Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(invariants): enforce runtime relationships

Browse Source
This commit is contained in:
Tianyi Cui
2026-07-20 23:16:08 +08:00
parent 023cde5d82
commit e92b34bd7e
22 changed files with 398 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
packages/sdk/telemetry/README.md
View File

@@ -10,8 +10,6 @@ Launcher-side telemetry primitives for the dsh-sdk toolchain. This is a plain li
| `getOrCreateAnonymousId` | Random UUID persisted in a per-user GLOBAL config file (never in the project, never derived from git). |
| `TelemetryReporter` | Fire-and-forget send: `report()` never blocks or throws; delivery resolves on every path; `flush()` optionally drains in-flight sends within a cap. |
The separately published `./invariant` diagnostic companion samples the security-critical redaction boundary: credential values must disappear, ordinary package metadata must survive, and a second redaction pass must be idempotent.
Consent is carried by the telemetry entry in `cordis.yml`, so disabling telemetry is disabling that entry. Telemetry reports by default and is off only when a present telemetry entry is explicitly `disabled`: a missing `cordis.yml` (first `create`), an enabled entry, or a `cordis.yml` with no telemetry entry all report. `DO_NOT_TRACK`/CI always deny. The no-config and absent-entry defaults are configurable on `ConsentResolver`.
The collection endpoint is a fixed constant (`DSH_TELEMETRY_ENDPOINT`); its `.invalid` placeholder must be replaced with the real endpoint before release.

27
packages/sdk/telemetry/src/redaction-contract.ts
View File

@@ -1,27 +0,0 @@
/** Structural redactor surface sampled by the telemetry invariant. */
export interface TelemetryRedactionBoundary {
/** Redact credential material in free-form telemetry content. */
redactText(value: string): string
}
/**
* Validate the security-critical telemetry redaction boundary.
* @param redactor - candidate content redactor.
* @param placeholder - expected replacement for a secret value.
* @param packageName - ordinary package metadata that must survive redaction.
* @returns the violated contract, or `undefined` when redaction is safe and idempotent.
*/
export function telemetryRedactionViolation(
redactor: TelemetryRedactionBoundary,
placeholder: string,
packageName: string,
): string | undefined {
const secret = 'sk-abcdefghij1234567890'
const redacted = redactor.redactText(`apiKey: ${secret}\nname: ${packageName}\n`)
return !redacted.includes(secret)
&& redacted.includes(`apiKey: ${placeholder}`)
&& redacted.includes(`name: ${packageName}`)
&& redactor.redactText(redacted) === redacted
? undefined
: 'telemetry redaction must remove credential values, preserve package metadata, and remain idempotent'
}

18
packages/sdk/telemetry/tests/redaction-contract.spec.ts
View File

@@ -1,18 +0,0 @@
import { describe, expect, it } from 'vitest'
import { SecretRedactor } from '../src/secret-redactor.ts'
import { telemetryRedactionViolation } from '../src/redaction-contract.ts'
describe('telemetryRedactionViolation', () => {
it('accepts the shipped redactor and rejects one that preserves credentials', () => {
expect(telemetryRedactionViolation(
new SecretRedactor(),
'[REDACTED]',
'@deepseek-ai/dsh-telemetry',
)).toBeUndefined()
expect(telemetryRedactionViolation(
{ redactText: value => value },
'[REDACTED]',
'@deepseek-ai/dsh-telemetry',
)).toBe('telemetry redaction must remove credential values, preserve package metadata, and remain idempotent')
})
})