claude-spotter 1.8.1 → 1.9.0

package/CHANGELOG.md

@@ -3,6 +3,10 @@
 各節はそのversion公開時点の変更記録であり、後続versionにより置換された仕様を含む。
 現行runtime契約は[`docs/00_overview.md`](https://github.com/kitepon/Spotter/blob/main/docs/00_overview.md)から辿る。
 
+## 1.9.0 — 2026-10-03
+
+- Spotter自身が端末内runtime-errorの累計をBugHubへ送るopt-in CLIを追加。署名済み受領だけでackし、既定では通信しない。
+
 ## 1.8.1 — 2026-10-03
 
 - Jev監査の大きなtool catalogを入力上限内のリクエストへ分け、全候補の判定とtoken usageを統合する。

package/README.ja.md

@@ -22,7 +22,7 @@
 project marker、catalog discoveryとhost-local tool DB、評価store、dashboard server、
 diagnostics、installer、release packagingを所有します。
 [dotagents](https://github.com/kitepon/dotagents)が所有するのは共有agent指示と、
-Spotterの端末内runtime-error集計を有効化する任意のfactory-reporter設定です。
+旧来の端末内runtime-error集計に使える任意のfactory-reporter設定です。実行時エラーの送信はSpotterが所有します。
 Spotterのcatalogやhost統合はdotagentsの責務ではありません。MarkItDownは別区分の第三者CLIです。
 
 Claude には「使えるツールがあるのに、使うべきタイミングで使わない」という構造的な弱点があります。記録すべき決定を memory / caveat MCP に残さない、docs lookup MCP を呼ばずに古い知識で応答する、ブラウザ自動化 MCP で確認せず UI 状態を推測する — **「分からないと自覚できない」から、ツールを取りに行けない**。
@@ -290,9 +290,10 @@ dashboardの2つのPowerShell actionを非対話・console非表示で起動す
 
 ## 端末内runtime error集計
 
-factory diagnosticsとruntime error集計は既定OFFです。canonicalなdotagents factory reporter設定で
-JSON booleanの`collection.enabled: true`が明示された場合だけ、固定codeの失敗を端末内へ集計します。
-Spotterはreporting credentialもnetwork送信経路も持ちません。保存APIは固定templateとallow-list済み集計だけを受け付け、
+factory diagnosticsとruntime error集計は既定OFFです。Spotter専用設定で
+`collection.enabled: true`を明示した場合、固定codeの失敗を端末内へ集計します。この設定が無い端末では、
+旧dotagents factory reporter設定を収集だけの互換入力として読みます。送信はSpotter専用設定の
+`reporting.enabled: true`で別に明示した時だけ行い、既定では通信しません。保存APIは固定templateとallow-list済み集計だけを受け付け、
 例外本文、stdout/stderr、stack、prompt、hook payload、finding、ファイル内容、絶対pathを保存しません。
 
 daemonとCodex hookの収集境界は、bounded timeout付きのkill可能なchild process groupで実行します。
@@ -305,6 +306,19 @@ readbackを検証します。
 受理後のlifecycle操作です。`spotter diagnostics logs`と`spotter diagnostics factory`はboundedな件数と
 statusだけを返し、store/config pathやrecord本文を出しません。
 
+指揮官の端末で送信を有効にする場合、所有者だけが読める通常ファイル（0600）を
+`~/.config/spotter/runtime-errors.json`（Windowsは`%LOCALAPPDATA%\Spotter\runtime-errors-config.json`）
+に置きます。内容は`{"schema_version":"1.0","collection":{"enabled":true},"reporting":{"enabled":true}}`です。
+BugHub担当が別途、端末ごとの合鍵を`~/.config/bughub/product-credentials/spotter.json`
+（Windowsは`%LOCALAPPDATA%\bughub\product-credentials\spotter.json`）へ置きます。
+`spotter runtime-errors report`を実行し、継続時はlaunchd、systemd user timer、Windows Task Schedulerで
+同じコマンドを1時間に1回起動します。未受領だけを送信し、署名を検証した200応答だけでackします。
+配布物の`ops/runtime-reporting/`にlaunchdとsystemd user timerの雛形があります。
+`REPLACE_WITH_ABSOLUTE_SPOTTER_PATH`を導入済みCLIの絶対pathへ替えてから登録します。
+Windowsでは同じ利用者のTask Schedulerへ`spotter.cmd runtime-errors report`を1時間ごとに登録します。
+422が返った版は再送を止め、修正版を導入すると再試行します。無効化は`reporting.enabled`を`false`にします。
+401/403で拒まれた合鍵は入れ替わるまで再送を止めます。時計ずれはackせず、時刻修正後に再試行します。
+
 Primary auditor backend policy: Claude hooks の auto selection は PATH に Codex CLI があれば Codex CLI、
 なければ Haiku compatibility path。Codex native hooks の auto selection は Codex CLI です。
 `SPOTTER_AUDITOR_BACKEND` の明示 override はどちらの host でも優先し、runtime failure では別 backend へ

