fix(cli): omit values from unknown command telemetry

[cursor]

Summary

• keep only the unresolved subcommand when Cyclopts cannot resolve a command chain
• prevent positional and short-option argument values from entering the telemetry command field
• cover ordinary, positional-only, quoted, and beta unknown-command invocations plus the full CLI lifecycle

The daily CLI failure export exposed an unknown root command whose telemetry command field contained its complete invocation. The fallback parser previously collected every token until a long option, so short options and positional values were misclassified as command names. No matching fix exists on main or in open PRs.

Verification

• TOGETHER_TELEMETRY_DISABLED=1 .venv/bin/pytest tests/unit/test_cli_telemetry.py tests/cli/test_command_telemetry.py -n 0 (50 passed)
• PATH="$HOME/.local/bin:$PATH" ./scripts/lint
• broader CLI suite: 512 passed; 6 subprocess-only JSON tests could not run because this environment has no mock API server on 127.0.0.1:4010

  

[broly-code-security-scanner]

Broly Security Scan

Warning

⚠️ Potential results — Broly is still completing analysis or verification. This comment will update automatically.
Files pending AI analysis: 3; findings pending verification: 0.

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.3-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Exploit Chains · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.