@indigoai-us/hq-cloud 6.14.0 → 6.14.2

package/src/skill-telemetry.ts

@@ -55,6 +55,7 @@
  * swallowed so telemetry never aborts or delays a sync.
  */
 
+import { createHash } from "node:crypto";
 import { promises as fs } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -62,6 +63,7 @@ import * as path from "node:path";
 import {
   buildRepoCompanyMap,
   resolveCompanyForCwd,
+  resolveCompanyForSkill,
   type RepoCompanyMap,
 } from "./company-resolver.js";
 import type {
@@ -100,6 +102,16 @@ export interface CollectSkillTelemetryOptions {
   cursorPath?: string;
   /** Override `~/.hq/menubar.json` (the offline opt-in fallback) for tests. */
   menubarPath?: string;
+  /**
+   * Override skillVersion resolution (skills-first-class US-015). Given a skill
+   * name, return its content-hash version marker (`sha256:<hex>`) or undefined.
+   * Defaults to hashing `<hqRoot>/.claude/skills/<skill>/SKILL.md` via
+   * {@link computeSkillVersion}. Injected in tests to decouple emission from the
+   * on-disk skills tree.
+   */
+  resolveSkillVersion?: (
+    skill: string,
+  ) => Promise<string | undefined> | string | undefined;
   /** Diagnostic sink. No-op by default. */
   log?: (msg: string) => void;
 }
@@ -123,6 +135,15 @@ export interface SkillEvent {
   uuid?: string;
   cwd?: string;
   hasArgs: boolean;
+  /**
+   * Content-version marker (skills-first-class US-015) — the sha256 of the
+   * skill's SKILL.md, `sha256:<hex>`. The version half of the analytics-v2 usage
+   * join key (`skill_uid` + `skillVersion`), so a run maps to the version that
+   * produced it. Resolved + stamped at capture (see `computeSkillVersion` +
+   * `collectAndSendSkillTelemetry`); OPTIONAL — absent when the SKILL.md can't
+   * be located, and additive on the wire (old clients/rows simply omit it).
+   */
+  skillVersion?: string;
 }
 
 // Privacy switch — keep false (see file header). When false, raw argument text
@@ -348,6 +369,25 @@ export function extractCodexSkillEvents(
 const CODEX_SKILL_FILE =
   /(?:^|\/)skills\/(?:[^/\s'"]+\/)*?([^/\s'"]+)\/SKILL\.md\b/;
 
+/** A company skill read via its REAL path `companies/<slug>/skills/<name>/
+ *  SKILL.md`. Codex loads a skill by *reading* its file, and a company skill's
+ *  real file lives under `companies/<slug>/skills/` — so, unlike the namespaced
+ *  `.claude/skills/<slug>:<name>/` symlink (whose captured directory already
+ *  carries the `<slug>:` prefix), this path names the owning company in a
+ *  SEPARATE `<slug>` segment that {@link CODEX_SKILL_FILE} discards, leaving a
+ *  bare `<name>` that no prefix-based attribution can place (the company view
+ *  then misses the run). Group 1 = `<slug>`, group 2 = `<name>`: we rebuild the
+ *  canonical `<slug>:<name>` invocation token from them so the event flows
+ *  through the SAME attribution as every other runtime — the client
+ *  `resolveCompanyForSkill` and the server rollup both key off that `<slug>:`
+ *  prefix — and shares one `skill_uid` with the Claude/typed forms. The slug
+ *  segment excludes `:` (a real company slug has none); skill discovery is one
+ *  level deep, so `<name>` is a single segment. The leading boundary admits a
+ *  RELATIVE `companies/…` path too (preceded by whitespace/quote/start, not just
+ *  `/`), since Codex often reads it relative to the run cwd. */
+const CODEX_COMPANY_SKILL_FILE =
+  /(?:^|[\s/'"])companies\/([^/\s'":]+)\/skills\/([^/\s'"]+)\/SKILL\.md\b/;
+
 /** Pull the shell command string out of a Codex `exec_command_end` `command`,
  *  which is `["/bin/zsh", "-lc", "<cmd>"]` (array) on the runtimes we see, but
  *  tolerate a bare string too. */
@@ -500,7 +540,13 @@ export function extractCodexSkillToolEvents(
   if (cls === "nonread") return [];
   if (cls === "unknown" && !CODEX_READ_VERB.test(cmd)) return [];
 
