exe-watcher 0.2.69 → 0.2.71

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "exe-watcher",
-  "version": "0.2.69",
-  "description": "The owl watching your AI coding spend — cost, tokens, agents, and projects in your terminal and menu bar",
+  "version": "0.2.71",
+  "description": "The owl watching your AI coding spend \u2014 cost, tokens, agents, and projects in your terminal and menu bar",
   "type": "module",
   "main": "./dist/cli.js",
   "bin": {
@@ -9,6 +9,7 @@
   },
   "files": [
     "dist",
+    "vendor/odd-core-analytics",
     "THIRD_PARTY_NOTICES.md",
     "!dist/**/*.map"
   ],
@@ -57,7 +58,8 @@
     "tsup": "^8.4.0",
     "tsx": "^4.19.0",
     "typescript": "^5.8.0",
-    "vitest": "^3.1.0"
+    "vitest": "^3.1.0",
+    "@odd-core/analytics": "file:vendor/odd-core-analytics"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org"

package/vendor/odd-core-analytics/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OddBold LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/vendor/odd-core-analytics/PROVENANCE.json

@@ -0,0 +1,28 @@
+{
+  "source": "OddCommunity/odd-core-kits/packages/analytics",
+  "revision": "3fb6fb095a1f9b1b8601965df58f08521fc38f7f",
+  "version": "0.2.0",
+  "dirty": false,
+  "compiler": "5.9.3",
+  "sourceHashes": {
+    "package.json": "5163e68c17ac1b0296c6d2a9c556e2847ad0a961d66dc072f9810e587d343ead",
+    "README.md": "a6785accc7fafbe5355cc01d9876f47d12d290b15568ff92890f98c258f9eeb6",
+    "LICENSE": "7a9af43e5df34f24605f6d7ea7613b0982429ab12d09150a76ed681781bd964f",
+    "gateway/server.mjs": "3cacb4903bbbfecc38f2c14152ace487001c3e4e362c3ca07b086b2dc279adf2",
+    "src/privacy/index.ts": "fcd05058ad316d87938248edfb4fd7a9a1305c3176201027e602f60957455a2b",
+    "src/privacy/client.ts": "facac772a0c4767304f7e0564af387555144ed61800257ab996801be90454ddc",
+    "src/privacy/schema.ts": "a5a8ed885d6f7674d9449e66f69f2a4debda937b96a0642d97c8b4d37e5d2dd8"
+  },
+  "hashes": {
+    "README.md": "a6785accc7fafbe5355cc01d9876f47d12d290b15568ff92890f98c258f9eeb6",
+    "LICENSE": "7a9af43e5df34f24605f6d7ea7613b0982429ab12d09150a76ed681781bd964f",
+    "gateway/server.mjs": "3cacb4903bbbfecc38f2c14152ace487001c3e4e362c3ca07b086b2dc279adf2",
+    "dist/privacy/index.js": "f345eebe3947115469d4b84361d17583165c77901388e5afd668bf8442fda561",
+    "dist/privacy/index.d.ts": "fcd05058ad316d87938248edfb4fd7a9a1305c3176201027e602f60957455a2b",
+    "dist/privacy/client.js": "a476348c2934a331de8f5eea70c2a11ff3610e46ead0b0a9f334f9ef5b894564",
+    "dist/privacy/client.d.ts": "cae6e898f34ee1b3c0b04087b1c66b5abd2b9ef4c409aecfe925ee23b3e5c7e8",
+    "dist/privacy/schema.js": "e850805166766fd36dc05b71915d0e64a4f64c32fd0b21c3086bb17e778ff510",
+    "dist/privacy/schema.d.ts": "babe50be7c11c0ef016cb442cc195d5584bd98dfbf9a7a81ef99a80b5460ebbc",
+    "package.json": "ab60af99e145369ff8819a8c8b161658fe1efb7edec7d4b39a44d592e77d12e7"
+  }
+}

