Merge branch 'Cockatrice:master' into token-decrement-fix

cockatrice/CMakeLists.txt

@@ -15,6 +15,7 @@ set(cockatrice_SOURCES
     src/client/network/update/client/client_update_checker.cpp
     src/client/network/update/client/release_channel.cpp
     src/client/network/update/card_spoiler/spoiler_background_updater.cpp
+    src/client/crash/crash_reporter.cpp
     src/client/latency_graph_widget.cpp
     src/client/latency_status_widget.cpp
     src/client/lag_monitor.cpp
@@ -30,6 +31,7 @@ set(cockatrice_SOURCES
     src/interface/widgets/dialogs/dlg_connect.cpp
     src/interface/widgets/dialogs/dlg_convert_deck_to_cod_format.cpp
     src/interface/widgets/dialogs/dlg_create_game.cpp
+    src/interface/widgets/dialogs/dlg_crash_report.cpp
     src/interface/widgets/dialogs/dlg_default_tags_editor.cpp
     src/interface/widgets/dialogs/dlg_edit_avatar.cpp
     src/interface/widgets/dialogs/dlg_edit_password.cpp
@@ -578,6 +580,8 @@ target_link_libraries(
          ${COCKATRICE_QT_MODULES}
 )
 
+cockatrice_target_enable_crash_reporting(cockatrice)
+
 if(UNIX)
   if(APPLE)
     set(MACOSX_BUNDLE_INFO_STRING "${PROJECT_NAME}")

cockatrice/src/client/crash/crash_reporter.cpp

@@ -0,0 +1,616 @@
+#include "crash_reporter.h"
+
+#if COCKATRICE_WITH_CRASH_REPORTING
+#include <sentry.h>
+#endif
+
+#include <QByteArray>
+#include <QCoreApplication>
+#include <QDir>
+#include <QFile>
+#include <QJsonDocument>
+#include <QJsonObject>
+#include <QLockFile>
+#include <QLoggingCategory>
+#include <QRegularExpression>
+#include <QThread>
+#include <QUrl>
+#include <cstring>
+#include <libcockatrice/settings/personal_settings.h>
+#include <string>
+
+Q_LOGGING_CATEGORY(CrashReportLog, "crash_report");
+
+#if COCKATRICE_WITH_CRASH_REPORTING
+namespace
+{
+
+constexpr char CockatriceUrlScheme[] = "cockatrice://";
+
+/**
+ * @brief Qt-free cockatrice:// secret scrubber for the before_send hook.
+ *
+ * before_send does not run in async-signal context on our backends (breakpad invokes it on the
+ * crashing thread outside the signal handler, and crashpad/native crashes bypass the hook
+ * entirely), but it still avoids QString/QRegularExpression so it stays safe to call from the
+ * crash-handler thread. Truncates each URL at the first terminator, keeping scheme://host like
+ * redactCockatriceUrls does. (std::string allocates, so this is not strictly signal-safe.)
+ */
+std::string scrubCockatriceUrls(const char *input)
+{
+    std::string out;
+    const char *pos = input;
+    const char *scheme = CockatriceUrlScheme;
+    const size_t schemeLen = std::strlen(scheme);
+    while (*pos != '\0') {
+        const char *found = std::strstr(pos, scheme);
+        if (found == nullptr) {
+            out.append(pos);
+            break;
+        }
+        out.append(pos, found);
+        const char *hostEnd = found + schemeLen;
+        while (*hostEnd != '\0' && *hostEnd != '/' && *hostEnd != '?' && *hostEnd != '#' && *hostEnd != ' ' &&
+               *hostEnd != '\t' && *hostEnd != '\n' && *hostEnd != '\'' && *hostEnd != '"' && *hostEnd != '<' &&
+               *hostEnd != '>') {
+            ++hostEnd;
+        }
+        out.append(found, hostEnd);
+        pos = hostEnd;
+    }
+    return out;
+}
+
+void scrubStringValue(sentry_value_t holder, const char *key)
+{
+    sentry_value_t current = sentry_value_get_by_key(holder, key);
+    if (sentry_value_get_type(current) != SENTRY_VALUE_TYPE_STRING) {
+        return;
+    }
+    const char *raw = sentry_value_as_string(current);
+    if (raw == nullptr || std::strstr(raw, CockatriceUrlScheme) == nullptr) {
+        return;
+    }
+    sentry_value_set_by_key(holder, key, sentry_value_new_string(scrubCockatriceUrls(raw).c_str()));
+}
+
+/**
+ * @brief Scrub trivially reachable string values inside a breadcrumb data object.
