feat(telemetry): TPA-scanner stats (schema v8) + tray menu alignment QA - #956
Merged
Conversation
New tpa_scanner payload block: scans completed/failed/with-findings and findings by severity (fixed 5-key enum), plus feature_flags.deep_scan_enabled. Counting unit is one Pass-1, non-dry-run scan job — deep-scan Pass-2 jobs and per-scanner failures are explicitly excluded so the deep-scan cohort comparison is not skewed. Recording is gated in the scanner package via a new EventEmitter.EmitSecurityScanTelemetry seam; the UI-facing scan events no longer touch telemetry. Privacy: counts and enum keys only — server names, scanner ids, rule ids, finding titles and paths structurally cannot reach the payload; a new v8_field_invalid anonymity rule drops any malformed payload before send. Counters live in CounterRegistry under one lock (snapshot can never show findings without scans) and reset only after an accepted heartbeat.
Four visual defects and one routing defect in the tray menu: - Histogram now spans the full menu width: the NSHostingView gets a flexible-width autoresizing mask (SwiftUI maxWidth .infinity, 272pt floor) instead of a fixed frame that left a dead band whenever a text row was wider. The cached chart item resets its width when reused so a once-wide menu cannot ratchet permanently. - 'Recent' and 'Clients' are real NSMenuItem.sectionHeaders on macOS 14+ (disabled-row fallback below), not full-size disabled rows. - Successful Recent rows carry an invisible 16x16 placeholder image so every title in the section shares one leading edge while failures stay the only visible marks (FR-010); all glance glyphs normalized to 16pt. - Start/Stop/Disconnect Core items lose their oversized 18x18 icons — the bottom command block now sits on one leading edge like its neighbours. - 'Open Activity…' and Recent rows open the native main window at the Activity section (showMainWindow(tab:) now honours its previously-dead parameter; fresh windows seed via MainWindow(initialTab:), live windows via a new .switchToSidebarTab notification; a miniaturized window is deminiaturized instead of duplicated). The Web-UI deep-link path (GlanceLinks) is deleted; Web UI stays reachable via 'Open Web UI'. Verified live via mcpproxy-ui-test against an isolated core with seeded success/error/blocked activity. 788 tests pass; new pins cover section headers, chart autoresizing, the notification decode seam and the glance routing destination.
Deploying mcpproxy-docs with
|
| Latest commit: |
01a3ee5
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://b1d499d3.mcpproxy-docs.pages.dev |
| Branch Preview URL: | https://feat-tpa-telemetry-tray-qa.mcpproxy-docs.pages.dev |
… reject null objects The v8 anonymity rule copied an unknown tpa_scanner key into the violation Pattern, which sendHeartbeat logs — echoing the key there is itself the leak the rule exists to stop; the pattern is now constant. tpa_scanner:null and findings:null unmarshal into nil maps and slipped past the object-shape check; both are rejected explicitly. The Snapshot-to-Reset loss window is documented as the deliberate registry-wide semantic (shared by every counter; anonymous daily aggregates, seconds-long window).
Dumbris
force-pushed
the
feat/tpa-telemetry-tray-qa
branch
from
August 5, 2026 10:29
3354fba to
3a3aac5
Compare
The payload-endpoint test asserted schema_version == 7 literally; v8 (the tpa_scanner block) is additive and the v7 fields keep rendering, which is what the test actually pins.
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 30998970239 --repo smart-mcp-proxy/mcpproxy-go
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two changesets, disjoint areas:
1. Anonymous TPA-scanner telemetry (heartbeat schema v7 → v8)
tpa_scannerpayload block: scans completed / failed / with-findings + findings by severity (fixed 5-key enum), plusfeature_flags.deep_scan_enabled.EventEmitter.EmitSecurityScanTelemetryseam; UI-facing scan events no longer touch telemetry.v8_field_invalidanonymity rule drops malformed payloads before send. Counters reset only after an accepted (2xx) heartbeat.2. macOS tray menu alignment + native Activity routing
maxWidth: .infinity; 272pt floor; cache resets width so a once-wide menu can't ratchet).NSMenuItem.sectionHeaders on macOS 14+; successful rows carry an invisible 16×16 placeholder so all titles share one leading edge while failures stay the only visible marks (FR-010); glyphs normalized to 16pt.showMainWindow(tab:)honours its previously-dead parameter;.switchToSidebarTabnotification for live windows,MainWindow(initialTab:)for fresh ones; miniaturized windows deminiaturize instead of duplicating). Web-UI deep-link path (GlanceLinks) deleted.Verification
go test -racegreen: telemetry, scanner, runtime. golangci-lint v2 (CI config): 0 issues../scripts/test-api-e2e.shPASS.