Harden diagnostic telemetry dimensions

Validate non-public diagnostic codes against the registry, bucket unknown categories, and bound retained telemetry dimensions deterministically.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: d6318e80-5da9-4858-a147-817e8692f10e

Author: TheLarkInn

common/changes/@rushstack/rush-reporter/copilot-reporter-telemetry-privacy_2026-08-28-03-20-00.json

@@ -2,7 +2,7 @@
   "changes": [
     {
       "packageName": "@rushstack/rush-reporter",
-      "comment": "Prevent non-public reporter events from contributing producer identities or other non-public values to telemetry aggregates.",
+      "comment": "Prevent non-public reporter events from contributing unvalidated or unbounded values to telemetry aggregates.",
       "type": "patch"
     }
   ],

common/reviews/api/rush-reporter.api.md

@@ -852,6 +852,8 @@ export interface IReporterPerformanceBudgets {
     readonly maxAiDetailedDiagnostics: number;
     readonly maxAiOutputBytes: number;
     readonly maxInteractiveRefreshHz: number;
+    readonly maxTelemetryDiagnosticCategories: number;
+    readonly maxTelemetryDiagnosticCodes: number;
     readonly maxWallTimeRegressionPercent: number;
 }
 

libraries/reporter/src/perf/PerformanceBudgets.ts

@@ -45,6 +45,18 @@ export interface IReporterPerformanceBudgets {
    * before summarizing the remainder. Defaults to `20`.
    */
   readonly maxAiDetailedDiagnostics: number;
+
+  /**
+   * The maximum number of distinct diagnostic codes retained in a telemetry
+   * aggregate. Defaults to `20`.
+   */
+  readonly maxTelemetryDiagnosticCodes: number;
+
+  /**
+   * The maximum number of diagnostic category buckets retained in a telemetry
+   * aggregate. Defaults to `20`.
+   */
+  readonly maxTelemetryDiagnosticCategories: number;
 }
 
 /**
@@ -68,7 +80,9 @@ export const REPORTER_PERFORMANCE_BUDGETS: IReporterPerformanceBudgets = {
   maxAdditionalPeakMemoryBytes: 32 * BYTES_PER_MIB,
   maxInteractiveRefreshHz: 10,
   maxAiOutputBytes: 64 * BYTES_PER_KIB,
-  maxAiDetailedDiagnostics: 20
+  maxAiDetailedDiagnostics: 20,
+  maxTelemetryDiagnosticCodes: 20,
+  maxTelemetryDiagnosticCategories: 20
 };
 
 /**

libraries/reporter/src/telemetry/TelemetrySubscriber.ts

@@ -5,8 +5,31 @@ import type { IReporterProtocolVersion } from '../events/ReporterProtocolVersion
 import type { IReporterEventEnvelope } from '../events/IReporterEventEnvelope';
 import type { IReporter } from '../manager/IReporter';
 import type { IOperationStatusChangedPayload } from '../lifecycle/LifecycleEvents';
+import {
+  isValidRushDiagnosticCode,
+  RUSH_DIAGNOSTIC_CODE_DEFINITIONS,
+  type IRushDiagnosticCodeDefinition
+} from '../diagnostics/RushDiagnosticCodeRegistry';
+import { REPORTER_PERFORMANCE_BUDGETS } from '../perf/PerformanceBudgets';
 import type { ITelemetryAggregate, TelemetryResult } from './TelemetryAggregate';
 
+const OTHER_DIAGNOSTIC_CATEGORY: 'other' = 'other';
+const KNOWN_DIAGNOSTIC_CATEGORIES: ReadonlySet<string> = new Set(
+  RUSH_DIAGNOSTIC_CODE_DEFINITIONS.map(
+    (definition: IRushDiagnosticCodeDefinition): string => definition.category
+  )
+);
+
+function compareDiagnosticCodeCandidates(
+  left: readonly [code: string, registered: boolean],
+  right: readonly [code: string, registered: boolean]
+): number {
+  if (left[1] !== right[1]) {
+    return left[1] ? -1 : 1;
+  }
+  return left[0] < right[0] ? -1 : left[0] > right[0] ? 1 : 0;
+}
+
 /**
  * Consumes canonical events and produces the allowlisted telemetry aggregate.
  *
@@ -29,13 +52,13 @@ export class TelemetrySubscriber {
   private _protocolVersion: IReporterProtocolVersion | undefined;
   private readonly _operationStatuses: Map<string, IOperationStatusChangedPayload['status']>;
   private readonly _diagnosticCategoryCounts: { [category: string]: number };
-  private readonly _diagnosticCodes: Set<string>;
+  private readonly _diagnosticCodes: Map<string, boolean>;
   private readonly _producerVersions: Set<string>;
 
   public constructor() {
     this._operationStatuses = new Map();
     this._diagnosticCategoryCounts = {};
-    this._diagnosticCodes = new Set();
+    this._diagnosticCodes = new Map();
     this._producerVersions = new Set();
   }
 