+ */
+int scrubDataEntry(const char *key, sentry_value_t value, void *userdata)
+{
+    if (sentry_value_get_type(value) != SENTRY_VALUE_TYPE_STRING) {
+        return 0;
+    }
+    const char *raw = sentry_value_as_string(value);
+    if (raw == nullptr || std::strstr(raw, CockatriceUrlScheme) == nullptr) {
+        return 0;
+    }
+    auto *holder = static_cast<sentry_value_t *>(userdata);
+    sentry_value_set_by_key(*holder, key, sentry_value_new_string(scrubCockatriceUrls(raw).c_str()));
+    return 0;
+}
+
+void scrubDataObject(sentry_value_t data)
+{
+    if (sentry_value_get_type(data) != SENTRY_VALUE_TYPE_OBJECT) {
+        return;
+    }
+    sentry_value_foreach_key_value(data, scrubDataEntry, &data);
+}
+
+void scrubCrumbList(sentry_value_t crumbs)
+{
+    const size_t count = sentry_value_get_length(crumbs);
+    for (size_t i = 0; i < count; ++i) {
+        sentry_value_t crumb = sentry_value_get_by_index(crumbs, i);
+        if (sentry_value_get_type(crumb) != SENTRY_VALUE_TYPE_OBJECT) {
+            continue;
+        }
+        scrubStringValue(crumb, "message");
+        scrubDataObject(sentry_value_get_by_key(crumb, "data"));
+    }
+}
+
+void scrubBreadcrumbs(sentry_value_t event)
+{
+    // The SDK merges scope breadcrumbs onto the event as a plain list (sentry__value_merge_breadcrumbs
+    // in sentry_scope.c); the { "values": [...] } envelope shape only exists on the wire. Accept both
+    // so the scrubbing runs on the actual merged form.
+    sentry_value_t breadcrumbs = sentry_value_get_by_key(event, "breadcrumbs");
+    if (sentry_value_get_type(breadcrumbs) == SENTRY_VALUE_TYPE_LIST) {
+        scrubCrumbList(breadcrumbs);
+        return;
+    }
+    if (sentry_value_get_type(breadcrumbs) == SENTRY_VALUE_TYPE_OBJECT) {
+        sentry_value_t values = sentry_value_get_by_key(breadcrumbs, "values");
+        if (sentry_value_get_type(values) == SENTRY_VALUE_TYPE_LIST) {
+            scrubCrumbList(values);
+        }
+    }
+}
+
+/**
+ * @brief before_send hook: scrub cockatrice:// secrets from the event.
+ *
+ * Defense in depth — payloads we build are pre-redacted. No breadcrumbs are recorded today (the Qt
+ * integration stays off), so this currently covers the top-level message and logentry.formatted,
+ * plus any breadcrumb messages/data that reach the merged event in the future. Native crash
+ * minidumps bypass this hook regardless of backend: breakpad captures them in-process without
+ * invoking before_send, and fast-fail crashes on Windows skip the local handler, so before_send is
+ * never invoked for those.
+ */
+sentry_value_t scrubEventBeforeSend(sentry_value_t event, sentry_hint_t *hint, void *userData)
+{
+    Q_UNUSED(hint);
+    Q_UNUSED(userData);
+    scrubStringValue(event, "message");
+    sentry_value_t logentry = sentry_value_get_by_key(event, "logentry");
+    if (sentry_value_get_type(logentry) == SENTRY_VALUE_TYPE_OBJECT) {
+        scrubStringValue(logentry, "formatted");
+    }
+    scrubBreadcrumbs(event);
+    return event;
+}
+
+} // namespace
+#endif
+
+namespace
+{
+
+/**
+ * @brief DSN matcher shared by isDsnWellFormed() and describeDsn().
+ *
+ * Kept unanchored on purpose, mirroring the MATCHES in cmake/CrashReporting.cmake (CMake searches
+ * rather than anchoring), so the client never rejects a DSN the build itself baked in. Compiled once
+ * because QRegularExpression construction is not free and both helpers are called per pending
+ * envelope.
