patchwork-os 1.2.0-beta.3.canary.883 → 1.2.0-beta.3.canary.885

package/dist/analyticsReporter.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Periodic + shutdown usage reporting.
+ *
+ * Telemetry used to be sent only at bridge shutdown. Long-running bridges
+ * (launchd services, containers) almost never shut down, so they never
+ * reported. The reporter sends on an interval and once more at shutdown.
+ *
+ * Each activity entry is counted exactly once: a send covers entries newer
+ * than the previous send's cutoff, and the cutoff advances even when the send
+ * fails (a failed send is dropped, never retried — retrying would double-count
+ * if the collector had in fact stored it). Activity while telemetry is not
+ * opted in advances the cutoff too, so opting in later never uploads history
+ * the user had not consented to.
+ */
+import type { ActivityEntry } from "./activityTypes.js";
+import { type AnalyticsSummary } from "./analyticsAggregator.js";
+export declare const DEFAULT_REPORT_INTERVAL_MS: number;
+export interface ReporterDeps {
+    /** Current in-memory activity entries (any order). */
+    entries: () => readonly ActivityEntry[];
+    /** True when the user has opted in. Checked at every flush. */
+    enabled: () => boolean;
+    bridgeVersion: string;
+    salt: () => string;
+    send: (summary: AnalyticsSummary) => Promise<void>;
+    now?: () => number;
+}
+export declare class AnalyticsReporter {
+    private readonly deps;
+    private cutoffMs;
+    private windowStartMs;
+    private timer;
+    private inFlight;
+    constructor(deps: ReporterDeps);
+    start(intervalMs?: number): void;
+    stop(): void;
+    /** Send everything since the last cutoff. Never rejects. Serialised. */
+    flush(): Promise<void>;
+    private doFlush;
+}

package/dist/analyticsReporter.js

@@ -0,0 +1,76 @@
+/**
+ * Periodic + shutdown usage reporting.
+ *
+ * Telemetry used to be sent only at bridge shutdown. Long-running bridges
+ * (launchd services, containers) almost never shut down, so they never
+ * reported. The reporter sends on an interval and once more at shutdown.
+ *
+ * Each activity entry is counted exactly once: a send covers entries newer
+ * than the previous send's cutoff, and the cutoff advances even when the send
+ * fails (a failed send is dropped, never retried — retrying would double-count
+ * if the collector had in fact stored it). Activity while telemetry is not
+ * opted in advances the cutoff too, so opting in later never uploads history
+ * the user had not consented to.
+ */
+import { buildSummary } from "./analyticsAggregator.js";
+export const DEFAULT_REPORT_INTERVAL_MS = 24 * 60 * 60 * 1000;
+export class AnalyticsReporter {
+    deps;
+    cutoffMs;
+    windowStartMs;
+    timer = null;
+    inFlight = null;
+    constructor(deps) {
+        this.deps = deps;
+        const now = (deps.now ?? Date.now)();
+        this.cutoffMs = now;
+        this.windowStartMs = now;
+    }
+    start(intervalMs = DEFAULT_REPORT_INTERVAL_MS) {
+        if (this.timer)
+            return;
+        this.timer = setInterval(() => {
+            void this.flush();
+        }, intervalMs);
+        this.timer.unref?.();
+    }
+    stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = null;
+    }
+    /** Send everything since the last cutoff. Never rejects. Serialised. */
+    flush() {
+        const run = (this.inFlight ?? Promise.resolve()).then(() => this.doFlush());
+        this.inFlight = run.finally(() => {
+            if (this.inFlight === run)
+                this.inFlight = null;
+        });
+        return run;
+    }
+    async doFlush() {
+        const now = (this.deps.now ?? Date.now)();
+        const since = this.cutoffMs;
+        const batch = this.deps.entries().filter((e) => {
+            const t = Date.parse(e.timestamp);
+            return Number.isFinite(t) && t > since && t <= now;
+        });
+        const windowMs = now - this.windowStartMs;
+        // Advance BEFORE sending: success, failure and opted-out all consume the
+        // window, so nothing is ever counted twice or uploaded retroactively.
+        this.cutoffMs = now;
+        if (batch.length === 0)
+            return;
+        this.windowStartMs = now;
+        if (!this.deps.enabled())
+            return;
+        try {
+            const summary = buildSummary(batch, Math.max(0, windowMs), this.deps.bridgeVersion, this.deps.salt());
+            await this.deps.send(summary);
+        }
+        catch {
+            // Dropped by design — see the header.
+        }
+    }
+}
+//# sourceMappingURL=analyticsReporter.js.map

