feat: 馃毀 opt-in telemetry endpoint for the AI plugin - #5180
Draft
sorensensig wants to merge 3 commits into
Draft
Conversation
|
7 tasks
POST /api/plugin-telemetry accepts the aggregate the plugin's /ds-telemetry command builds, validated against a strict allowlist: any unknown field rejects the request, so the endpoint cannot be talked into storing code, prompts or paths. No cookies, no auth; 32KB body cap; accepted aggregates go to the application log as one JSON line. Storage/dashboarding is a follow-up decision. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
sorensensig
force-pushed
the
feat/ai-telemetry-endpoint
branch
from
August 13, 2026 10:25
01b91f8 to
9f21b21
Compare
Review findings: 'period' was allowlisted but never validated (arbitrary nested content passed), row string fields had no length caps (one query field could carry the whole 32KB), rows accepted arrays and empty objects, and the body cap measured UTF-16 length rather than bytes. Every field now has a per-field validator (bounded strings, bounded integer counts, real booleans), rows require their identifying field, and the cap checks Content-Length first and encoded bytes after. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #5166 (AI-readiness), the receiving side of the plugin's opt-in telemetry. Independent of the twin-registry stack: branches off main and can merge in any order.
POST /api/plugin-telemetry, a resource route following the/api/consentpattern/ds-telemetrycommand builds: install id, plugin version, lookup counts (which contracts agents fetch and whether they were found), guard-denial countsplugin-telemetry:JSON line; storage or a dashboard is deliberately a follow-up decision for the team馃毀 Draft: the plugin only gains a send step once this endpoint's final URL exists, so the two land in either order but activate together.
Checks
pnpm changesetif relevant): not relevant, www app route only馃 Generated with Claude Code