@mushi-mushi/react-native 0.8.0 → 0.8.2

package/SECURITY.md

@@ -19,15 +19,59 @@ If you discover a security vulnerability, please report it responsibly.
 
 **Do NOT open a public GitHub issue.**
 
-Instead, email: **kensaurus@gmail.com**
+Use either channel below:
+
+1. **GitHub Private Vulnerability Reporting** — strongly preferred.
+   <https://github.com/kensaurus/mushi-mushi/security/advisories/new>
+   Routes the report into a private advisory with built-in CVE issuance,
+   patch coordination, and contributor-credit workflow.
+2. **Email** — `kensaurus@gmail.com`, subject prefix `[mushi-security]`.
+   PGP welcome but not required.
 
 Include:
 - Description of the vulnerability
-- Steps to reproduce
-- Impact assessment
+- Steps to reproduce (smallest reproducer wins)
+- Impact assessment (what an attacker gains)
 - Suggested fix (if any)
+- Whether you want public credit (and how to spell your name)
+
+### Coordinated-disclosure timeline
+
+| Day | Action |
+|-----|--------|
+| 0 | Report received |
+| ≤ 2 | Acknowledgment + assigned a tracking ID |
+| ≤ 7 | Triage complete: severity assigned (CVSS 3.1) and target patch date communicated |
+| ≤ 30 | Patch released for critical / high (CVSS ≥ 7.0); ≤ 60 days for medium; best-effort for low |
+| Patch + 7 | Public advisory + CVE published; reporter credited unless they declined |
+| Patch + 90 | Embargo expires regardless; if upstream is unresponsive, the reporter is free to publish |
+
+### Safe harbor
+
+Good-faith security research on Mushi Mushi is welcome. If you stay
+within the rules below, we will not pursue legal action, will not ask
+your hosting provider to take you offline, and will publicly credit your
+work:
+
+- Test only against your own self-hosted instance, the public demo at
+  <https://kensaur.us/mushi-mushi/admin/>, or accounts you own.
+- Do not access, exfiltrate, or modify data belonging to other users.
+- Do not run automated scanning that affects availability for others
+  (rate-limit your tooling, exclude `/health`).
+- Disclose privately first (channels above); do not publish before the
+  embargo above expires.
+- Do not intentionally exploit a finding to escalate beyond proving it
+  exists.
+
+If a finding requires touching production data to confirm, **stop and
+ask first** — describe what you'd need to do and we'll spin up a sandbox.
+
+### Hall of fame
 
-We will acknowledge receipt within 48 hours and aim to release a patch within 7 days for critical issues.
+Researchers who report a confirmed vulnerability are credited in the
+release notes for the patched version and added to
+[`docs/SECURITY_HALL_OF_FAME.md`](./docs/SECURITY_HALL_OF_FAME.md) (with
+permission).
 