-  const skill = m[1].trim();
+  // Prefer the canonical `<slug>:<name>` token when the read is of a company
+  // skill's real file (`companies/<slug>/skills/<name>/SKILL.md`) — the slug is
+  // in the path but dropped by CODEX_SKILL_FILE, so reconstruct it here to keep
+  // the run attributable. Otherwise keep the last-segment name (core/personal/
+  // namespaced skills already carry their prefix in the captured directory).
+  const co = CODEX_COMPANY_SKILL_FILE.exec(cmd);
+  const skill = co ? `${co[1]}:${co[2]}` : m[1].trim();
   if (!skill) return [];
 
   const sessionId = ctx.sessionId;
@@ -541,6 +587,55 @@ export function extractCodexSkillToolEvents(
   ];
 }
 
+/**
+ * Resolve a skill's content-version marker ("skillVersion", skills-first-class
+ * US-015) — the sha256 of its SKILL.md as `sha256:<hex>` (the canonical
+ * content-hash shape used across hq-cloud, e.g. `watcher.ts`). This is the
+ * version half of the analytics-v2 usage join key (`skill_uid` + `skillVersion`),
+ * so a captured run maps to the exact version that produced it.
+ *
+ * Resolution is best-effort against `<hqRoot>/.claude/skills/<skill>/SKILL.md` —
+ * the canonical single-source skills location, which holds an entry (a real dir
+ * or a symlink) for every skill by its FULL invocation name incl. namespace
+ * (`indigo:hello-world`, `personal:worktree`, `deploy`, …). A `.agents/skills/`
+ * fallback covers the Codex bridge layout. `readFile` follows symlinks, so a
+ * company/personal skill surfaced into `.claude/skills/` resolves transparently.
+ * Returns undefined when `hqRoot` is absent or the file can't be located/read,
+ * so the wire field is simply OMITTED — additive + backwards-compatible, exactly
+ * like the optional `companyUid` attribution.
+ *
+ * "At invocation time" is approximated by the SKILL.md's content AT CAPTURE TIME:
+ * the collector scans historical session logs during sync, so the file's current
+ * bytes are the closest available proxy for the version that ran. A skill edited
+ * between run and sync can differ — acceptable for a usage-rollup join key (the
+ * overwhelming majority of runs sync before any edit to the skill).
+ */
+export async function computeSkillVersion(
+  hqRoot: string | undefined,
+  skill: string,
+): Promise<string | undefined> {
+  if (!hqRoot || !skill) return undefined;
+  // A skill token maps to exactly one directory name here; reject anything that
+  // could escape the skills dir (path traversal / separators). Namespaced names
+  // use `:` (not a separator) and pass.
+  if (skill.includes("/") || skill.includes("\\") || skill.includes("..")) {
+    return undefined;
+  }
+  const candidates = [
+    path.join(hqRoot, ".claude", "skills", skill, "SKILL.md"),
+    path.join(hqRoot, ".agents", "skills", skill, "SKILL.md"),
+  ];
+  for (const candidate of candidates) {
+    try {
+      const bytes = await fs.readFile(candidate);
+      return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+    } catch {
+      // Not at this candidate — try the next.
+    }
+  }
+  return undefined;
+}
+
 /** Shape the event for the wire. Drops raw args unless explicitly enabled.
  *
  *  `companyUid` (US-002): the caller resolves the event's `cwd` → owning company
@@ -548,7 +643,11 @@ export function extractCodexSkillToolEvents(
  *  server's KEEP allowlist (`apps/hq-pro/src/vault-service/handlers/
  *  skill-invocations.ts`). When undefined (cwd maps to no company repo) the
  *  field is OMITTED — the server treats absence as unattributed/personal. The
- *  reserved value `unattributed` is never produced. */
+ *  reserved value `unattributed` is never produced.
+ *
+ *  `skillVersion` (US-015): the caller stamps `ev.skillVersion` from
+ *  `computeSkillVersion` before shaping; a `sha256:<hex>` marker (or omitted when
+ *  unresolved). Also on the server KEEP allowlist; additive + backwards-compatible. */
 function toWireRow(ev: SkillEvent, companyUid?: string): Record<string, unknown> {
   const row: Record<string, unknown> = {
     skill: ev.skill,
@@ -559,6 +658,7 @@ function toWireRow(ev: SkillEvent, companyUid?: string): Record<string, unknown>
   if (ev.timestamp !== undefined) row.timestamp = ev.timestamp;
   if (ev.uuid !== undefined) row.uuid = ev.uuid;
   if (ev.cwd !== undefined) row.cwd = ev.cwd;
+  if (ev.skillVersion !== undefined) row.skillVersion = ev.skillVersion;
   if (companyUid !== undefined) row.companyUid = companyUid;
   // INCLUDE_ARGS_PREVIEW is intentionally a compile-time constant `false`;
   // the guarded branch documents the (currently disabled) egress path.
@@ -754,7 +854,27 @@ export async function collectAndSendSkillTelemetry(
   // When `hqRoot` is omitted the map is empty → every event stays unattributed.
   const repoCompanyMap: RepoCompanyMap = opts.hqRoot
     ? await buildRepoCompanyMap(opts.hqRoot)
-    : { entries: [] };
+    : { entries: [], bySlug: new Map() };
+
+  // skillVersion resolution (US-015): resolve each skill's SKILL.md content hash
+  // ONCE per run (skills repeat across a session) and stamp it onto every event.
+  // Injectable for tests; defaults to hashing under hqRoot. Errors degrade to
+  // undefined so a resolver failure never blocks telemetry (additive field).
+  const resolveSkillVersion =
+    opts.resolveSkillVersion ??
+    ((skill: string) => computeSkillVersion(opts.hqRoot, skill));
+  const skillVersionCache = new Map<string, string | undefined>();
+  const skillVersionFor = async (skill: string): Promise<string | undefined> => {
+    if (skillVersionCache.has(skill)) return skillVersionCache.get(skill);
+    let version: string | undefined;
+    try {
+      version = await resolveSkillVersion(skill);
+    } catch {
+      version = undefined;
+    }
+    skillVersionCache.set(skill, version);
+    return version;
+  };
 