+ */
+const QRegularExpression &dsnPattern()
+{
+    static const QRegularExpression pattern(QStringLiteral("(https?)://([^@]+)@([^/]+)/([0-9]+)"));
+    return pattern;
+}
+
+} // namespace
+
+bool CrashReporter::isDsnWellFormed(const QString &dsn)
+{
+    return dsnPattern().match(dsn).hasMatch();
+}
+
+QString CrashReporter::describeDsn(const QString &dsn)
+{
+    const QRegularExpressionMatch match = dsnPattern().match(dsn);
+    if (!match.hasMatch()) {
+        return QString();
+    }
+    // Host and project id only: the key in group 2 must never reach a log line.
+    return QStringLiteral("%1 (project %2)").arg(match.captured(3), match.captured(4));
+}
+
+QString CrashReporter::describeOriginMismatch(const QString &envelopePath, const QString &currentDsn)
+{
+    const QString destination = describeDsn(currentDsn);
+    if (destination.isEmpty()) {
+        return QString();
+    }
+
+    QFile file(envelopePath);
+    if (!file.open(QIODevice::ReadOnly)) {
+        return QString();
+    }
+    // The envelope header is the first line and is small; the cap only keeps a corrupt file from
+    // being read in full.
+    const QByteArray headerLine = file.readLine(4096).trimmed();
+    if (headerLine.isEmpty() || !headerLine.startsWith('{')) {
+        return QString();
+    }
+    const QString originDsn = QJsonDocument::fromJson(headerLine).object().value(QStringLiteral("dsn")).toString();
+    const QString origin = describeDsn(originDsn);
+    // Equal destinations are not a mismatch: a different key for the same host and project still
+    // uploads where the crash was captured.
+    if (origin.isEmpty() || origin == destination) {
+        return QString();
+    }
+    return QStringLiteral("was captured for %1 but this session uploads with %2").arg(origin, destination);
+}
+
+bool CrashReporter::isReportingEnabled(const QString &dsn, PersonalSettings::CrashReportingMode consentMode)
+{
+    return !dsn.isEmpty() && consentMode != PersonalSettings::CrashReportingMode::NeverSend;
+}
+
+void CrashReporter::init(const QString &dsn,
+                         const QString &release,
+                         const QString &databasePath,
+                         PersonalSettings::CrashReportingMode consentMode)
+{
+    shutdown();
+    sentryDatabasePath = databasePath;
+    if (!isReportingEnabled(dsn, consentMode)) {
+        if (!dsn.isEmpty()) {
+            // A deliberate choice rather than a misconfiguration, so it is not a warning. The
+            // no-DSN case is reported by the caller, which is the only place that knows whether
+            // the environment or the build supplied the DSN.
+            qCInfo(CrashReportLog) << "crash reporting disabled by preference (Never send)";
+        }
+        return;
+    }
+    // Only created when the SDK will actually run: no-DSN launches stay side-effect free.
+#if COCKATRICE_WITH_CRASH_REPORTING
+    // A crash captured by an earlier run is uploaded by THIS session's transport, which posts every
+    // envelope with the DSN it was armed with (sentry-native keeps the DSN in the transport state,
+    // and envelopes restored from disk are raw, so their own "dsn" header is never read). When the
+    // two disagree the report lands in a project nobody chose, which no other log line reveals.
+    const QStringList pendingEnvelopes = pendingEnvelopePaths(sentryDatabasePath);
+    for (const QString &envelopePath : pendingEnvelopes) {
+        const QString mismatch = describeOriginMismatch(envelopePath, dsn);
+        if (!mismatch.isEmpty()) {
+            qCWarning(CrashReportLog) << "pending crash envelope" << envelopePath << mismatch;
+        }
+    }
+    qCInfo(CrashReportLog) << "crash reporting armed for" << describeDsn(dsn);
+    QDir().mkpath(sentryDatabasePath);
+    if (consentMode != PersonalSettings::CrashReportingMode::AlwaysSend) {
+        // sentry-native persists consent to <database>/user-consent and reloads it in sentry_init
+        // before old runs are processed, so a stale "given" from an earlier AlwaysSend run (or an
+        // earlier Send in Ask mode) would upload the next crash before the dialog asks. Our
+        // CrashReportingMode is the source of truth, so clear the persisted state first; asking
+        // afterwards re-establishes it via giveConsent()/revokeConsent().