package/vendor/odd-core-analytics/README.md

@@ -0,0 +1,196 @@
+# Shared private PostHog + Sentry integration
+
+Use **`@odd-core/analytics/privacy`** for Odd's self-hosted counter/error collector.
+It is separate from the older generic API at `@odd-core/analytics` and from
+`@odd-core/telemetry`; those APIs do not enforce this wire protocol or its defaults.
+The privacy entry point has no runtime dependencies or provider SDKs. Its source
+and the matching Node gateway are MIT licensed. This change does not publish npm
+artifacts or make the containing repository public.
+
+## New app setup
+
+1. Create separate PostHog and Sentry projects for the app. A CLI and a native app
+   may use separate Sentry projects/aliases. Reuse the existing **build-my** server.
+2. Register public aliases, the app slug, and static feature/source allowlists in
+   the gateway's private maps (see below). Never copy Hansel's project IDs/aliases.
+3. Install/link `@odd-core/analytics` through the app's normal dependency process.
+   Build it with `tsc -b packages/types packages/analytics` from this repository.
+   In this workspace, use `"@odd-core/analytics": "workspace:*"`.
+4. Supply private storage and a cryptographic UUID provider, then expose **two
+   independent opt-in controls**, both initially off. Keys/configuration alone
+   never constitute consent. Update the app's privacy policy/store disclosures.
+5. Hook explicit features, foreground/idle state, real recording completion, and
+   handled structural errors to the client. Schedule `flush()` on a bounded timer
+   and lifecycle transitions. No timers or error hooks start automatically.
+6. Verify real local app usage and one harmless handled error in the app's own
+   dashboards. Check opt-out, no pre-consent history, retry IDs, and tenant routing
+   before the app's normal release process. No paid/cloud build is required here.
+
+```ts
+import { ActiveClock, PrivacyClient } from '@odd-core/analytics/privacy';
+
+const analytics = await PrivacyClient.create({
+  app: 'watcher',
+  usageAlias: 'public-watcher-v1',       // provision first; illustrative values
+  diagnosticsAlias: 'public-watcher-cli-v1',
+  features: ['home', 'menu'],           // static developer-owned list, not user text
+  storage: privateAppStorage,          // getItem/setItem, atomic durable replacement
+  randomUUID: () => crypto.randomUUID(),
+  // collector defaults to https://data.odd.community
+});
+
+// Only after the user accepts the relevant disclosure:
+await analytics.setConsent({ usage: true });
+await analytics.track({ event: 'active' }); // startup/return-to-active, not background polls
+await analytics.track({ event: 'feature', feature: 'menu' });
+
+const clock = new ActiveClock();
+// Sample about every 5 seconds using a monotonic clock and actual app state.
+// Skip/reset the clock while consent is off, after consent changes, and on sleep.
+if (analytics.status().usage) {
+  const active_ms = clock.sample(performance.now(), isFocused, idleSeconds, isRecording);
+  if (active_ms > 0) await analytics.track({ event: 'usage', active_ms });
+} else clock.reset();
+
+// Recording apps only: duration from the actual completed recording, no audio/text.
+await analytics.track({ event: 'recording', recording_ms: 3700 });
+
+// Separate diagnostics consent, followed by a safe structural report.
+await analytics.setConsent({ diagnostics: true });
+await analytics.report({ event: 'error', category: 'ipc_error',
+  error_class: 'RangeError', version: '1.0.0', frames: [] });
+await analytics.flush();
+
+// On revocation: abort pending requests, erase the channel queue and usage ID.
+await analytics.setConsent({ usage: false });
+clock.reset();
+```
+
+`setConsent`, `track`, and `report` return a boolean: check it when displaying
+settings or troubleshooting persistence. A storage failure disables both channels
+in memory. If a revocation cannot be persisted, the app must keep collection off
+on subsequent launches until it can durably save the choice. One client instance
+owns each app state store; don't share a writable queue across processes/tabs.
+Already accepted server events cannot be recalled by aborting a request.
+
+## Platform adapters
+
+| Platform | Adapter responsibilities |
+| --- | --- |
+| Node CLI / Electron main | Owner-only atomic file replacement (directory `0700`, files `0600`), `node:crypto.randomUUID`, explicit lifecycle flush. Renderer requests cross a narrow, validated IPC boundary. Suppress background child CLI polling. |
+| Web | App-scoped storage, Web Crypto UUIDs, visibility/focus/idle sampling. Configure exact CORS origins on the gateway and ingress. Cross-origin cookies are omitted. Browser storage is accessible to same-origin code. |
+| React Native / Expo | Durable app-scoped storage, platform cryptographic UUIDs, foreground state and actual activity/idle signals. Keep Node modules out of the mobile bundle. |
+| Native Swift/Kotlin/Dart | Implement the small protocol below or bridge this client; JavaScript cannot be imported directly into Swift. Reuse the same consent/storage/lifecycle rules and gateway allowlists. |
+
+Never install global native crash handlers or send minidumps/raw crash reports as
+part of this kit. Sentry gets explicit sanitized structural errors. There are no
+automatic breadcrumbs, network traces, replay, screenshots, account identification,
+device fingerprints, prompt/transcript/audio collection, or Google analytics.
+DAU counts consenting installations, not authenticated people. Recording minutes
+are **N/A** for apps without a recording feature. Metric days are UTC in the pilot.
+IP addresses necessarily reach the collection network edge; the gateway does not
+forward incoming IP/user-agent/cookies to PostHog or Sentry. Edge logging and
+retention are operator responsibilities; pseudonymous analytics is still data.
+
+## Persistence and transport contract
+
+Both queues are capped at **500 events**, expire after **7 days**, and are