   // 1. Opt-in check — reuse the same gate as token telemetry.
   let enabled: boolean;
@@ -909,9 +1029,17 @@ export async function collectAndSendSkillTelemetry(
             continue;
           }
         }
-        // Resolve cwd → owning company (cmp_* uid) from the per-run map.
-        // Unresolved → undefined → companyUid omitted (unattributed/personal).
-        const companyUid = resolveCompanyForCwd(ev.cwd, repoCompanyMap);
+        // Attribute the event to a company (cmp_* uid) from the per-run map.
+        // A company SKILL (`<slug>:<skill>`) belongs to ITS company regardless of
+        // the cwd it ran in, so skill-based resolution takes precedence; a core
+        // skill falls back to the cwd's owning company. Unresolved by both →
+        // undefined → companyUid omitted (unattributed/personal).
+        const companyUid =
+          resolveCompanyForSkill(ev.skill, repoCompanyMap) ??
+          resolveCompanyForCwd(ev.cwd, repoCompanyMap);
+        // Stamp the skill's content-version marker (US-015). Unresolved → the
+        // field is omitted from the wire row (additive).
+        ev.skillVersion = await skillVersionFor(ev.skill);
         const wireRow = toWireRow(ev, companyUid);
         const wasOversized = jsonBytes(wireRow) > maxRowBytes;
         const bounded = boundRowForPost(wireRow, maxRowBytes);

package/src/sync/event-sync.ts

@@ -48,6 +48,11 @@ import {
 } from "./push-receiver.js";
 import { PushEventEmitter } from "../watcher.js";
 import type { TreeChangeBatch } from "../watcher.js";
+import {
+  emitCloudTelemetry,
+  type CloudTelemetryClient,
+  type TelemetryClaims,
+} from "../telemetry-events.js";
 import {
   createSyncLatencyMetricPublisher,
   type SyncMetricCredentials,
@@ -415,6 +420,8 @@ export interface StartEventSyncOptions {
   subscribe?: (deviceId: string) => Promise<SubscribeSyncResponse>;
   buildSqs?: (resp: SubscribeSyncResponse) => SqsClientLike;
   transport?: HttpPushTransport;
+  telemetryClient?: CloudTelemetryClient | null;
+  telemetryClaims?: TelemetryClaims | null;
   now?: () => number;
 }
 
