@quatronic/qore 0.1.4 → 0.1.5

package/README.md

@@ -511,6 +511,38 @@ and never in an environment variable.
 - `NODE_EXTRA_CA_CERTS` can point at an additional CA bundle, for portals or
   identity providers behind a corporate proxy with a private root CA.
 
+## Privacy
+
+`qore` sends crash reports to Quatronic so we can find and fix bugs. It is on by
+default; the first interactive run says so once, on stderr.
+
+**What is sent**, to Sentry (EU region, project `qore-cli`):
+
+- errors qore did not anticipate — a bug in qore, not an expected error such as
+  "not logged in" or "port in use";
+- one health record per run: whether it crashed or not;
+- with each: the qore version, the Node version, the OS, whether it ran in CI, the
+  command name (e.g. `env pull`), the stack trace, and the error message;
+- the method, host and status code of the HTTP requests qore made before a crash.
+
+**Removed before sending:** tokens, keys and other secrets, environment variable
+values (including the local env qore fetched), argument values, e-mail addresses,
+URL query strings, and your home directory (paths show as `~`). This is pattern-based:
+an error message about a file qore failed to parse can still quote a fragment of it.
+
+**Never attached:** your hostname, your user account, your tenant, or an IP address.
+qore sends no field that carries an IP; the address a report arrives from is dropped
+by the Sentry project's "Prevent Storing of IP Addresses" setting, part of its infra setup.
+
+**Turning it off** (the first match wins):
+
+1. `DO_NOT_TRACK=1`
+2. `QORE_TELEMETRY=0` (or `QORE_TELEMETRY=1` to turn it on)
+3. `qore config telemetry off` (or `on`)
+
+`qore config telemetry` and `qore doctor` show the current state and where it
+comes from. A build from source or a fork carries no DSN and sends nothing.
+
 ## Releasing
 
 See [RELEASING.md](./RELEASING.md).