 ## Scope
 
@@ -48,6 +92,125 @@ We will acknowledge receipt within 48 hours and aim to release a patch within 7
 - **Rotate API keys** regularly via the admin console
 - **Enable SSO** for team projects (Enterprise tier)
 - **Review audit logs** periodically for suspicious activity
+- **Verify SDK integrity** with `npm audit signatures` after install
+- **Set `Content-Security-Policy`** on any page embedding the Mushi widget;
+  the widget itself ships with `script-src 'self'` and does not load
+  remote scripts.
+
+## Threat model
+
+What we treat as in-scope attacker capabilities, and what we don't.
+
+| Capability | In scope | Notes |
+|-----------|----------|-------|
+| Unauthenticated network attacker hitting public endpoints | ✅ | Rate-limit + HMAC + replay protection on every webhook endpoint (`packages/server/supabase/functions/_shared/webhook-middleware.ts`). |
+| Authenticated user trying to read another tenant's data | ✅ | Postgres RLS on every `public.*` table; advisor lints reviewed monthly. |
+| Authenticated user trying to escalate to super-admin | ✅ | Role lives in `auth.users.raw_app_meta_data.role`; cannot be self-edited via PostgREST. |
+| Compromised dependency (npm supply-chain attack) | ✅ | 7-day cooldown + provenance + Harden-Runner + pinned SHAs (see "Supply-chain hardening" below). |
+| Stolen API key | ✅ | Per-key scopes (`api_key_has_scope`), revocation via admin console, audit log of every use. |
+| User pasting a Stripe / OpenAI / GitHub PAT into a bug report | ✅ | PII scrubber redacts ~15 vendor token formats client-side before the report leaves the device. Mirrors `packages/core/src/pii-scrubber.ts` across iOS, Android, Flutter, React Native. |
+| Stolen end-user device with the SDK installed | ⚠️ partial | Offline queue is AsyncStorage / Keychain / SharedPreferences — no app-level encryption beyond the OS default. Reports waiting to flush are vulnerable to a forensic attacker. |
+| Compromised Supabase service-role key | ❌ | Treated as a tier-0 incident; would require key rotation and audit-log forensics. Not defendable in software. |
+| Compromise of `kensaurus@gmail.com` | ❌ | Treated as a project-fork event; downstream consumers should pin to the last known-good version and follow the new release channel. |
+| Physical / OS-level attacker on an end-user device | ❌ | Out of scope. |
+| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT/BSL grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
+
+## Data handling and PII
+
+### What the SDK collects by default
+
+| Field | Scope | PII risk |
+|-------|-------|----------|
+| URL / route the user was on | Always | Low — strip query strings if your routes encode user IDs. |
+| Browser / OS / device | Always | None |
+| Console errors (last 50) | Opt-in via `captureConsole: true` | Medium — can include user data your code logs. |
+| Network failures (URL + status) | Opt-in via `captureNetwork: true` | Medium — query params logged as-is unless you redact in-app. |
+| User id / email / role | Only if you call `setUser()` | High — only set what you need; we do not auto-discover. |
+| Session replay frames | Off by default | High — handled by the masking layer; passwords / cards / opted-out elements never leave the page. |
+| Free-text bug description | Always | Medium — passed through the PII scrubber (see below). |
+
+### What the PII scrubber redacts before send
+
+Implemented identically across `@mushi-mushi/core`, the iOS, Android,
+Flutter, and React Native SDKs. Defaults are below — every category can
+be toggled off, but `secretTokens` is on by default and we recommend
+keeping it that way.
+
+| Category | Default | Patterns |
+|----------|---------|----------|
+| `ssns` | on | `123-45-6789` |
+| `creditCards` | on | 12–19 digit Luhn-shaped sequences with optional separators |
