Prevent telemetry low_savings_commands from including arguments

Summary

Telemetry documentation says full command lines, arguments, file paths, environment variables, source code, and secrets are not collected. In v0.39.0, most telemetry fields are aggregate or reduced, but low_savings_commands can still include command arguments because it sends the first three whitespace-separated words of the stored rtk_cmd.

This is a privacy hardening issue, not an accusation of malware.

Version / tag / commit

• Release: v0.39.0
• Commit/tag target: 2fbc7514f6964acabcfac65501b8bb6b525e3aa8
• Producing Actions run: https://github.com/rtk-ai/rtk/actions/runs/25445836840

Evidence

Telemetry payload:

• src/core/telemetry.rs:106-140 includes low_savings_commands in the JSON payload.
• src/core/telemetry.rs:271-278 populates it from tracker.low_savings_commands(5) and formats each entry as "{cmd}:{pct}%".
• src/core/tracking.rs:1053-1067 implements low_savings_commands; it selects full rtk_cmd, then returns cmd.split_whitespace().take(3).join(" ").

Stored command sources can include arguments:

• src/main.rs:1199-1204 records TOML-filtered fallback as rtk:toml {raw_command}.
• src/main.rs:1227 records passthrough as rtk fallback: {raw_command}.
• src/main.rs:2341-2344 records proxy usage as rtk proxy {cmd_name} {cmd_args.join(" ")}.

Therefore a command such as a proxy or fallback invocation with a URL/path/token-like first argument can flow into the first three words of low_savings_commands, depending on savings stats and ranking.

Docs:

• docs/TELEMETRY.md:65 documents low_savings_commands as a sent telemetry field.
• docs/TELEMETRY.md:109-114 says RTK does not collect full command lines or arguments, file paths, secrets, API keys, or environment variable values.

Other telemetry fields look better reduced:

• src/core/tracking.rs:976-986 extracts only the tool name for top_commands.
• src/core/tracking.rs:1024-1038 groups passthrough telemetry by first word only.
• src/core/tracking.rs:1141-1172 maps commands to ecosystem categories for ecosystem_mix.
• src/core/tracking.rs:1188-1195 sends only a count of distinct project paths.

Impact

Users who opt in to telemetry may unintentionally send a command argument in low_savings_commands. Depending on the command, the first argument can be a URL, path, repository name, host, branch, package, or token-like string. This conflicts with the documented privacy claim and creates avoidable telemetry sensitivity.

Verification steps

No release binary execution is needed.

1. Inspect src/core/telemetry.rs at v0.39.0 and confirm low_savings_commands is included in the payload.
2. Inspect src/core/tracking.rs:1053-1067 and confirm the first three words of rtk_cmd are sent.
3. Inspect src/main.rs:1199-1204, :1227, and :2341-2344 and confirm stored rtk_cmd values can include raw command arguments.
4. Compare with docs/TELEMETRY.md:109-114.

Suggested mitigation

• Make low_savings_commands use the same tool-name reduction as top_commands, or map to a fixed taxonomy.
• If subcommand granularity is needed, maintain a per-tool allowlist of safe subcommands and drop all other arguments.
• Add unit tests with URL/path/token-like arguments proving telemetry payload fields do not include them.
• Update docs/TELEMETRY.md if the intended policy is to send sanitized subcommand names rather than only tool names.