package/dist/chunk-QYBDINUC.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a8210538-dc3e-507d-ab33-bdf6a49d6d16")}catch(e){}}();
+import { createRequire as __qoreCreateRequire } from "node:module"; const require = __qoreCreateRequire(import.meta.url);
+
+// src/core/telemetry/scrub.ts
+var SECRET_ENV_KEY = /TOKEN|SECRET|PASSWORD|PASSWD|PRIVATE|API_?KEY|ACCESS_?KEY|DSN|AUTH|CREDENTIAL|COOKIE|SESSION/i;
+var KEEP_CONTEXTS = /* @__PURE__ */ new Set(["runtime", "os"]);
+var PATTERNS = [
+  // an unterminated block runs to the end, so a truncated key is still dropped
+  [/-----BEGIN [A-Z0-9 ]{1,40}-----[\s\S]*?(?:-----END [A-Z0-9 ]{1,40}-----|$)/g, "[pem]"],
+  // query strings and fragments carry OAuth codes, states and signed-URL tokens
+  [/\b([a-z][a-z0-9+.-]{0,30}:\/\/[^\s?#"'<>]*)[?#][^\s"'<>]*/gi, "$1"],
+  [/\b(authorization["']?\s*[=:]\s*)(\[redacted\]|"[^"]*"|'[^']*'|[A-Za-z][A-Za-z0-9_-]{0,30}\s+[^\s,;&]+|[^\s,;&]+)/gi, "$1[redacted]"],
+  [/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [redacted]"],
+  [/\bBasic\s+[A-Za-z0-9+/=]{8,}/gi, "Basic [redacted]"],
+  [/\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]*/g, "[jwt]"],
+  [/\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sntr[ysu]_[A-Za-z0-9+/=_-]{20,}|npm_[A-Za-z0-9]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[abpr]-[A-Za-z0-9-]{10,}|[sr]k_(?:live|test)_[A-Za-z0-9]{10,}|(?:AKIA|ASIA)[0-9A-Z]{16})/g, "[token]"],
+  // URL credentials, which is also what a DSN's public key looks like
+  [/\b([a-z][a-z0-9+.-]{0,30}:\/\/)[^\s/:@]+(?::[^\s/@]*)?@/gi, "$1[redacted]@"],
+  [/[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63}){0,8}\.[A-Za-z]{2,24}\b/g, "[email]"],
+  // affixes are bounded so a long run of key-like characters cannot backtrack quadratically
+  [/\b([A-Za-z0-9_.-]{0,40}(?:(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|private[_-]?key|auth|credential|dsn|session|cookie)[A-Za-z0-9_.-]{0,40}|key))(["']?\s*[=:]\s*)(\[redacted\]|"[^"]*"|'[^']*'|[^\s&,;]+)/gi, "$1$2[redacted]"]
+];
+var escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var longestFirst = (xs, min) => [...new Set(xs.filter((x) => x.length >= min))].sort((a, b) => b.length - a.length);
+function buildScrubContext(o) {
+  const words = new Set(o.commandWords);
+  const argvValues = o.argv.flatMap((a) => {
+    if (a.startsWith("-")) {
+      const i = a.indexOf("=");
+      return i > 0 ? [a.slice(i + 1)] : [];
+    }
+    return words.has(a) ? [] : [a];
+  });
+  const secretEnvValues = Object.entries(o.env).flatMap(([k, v]) => v && SECRET_ENV_KEY.test(k) ? [v] : []);
+  return { home: o.home, platform: o.platform, argvValues: longestFirst(argvValues, 3), secretEnvValues: longestFirst(secretEnvValues, 8) };
+}
+function addSecretValues(ctx, values) {
+  ctx.secretEnvValues = longestFirst([...ctx.secretEnvValues, ...values], 8);
+}
+function replaceLiteral(s, needle, repl, flags) {
+  return s.replace(new RegExp(escapeRe(needle), flags), () => repl);
+}
+function replaceHome(s, ctx) {
+  const win = ctx.platform === "win32";
+  const plain = [ctx.home, ...win ? [ctx.home.replace(/\\/g, "/")] : []];
+  const variants = /* @__PURE__ */ new Set([...plain, ...plain.map((h) => encodeURI(h).replace(/[?#]/g, encodeURIComponent))]);
+  let out = s;
+  for (const h of [...variants].filter((v) => v.length > 1).sort((a, b) => b.length - a.length)) {
+    out = out.replace(new RegExp(`${escapeRe(h)}(?![A-Za-z0-9._-])`, win ? "gi" : "g"), () => "~");
+  }
+  return out;
+}
+function scrubText(s, ctx) {
+  let out = s;
+  for (const v of ctx.secretEnvValues) out = replaceLiteral(out, v, "[env]", "g");
+  for (const v of ctx.argvValues) out = replaceLiteral(out, v, "[arg]", "g");
+  out = replaceHome(out, ctx);
+  for (const [re, repl] of PATTERNS) out = out.replace(re, repl);
+  return out;
+}
+function hostOf(url) {
+  if (typeof url !== "string") return void 0;
+  try {
+    return new URL(url).host;
+  } catch {
+    return void 0;
+  }
+}
+function scrubBreadcrumb(b, ctx) {
+  if (b.category === "console") return null;
+  if (b.type === "http" || b.category === "http" || b.category === "fetch") {
+    const d = b.data ?? {};
+    return {
+      type: b.type,
+      category: b.category,
+      level: b.level,
+      timestamp: b.timestamp,
+      data: { method: d.method ?? d["http.method"], host: hostOf(d.url) ?? d.host, status_code: d.status_code }
+    };
+  }
+  return { ...b, message: b.message === void 0 ? void 0 : scrubText(b.message, ctx), data: void 0 };
+}
+function scrubEvent(e, ctx) {
+  delete e.server_name;
+  delete e.user;
+  delete e.request;
+  delete e.extra;
+  delete e.modules;
+  for (const k of Object.keys(e.contexts ?? {})) if (!KEEP_CONTEXTS.has(k)) delete e.contexts[k];
+  if (e.message !== void 0) e.message = scrubText(e.message, ctx);
+  if (e.logentry?.message !== void 0) {
+    e.logentry.message = scrubText(e.logentry.message, ctx);
+    delete e.logentry.params;
+  }
+  for (const v of e.exception?.values ?? []) {
+    if (v.value !== void 0) v.value = scrubText(v.value, ctx);
+    for (const f of v.stacktrace?.frames ?? []) {
+      if (f.filename) f.filename = replaceHome(f.filename, ctx);
+      if (f.abs_path) f.abs_path = replaceHome(f.abs_path, ctx);
+      if (f.module) f.module = replaceHome(f.module, ctx);
+      delete f.vars;
+      delete f.pre_context;
+      delete f.context_line;
+      delete f.post_context;
+    }
+  }
+  for (const img of e.debug_meta?.images ?? []) if (img.code_file) img.code_file = replaceHome(img.code_file, ctx);
+  if (e.breadcrumbs) e.breadcrumbs = e.breadcrumbs.map((b) => scrubBreadcrumb(b, ctx)).filter((b) => b !== null);
+  return e;
+}
+
+export {
+  buildScrubContext,
+  addSecretValues,
+  scrubBreadcrumb,
+  scrubEvent
+};
+//# sourceMappingURL=chunk-QYBDINUC.js.map
+//# debugId=a8210538-dc3e-507d-ab33-bdf6a49d6d16