+| `secretTokens` | on | AWS access key (`AKIA…` / `ASIA…`), AWS secret (`aws_secret_access_key=…`), Stripe (`sk_live_…`, `sk_test_…`, `rk_…`, `pk_…`), Slack (`xox[abpor]-…`), GitHub PAT (`ghp_…`, `github_pat_…`), OpenAI (`sk-…`, `sk-proj-…`), Anthropic (`sk-ant-…`), Google API (`AIza…`), JWT (`eyJ…` 3-segment) |
+| `emails` | on | RFC-5322 lite |
+| `phones` | on | E.164 with optional country code |
+| `ipAddresses` | off | IPv4 (off because internal IPs are usually not PII and noise hurts triage) |
+| `ipv6` | off | Same |
+
+The fields scrubbed are:
+
+- `description` — primary free-text field of every bug report
+- `summary` — short summary, in the same composer
+- `breadcrumbs[].message` — auto-captured user-action trail (clicks, route changes, console messages)
+
+Structured fields you set explicitly (`metadata.userEmail`,
+`metadata.userId`, etc.) are intentionally **not** scrubbed — those are
+opt-in attribution data, and silently rewriting them would break
+support workflows.
+
+### Where data lives
+
+- **Reports & telemetry** — Supabase Postgres in the `us-west-1` region.
+- **Session replays** — Supabase Storage, same region. Lifecycle policy
+  trims replays older than 30 days unless explicitly retained from the
+  admin console.
+- **Inbound webhook bodies** — only a SHA-256 hash + `delivery_id` of
+  the body is persisted (`webhook_audit_log`). The full body is
+  processed in memory and discarded.
+- **Outbound integrations** (Slack, Jira, …) — Mushi is a sender only;
+  the receiving system's retention applies.
+
+### Encryption
+
+| Surface | At rest | In transit |
+|---------|---------|------------|
+| Postgres (Supabase) | AES-256 (Supabase default) | TLS 1.2+ |
+| Supabase Storage (replays) | AES-256 | TLS 1.2+ |
+| Edge Function ↔ Postgres | — | TLS via the Supavisor pooler |
+| SDK ↔ ingest endpoint | — | TLS 1.2+ enforced; HSTS preload on `kensaur.us` |
+| Inbound webhooks | — | TLS terminated at CloudFront / Supabase edge |
+| Audit log integrity | append-only by RLS; no in-row signing | — |
+
+### Cryptographic primitives
+
+| Use | Algorithm | Implementation |
+|-----|-----------|---------------|
+| Webhook HMAC verification (Sentry, GitHub, Datadog, Honeycomb, Grafana, Bugsnag, Rollbar, Crashlytics) | HMAC-SHA256, constant-time compare | Web Crypto in Deno; `crypto.subtle.timingSafeEqual` analogue |
+| AWS SNS subscription confirmation | RSA-SHA1 / RSA-SHA256 | Deno `crypto.subtle.verify` with the cert from `SigningCertURL` (URL allow-listed to `*.sns.*.amazonaws.com`) |
+| Opsgenie JWT shared-token | HS256 with `aud` claim verification | `jose` (Deno-compatible) |
+| API-key hashing (database) | SHA-256 prefix + bcrypt secret half | `pgcrypto` |
+| Provenance attestations (npm) | Sigstore (Fulcio + Rekor) | `npm publish --provenance` |
+
+We deliberately do not roll our own crypto. If you find an algorithm or
+library above that has been deprecated, please file a security advisory.
+
+### Operator security checklist
+
+When you provision a new self-hosted Mushi instance:
+
+- [ ] Set `auth_leaked_password_protection = true` in Supabase Auth
+      (HaveIBeenPwned blocklist; flagged as `auth_leaked_password_protection`
+      in the security advisor).
+- [ ] Enable at least two MFA factors in Supabase Auth (`auth_insufficient_mfa_options`).
+- [ ] Rotate the service-role key on day 1, then quarterly.
+- [ ] Restrict Postgres direct connections to your CI / migration runners
+      via Supabase network restrictions.
+- [ ] Run `pnpm dlx supabase advisors --project-ref <ref>` after every
+      migration; aim for zero ERROR-level findings.
+- [ ] Configure a Supabase log drain to your SIEM if you are subject to
+      SOC 2 / ISO 27001.
+- [ ] Set CSP `frame-ancestors` on the host page if you embed the Mushi
+      widget (the widget is iframe-friendly but does not enforce
+      framing constraints itself).
 
