vscode telemetry: emit Aspire wire names without losing VS Code safeguards

[Adam Ratzman (adamint)]

Summary

• Emit extension events as aspire/vscode/* and dashboard passthrough events as fixed aspire/dashboard/* wire names.
• Keep VS Code's telemetry opt-in, privacy cleaning, common properties, telemetry output logging, and automatic exception handling by bridging the cleaned TelemetryLogger payload into the existing reporter transport.
• Preserve known dashboard event names without creating a telemetry entity per upstream event. Unknown names map to other, including near misses.
• Sanitize and bound every dashboard string before bundling it. String arrays remain arrays, and the final JSON stays parseable after VS Code's path and secret cleaning.
• Add the VS Code-provided common properties to telemetry.json.

The inner reporter no longer owns extension-host exceptions; the outer VS Code logger does. This avoids duplicate exception events while preserving the existing automatic exception path.

Testing

• VS Code 1.98.0 focused telemetry tests: 101 passed
• VS Code 1.129.1 focused telemetry tests: 101 passed
• VS Code 1.129.1 full extension suite: 1,226 passed, 1 pending
• corepack yarn run lint
• corepack yarn run package

The focused coverage includes exact wire names, telemetry-level gating, common-property forwarding, one-time automatic exceptions, structural string arrays, older shipped dashboard event names, and every VS Code 1.98 secret-pattern category.

Fixes #17844

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 18562

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 18562"

[Copilot]

Pull request overview

This PR removes the implicit microsoft-aspire.aspire-vscode/ extension‑id prefix that VS Code's TelemetryLogger prepends to every Aspire VS Code extension telemetry event, replacing it with two explicit dashboard‑native namespaces: extension events become aspire/vscode/<area>/<event> and dashboard passthrough events become aspire/dashboard/<route>. This aligns the extension's wire names with what other Aspire dashboard hosts (Visual Studio, C# Dev Kit) emit. The prefix is bypassed by routing all sends through sendDangerousTelemetryEvent / sendDangerousTelemetryErrorEvent, and because those "dangerous" APIs skip the reporter's built-in opt-in gate, the PR re-implements the gate explicitly via reporter.telemetryLevel.

Changes:

• Route all telemetry through the dangerous send APIs and add explicit telemetry-level gating ('all' for usage events; 'all'/'error' for error events; suppress at 'crash'/'off').
• Rename every registry event name, every production call site, and every telemetry.json classification key to the new aspire/vscode/... and aspire/dashboard/... wire names.
• Update all test fakes to expose telemetryLevel and record dangerous sends, and add pinning tests proving names emit unprefixed via the dangerous channel plus level-gating behavior.

Show a summary per file

File	Description
extension/src/utils/telemetry.ts	Adds dangerous-send routing, getCurrentTelemetryLevel(), and explicit usage/error gating
extension/src/utils/telemetryRegistry.ts	Renames event schema keys to final wire names; documents naming convention and known dashboard names
extension/telemetry.json	Renames all 22 classification entity keys to the new wire names
extension/src/extension.ts	Updates extension/activated call site to aspire/vscode/...
extension/src/utils/workspace.ts	Updates cli/availability call site
extension/src/utils/meaningfulEngagement.ts	Updates engagement/active call site
extension/src/utils/appHostDiscovery.ts	Updates apphost/discovery/result call site
extension/src/services/AppHostLaunchService.ts	Updates apphost/launch/result call sites and typed properties
extension/src/server/interactionService.ts	Updates dashboard launch resolved/migration call sites
extension/src/views/AppHostsViewTelemetry.ts	Updates runningapphostsview/shown call site
extension/src/debugger/AspireDebugSession.ts	Updates debug/apphost/start and debug/apphost/end call sites
extension/src/dcp/AspireDcpServer.ts	Updates debug/runsession/start / end call sites
extension/src/dcp/DashboardTelemetryPassthrough.ts	Updates dashboard passthrough event names and typed properties to aspire/dashboard/...
extension/src/test/telemetry.test.ts	Adds dangerous-channel and level-gating pinning tests; reworks fake reporter
extension/src/test/telemetryInventory.test.ts	Sets the entity prefix to empty to match unprefixed wire names
extension/src/test/dashboardTelemetryRoutes.test.ts	Updates fake reporter and route name assertions
extension/src/test/aspireDebugSession.test.ts	Updates fake reporter and debug event name assertions
extension/src/test/appHostsViewTelemetry.test.ts	Updates fake reporter and event name assertion
extension/src/test/appHostLaunchService.test.ts	Updates fake reporter and launch result assertions
extension/src/test/appHostDiscovery.test.ts	Updates fake reporter and discovery result assertions
extension/src/test/meaningfulEngagement.test.ts	Updates fake reporter and engagement event assertion

Review details

• Files reviewed: 21/21 changed files
• Comments generated: 0
• Review effort level: Medium

[Copilot]

Review details

• Files reviewed: 21/21 changed files
• Comments generated: 3
• Review effort level: Medium

[Copilot]

Review details

• Files reviewed: 21/21 changed files
• Comments generated: 0 new
• Review effort level: Medium

[Adam Ratzman (adamint)]

Merged main in — extension suite green (1224 passing, lint clean).