+re-sanitized on load. UUID/timestamp are assigned once before retries, preserving
+the backend deduplication key. Each flush sends at most 50 usage and 10 errors,
+with 5s/10s timeouts. Failures retain safe events for the next scheduled attempt.
+Re-enabling usage after revocation creates a fresh random installation UUID.
+The state is bound to collector/app/aliases so a config change cannot reroute an
+old queue. App adapters must not backfill history or generate synthetic activity.
+
+`POST /batch/`, JSON content type:
+
+```json
+{"api_key":"public-watcher-v1","batch":[{
+  "uuid":"a1c01189-72bf-4f63-b6e6-9e940e87ebc7","timestamp":"2026-10-23T12:00:00.000Z",
+  "event":"app_feature","properties":{
+    "distinct_id":"a1c01189-72bf-4f63-b6e6-9e940e87ebc8","app":"watcher","feature":"menu"
+  }
+}]}
+```
+
+Usage events: `app_active` (no counter), `app_usage` (`active_ms`, integer 1–60000),
+`app_recording` (`recording_ms`, integer 1–86400000), `app_feature` (registered enum).
+`POST /errors/`: same envelope/UUID/timestamp but each row has `diagnostic` instead
+of `event`/`properties`. Diagnostic fields: `event: "error"`, fixed `category`,
+standard JS `error_class` (unknown becomes `Error`), numeric `x.y.z` version, and
+up to 8 registered logical frames with bounded integer line/column numbers.
+Never put a raw exception object, message, stack string, arbitrary properties,
+filesystem path, attachment, user identity, or DSN into either payload.
+
+## Gateway and provisioning
+
+The dependency-free gateway is `@odd-core/analytics/gateway` (ESM, Node 20+).
+Run `node node_modules/@odd-core/analytics/gateway/server.mjs` in the private
+deployment. Server-only configuration, supplied as mounted owner-only JSON files:
+
+```json
+// PROJECT_TOKENS_FILE
+{"public-watcher-v1":{"app":"watcher","token":"PRIVATE_POSTHOG_PROJECT_TOKEN","features":["home","menu"]}}
+// SENTRY_PROJECTS_FILE
+{"public-watcher-cli-v1":{"app":"watcher","project_id":7,"public_key":"32_HEX_CHAR_PUBLIC_KEY","platform":"javascript","frames":["app:///main/index.js"]}}
+```
+
+Those aliases/IDs are examples, not provisioned projects. Maps route each alias
+to a single backend project; caller-supplied project IDs, tokens, and properties
+cannot select another tenant. Copy only public aliases into app configuration.
+The server supports per-project `features`/`frames`; omitted lists preserve the
+Hansel pilot defaults. The pilot gateway currently deployed in Hansel predates
+these per-app lists: validate and deploy the shared gateway before using new
+Watcher feature/source enums. Existing Hansel payloads remain compatible.
+
+Optional `ALLOWED_ORIGINS` is a JSON array of exact web origins; none by default.
+Unlisted Origin headers are rejected. Permit OPTIONS for only the two intake
+routes at ingress when enabling web apps; do not expose dashboard routes.
+The process binds port 8080; provision private upstreams via `POSTHOG_UPSTREAM`
+(default `http://proxy:80/batch/`) and `SENTRY_UPSTREAM` (`http://sentry-ingress`).
+Standalone mode restricts upstream hostnames to the private service names/local
+host; never configure a hosted provider fallback. Rate/body/connection limits
+remain enabled. `GET /health` does not prove end-to-end ingestion.
+
+Existing infrastructure runbooks and provisioning helpers are in
+`/Users/exeai/Hansel/docs/analytics/`: `APP_SETUP.md`, `STATUS.md`, `SENTRY.md`,
+`provision-hansel.py`, `provision-sentry.py`, `create-dashboard.py`,
+`connect-sentry-intake.py`, and `backup/README.md`. Adapt scripts without replacing
+Hansel mappings. Actual credentials stay on the server, outside source control.
+Dashboards: PostHog `https://build-my.tail910c31.ts.net`, Sentry
+`https://build-my.tail910c31.ts.net:8443` (Tailscale + Tailscale DNS).
+Encrypted daily restic backups already use Cloudflare R2, seven-day retention.
+
+## Checks and adoption status
+
+`pnpm --filter @odd-core/analytics test` builds the package and runs the privacy,
+wire-contract, project isolation, CORS, and gateway tests without live services.
+`pnpm --filter @odd-core/analytics test:privacy` runs against an existing build.
+The legacy API remains available; adding this entry point does not automatically
+migrate apps, deploy the gateway, create projects, or qualify Swift/mobile builds.
+Hansel's original integration has live dogfood evidence; this shared extraction
+requires each consuming app's normal integration checks before rollout.
+
+## Standard basic analytics (0.2.0)
+
+Keep collection off until the person explicitly accepts a clear first-run choice.
+Offer **Share Basic Analytics** and **Not Now**. An unchecked optional diagnostics
+choice can share the same screen, while usage/errors remain independently
+controllable in Settings. Persist a decline; never repeatedly prompt or silently
+turn on a channel after an upgrade. Existing approved choices remain approved.
+Apps must obtain their required platform/privacy permissions before collection.
+
+The standard product dataset is consenting-installation DAU/WAU/MAU, foreground
+active duration, real recording duration where applicable, allowlisted feature
+counts/outcomes, numeric app version and coarse platform. `USAGE_DISCLOSURE` and
+`DIAGNOSTICS_DISCLOSURE` provide shared field descriptions. Supply static
+`appVersion: '1.0.48'` and `platform: 'macos'` to PrivacyClient; platform is one of
+macos/windows/linux/ios/android/web. Neither field comes from arbitrary event data.
+Feature results are `{ event: 'result', feature: 'menu', outcome: 'success' }`
+(or `failure`), sent as app_result. No error text accompanies a failure counter.
+The gateway independently validates metadata and results. Deploy that capability
+before enabling result events in clients; old payloads remain compatible.
+
+DAU/WAU/MAU use the same per-app random installation ID with UTC day/7-day/30-day
+windows; no account or cross-app ID is necessary. Existing 30-day raw retention
+limits the rolling monthly window. Counts cover consenting installations only.

