feat(packaged): attach crash-scene evidence to packaged_runtime_failed (nexu-io#5224)

* feat(packaged): attach crash-scene evidence to packaged_runtime_failed

The pre-daemon startup crash class (`packaged_runtime_failed`, nexu-io#4696) reports
only structured buckets today: failure_kind, exit_code, error_name, and a
log-tail-parsed error_code/missing_module. That is enough to see THAT startup
failed, but not WHY on a given machine:

- The mac `daemon-start` failures are better-sqlite3 ERR_MODULE_NOT_FOUND, yet
  the shipped 0.13.0 DMG's `better_sqlite3.node` is verified present, arm64,
  signed, notarized and resolvable — so this is a machine-side subset, not a
  build defect, and we have no per-machine signal to explain the subset.
- The Windows `unknown` bucket (the single largest slice) carries no exit code
  and no daemon log to parse, so today it is a dead end.

Enrich the event with on-machine crash evidence: the scrubbed + truncated
top-level error message/stack (the only signal the `unknown` bucket has), and a
best-effort probe of the daemon's better-sqlite3 binding on THIS machine
(present + size), which separates "file missing" from "file present but
unloadable" (arch mismatch / quarantine / AV). All paths and free-form text are
run through the existing `scrubUserPaths` and length-capped before send.

- startup-telemetry.ts: add `error_message`, `error_stack`,
  `native_module_present/size/path`; new `nativeModulePath` arg + injectable
  `statNativeModule` dep.
- index.ts: pass the packaged binding path
  (`getAppPath()/node_modules/better-sqlite3/build/Release/better_sqlite3.node`,
  layout verified against the shipped DMG) through the fatal-exit report.
- contracts: extend `PackagedRuntimeFailedProps` with the optional fields.
- tests: red-spec first — assert scrubbed message/stack and the native probe
  (present/missing) via the injected `statNativeModule`.

* fix(packaged): scrub full Windows profile segment even with spaces

Review (PerishCode/Looper): the new free-form error_message/error_stack fields
run through scrubUserPaths, but its Windows branch matched `[^\\\s]+` — it
stopped at the first whitespace. A Windows profile dir can contain a space
("C:\Users\John Doe\..."), so it produced "C:\Users\<redacted> Doe\..." and
leaked the rest of the segment, breaking this PR's stated privacy bound.

Consume the whole segment up to the next backslash (`[^\\]+`). POSIX home
segments cannot contain spaces and file:// URLs percent-encode them, so only
this backslash form needs the whitespace-tolerant boundary. Add fixture
coverage for the spaced profile — both standalone and embedded in a crash
message — asserting the surname never survives.

* fix(packaged): make Windows-home scrub separator-agnostic

Review round 2 (PerishCode/Looper): the prior fix covered the backslash form,
but slash-normalized Windows paths ("C:/Users/John Doe/...", which JS/Electron/
Node diagnostics commonly emit) still leaked the surname — the POSIX "/Users/"
rule matched them and stopped at the first space, producing
"C:/Users/<redacted> Doe/...".

Replace the backslash-only Windows rule with a separator-agnostic one that
matches `<drive>:[\\/]Users[\\/]` and consumes the whole segment up to the next
slash OR backslash (spaces allowed), running before the POSIX rule. The `\r\n`
in the class keeps it from running across lines in a multi-line stack. POSIX
segments can't contain spaces, so that rule is left with its whitespace
boundary. Fixtures added for the slash form (standalone + embedded) and a
multi-line no-over-redaction case.

Author: lefarcen

apps/packaged/src/index.ts

@@ -55,6 +55,7 @@ let startupTelemetryContext:
       namespace: string;
       source: string;
       installationRoot: string;
+      nativeModulePath: string | null;
     }
   | null = null;
 
@@ -129,6 +130,18 @@ async function main(): Promise<void> {
     // Pass installationRoot explicitly: OD_INSTALLATION_DIR is only set in the
     // daemon child env, not this parent process (see startup-telemetry.ts).
     installationRoot: paths.installationRoot,
+    // Absolute path where the daemon's better-sqlite3 binding ships in the
+    // packaged bundle (`Contents/Resources/app/node_modules/...` — layout
+    // verified against the shipped 0.13.0 DMG). The fatal-exit report probes
+    // this to record whether the .node actually exists on the crashing machine.
+    nativeModulePath: join(
+      app.getAppPath(),
+      "node_modules",
+      "better-sqlite3",
+      "build",
+      "Release",
+      "better_sqlite3.node",
+    ),
   };
 