package/README.md

@@ -21,8 +21,8 @@ This repository owns the complete Spotter product surface: auditor behavior,
 Claude/Codex/Cursor/Grok hook adapters, project markers, catalog discovery and host-local
 tool databases, evaluation storage, dashboard servers, diagnostics, installers,
 and release packaging. [dotagents](https://github.com/kitepon/dotagents)
-owns shared agent instructions and the optional factory-reporter configuration
-that enables Spotter's local runtime-error aggregate; it does not own Spotter's
+owns shared agent instructions and an optional legacy factory-reporter configuration
+for local collection; Spotter owns its product runtime-error reporting; dotagents does not own Spotter's
 catalog or host integration. MarkItDown is a separate third-party CLI.
 
 Claude has a structural blind spot: **it can't reach for a tool it doesn't realize it needs**. It may skip a project memory MCP when a decision should be recorded, answer from stale memory instead of a docs-lookup MCP, or reason about UI state without a browser-automation MCP. The model can't always tell when it doesn't know — so the tool stays unused.
@@ -305,17 +305,18 @@ otherwise the Haiku-compatible path. Codex native hooks automatically select Cod
 error aggregate は collection が既定OFFです。npm `latest`、tag / GitHub Release、
 公開CI、registry由来installを確認済みです。
 
-Spotter collects fixed-code runtime failures only when the canonical dotagents factory reporter
-configuration contains the JSON boolean `collection.enabled: true`. Missing, malformed, and disabled
-configuration all fail closed. Collection is local-only: Spotter has no reporting credential or network
-transport code. The owner-private atomic store contains only fixed templates and allow-listed aggregates;
+Spotter collects fixed-code runtime failures when its owner-private product config contains
+`collection.enabled: true`. If that config is absent, the old canonical dotagents factory reporter
+config remains a collection-only compatibility input. Malformed or disabled product config fails closed.
+Reporting is independently opt-in with `reporting.enabled: true`; the default makes no network request.
+The owner-private atomic store contains only fixed templates and allow-listed aggregates;
 raw exceptions, stdout/stderr, stacks, prompts, hook payloads, findings, file contents, and absolute paths
 are not accepted by its API.
 
 Daemon and direct Codex-hook owner boundaries perform collection in a killable child-process group with
-a bounded timeout. A blocked FIFO or descendant therefore cannot stall the hook or daemon. HTTP reporting
-metadata, when present in the shared config, is accepted only when `new URL(value).href === value` and the
-scheme is HTTP(S); Spotter still neither reads credentials nor sends the aggregate anywhere.
+a bounded timeout. A blocked FIFO or descendant therefore cannot stall the hook or daemon. The product
+report command reads only Spotter's opt-in config and the owner-private BugHub credential, never factory
+reporting metadata. It sends only fixed aggregate fields to the configured owner-LAN BugHub endpoint.
 