package/dist/cli.js

@@ -1,5 +1,12 @@
 #!/usr/bin/env node
 
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a70250c5-daf4-5ff3-b490-5556ac377549")}catch(e){}}();
+import { createRequire as __qoreCreateRequire } from "node:module"; const require = __qoreCreateRequire(import.meta.url);
+import {
+  addSecretValues,
+  buildScrubContext
+} from "./chunk-QYBDINUC.js";
+
 // src/cli.ts
 import { homedir as homedir2 } from "os";
 import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici";
@@ -320,7 +327,7 @@ function renderDoctorJson(io2, report) {
   return true;
 }
 var SYMBOL = { ok: "\u2713", warn: "!", fail: "\u2717" };
-var TOOL_IDS = ["qore", "node", "git", "github-ssh", "docker"];
+var TOOL_IDS = ["qore", "node", "git", "github-ssh", "docker", "telemetry"];
 var ROW_WIDTH = 80;
 var COL_B = 36;
 function rawLine(r) {
@@ -435,7 +442,16 @@ function buildProgram(deps2, io2, signal, register, setExitCode) {
   for (const r of register) r(program, ctx);
   return program;
 }
-async function run(argv2, deps2, io2, signal, register) {
+function commandPath(action) {
+  const names = [];
+  for (let c = action; c?.parent; c = c.parent) names.unshift(c.name());
+  return names.join(" ");
+}
+function isCrash(e) {
+  if (e instanceof QoreError || e instanceof CancelledError || e instanceof CommanderError) return false;
+  return !(e instanceof Error && (e.name === "CancelledError" || e.name === "QoreError"));
+}
+async function run(argv2, deps2, io2, signal, register, hooks = {}) {
   const json2 = jsonFromArgv(argv2);
   const parseIo = json2 ? { ...io2, err: () => {
   } } : io2;
@@ -443,8 +459,12 @@ async function run(argv2, deps2, io2, signal, register) {
   const program = buildProgram(deps2, parseIo, signal, register, (code) => {
     state.exitCode = code;
   });
-  program.hook("preAction", (_program, action) => {
+  program.hook("preAction", async (_program, action) => {
     state.command = action.name();
+    try {
+      await hooks.onCommand?.(commandPath(action));
+    } catch {
+    }
   });
   try {
     await program.parseAsync(argv2, { from: "user" });
@@ -456,6 +476,12 @@ async function run(argv2, deps2, io2, signal, register) {
       if (json2) io2.out(JSON.stringify({ ok: false, error: { code: "QORE_CONTEXT_INVALID", message: e.message } }));
       return 2;
     }
+    if (isCrash(e)) {
+      try {
+        hooks.onCrash?.(e);
+      } catch {
+      }
+    }
     const opts = program.opts();
     renderError(io2, e, Boolean(opts.json), pc2.isColorSupported && opts.color !== false);
     if (!opts.json && needsDoctor(e) && state.command !== "doctor") io2.err("Run qore doctor for a full check of your machine.");
@@ -1261,8 +1287,8 @@ async function readAt(dir2) {
 async function readWorkspace(dir2) {
   return readAt(dir2);
 }
-async function findWorkspace(start, home) {
-  let dir2 = resolve(start);
+async function findWorkspace(start2, home) {
+  let dir2 = resolve(start2);
   const stop = resolve(home);
   for (; ; ) {
     const ws = await readAt(dir2);
@@ -1506,6 +1532,48 @@ function registerClone(program, ctx) {
   });
 }
 