@@ -63,12 +86,17 @@ export class TelemetrySubscriber {
         code?: string;
         category?: string;
       };
-      if (payload.code !== undefined) {
-        this._diagnosticCodes.add(payload.code);
+      if (typeof payload.code === 'string' && isValidRushDiagnosticCode(payload.code)) {
+        const registeredDefinition: IRushDiagnosticCodeDefinition | undefined =
+          RUSH_DIAGNOSTIC_CODE_DEFINITIONS.find(
+            (definition: IRushDiagnosticCodeDefinition): boolean => definition.code === payload.code
+          );
+        if (isPublicEnvelope || registeredDefinition !== undefined) {
+          this._recordDiagnosticCode(payload.code, registeredDefinition !== undefined);
+        }
       }
-      if (payload.category !== undefined) {
-        this._diagnosticCategoryCounts[payload.category] =
-          (this._diagnosticCategoryCounts[payload.category] ?? 0) + 1;
+      if (typeof payload.category === 'string') {
+        this._recordDiagnosticCategory(payload.category);
       }
       return;
     }
@@ -170,7 +198,7 @@ export class TelemetrySubscriber {
       producerVersions: string[];
     } = {
       operationStatusCounts,
-      diagnosticCodes: [...this._diagnosticCodes].sort(),
+      diagnosticCodes: [...this._diagnosticCodes.keys()].sort(),
       diagnosticCategoryCounts: { ...this._diagnosticCategoryCounts },
       producerVersions: [...this._producerVersions].sort()
     };
@@ -196,6 +224,48 @@ export class TelemetrySubscriber {
 
     return aggregate;
   }
+
+  private _recordDiagnosticCode(code: string, registered: boolean): void {
+    const existingRegistration: boolean | undefined = this._diagnosticCodes.get(code);
+    if (existingRegistration !== undefined) {
+      if (registered && !existingRegistration) {
+        this._diagnosticCodes.set(code, true);
+      }
+      return;
+    }
+
+    if (this._diagnosticCodes.size < REPORTER_PERFORMANCE_BUDGETS.maxTelemetryDiagnosticCodes) {
+      this._diagnosticCodes.set(code, registered);
+      return;
+    }
+
+    let worstCandidate: readonly [code: string, registered: boolean] | undefined;
+    for (const candidate of this._diagnosticCodes) {
+      if (worstCandidate === undefined || compareDiagnosticCodeCandidates(candidate, worstCandidate) > 0) {
+        worstCandidate = candidate;
+      }
+    }
+
+    const newCandidate: readonly [code: string, registered: boolean] = [code, registered];
+    if (worstCandidate !== undefined && compareDiagnosticCodeCandidates(newCandidate, worstCandidate) < 0) {
+      this._diagnosticCodes.delete(worstCandidate[0]);
+      this._diagnosticCodes.set(code, registered);
+    }
+  }
+
+  private _recordDiagnosticCategory(category: string): void {
+    let safeCategory: string = KNOWN_DIAGNOSTIC_CATEGORIES.has(category)
+      ? category
+      : OTHER_DIAGNOSTIC_CATEGORY;
+    if (
+      this._diagnosticCategoryCounts[safeCategory] === undefined &&
+      Object.keys(this._diagnosticCategoryCounts).length >=
+        REPORTER_PERFORMANCE_BUDGETS.maxTelemetryDiagnosticCategories
+    ) {
+      safeCategory = OTHER_DIAGNOSTIC_CATEGORY;
+    }
+    this._diagnosticCategoryCounts[safeCategory] = (this._diagnosticCategoryCounts[safeCategory] ?? 0) + 1;
+  }
 }
 
 /**

libraries/reporter/src/test/Performance.test.ts

@@ -118,6 +118,8 @@ describe('reporter performance budgets', () => {
     expect(REPORTER_PERFORMANCE_BUDGETS.maxInteractiveRefreshHz).toBe(10);
     expect(REPORTER_PERFORMANCE_BUDGETS.maxAiOutputBytes).toBe(64 * 1024);
     expect(REPORTER_PERFORMANCE_BUDGETS.maxAiDetailedDiagnostics).toBe(20);
+    expect(REPORTER_PERFORMANCE_BUDGETS.maxTelemetryDiagnosticCodes).toBe(20);
+    expect(REPORTER_PERFORMANCE_BUDGETS.maxTelemetryDiagnosticCategories).toBe(20);
   });
 
   it('evaluates wall-time regression against the 3 percent budget', () => {

libraries/reporter/src/test/Telemetry.test.ts

@@ -5,6 +5,7 @@ import {
   TelemetrySubscriber,
   createTelemetryReporter,
   createBeforeLogAdapter,
+  REPORTER_PERFORMANCE_BUDGETS,
   TELEMETRY_AGGREGATE_KEYS,
   LifecycleEmitter,
   ReporterManager,
@@ -51,6 +52,25 @@ function rawInput(type: string, payload: unknown): IReporterEmitEventInput<unkno
   };
 }
 
