fix(cli): preserve model download diagnostics

[cursor]

Summary

• replace bare model-download SystemExit(1) paths with stable CliDiagnosticExit categories
• keep detailed local console errors while preventing customer-specific error text from entering telemetry
• cover diagnostic classification and the full command-failure telemetry path

The daily export contained three current-version models download failures across three devices, including a non-agent invocation; all were recorded only as error 1. No matching change exists on main or in the open PRs.

Verification

• TOGETHER_TELEMETRY_DISABLED=1 uv run pytest tests/cli/test_command_telemetry.py tests/cli/test_beta_models.py -n 0 (42 passed)
• TOGETHER_TELEMETRY_DISABLED=1 ./scripts/lint

  

[broly-code-security-scanner]

Broly Security Scan

Caution

⚠️ 3 file(s) not yet AI-analyzed — re-analysis in progress, this comment will update

Note

Summary

6 actionable finding(s) in this PR

• 🟠 6 high

All actionable items are in the table below.

Severity	Scanner	Issue	Location	Dismiss	Verdict
🟠 HIGH	SAST	Weak hash (MD5)	tests/cli/test_beta_models.py:59	d1	⚠️ Not verified
🟠 HIGH	SAST	Weak hash (MD5)	tests/cli/test_beta_models.py:708	d2	⚠️ Not verified
🟠 HIGH	SAST	Weak hash (MD5)	tests/cli/test_beta_models.py:721	d3	⚠️ Not verified
🟠 HIGH	SAST	Weak hash (MD5)	tests/cli/test_beta_models.py:770	d4	⚠️ Not verified
🟠 HIGH	SAST	Weak hash (MD5)	tests/cli/test_beta_models.py:815	d5	⚠️ Not verified
🟠 HIGH	SAST	Path concatenation	src/together/lib/cli/api/beta/models/download.py:153	d6	⚠️ Not verified

Dismiss false positives

Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.

• d1 · 🟠 HIGH     · tests/cli/test_beta_models.py:59 · Weak hash (MD5)
• d2 · 🟠 HIGH     · tests/cli/test_beta_models.py:708 · Weak hash (MD5)
• d3 · 🟠 HIGH     · tests/cli/test_beta_models.py:721 · Weak hash (MD5)
• d4 · 🟠 HIGH     · tests/cli/test_beta_models.py:770 · Weak hash (MD5)
• d5 · 🟠 HIGH     · tests/cli/test_beta_models.py:815 · Weak hash (MD5)
• d6 · 🟠 HIGH     · src/together/lib/cli/api/beta/models/download.py:153 · Path concatenation

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.3-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Exploit Chains · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.