@@ -473,6 +480,8 @@ export async function startEventSync(
         log(
           `event-sync: publish failed for ${ctx.relativePath ?? "?"}: ${err.message}`,
         ),
+      telemetryClient: opts.telemetryClient,
+      telemetryClaims: opts.telemetryClaims,
     });
 
     // ── receive leg (US-018) ──
@@ -515,6 +524,20 @@ export async function startEventSync(
     log(
       `event-sync: live (tenant=${tenantId} device=${deviceId} queue=${initial.queueUrl})`,
     );
+    void emitCloudTelemetry(
+      opts.telemetryClient,
+      {
+        eventName: "event_sync_live",
+        source: "event-sync",
+        properties: {
+          deviceId,
+          startupResult: "live",
+          receiveState: "enabled",
+          publishState: "enabled",
+        },
+      },
+      { claims: opts.telemetryClaims },
+    );
 
     return {
       publishBatch: (batch) => void emitter.emitForBatch(batch),
@@ -529,6 +552,20 @@ export async function startEventSync(
     log(
       `event-sync: startup failed, continuing poll-only: ${err instanceof Error ? err.message : String(err)}`,
     );
+    void emitCloudTelemetry(
+      opts.telemetryClient,
+      {
+        eventName: "event_sync_live",
+        source: "event-sync",
+        properties: {
+          deviceId: opts.deviceId,
+          startupResult: "poll_only",
+          receiveState: "disabled",
+          publishState: "disabled",
+        },
+      },
+      { claims: opts.telemetryClaims },
+    );
     return null;
   }
 }

package/src/sync/pull-scope.ts

@@ -18,6 +18,20 @@
  * The two surfaces drifting apart is exactly what caused the wedge, so the
  * resolver is defined ONCE here and consumed by both. Any future change to how
  * scope is derived now lands for the runner and the CLI in lockstep.
+ *
+ * SESSIONS ARE PUSH-ONLY (US-006). Session transcripts are pushed by clients
+ * into the company vault under `sessions/{personUid}/...`, but the sync engine
+ * NEVER auto-pulls that prefix onto grantee laptops — in EVERY sync mode,
+ * including `all` (which otherwise means a full-bucket pull) and an owner's
+ * role-wide scope. That never-pull contract is expressed HERE as
+ * `PullScope.excludePrefixes` (always carrying {@link SESSIONS_SCOPE_PREFIX}),
+ * NOT in `ignore.ts` (which only filters the push-side walk — sessions MUST
+ * still upload). A specific session is materialized on demand via `hq files
+ * get`, which pins the key so it survives scope-shrink pruning. The exclude set
+ * is subtracted from the pull's download filter but is deliberately NOT fed
+ * into scope-shrink, so a locally-authored (`direction:"up"`) or pinned
+ * on-demand-materialized session is never orphaned. See `computePullPlan`
+ * (subtraction) and `scope-shrink.ts` (retention).
  */
 import * as fs from "fs";
 import * as path from "path";
@@ -55,6 +69,41 @@ export interface PullScope {
   syncMode: SyncMode;
   /** Coalesced company-relative prefixes; omitted/undefined for `all`. */
   prefixSet?: string[];
+  /**
+   * Company-relative prefixes subtracted from the effective PULL scope in
+   * EVERY mode — the push-only set. Always carries {@link SESSIONS_SCOPE_PREFIX}
+   * (US-006): session transcripts are pushed into the vault but never
+   * auto-pulled onto grantee laptops, even under `all`/owner scope. A key is
+   * downloaded iff it is covered by the inclusion `prefixSet` (or `all`) AND
+   * NOT covered by any `excludePrefixes` entry. Distinct from `prefixSet` and
+   * deliberately NOT fed into scope-shrink, so a locally-authored or pinned
+   * on-demand-materialized session is never pruned. Stamped on every
+   * `resolvePullScope` return via {@link sessionsPushOnlyScope}.
+   */
+  excludePrefixes: string[];
+}
+
+/**
+ * Company-relative prefix under which session transcripts are pushed
+ * (`sessions/{personUid}/...`). Push-only by contract (US-006): a client
+ * uploads its own session transcripts here, but the sync engine NEVER
+ * auto-pulls this prefix onto grantee laptops — in ANY sync mode, including
+ * `all`. Materializing a specific session is an on-demand action (`hq files
+ * get`), which pins the key so it survives scope-shrink pruning.
+ */
+export const SESSIONS_SCOPE_PREFIX = "sessions/";
+
+/**
+ * Stamp the push-only session exclusion onto a resolved scope. Centralized so
+ * NO `resolvePullScope` return site can silently regress to a full session pull
+ * (the architect's flagged risk): the exclusion rides EVERY mode — `all`,
+ * owner→all, agent→all, config-all, shared, custom, and every degrade-to-`all`
+ * path — because each return is built through this helper.
+ */
+function sessionsPushOnlyScope(
+  scope: Omit<PullScope, "excludePrefixes">,
+): PullScope {
+  return { ...scope, excludePrefixes: [SESSIONS_SCOPE_PREFIX] };
 }
 
