Merge main to preserve decoder coverage and restore leak-analysis CI

Resolve the decoder-test includes without dropping either branch's regressions. Brace the compact-SKU logging conditional so disabling logging does not trigger C4390. Aggregate completed Dr. Memory process reports so forked Linux tests retain leak accounting instead of failing report discovery.

Files updated beyond the main merge: tests/unittests/PayloadDecoderTests.cpp; lib/pal/desktop/WindowsDesktopSystemInformationImpl.cpp; .github/scripts/run-drmemory.ps1; .github/workflows/memory-leak-analysis.yml; tests/memory-leak-analysis/run-drmemory-tests.ps1; docs/maintainer-onboarding.md.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f81706eb-e23d-4739-a41b-8851e2c3653a

Author: bmehta001

.github/scripts/run-drmemory.ps1

@@ -27,24 +27,25 @@ $ErrorActionPreference = "Stop"
 function Get-LeakCount {
     param(
         [Parameter(Mandatory = $true)]
-        [string]$Results,
+        [string[]]$Results,
 
         [Parameter(Mandatory = $true)]
         [string]$Category
     )
 
     $escapedCategory = [regex]::Escape($Category)
     $pattern = "(?m)^\s*(?:~~Dr\.M~~\s+)?([\d,]+) unique,\s+([\d,]+) total,\s+([\d,]+) byte\(s\) of $escapedCategory\r?$"
-    $match = [regex]::Match($Results, $pattern)
-    if (-not $match.Success) {
-        throw "Dr. Memory results do not contain the '$Category' summary."
-    }
-
-    return @{
-        Unique = [int64]($match.Groups[1].Value -replace ",", "")
-        Total  = [int64]($match.Groups[2].Value -replace ",", "")
-        Bytes  = [int64]($match.Groups[3].Value -replace ",", "")
+    $counts = @{ Unique = [int64]0; Total = [int64]0; Bytes = [int64]0 }
+    foreach ($result in $Results) {
+        $match = [regex]::Match($result, $pattern)
+        if (-not $match.Success) {
+            throw "Dr. Memory results do not contain the '$Category' summary."
+        }
+        $counts.Unique += [int64]($match.Groups[1].Value -replace ",", "")
+        $counts.Total += [int64]($match.Groups[2].Value -replace ",", "")
+        $counts.Bytes += [int64]($match.Groups[3].Value -replace ",", "")
     }
+    return $counts
 }
 
 $resolvedDrMemoryPath = (Resolve-Path -LiteralPath $DrMemoryPath).Path
@@ -70,11 +71,12 @@ $resultFiles = @(Get-ChildItem -LiteralPath $scenarioDirectory -Filter results.t
 $resultFiles = @($resultFiles | Where-Object {
     Select-String -LiteralPath $_.FullName -Pattern '^(?:NO )?ERRORS FOUND:\r?$' -Quiet
 })
-if ($resultFiles.Count -ne 1) {
-    throw "Expected one completed Dr. Memory results.txt for $Scenario, found $($resultFiles.Count)."
+if ($resultFiles.Count -eq 0) {
+    throw "Expected at least one completed Dr. Memory results.txt for $Scenario, found none."
 }
 
-$results = Get-Content -LiteralPath $resultFiles[0].FullName -Raw
+# Forked tests produce separate reports; include every completed process.
+$results = @($resultFiles | ForEach-Object { Get-Content -LiteralPath $_.FullName -Raw })
 $leaks = Get-LeakCount -Results $results -Category "leak(s)"
 $possibleLeaks = Get-LeakCount -Results $results -Category "possible leak(s)"
 $reachable = Get-LeakCount -Results $results -Category "still-reachable allocation(s)"

.github/workflows/build-android.yml

@@ -109,6 +109,10 @@ jobs:
       run: |
         .\gradlew.bat maesdk:test
       working-directory: lib\android_build
+    - name: Gradle Build without native device-ID collection
+      run: |
+        .\gradlew.bat maesdk:assembleDebug app:assembleDebug -PMATSDK_ENABLE_DEVICE_ID=OFF
+      working-directory: lib\android_build
     - name: Upload Reports
       if: failure()
       uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

.github/workflows/build-posix-latest.yml

@@ -50,6 +50,37 @@ jobs:
     - name: Test ${{ matrix.os }} ${{ matrix.config }}
       run: ./build-tests.sh ${{ matrix.config }}
 
+  device-id-optout:
+    name: Device-ID opt-out (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    env:
+      CMAKE_POLICY_VERSION_MINIMUM: "3.5"
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macOS-latest, windows-2022]
+    steps:
+    - name: Checkout
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+    - name: Initialize googletest
+      run: git submodule update --init --depth=1 third_party/googletest
+    - name: Test Linux/macOS without native device-ID collection
+      if: runner.os != 'Windows'
+      env:
+        CMAKE_OPTS: -DMATSDK_ENABLE_DEVICE_ID=OFF
+      run: ./build-tests.sh debug
+    - name: setup-msbuild
+      if: runner.os == 'Windows'
+      uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2.0.0
+      with:
+        vs-version: '[17,)'
+    - name: Test Windows without native device-ID collection
+      if: runner.os == 'Windows'
+      shell: cmd
+      run: build-tests.cmd x64 Debug "tests\device-id-optout.props" WinHTTP
+    - name: Verify vcpkg feature mapping
+      run: cmake -P tests/vcpkg/device-id-feature-tests.cmake
+
   public-headers:
     name: Public header gate (GCC/Clang)
     runs-on: ubuntu-latest

