Document an agent-<name> convention for MAPBOX_CLI_INSTALL_SOURCE

CHANGELOG.md

@@ -23,6 +23,14 @@ that may never merge. They are not releases and are not listed here.
   the same `k1=v1&k2=v2` shape as a URL's own query string — for an API
   parameter this CLI's specs don't declare a flag for.
 
+- `install.sh`/`install.ps1` now document a convention for `MAPBOX_CLI_INSTALL_SOURCE`
+  when a coding agent invokes the installer on someone's behalf: `agent-<name>`
+  (`agent-claude-code`, `agent-cursor`), so an access-log query can tell those
+  installs apart from a human or CI one. A dash rather than the slash an
+  earlier proposal used — `/` is stripped by the installers' own sanitizer,
+  which would have collapsed `agent/claude-code` into `agentclaude-code` and
+  lost the separator. Comment-only: neither installer's behavior changed.
+
 ## 0.3.0 - 2026-09-22
 
 ### Added

scripts/install.ps1

@@ -91,6 +91,15 @@
     # provisioning script, CI - and it rides along as `src/<value>`.
     # Everything but letters, digits, dot, dash and underscore is dropped,
     # because this value comes from the environment and ends up in a header.
+    #
+    # Convention for a coding agent invoking this script on someone's behalf:
+    # agent-<name> - agent-claude-code, agent-cursor - so an access-log query
+    # can tell an agent-driven install from a human or CI one without a second
+    # reporting mechanism. A dash, not a slash: / is one of the characters the
+    # sanitizer below strips, so agent/claude-code would silently become
+    # agentclaude-code and lose the separator that makes the convention
+    # legible. Freeform otherwise, the same as every other value here - no
+    # fixed list of agent names to keep in sync.
     $InstallSource = $env:MAPBOX_CLI_INSTALL_SOURCE
 
     # The switch src/telemetry.rs honors for the CLI's own User-Agent, read

scripts/install.sh

@@ -74,6 +74,15 @@ USER_AGENT='mapbox-cli-install/1'
 # as `src/<value>`. Everything but letters, digits, dot, dash and underscore is
 # dropped, because this value comes from the environment and ends up in a
 # header.
+#
+# **Convention for a coding agent invoking this script on someone's behalf:**
+# `agent-<name>` — `agent-claude-code`, `agent-cursor` — so an access-log query
+# can tell an agent-driven install from a human or CI one without a second
+# reporting mechanism. A dash, not a slash: `/` is one of the characters the
+# sanitizer above strips, so `agent/claude-code` would silently become
+# `agentclaude-code` and lose the separator that makes the convention legible.
+# Freeform otherwise, the same as every other value here — no fixed list of
+# agent names to keep in sync.
 INSTALL_SOURCE="${MAPBOX_CLI_INSTALL_SOURCE:-}"
 
 # The switch `src/telemetry.rs` honors for the CLI's own User-Agent, read here