feat(telemetry): strip cloud API key from lambda payload

The CopilotCloud customer key (`ck_<env>_<id>.<secret>`) is routed to
Segment for downstream user analytics, but has no role in the
telemetry-sink Lambda. Worse, the secret half should never leave the
customer's runtime.

Strips both wire-format variants at the lambda-client boundary:
- `cloud.public_api_key` (v2 event property convention)
- `cloud.publicApiKey` (v1 globalProperties from setCloudConfiguration)

The strip happens at the lambda-client wire layer rather than in each
caller, so any future caller (or accidental property regression) is
covered by default. Boolean indicators like `cloud.api_key_provided`
and unrelated fields like `cloud.baseUrl` continue to ride through.

New unit test (`lambda-client.test.ts`) exercises the strip with a real
fetch spy, plus end-to-end JWT extraction including the
no-`telemetry_id` and not-a-JWT fallback paths.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: BenTaylorDev

packages/shared/src/telemetry/lambda-client.test.ts

@@ -0,0 +1,111 @@
+import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
+import { send } from "./lambda-client";
+
+describe("lambda-client send()", () => {
+  let fetchMock: ReturnType<typeof vi.fn>;
+  let originalFetch: typeof fetch;
+
+  beforeEach(() => {
+    originalFetch = global.fetch;
+    fetchMock = vi.fn().mockResolvedValue(new Response("", { status: 202 }));
+    global.fetch = fetchMock as unknown as typeof fetch;
+  });
+
+  afterEach(() => {
+    global.fetch = originalFetch;
+  });
+
+  function bodyOf(callIdx = 0): {
+    properties: Record<string, unknown>;
+    global_properties: Record<string, unknown>;
+  } {
+    const init = fetchMock.mock.calls[callIdx][1] as RequestInit;
+    return JSON.parse(init.body as string);
+  }
+
+  function headersOf(callIdx = 0): Record<string, string> {
+    const init = fetchMock.mock.calls[callIdx][1] as RequestInit;
+    return init.headers as Record<string, string>;
+  }
+
+  test("strips cloud.public_api_key from properties before sending", async () => {
+    await send({
+      event: "oss.runtime.copilot_request_created",
+      properties: {
+        requestType: "run",
+        "cloud.api_key_provided": true,
+        "cloud.public_api_key": "ck_live_abc.secret-blob",
+      },
+    });
+
+    const body = bodyOf();
+    expect(body.properties).not.toHaveProperty("cloud.public_api_key");
+    // Boolean indicator stays — it's not the key itself.
+    expect(body.properties).toMatchObject({
+      requestType: "run",
+      "cloud.api_key_provided": true,
+    });
+  });
+
+  test("strips cloud.publicApiKey from globalProperties (v1 camelCase variant)", async () => {
+    await send({
+      event: "oss.runtime.instance_created",
+      globalProperties: {
+        "cloud.publicApiKey": "ck_live_abc.secret-blob",
+        "cloud.baseUrl": "https://api.cloud.copilotkit.ai",
+        sampleRate: 0.05,
+      },
+    });
+
+    const body = bodyOf();
+    expect(body.global_properties).not.toHaveProperty("cloud.publicApiKey");
+    // baseUrl is unrelated to attribution and rides through.
+    expect(body.global_properties).toMatchObject({
+      "cloud.baseUrl": "https://api.cloud.copilotkit.ai",
+      sampleRate: 0.05,
+    });
+  });
+
+  test("emits X-CopilotKit-Telemetry-Id when license JWT carries telemetry_id", async () => {
+    const payload = Buffer.from('{"telemetry_id":"abc-123"}').toString(
+      "base64url",
+    );
+    const token = `header.${payload}.sig`;
+
+    await send({
+      event: "oss.runtime.instance_created",
+      licenseToken: token,
+    });
+
+    expect(headersOf()["X-CopilotKit-Telemetry-Id"]).toBe("abc-123");
+  });
+
+  test("falls through to anonymous when license JWT has no telemetry_id", async () => {
+    const payload = Buffer.from('{"license_id":"foo"}').toString("base64url");
+    const token = `header.${payload}.sig`;
+
+    await send({
+      event: "oss.runtime.instance_created",
+      licenseToken: token,
+    });
+
+    expect(headersOf()["X-CopilotKit-Telemetry-Id"]).toBeUndefined();
+  });
+
+  test("falls through to anonymous when license token isn't a JWT shape", async () => {
+    await send({
+      event: "oss.runtime.instance_created",
+      licenseToken: "not-a-jwt",
+    });
+
+    expect(headersOf()["X-CopilotKit-Telemetry-Id"]).toBeUndefined();
+  });
+
+  test("swallows fetch errors silently", async () => {
+    fetchMock.mockRejectedValueOnce(new Error("network down"));
+
+    await expect(
+      send({ event: "oss.runtime.instance_created" }),
+    ).resolves.toBeUndefined();
+  });
+});

packages/shared/src/telemetry/lambda-client.ts

@@ -44,6 +44,26 @@ export interface LambdaSendOptions {
   licenseToken?: string;
 }
 
+// Cloud API key fields routed by the v1 shared TelemetryClient land in
+// `globalProperties` for Segment's benefit, but the telemetry-sink
+// Lambda has no use for them — and the `.<secret>` half of
+// `ck_<env>_<id>.<secret>` must never leave the customer's runtime.
+// Strip both the snake_case (v2 event property) and camelCase (v1
+// globalProperties) variants at the wire boundary so callers can't
+// accidentally leak the key.
+const STRIPPED_KEYS = new Set(["cloud.public_api_key", "cloud.publicApiKey"]);
+
+function stripCloudKeys(
+  obj: Record<string, unknown> | undefined,
+): Record<string, unknown> {
+  if (!obj) return {};
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (!STRIPPED_KEYS.has(k)) out[k] = v;
+  }
+  return out;
+}
+
 // Pull telemetry_id out of a CopilotKit license token without verifying
 // the signature. The token shape is a standard JWT
 // (`<header>.<payload>.<sig>`) with base64url-encoded segments; the
@@ -77,8 +97,8 @@ export async function send(opts: LambdaSendOptions): Promise<void> {
   try {
     const body = JSON.stringify({
       event: opts.event,
-      properties: opts.properties || {},
-      global_properties: opts.globalProperties || {},
+      properties: stripCloudKeys(opts.properties),
+      global_properties: stripCloudKeys(opts.globalProperties),
       package: {
         name: opts.packageName,
         version: opts.packageVersion,