Note for whoever reviews this: #18602 currently contains all 21 files from this PR plus 9 more. I'd rather land this one first and then rebase #18602 down to just the attach-debugger change, so the telemetry prefix rename gets reviewed on its own.

[Copilot]

Review details

Comments suppressed due to low confidence (1)

extension/src/utils/telemetry.ts:190

• This replacement sanitizer leaves quoted credential assignments unchanged: for example, --token="secret-value" and password='secret value' do not match because the value character class excludes quotes at its first position. Since the dangerous path no longer runs TelemetryLogger.cleanData(), those common forms are sent verbatim. Handle optional quoted values (including spaces) and add regression coverage for both quote styles.

        .replace(/\b(password|passwd|pwd|token|secret|api[_-]?key|key)(\s*[:=]\s*)[^&\s"',;}]+/gi, '$1$2<redacted>');

• Files reviewed: 21/21 changed files
• Comments generated: 1
• Review effort level: Medium

[Copilot]

Review details

Comments suppressed due to low confidence (3)

extension/src/utils/telemetry.ts:395

• The replacement sanitizer still leaks the common whitespace form of CLI credentials. For example, --password secret and --token secret do not match this expression because it requires : or =, so they reach the dangerous sender unchanged; the bypassed VS Code cleanData() generic-secret rule redacted these values. Treat whitespace as a credential separator too (and add a regression case) before relying on this path as the cleaner replacement.

        .replace(/\b(password|passwd|pwd|token|secret|sig|api[_-]?key|client[_-]?secret|account[_-]?key|shared[_-]?access[_-]?key|sharedaccesskey|connection[_-]?string|connectionstring|key)(\s*[:=]\s*)(?:(["'])([^"']*)\3|([^&\s"',;}]+))/gi, (_match: string, key: string, separator: string, quote: string | undefined) => `${key}${separator}${quote ?? ''}<redacted>${quote ?? ''}`)

extension/src/utils/telemetry.ts:480

• This intentionally exempts every relative slash-separated value, but the bypassed cleanData() file-path matcher also removed relative paths. A dashboard bundle value such as customer/project/file.cs now leaves through the dangerous sender unchanged, even though the passthrough treats its input as a hostile boundary and promises not to report workspace content. Preserve only the known structural route fields (such as dashboard_event_name) and redact relative paths in free-form values.

        // POSIX absolute paths outside the user's home tree. Require at least two
        // segments so a bare `/` or a lone `/word` (often a route or flag, not a path)
        // is left intact, and require a leading delimiter so relative event names are
        // not matched. `/Users/...` and `/home/...` are already redacted above.
        .replace(/(^|[\s"'=(:,|])\/(?!Users\/|home\/)[^/\s"'<>:;,|]+(?:\/[^/\s"'<>:;,|]*)+/g, (_match: string, prefix: string) => `${prefix}<path>`);

extension/src/utils/telemetry.ts:360

• Re-serializing after replacement can expand a dashboard bundle beyond MAX_BUNDLE_CHARS, whose limit was enforced before this sanitizer ran. Repeated short values such as token=x expand substantially to token=<redacted>; a bundle near 8192 characters can therefore exceed the telemetry property limit and be truncated/rejected downstream, making dashboard_properties invalid JSON. Sanitize before serializeBundle, or reapply the bundle budget while preserving a valid JSON envelope.

    return JSON.stringify(sanitizeJsonNode(parsed, preserveGuids));

• Files reviewed: 21/21 changed files
• Comments generated: 1
• Review effort level: Medium

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Copilot]

Review details

Comments suppressed due to low confidence (6)

extension/src/utils/telemetry.ts:395

• The replacement sanitizer still leaks common space-separated credentials. For example, --token secret, password secret, and signature=secret do not match this expression, while the bypassed VS Code cleanData() generic-secret check redacts them. A dashboard value such as Aspire.Dashboard.UserAgent: "--token secret" therefore reaches the dangerous sender unchanged. Extend this pass to cover whitespace-delimited assignments and the omitted generic-secret keywords, with regression tests for those forms.

