chenchenandClaude Opus 4.8
2e37495133
Telemetry up-gating hardening (code portion of #32): - Context field whitelist: telemetry `context` is filtered to a small set of non-content diagnostic keys (route/retryable/phase/exit_code/duration_ms/ attempt) before persistence. Unknown keys — including potentially identifying ones (email, full file path, prompt, raw IP) — are dropped, so a client regression cannot land arbitrary JSON in the store. Empty/unparseable/no-allowed-key context is dropped to "". - Per-field size cap: stack_top and context are truncated to 8KiB after redaction (backstop against unbounded blobs within batch limits). - Retention: daily master-only task deletes telemetry rows older than HEICODE_TELEMETRY_RETENTION_DAYS (default 30; <=0 disables). HEICODE_TELEMETRY_RETENTION_INTERVAL_HOURS (default 24) sets cadence. model.DeleteTelemetryEventsBefore(cutoff) + controller.StartTelemetryRetentionTask() wired into main.go under IsMasterNode. - GET /api/heicode/config telemetry block now surfaces retention_days for client/admin transparency. Tests: whitelist drop/keep, size cap, redaction-within-allowed-key. go build/vet clean; controller telemetry tests pass. Affects: Manager only (telemetry ingest + retention). No billing/consume-log change (telemetry still never bills). Privacy-doc disclosure + production enable-checklist portions of #32 tracked in heicodeDocs sync (#34) / desktop client API docs (#35). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
32 lines
1.3 KiB
Go
32 lines
1.3 KiB
Go
package controller
|
|
|
|
import (
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"github.com/heicode/manager/common"
|
|
)
|
|
|
|
// HeicodeConfig: GET /api/heicode/config — client runtime config (issue #24).
|
|
//
|
|
// Dedicated config endpoint (client's chosen delivery, #24 §1) so kill switches
|
|
// propagate within a session WITHOUT re-login: the client polls this and obeys
|
|
// the latest telemetry.enabled / endpoint. Unauthenticated, non-sensitive global
|
|
// config — same posture as /api/heicode/capabilities; a natural home for future
|
|
// client config (feature flags, model-list pointer, …).
|
|
//
|
|
// telemetry.enabled defaults FALSE — telemetry stays off (the ingest endpoint
|
|
// also answers 410) until the privacy policy discloses account-linkable device
|
|
// IDs and ops flips HEICODE_TELEMETRY_ENABLED=true.
|
|
func HeicodeConfig(c *gin.Context) {
|
|
common.ApiSuccess(c, gin.H{
|
|
"telemetry": gin.H{
|
|
"enabled": common.GetEnvOrDefaultBool("HEICODE_TELEMETRY_ENABLED", false),
|
|
"endpoint": "/api/heicode/telemetry/events",
|
|
"max_batch": common.GetEnvOrDefault("HEICODE_TELEMETRY_MAX_BATCH", telemetryMaxBatch),
|
|
"flush_interval_sec": common.GetEnvOrDefault("HEICODE_TELEMETRY_FLUSH_INTERVAL_SEC", 30),
|
|
// Server retention window (#32): events older than this are purged.
|
|
"retention_days": telemetryRetentionDays(),
|
|
},
|
|
})
|
|
}
|