T6: mobile-parity options and default-sanitizer access

[krassx]

Review-only PR. This change is already on main (the repo works directly on main; see CLAUDE.md). The base branch is the commit it forked from, so the diff below is exactly this task. Merging this PR changes nothing. Review findings become follow-up commits on main. Plan: docs/design/mobile-api-alignment.md.

Adds captureLogsLevel, captureBreadcrumbs, detectHttpErrors (new provider), captureNetworkDefaultSanitizer, reportDefaultCrashPriority, reportDefaultErrorPriority and getDefaultNetworkSanitizer() (a custom network filter replaces the default sanitizer; this lets it be composed).

Review focus / known gaps

• captureBreadcrumbs defaults to true (mobile: false): UI breadcrumbs are a core web signal. Turning it off drops every breadcrumb, including manual ones. Documented under Kept differences.
• detectHttpErrors tested against stubbed fetch only (no real XHR / node:http / Bun / Deno / browser).
• Electron native-crash recovery ignores reportDefaultCrashPriority (keeps blocker).
• getDefaultNetworkSanitizer is not re-exported from the umbrella edge/worker entries.

🤖 Generated with Claude Code

[cursor]

Deep review (T6: mobile-parity options and default-sanitizer access)

Reviewed 382bdee against 5b0a816 (review/base-1), including callers in @bugsee/browser / @bugsee/node, the fetch/XHR/node:http interceptors the new detector actually sees, and the existing sanitizer / reporting paths this wires into. No prior review threads on this PR.

The option plumbing is in good shape: friendly names resolve onto the canonical com.bugsee.option.* keys, land on sdk.options (dots-to-colons), captureLogsLevel filters both client.log() and console capture before the log filter, derived crash/error severity is tracked out-of-band so an explicit per-call value still wins, and getDefaultNetworkSanitizer() is the same sanitize the provider uses. Those pieces look correct.

The problem is the new http-error detector. It tries to ignore user aborts, but that only works for XHR. fetch (and node:http destroy/AbortSignal) emit error, so an opted-in SPA will file real error reports for cancelled in-flight requests. Path IDs in the report summary also undo the grouping the query-stripping was written to protect.

Overall risk: Medium
Merge recommendation: Request changes

Must fix

1. P1 — detectHttpErrors reports aborted fetch / node:http as failures (http-error-provider.ts vs fetch interceptor reject path).
2. P2 — report text keeps path IDs, so /orders/1 vs /orders/2 become distinct issues after query-stripping was added specifically to avoid that.

Residual (documented, not blocking this review)

• Electron native-crash recovery still ignores reportDefaultCrashPriority.
• getDefaultNetworkSanitizer is not re-exported from the umbrella edge/worker entries.
• detectHttpErrors is only registered in @bugsee/browser and @bugsee/node (edge/worker/webview resolve the option onto the wire but never install the provider).

What looks solid

• hasDefaultSeverity WeakSet keeps the Report wire shape unchanged and lets a report handler rewrite severity afterwards.
• Network-filter XOR is documented at the public setNetworkEventFilter seam, with a compose API that actually reuses the built-in sanitizer.
• Query, fragment, and URL credentials are stripped before the summary, and own SDK traffic stays skipped because the detector rides the interceptors.
• Own 20/min budget is separate from the client capture limiter, so a failing poll cannot starve crash reports.

  

_{Sent by Cursor Automation: Bugsee code review}

[krassx]

Review findings triaged against current main (this PR branch is a frozen snapshot, so its diff does not show the fixes): http-error aborts/path IDs, getDefaultNetworkSanitizer exports and wiring were fixed on main earlier; sanitizer numberless and short-token holes closed (f0ff405).

The overview PR #46 (head = main) was re-reviewed at ba608c4: no remaining findings, recommendation Approve.

🤖 Generated with Claude Code

[cursor]

Re-review (author triage vs main)

Verified the claimed fixes against origin/main at ba608c4. This PR branch is still the frozen T6 snapshot (382bdee), so the diff here still shows the pre-fix detector. The product bugs this review flagged are gone on main.

P1 abort (fully_addressed). On main, detectHttpErrors only files status 500–599. Transport failures and cancellations have no HTTP status, so they drop before a report is built. Independently, fetch now emits stage abort for AbortError and for a caller signal that has already fired, and node:http does the same for AbortError / ABORT_ERR. Tests cover abort-by-name, already-aborted signal, and a live signal that still reports a real network error as error.

P2 path IDs (fully_addressed). reportableUrl now runs sanitizeDetectorUrl, which templates numeric / UUID / token-shaped path segments (/users/42/orders → /users/{id}/orders). Grouping is pinned with a synthetic crash.json frame (HttpError.<METHOD> <templated URL> <status>), plus per-session de-dup on that label. The old assertion that /orders/42 is preserved is gone.

Also confirmed on main: getDefaultNetworkSanitizer is re-exported from the umbrella edge-light / worker / workerd entries.

Overall risk: Low
Merge recommendation: Approve (review-only PR; findings closed on main, nothing left to gate here)

No remaining P0–P3 against current main.

  

_{Sent by Cursor Automation: Bugsee code review}

[krassx]

Closing instead of merging: this review-only branch is a frozen snapshot that now conflicts with the review base branch after #37/#40/#43/#46 were merged. Its content is already on main, and every finding was addressed there (see the earlier triage comment; #46 was approved at the final review).

🤖 Generated with Claude Code