Extension: implement VS Code telemetry signals (#17721)

[adamint]

Description

Implements the VS Code extension telemetry signals from #17721. Adds five categories of events plus a foundation for outcome/duration tracking, with a documented data-collection notice in the extension README. CLI-side telemetry signals listed in #17721 are intentionally out of scope for this PR and tracked separately.

Fixes #17721

What's included

Signal	Event(s)
S1 Meaningful engagement	engagement/active — once per session on first AppHost-detected / command / debug session trigger; common property apphost_languages is published once known
S2 Running AppHosts view shown	runningAppHostsView/shown — 1s-debounced hidden→visible transitions; view_mode property + running_apphosts / total_resources measurements
S3 Command palette commands	command/invoked — both tryExecuteCommand and bypass paths (~30 commands across editor / tree / code lens / walkthrough) routed through the new registerInstrumentedCommand helper with source, outcome (success / error / canceled), and duration_ms
S4 Debug / launch lifecycle	debug/runSession/{start,end} (per child resource) and debug/appHost/{start,end} (per AppHost). End event aggregates total_child_sessions, distinct_resource_type_count + names, ended_with_error, and duration_ms so we can see multi-language debugging at a glance
S5 Dashboard telemetry passthrough	Full /telemetry/* contract bridged to the extension's reporter, replacing the hardcoded /telemetry/enabled = false stub. Honors the global VS Code telemetry setting. Bearer-only auth middleware for routes the dashboard hits (it does not send the DCP instance-id header). Per-operation correlation Map with a 1h abandoned-op TTL.

Foundation work

• Singleton telemetry reporter accessor + sendTelemetryErrorEvent helper
• withCommandTelemetry wrapper records outcome and duration_ms; cancellation-aware so cancel errors don't show error toasts
• Common-properties merging (apphost_languages, apphost_present) attached automatically to every event
• summarizeAppHostLanguages(candidates) → csharp | typescript | polyglot | unknown | none classifier
• classifyAppHostPath(path) → csharp | typescript | unknown for the debug-session path
• Test seams (__setReporterForTests, __resetCommonPropertiesForTests) for unit tests

Privacy

The README's new "Data and telemetry" section enumerates every event category and explicitly documents that source code, file paths, env values, and resource names are not reported. All events are gated on VS Code's global telemetry.telemetryLevel setting via @vscode/extension-telemetry.

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes — 13 new unit tests for the telemetry + appHostLanguage helpers; full extension suite (yarn run test) passes with 635 tests
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No — TypeScript extension only; no .NET public API surface affected.
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No — happy to walk through if a reviewer wants. Notes below.
  • No

Security notes

• The new requireBearerOnly middleware on /telemetry/* routes still requires the DCP bearer token; it only relaxes the DCP-instance-id header requirement because the dashboard's HttpClient does not send it. The token is the same shared secret already used to gate every other DCP route.
• Dashboard telemetry payloads are forwarded through @vscode/extension-telemetry, which respects the global VS Code telemetry.telemetryLevel setting. The extension never logs or persists payloads outside the existing extension log output channel.
• Property flattening strips nested objects via JSON.stringify, but no per-event allow-list is enforced. Future work could add one if we observe the dashboard sending unexpectedly large or sensitive properties; current dashboard surface area is limited to its own structured AspireTelemetryProperty shape.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 17723

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 17723"

[github-actions]

Re-running the failed jobs in the CI workflow for this pull request because 1 job was identified as retry-safe transient failures in the CI run attempt.
GitHub was asked to rerun all failed jobs for that attempt, and the rerun is being tracked in the rerun attempt.
The job links below point to the failed attempt jobs that matched the retry-safe transient failure rules.

• Tests / Hosting-1 / Hosting-1 (windows-latest) - Job-level runner or infrastructure failure matched the transient allowlist.

[Copilot]

Pull request overview

Implements the next round of telemetry instrumentation in the Aspire VS Code extension, including meaningful engagement, view visibility, command outcome/duration tracking, debug lifecycle signals, and a dashboard telemetry passthrough bridge (with an explicit privacy notice in the extension README).

Changes:

• Adds a typed telemetry event/property registry and expands the telemetry utilities to support common properties plus command outcome/duration tracking.
• Instruments extension commands, view visibility, meaningful engagement triggers, and debug session lifecycle events.
• Implements the /telemetry/* HTTP contract for dashboard telemetry passthrough with bundling/scrubbing guardrails and adds extension unit/route-level tests.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
extension/src/views/AppHostsViewTelemetry.ts	Emits runningAppHostsView/shown on debounced hidden→visible transitions with counts/measurements.
extension/src/utils/telemetryRegistry.ts	Central registry of allowed event names and per-event property/measurement keys for classification control.
extension/src/utils/telemetry.ts	Adds common-property merging, enablement gating, error event helper, and withCommandTelemetry outcome/duration wrapper.
extension/src/utils/meaningfulEngagement.ts	Adds once-per-session engagement/active emission gated on AppHost detection/command/debug-session triggers.
extension/src/utils/appHostLanguage.ts	Adds AppHost language-family classifiers for telemetry (workspace and debug-path variants).
extension/src/test/telemetry.test.ts	Unit tests for telemetry utilities (common props merge, command outcome/duration, cancellation detection).
extension/src/test/dashboardTelemetryRoutes.test.ts	Route-level integration tests for dashboard→extension passthrough normalization and privacy guarantees.
extension/src/test/dashboardTelemetryPassthrough.test.ts	Unit tests for bundling/scrubbing/clamping and defensive parsing in passthrough helpers.
extension/src/test/appHostLanguage.test.ts	Unit tests for AppHost language summary and path/directory classification.
extension/src/extension.ts	Wires engagement reporter, adds command instrumentation wrapper, instruments many commands, and routes tryExecuteCommand through telemetry.
extension/src/debugger/AspireDebugSession.ts	Emits debug/appHost/start and delayed debug/appHost/end summary using DCP aggregate stats.
extension/src/dcp/DashboardTelemetryPassthrough.ts	Implements the full /telemetry/* dashboard contract, normalization, and privacy/scrubbing guardrails.
extension/src/dcp/AspireDcpServer.ts	Adds dashboard telemetry routes, tightens bearer parsing, emits debug/runSession/*, and hardens IDs with crypto.randomBytes.
extension/README.md	Documents telemetry collection categories and privacy posture/guarantees.