slopbrick 0.21.2 → 0.24.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +72 -0
- package/dist/engine/worker.cjs +1532 -72
- package/dist/engine/worker.js +1532 -72
- package/dist/index.cjs +1826 -33
- package/dist/index.js +1822 -30
- package/package.json +5 -2
package/README.md
CHANGED
|
@@ -106,6 +106,78 @@ For per-rule precision/recall/FPR (auditable), see
|
|
|
106
106
|
|
|
107
107
|
---
|
|
108
108
|
|
|
109
|
+
## Telemetry (opt-in)
|
|
110
|
+
|
|
111
|
+
Starting in **v0.24.0**, slopbrick can send a single one-shot usage
|
|
112
|
+
ping after `slopbrick scan` completes. This is **opt-in** — the
|
|
113
|
+
default is OFF — and is intended for the v9 corpus build script
|
|
114
|
+
and self-hosted CI.
|
|
115
|
+
|
|
116
|
+
### How to opt in
|
|
117
|
+
|
|
118
|
+
```bash
|
|
119
|
+
# 1. Set the endpoint env var
|
|
120
|
+
export SLOPBRICK_TELEMETRY_ENDPOINT="https://your-host.example/ingest"
|
|
121
|
+
|
|
122
|
+
# 2. Pass the flag on the CLI
|
|
123
|
+
slopbrick scan --report-usage
|
|
124
|
+
```
|
|
125
|
+
|
|
126
|
+
Both conditions are required. If either is missing, no request
|
|
127
|
+
is sent, no warning is printed, and exit code is unaffected.
|
|
128
|
+
|
|
129
|
+
### What is sent
|
|
130
|
+
|
|
131
|
+
A single POST with `Content-Type: application/json` and exactly
|
|
132
|
+
**8 fields**:
|
|
133
|
+
|
|
134
|
+
| Field | Type | Example | Source |
|
|
135
|
+
|-------|------|---------|--------|
|
|
136
|
+
| `schema_version` | string | `"1"` | constant |
|
|
137
|
+
| `slopbrick_version` | string | `"0.24.0"` | `package.json` |
|
|
138
|
+
| `scan_id` | string (UUID v4) | `"f47ac10b-…"` | generated per run |
|
|
139
|
+
| `file_count` | int | `42` | `results.length` |
|
|
140
|
+
| `rule_count` | int | `95` | `builtinRules.length` |
|
|
141
|
+
| `duration_ms` | int | `1834` | wall-clock scan time |
|
|
142
|
+
| `platform` | string | `"darwin"` | `process.platform` |
|
|
143
|
+
| `node_version` | string | `"v20.11.0"` | `process.version` |
|
|
144
|
+
|
|
145
|
+
### Privacy promise
|
|
146
|
+
|
|
147
|
+
The payload is **frozen** at exactly 8 fields. We will never send:
|
|
148
|
+
|
|
149
|
+
- file paths, file hashes, or file contents
|
|
150
|
+
- rule ids, rule violations, or rule categories
|
|
151
|
+
- user identifiers, IP addresses, or environment variables
|
|
152
|
+
- timestamps other than what `process.version` provides indirectly
|
|
153
|
+
|
|
154
|
+
### Failure mode
|
|
155
|
+
|
|
156
|
+
The beacon is **fire-and-forget** with a 5-second socket timeout.
|
|
157
|
+
Network errors, DNS failures, 4xx/5xx responses, and timeouts are
|
|
158
|
+
all silent — `slopbrick scan` exit code is never affected. The
|
|
159
|
+
request is also unidirectional: no retries, no follow-up calls.
|
|
160
|
+
|
|
161
|
+
### Scope
|
|
162
|
+
|
|
163
|
+
Only `slopbrick scan` fires the beacon. `slopbrick watch`,
|
|
164
|
+
`slopbrick ci`, and programmatic `scanProject` calls are
|
|
165
|
+
unaffected regardless of the flag or env var.
|
|
166
|
+
|
|
167
|
+
### Local flywheel
|
|
168
|
+
|
|
169
|
+
This is separate from the local flywheel. The local flywheel
|
|
170
|
+
writes detailed scan results to `.slopbrick/flywheel/scans.jsonl`
|
|
171
|
+
and is gated by `--no-telemetry` (default ON, opt-out per-run
|
|
172
|
+
or via `config.telemetry = false`). The new beacon is gated by
|
|
173
|
+
`--report-usage` + `SLOPBRICK_TELEMETRY_ENDPOINT` (default OFF).
|
|
174
|
+
|
|
175
|
+
See [`docs/research/beacon-design.md`](./docs/research/beacon-design.md)
|
|
176
|
+
for the full design doc, threat model, and OPSEC requirements
|
|
177
|
+
for the receiver.
|
|
178
|
+
|
|
179
|
+
---
|
|
180
|
+
|
|
109
181
|
## Example output
|
|
110
182
|
|
|
111
183
|
```text
|