   await ensurePackagedNamespacePaths(paths);
@@ -284,6 +297,7 @@ void main().catch(async (error: unknown) => {
       appVersion: startupTelemetryContext.appVersion,
       namespace: startupTelemetryContext.namespace,
       source: startupTelemetryContext.source,
+      nativeModulePath: startupTelemetryContext.nativeModulePath,
     });
   }
   process.exit(1);

apps/packaged/src/startup-telemetry.ts

@@ -22,9 +22,15 @@
 // in apps/daemon/src/analytics.ts — stability data is retained even for
 // opted-out users (and the main process cannot read daemon consent anyway,
 // since the daemon isn't up). The Settings → Privacy copy MUST call this out.
+//
+// Payload PII: the free-form crash fields (error_message, error_stack) and every
+// path we send (log_path, native_module_path) run through `scrubUserPaths` to
+// strip the user's home dir, and the free-form text is length-capped. Startup
+// errors are module-resolution / daemon-exit messages, not user content, so this
+// bounds the exposure to build/OS strings rather than anything the user typed.
 
 import { readFile } from "node:fs/promises";
-import { readFileSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { release } from "node:os";
 
@@ -146,8 +152,19 @@ export function parseDaemonLogTail(logText: string): {
 // can't import the web module anyway, so we ship a focused scrubber here.
 export function scrubUserPaths(value: string): string {
   return value
-    .replace(/\/(Users|home)\/[^/\s]+/g, "/$1/<redacted>")
-    .replace(/([A-Za-z]:\\Users\\)[^\\\s]+/g, "$1<redacted>");
+    // Windows profile dirs FIRST, either separator style (`C:\Users\…` or the
+    // slash-normalized `C:/Users/…` that JS/Electron/Node diagnostics commonly
+    // emit). Consume the WHOLE segment up to the next slash/backslash — a
+    // profile dir can contain spaces ("John Doe"), and a whitespace boundary
+    // would leak the tail ("<redacted> Doe/…"). Anchored on `<drive>:` so it
+    // only fires on a real Windows home path; `\r\n` in the class stops it from
+    // running across lines in a multi-line stack. Runs before the POSIX rule
+    // because that rule also matches the "/Users/" inside a `C:/Users/` path.
+    .replace(/([A-Za-z]:[\\/]Users[\\/])[^\\/\r\n]+/g, "$1<redacted>")
+    // POSIX home dirs. Real macOS/Linux home segments cannot contain spaces, so
+    // the whitespace boundary is correct here and avoids over-redacting a
+    // following word in free-form crash text.
+    .replace(/\/(Users|home)\/[^/\s]+/g, "/$1/<redacted>");
 }
 
 function osName(platform: NodeJS.Platform = process.platform): string {
@@ -196,6 +213,28 @@ async function defaultReadLogTail(path: string): Promise<string | null> {
   }
 }
 
+// Keep the message/stack payload bounded (a stack can be arbitrarily long).
+const ERROR_MESSAGE_MAX = 1000;
+const ERROR_STACK_MAX = 2000;
+
+function truncateForTelemetry(value: string, max: number): string {
+  return value.length > max ? `${value.slice(0, max)}…[+${value.length - max} chars]` : value;
+}
+
+// Best-effort probe: does the native module actually exist on THIS machine, and
+// how big is it? The field crash is a subset of machines rather than a build
+// defect (the shipped .node is present + signed + resolvable), so per-machine
+// existence/size is the signal that separates "file missing" from "file present
+// but unloadable (arch/quarantine/AV)".
+function defaultStatNativeModule(path: string): { size: number } | null {
+  try {
+    const s = statSync(path);
+    return s.isFile() ? { size: s.size } : null;
+  } catch {
+    return null;
+  }
+}
+
 export interface CaptureDeps {
   fetchImpl?: typeof fetch;
   timeoutMs?: number;
@@ -277,10 +316,15 @@ export interface ReportStartupFailureArgs {
   appVersion: string | null;
   namespace: string;
   source: string;
+  // Absolute path to the daemon's better-sqlite3 native binding, so the report
+  // can probe whether that .node exists on this machine. Optional: null skips
+  // the probe (fields report null).
+  nativeModulePath?: string | null;
 }
 
 export interface ReportDeps extends CaptureDeps {
   readLogTail?: (path: string) => Promise<string | null>;
+  statNativeModule?: (path: string) => { size: number } | null;
 }
 