package/vendor/odd-core-analytics/dist/privacy/client.d.ts

@@ -0,0 +1,58 @@
+import { PLATFORMS } from './schema';
+export type Consent = {
+    usage: boolean;
+    diagnostics: boolean;
+};
+export interface PrivateStorage {
+    getItem(key: string): Promise<string | null>;
+    /** Must replace atomically. Native adapters must use owner-only files/encrypted app storage. */
+    setItem(key: string, value: string): Promise<void>;
+}
+export interface PrivacyOptions {
+    app: string;
+    /** Public gateway aliases, never PostHog admin tokens or a Sentry DSN. */
+    usageAlias: string;
+    diagnosticsAlias: string;
+    features: readonly string[];
+    appVersion?: string;
+    platform?: typeof PLATFORMS[number];
+    /** Static logical source names, registered in the gateway; never filesystem paths. */
+    frames?: readonly string[];
+    collector?: string;
+    storage: PrivateStorage;
+    /** Cryptographically random UUID provider (crypto.randomUUID, expo-crypto, etc.). */
+    randomUUID: () => string;
+    send?: typeof fetch;
+    now?: () => number;
+}
+/** No SDK autocapture, user context, content strings, cookies, or provider fallback. */
+export declare class PrivacyClient {
+    private readonly options;
+    private state;
+    private serial;
+    private generation;
+    private sending;
+    private readonly origin;
+    private readonly key;
+    private readonly now;
+    private readonly features;
+    private readonly frames;
+    private constructor();
+    static create(options: PrivacyOptions): Promise<PrivacyClient>;
+    private binding;
+    private fresh;
+    private sanitize;
+    private uuid;
+    private run;
+    private persist;
+    status(): Consent;
+    /** Call only after the app presents disclosure and records an explicit user choice. */
+    setConsent(update: Partial<Consent>): Promise<boolean>;
+    track(input: unknown): Promise<boolean>;
+    report(input: unknown): Promise<boolean>;
+    private enqueue;
+    /** One bounded batch per channel; schedule retries in the app's lifecycle. */
+    flush(): Promise<void>;
+    private flushKind;
+    abort(): void;
+}