 On POSIX, every config/store read revalidates the current uid and exact `0600` file / `0700` directory
 modes. Store mutations use a private SQLite `BEGIN IMMEDIATE` mutex that the OS releases on process crash;
@@ -330,6 +331,27 @@ and `spotter diagnostics factory` include only bounded store counts/status, neve
 or record payload. Programmatic consumers can import `readRuntimeErrorSnapshot`,
 `acknowledgeRuntimeErrors`, `resolveRuntimeError`, `reopenRuntimeError`, and `compactRuntimeErrors`.
 Acknowledgement is monotonic, and compaction never removes an unacknowledged record.
+
+To enable owner-LAN reporting on one terminal, create the following `0600` owner-owned regular file
+at `~/.config/spotter/runtime-errors.json` (Windows: `%LOCALAPPDATA%\Spotter\runtime-errors-config.json`):
+
+```json
+{"schema_version":"1.0","collection":{"enabled":true},"reporting":{"enabled":true}}
+```
+
+BugHub's operator supplies a separate `0600` credential at
+`~/.config/bughub/product-credentials/spotter.json` (Windows:
+`%LOCALAPPDATA%\bughub\product-credentials\spotter.json`). Run `spotter runtime-errors report`
+once, then schedule the same command hourly with launchd, a systemd user timer, or Windows Task Scheduler.
+The package includes launchd and systemd templates in `ops/runtime-reporting/`; replace
+`REPLACE_WITH_ABSOLUTE_SPOTTER_PATH` with the installed CLI path before registering them. On Windows,
+register an hourly task for the installed `spotter.cmd runtime-errors report` under the same user account.
+Only unacknowledged records are sent. A signed 200 response advances the cursor; timeout, 5xx, or an
+unverified response leaves it pending. A 422 blocks further sends for that installed version until a
+corrected Spotter version is installed; the block marker is under the private `~/.spotter` state directory
+(Windows: `%LOCALAPPDATA%\Spotter`). A rejected 401/403 credential is paused until it is rotated;
+clock-skew responses leave the cursor pending for a later attempt. Disable reporting by changing
+`reporting.enabled` to `false`.
 The Codex SessionStart hook refreshes `.spotter/tool-db.codex.json` in the background
 without touching the Claude DB.
 Codex CLI auditor child processes use a versioned product policy. The production selection is

package/bin/spotter.mjs

@@ -12,6 +12,7 @@ import { runCursorHookCommand } from '../src/cli/cursor-hook-cmd.mjs';
 import { runGrokHookCommand } from '../src/cli/grok-hook-cmd.mjs';
 import { runAuditorCommand } from '../src/cli/auditor-cmd.mjs';
 import { runDiagnosticsCommand } from '../src/cli/diagnostics-cmd.mjs';
+import { runRuntimeErrorReportCommand } from '../src/cli/runtime-error-report-cmd.mjs';
 import { runEvaluationCommand } from '../src/cli/evaluation-cmd.mjs';
 import { runDashboardCommand } from '../src/cli/dashboard-cmd.mjs';
 import {
@@ -53,6 +54,7 @@ Usage:
   spotter diagnostics factory           emit a fixed-field read-only JSON diagnostic
   spotter diagnostics runtime-errors [snapshot|ack|resolve|reopen|compact]
                                         consume the local allow-listed aggregate store
+  spotter runtime-errors report          send pending aggregates to the owner LAN BugHub (opt-in)
   spotter evaluation report [--project PATH] [--from ISO] [--to ISO] [--host HOST]
                             [--tool-id ID] [--backend NAME] [--model NAME]
                             [--spotter-version VERSION] [--json]
@@ -151,6 +153,10 @@ async function main() {
       }
       await runDiagnosticsCommand({ argv: rest });
       return;
+    case 'runtime-errors':
+      if (rest[0] !== 'report') throw Object.assign(new Error('usage: spotter runtime-errors report'), { exitCode: 2 });
+      await runRuntimeErrorReportCommand({ argv: rest.slice(1) });
+      return;
     case 'evaluation':
       await runEvaluationCommand({ argv: rest });
       return;

package/ops/runtime-reporting/dev.spotter.runtime-errors.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>dev.spotter.runtime-errors</string>
+  <key>ProgramArguments</key><array>
+    <string>REPLACE_WITH_ABSOLUTE_SPOTTER_PATH</string>
+    <string>runtime-errors</string><string>report</string>
+  </array>
+  <key>StartInterval</key><integer>3600</integer>
+</dict></plist>

package/ops/runtime-reporting/spotter-runtime-errors.service

@@ -0,0 +1,6 @@
+[Unit]
+Description=Send pending Spotter runtime errors to owner-LAN BugHub
+
+[Service]
+Type=oneshot
+ExecStart=REPLACE_WITH_ABSOLUTE_SPOTTER_PATH runtime-errors report

package/ops/runtime-reporting/spotter-runtime-errors.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Report pending Spotter runtime errors hourly
+
+[Timer]
+OnStartupSec=5m
+OnUnitActiveSec=1h
+Unit=spotter-runtime-errors.service
+
+[Install]
+WantedBy=timers.target

