Move Node telemetry consent to mxc_ffi

[Branden Bonaby (bbonaby)]

📖 Description

Goal

Replace the Node SDK's telemetry executor protocol with direct, in-process
mxc_ffi calls while preserving the existing public consent API, asynchronous
presenter behavior, fail-closed policy handling, and typed native errors.

The implementation:

• queries telemetry consent through
  mxc_telemetry_get_consent_status
• withdraws consent through mxc_telemetry_withdraw_consent
• requests consent through mxc_telemetry_request_consent
• uses asynchronous native calls directly for query and withdrawal
• uses a dedicated worker only for consent requests because the native
  presenter callback is synchronous while the JavaScript presenter may be
  asynchronous
• returns presenter decisions through SharedArrayBuffer and
  Atomics.wait/Atomics.notify
• bounds native progress with a deadline that pauses while the JavaScript
  presenter is deciding
• unreferences and terminates timed-out workers so blocked native calls do not
  keep Node alive
• preserves MxcError details, including the native FFI status
• keeps telemetry consent Windows-only and fail-closed
• removes the Node telemetry dependency on executor processes

flowchart LR
    A[Node telemetry API] --> B{Operation}

    B -->|query| C[Async native binding]
    B -->|withdraw| C
    C --> D[mxc_ffi telemetry APIs]

    B -->|request consent| E[Telemetry request worker]
    E --> F[mxc_telemetry_request_consent]
    F -->|synchronous prompt callback| E
    E -->|present message| G[Main-thread JS presenter]
    G -->|decision| H[SharedArrayBuffer + Atomics]
    H --> E
    E --> F

    D --> I[Native consent and policy implementation]
    F --> I

Loading

The native layer remains authoritative for consent persistence, administrative
policy, prompt content, and consent transitions. The Node SDK owns JavaScript
presentation, public result parsing, cancellation, and worker lifecycle.

Current limitations

• Telemetry consent remains Windows-only.
• Native diagnostics are written to process stderr on error paths; they are not
  routed through an SDK-owned console.warn channel.
• A worker blocked inside synchronous native code may not stop immediately
  when termination is requested. The worker is unreferenced on timeout so it
  cannot keep the Node process alive.
• Unsupported platforms fail closed and do not invoke the native telemetry
  APIs.

🔗 References

🔍 Validation

• Node production and unit-test TypeScript builds passed.
• Focused telemetry binding, worker, timeout, status-mapping, and public API
  tests passed.
• Full Node unit suite passed: 475 passed, 20 skipped, 0 failed.
• Two adversarial review-and-fix passes completed.
• git diff --check passed.
• Integration type-checking was not completed in the detached worktree because
  its @microsoft/mxc-sdk package alias was unresolved; the resulting errors
  were not specific to the telemetry change.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with
the GitHub Actions build; it runs on merge to main, and Microsoft reviewers
with write access can trigger it on a PR with /azp run. See
docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must
be added to the feed before the PR can pass. See
docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot review overview

🟡 Changes recommended

Worker timeout races and the non-Windows locale behavior regression must be resolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Preserve non-Windows notApplicable behavior before locale validation · New

What changed in this PR

Moves Node telemetry consent from executor processes to direct mxc_ffi bindings while preserving asynchronous presentation and typed errors.

Changes:

• Adds native telemetry bindings and worker-based consent presentation.
• Updates error mapping, tests, documentation, and test configuration.
• Removes obsolete executor-protocol coverage.

File	Description
sdk/​node/​tests/​unit/​telemetry.test.ts	Updates public telemetry tests.
sdk/​node/​tests/​unit/​telemetry-request-worker.test.ts	Tests worker lifecycle and timeouts.
sdk/​node/​tests/​unit/​default-consent-protocol-runner.test.ts	Removes obsolete protocol tests.
sdk/​node/​tests/​unit/​binding-run.test.ts	Extends native status mapping coverage.
sdk/​node/​src/​telemetry.ts	Uses direct native telemetry operations.
sdk/​node/​src/​bindings/​telemetry.ts	Defines telemetry FFI bindings.
sdk/​node/​src/​bindings/​telemetry-request-worker.ts	Coordinates presenters, deadlines, and worker lifecycle.
sdk/​node/​src/​bindings/​telemetry-request-worker-entry.ts	Executes blocking native consent requests.
sdk/​node/​src/​bindings/​native-error.ts	Maps telemetry FFI statuses.
sdk/​node/​README.md	Documents updated telemetry behavior.
sdk/​node/​package.json	Registers the worker test suite.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Jeff Whiteside (jsidewhite)]

curiuos

[Jeff Whiteside (jsidewhite)]

[Copilot]

Copilot review overview

🔵 Needs a closer look

The worker can invoke the presenter after the request has already timed out.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Preserve non-Windows notApplicable behavior before locale validation