+// src/core/telemetry/consent.ts
+var ON = /* @__PURE__ */ new Set(["1", "true", "on", "yes"]);
+var DO_NOT_TRACK_EXEMPT = /* @__PURE__ */ new Set(["0", "false"]);
+var norm = (v) => (v ?? "").trim().toLowerCase();
+function resolveConsent(env, cfg) {
+  const dnt = norm(env.DO_NOT_TRACK);
+  if (dnt !== "" && !DO_NOT_TRACK_EXEMPT.has(dnt)) return { enabled: false, source: "DO_NOT_TRACK" };
+  const q = norm(env.QORE_TELEMETRY);
+  if (q !== "") return { enabled: ON.has(q), source: "QORE_TELEMETRY" };
+  if (typeof cfg.telemetry?.enabled === "boolean") return { enabled: cfg.telemetry.enabled, source: "config" };
+  return { enabled: true, source: "default" };
+}
+function needsNotice(cfg, consent) {
+  return consent.enabled && consent.source === "default" && !cfg.telemetry?.noticeShownAt;
+}
+function describeConsent(consent, built) {
+  const state = `crash reports ${consent.enabled ? "on" : "off"} (${consent.source})`;
+  return consent.enabled && !built ? `${state} \xB7 this build has no DSN, nothing is sent` : state;
+}
+
+// src/cli/commands/config.ts
+function registerConfig(program, ctx) {
+  const config = program.command("config").description("Change qore's own settings");
+  config.command("telemetry").description("Show or set crash reporting").argument("[state]", "on or off").action(async (state) => {
+    const { deps: deps2, io: io2 } = ctx;
+    if (state !== void 0 && state !== "on" && state !== "off") {
+      throw new QoreError("QORE_CONTEXT_INVALID", `Unknown telemetry state: ${state}`, { hint: "Use: qore config telemetry on|off" });
+    }
+    if (state) await deps2.config.update((c) => {
+      c.telemetry = { ...c.telemetry, enabled: state === "on" };
+    });
+    const consent = resolveConsent(deps2.env, await deps2.config.read());
+    const built = deps2.sentryDsn !== "";
+    if (ctx.opts().json) {
+      renderJson(io2, { telemetry: { ...consent, built } });
+      return;
+    }
+    io2.out(describeConsent(consent, built));
+    if (state && consent.source !== "config") io2.err(`${consent.source} in your environment overrides this setting.`);
+  });
+}
+
 // src/cli/commands/dev.ts
 import { randomBytes as randomBytes5 } from "crypto";
 import { realpath as realpath5 } from "fs/promises";
@@ -1583,8 +1651,8 @@ async function readRepoConfig(root) {
 // src/core/context/repoRoot.ts
 import { stat } from "fs/promises";
 import { dirname as dirname2, join as join8, resolve as resolve3 } from "path";
-async function findRepoRoot(start) {
-  let dir2 = resolve3(start);
+async function findRepoRoot(start2) {
+  let dir2 = resolve3(start2);
   for (; ; ) {
     try {
       await stat(join8(dir2, ".git"));
@@ -1968,9 +2036,11 @@ import { dirname as dirname5, join as join12 } from "path";
 async function fetchLocalEnv(deps2, mc, app) {
   await ensureCapability(deps2, mc.portal.apiOrigin, "module.local-env");
   try {
-    return await mc.session.api.get(
+    const local = await mc.session.api.get(
       `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/local-env?app_id=${encodeURIComponent(app.id)}`
     );
+    deps2.registerSecrets(Object.values(local.env));
+    return local;
   } catch (e) {
     if (!(e instanceof QoreError) || e.code !== "QORE_ACCESS_DENIED") throw e;
     if (e.serverCode === "app.access.denied") {
@@ -3182,8 +3252,8 @@ function planDev(modules, sel) {
   }
   const order = sccs.map((_, i) => i).sort((a, b) => minSlug[a].localeCompare(minSlug[b]));
   for (const i of order) visit(i);
-  const start = [];
-  for (const i of orderedSccIndices) start.push(...sccSlugs[i]);
+  const start2 = [];
+  for (const i of orderedSccIndices) start2.push(...sccSlugs[i]);
   const waitFor = {};
   for (const m of starting) {
     const mySccId = sccOf.get(m.id);
@@ -3198,7 +3268,7 @@ function planDev(modules, sel) {
       missingProviders[m.slug] = [...new Set(missing)].sort();
     }
   }
-  return { start, waitFor, cycles, skipped, missingProviders };
+  return { start: start2, waitFor, cycles, skipped, missingProviders };
 }
 