package/dist/analyticsReporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyticsReporter.js","sourceRoot":"","sources":["../src/analyticsReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAyB,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE/E,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAa9D,MAAM,OAAO,iBAAiB;IACX,IAAI,CAAe;IAC5B,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,KAAK,GAA0C,IAAI,CAAC;IACpD,QAAQ,GAAyB,IAAI,CAAC;IAE9C,YAAY,IAAkB;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;QACpB,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAqB,0BAA0B;QACnD,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,UAAU,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,wEAAwE;IACxE,KAAK;QACH,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;gBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAC1C,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;QACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAC1B,KAAK,EACL,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,EACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CACjB,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;CACF"}

package/dist/analyticsSend.d.ts

@@ -1,18 +1,27 @@
 /**
- * Sends an anonymized analytics summary to the usage endpoint.
- * - Fire-and-forget is NOT used: callers must await this with a timeout race.
- * - All errors are caught and swallowed — telemetry must never affect bridge operation.
- * - Endpoint defaults to the upstream collector. Operators may override via:
- *     1. env: PATCHWORK_ANALYTICS_ENDPOINT  (highest precedence; for CI/headless)
- *     2. config file: ~/.claude/ide/analytics-config.json  (preferred — managed by
- *        `patchwork analytics configure`, keeps secrets out of launchd plists)
- *     3. default upstream collector
- *   Endpoint is resolved per-call (cheap fs read) so live config changes take
- *   effect on the next send without restart. Invalid values fall back through.
- *   Never read from the network or summary payload — preserves the
- *   redirect-attack property the original hardcoded constant was protecting.
+ * Sends an anonymized analytics summary to the usage endpoint (opt-in only;
+ * the caller checks the preference).
+ *
+ * - Callers await this with a timeout race; it never rejects.
+ * - Endpoint resolution (per call, so config changes apply without restart):
+ *     1. env PATCHWORK_ANALYTICS_ENDPOINT (CI / headless / containers)
+ *     2. config file ~/.claude/ide/analytics-config.json
+ *        (managed by `patchwork analytics configure`)
+ *     3. DEFAULT_ANALYTICS_ENDPOINT
+ *   Never read from the network or the payload — a redirect attacker cannot
+ *   choose where telemetry goes.
+ * - Stops, in order: DO_NOT_TRACK (Console Do Not Track convention),
+ *   PATCHWORK_TELEMETRY_DEBUG (prints the payload instead of sending), an
+ *   engaged write kill switch.
+ * - Transport is `safeFetch`, never raw fetch, and never follows redirects.
+ *   The default endpoint must resolve to a PUBLIC address; an operator-
+ *   configured endpoint may be private or plain http (e.g. a collector on
+ *   a private network), because the operator chose it.
  */
 import type { AnalyticsSummary } from "./analyticsAggregator.js";
+import { type SafeFetchOptions } from "./ssrfGuard.js";
+/** The live public collector. The single definition; import it, never copy it. */
+export declare const DEFAULT_ANALYTICS_ENDPOINT = "https://analytics.patchworkos.com/v1/usage";
 export declare function resolveAnalyticsTarget(): {
     endpoint: string;
     key: string | undefined;
@@ -21,8 +30,15 @@ export declare function resolveAnalyticsTarget(): {
         key: "env" | "config" | "none";
     };
 };
-/**
- * Sends the summary to the analytics endpoint.
- * Resolves (never rejects) — all errors are swallowed silently.
- */
-export declare function sendAnalytics(summary: AnalyticsSummary): Promise<void>;
+/** Why telemetry is suppressed in this environment, or null. */
+export declare function telemetrySuppressed(env?: NodeJS.ProcessEnv): "do_not_track" | "debug" | null;
+/** Injection seam for tests; production uses the defaults. */
+export interface SendDeps {
+    fetchImpl?: SafeFetchOptions["fetchImpl"];
+    resolveDns?: SafeFetchOptions["resolveDns"];
+    killSwitchEngaged?: () => boolean;
+    writeDebug?: (line: string) => void;
+    onSent?: () => void;
+}
+/** Sends the summary. Resolves (never rejects) — all errors are swallowed. */
+export declare function sendAnalytics(summary: AnalyticsSummary, deps?: SendDeps): Promise<void>;