 ## Supply-chain hardening (how this package is protected)
 

package/dist/index.cjs

@@ -138,13 +138,28 @@ function stripQueryParams(url) {
 var import_react_native = require("react-native");
 function getDeviceInfo() {
   const { width, height } = import_react_native.Dimensions.get("window");
+  const locale = (
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+    import_react_native.NativeModules.SettingsManager?.settings?.AppleLocale ?? // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+    import_react_native.NativeModules.I18nManager?.localeIdentifier ?? "en"
+  );
+  let timezone = "UTC";
+  try {
+    timezone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+  } catch {
+  }
+  const appVersion = import_react_native.NativeModules.RNDeviceInfo?.appVersion ?? import_react_native.NativeModules.RNBuildConfig?.VERSION_NAME ?? String(import_react_native.Platform.Version);
   return {
     platform: import_react_native.Platform.OS,
     osVersion: import_react_native.Platform.Version,
     screenWidth: width,
     screenHeight: height,
     pixelRatio: import_react_native.PixelRatio.get(),
-    fontScale: import_react_native.PixelRatio.getFontScale()
+    fontScale: import_react_native.PixelRatio.getFontScale(),
+    systemName: import_react_native.Platform.OS,
+    locale,
+    timezone,
+    appVersion
   };
 }
 
