`
+        emit to fail fast instead of blocking 300s on a browser callback nobody
+        will read (test_json_login_fails_fast_when_login_url_write_breaks).
+        Guarding "no usable stream" must not quietly become "ignore all I/O
+        errors"."""
+
+        class BrokenPipe:
+            def isatty(self):
+                return False
+
+            def write(self, _):
+                raise BrokenPipeError(32, "Broken pipe")
+
+            def flush(self):
+                pass
+
+        r = self._dead_stdout_renderer(monkeypatch, BrokenPipe())
+        with pytest.raises(BrokenPipeError):
+            r.emit({"hello": "world"})
+
+    def test_a_malformed_payload_still_surfaces(self, monkeypatch):
+        """The handler is deliberately narrower than `stream_is_tty`'s: a
+        TypeError from the write means our payload is wrong, which is a bug and
+        must stay visible rather than being silently swallowed."""
+
+        class Fussy:
+            def isatty(self):
+                return False
+
+            def write(self, _):
+                raise TypeError("not a string")
+
+            def flush(self):
+                pass
+
+        r = self._dead_stdout_renderer(monkeypatch, Fussy())
+        with pytest.raises(TypeError):
+            r.emit({"hello": "world"})
diff --git a/tests/comfy_cli/test_tracking.py b/tests/comfy_cli/test_tracking.py
index 18aad161..f455c1b7 100644
--- a/tests/comfy_cli/test_tracking.py
+++ b/tests/comfy_cli/test_tracking.py
@@ -177,26 +177,58 @@ class TestFeedbackCallerKindIsNarrowed:
     there. The four intrinsic kinds still answer "human or agent?" exactly.
     """
 
+    @staticmethod
+    def _as_caller(tracking_module, env):
+        """Patch the module-scope caller state as `detect_caller` would derive it
+        for *env*. Both values are computed once at import, so a test that sets
+        only one of them proves nothing about the real pairing."""
+        from comfy_cli.caller import detect_caller
+
+        caller = detect_caller(env=env, is_tty=True)
+        return (
+            patch.object(tracking_module, "_caller_kind", tracking_module._sanitize_caller_kind(caller.kind)),
+            patch.object(tracking_module, "_caller_kind_is_custom", caller.source_env == "COMFY_USER_AGENT"),
+        )
+
     def test_custom_label_becomes_custom_on_the_feedback_path(self, tracking_module):
-        with patch.object(tracking_module, "_caller_kind", "acme-harness/2.1"):
+        kind_patch, custom_patch = self._as_caller(tracking_module, {"COMFY_USER_AGENT": "Acme-Harness/2.1"})
+        with kind_patch, custom_patch:
             tracking_module.submit_feedback("nice tool")
         _, _, properties = _last_track_call(tracking_module.provider)
         assert properties["caller_kind"] == "custom"
         assert "acme-harness" not in str(properties)
 
     def test_intrinsic_kinds_survive_on_the_feedback_path(self, tracking_module):
-        for kind in ("user", "pipe", "agent", "claude-code"):
-            with patch.object(tracking_module, "_caller_kind", kind):
+        for env, expected in (
+            ({}, "user"),
+            ({"AI_AGENT": "1"}, "agent"),
+            ({"CLAUDECODE": "1"}, "claude-code"),
+        ):
+            kind_patch, custom_patch = self._as_caller(tracking_module, env)
+            with kind_patch, custom_patch:
+                tracking_module.submit_feedback("nice tool")
+            _, _, properties = _last_track_call(tracking_module.provider)
+            assert properties["caller_kind"] == expected
+
+    def test_a_label_spelling_an_intrinsic_kind_is_still_narrowed(self, tracking_module):
+        """`COMFY_USER_AGENT=user` produces the literal string "user" while being
+        exactly the self-attributed case. Deciding by membership in the intrinsic
+        set would let an agent pass itself off as a human here, so the decision
+        is made on `source_env`, which is authoritative."""
+        for label in ("user", "pipe", "agent", "claude-code"):
+            kind_patch, custom_patch = self._as_caller(tracking_module, {"COMFY_USER_AGENT": label})
+            with kind_patch, custom_patch:
                 tracking_module.submit_feedback("nice tool")
             _, _, properties = _last_track_call(tracking_module.provider)
-            assert properties["caller_kind"] == kind
+            assert properties["caller_kind"] == "custom", f"COMFY_USER_AGENT={label} bypassed the narrowing"
 
     def test_consent_gated_paths_keep_the_full_label(self, tracking_module):
         """The narrowing is scoped to the unconsented path: passive telemetry
         (which the user opted into) keeps the self-attribution label, which is
         the whole point of COMFY_USER_AGENT."""
         tracking_module.config_manager.set(constants.CONFIG_KEY_ENABLE_TRACKING, "True")
-        with patch.object(tracking_module, "_caller_kind", "acme-harness/2.1"):
+        kind_patch, custom_patch = self._as_caller(tracking_module, {"COMFY_USER_AGENT": "Acme-Harness/2.1"})
+        with kind_patch, custom_patch:
             tracking_module.track_event("some_event")
             _, _, properties = _last_track_call(tracking_module.provider)
             assert properties["caller_kind"] == "acme-harness/2.1"
@@ -233,6 +265,23 @@ def test_userinfo_goes_for_non_http_schemes_too(self, tracking_module):
     def test_at_inside_userinfo_uses_the_last_delimiter(self, tracking_module):
         assert tracking_module._scrub_value("https://a@b:c@host.example/p") == "https://host.example/p"
 
+    def test_credential_containing_url_punctuation_is_still_stripped(self, tracking_module):
+        """The ordering trap: if the query/fragment split ran first, or the
+        authority were bounded at the first `/`, a credential containing `?`,
+        `#` or `/` would move the cut point and strand part of the secret in the
+        result. base64-ish tokens routinely contain `/` and `+`."""
+        cases = [
+            "https://svc:s3cr?et@harness.example/agent",
+            "https://svc:ab/cd@harness.example/agent",
+            "https://svc:x#y@harness.example/agent",
+            "https://svc:a/b?c#d@harness.example/agent",
+        ]
+        for value in cases:
+            scrubbed = tracking_module._scrub_value(value)
+            assert scrubbed == "https://harness.example/agent", value
+            for secret in ("s3cr", "ab/cd", "x#y", "a/b"):
+                assert secret not in scrubbed, f"{secret!r} survived in {scrubbed!r} from {value!r}"
+
     def test_a_custom_user_agent_url_ships_no_secret(self, tracking_module):
         """The end-to-end property: a harness that self-attributes with a
         service URL must not ship its own basic-auth password to the providers