+        QFile::remove(sentryDatabasePath + QStringLiteral("/user-consent"));
+    }
+    sentry_options_t *options = sentry_options_new();
+    sentry_options_set_dsn(options, dsn.toUtf8().constData());
+    sentry_options_set_release(options, release.toUtf8().constData());
+    sentry_options_set_database_path(options, sentryDatabasePath.toUtf8().constData());
+    // Consent-gated uploads: crashes are captured into the local database but
+    // nothing leaves the machine until giveConsent(). cache_keep holds the previous run's
+    // crash envelope in <database>/cache instead of dropping it at init, so the Ask dialog
+    // decides its fate: giveConsent() flushes it via the transport retry, revokeConsent()
+    // deletes it below. This also covers the first crash after switching to AlwaysSend,
+    // which giveConsent() (running after init) would otherwise miss. http_retry is required
+    // for the flush: without it the held envelope is written with a plain filename the retry
+    // scanner skips, and giveConsent()'s sentry_transport_retry() sends nothing.
+    sentry_options_set_require_user_consent(options, 1);
+    sentry_options_set_cache_keep(options, SENTRY_CACHE_KEEP_OFFLINE);
+    sentry_options_set_http_retry(options, 1);
+    sentry_options_set_before_send(options, scrubEventBeforeSend, nullptr);
+    ready = (sentry_init(options) == 0);
+#else
+    Q_UNUSED(release);
+    // Not a misconfiguration like an empty DSN: this build cannot report whatever the DSN says, so
+    // a tester forcing a crash needs to know the difference.
+    qCInfo(CrashReportLog) << "crash reporting unavailable: built without Sentry support";
+    ready = false;
+#endif
+}
+
+bool CrashReporter::isReady() const
+{
+    return ready;
+}
+
+void CrashReporter::shutdown()
+{
+#if COCKATRICE_WITH_CRASH_REPORTING
+    if (ready) {
+        sentry_close();
+    }
+#endif
+    ready = false;
+}
+
+CrashReporter::~CrashReporter() = default;
+CrashReporter::CrashReporter() = default;
+
+bool CrashReporter::beginSession(const QString &dir)
+{
+    // Restartable: releasing first keeps begin->end->begin round-trips clean.
+    endSession();
+
+    QDir().mkpath(dir);
+    const QDir sessionDir(dir);
+    const QString selfName = QStringLiteral("session-%1").arg(QCoreApplication::applicationPid());
+
+    bool unclean = false;
+    const QStringList leftovers = sessionDir.entryList({QStringLiteral("session-*")}, QDir::Files);
+    for (const QString &name : leftovers) {
+        if (name == selfName) {
+            continue;
+        }
+        const QString path = sessionDir.filePath(name);
+        QLockFile probe(path);
+        // Long-lived session lock: stale means "owner dead", regardless of file age, so a
+        // crash followed by an immediate relaunch (younger than the 30 s default) is still
+        // detected. tryLock() only deletes the file when it finds it stale, so a live
+        // concurrent instance's lock is never touched here. (The static
+        // QLockFile::removeStaleLockFile(path) form does not exist in Qt5/Qt6, and the
+        // member removeStaleLockFile() force-removes without a staleness check, so neither
+        // is usable for this scan.)
+        probe.setStaleLockTime(0);
+        if (probe.tryLock(0)) {
+            unclean = true;
+            probe.unlock(); // deletes the stale file
+            continue;
+        }
+        // tryLock failed: either a live concurrent instance owns the file, or it is
+        // unreadable (garbage/empty) and therefore has no live owner. Only the latter is
+        // cleaned up; a live instance is left alone. On Unix QLockFile creates the file
+        // before writing the pid, so a second instance starting at the same moment can
+        // briefly observe an empty (or half-written) file for a live owner: re-read once
+        // after a beat so a live owner's fresh lock is never mistaken for garbage and deleted.
+        qint64 pid = 0;
+        QString hostname, appname;
+        if (!probe.getLockInfo(&pid, &hostname, &appname)) {
+            QThread::msleep(100);
+            if (!probe.getLockInfo(&pid, &hostname, &appname)) {
+                QFile::remove(path);
+                unclean = true;
+            }
+        }
+    }
+
+    sessionLockPath = sessionDir.filePath(selfName);
+    sessionLock = std::make_unique<QLockFile>(sessionLockPath);
+    sessionLock->setStaleLockTime(0);
+    if (!sessionLock->tryLock(0)) {
+        qCWarning(CrashReportLog) << "Failed to claim session lock at" << sessionLockPath;
+    }
+    return unclean;
+}
+
+void CrashReporter::endSession()
+{
+    if (sessionLock) {
+        // unlock() removes the lock file; nothing left to clean up.