@@ -164,7 +179,8 @@ var AsyncStorageQueue = class {
     if (!AsyncStorage) return;
     const queue = await this.getQueue(AsyncStorage);
     if (queue.length >= this.maxSize) queue.shift();
-    queue.push({ report, enqueuedAt: Date.now() });
+    const scrubbedReport = this.scrubReportPii(report);
+    queue.push({ report: scrubbedReport, enqueuedAt: Date.now() });
     await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(queue));
   }
   async flush() {
@@ -175,21 +191,10 @@ var AsyncStorageQueue = class {
     let flushed = 0;
     const remaining = [];
     for (const item of queue) {
-      try {
-        const res = await fetch(`${this.apiEndpoint}/v1/reports`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "X-Mushi-Api-Key": this.apiKey
-          },
-          body: JSON.stringify(item.report)
-        });
-        if (res.ok) {
-          flushed++;
-        } else {
-          remaining.push(item);
-        }
-      } catch {
+      const ok = await sendWithRetry(item, this.apiEndpoint, this.apiKey);
+      if (ok) {
+        flushed++;
+      } else {
         remaining.push(item);
         break;
       }
@@ -203,6 +208,27 @@ var AsyncStorageQueue = class {
     const queue = await this.getQueue(AsyncStorage);
     return queue.length;
   }
+  // Added: PII scrubbing (Phase 2.4)
+  // Scrubs free-text fields where users typically type emails / phones /
+  // card numbers when describing a bug. We deliberately do NOT scrub
+  // structured fields like `metadata.userEmail` — those are explicitly
+  // captured by the host app via `setUser()` and the operator opts in to
+  // collecting them. Scrubbing them here would silently break attribution.
+  scrubReportPii(report) {
+    const next = { ...report };
+    if (typeof next.description === "string") {
+      next.description = scrubPii(next.description);
+    }
+    if (typeof next.summary === "string") {
+      next.summary = scrubPii(next.summary);
+    }
+    if (Array.isArray(next.breadcrumbs)) {
+      next.breadcrumbs = next.breadcrumbs.map(
+        (b) => typeof b?.message === "string" ? { ...b, message: scrubPii(b.message) } : b
+      );
+    }
+    return next;
+  }
   async getQueue(storage) {
     try {
       const raw = await storage.getItem(QUEUE_KEY);
@@ -220,6 +246,63 @@ var AsyncStorageQueue = class {
     }
   }
 };
+var SCRUB_PATTERNS = [
+  [/\b\d{3}-\d{2}-\d{4}\b/g, "[REDACTED_SSN]"],
+  [/\b(?:\d[ -]*){12,18}\d\b/g, "[REDACTED_CC]"],
+  [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, "[REDACTED_AWS_KEY]"],
+  [
+    /(?:aws_secret_access_key|secret_access_key)["'\s:=]+[A-Za-z0-9/+=]{40}\b/gi,
+    "aws_secret_access_key=[REDACTED_AWS_SECRET]"
+  ],
+  [/\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{24,}\b/g, "[REDACTED_STRIPE_KEY]"],
+  [/\bpk_(?:live|test)_[A-Za-z0-9]{24,}\b/g, "[REDACTED_STRIPE_PK]"],
+  [/\bxox[abpor]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED_SLACK_TOKEN]"],
+  [/\bghp_[A-Za-z0-9]{36}\b/g, "[REDACTED_GITHUB_PAT]"],
+  [/\bgithub_pat_[A-Za-z0-9_]{80,}\b/g, "[REDACTED_GITHUB_PAT]"],
+  [/\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g, "[REDACTED_OPENAI_KEY]"],
+  [/\bsk-ant-[A-Za-z0-9_-]{20,}\b/g, "[REDACTED_ANTHROPIC_KEY]"],
+  [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED_GOOGLE_KEY]"],
+  [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED_JWT]"],
+  [/\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/g, "[REDACTED_EMAIL]"],
+  [
+    /(?:\+\d{1,3}[\s.\-])?\(?\d{2,4}\)?[\s.\-]\d{3,4}[\s.\-]\d{3,4}\b/g,
+    "[REDACTED_PHONE]"
+  ]
+];
+function scrubPii(text) {
+  let result = text;
+  for (const [regex, replacement] of SCRUB_PATTERNS) {
+    result = result.replace(regex, replacement);
+  }
+  return result;
+}
+async function sendWithRetry(item, endpoint, apiKey, attempt = 0) {
+  const delay = Math.min(1e3 * Math.pow(2, attempt) + Math.random() * 500, 1e4);
+  try {
+    const res = await fetch(`${endpoint}/v1/reports`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Mushi-Api-Key": apiKey
+      },
+      body: JSON.stringify(item.report)
+    });
+    if ((res.status === 429 || res.status >= 500) && attempt < 3) {
+      await sleep(delay);
+      return sendWithRetry(item, endpoint, apiKey, attempt + 1);
+    }
+    return res.ok;
+  } catch {
+    if (attempt < 3) {
+      await sleep(delay);
+      return sendWithRetry(item, endpoint, apiKey, attempt + 1);
+    }
+    return false;
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 
 // src/components/MushiBottomSheet.tsx
 var import_react = require("react");
@@ -599,6 +682,11 @@ function MushiProvider({ children, ...config }) {
   const queueRef = (0, import_react3.useRef)(null);
   const apiClientRef = (0, import_react3.useRef)(null);
   const [sheetVisible, setSheetVisible] = (0, import_react3.useState)(false);
+  if (config.endpoint !== void 0 && config.endpoint.trim() === "") {
+    throw new Error(
+      "[MushiProvider] endpoint is set to an empty string. Set endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api, or omit it to use the cloud default."
+    );
+  }
   const apiEndpoint = config.endpoint ?? import_core.DEFAULT_API_ENDPOINT;
   (0, import_react3.useEffect)(() => {
     if (config.capture?.console !== false) {
@@ -624,6 +712,22 @@ function MushiProvider({ children, ...config }) {
       networkRef.current?.restore();
     };
   }, []);
+  (0, import_react3.useEffect)(() => {
+    let unsubscribe;
+    (async () => {
+      try {
+        const NetInfo = await new Function("s", "return import(s)")("@react-native-community/netinfo");
+        unsubscribe = NetInfo.default.addEventListener((state) => {
+          if (state.isConnected && state.isInternetReachable) {
+            queueRef.current?.flush().catch(() => {
+            });
+          }
+        });
+      } catch {
+      }
+    })();
+    return () => unsubscribe?.();
+  }, []);
   const open = (0, import_react3.useCallback)(() => setSheetVisible(true), []);
   const close = (0, import_react3.useCallback)(() => setSheetVisible(false), []);
   const attachTo = (0, import_react3.useCallback)(() => ({ onPress: open }), [open]);

package/dist/index.d.cts

@@ -36,6 +36,7 @@ interface DeviceInfo {
     systemName?: string;
     locale?: string;
     timezone?: string;
+    appVersion?: string;
 }
 declare function getDeviceInfo(): DeviceInfo;
 
@@ -189,6 +190,7 @@ declare class AsyncStorageQueue {
     enqueue(report: object): Promise<void>;
     flush(): Promise<number>;
     size(): Promise<number>;
+    private scrubReportPii;
     private getQueue;
     private getAsyncStorage;
 }

package/dist/index.d.ts

@@ -36,6 +36,7 @@ interface DeviceInfo {
     systemName?: string;
     locale?: string;
     timezone?: string;
+    appVersion?: string;
 }
 declare function getDeviceInfo(): DeviceInfo;
 
@@ -189,6 +190,7 @@ declare class AsyncStorageQueue {
     enqueue(report: object): Promise<void>;
     flush(): Promise<number>;
     size(): Promise<number>;
+    private scrubReportPii;
     private getQueue;
     private getAsyncStorage;
 }

package/dist/index.js

@@ -97,16 +97,31 @@ function stripQueryParams(url) {
 }
 
 // src/capture/device-info.ts
-import { Platform, Dimensions, PixelRatio } from "react-native";
+import { Platform, Dimensions, PixelRatio, NativeModules } from "react-native";
 function getDeviceInfo() {
   const { width, height } = Dimensions.get("window");
+  const locale = (
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+    NativeModules.SettingsManager?.settings?.AppleLocale ?? // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+    NativeModules.I18nManager?.localeIdentifier ?? "en"
+  );
+  let timezone = "UTC";
+  try {
+    timezone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+  } catch {
+  }
+  const appVersion = NativeModules.RNDeviceInfo?.appVersion ?? NativeModules.RNBuildConfig?.VERSION_NAME ?? String(Platform.Version);
   return {
     platform: Platform.OS,
     osVersion: Platform.Version,
     screenWidth: width,
     screenHeight: height,
     pixelRatio: PixelRatio.get(),
-    fontScale: PixelRatio.getFontScale()
+    fontScale: PixelRatio.getFontScale(),
+    systemName: Platform.OS,
+    locale,
+    timezone,
+    appVersion
   };
 }
 