        .replace(/\b(password|passwd|pwd|token|secret|sig|api[_-]?key|client[_-]?secret|account[_-]?key|shared[_-]?access[_-]?key|sharedaccesskey|connection[_-]?string|connectionstring|key)(\s*[:=]\s*)(?:(["'])([^"']*)\3|([^&\s"',;}]+))/gi, (_match: string, key: string, separator: string, quote: string | undefined) => `${key}${separator}${quote ?? ''}<redacted>${quote ?? ''}`)

extension/src/test/telemetry.test.ts:227

• Remove the Item 1: label. It refers to an internal review checklist rather than durable code context; keep the current-state rationale that follows it.

        // Item 1: VS Code's `TelemetryLogger.cleanData()` (bypassed on the dangerous send path)

extension/src/test/telemetry.test.ts:512

• Remove the Item 2: label. It refers to an internal review checklist rather than durable code context; keep the current-state rationale that follows it.

        // Item 2: the `sendDangerous*` APIs bypass `TelemetryLogger`, which is what normally enforces

extension/src/test/telemetry.test.ts:163

• Remove the Item 1: label. It refers to an internal review checklist rather than durable code context; keep the current-state rationale that follows it.

This issue also appears on line 227 of the same file.

        // Item 1: the manual sanitizer replaces the `TelemetryLogger.cleanData()` that the dangerous

extension/src/test/telemetry.test.ts:262

• Remove the Item 2: label. It refers to an internal review checklist rather than durable code context; keep the current-state rationale that follows it.

This issue also appears on line 512 of the same file.

        // Item 2: `JSON.stringify({ x: 'token="secret"' })` is `{"x":"token=\"secret\""}`. A text-level

extension/src/test/telemetry.test.ts:278

• Remove the Item 4: label. It refers to an internal review checklist rather than durable code context; keep the current-state rationale that follows it.

        // Item 4: VS Code's `cleanData()` treats UNC paths (`\\server\share\...`) as absolute paths.

• Files reviewed: 21/21 changed files
• Comments generated: 0 new
• Review effort level: Medium

[Copilot]

Review details

Comments suppressed due to low confidence (2)

extension/src/utils/telemetryRegistry.ts:227

• This weakens the registry's privacy boundary: every event property now accepts TelemetryTrustedValue, so any producer can bypass VS Code's PII/path cleaning for arbitrary fields. Only the allowlisted dashboard_event_name needs that escape hatch; keep all other event/common properties string-only so accidental trusted wrapping is rejected by the type checker.

    Partial<Record<TelemetryEventSchema[E]['properties'] | CommonTelemetryProperty, TelemetryPropertyValue>>;

extension/src/dcp/DashboardTelemetryPassthrough.ts:1055

• This contradicts the PR's stated dashboard contract: instead of preserving and bounding the raw dashboard_event_name, every valid dashboard event outside this hard-coded set becomes other. That drops the native signal whenever a supported older/newer dashboard emits another event and requires an extension update for each addition. Either preserve a sanitized/clamped aspire/dashboard/... value as described, or explicitly change the contract and keep the allowlist/documentation synchronized.

function dashboardEventNameProperty(value: unknown): TelemetryPropertyValue {
    const eventName = typeof value === 'string' ? value : '';
    return KNOWN_DASHBOARD_EVENT_NAMES.has(eventName)
        ? new vscode.TelemetryTrustedValue(eventName)
        : 'other';

• Files reviewed: 22/22 changed files
• Comments generated: 0 new
• Review effort level: Medium

[Ella Hathaway (ellahathaway)]

Looks good overall. The telemetry bridge preserves VS Code's safeguards while emitting the intended Aspire wire names. I left one non-blocking comment to align the registry guidance with the implemented dashboard event allowlist.

[Copilot]

Review details

Suppressed comments (1)

extension/src/dcp/DashboardTelemetryPassthrough.ts:1028

• This pre-check misses a secret keyword at the end of a leaf. After serialization, VS Code tests the whole JSON string, so the closing quote supplies the required non-alphanumeric delimiter; for example, a value of monkey does not match here but the final "monkey" matches VS Code's key[^A-Za-z0-9] pattern. VS Code then replaces the entire dashboard_properties value with a redaction marker, so it is no longer parseable JSON. Include the serialized closing delimiter in this probe and add a regression case for a trailing keyword.

        /(key|token|sig|secret|signature|password|passwd|pwd|android:value)[^A-Za-z0-9]/i.test(boundedValue) ||

• Files reviewed: 22/22 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.