+        sessionLock->unlock();
+        sessionLock.reset();
+    } else if (!sessionLockPath.isEmpty()) {
+        // The lock was never claimed (a live concurrent instance owns its file): only our
+        // own unclaimed file, if tryLock left one behind, is removed.
+        QFile::remove(sessionLockPath);
+    }
+    sessionLockPath.clear();
+}
+
+void CrashReporter::giveConsent()
+{
+#if COCKATRICE_WITH_CRASH_REPORTING
+    if (ready) {
+        sentry_user_consent_give();
+    }
+#endif
+}
+
+void CrashReporter::revokeConsent()
+{
+#if COCKATRICE_WITH_CRASH_REPORTING
+    // Revoke (not reset): an explicit refusal blocks uploads; reset would
+    // return to unknown, which blocks uploads too but loses the decision.
+    if (ready) {
+        sentry_user_consent_revoke();
+        // Drop the held crash envelope: without this it would sit in <database>/cache and
+        // upload on the next give (e.g. after switching to AlwaysSend), after the user
+        // explicitly refused it. The SDK recreates the directory as needed.
+        QDir(sentryDatabasePath + QStringLiteral("/cache")).removeRecursively();
+    }
+#endif
+}
+
+bool CrashReporter::sendReport(const QString &redactedPreview, const QString &userNote)
+{
+#if COCKATRICE_WITH_CRASH_REPORTING
+    if (!ready) {
+        return false;
+    }
+    // Local scope (not the global one): the log preview rides only on this event. A global
+    // sentry_attach_bytes would linger and ride along on every later event in the session,
+    // including a real native crash later on — and with the crashpad backend byte attachments
+    // are written to disk for exactly that. In-memory bytes also mean no report files land in
+    // the Sentry DB dir, so there is no disk growth and no same-second filename collision.
+    sentry_scope_t *scope = sentry_scope_new();
+    if (scope == nullptr) {
+        qCWarning(CrashReportLog) << "Could not create scope for crash report";
+        return false;
+    }
+    const QByteArray previewBytes = redactedPreview.toUtf8();
+    const sentry_uuid_t attachmentId = sentry_scope_attach_bytes(
+        scope, previewBytes.constData(), static_cast<size_t>(previewBytes.size()), "crash-log.txt");
+    const bool attachOk = sentry_uuid_is_nil(&attachmentId) == 0;
+    if (!attachOk) {
+        qCWarning(CrashReportLog) << "Could not attach crash log to crash report";
+    }
+    bool noteAttachOk = true;
+    if (!userNote.isEmpty()) {
+        const QByteArray noteBytes = userNote.toUtf8();
+        const sentry_uuid_t noteId = sentry_scope_attach_bytes(scope, noteBytes.constData(),
+                                                               static_cast<size_t>(noteBytes.size()), "user-note.txt");
+        noteAttachOk = sentry_uuid_is_nil(&noteId) == 0;
+        if (!noteAttachOk) {
+            qCWarning(CrashReportLog) << "Could not attach user note to crash report";
+        }
+    }
+
+    // Release is attached automatically from the init options. Deliberately no
+    // sentry_set_user call: the report must carry no PII. The dialog collects
+    // no contact info, so the message event + attachments are the whole payload
+    // (sentry_value_new_feedback/sentry_capture_feedback exist but stay unused).
+    sentry_value_t event = sentry_value_new_message_event(SENTRY_LEVEL_ERROR, "crash-report", "Crash report");
+    const sentry_uuid_t eventId = sentry_scope_capture_event(scope, event, nullptr);
+    sentry_scope_free(scope);
+    if (sentry_uuid_is_nil(&eventId)) {
+        qCWarning(CrashReportLog) << "Failed to capture crash report event";
+        return false;
+    }
+    char eventIdStr[37] = {};
+    sentry_uuid_as_string(&eventId, eventIdStr);
+    // Capture only queues the envelope to the background transport: a network failure stays
+    // invisible here, so true means "queued", not "delivered". The Save fallback is offered only
+    // when the local capture itself fails.
+    qCInfo(CrashReportLog) << "Crash report queued, event id:" << eventIdStr;
+    // A failed attachment still captures the event above, but reports failure
+    // so callers offer the local-save fallback instead of silent success.
+    return attachOk && noteAttachOk;
+#else
+    Q_UNUSED(redactedPreview);
+    Q_UNUSED(userNote);
+    return false;
+#endif
+}
+
+bool CrashReporter::appendAttachmentToEnvelope(const QString &envelopePath,
+                                               const QString &filename,
+                                               const QByteArray &payload)
+{
+    // QIODevice::ReadWrite creates a missing file; appending to a file that was never
+    // written by the SDK would fabricate an envelope, so require it to exist.