+function foreignDiagnosticEnvelope(
+  sequence: number,
+  privacy: IReporterEventEnvelope<unknown>['privacy'],
+  payload: unknown
+): IReporterEventEnvelope<unknown> {
+  return {
+    protocolVersion: { major: 1, minor: 0 },
+    eventId: `foreign_${sequence}`,
+    sessionId: 'foreign-session',
+    sequence,
+    timestamp: '2026-08-28T00:00:00.000Z',
+    source: { packageName: '@foreign/reporter-plugin', packageVersion: '1.0.0' },
+    privacy,
+    required: true,
+    type: 'diagnosticEmitted',
+    payload
+  };
+}
+
 describe('TelemetrySubscriber', () => {
   it('produces an allowlisted aggregate from the event stream before reporter filtering', async () => {
     const telemetry: TelemetrySubscriber = new TelemetrySubscriber();
@@ -152,6 +172,174 @@ describe('TelemetrySubscriber', () => {
     }
   });
 
+  it('rejects hostile non-public diagnostic fields from foreign envelopes', async () => {
+    const TOKEN_CODE: string = 'ghp_super_secret_token';
+    const TOKEN_CATEGORY: string = 'token=super-secret-value';
+    const PATH_CODE: string = '/home/user/private/.npmrc';
+    const PATH_CATEGORY: string = 'C:\\Users\\private\\rush.json';
+    const telemetry: TelemetrySubscriber = new TelemetrySubscriber();
+    const manager: ReporterManager = new ReporterManager();
+    manager.addReporter(createTelemetryReporter(telemetry));
+    await manager.initializeAsync();
+
+    manager.ingestForeignEnvelope(
+      foreignDiagnosticEnvelope(1, 'local-sensitive', {
+        code: PATH_CODE,
+        category: TOKEN_CATEGORY
+      })
+    );
+    manager.ingestForeignEnvelope(
+      foreignDiagnosticEnvelope(2, 'secret', {
+        code: TOKEN_CODE,
+        category: PATH_CATEGORY
+      })
+    );
+    manager.ingestForeignEnvelope(
+      foreignDiagnosticEnvelope(3, 'local-sensitive', {
+        code: 'RUSH_OPERATION_FAILED',
+        category: 'operation'
+      })
+    );
+    manager.ingestForeignEnvelope(
+      foreignDiagnosticEnvelope(4, 'secret', {
+        code: 'RUSH_DEPENDENCY_TOOL_FAILED',
+        category: 'dependency-tool'
+      })
+    );
+    await manager.flushAsync();
+
+    const aggregate: ITelemetryAggregate = telemetry.buildAggregate();
+    expect(aggregate.diagnosticCodes).toEqual(['RUSH_DEPENDENCY_TOOL_FAILED', 'RUSH_OPERATION_FAILED']);
+    expect(aggregate.diagnosticCategoryCounts).toEqual({
+      other: 2,
+      operation: 1,
+      'dependency-tool': 1
+    });
+    const serialized: string = JSON.stringify(aggregate);
+    for (const forbidden of [TOKEN_CODE, TOKEN_CATEGORY, PATH_CODE, PATH_CATEGORY]) {
+      expect(serialized).not.toContain(forbidden);
+    }
+  });
+
+  it('preserves allowlisted diagnostics across mixed privacy ordering', async () => {
+    const telemetry: TelemetrySubscriber = new TelemetrySubscriber();
+    const manager: ReporterManager = new ReporterManager();
+    manager.addReporter(createTelemetryReporter(telemetry));
+    await manager.initializeAsync();
+
+    manager.ingestForeignEnvelope(
+      foreignDiagnosticEnvelope(1, 'secret', {
+        code: 'RUSH_DEPENDENCY_TOOL_FAILED',
+        category: 'dependency-tool'
+      })
+    );
+    manager.ingestForeignEnvelope(
+      foreignDiagnosticEnvelope(2, 'public', {
+        code: 'RUSH_OPERATION_FAILED',
+        category: 'operation'
+      })
+    );
+    manager.ingestForeignEnvelope(
+      foreignDiagnosticEnvelope(3, 'local-sensitive', {
+        code: 'RUSH_CONFIG_INVALID_JSON',
+        category: 'configuration'
+      })
+    );
+    manager.ingestForeignEnvelope(
+      foreignDiagnosticEnvelope(4, 'secret', {
+        code: 'RUSH_NOT_REGISTERED_PRIVATE',
