release: v6.7.1

[code-crusher]

Cut the v6.7.1 release.

Changes

• Organization usage metrics. OrbCode now reports metadata-only user-message events, model/version-aware accepted agent line counts, and newly observed Git commit line totals for AI-share, active-user, leaderboard, conversation, and client-version analytics. Git remotes are credential-sanitized, and prompt/file contents are never included.

Release flow

After this PR is merged into main, tag the merge commit and push the tag to trigger the publish workflow:

git checkout main && git pull
git tag v6.7.1
git push origin v6.7.1

See RELEASE.md for the full release process.

[matterai-app]

Summary By MatterAI

🔄 What Changed

This PR bumps the CLI version to v6.7.1 and introduces comprehensive Git metrics tracking. It adds utility functions in src/api/metrics.ts to detect repositories, normalize remote URLs securely without leaking credentials, observe descendant commits via git log, and report code metrics asynchronously to the MatterAI telemetry backend.

🔍 Impact of the Change

Enhances product observability by automatically capturing user coding activity, line changes, and commit metrics tied to active CLI sessions. Improves data privacy by sanitizing credentials from remote URLs before transmission.

📁 Total Files Changed

Click to Expand

File	ChangeLog
Version Bump package.json	Updated project version to 6.7.1 and registered new metrics test script.
Metrics API src/api/metrics.ts	Added Git remote normalization, commit observation, and telemetry reporting functions.
Agent Integration src/core/agent.ts	Integrated Git head tracking and background metrics reporting during agent turns and session lifecycle events.
Session Persistence src/core/sessions.ts	Added lastGitHead field to persist Git tracking state across resumed sessions.
Unit Tests test/metrics.test.ts	Added test suite verifying remote credential sanitization and descendant commit stat calculations.

🧪 Test Added/Recommended

Added

• test/metrics.test.ts: Verifies secure Git remote normalization (stripping user info/tokens) and accurate numstat calculations for observed descendant commits.

🔒 Security Vulnerabilities

• None detected. Git URLs are safely parsed and stripped of credentials before transmission.

[matterai-app]

🧪 PR Review is completed: Release v6.7.1 adds usage telemetry with git commit observation and usage event reporting. Main concern: detectGitRepo spawns a synchronous git subprocess on every call and is invoked redundantly throughout the agent lifecycle — up to 2× per tool call.

Skipped files

• CHANGELOG.md: Skipped file pattern

[matterai-app]

🟠 Performance

Issue: detectGitRepo(this.options.cwd) spawns a synchronous git config --get remote.origin.url subprocess, and is called redundantly in runTurn (line 650), observeCommittedCode (line 835, invoked after every tool execution at line 1288), and reportLineMetrics (line 1322). The repo URL is static for the lifetime of a session, so these are wasted subprocess spawns — up to 2 per tool call, potentially 20+ per turn.

Fix: Cache the result as a private field initialized once in the constructor, and replace all detectGitRepo(...) call sites with the cached value.

Impact: Eliminates up to 20+ synchronous git subprocess spawns per turn for a session with 10 tool calls, reducing event-loop blocking.

Suggested change

	this.lastGitHead =
	options.resume?.lastGitHead ??
	getPersistedGitHead(options.cwd) ??
	getGitHead(options.cwd)
	persistGitHead(options.cwd, this.lastGitHead)
	this.repo = detectGitRepo(options.cwd)
	this.lastGitHead =
	options.resume?.lastGitHead ??
	getPersistedGitHead(options.cwd) ??
	getGitHead(options.cwd)
	persistGitHead(options.cwd, this.lastGitHead)