package/vendor/odd-core-analytics/dist/privacy/client.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrivacyClient = void 0;
+const schema_1 = require("./schema");
+const WEEK = 7 * 86400000;
+const empty = () => ({ consent: { usage: false, diagnostics: false }, id: '', usage: [], diagnostics: [] });
+/** No SDK autocapture, user context, content strings, cookies, or provider fallback. */
+class PrivacyClient {
+    constructor(options) {
+        this.options = options;
+        this.state = empty();
+        this.serial = Promise.resolve();
+        this.generation = { usage: 0, diagnostics: 0 };
+        this.sending = {};
+        this.options = { ...options };
+        if (!/^[a-z][a-z0-9-]{0,63}$/.test(options.app) ||
+            ![options.usageAlias, options.diagnosticsAlias].every(v => /^[a-zA-Z0-9_-]{1,128}$/.test(v)) ||
+            options.features.length > 64 || !options.features.every(v => /^[a-z][a-z0-9_]{0,63}$/.test(v)))
+            throw new Error('Invalid static app configuration');
+        if (options.appVersion !== undefined && !/^\d{1,4}\.\d{1,4}\.\d{1,4}$/.test(options.appVersion))
+            throw new Error('Invalid app version');
+        if (options.platform !== undefined && !schema_1.PLATFORMS.includes(options.platform))
+            throw new Error('Invalid platform');
+        this.features = [...options.features];
+        this.frames = [...(options.frames ?? schema_1.DEFAULT_FRAMES)];
+        if (this.frames.length > 16 || !this.frames.every(v => /^app:\/\/\/[a-zA-Z0-9_/-]+\.(js|ts|swift|kt|dart)$/.test(v) && !v.includes('..')))
+            throw new Error('Invalid logical source configuration');
+        this.origin = (0, schema_1.collectorOrigin)(options.collector ?? schema_1.DEFAULT_COLLECTOR);
+        this.key = `odd-privacy-v1:${options.app}`;
+        this.now = options.now ?? Date.now;
+    }
+    static async create(options) {
+        const client = new PrivacyClient(options);
+        try {
+            const input = (0, schema_1.record)(JSON.parse(await options.storage.getItem(client.key) ?? 'null'));
+            // Binding prevents old queued data being routed to a different project's aliases.
+            if (!input || input.binding !== client.binding())
+                return client;
+            const consent = (0, schema_1.record)(input.consent);
+            client.state.consent.diagnostics = consent?.diagnostics === true;
+            client.state.consent.usage = consent?.usage === true && typeof input.id === 'string' && schema_1.UUID.test(input.id);
+            client.state.id = client.state.consent.usage ? input.id : '';
+            for (const kind of ['usage', 'diagnostics']) {
+                if (!client.state.consent[kind] || !Array.isArray(input[kind]))
+                    continue;
+                for (const raw of input[kind].slice(-500)) {
+                    const row = (0, schema_1.record)(raw);
+                    const metric = client.sanitize(kind, row?.metric);
+                    if (row && metric && typeof row.uuid === 'string' && schema_1.UUID.test(row.uuid) && client.fresh(row.timestamp)) {
+                        client.state[kind].push({ uuid: row.uuid, timestamp: new Date(Date.parse(row.timestamp)).toISOString(), metric });
+                    }
+                }
+            }
+            // Remove expired/malformed fields from disk too, not only from memory.
+            await client.persist();
+        }
+        catch {
+            client.state = empty();
+        }
+        return client;
+    }
+    binding() { return JSON.stringify([this.origin, this.options.app, this.options.usageAlias, this.options.diagnosticsAlias]); }
+    fresh(time) {
+        const value = typeof time === 'string' ? Date.parse(time) : NaN;
+        return Number.isFinite(value) && value <= this.now() && this.now() - value < WEEK;
+    }
+    sanitize(kind, input) {
+        return kind === 'usage' ? (0, schema_1.sanitizeMetric)(input, this.features) : (0, schema_1.sanitizeDiagnostic)(input, this.frames);
+    }
+    uuid() {
+        const id = this.options.randomUUID();
+        if (typeof id !== 'string' || !schema_1.UUID.test(id))
+            throw new Error('A cryptographic UUID provider is required');
+        return id;
+    }
+    run(fn) {
+        const next = this.serial.then(fn);
+        this.serial = next.catch(() => undefined);
+        return next;
+    }
+    async persist() {
+        try {
+            await this.options.storage.setItem(this.key, JSON.stringify({ binding: this.binding(), ...this.state }));
+            return true;
+        }
+        catch {
+            this.state = empty();
+            this.abort();
+            return false;
+        }
+    }
+    status() { return { ...this.state.consent }; }
+    /** Call only after the app presents disclosure and records an explicit user choice. */
+    setConsent(update) {
+        // Abort immediately, including requests blocked behind a slow storage write.
+        for (const kind of ['usage', 'diagnostics'])