 /**
@@ -81,11 +130,11 @@ export async function resolvePullScope(
   // When omitted, pins are simply not unioned (no behavior change).
   hqRoot?: string,
 ): Promise<PullScope> {
-  if (!client.getMembershipSyncConfig) return { syncMode: "all" };
+  if (!client.getMembershipSyncConfig) return sessionsPushOnlyScope({ syncMode: "all" });
   try {
     const memberships = await client.listMyMemberships();
     const m = memberships.find((x) => x.companyUid === companyUid);
-    if (!m) return { syncMode: "all" };
+    if (!m) return sessionsPushOnlyScope({ syncMode: "all" });
     // OWNER role-bypass (feedback_67bdb8a4 / feedback_a46c3b37). An owner's
     // effective vault access is the WHOLE company by role — the data plane
     // resolves owner to `admin` on every key (`resolveEffectivePermission`'s
@@ -110,7 +159,7 @@ export async function resolvePullScope(
     // below — a member/guest's explicit grants ARE their full footprint, and a
     // (conditionally bypassed) admin stays grant-scoped so a company that set
     // `admin.viewOthersFiles=false` keeps its admins narrowed.
-    if (m.role === "owner") return { syncMode: "all" };
+    if (m.role === "owner") return sessionsPushOnlyScope({ syncMode: "all" });
     // Agent memberships (`agt_…#cmp_…`) belong to an agent identity that owns NO
     // person entity. hq-pro's per-membership sync-config endpoint sits behind an
     // up-front person-gate, so an agent caller is rejected with
@@ -124,9 +173,9 @@ export async function resolvePullScope(
     // 403 spam. (A server-side alternative would be to exempt sync-config from
     // the up-front person-gate and let its own `authorizeSyncConfigAccess`
     // handle agent ownership; tracked as a possible follow-up.)
-    if (m.membershipKey?.startsWith("agt_")) return { syncMode: "all" };
+    if (m.membershipKey?.startsWith("agt_")) return sessionsPushOnlyScope({ syncMode: "all" });
     const cfg = await client.getMembershipSyncConfig(m.membershipKey);
-    if (cfg.syncMode === "all") return { syncMode: "all" };
+    if (cfg.syncMode === "all") return sessionsPushOnlyScope({ syncMode: "all" });
 
     // Pins are company-relative prefixes a user explicitly materialized via
     // `hq files get`. They're unioned into the scope so a scoped pull keeps
@@ -143,15 +192,15 @@ export async function resolvePullScope(
       // `coalescePrefixes` (which drops empties) to "nothing", which would
       // prune the whole tree. An everything-scope is semantically `all`.
       if (customPrefixes.some((p) => p.prefix === "")) {
-        return { syncMode: "all" };
+        return sessionsPushOnlyScope({ syncMode: "all" });
       }
-      return {
+      return sessionsPushOnlyScope({
         syncMode: "custom",
         prefixSet: coalescePrefixes([
           ...customPrefixes,
           ...pinPrefixes.map(pathToScopePrefix),
         ]),
-      };
+      });
     }
     // shared: scope to the caller's explicit grants. Real grant paths are
     // inconsistent — full (`companies/<slug>/x/*`), slug-anchored
@@ -165,7 +214,7 @@ export async function resolvePullScope(
     // and scope-shrink would prune every clean local file. Degrade to `all`
     // instead. A genuinely-empty grant list (the method exists and returns
     // []) is a real "nothing shared with me" and is allowed to narrow.
-    if (!client.listMyExplicitGrants) return { syncMode: "all" };
+    if (!client.listMyExplicitGrants) return sessionsPushOnlyScope({ syncMode: "all" });
     const grants = await client.listMyExplicitGrants(companyUid);
     const sharedPrefixes = grants.map((g) =>
       grantPathToScopePrefix(g.path, slug),
@@ -174,18 +223,18 @@ export async function resolvePullScope(
     // `coalescePrefixes` drops empties (collapsing "everything" to "nothing"),
     // treat any such grant as full-access `all` rather than risk pruning.
     if (sharedPrefixes.some((p) => p.prefix === "")) {
-      return { syncMode: "all" };
+      return sessionsPushOnlyScope({ syncMode: "all" });
     }
-    return {
+    return sessionsPushOnlyScope({
       syncMode: "shared",
       prefixSet: coalescePrefixes([
         ...sharedPrefixes,
         ...pinPrefixes.map(pathToScopePrefix),
       ]),
-    };
+    });
   } catch {
     // Degrade to `all` — never prune on a resolution failure.
-    return { syncMode: "all" };
+    return sessionsPushOnlyScope({ syncMode: "all" });
   }
 }
 