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-spotter",
-  "version": "1.8.1",
+  "version": "1.9.0",
   "description": "Audit agent running alongside Claude Code that catches missed tool calls — 気づく役と実行する役の分離",
   "type": "module",
   "bin": {
@@ -50,6 +50,7 @@
     "src",
     "scripts",
     "ops/dashboard",
+    "ops/runtime-reporting",
     "docs/11_dashboard-operations.md",
     "README.md",
     "LICENSE",

package/src/cli/runtime-error-report-cmd.mjs

@@ -0,0 +1,16 @@
+import { reportRuntimeErrors } from '../core/runtime-error-reporter.mjs';
+
+export async function runRuntimeErrorReportCommand({ argv = [], write = (line) => process.stdout.write(line) } = {}) {
+  if (argv.length !== 0) {
+    const error = new Error('usage: spotter runtime-errors report');
+    error.exitCode = 2;
+    throw error;
+  }
+  let result;
+  try { result = await reportRuntimeErrors(); }
+  catch {
+    result = { status: 'report_unavailable' };
+  }
+  write(`${JSON.stringify(result)}\n`);
+  if (!['accepted', 'nothing_to_report', 'disabled'].includes(result.status)) process.exitCode = 1;
+}

package/src/core/runtime-error-reporter.mjs

@@ -0,0 +1,196 @@
+import { createHash, createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import { version } from '../version.mjs';
+import { readOwnerPrivateFile, writeOwnerPrivateFile } from '../platform/owner-private-file.mjs';
+import {
+  acknowledgeRuntimeErrors,
+  defaultRuntimeErrorStorePath,
+  readRuntimeErrorSnapshot,
+  readRuntimeErrorStoreStatus,
+} from './runtime-error-store.mjs';
+import { readRuntimeReportConfig, readRuntimeReportCredential } from './runtime-report-config.mjs';
+
+const MAX_BODY_BYTES = 512 * 1024;
+const FIELDS = [
+  'fingerprint', 'error_code', 'component', 'message_template', 'severity', 'status',
+  'occurrence_count', 'first_seen', 'last_seen', 'product_version', 'state_schema_version',
+];
+
+export function signRuntimeReport(secret, ts, bodyBytes) {
+  const digest = createHash('sha256').update(bodyBytes).digest('hex');
+  return createHmac('sha256', Buffer.from(secret, 'utf8')).update(`${ts}\n${digest}`).digest('hex');
+}
+
+export function signRuntimeReportReceipt(secret, reportId, receivedAt) {
+  return createHmac('sha256', Buffer.from(secret, 'utf8'))
+    .update(`${reportId}\n${receivedAt}`).digest('hex');
+}
+
+function verifiedReceipt(value, reportId, secret) {
+  if (!value || value.accepted !== true || value.report_id !== reportId
+    || typeof value.received_at !== 'string' || typeof value.sig !== 'string'
+    || !/^[a-f0-9]{64}$/.test(value.sig)) return false;
+  const expected = signRuntimeReportReceipt(secret, reportId, value.received_at);
+  return timingSafeEqual(Buffer.from(value.sig, 'hex'), Buffer.from(expected, 'hex'));
+}
+
+function project(record) {
+  const item = Object.fromEntries(FIELDS.filter((field) => record[field] !== undefined)
+    .map((field) => [field, record[field]]));
+  const resolution = record.status === 'resolved'
+    ? { fingerprint: record.fingerprint, resolved_at: record.resolved_at, reason_code: record.reason_code }
+    : null;
+  return { item, resolution };
+}
+
+function blockPath(storeOptions) {
+  return join(dirname(storeOptions.storePath ?? defaultRuntimeErrorStorePath(storeOptions)), 'runtime-report-blocked-v1.json');
+}
+
+function credentialBlockPath(storeOptions) {
+  return join(dirname(storeOptions.storePath ?? defaultRuntimeErrorStorePath(storeOptions)), 'runtime-report-credential-blocked-v1.json');
+}
+
+function credentialTag(credential) {
+  return createHash('sha256').update(`${credential.key_id}\n${credential.secret}`, 'utf8').digest('hex');
+}
+
+async function readBlockedCredential(storeOptions) {
+  try {
+    const value = JSON.parse(await readOwnerPrivateFile(credentialBlockPath(storeOptions), storeOptions));
+    return value?.schema === 'spotter.runtime_report_credential_block.v1' && /^[a-f0-9]{64}$/.test(value.tag)
+      ? value.tag : null;
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+async function writeBlockedCredential(storeOptions, tag) {
+  await writeOwnerPrivateFile(
+    credentialBlockPath(storeOptions),
+    JSON.stringify({ schema: 'spotter.runtime_report_credential_block.v1', tag }),
+    storeOptions,
+  );
+}
+
+async function responseCode(response) {
+  try {
+    const raw = await response.text();
+    if (Buffer.byteLength(raw, 'utf8') > 16_384) return null;
+    const value = JSON.parse(raw);
+    return typeof value.code === 'string' ? value.code
+      : typeof value.error === 'string' ? value.error
+        : typeof value.error?.code === 'string' ? value.error.code : null;
+  } catch { return null; }
+}
+
+async function readBlockedVersion(storeOptions) {
+  try {
+    const value = JSON.parse(await readOwnerPrivateFile(blockPath(storeOptions), storeOptions));
