vaspera 2.15.0 → 2.16.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 2.16.0
+
+### Minor Changes
+
+- [#70](https://github.com/RCOLKITT/hardening-mcp/pull/70) [`d79820c`](https://github.com/RCOLKITT/hardening-mcp/commit/d79820cee28743a0dad7457b34ed3aa2a4def33e) Thanks [@RCOLKITT](https://github.com/RCOLKITT)! - Anonymous, opt-out usage telemetry
+
+  The CLI / MCP server now reports anonymous usage metrics — no source code, no
+  secrets, no file contents — so adoption can be measured and the product
+  improved. It is **opt-out**: a one-time first-run notice is shown, and it can be
+  disabled with `VASPERA_TELEMETRY_DISABLED=1` or the cross-tool standard
+  `DO_NOT_TRACK=1`. Events carry only an anonymous install id, a hashed project
+  path, version/platform, and aggregate result counts. Full disclosure in
+  `TELEMETRY.md`.
+
+  Also resolves high-severity transitive dependency advisories (undici, vite,
+  hono) surfaced by self-certification.
+
 ## 2.15.0
 
 ### Minor Changes

package/dist/index.js

@@ -62,7 +62,7 @@ import { applyProjectPathGuard } from "./tool-guard.js";
 import { finalizeCertificate, verifyCertificate, CertificateError, } from "./certification/agent-certificate.js";
 import { certificationToCertificateBody, baselineCertificateBody, } from "./certification/agent-certificate-map.js";
 // Telemetry and scan registry
-import { trackCertificationStarted, trackCertificationCompleted, trackScannerRun, } from "./telemetry/usage.js";
+import { telemetry, trackCertificationStarted, trackCertificationCompleted, trackScannerRun, } from "./telemetry/usage.js";
 import { getRegistry } from "./telemetry/registry.js";
 // False positive feedback
 import { submitFeedback, generateFeedbackReport, getSuppressionSuggestions, FP_REASON_DESCRIPTIONS, } from "./scanners/fp-feedback.js";
@@ -6778,6 +6778,15 @@ export { server, textResponse, jsonResponse, errorResponse };
 // ---------------------------------------------------------------------------
 async function main() {
     logger.info("server.starting", { version: "2.0.0" });
+    // Anonymous, opt-out usage telemetry. Initialized only here (real server
+    // boot) — never on imports from tests/scripts. See TELEMETRY.md.
+    telemetry.init({});
+    telemetry.showNotice();
+    const flushOnExit = () => {
+        void telemetry.shutdown().finally(() => process.exit(0));
+    };
+    process.once("SIGINT", flushOnExit);
+    process.once("SIGTERM", flushOnExit);
     const transport = new StdioServerTransport();
     await server.connect(transport);
     logger.info("server.started", { transport: "stdio" });