.github/workflows/memory-leak-analysis.yml

@@ -9,6 +9,7 @@ on:
     - main
     paths:
     - .github/scripts/run-drmemory.ps1
+    - tests/memory-leak-analysis/**
     - .github/memory-leak-baseline.csv
     - .github/workflows/memory-leak-analysis.yml
     - CMakeLists.txt
@@ -28,6 +29,7 @@ on:
     - main
     paths:
     - .github/scripts/run-drmemory.ps1
+    - tests/memory-leak-analysis/**
     - .github/memory-leak-baseline.csv
     - .github/workflows/memory-leak-analysis.yml
 
@@ -51,6 +53,10 @@ jobs:
     - name: Checkout
       uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
+    - name: Test Dr. Memory report parsing
+      shell: pwsh
+      run: ./tests/memory-leak-analysis/run-drmemory-tests.ps1
+
     - name: Initialize googletest
       run: git submodule update --init --depth=1 third_party/googletest
 
@@ -170,6 +176,10 @@ jobs:
     - name: Checkout
       uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
+    - name: Test Dr. Memory report parsing
+      shell: pwsh
+      run: ./tests/memory-leak-analysis/run-drmemory-tests.ps1
+
     - name: Initialize googletest
       run: git submodule update --init --depth=1 third_party/googletest
 

CMakeLists.txt

@@ -120,6 +120,10 @@ if(MATSDK_DISABLE_LOGGING)
   target_compile_definitions(matsdk_internal_config INTERFACE
     MATSDK_DISABLE_LOGGING)
 endif()
+if(NOT MATSDK_ENABLE_DEVICE_ID)
+  target_compile_definitions(matsdk_internal_config INTERFACE
+    MATSDK_DISABLE_DEVICE_ID)
+endif()
 
 option(GCC5_CXX11_ABI_WORKAROUND "Workaround: Use legacy C++11 ABI (for GCC 5 compatibility)" OFF)
 if(GCC5_CXX11_ABI_WORKAROUND)

cmake/MatsdkOptions.cmake

@@ -46,6 +46,8 @@ option(MATSDK_USE_WININET
   "Use WinInet instead of WinHTTP as the Win32 desktop HTTP client" OFF)
 option(MATSDK_DISABLE_LOGGING
   "Compile internal SDK logging out" OFF)
+option(MATSDK_ENABLE_DEVICE_ID
+  "Collect a device ID using the SDK's platform-specific implementation" ON)
 
 set(_matsdk_android_http_client_predefined OFF)
 if(DEFINED MATSDK_ANDROID_HTTP_CLIENT)

docs/CsProtocol-decoding.md

@@ -28,3 +28,23 @@ Please refer to usage examples:
 
 * EventDecoderListener.cpp [EventDecoderListener::DecodeBuffer](../tests/functests/EventDecoderListener.cpp) for HTTP(s) request - Package of Records decoding
 * APITest.cpp [UTC_Callback_Test](../tests/functests/APITest.cpp) for Common Schema Record decoding
+
+## Decoder input limits
+
+Diagnostic request decoding rejects inputs larger than 64 MiB, including
+compressed input and the inflated output. Inflation uses a fixed-size work
+buffer and stops before growing the output beyond that limit; it does not
+estimate output size from a presumed compression ratio.
+
+Binary container counts must fit the remaining encoded input (at least one
+byte per sequence element or two bytes per map entry). Impossible counts are
+rejected before generated readers allocate their containers; no separate
+fixed element-count or record-count limit is imposed.
+Record-boundary scanning reads the request in place and copies only each
+individual record, so scanning and input copying are linear in request size.
+Decoding failure returns `false` rather than reporting a partial request as
+success; partial inflation output
+must not be used after a failed call.
+
+These diagnostic limits do not change the event submission API or its
+configured serialized-event size policy.