package/src/telemetry-events.test.ts

@@ -0,0 +1,88 @@
+import { describe, expect, it, vi } from "vitest";
+
+import {
+  emitCloudTelemetry,
+  type CloudTelemetryClient,
+  type TelemetryEvent,
+} from "./telemetry-events.js";
+import type { TelemetryEventsBatch } from "./vault-client.js";
+
+describe("emitCloudTelemetry", () => {
+  it("is best-effort, stamps metadata, caps batches, and sanitizes properties", async () => {
+    const posts: TelemetryEventsBatch[] = [];
+    const client: CloudTelemetryClient = {
+      postTelemetryEvents: vi.fn(async (batch) => {
+        posts.push(batch);
+        throw new Error("vault unavailable");
+      }),
+    };
+    const logs: string[] = [];
+    const events: TelemetryEvent[] = Array.from({ length: 55 }, (_, i) => ({
+      eventName: `sync_completed_${i}`,
+      source: "hq-sync",
+      companyUid: "cmp_abc",
+      sessionId: "sync_123",
+      properties:
+        i === 0
+          ? ({
+              fileCount: 2,
+              result: "success",
+              companyUid: "cmp_abc",
+              labels: ["completed", "has spaces", "cmp_abc"],
+              path: "/Users/alice/company/secret.md",
+              filename: "secret.md",
+              secretToken: "tok_123",
+              message: "free text should not leave the process",
+              unsafeLabel: "contains spaces",
+              nanCount: Number.NaN,
+              enabled: true,
+              nested: { value: "nope" },
+              "bad-key": "nope",
+            } as unknown as TelemetryEvent["properties"])
+          : { fileCount: i },
+    }));
+
+    await expect(
+      emitCloudTelemetry(client, events, {
+        claims: {
+          "custom:entityType": "agent",
+          "custom:entityUid": "agt_runner",
+        },
+        timeoutMs: 25,
+        log: (message) => logs.push(message),
+      }),
+    ).resolves.toBeUndefined();
+
+    expect(client.postTelemetryEvents).toHaveBeenCalledTimes(1);
+    expect(client.postTelemetryEvents).toHaveBeenCalledWith(
+      { events: expect.any(Array) },
+      { timeoutMs: 25 },
+    );
+    expect(posts).toHaveLength(1);
+    expect(posts[0].events).toHaveLength(50);
+
+    const first = posts[0].events[0];
+    expect(first).toMatchObject({
+      eventName: "sync_completed_0",
+      app: "hq-cloud",
+      source: "hq-sync",
+      companyUid: "cmp_abc",
+      agentUid: "agt_runner",
+      sessionId: "sync_123",
+      schemaVersion: 1,
+      properties: {
+        fileCount: 2,
+        result: "success",
+        companyUid: "cmp_abc",
+        labels: ["completed", "cmp_abc"],
+      },
+    });
+    expect(Number.isNaN(Date.parse(first.occurredAt))).toBe(false);
+    expect(JSON.stringify(posts[0])).not.toContain("personUid");
+    expect(JSON.stringify(posts[0])).not.toContain("/Users/alice");
+    expect(JSON.stringify(posts[0])).not.toContain("secret.md");
+    expect(JSON.stringify(posts[0])).not.toContain("free text");
+    expect(JSON.stringify(posts[0])).not.toContain("tok_123");
+    expect(logs.join("\n")).toContain("postTelemetryEvents failed");
+  });
+});