 // The single entry point index.ts's fatal-exit catch calls. Orchestrates
@@ -302,15 +346,48 @@ export async function reportStartupFailure(
         missingModule = parsed.missingModule;
       }
     }
+    const rawMessage =
+      args.error instanceof Error
+        ? args.error.message
+        : args.error == null
+          ? ""
+          : String(args.error);
+    const rawStack =
+      args.error instanceof Error && typeof args.error.stack === "string"
+        ? args.error.stack
+        : null;
+    // Probe the native module on THIS machine (existence + size). This is the
+    // signal the `unknown` bucket (no daemon log to parse) otherwise lacks, and
+    // it distinguishes "file missing" from "file present but unloadable".
+    let nativeModulePresent: boolean | null = null;
+    let nativeModuleSize: number | null = null;
+    let nativeModulePath: string | null = null;
+    if (args.nativeModulePath) {
+      const stat = (deps.statNativeModule ?? defaultStatNativeModule)(args.nativeModulePath);
+      nativeModulePresent = stat != null;
+      nativeModuleSize = stat?.size ?? null;
+      nativeModulePath = scrubUserPaths(args.nativeModulePath);
+    }
     const properties: Record<string, unknown> = {
       failure_kind: classification.failureKind,
       exit_code: classification.exitCode,
       signal: classification.signal,
       error_name: args.error instanceof Error ? args.error.name : "unknown",
       error_code: errorCode ?? null,
       missing_module: missingModule ?? null,
-      // Structured fields only — no raw message/stack. Scrub the one path we do
-      // send so a user's home dir never reaches PostHog.
+      // Scrub every path we send (message/stack/log/native path) so a user's
+      // home dir never reaches PostHog; truncate free-form text to bound the
+      // payload. These crash-scene fields are why the mac subset can't resolve
+      // the module and what the Windows `unknown` bucket actually threw.
+      error_message: rawMessage
+        ? truncateForTelemetry(scrubUserPaths(rawMessage), ERROR_MESSAGE_MAX)
+        : null,
+      error_stack: rawStack
+        ? truncateForTelemetry(scrubUserPaths(rawStack), ERROR_STACK_MAX)
+        : null,
+      native_module_present: nativeModulePresent,
+      native_module_size: nativeModuleSize,
+      native_module_path: nativeModulePath,
       log_path: classification.logPath ? scrubUserPaths(classification.logPath) : null,
       app_version: args.appVersion,
       namespace: args.namespace,

apps/packaged/tests/startup-telemetry.test.ts

@@ -103,6 +103,47 @@ describe('scrubUserPaths', () => {
       'C:\\Users\\<redacted>\\AppData\\Roaming',
     );
   });
+
+  it('redacts the FULL Windows profile segment even when it contains spaces', () => {
+    // A Windows profile dir can contain whitespace ("John Doe"). The redaction
+    // must consume the whole segment up to the next separator, not stop at the
+    // first space and leak the surname.
+    const scrubbed = scrubUserPaths('C:\\Users\\John Doe\\AppData\\Roaming');
+    expect(scrubbed).toBe('C:\\Users\\<redacted>\\AppData\\Roaming');
+    expect(scrubbed).not.toContain('Doe');
+  });
+
+  it('scrubs a spaced Windows profile embedded in a crash message/stack', () => {
+    const raw =
+      "Cannot find package 'better-sqlite3' imported from C:\\Users\\John Doe\\App\\Resources\\app\\daemon\\server.mjs";
+    const scrubbed = scrubUserPaths(raw);
+    expect(scrubbed).not.toContain('John Doe');
+    expect(scrubbed).not.toContain('Doe');
+    expect(scrubbed).toContain('C:\\Users\\<redacted>\\App\\Resources');
+  });
+
+  it('redacts SLASH-separated Windows home paths with spaces (forward-slash form)', () => {
+    // JS/Electron/Node diagnostics frequently normalize Windows paths to forward
+    // slashes; the profile segment can still contain a literal space. The POSIX
+    // "/Users/" rule alone would stop at the space and leak the tail.
+    expect(scrubUserPaths('C:/Users/John Doe/AppData/Roaming')).toBe(
+      'C:/Users/<redacted>/AppData/Roaming',
+    );
+  });
+
+  it('scrubs a slash-form spaced Windows profile embedded in a crash message', () => {
+    const raw =
+      "Cannot find package 'better-sqlite3' imported from C:/Users/John Doe/App/Resources/app/daemon/server.mjs";
+    const scrubbed = scrubUserPaths(raw);
+    expect(scrubbed).not.toContain('John Doe');
+    expect(scrubbed).not.toContain('Doe');
+    expect(scrubbed).toContain('C:/Users/<redacted>/App/Resources');
+  });
+
+  it('does not over-redact across lines in a multi-line stack', () => {
+    const scrubbed = scrubUserPaths('a C:\\Users\\John Doe\\x\nb /Users/bob/y');
+    expect(scrubbed).toBe('a C:\\Users\\<redacted>\\x\nb /Users/<redacted>/y');
+  });
 });
 
