feat: add PostHog event tracking for SDK installs (ENG-2277)

[devin-ai-integration]

Summary

Adds lightweight PostHog event tracking to the Python SDK to fire an "Installed SDK" event once per new SDK version. Mirrors the existing Sentry pattern — no external PostHog library, uses httpx (already a dependency) for a raw HTTP POST to https://us.i.posthog.com/capture/.

How it works:

• track_sdk_installed() is called during autoload() (gated behind settings.tracking)
• Deduplicates via ~/.blaxel/telemetry.json — only fires once per SDK version
• Fire-and-forget on a daemon thread with 5s timeout; all exceptions silently swallowed
• __posthog_key__ placeholder in __init__.py is injected at build time via sed in CI (same pattern as __sentry_dsn__)
• Anonymous UUID v4 as distinct_id, persisted in telemetry.json

Review & Testing Checklist for Human

• Provision POSTHOG_KEY secret in the repo's release environment before the next release — without it, tracking is silently disabled (no build failure)
• Verify circular import safety: posthog.py does import blaxel inside _get_posthog_key() which is called from track_sdk_installed() during autoload(), itself called from blaxel.__init__. The lazy call timing should be safe (same pattern as settings.sentry_dsn), but worth a manual python -c "import blaxel.core" check
• Verify telemetry.json concurrent access is acceptable: no file lock is used when reading/writing the shared state file — concurrent CLI + SDK runs could race, but worst case is a duplicate event (matches existing CLI pattern)
• Test sed injection end-to-end: after CI runs, confirm __posthog_key__ in the built package is replaced with the actual key value

Notes

• httpx is already a core dependency — no new packages added
• telemetry.json is shared between CLI and all SDKs (Python, TypeScript) — the sdks.python key tracks the last reported Python SDK version
• Tracking is opt-in (settings.tracking defaults to False), consistent with the existing Sentry behavior

Link to Devin session: https://app.devin.ai/sessions/43a6073c1fe54dbfb87b42e3dc01db56
Requested by: @Grotoma

---

---

Note

Adds lightweight PostHog "Installed SDK" event tracking to the Python SDK. Uses httpx for a raw HTTP POST (no new dependencies), deduplicates via ~/.blaxel/telemetry.json, fires on a daemon thread, and injects the API key at build time via sed — mirroring the existing Sentry pattern.

^{Written by Mendral for commit 2cf9882.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.

[mendral-app]

LGTM

All three commits are clean. The TOCTOU fix and unknown-field preservation are both correctly implemented. No new issues.

_{Tag @mendral-app with feedback or questions. View session}