+    return value?.schema === 'spotter.runtime_report_block.v1' && typeof value.version === 'string'
+      ? value.version : null;
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+async function writeBlockedVersion(storeOptions, installedVersion) {
+  await writeOwnerPrivateFile(
+    blockPath(storeOptions),
+    JSON.stringify({ schema: 'spotter.runtime_report_block.v1', version: installedVersion }),
+    storeOptions,
+  );
+}
+
+export async function reportRuntimeErrors(options = {}) {
+  const config = await (options.readConfig ?? readRuntimeReportConfig)(options);
+  if (config.state !== 'valid' || !config.collectionEnabled || !config.reportingEnabled) {
+    return { status: 'disabled', reason: config.state };
+  }
+  const storeOptions = options.storeOptions ?? {};
+  const status = await (options.readStatus ?? readRuntimeErrorStoreStatus)(storeOptions);
+  if (status.store === 'unavailable') return { status: 'store_unavailable' };
+  if (status.unacknowledged === 0) return { status: 'nothing_to_report' };
+  const snapshot = await (options.readSnapshot ?? readRuntimeErrorSnapshot)({
+    ...storeOptions, afterCursor: status.acknowledged_through, limit: 500,
+  });
+  if (snapshot.collection !== 'enabled' || snapshot.records.length === 0) {
+    return { status: 'nothing_to_report' };
+  }
+  const installedVersion = options.installedVersion ?? version;
+  if (await (options.readBlockedVersion ?? readBlockedVersion)(storeOptions) === installedVersion) {
+    return { status: 'invalid_report_blocked' };
+  }
+  const credential = await (options.readCredential ?? readRuntimeReportCredential)(options);
+  const tag = credentialTag(credential);
+  if (await (options.readBlockedCredential ?? readBlockedCredential)(storeOptions) === tag) {
+    return { status: 'credential_rejected_blocked' };
+  }
+  const at = new Date(options.nowMs ?? Date.now());
+  const ts = String(Math.floor(at.getTime() / 1000));
+  const reportId = (options.uuid ?? randomUUID)();
+  const payload = {
+    schema_version: '1.0', report_id: reportId, product_id: 'spotter',
+    installed_version: installedVersion,
+    observed_at: at.toISOString(), runtime_errors: [], resolutions: [],
+  };
+  let cursor = status.acknowledged_through;
+  let body;
+  for (const record of snapshot.records.slice(0, 500)) {
+    const { item, resolution } = project(record);
+    payload.runtime_errors.push(item);
+    if (resolution) payload.resolutions.push(resolution);
+    const candidate = Buffer.from(JSON.stringify(payload), 'utf8');
+    if (candidate.length > MAX_BODY_BYTES) {
+      payload.runtime_errors.pop();
+      if (resolution) payload.resolutions.pop();
+      if (cursor === status.acknowledged_through) return { status: 'record_too_large' };
+      break;
+    }
+    body = candidate;
+    cursor = record.sequence;
+  }
+  const sig = signRuntimeReport(credential.secret, ts, body);
+  let response;
+  try {
+    response = await (options.fetchFn ?? fetch)(credential.url, {
+      method: 'POST', redirect: 'manual', signal: AbortSignal.timeout(10_000), body,
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `BugHub-HMAC-SHA256 key_id=${credential.key_id}, ts=${ts}, sig=${sig}`,
+      },
+    });
+  } catch {
+    return { status: 'unconfirmed', count: payload.runtime_errors.length };
+  }
+  if (response.status === 401 && await responseCode(response) === 'timestamp_skew') {
+    return { status: 'clock_skew' };
+  }
+  if (response.status === 401 || response.status === 403) {
+    await (options.writeBlockedCredential ?? writeBlockedCredential)(storeOptions, tag);
+    return { status: 'credential_rejected' };
+  }
+  if (response.status === 422 && await responseCode(response) === 'observed_at_skew') {
+    return { status: 'clock_skew' };
+  }
+  if (response.status === 422) {
+    await (options.writeBlockedVersion ?? writeBlockedVersion)(storeOptions, installedVersion);
+    return { status: 'invalid_report', count: payload.runtime_errors.length };
+  }
+  if (response.status !== 200) return { status: 'unconfirmed', httpStatus: response.status, count: payload.runtime_errors.length };
+  let receipt;
+  try {
+    const raw = await response.text();
+    if (Buffer.byteLength(raw, 'utf8') > 16_384) throw new Error('oversized receipt');
+    receipt = JSON.parse(raw);
+  } catch {
+    return { status: 'unconfirmed', count: payload.runtime_errors.length };
+  }
+  if (!verifiedReceipt(receipt, reportId, credential.secret)) {
+    return { status: 'unconfirmed', count: payload.runtime_errors.length };
+  }
+  const ack = await (options.acknowledge ?? acknowledgeRuntimeErrors)({ cursor }, storeOptions);
+  return { status: ack.acknowledged ? 'accepted' : 'ack_failed', count: payload.runtime_errors.length, cursor };
+}