package/dist/analyticsSend.js

@@ -1,20 +1,30 @@
 /**
- * Sends an anonymized analytics summary to the usage endpoint.
- * - Fire-and-forget is NOT used: callers must await this with a timeout race.
- * - All errors are caught and swallowed — telemetry must never affect bridge operation.
- * - Endpoint defaults to the upstream collector. Operators may override via:
- *     1. env: PATCHWORK_ANALYTICS_ENDPOINT  (highest precedence; for CI/headless)
- *     2. config file: ~/.claude/ide/analytics-config.json  (preferred — managed by
- *        `patchwork analytics configure`, keeps secrets out of launchd plists)
- *     3. default upstream collector
- *   Endpoint is resolved per-call (cheap fs read) so live config changes take
- *   effect on the next send without restart. Invalid values fall back through.
- *   Never read from the network or summary payload — preserves the
- *   redirect-attack property the original hardcoded constant was protecting.
+ * Sends an anonymized analytics summary to the usage endpoint (opt-in only;
+ * the caller checks the preference).
+ *
+ * - Callers await this with a timeout race; it never rejects.
+ * - Endpoint resolution (per call, so config changes apply without restart):
+ *     1. env PATCHWORK_ANALYTICS_ENDPOINT (CI / headless / containers)
+ *     2. config file ~/.claude/ide/analytics-config.json
+ *        (managed by `patchwork analytics configure`)
+ *     3. DEFAULT_ANALYTICS_ENDPOINT
+ *   Never read from the network or the payload — a redirect attacker cannot
+ *   choose where telemetry goes.
+ * - Stops, in order: DO_NOT_TRACK (Console Do Not Track convention),
+ *   PATCHWORK_TELEMETRY_DEBUG (prints the payload instead of sending), an
+ *   engaged write kill switch.
+ * - Transport is `safeFetch`, never raw fetch, and never follows redirects.
+ *   The default endpoint must resolve to a PUBLIC address; an operator-
+ *   configured endpoint may be private or plain http (e.g. a collector on
+ *   a private network), because the operator chose it.
  */
 import { getAnalyticsConfig } from "./analyticsConfig.js";
 import { recordAnalyticsSent } from "./analyticsPrefs.js";
-const DEFAULT_ENDPOINT = "https://analytics.claude-ide-bridge.dev/v1/usage";
+import { readKillSwitch } from "./governance/killSwitchPolicy.js";
+import { safeFetch } from "./ssrfGuard.js";
+/** The live public collector. The single definition; import it, never copy it. */
+export const DEFAULT_ANALYTICS_ENDPOINT = "https://analytics.patchworkos.com/v1/usage";
+const SEND_TIMEOUT_MS = 3000;
 function validUrl(value) {
     if (!value)
         return undefined;
@@ -33,7 +43,7 @@ export function resolveAnalyticsTarget() {
     const envKey = process.env.PATCHWORK_ANALYTICS_KEY;
     const cfg = getAnalyticsConfig();
     const cfgEndpoint = validUrl(cfg.endpoint);
-    let endpoint = DEFAULT_ENDPOINT;
+    let endpoint = DEFAULT_ANALYTICS_ENDPOINT;
     let endpointSource = "default";
     if (envEndpoint) {
         endpoint = envEndpoint;
@@ -59,14 +69,34 @@ export function resolveAnalyticsTarget() {
         source: { endpoint: endpointSource, key: keySource },
     };
 }
-const SEND_TIMEOUT_MS = 3000;
-/**
- * Sends the summary to the analytics endpoint.
- * Resolves (never rejects) — all errors are swallowed silently.
- */
-export async function sendAnalytics(summary) {
+function truthy(v) {
+    if (v === undefined)
+        return false;
+    const s = v.trim().toLowerCase();
+    return s !== "" && s !== "0" && s !== "false" && s !== "no";
+}
+/** Why telemetry is suppressed in this environment, or null. */
+export function telemetrySuppressed(env = process.env) {
+    if (truthy(env.DO_NOT_TRACK))
+        return "do_not_track";
+    if (truthy(env.PATCHWORK_TELEMETRY_DEBUG))
+        return "debug";
+    return null;
+}
+/** Sends the summary. Resolves (never rejects) — all errors are swallowed. */
+export async function sendAnalytics(summary, deps = {}) {
     try {
-        const { endpoint, key } = resolveAnalyticsTarget();
+        const suppressed = telemetrySuppressed();
+        if (suppressed === "do_not_track")
+            return;
+        if (suppressed === "debug") {
+            (deps.writeDebug ?? ((l) => process.stderr.write(l)))(`[telemetry debug — not sent] ${JSON.stringify(summary)}\n`);
+            return;
+        }
+        const engaged = deps.killSwitchEngaged ?? (() => readKillSwitch().engaged);
+        if (engaged())
+            return;
+        const { endpoint, key, source } = resolveAnalyticsTarget();
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), SEND_TIMEOUT_MS);
         try {
@@ -75,22 +105,26 @@ export async function sendAnalytics(summary) {
             };
             if (key)
                 headers["X-Analytics-Key"] = key;
-            const res = await fetch(endpoint, {
+            const { response } = await safeFetch(endpoint, {
                 method: "POST",
                 headers,
                 body: JSON.stringify(summary),
                 signal: controller.signal,
+            }, {
+                allowPrivate: source.endpoint !== "default",
+                followRedirects: false,
+                ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+                ...(deps.resolveDns ? { resolveDns: deps.resolveDns } : {}),
             });
-            if (res.ok) {
-                recordAnalyticsSent();
-            }
+            if (response.ok)
+                (deps.onSent ?? recordAnalyticsSent)();
         }
         finally {
             clearTimeout(timer);
         }
     }
     catch {
-        // Silently swallow all errors — telemetry must never surface to the user
+        // Telemetry must never surface to the user or affect the bridge.
     }
 }
 //# sourceMappingURL=analyticsSend.js.map