+    if (!QFile::exists(envelopePath)) {
+        return false;
+    }
+    QFile file(envelopePath);
+    if (!file.open(QIODevice::ReadWrite)) {
+        return false;
+    }
+    // Item boundaries are single newlines: make sure the header starts on a fresh line.
+    if (file.size() > 0) {
+        if (!file.seek(file.size() - 1)) {
+            return false;
+        }
+        char lastByte = 0;
+        if (file.read(&lastByte, 1) != 1) {
+            return false;
+        }
+        if (lastByte != '\n' && file.write("\n", 1) != 1) {
+            return false;
+        }
+    }
+    // Item shape mirrors sentry__envelope_add_attachment in the SDK. `length` is what the
+    // SDK's envelope re-parser uses to frame the payload (a missing length ends the item at
+    // the next newline, which would truncate a multi-line log and make the rest of the file
+    // fail to parse); `attachment_length` is the logical attachment size the SDK also emits.
+    // The filename is a compile-time ASCII constant from the callers, so no JSON escaping is
+    // needed.
+    const QByteArray header = QByteArrayLiteral("{\"type\":\"attachment\",\"length\":") +
+                              QByteArray::number(payload.size()) + QByteArrayLiteral(",\"attachment_length\":") +
+                              QByteArray::number(payload.size()) + QByteArrayLiteral(",\"filename\":\"") +
+                              filename.toUtf8() + QByteArrayLiteral("\",\"content_type\":\"text/plain\"}") + '\n';
+    if (file.write(header) != header.size()) {
+        return false;
+    }
+    return file.write(payload) == payload.size();
+}
+
+QStringList CrashReporter::pendingEnvelopePaths(const QString &databasePath)
+{
+    static const auto isUuid = [](const QString &id) { return id.size() == 36 && id.count(QLatin1Char('-')) == 4; };
+    static const auto isEnvelopeName = [](const QString &name) {
+        if (name == QStringLiteral("__sentry-crash.envelope")) {
+            return false;
+        }
+        const QString stem = name.left(name.size() - 9); // strip ".envelope"
+        if (isUuid(stem)) {
+            return true;
+        }
+        // Retry cache filename: "<ts>-<count>-<uuid>".
+        const qsizetype firstSep = stem.indexOf(QLatin1Char('-'));
+        const qsizetype secondSep = firstSep > 0 ? stem.indexOf(QLatin1Char('-'), firstSep + 1) : -1;
+        return firstSep > 0 && secondSep > 0 && isUuid(stem.mid(secondSep + 1)) && stem.left(firstSep).toLongLong() > 0;
+    };
+    QStringList result;
+    const QDir dbDir(databasePath);
+    if (!dbDir.exists()) {
+        return result;
+    }
+    // Consent-held envelopes (Ask mode: the SDK cached them at crash time instead
+    // of sending, see sentry__submit_envelope). Bare "<uuid>.envelope" with
+    // cache_keep only, "<ts>-<count>-<uuid>.envelope" with http_retry.
+    const QDir cacheDir(databasePath + QStringLiteral("/cache"));
+    const QStringList cacheNames = cacheDir.entryList({QStringLiteral("*.envelope")}, QDir::Files, QDir::Name);
+    for (const QString &name : cacheNames) {
+        if (isEnvelopeName(name)) {
+            result.append(cacheDir.filePath(name));
+        }
+    }
+    // In-flight envelopes dumped to the crashed run's own directory (AlwaysSend
+    // mode: consent was already given, so the transport dump wrote them there and
+    // sentry_init's process_old_runs replays them at startup — attach before init).