+        category: 'future-private-category'
+      })
+    );
+    manager.ingestForeignEnvelope(
+      foreignDiagnosticEnvelope(5, 'public', {
+        code: 'RUSH_FUTURE_PUBLIC_CODE',
+        category: 'future-public-category'
+      })
+    );
+    await manager.flushAsync();
+
+    expect(telemetry.buildAggregate()).toMatchObject({
+      diagnosticCodes: [
+        'RUSH_CONFIG_INVALID_JSON',
+        'RUSH_DEPENDENCY_TOOL_FAILED',
+        'RUSH_FUTURE_PUBLIC_CODE',
+        'RUSH_OPERATION_FAILED'
+      ],
+      diagnosticCategoryCounts: {
+        configuration: 1,
+        'dependency-tool': 1,
+        operation: 1,
+        other: 2
+      }
+    });
+  });
+
+  it('bounds diagnostic dimensions deterministically under cardinality flooding', async () => {
+    const publicCodes: string[] = [];
+    for (
+      let index: number = 0;
+      index < REPORTER_PERFORMANCE_BUDGETS.maxTelemetryDiagnosticCodes * 3;
+      index++
+    ) {
+      publicCodes.push(`RUSH_FOREIGN_CODE${String(index).padStart(3, '0')}`);
+    }
+    const hostilePrivateCodes: string[] = publicCodes.map((code: string): string => `${code}_PRIVATE`);
+    const payloads: Array<{
+      privacy: IReporterEventEnvelope<unknown>['privacy'];
+      code: string;
+      category: string;
+    }> = [
+      ...publicCodes.map((code: string, index: number) => ({
+        privacy: 'public' as const,
+        code,
+        category: `/private/category/${index}`
+      })),
+      ...hostilePrivateCodes.map((code: string, index: number) => ({
+        privacy: index % 2 === 0 ? ('local-sensitive' as const) : ('secret' as const),
+        code,
+        category: `token-${index}`
+      })),
+      { privacy: 'secret', code: 'RUSH_OPERATION_FAILED', category: 'operation' },
+      {
+        privacy: 'local-sensitive',
+        code: 'RUSH_DEPENDENCY_TOOL_FAILED',
+        category: 'dependency-tool'
+      }
+    ];
+
+    async function aggregatePayloads(orderedPayloads: typeof payloads): Promise<ITelemetryAggregate> {
+      const telemetry: TelemetrySubscriber = new TelemetrySubscriber();
+      const manager: ReporterManager = new ReporterManager();
+      manager.addReporter(createTelemetryReporter(telemetry));
+      await manager.initializeAsync();
+      orderedPayloads.forEach((payload, index: number) => {
+        manager.ingestForeignEnvelope(
+          foreignDiagnosticEnvelope(index + 1, payload.privacy, {
+            code: payload.code,
+            category: payload.category
+          })
+        );
+      });
+      await manager.flushAsync();
+      return telemetry.buildAggregate();
+    }
+
+    const forward: ITelemetryAggregate = await aggregatePayloads(payloads);
+    const reverse: ITelemetryAggregate = await aggregatePayloads([...payloads].reverse());
+    expect(reverse.diagnosticCodes).toEqual(forward.diagnosticCodes);
+    expect(forward.diagnosticCodes).toHaveLength(REPORTER_PERFORMANCE_BUDGETS.maxTelemetryDiagnosticCodes);
+    expect(forward.diagnosticCodes).toContain('RUSH_OPERATION_FAILED');
+    expect(forward.diagnosticCodes).toContain('RUSH_DEPENDENCY_TOOL_FAILED');
+    expect(forward.diagnosticCodes).not.toContain(hostilePrivateCodes[0]);
+    expect(forward.diagnosticCategoryCounts).toEqual({
+      other: publicCodes.length + hostilePrivateCodes.length,
+      operation: 1,
+      'dependency-tool': 1
+    });
+    expect(Object.keys(forward.diagnosticCategoryCounts)).toHaveLength(3);
+  });
+
   it('projects public envelopes while preserving allowlisted diagnostic fields deterministically', async () => {
     const PUBLIC_EXTENSION_SOURCE: IReporterEventSource = {
       packageName: '@rushstack/public-reporter-plugin',