 // src/core/dev/supervisor.ts
@@ -3306,7 +3376,7 @@ function supervise(o) {
       checkDone();
     });
   };
-  const start = async (m) => {
+  const start2 = async (m) => {
     const providers = m.waitFor.filter((p) => readiness.has(p));
     const results = await Promise.all(providers.map((p) => readiness.get(p).promise));
     if (stopCode !== null) return;
@@ -3316,7 +3386,7 @@ function supervise(o) {
     });
     launch(m);
   };
-  for (const m of o.modules) void start(m);
+  for (const m of o.modules) void start2(m);
   checkDone();
   return {
     done,
@@ -4136,6 +4206,14 @@ async function prepareModule(ctx, f, waitTimeout, p) {
   return { root, slug, recipe, env, port: dev.port, pkg, devEnv: dev.env };
 }
 
+// src/cli/commands/debugTelemetry.ts
+function registerDebugTelemetry(program, ctx) {
+  program.command("debug-telemetry", { hidden: true }).description("Send a test crash report").option("--crash", "throw an unexpected error").action((o) => {
+    if (o.crash) throw new Error(`qore debug-telemetry crash in ${ctx.deps.home} token=debug-telemetry-secret`);
+    if (ctx.opts().json) renderJson(ctx.io, { crash: false });
+  });
+}
+
 // src/cli/commands/doctor.ts
 import pc3 from "picocolors";
 