+            if (update[kind] === false) {
+                this.generation[kind]++;
+                this.sending[kind]?.abort();
+            }
+        return this.run(async () => {
+            try {
+                for (const kind of ['usage', 'diagnostics'])
+                    if (typeof update[kind] === 'boolean' && this.state.consent[kind] !== update[kind]) {
+                        this.generation[kind]++;
+                        this.sending[kind]?.abort();
+                        this.state.consent[kind] = update[kind];
+                        this.state[kind] = [];
+                        if (kind === 'usage')
+                            this.state.id = update[kind] ? this.uuid() : '';
+                    }
+                return await this.persist();
+            }
+            catch {
+                this.state = empty();
+                this.abort();
+                return false;
+            }
+        });
+    }
+    track(input) { return this.enqueue('usage', input); }
+    report(input) { return this.enqueue('diagnostics', input); }
+    enqueue(kind, input) {
+        // Sanitize now so caller mutation cannot add content while awaiting storage.
+        const metric = this.sanitize(kind, input);
+        const generation = this.generation[kind];
+        const allowed = this.state.consent[kind];
+        return this.run(async () => {
+            if (!allowed || !this.state.consent[kind] || generation !== this.generation[kind] || !metric)
+                return false;
+            try {
+                this.state[kind] = this.state[kind].filter(row => this.fresh(row.timestamp)).slice(-499);
+                this.state[kind].push({ uuid: this.uuid(), timestamp: new Date(this.now()).toISOString(), metric });
+                return await this.persist();
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    /** One bounded batch per channel; schedule retries in the app's lifecycle. */
+    async flush() { await Promise.all([this.flushKind('usage'), this.flushKind('diagnostics')]); }
+    async flushKind(kind) {
+        const requestedGeneration = this.generation[kind];
+        const pending = await this.run(async () => {
+            if (this.sending[kind] || !this.state.consent[kind] || requestedGeneration !== this.generation[kind])
+                return null;
+            const before = this.state[kind].length;
+            this.state[kind] = this.state[kind].filter(row => this.fresh(row.timestamp));
+            if (before !== this.state[kind].length && !await this.persist())
+                return null;
+            const batch = this.state[kind].slice(0, kind === 'usage' ? 50 : 10);
+            if (!batch.length)
+                return null;
+            const controller = new AbortController();
+            this.sending[kind] = controller;
+            return { batch, controller, generation: this.generation[kind], id: this.state.id };
+        });
+        if (!pending)
+            return;
+        const { batch, controller, generation, id } = pending;
+        const timer = setTimeout(() => controller.abort(), kind === 'usage' ? 5000 : 10000);
+        try {
+            if (controller.signal.aborted)
+                return;
+            const response = await (this.options.send ?? fetch)(`${this.origin}/${kind === 'usage' ? 'batch' : 'errors'}/`, {
+                method: 'POST', redirect: 'error', credentials: 'omit', referrerPolicy: 'no-referrer', signal: controller.signal,
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ api_key: kind === 'usage' ? this.options.usageAlias : this.options.diagnosticsAlias,
+                    batch: batch.map(row => kind === 'diagnostics' ? { uuid: row.uuid, timestamp: row.timestamp, diagnostic: row.metric } : {
+                        uuid: row.uuid, timestamp: row.timestamp, event: `app_${row.metric.event}`,
+                        properties: { distinct_id: id, app: this.options.app, ...row.metric, ...(this.options.appVersion ? { app_version: this.options.appVersion } : {}),
+                            ...(this.options.platform ? { app_platform: this.options.platform } : {}), $process_person_profile: false, $geoip_disable: true },
+                    }) }),
+            });
+            if (response.ok)
+                await this.run(async () => {
+                    if (generation !== this.generation[kind])
+                        return;
+                    const sent = new Set(batch.map(row => row.uuid));
+                    this.state[kind] = this.state[kind].filter(row => !sent.has(row.uuid));
+                    await this.persist();
+                });
+            await response.body?.cancel();
+        }
+        catch { /* Retry the same IDs later; never log payloads or response bodies. */ }
+        finally {
+            clearTimeout(timer);
+            if (this.sending[kind] === controller)
+                delete this.sending[kind];
+        }
+    }
+    abort() { this.sending.usage?.abort(); this.sending.diagnostics?.abort(); }
+}
+exports.PrivacyClient = PrivacyClient;