package/dist/analyticsSend.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyticsSend.js","sourceRoot":"","sources":["../src/analyticsSend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,gBAAgB,GAAG,kDAAkD,CAAC;AAE5E,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACxE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB;IAQpC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACnD,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE3C,IAAI,QAAQ,GAAG,gBAAgB,CAAC;IAChC,IAAI,cAAc,GAAiC,SAAS,CAAC;IAC7D,IAAI,WAAW,EAAE,CAAC;QAChB,QAAQ,GAAG,WAAW,CAAC;QACvB,cAAc,GAAG,KAAK,CAAC;IACzB,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,QAAQ,GAAG,WAAW,CAAC;QACvB,cAAc,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED,IAAI,GAAuB,CAAC;IAC5B,IAAI,SAAS,GAA8B,MAAM,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,GAAG,MAAM,CAAC;QACb,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;SAAM,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACnB,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACd,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;IAED,OAAO;QACL,QAAQ;QACR,GAAG;QACH,MAAM,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,SAAS,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAyB;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,sBAAsB,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,kBAAkB;aACnC,CAAC;YACF,IAAI,GAAG;gBAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,GAAG,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,mBAAmB,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC"}
+{"version":3,"file":"analyticsSend.js","sourceRoot":"","sources":["../src/analyticsSend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAyB,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAElE,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GACrC,4CAA4C,CAAC;AAE/C,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACxE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB;IAQpC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACnD,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE3C,IAAI,QAAQ,GAAG,0BAA0B,CAAC;IAC1C,IAAI,cAAc,GAAiC,SAAS,CAAC;IAC7D,IAAI,WAAW,EAAE,CAAC;QAChB,QAAQ,GAAG,WAAW,CAAC;QACvB,cAAc,GAAG,KAAK,CAAC;IACzB,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,QAAQ,GAAG,WAAW,CAAC;QACvB,cAAc,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED,IAAI,GAAuB,CAAC;IAC5B,IAAI,SAAS,GAA8B,MAAM,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,GAAG,MAAM,CAAC;QACb,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;SAAM,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACnB,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACd,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;IAED,OAAO;QACL,QAAQ;QACR,GAAG;QACH,MAAM,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,SAAS,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,CAAqB;IACnC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,mBAAmB,CACjC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,cAAc,CAAC;IACpD,IAAI,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAAE,OAAO,OAAO,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAyB,EACzB,OAAiB,EAAE;IAEnB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;QACzC,IAAI,UAAU,KAAK,cAAc;YAAE,OAAO;QAC1C,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CACnD,gCAAgC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAC5D,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,OAAO,EAAE;YAAE,OAAO;QAEtB,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,sBAAsB,EAAE,CAAC;QAC3D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,kBAAkB;aACnC,CAAC;YACF,IAAI,GAAG;gBAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,GAAG,CAAC;YAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,SAAS,CAClC,QAAQ,EACR;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,EACD;gBACE,YAAY,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS;gBAC3C,eAAe,EAAE,KAAK;gBACtB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CACF,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE;gBAAE,CAAC,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,EAAE,CAAC;QAC1D,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC"}