package/src/core/runtime-error-store-worker.mjs

@@ -14,13 +14,14 @@ async function main() {
     process.exit(2);
   }
   const allowed = action === 'observe'
-    ? new Set(['configPath', 'storePath', 'productVersion', 'platform', 'arch', 'beforeOpenDelayMs', 'observationId'])
-    : new Set(['configPath', 'storePath', 'productVersion', 'platform', 'arch', 'observationId', 'expectedFingerprint', 'waitMs']);
+    ? new Set(['configPath', 'productConfigPath', 'storePath', 'productVersion', 'platform', 'arch', 'beforeOpenDelayMs', 'observationId'])
+    : new Set(['configPath', 'productConfigPath', 'storePath', 'productVersion', 'platform', 'arch', 'observationId', 'expectedFingerprint', 'waitMs']);
   const required = new Set(['configPath', 'storePath', 'productVersion', 'platform', 'arch', 'observationId']);
   if (!options || typeof options !== 'object' || Array.isArray(options)
     || Object.keys(options).some((key) => !allowed.has(key))
     || [...required].some((key) => !Object.hasOwn(options, key))
     || (options.configPath !== null && (typeof options.configPath !== 'string' || options.configPath.length > 4_096))
+    || ('productConfigPath' in options && (typeof options.productConfigPath !== 'string' || options.productConfigPath.length < 1 || options.productConfigPath.length > 4_096))
     || typeof options.storePath !== 'string' || options.storePath.length < 1 || options.storePath.length > 4_096
     || typeof options.productVersion !== 'string' || options.productVersion.length < 1 || options.productVersion.length > 64
     || typeof options.platform !== 'string' || !/^[a-z0-9_-]{1,32}$/.test(options.platform)

package/src/core/runtime-error-store.mjs

@@ -16,6 +16,7 @@ import { DatabaseSync } from 'node:sqlite';
 import { fileURLToPath } from 'node:url';
 import { version } from '../version.mjs';
 import { WINDOWS_POWERSHELL_COMMAND } from '../platform/spawn.mjs';
+import { readRuntimeReportConfig } from './runtime-report-config.mjs';
 