+    const QStringList runDirs =
+        dbDir.entryList({QStringLiteral("*.run")}, QDir::Dirs | QDir::NoDotAndDotDot, QDir::Name);
+    for (const QString &runDir : runDirs) {
+        const QDir dir(dbDir.filePath(runDir));
+        const QStringList names = dir.entryList({QStringLiteral("*.envelope")}, QDir::Files, QDir::Name);
+        for (const QString &name : names) {
+            if (isEnvelopeName(name)) {
+                result.append(dir.filePath(name));
+            }
+        }
+    }
+    return result;
+}
+
+int CrashReporter::attachToPendingCrashEnvelopes(const QString &redactedLogText, const QString &userNoteText)
+{
+    return attachToPendingCrashEnvelopes(sentryDatabasePath, redactedLogText, userNoteText);
+}
+
+int CrashReporter::attachToPendingCrashEnvelopes(const QString &databasePath,
+                                                 const QString &redactedLogText,
+                                                 const QString &userNoteText)
+{
+    if (databasePath.isEmpty()) {
+        return 0;
+    }
+    const QByteArray logBytes = redactedLogText.toUtf8();
+    const QByteArray noteBytes = userNoteText.toUtf8();
+    int attached = 0;
+    const QStringList envelopes = pendingEnvelopePaths(databasePath);
+    for (const QString &path : envelopes) {
+        bool ok = appendAttachmentToEnvelope(path, QStringLiteral("crash-log.txt"), logBytes);
+        if (ok && !noteBytes.isEmpty()) {
+            ok = appendAttachmentToEnvelope(path, QStringLiteral("user-note.txt"), noteBytes);
+        }
+        if (ok) {
+            ++attached;
+        } else {
+            qCWarning(CrashReportLog) << "Failed to attach crash log to pending envelope" << path;
+        }
+    }
+    if (attached > 0) {
+        qCInfo(CrashReportLog) << "Attached crash log and user note to" << attached << "pending crash envelope(s)";
+    }
+    return attached;
+}
+
+QString CrashReporter::sanitizeLogLine(const QString &line)
+{
+    static const auto colorEscapeCodePattern = QRegularExpression(QStringLiteral("\033\\[[0-9;]*m"));
+
+    QString sanitized = line;
+    sanitized.replace(colorEscapeCodePattern, "");
+    return sanitized;
+}
+
+QString CrashReporter::redactCockatriceUrls(const QString &line)
+{
+    static auto urlPattern = QRegularExpression(QStringLiteral("cockatrice://\\S+"));
+
+    // Single pass over the original line: rescanning the replaced text would match a redacted
+    // secret-free URL again and loop forever.
+    QString redacted;
+    redacted.reserve(line.size());
+    qsizetype pos = 0;
+    QRegularExpressionMatchIterator it = urlPattern.globalMatch(line);
+    while (it.hasNext()) {
+        QRegularExpressionMatch match = it.next();
+        redacted.append(line.mid(pos, match.capturedStart() - pos));
+        // The pattern only matches cockatrice:// URLs, so the check is folded into the parse:
+        // scheme://host, secrets dropped.
+        const QUrl parsed(match.captured(0));
+        redacted.append(parsed.scheme() + QStringLiteral("://") + parsed.host());
+        pos = match.capturedEnd();
+    }
+    redacted.append(line.mid(pos));
+    return redacted;
+}

cockatrice/src/client/crash/crash_reporter.h

@@ -0,0 +1,177 @@
+/**
+ * @file crash_reporter.h
+ * @ingroup Core
+ */
+
+#ifndef CRASH_REPORTER_H
+#define CRASH_REPORTER_H
+
+#include <QByteArray>
+#include <QLoggingCategory>
+#include <QString>
+#include <QStringList>
+#include <libcockatrice/settings/personal_settings.h>
+#include <memory>
+
+#ifndef COCKATRICE_WITH_CRASH_REPORTING
+#define COCKATRICE_WITH_CRASH_REPORTING 0
+#endif
+
+#ifndef COCKATRICE_SENTRY_DSN
+#define COCKATRICE_SENTRY_DSN ""
+#endif
+
+#ifndef COCKATRICE_SENTRY_RELEASE
+#define COCKATRICE_SENTRY_RELEASE ""
+#endif
+
+class QLockFile;
+
+Q_DECLARE_LOGGING_CATEGORY(CrashReportLog);
+
+/**
+ * @brief Sentry-backed crash-report facade, owned by main().
+ *
+ * An empty DSN (or Never consent) skips the SDK entirely, so the mock dialog
+ * fallback behaves exactly as before. All SDK calls are guarded so OFF builds
+ * compile to no-ops.
+ *
+ * @par Consent gating
+ * init() arms require-user-consent and before_send scrubbing. Stale persisted
+ * consent from a previous AlwaysSend run is cleared before init when the mode is
+ * not AlwaysSend, and cached crash envelopes are held for the dialog instead of
+ * being dropped. giveConsent()/revokeConsent() gate uploads.