@@ -4421,6 +4499,12 @@ async function resolveRepoModule(deps2, session, portal, meta, root) {
   }
   return session.api.get(`/api/cli/v1/modules/${encodeURIComponent(ids[0])}`);
 }
+function checkTelemetry(deps2, cfg) {
+  const built = deps2.sentryDsn !== "";
+  if (!cfg) return ok("crash reports off (config unreadable)", { enabled: false, source: "config", reason: "unreadable", built });
+  const consent = resolveConsent(deps2.env, cfg);
+  return ok(describeConsent(consent, built), { enabled: consent.enabled, source: consent.source, built });
+}
 async function runDoctor(deps2, o = {}) {
   const signal = o.signal ?? new AbortController().signal;
   const toolMs = o.toolTimeoutMs ?? TOOL_TIMEOUT_MS;
@@ -4440,12 +4524,14 @@ async function runDoctor(deps2, o = {}) {
     return r;
   };
   let cfg;
+  let cfgReadable = true;
   try {
     cfg = await deps2.config.read();
   } catch (e) {
     if (isCancel(e, signal)) throw e;
     await push("config", "tools", () => withError("fail", errorLabel(e), e));
     cfg = { schemaVersion: 1, profiles: {} };
+    cfgReadable = false;
   }
   let ws = null;
   let wsError = null;
@@ -4467,6 +4553,7 @@ async function runDoctor(deps2, o = {}) {
   await push("git", "tools", () => checkGit(deps2, signal, toolMs));
   await push("github-ssh", "tools", () => checkGithubSsh(deps2, signal, toolMs));
   await push("docker", "tools", () => checkDocker(deps2, signal, toolMs));
+  await push("telemetry", "tools", () => checkTelemetry(deps2, cfgReadable ? cfg : null));
   const sessions = /* @__PURE__ */ new Map();
   let loggedIn = [];
   try {
@@ -4745,9 +4832,9 @@ async function createOidc(opts) {
         throw mapOidcError(e, host);
       }
     },
-    async pollDevice(start, signal) {
+    async pollDevice(start2, signal) {
       try {
-        const t = await oc.pollDeviceAuthorizationGrant(config, start.handle, void 0, { signal });
+        const t = await oc.pollDeviceAuthorizationGrant(config, start2.handle, void 0, { signal });
         return toTokenSet(t);
       } catch (e) {
         throw mapOidcError(e, host);
@@ -4774,14 +4861,14 @@ async function createOidc(opts) {
 // src/core/auth/login.ts
 async function deviceLogin(opts) {
   await opts.store.getRefresh();
-  const start = await opts.oidc.startDevice(LOGIN_SCOPE);
+  const start2 = await opts.oidc.startDevice(LOGIN_SCOPE);
   const stopPoll = new AbortController();
   const settled = new AbortController();
-  const poll = opts.oidc.pollDevice(start, AbortSignal.any([opts.signal, stopPoll.signal])).finally(() => settled.abort());
+  const poll = opts.oidc.pollDevice(start2, AbortSignal.any([opts.signal, stopPoll.signal])).finally(() => settled.abort());
   poll.catch(() => {
   });
   try {
-    await opts.onCode(start, settled.signal);
+    await opts.onCode(start2, settled.signal);
   } catch (e) {
     stopPoll.abort();
     const late = await poll.catch(() => null);
@@ -5179,8 +5266,110 @@ var COMMANDS = [
   registerClone,
   registerSync,
   registerVersion,
-  registerDoctor
+  registerConfig,
+  registerDoctor,
+  registerDebugTelemetry
+];
+
+// src/cli/telemetry/notice.ts
+var NOTICE = [
+  "qore sends anonymous crash reports and a per-run health record to Quatronic, to find and fix bugs.",
+  "Tokens, env values and your home path are removed; no user or tenant is attached.",
+  "Turn it off with `qore config telemetry off`, QORE_TELEMETRY=0 or DO_NOT_TRACK=1. See the Privacy section of the README."
 ];
+async function showNoticeOnce(deps2, io2, o) {
+  if (o.json || !io2.interactive || !deps2.sentryDsn) return;
+  try {
+    const cfg = await deps2.config.read();
+    if (!needsNotice(cfg, resolveConsent(deps2.env, cfg))) return;
+    await deps2.config.update((c) => {
+      c.telemetry = { ...c.telemetry, noticeShownAt: deps2.now().toISOString() };
+    });
+  } catch {
+    return;
+  }
+  for (const line2 of NOTICE) io2.err(line2);
+}
+
+// src/cli/telemetry/index.ts
+var CRASH_FLUSH_MS = 2e3;
+var CLEAN_FLUSH_MS = 200;
+var loadSentry = async () => (await import("./sentry-B3MDCAOI.js")).createSdk;
+function createTelemetry(deps2, o) {
+  const load = o.load ?? loadSentry;
+  const flushMs = o.flushMs ?? { crash: CRASH_FLUSH_MS, clean: CLEAN_FLUSH_MS };
+  let sdk = null;
+  let crashed = null;
+  const secrets = [];
+  let scrub = null;
+  return {
+    begin(command) {
+      if (sdk || !deps2.sentryDsn) return;
+      sdk = start(deps2, o.argv, command, load, (ctx) => {
+        scrub = ctx;
+        addSecretValues(ctx, secrets);
+      }).catch(() => null);
+    },
+    crash(e) {
+      crashed ??= { e };
+    },
+    registerSecrets(values) {
+      secrets.push(...values);
+      if (scrub) addSecretValues(scrub, values);
+    },
+    async end(signal) {
+      if (!sdk) return { drained: true };
+      const ms = crashed ? flushMs.crash : flushMs.clean;
+      const work = sdk.then(async (s) => {
+        if (!s) return true;
+        if (crashed) s.crash(crashed.e);
+        return s.end(ms);
+      }).catch(() => false);
+      return { drained: await withDeadline(work, ms, signal) };
+    }
+  };
+}
+async function start(deps2, argv2, command, load, onScrub) {
+  const cfg = await deps2.config.read().catch(() => null);
+  if (!cfg) return null;
+  if (!resolveConsent(deps2.env, cfg).enabled) return null;
+  const create = await load();
+  const scrub = buildScrubContext({ home: deps2.home, platform: deps2.platform, env: deps2.env, argv: argv2, commandWords: command.split(" ") });
+  onScrub(scrub);
+  const sdk = create({
+    dsn: deps2.sentryDsn,
+    environment: deps2.sentryEnvironment,
+    release: deps2.version,
+    tags: { command, "cli.version": deps2.version, "node.version": deps2.nodeVersion, os: deps2.platform, ci: deps2.env.CI ? "true" : "false" },
+    scrub
+  });
+  sdk.start();
+  return sdk;
+}
+function withDeadline(work, ms, signal) {
+  if (signal?.aborted) return Promise.resolve(false);
+  return new Promise((resolve5) => {
+    const done = (v) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      resolve5(v);
+    };
+    const onAbort = () => done(false);
+    const timer = setTimeout(() => done(false), ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+    work.then(done, () => done(false));
+  });
+}
+function telemetryHooks(deps2, io2, t, o) {
+  return {
+    onCommand: async (command) => {
+      if (command === "config telemetry") return;
+      await showNoticeOnce(deps2, io2, o);
+      t.begin(command);
+    },
+    onCrash: (e) => t.crash(e)
+  };
+}
 