 export const RUNTIME_ERROR_STORE_SCHEMA = 'spotter.runtime_errors.v1';
 export const RUNTIME_ERROR_STATE_SCHEMA_VERSION = '1.0';
@@ -109,6 +110,15 @@ export function runtimeErrorFingerprint(definition) {
 }
 
 export async function readRuntimeCollectionMode(options = {}) {
+  if (options.configPath == null) {
+    const product = await readRuntimeReportConfig(options);
+    if (product.state !== 'missing') {
+      if (product.state === 'malformed') return { mode: 'config_malformed', enabled: false };
+      return product.collectionEnabled
+        ? { mode: 'enabled', enabled: true }
+        : { mode: 'disabled', enabled: false };
+    }
+  }
   const configPath = options.configPath ?? defaultFactoryReporterConfigPath(options);
   if (!configPath) return { mode: 'config_missing', enabled: false };
   let raw;
@@ -223,7 +233,8 @@ export async function observeRuntimeErrorIsolatedSafe(input, options = {}) {
   const observationId = randomUUID().replaceAll('-', '');
   const expectedFingerprint = runtimeErrorFingerprint(RUNTIME_ERROR_DEFINITIONS[kind]);
   const workerOptions = {
-    configPath: options.configPath ?? defaultFactoryReporterConfigPath(options),
+    configPath: options.configPath ?? null,
+    productConfigPath: options.productConfigPath,
     storePath: options.storePath ?? defaultRuntimeErrorStorePath(options),
     productVersion: options.productVersion ?? version,
     platform: options.platform ?? process.platform,

package/src/core/runtime-report-config.mjs

@@ -0,0 +1,58 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { readOwnerPrivateFile } from '../platform/owner-private-file.mjs';
+
+export const BUGHUB_RUNTIME_ERROR_URL = 'http://192.168.1.2:39310/api/products/v1/runtime-errors';
+
+export function defaultRuntimeReportConfigPath({ env = process.env, platform = process.platform, homeDir = homedir() } = {}) {
+  if (platform === 'win32') return join(env.LOCALAPPDATA || homeDir, 'Spotter', 'runtime-errors-config.json');
+  return join(env.XDG_CONFIG_HOME || join(homeDir, '.config'), 'spotter', 'runtime-errors.json');
+}
+
+export function defaultRuntimeReportCredentialPath({ env = process.env, platform = process.platform, homeDir = homedir() } = {}) {
+  if (platform === 'win32') return join(env.LOCALAPPDATA || homeDir, 'bughub', 'product-credentials', 'spotter.json');
+  return join(homeDir, '.config', 'bughub', 'product-credentials', 'spotter.json');
+}
+
+export async function readRuntimeReportConfig(options = {}) {
+  const path = options.productConfigPath ?? defaultRuntimeReportConfigPath(options);
+  let raw;
+  try { raw = await readOwnerPrivateFile(path, options); }
+  catch (error) {
+    if (error?.code === 'ENOENT') return { state: 'missing', collectionEnabled: false, reportingEnabled: false };
+    return { state: 'malformed', collectionEnabled: false, reportingEnabled: false };
+  }
+  try {
+    const value = JSON.parse(raw);
+    if (!exactKeys(value, ['schema_version', 'collection', 'reporting'])
+      || value.schema_version !== '1.0'
+      || !exactKeys(value.collection, ['enabled']) || typeof value.collection.enabled !== 'boolean'
+      || !exactKeys(value.reporting, ['enabled']) || typeof value.reporting.enabled !== 'boolean') {
+      throw new Error('invalid config');
+    }
+    return {
+      state: 'valid',
+      collectionEnabled: value.collection.enabled,
+      reportingEnabled: value.reporting.enabled,
+    };
+  } catch {
+    return { state: 'malformed', collectionEnabled: false, reportingEnabled: false };
+  }
+}
+
+export async function readRuntimeReportCredential(options = {}) {
+  const path = options.credentialPath ?? defaultRuntimeReportCredentialPath(options);
+  const value = JSON.parse(await readOwnerPrivateFile(path, options));
+  if (!exactKeys(value, ['url', 'key_id', 'secret'])
+    || value.url !== BUGHUB_RUNTIME_ERROR_URL
+    || typeof value.key_id !== 'string' || !/^[A-Za-z0-9._:-]{1,128}$/.test(value.key_id)
+    || typeof value.secret !== 'string' || value.secret.length < 16 || value.secret.length > 1024) {
+    throw new Error('invalid runtime report credential');
+  }
+  return value;
+}
+
+function exactKeys(value, keys) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}

