P3-6: Autostart, diagnostics export, opt-in error reporting #35

New issue

Open

opened 2026-09-10 17:44:31 +00:00 by Cordy · 0 comments

Cordy commented

2026-09-10 17:44:31 +00:00

Owner

Depends on P3-5.

1. Autostart

A sync client that does not start with the session does not sync.

Windows: registry HKCU\Software\Microsoft\Windows\CurrentVersion\Run, or a Startup shortcut.
macOS: SMAppService login item (the modern replacement for the deprecated login-item APIs).
Linux: an XDG autostart .desktop file in ~/.config/autostart/.

Make it a user-visible setting, on by default, and policy-overridable (P3-1).

2. Diagnostics export

One button producing a single file you can ask a customer to email. This is the primary support mechanism, and it requires no network at all.

Include: app version, OS version, config with credentials redacted, recent log lines, the last sync Result summary, counts from the state DB. Exclude: file contents, full file listings, anything resembling a credential.

Write a test that generates a bundle from a config containing a known password and asserts that string appears nowhere in the output. This test is the whole point of the feature being safe to use.

3. Opt-in error reporting

Per docs/design-spec.md §8.2 — and this needs care, because Cairn's marketing promise is "no phone-home, ever".

Off by default. Nothing is transmitted unless the user turns it on.
On crash, show the user exactly what would be sent — stack trace, app version, OS version — before offering to send it. No hidden payload.
Send to a self-hosted collector (GlitchTip or self-hosted Sentry) on our own infrastructure. No third-party processor.
Policy-disableable fleet-wide.
Rejected: always-on telemetry. It would contradict the product's central claim, and the claim is worth more than the data.

4. State the network behaviour honestly

Add a Privacy panel in Settings, stating plainly:

The Cairn server never phones home. This client does exactly two optional things: it checks for updates, and — only if you turn it on — it sends crash reports. Both can be switched off by you, or by your administrator.

Mirror this wording in the handbook and on the website. Ambiguity here would undermine the strongest claim the product makes.

Steps

Implement autostart per platform, with a test per platform where feasible.
Implement diagnostics export plus the redaction test.
Implement opt-in crash reporting with the pre-send preview.
Add the Privacy panel.
Commit: git commit -s -m "feat(app): autostart, diagnostics export, opt-in error reporting"

Acceptance criteria

Autostart works on all three platforms and is policy-overridable.
The redaction test passes: no credential in any exported bundle.
Error reporting is off until explicitly enabled, and shows its payload first.

Depends on P3-5. ## 1. Autostart A sync client that does not start with the session does not sync. - **Windows:** registry `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, or a Startup shortcut. - **macOS:** `SMAppService` login item (the modern replacement for the deprecated login-item APIs). - **Linux:** an XDG autostart `.desktop` file in `~/.config/autostart/`. Make it a user-visible setting, on by default, and policy-overridable (P3-1). ## 2. Diagnostics export One button producing a single file you can ask a customer to email. This is the **primary** support mechanism, and it requires no network at all. Include: app version, OS version, config **with credentials redacted**, recent log lines, the last sync `Result` summary, counts from the state DB. Exclude: file contents, full file listings, anything resembling a credential. - [ ] Write a test that generates a bundle from a config containing a known password and asserts that string appears **nowhere** in the output. This test is the whole point of the feature being safe to use. ## 3. Opt-in error reporting Per `docs/design-spec.md` §8.2 — and this needs care, because Cairn's marketing promise is "no phone-home, ever". - **Off by default.** Nothing is transmitted unless the user turns it on. - On crash, **show the user exactly what would be sent** — stack trace, app version, OS version — before offering to send it. No hidden payload. - Send to a **self-hosted collector** (GlitchTip or self-hosted Sentry) on our own infrastructure. No third-party processor. - Policy-disableable fleet-wide. - **Rejected: always-on telemetry.** It would contradict the product's central claim, and the claim is worth more than the data. ## 4. State the network behaviour honestly Add a Privacy panel in Settings, stating plainly: > The Cairn **server** never phones home. This **client** does exactly two optional things: it checks for updates, and — only if you turn it on — it sends crash reports. Both can be switched off by you, or by your administrator. Mirror this wording in the handbook and on the website. Ambiguity here would undermine the strongest claim the product makes. ## Steps - [ ] Implement autostart per platform, with a test per platform where feasible. - [ ] Implement diagnostics export **plus the redaction test**. - [ ] Implement opt-in crash reporting with the pre-send preview. - [ ] Add the Privacy panel. - [ ] Commit: `git commit -s -m "feat(app): autostart, diagnostics export, opt-in error reporting"` ## Acceptance criteria - Autostart works on all three platforms and is policy-overridable. - The redaction test passes: no credential in any exported bundle. - Error reporting is off until explicitly enabled, and shows its payload first.