Harden reporter telemetry privacy projection

common/changes/@rushstack/rush-reporter/copilot-reporter-telemetry-privacy_2026-08-28-03-20-00.json

@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-reporter",
+      "comment": "Prevent non-public reporter events from contributing unvalidated or unbounded values to telemetry aggregates, protect parent-owned producer and protocol metadata, and preserve the original five-field performance budget contract.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-reporter",
+  "email": "TheLarkInn@users.noreply.github.com"
+}

common/changes/@rushstack/rush-reporter/review-r4-followup_2026-09-11-19-24.json

@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-reporter",
+      "comment": "Bound individual telemetry diagnostic codes without truncation and exclude secret diagnostic codes and categories from aggregates.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-reporter",
+  "email": "TheLarkInn@users.noreply.github.com"
+}

common/reviews/api/rush-reporter.api.md

@@ -901,6 +901,14 @@ export interface IReporterSelectionInput {
     readonly isTTY: boolean;
 }
 
+// @beta
+export interface IReporterTelemetryLimits {
+    readonly maxTelemetryDiagnosticCategories: number;
+    readonly maxTelemetryDiagnosticCodes: number;
+    readonly maxTelemetryProducerVersionLength: number;
+    readonly maxTelemetryProducerVersions: number;
+}
+
 // @beta
 export interface IResolveExitStatusFromEventsOptions {
     readonly cancelled?: boolean;
@@ -1340,7 +1348,7 @@ export const REPORTER_MIGRATION_PHASES: readonly IReporterMigrationPhase[];
 export const REPORTER_PACKAGE_NAME: '@rushstack/rush-reporter';
 
 // @beta
-export const REPORTER_PERFORMANCE_BUDGETS: IReporterPerformanceBudgets;
+export const REPORTER_PERFORMANCE_BUDGETS: IReporterPerformanceBudgets & IReporterTelemetryLimits;
 
 // @beta
 export const REPORTER_PROTOCOL_LIMITS: IReporterProtocolLimits;

libraries/reporter/src/index.ts

@@ -327,7 +327,7 @@ export {
   parseReporterExtensionEventName
 } from './producers/ReporterExtensionEventName';
 
-export type { IReporterPerformanceBudgets } from './perf/PerformanceBudgets';
+export type { IReporterPerformanceBudgets, IReporterTelemetryLimits } from './perf/PerformanceBudgets';
 export {
   REPORTER_PERFORMANCE_BUDGETS,
   computeWallTimeRegressionPercent,

libraries/reporter/src/perf/PerformanceBudgets.ts

@@ -47,6 +47,38 @@ export interface IReporterPerformanceBudgets {
   readonly maxAiDetailedDiagnostics: number;
 }
 
+/**
+ * The capacity limits applied when reporter events are projected into telemetry
+ * aggregates.
+ *
+ * @beta
+ */
+export interface IReporterTelemetryLimits {
+  /**
+   * The maximum number of distinct diagnostic codes retained in a telemetry
+   * aggregate. Defaults to `20`.
+   */
+  readonly maxTelemetryDiagnosticCodes: number;
+
+  /**
+   * The maximum number of diagnostic category buckets retained in a telemetry
+   * aggregate. Defaults to `20`.
+   */
+  readonly maxTelemetryDiagnosticCategories: number;
+
+  /**
+   * The maximum number of distinct producer versions retained in a telemetry
+   * aggregate. Defaults to `20`.
+   */
+  readonly maxTelemetryProducerVersions: number;
+
+  /**
+   * The maximum character length of one `packageName@packageVersion` telemetry
+   * entry. Longer entries are omitted. Defaults to `256`.
+   */
+  readonly maxTelemetryProducerVersionLength: number;
+}
+
 /**
  * One mebibyte, in bytes.
  */
@@ -63,12 +95,16 @@ const BYTES_PER_KIB: number = 1024;
  *
  * @beta
  */
-export const REPORTER_PERFORMANCE_BUDGETS: IReporterPerformanceBudgets = {
+export const REPORTER_PERFORMANCE_BUDGETS: IReporterPerformanceBudgets & IReporterTelemetryLimits = {
   maxWallTimeRegressionPercent: 3,
   maxAdditionalPeakMemoryBytes: 32 * BYTES_PER_MIB,
   maxInteractiveRefreshHz: 10,
   maxAiOutputBytes: 64 * BYTES_PER_KIB,
-  maxAiDetailedDiagnostics: 20
+  maxAiDetailedDiagnostics: 20,
+  maxTelemetryDiagnosticCodes: 20,
+  maxTelemetryDiagnosticCategories: 20,
+  maxTelemetryProducerVersions: 20,
+  maxTelemetryProducerVersionLength: 256
 };
 
 /**

libraries/reporter/src/telemetry/TelemetryAggregate.ts

@@ -47,12 +47,20 @@ export interface ITelemetryAggregate {
   readonly operationStatusCounts: { readonly [status: string]: number };
 
   /**
-   * The distinct diagnostic codes emitted, sorted.
+   * The distinct diagnostic codes admitted by telemetry, sorted.
+   *
+   * @remarks
+   * Codes from effectively public diagnostics and registered codes from
+   * local-sensitive envelopes are eligible. Secret envelopes contribute no
+   * values. Codes over 256 characters are omitted, not truncated, and the
+   * number retained is bounded by the reporter telemetry budgets.
    */
   readonly diagnosticCodes: readonly string[];
 
   /**
-   * The number of diagnostics emitted in each category.
+   * The number of eligible diagnostics in each category. Local-sensitive
+   * diagnostics contribute only their registered code's category; secret
+   * envelopes never contribute.
    */
   readonly diagnosticCategoryCounts: { readonly [category: string]: number };
 
@@ -67,7 +75,14 @@ export interface ITelemetryAggregate {
   readonly protocolVersion?: IReporterProtocolVersion;
 
   /**
-   * The distinct `packageName@packageVersion` producers observed, sorted.
+   * The distinct `packageName@packageVersion` producers observed on effectively
+   * public envelopes, sorted.
+   *
+   * @remarks
+   * The list is bounded by the reporter telemetry budgets. Parent-session
+   * producers are retained before child-session producers, remaining entries
+   * are selected lexicographically, and entries over the per-entry length
+   * budget are omitted. Package namespace text does not confer priority.
    */
   readonly producerVersions: readonly string[];
 }