package/src/platform/owner-private-file.mjs

@@ -0,0 +1,82 @@
+import { constants } from 'node:fs';
+import { chmod, lstat, open, rename, rm, writeFile } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { WINDOWS_POWERSHELL_COMMAND } from './spawn.mjs';
+
+export async function readOwnerPrivateFile(path, { platform = process.platform } = {}) {
+  const info = await lstat(path);
+  if (!info.isFile() || info.isSymbolicLink()) throw new Error('private file type is unsafe');
+  if (platform === 'win32') await checkWindowsOwnerAcl(path);
+  else if (info.uid !== process.getuid() || (info.mode & 0o777) !== 0o600) {
+    throw new Error('private file ownership or mode is unsafe');
+  }
+  const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const opened = await handle.stat();
+    if (!opened.isFile() || opened.dev !== info.dev || opened.ino !== info.ino) {
+      throw new Error('private file changed during read');
+    }
+    if (platform !== 'win32' && (opened.uid !== process.getuid() || (opened.mode & 0o777) !== 0o600)) {
+      throw new Error('private file ownership or mode changed');
+    }
+    return new TextDecoder('utf-8', { fatal: true }).decode(await handle.readFile());
+  } finally {
+    await handle.close();
+  }
+}
+
+function checkWindowsOwnerAcl(path) {
+  const script = [
+    '$ErrorActionPreference = "Stop"',
+    '$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value',
+    '$admins = "S-1-5-32-544"',
+    '$system = "S-1-5-18"',
+    '$acl = Get-Acl -LiteralPath $env:SPOTTER_PRIVATE_FILE',
+    '$owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value',
+    '$rules = @($acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))',
+    '$unsafe = @($rules | Where-Object { $_.AccessControlType -eq "Allow" -and @($sid, $admins, $system) -notcontains $_.IdentityReference.Value })',
+    'if (@($sid, $admins) -notcontains $owner -or $unsafe.Count -gt 0) { exit 7 }',
+  ].join('; ');
+  return runPowerShellFileScript(path, script);
+}
+
+export async function writeOwnerPrivateFile(path, content, { platform = process.platform } = {}) {
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, content, { flag: 'wx', mode: 0o600 });
+    if (platform === 'win32') {
+      const script = [
+        '$ErrorActionPreference = "Stop"',
+        '$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User',
+        '$acl = Get-Acl -LiteralPath $env:SPOTTER_PRIVATE_FILE',
+        '$acl.SetOwner($sid)',
+        '$acl.SetAccessRuleProtection($true, $false)',
+        '$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($sid, "FullControl", [System.Security.AccessControl.InheritanceFlags]::None, [System.Security.AccessControl.PropagationFlags]::None, [System.Security.AccessControl.AccessControlType]::Allow)',
+        '$acl.AddAccessRule($rule)',
+        'Set-Acl -LiteralPath $env:SPOTTER_PRIVATE_FILE -AclObject $acl',
+      ].join('; ');
+      await runPowerShellFileScript(temporary, script);
+      await checkWindowsOwnerAcl(temporary);
+    } else await chmod(temporary, 0o600);
+    await rename(temporary, path);
+  } catch (error) {
+    await rm(temporary, { force: true }).catch(() => {});
+    throw error;
+  }
+}
+
+function runPowerShellFileScript(path, script) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(WINDOWS_POWERSHELL_COMMAND, ['-NoProfile', '-NonInteractive', '-Command', script], {
+      stdio: 'ignore', windowsHide: true,
+      env: { ...process.env, SPOTTER_PRIVATE_FILE: path },
+    });
+    const timer = setTimeout(() => child.kill('SIGKILL'), 15_000);
+    child.once('error', (error) => { clearTimeout(timer); reject(error); });
+    child.once('close', (code) => {
+      clearTimeout(timer);
+      code === 0 ? resolve() : reject(new Error('private file ACL is unsafe'));
+    });
+  });
+}