package/vendor/odd-core-analytics/dist/privacy/index.d.ts

@@ -0,0 +1,2 @@
+export * from './schema';
+export * from './client';

package/vendor/odd-core-analytics/dist/privacy/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./schema"), exports);
+__exportStar(require("./client"), exports);

package/vendor/odd-core-analytics/dist/privacy/schema.d.ts

@@ -0,0 +1,46 @@
+/** MIT. Counters and structural errors only; never forward caller property bags. */
+export declare const DEFAULT_COLLECTOR = "https://data.odd.community";
+export declare const HANSEL_FEATURES: readonly ["home", "recordings", "vocabulary", "shortcuts", "dictation"];
+export declare const ERROR_CATEGORIES: readonly ["crash", "unhandled_exception", "render_error", "ipc_error", "ml_error"];
+export declare const DEFAULT_FRAMES: readonly ["app:///main/index.js", "app:///renderer/index.js"];
+export declare const USAGE_DISCLOSURE = "Share active time, recording duration, feature counts and outcomes, app version and platform with our own servers. A random ID unique to this app measures returning installations. Never audio, transcripts, prompts, account details or screen recordings.";
+export declare const DIAGNOSTICS_DISCLOSURE = "Share sanitized error categories, app version and code locations with our own Sentry server. Never error text, account details, recordings or memory dumps.";
+export declare const PLATFORMS: readonly ["macos", "windows", "linux", "ios", "android", "web"];
+export type Metric = {
+    event: 'active';
+} | {
+    event: 'usage';
+    active_ms: number;
+} | {
+    event: 'recording';
+    recording_ms: number;
+} | {
+    event: 'feature';
+    feature: string;
+} | {
+    event: 'result';
+    feature: string;
+    outcome: 'success' | 'failure';
+};
+export type Diagnostic = {
+    event: 'error';
+    category: typeof ERROR_CATEGORIES[number];
+    error_class: string;
+    version: string;
+    frames: {
+        filename: string;
+        lineno: number;
+        colno: number;
+    }[];
+};
+export declare const UUID: RegExp;
+export declare function record(input: unknown): Record<string, unknown> | null;
+export declare function sanitizeMetric(input: unknown, features?: readonly string[]): Metric | null;
+export declare function sanitizeDiagnostic(input: unknown, allowedFrames?: readonly string[]): Diagnostic | null;
+export declare function collectorOrigin(input: string): string;
+/** Sample with a monotonic clock; reset at consent/focus lifecycle boundaries. */
+export declare class ActiveClock {
+    private previous;
+    sample(time: number, focused: boolean, idleSeconds: number, recording?: boolean): number;
+    reset(): void;
+}