docs/PAL.md

@@ -59,6 +59,61 @@
 
 ## Remote configuration (ECS client)
 
+## Device-ID collection
+
+`MATSDK_ENABLE_DEVICE_ID` defaults to `ON`. Configure with
+`-DMATSDK_ENABLE_DEVICE_ID=OFF` to compile out the SDK's native device-ID
+collectors, including machine-ID reads, fallback shell commands, adapter
+queries, host UUIDs, and vendor/Android identifiers. Other system and device
+metadata remain enabled. The macOS build also stops linking the ID-specific
+IOKit framework; dependencies still used by other features remain.
+
+Without a supplied ID, `DeviceInfo.Id` is omitted rather than replaced with a
+placeholder. Applications can still supply their own ID through
+`ISemanticContext::SetDeviceId`; registration does not overwrite it with an
+empty automatically collected ID. Android's Java bridge consults the native
+build setting before accessing `ANDROID_ID`; use the matching Java bridge
+sources with the native SDK. For Android Gradle builds, pass
+`-PMATSDK_ENABLE_DEVICE_ID=OFF` to apply the setting to both the SDK AAR and
+the test application. The Gradle property takes precedence over the
+`MATSDK_ENABLE_DEVICE_ID` environment variable; both default to `ON` when
+unspecified.
+
+This option does not disable session/SDK identifiers or control device IDs
+added independently by the operating system's UTC telemetry pipeline.
+
+## Targeted input safeguards
+
+The SDK bounds the command-line input involved in initialization and buffered
+HTTP responses. It does not impose a blanket metadata limit on system,
+device, application, or network-provider strings, additional limits on
+OS-reported buffer sizes, or a size limit on persisted session files.
+
+| Input | Limit | Oversize behavior |
+| --- | --- | --- |
+| POSIX application identifier | 4 KiB, stopping at the first NUL in `/proc/self/cmdline` | Truncate the executable name; never collect arguments or run a regex |
+| HTTP response body | 16 MiB | Fail the request rather than retain an oversized response |
+| HTTP response headers | 64 KiB | Fail the request rather than retain oversized headers |
+
+POSIX OS release values use exact line-key matching rather than recursive
+regular expressions. Curl response headers are also parsed without regex.
+Command-line truncation preserves UTF-8 boundaries. Other metadata is not
+truncated by these safeguards. Session files retain the existing platform
+text-read behavior; session parsing accepts both LF and CRLF line endings.
+The header budget includes framing for native raw headers or a minimum
+four-byte allowance per name/value pair. Windows native queries measure raw
+UTF-16/ANSI buffer bytes; WinRT conservatively budgets up to three UTF-8 bytes
+per UTF-16 unit. Android counts JNI modified UTF-8 bytes without allocating
+encoded strings, including two bytes for NUL and three per surrogate, before
+JNI additionally checks their encoded byte sizes. OS networking frameworks may
+have their own internal limits; the SDK limits its own copies and streaming
+body reads.
+
+Caller-provided events retain the existing configured serialized-event,
+upload, and offline-cache size policies; no new per-property limit is applied.
+See [decoder limits](CsProtocol-decoding.md#decoder-input-limits) for the
+separate diagnostic decoding budget.
+
 ## Bandwidth manager (Resource manager)
 
 - Get available bandwidth

docs/building-with-vcpkg.md

@@ -57,6 +57,46 @@ project's `vcpkg.json`:
 
 ## Platform-Specific Instructions
 
+### Disabling SDK device-ID collection
+
+The in-repo overlay port has a default-enabled `device-id` feature, mapped to
+the default-on CMake option `MATSDK_ENABLE_DEVICE_ID`. To supply your own
+`DeviceInfo.Id` without running the SDK's native collectors, omit that feature
+and explicitly retain the other features you need:
+
+```json
+{
+  "dependencies": [
+    {
+      "name": "cpp-client-telemetry",
+      "default-features": false,
+      "features": ["curl-openssl", "system-sqlite"]
+    }
+  ]
+}
+```
+
+For classic mode:
+
+```console
+vcpkg install "cpp-client-telemetry[core,curl-openssl,system-sqlite]" --overlay-ports=tools/ports
+```
+
+`curl-openssl` affects Linux only; Android still defaults to Java transport.
+`[core,...]` and `default-features: false` drop **all** defaults, including
+`device-id`. Add `device-id` explicitly when combining non-default features
+but wanting to retain native ID collection.
+
+vcpkg features are additive across the dependency graph: another dependency
+requesting `device-id` (or the default features) re-enables collection. Ensure
+all requests for this port agree when opting out.
+
+The official registry requires a port update pointing to an SDK release
+containing this option; existing registry versions do not expose the feature.
+Until then, use this repository's overlay port and source checkout. The port
+rejects an opt-out against an older SDK rather than silently collecting an ID.
+For direct CMake builds, use `-DMATSDK_ENABLE_DEVICE_ID=OFF`.
+
 ### Windows
 
 ```powershell

docs/embedding-with-cmake.md

@@ -29,6 +29,12 @@ Set it explicitly to `ON` in consumer CI to test new toolchains strictly.
 Set `MATSDK_DISABLE_LOGGING=ON` to compile the SDK's internal diagnostic
 logging out. This does not disable telemetry event collection or upload.
 
+Set `MATSDK_ENABLE_DEVICE_ID=OFF` before adding the SDK to compile out native
+device-ID collection while retaining other metadata. It defaults to `ON`.
+Applications can still set their own ID through `ISemanticContext::SetDeviceId`;
+without one, `DeviceInfo.Id` is omitted. See [device-ID collection](PAL.md#device-id-collection)
+for platform details and the distinction from session/SDK identifiers.
+
 ## SQLite and zlib providers
 
 Source builds can select dependency modes without patching 1DS sources: