@quatronic/qore 0.1.3 → 0.1.5

package/README.md

@@ -428,6 +428,26 @@ qore dev --kill-others        # the first module to exit stops the rest
   module that would start is already trusted and has an env file on disk;
   one exception fails the whole run with the original error.
 
+**Feedback.** Before anything starts, a module not yet cloned is offered as
+`Clone <module>, <module> now with qore sync? [Y/n]` (a TTY only, never
+with `--json`/`--no-input`; `--yes` does not accept it). A module sync
+cannot clone (a conflicting directory, no repository yet, an unsupported
+repository URL, GitHub not linked, no repository access) gets its own
+warning naming the real next step, and no prompt. While preflight runs, one progress line per
+module per step (package manager, install, env, ports) is printed as it
+completes. Once every module with a port is either listening or has been
+reported as not running, a one-line summary follows: `✔ All modules
+running:` (or `✔ Running:` / `! Not running:` when some were skipped) lists
+each module with its URL or its reason. A module that crashes while others
+keep running gets a restart hint
+(`Restart it on its own: qore dev --only <module>`, in another terminal;
+the others keep running); on shutdown, a final
+line lists what stopped cleanly and what crashed, with how long it ran.
+When the failure is about the developer's machine rather than the app
+(Docker, Node version, a port busy with something other than a previous
+`qore dev`, a package manager), the error is followed by a pointer to
+`qore doctor` for a full check.
+
 **Output.** Every line of a dev server's own stdout/stderr is prefixed per
 module and column-aligned:
 
@@ -491,6 +511,38 @@ and never in an environment variable.
 - `NODE_EXTRA_CA_CERTS` can point at an additional CA bundle, for portals or
   identity providers behind a corporate proxy with a private root CA.
 
+## Privacy
+
+`qore` sends crash reports to Quatronic so we can find and fix bugs. It is on by
+default; the first interactive run says so once, on stderr.
+
+**What is sent**, to Sentry (EU region, project `qore-cli`):
+
+- errors qore did not anticipate — a bug in qore, not an expected error such as
+  "not logged in" or "port in use";
+- one health record per run: whether it crashed or not;
+- with each: the qore version, the Node version, the OS, whether it ran in CI, the
+  command name (e.g. `env pull`), the stack trace, and the error message;
+- the method, host and status code of the HTTP requests qore made before a crash.
+
+**Removed before sending:** tokens, keys and other secrets, environment variable
+values (including the local env qore fetched), argument values, e-mail addresses,
+URL query strings, and your home directory (paths show as `~`). This is pattern-based:
+an error message about a file qore failed to parse can still quote a fragment of it.
+
+**Never attached:** your hostname, your user account, your tenant, or an IP address.
+qore sends no field that carries an IP; the address a report arrives from is dropped
+by the Sentry project's "Prevent Storing of IP Addresses" setting, part of its infra setup.
+
+**Turning it off** (the first match wins):
+
+1. `DO_NOT_TRACK=1`
+2. `QORE_TELEMETRY=0` (or `QORE_TELEMETRY=1` to turn it on)
+3. `qore config telemetry off` (or `on`)
+
+`qore config telemetry` and `qore doctor` show the current state and where it
+comes from. A build from source or a fork carries no DSN and sends nothing.
+
 ## Releasing
 
 See [RELEASING.md](./RELEASING.md).

package/dist/chunk-QYBDINUC.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a8210538-dc3e-507d-ab33-bdf6a49d6d16")}catch(e){}}();
+import { createRequire as __qoreCreateRequire } from "node:module"; const require = __qoreCreateRequire(import.meta.url);
+
+// src/core/telemetry/scrub.ts
+var SECRET_ENV_KEY = /TOKEN|SECRET|PASSWORD|PASSWD|PRIVATE|API_?KEY|ACCESS_?KEY|DSN|AUTH|CREDENTIAL|COOKIE|SESSION/i;
+var KEEP_CONTEXTS = /* @__PURE__ */ new Set(["runtime", "os"]);
+var PATTERNS = [
+  // an unterminated block runs to the end, so a truncated key is still dropped
+  [/-----BEGIN [A-Z0-9 ]{1,40}-----[\s\S]*?(?:-----END [A-Z0-9 ]{1,40}-----|$)/g, "[pem]"],
+  // query strings and fragments carry OAuth codes, states and signed-URL tokens
+  [/\b([a-z][a-z0-9+.-]{0,30}:\/\/[^\s?#"'<>]*)[?#][^\s"'<>]*/gi, "$1"],
+  [/\b(authorization["']?\s*[=:]\s*)(\[redacted\]|"[^"]*"|'[^']*'|[A-Za-z][A-Za-z0-9_-]{0,30}\s+[^\s,;&]+|[^\s,;&]+)/gi, "$1[redacted]"],
+  [/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [redacted]"],
+  [/\bBasic\s+[A-Za-z0-9+/=]{8,}/gi, "Basic [redacted]"],
+  [/\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]*/g, "[jwt]"],
+  [/\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sntr[ysu]_[A-Za-z0-9+/=_-]{20,}|npm_[A-Za-z0-9]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[abpr]-[A-Za-z0-9-]{10,}|[sr]k_(?:live|test)_[A-Za-z0-9]{10,}|(?:AKIA|ASIA)[0-9A-Z]{16})/g, "[token]"],
+  // URL credentials, which is also what a DSN's public key looks like
+  [/\b([a-z][a-z0-9+.-]{0,30}:\/\/)[^\s/:@]+(?::[^\s/@]*)?@/gi, "$1[redacted]@"],
+  [/[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63}){0,8}\.[A-Za-z]{2,24}\b/g, "[email]"],
+  // affixes are bounded so a long run of key-like characters cannot backtrack quadratically
+  [/\b([A-Za-z0-9_.-]{0,40}(?:(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|private[_-]?key|auth|credential|dsn|session|cookie)[A-Za-z0-9_.-]{0,40}|key))(["']?\s*[=:]\s*)(\[redacted\]|"[^"]*"|'[^']*'|[^\s&,;]+)/gi, "$1$2[redacted]"]
+];
+var escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var longestFirst = (xs, min) => [...new Set(xs.filter((x) => x.length >= min))].sort((a, b) => b.length - a.length);
+function buildScrubContext(o) {
+  const words = new Set(o.commandWords);
+  const argvValues = o.argv.flatMap((a) => {
+    if (a.startsWith("-")) {
+      const i = a.indexOf("=");
+      return i > 0 ? [a.slice(i + 1)] : [];
+    }
+    return words.has(a) ? [] : [a];
+  });
+  const secretEnvValues = Object.entries(o.env).flatMap(([k, v]) => v && SECRET_ENV_KEY.test(k) ? [v] : []);
+  return { home: o.home, platform: o.platform, argvValues: longestFirst(argvValues, 3), secretEnvValues: longestFirst(secretEnvValues, 8) };
+}
+function addSecretValues(ctx, values) {
+  ctx.secretEnvValues = longestFirst([...ctx.secretEnvValues, ...values], 8);
+}
+function replaceLiteral(s, needle, repl, flags) {
+  return s.replace(new RegExp(escapeRe(needle), flags), () => repl);
+}
+function replaceHome(s, ctx) {
+  const win = ctx.platform === "win32";
+  const plain = [ctx.home, ...win ? [ctx.home.replace(/\\/g, "/")] : []];
+  const variants = /* @__PURE__ */ new Set([...plain, ...plain.map((h) => encodeURI(h).replace(/[?#]/g, encodeURIComponent))]);
+  let out = s;
+  for (const h of [...variants].filter((v) => v.length > 1).sort((a, b) => b.length - a.length)) {
+    out = out.replace(new RegExp(`${escapeRe(h)}(?![A-Za-z0-9._-])`, win ? "gi" : "g"), () => "~");
+  }
+  return out;
+}
+function scrubText(s, ctx) {
+  let out = s;
+  for (const v of ctx.secretEnvValues) out = replaceLiteral(out, v, "[env]", "g");
+  for (const v of ctx.argvValues) out = replaceLiteral(out, v, "[arg]", "g");
+  out = replaceHome(out, ctx);
+  for (const [re, repl] of PATTERNS) out = out.replace(re, repl);
+  return out;
+}
+function hostOf(url) {
+  if (typeof url !== "string") return void 0;
+  try {
+    return new URL(url).host;
+  } catch {
+    return void 0;
+  }
+}
+function scrubBreadcrumb(b, ctx) {
+  if (b.category === "console") return null;
+  if (b.type === "http" || b.category === "http" || b.category === "fetch") {
+    const d = b.data ?? {};
+    return {
+      type: b.type,
+      category: b.category,
+      level: b.level,
+      timestamp: b.timestamp,
+      data: { method: d.method ?? d["http.method"], host: hostOf(d.url) ?? d.host, status_code: d.status_code }
+    };
+  }
+  return { ...b, message: b.message === void 0 ? void 0 : scrubText(b.message, ctx), data: void 0 };
+}
+function scrubEvent(e, ctx) {
+  delete e.server_name;
+  delete e.user;
+  delete e.request;
+  delete e.extra;
+  delete e.modules;
+  for (const k of Object.keys(e.contexts ?? {})) if (!KEEP_CONTEXTS.has(k)) delete e.contexts[k];
+  if (e.message !== void 0) e.message = scrubText(e.message, ctx);
+  if (e.logentry?.message !== void 0) {
+    e.logentry.message = scrubText(e.logentry.message, ctx);
+    delete e.logentry.params;
+  }
+  for (const v of e.exception?.values ?? []) {
+    if (v.value !== void 0) v.value = scrubText(v.value, ctx);
+    for (const f of v.stacktrace?.frames ?? []) {
+      if (f.filename) f.filename = replaceHome(f.filename, ctx);
+      if (f.abs_path) f.abs_path = replaceHome(f.abs_path, ctx);
+      if (f.module) f.module = replaceHome(f.module, ctx);
+      delete f.vars;
+      delete f.pre_context;
+      delete f.context_line;
+      delete f.post_context;
+    }
+  }
+  for (const img of e.debug_meta?.images ?? []) if (img.code_file) img.code_file = replaceHome(img.code_file, ctx);
+  if (e.breadcrumbs) e.breadcrumbs = e.breadcrumbs.map((b) => scrubBreadcrumb(b, ctx)).filter((b) => b !== null);
+  return e;
+}
+
+export {
+  buildScrubContext,
+  addSecretValues,
+  scrubBreadcrumb,
+  scrubEvent
+};
+//# sourceMappingURL=chunk-QYBDINUC.js.map
+//# debugId=a8210538-dc3e-507d-ab33-bdf6a49d6d16