imccyu e674f4c20e fix(telemetry): withhold package.json when cordis.yml is absent ...

buildTelemetryPayload read the two reported files independently, so a
dsh-sdk command mistakenly run in an arbitrary non-SDK directory (no
cordis.yml, e.g. any unrelated repo) still uploaded that directory's
package.json — dependency names and metadata of a project that never
opted into the SDK toolchain. Gate the manifest on cordis.yml presence:
without the config the directory is not an SDK project and its manifest
is not ours to report. Consent semantics are unchanged.

2026-07-18 22:10:22 +08:00

3.3 KiB

Raw Blame History

View Raw