 // src/cli/updateCheck.ts
 var REGISTRY_URL = "https://registry.npmjs.org/@quatronic%2Fqore/latest";
@@ -5728,6 +5917,10 @@ var systemPorts = {
   }
 };
 
+// src/buildInfo.ts
+var SENTRY_DSN = true ? "https://50b592efb53dbc1a31cb10d3945c6d52@o4512129906049024.ingest.de.sentry.io/4512174341750864" : "";
+var SENTRY_ENVIRONMENT = true ? "production" : "development";
+
 // src/platform/proxy.ts
 import { execFile as execFile3 } from "child_process";
 
@@ -5790,7 +5983,7 @@ function systemProxy(platform = process.platform) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.4" : "0.0.0-dev";
+var VERSION = true ? "0.1.5" : "0.0.0-dev";
 
 // src/cli.ts
 if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent());
@@ -5833,6 +6026,11 @@ var deps = {
     process.kill(process.pid, signal);
   },
   pid: process.pid,
+  registerSecrets: (values) => {
+    telemetry.registerSecrets(values);
+  },
+  sentryDsn: SENTRY_DSN,
+  sentryEnvironment: SENTRY_ENVIRONMENT,
   systemProxy: () => systemProxy(process.platform)
 };
 var termination = preflightTermination(() => ac.abort(), deps.raise);
@@ -5843,16 +6041,24 @@ var io = processIo(isInteractive({
   noInput: preSeparatorArgv.includes("--no-input"),
   env: process.env
 }));
-process.exitCode = await run(argv, deps, io, ac.signal, COMMANDS);
-await termination.reRaise(async () => {
+var flushStd = async () => {
   await Promise.all([process.stdout, process.stderr].map((s) => new Promise((r) => {
     s.write("", () => r());
   })));
-});
+};
+var telemetry = createTelemetry(deps, { argv });
+process.exitCode = await run(argv, deps, io, ac.signal, COMMANDS, telemetryHooks(deps, io, telemetry, { json }));
+var { drained } = await telemetry.end(ac.signal);
+await termination.reRaise(flushStd);
 if (!ac.signal.aborted) {
   try {
     await maybeNotifyUpdate(deps, io, { json });
   } catch {
   }
 }
-//# sourceMappingURL=cli.js.map
+if (!drained) {
+  await flushStd();
+  process.exit();
+}
+//# sourceMappingURL=cli.js.map
+//# debugId=a70250c5-daf4-5ff3-b490-5556ac377549