@@ -126,7 +141,8 @@ var AsyncStorageQueue = class {
     if (!AsyncStorage) return;
     const queue = await this.getQueue(AsyncStorage);
     if (queue.length >= this.maxSize) queue.shift();
-    queue.push({ report, enqueuedAt: Date.now() });
+    const scrubbedReport = this.scrubReportPii(report);
+    queue.push({ report: scrubbedReport, enqueuedAt: Date.now() });
     await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(queue));
   }
   async flush() {
@@ -137,21 +153,10 @@ var AsyncStorageQueue = class {
     let flushed = 0;
     const remaining = [];
     for (const item of queue) {
-      try {
-        const res = await fetch(`${this.apiEndpoint}/v1/reports`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "X-Mushi-Api-Key": this.apiKey
-          },
-          body: JSON.stringify(item.report)
-        });
-        if (res.ok) {
-          flushed++;
-        } else {
-          remaining.push(item);
-        }
-      } catch {
+      const ok = await sendWithRetry(item, this.apiEndpoint, this.apiKey);
+      if (ok) {
+        flushed++;
+      } else {
         remaining.push(item);
         break;
       }
@@ -165,6 +170,27 @@ var AsyncStorageQueue = class {
     const queue = await this.getQueue(AsyncStorage);
     return queue.length;
   }
+  // Added: PII scrubbing (Phase 2.4)
+  // Scrubs free-text fields where users typically type emails / phones /
+  // card numbers when describing a bug. We deliberately do NOT scrub
+  // structured fields like `metadata.userEmail` — those are explicitly
+  // captured by the host app via `setUser()` and the operator opts in to
+  // collecting them. Scrubbing them here would silently break attribution.
+  scrubReportPii(report) {
+    const next = { ...report };
+    if (typeof next.description === "string") {
+      next.description = scrubPii(next.description);
+    }
+    if (typeof next.summary === "string") {
+      next.summary = scrubPii(next.summary);
+    }
+    if (Array.isArray(next.breadcrumbs)) {
+      next.breadcrumbs = next.breadcrumbs.map(
+        (b) => typeof b?.message === "string" ? { ...b, message: scrubPii(b.message) } : b
+      );
+    }
+    return next;
+  }
   async getQueue(storage) {
     try {
       const raw = await storage.getItem(QUEUE_KEY);
@@ -182,6 +208,63 @@ var AsyncStorageQueue = class {
     }
   }
 };
+var SCRUB_PATTERNS = [
+  [/\b\d{3}-\d{2}-\d{4}\b/g, "[REDACTED_SSN]"],
+  [/\b(?:\d[ -]*){12,18}\d\b/g, "[REDACTED_CC]"],
+  [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, "[REDACTED_AWS_KEY]"],
+  [
+    /(?:aws_secret_access_key|secret_access_key)["'\s:=]+[A-Za-z0-9/+=]{40}\b/gi,
+    "aws_secret_access_key=[REDACTED_AWS_SECRET]"
+  ],
+  [/\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{24,}\b/g, "[REDACTED_STRIPE_KEY]"],
+  [/\bpk_(?:live|test)_[A-Za-z0-9]{24,}\b/g, "[REDACTED_STRIPE_PK]"],
+  [/\bxox[abpor]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED_SLACK_TOKEN]"],
+  [/\bghp_[A-Za-z0-9]{36}\b/g, "[REDACTED_GITHUB_PAT]"],
+  [/\bgithub_pat_[A-Za-z0-9_]{80,}\b/g, "[REDACTED_GITHUB_PAT]"],
+  [/\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g, "[REDACTED_OPENAI_KEY]"],
+  [/\bsk-ant-[A-Za-z0-9_-]{20,}\b/g, "[REDACTED_ANTHROPIC_KEY]"],
+  [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED_GOOGLE_KEY]"],
+  [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED_JWT]"],
+  [/\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/g, "[REDACTED_EMAIL]"],
+  [
+    /(?:\+\d{1,3}[\s.\-])?\(?\d{2,4}\)?[\s.\-]\d{3,4}[\s.\-]\d{3,4}\b/g,
+    "[REDACTED_PHONE]"
+  ]
+];
+function scrubPii(text) {
+  let result = text;
+  for (const [regex, replacement] of SCRUB_PATTERNS) {
+    result = result.replace(regex, replacement);
+  }
+  return result;
+}
+async function sendWithRetry(item, endpoint, apiKey, attempt = 0) {
+  const delay = Math.min(1e3 * Math.pow(2, attempt) + Math.random() * 500, 1e4);
+  try {
+    const res = await fetch(`${endpoint}/v1/reports`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Mushi-Api-Key": apiKey
+      },
+      body: JSON.stringify(item.report)
+    });
+    if ((res.status === 429 || res.status >= 500) && attempt < 3) {
+      await sleep(delay);
+      return sendWithRetry(item, endpoint, apiKey, attempt + 1);
+    }
+    return res.ok;
+  } catch {
+    if (attempt < 3) {
+      await sleep(delay);
+      return sendWithRetry(item, endpoint, apiKey, attempt + 1);
+    }
+    return false;
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 
 // src/components/MushiBottomSheet.tsx
 import {
@@ -585,6 +668,11 @@ function MushiProvider({ children, ...config }) {
   const queueRef = useRef3(null);
   const apiClientRef = useRef3(null);
   const [sheetVisible, setSheetVisible] = useState2(false);
+  if (config.endpoint !== void 0 && config.endpoint.trim() === "") {
+    throw new Error(
+      "[MushiProvider] endpoint is set to an empty string. Set endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api, or omit it to use the cloud default."
+    );
+  }
   const apiEndpoint = config.endpoint ?? DEFAULT_API_ENDPOINT;
   useEffect2(() => {
     if (config.capture?.console !== false) {
@@ -610,6 +698,22 @@ function MushiProvider({ children, ...config }) {
       networkRef.current?.restore();
     };
   }, []);
+  useEffect2(() => {
+    let unsubscribe;
+    (async () => {
+      try {
+        const NetInfo = await new Function("s", "return import(s)")("@react-native-community/netinfo");
+        unsubscribe = NetInfo.default.addEventListener((state) => {
+          if (state.isConnected && state.isInternetReachable) {
+            queueRef.current?.flush().catch(() => {
+            });
+          }
+        });
+      } catch {
+      }
+    })();
+    return () => unsubscribe?.();
+  }, []);
   const open = useCallback3(() => setSheetVisible(true), []);
   const close = useCallback3(() => setSheetVisible(false), []);
   const attachTo = useCallback3(() => ({ onPress: open }), [open]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/react-native",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "license": "MIT",
   "description": "React Native SDK for Mushi Mushi — shake-to-report, bottom sheet widget, full context capture",
   "main": "./dist/index.js",
@@ -8,6 +8,7 @@
   "types": "./dist/index.d.ts",
   "peerDependencies": {
     "@react-native-async-storage/async-storage": ">=1.19",
+    "@react-native-community/netinfo": ">=11",
     "@react-navigation/native": ">=6",
     "expo-sensors": ">=13",
     "react": ">=18",
@@ -22,10 +23,13 @@
     },
     "expo-sensors": {
       "optional": true
+    },
+    "@react-native-community/netinfo": {
+      "optional": true
     }
   },
   "dependencies": {
-    "@mushi-mushi/core": "^0.8.0"
+    "@mushi-mushi/core": "^1.0.0"
   },
   "devDependencies": {
     "@types/react": "^19.1.4",