package/dist/bridge.d.ts

@@ -17,6 +17,7 @@ export declare class Bridge {
     private server;
     private extensionClient;
     private activityLog;
+    private analyticsReporter;
     private authToken;
     private sessions;
     /**

package/dist/bridge.js

@@ -4,8 +4,8 @@ import os from "node:os";
 import path from "node:path";
 import { WebSocket } from "ws";
 import { ActivityLog } from "./activityLog.js";
-import { buildSummary } from "./analyticsAggregator.js";
 import { getAnalyticsPref, getAnalyticsSalt } from "./analyticsPrefs.js";
+import { AnalyticsReporter } from "./analyticsReporter.js";
 import { sendAnalytics } from "./analyticsSend.js";
 import { dispatchCancelPush, enqueueApprovalWithDispatch, } from "./approvalHttp.js";
 import { resolveApprovalLogDir } from "./approvalPersistence.js";
@@ -116,6 +116,7 @@ export class Bridge {
     server;
     extensionClient;
     activityLog;
+    analyticsReporter = null;
     authToken;
     sessions = new Map();
     /**
@@ -958,6 +959,18 @@ export class Bridge {
     async start() {
         // 0. Initialize OpenTelemetry (no-op when OTEL_EXPORTER_OTLP_ENDPOINT is unset)
         initTelemetry();
+        // 0. Opt-in usage telemetry: daily + at shutdown, so long-running bridges
+        // report too. The preference is re-read at every flush.
+        this.analyticsReporter = new AnalyticsReporter({
+            entries: () => this.activityLog.queryAll(),
+            enabled: () => (this.config.analyticsEnabled !== null
+                ? this.config.analyticsEnabled
+                : getAnalyticsPref()) === true,
+            bridgeVersion: PACKAGE_VERSION,
+            salt: getAnalyticsSalt,
+            send: (summary) => sendAnalytics(summary),
+        });
+        this.analyticsReporter.start();
         // 0a. Snapshot env-derived kill-switch flags. After this, plugins or
         // recipe steps mutating `process.env.PATCHWORK_FLAG_*` cannot disable an
         // active emergency stop. Closes MED-2 from the 2026-04-28 audit.
@@ -2244,22 +2257,18 @@ export class Bridge {
             ? `, ${totalErrors} error${totalErrors === 1 ? "" : "s"}`
             : "";
         this.logger.info(`Shutdown complete — ${totalSessions} session${totalSessions === 1 ? "" : "s"}, ${totalCalls} tool call${totalCalls === 1 ? "" : "s"}${shutdownErrorPart}`);
-        // Send analytics if opted in — awaited with 2s timeout so it completes before process.exit()
-        const analyticsOn = this.config.analyticsEnabled !== null
-            ? this.config.analyticsEnabled
-            : getAnalyticsPref();
-        if (analyticsOn === true && totalSessions > 0) {
+        // Final telemetry flush (opt-in only; the reporter checks). Covers activity
+        // since the last periodic send. Awaited with a 2s cap before exit.
+        if (this.analyticsReporter) {
+            this.analyticsReporter.stop();
             try {
-                const entries = this.activityLog.query({ last: 500 });
-                const salt = getAnalyticsSalt();
-                const summary = buildSummary(entries, maxDurationMs, PACKAGE_VERSION, salt);
                 await Promise.race([
-                    sendAnalytics(summary),
+                    this.analyticsReporter.flush(),
                     new Promise((resolve) => setTimeout(resolve, 2000)),
                 ]);
             }
             catch {
-                // Swallow all errors — analytics must never affect shutdown
+                // Telemetry must never affect shutdown.
             }
         }
         // Send aggregate session-end notification to the extension before disconnecting