 describe('resolveStartupDistinctId', () => {
@@ -292,4 +333,73 @@ describe('reportStartupFailure', () => {
     );
     expect(fetchImpl).not.toHaveBeenCalled();
   });
+
+  // Why these exist: the field crash is a SUBSET of machines (verified 2026-07-06
+  // — the shipped 0.13.0 DMG's better_sqlite3.node is present, signed, notarized,
+  // and resolvable, so it is NOT a build defect). To learn WHY a given machine
+  // can't load it, the event must carry on-machine evidence: the scrubbed error
+  // message/stack (the only signal for the `unknown` bucket, which has no daemon
+  // log to parse) and whether the native module file actually exists there.
+  it('captures scrubbed error message/stack + native-module probe (on-machine evidence)', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(new Response('ok'));
+    const error = new Error(
+      "Cannot find package 'better-sqlite3' imported from /Users/liudetao/App/Contents/Resources/app/prebundled/daemon/server.mjs",
+    );
+    error.stack = `${error.message}\n    at file:///Users/liudetao/App/Contents/Resources/app/prebundled/daemon/server.mjs:1:1`;
+    await reportStartupFailure(
+      {
+        error,
+        isPathAccess: false,
+        posthogKey: 'phc_test',
+        posthogHost: null,
+        distinctId: 'd',
+        appVersion: '0.13.0',
+        namespace: 'release-stable',
+        source: 'packaged',
+        nativeModulePath:
+          '/Users/liudetao/App/Contents/Resources/app/node_modules/better-sqlite3/build/Release/better_sqlite3.node',
+      },
+      {
+        fetchImpl: fetchImpl as unknown as typeof fetch,
+        readLogTail: async () => null,
+        statNativeModule: (p) => (p.endsWith('better_sqlite3.node') ? { size: 1_234_567 } : null),
+      },
+    );
+    const [, init] = fetchImpl.mock.calls[0] as [string, RequestInit];
+    const props = (JSON.parse(init.body as string) as { properties: Record<string, unknown> }).properties;
+    // scrubbed message/stack: content kept, home dir gone.
+    expect(props.error_message).toContain("Cannot find package 'better-sqlite3'");
+    expect(props.error_message).not.toContain('liudetao');
+    expect(String(props.error_stack)).not.toContain('liudetao');
+    // native-module probe answers "is the .node actually on THIS machine".
+    expect(props.native_module_present).toBe(true);
+    expect(props.native_module_size).toBe(1_234_567);
+    expect(props.native_module_path).not.toContain('liudetao');
+  });
+
+  it('reports native_module_present=false when the .node is missing on the machine', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(new Response('ok'));
+    await reportStartupFailure(
+      {
+        error: new Error('boom'),
+        isPathAccess: false,
+        posthogKey: 'phc_test',
+        posthogHost: null,
+        distinctId: 'd',
+        appVersion: '0.13.0',
+        namespace: 'release-stable',
+        source: 'packaged',
+        nativeModulePath: '/a/b/better_sqlite3.node',
+      },
+      {
+        fetchImpl: fetchImpl as unknown as typeof fetch,
+        readLogTail: async () => null,
+        statNativeModule: () => null,
+      },
+    );
+    const [, init] = fetchImpl.mock.calls[0] as [string, RequestInit];
+    const props = (JSON.parse(init.body as string) as { properties: Record<string, unknown> }).properties;
+    expect(props.native_module_present).toBe(false);
+    expect(props.native_module_size).toBeNull();
+  });
 });

packages/contracts/src/analytics/events/result-events.ts

@@ -663,6 +663,20 @@ export interface PackagedRuntimeFailedProps {
   // The unresolved module when error_code is a module-resolution failure
   // (e.g. `better-sqlite3` for #4638).
   missing_module: string | null;
+  // Crash-scene evidence added for the field-crash subset (#4638 follow-up): the
+  // shipped build is verified-good, so these separate a machine-side "module
+  // missing/unloadable" from a code path, and give the Windows `unknown` bucket
+  // (which has no daemon log to parse) its only signal. All scrubbed of the
+  // user's home dir and truncated before send.
+  //
+  // Free-form error text off the top-level thrown error (not the log tail).
+  error_message?: string | null;
+  error_stack?: string | null;
+  // Probe of the daemon's better-sqlite3 native binding on THIS machine.
+  // present=null when no path was supplied; size is bytes when present.
+  native_module_present?: boolean | null;
+  native_module_size?: number | null;
+  native_module_path?: string | null;
   // Scrubbed of the user's home dir before send.
   log_path: string | null;
   app_version: string | null;