+ *
+ * @par Envelope and log helpers
+ * attachToPendingCrashEnvelopes() folds the redacted log and the optional user
+ * note into the pending native crash event(s) before consent releases them, so
+ * dump, stack, log and note arrive as ONE Sentry event. sendReport() is the
+ * fallback for unclean exits that produced no native crash event, capturing a
+ * redacted message event with the log preview attached. The log redaction
+ * helpers are static and SDK-independent.
+ *
+ * @par Session tracking
+ * beginSession()/endSession() are SDK-independent: a QLockFile per process in
+ * the database dir detects unclean exits cross-platform, replacing the legacy
+ * Windows-only .dmp scan. The held lock makes the reporter non-copyable and
+ * non-movable.
+ */
+class CrashReporter
+{
+public:
+    CrashReporter();
+    CrashReporter(const CrashReporter &) = delete;
+    CrashReporter &operator=(const CrashReporter &) = delete;
+    CrashReporter(CrashReporter &&) = delete;
+    CrashReporter &operator=(CrashReporter &&) = delete;
+    ~CrashReporter();
+
+    void init(const QString &dsn,
+              const QString &release,
+              const QString &databasePath,
+              PersonalSettings::CrashReportingMode consentMode);
+    [[nodiscard]] bool isReady() const;
+    void shutdown();
+    void giveConsent();
+    void revokeConsent();
+    bool sendReport(const QString &redactedPreview, const QString &userNote = QString());
+
+    /**
+     * @brief Append the redacted log (and optional user note) to every pending
+     * native crash envelope in the local database, so the crashed event uploads
+     * with dump, stack, log and note together instead of the log arriving as a
+     * separate event that has to be correlated by hand. Both storage locations
+     * are covered: consent-held envelopes in <database>/cache (Ask mode) and
+     * in-flight envelopes dumped into <database>/<run>.run (AlwaysSend mode).
+     *
+     * For the AlwaysSend variant run this BEFORE init() (static overload): the
+     * startup replay of *.run envelopes happens inside sentry_init. SDK-independent
+     * plain-file surgery on the Sentry envelope format, so it stays unit-testable
+     * in OFF builds.
+     *
+     * @return the number of envelopes that received the attachments.
+     */
+    int attachToPendingCrashEnvelopes(const QString &redactedLogText, const QString &userNoteText);
+    static int attachToPendingCrashEnvelopes(const QString &databasePath,
+                                             const QString &redactedLogText,
+                                             const QString &userNoteText);
+
+    /**
+     * @brief Append one attachment item to a cached Sentry envelope file.
+     *
+     * An envelope is a newline-separated stream of item-header-line + payload
+     * pairs. The retry transport replays cached envelopes byte-for-byte
+     * (sentry-native 0.17.3 reads them raw and serializes raw envelopes back
+     * verbatim), so appending well-formed items associates them with the event
+     * already in the file; the first line (event id header) is never touched.
+     *
+     * @param filename ASCII-only item filename, embedded verbatim in the header.
+     */
+    static bool
+    appendAttachmentToEnvelope(const QString &envelopePath, const QString &filename, const QByteArray &payload);
+
+    /**
+     * @brief Pending crash envelopes in <database>: the consent-held files in
+     * <database>/cache and the in-flight files in <database>/<run>.run.
+     *
+     * Matches the cache filename conventions sentry-native accepts (see
+     * sentry__parse_cache_filename): bare "<uuid>.envelope" and retry
+     * "<ts>-<count>-<uuid>.envelope"; run dirs accept plain "<uuid>.envelope"
+     * minus the SDK's own "__sentry-crash.envelope" marker.
+     */
+    static QStringList pendingEnvelopePaths(const QString &databasePath);
+
+    /**
+     * @brief SDK-independent gating decision, unit-testable in OFF builds.
+     */
+    static bool isReportingEnabled(const QString &dsn, PersonalSettings::CrashReportingMode consentMode);
+
+    /**
+     * @brief Whether a DSN has the shape the build and the SDK require:
+     * <scheme>://<key>@<host>/<project-id>.
+     *
+     * Deliberately the same unanchored pattern cmake/CrashReporting.cmake matches (CMake's MATCHES
+     * searches rather than anchoring), so a DSN this build accepted is never rejected here. The SDK
+     * refuses to even build a request for a DSN it considers invalid, so an unchecked typo disables
+     * uploading with no error anywhere.
+     */
+    static bool isDsnWellFormed(const QString &dsn);
+
+    /**
+     * @brief Human-readable destination of a DSN, e.g. "o0.ingest.sentry.io (project 1234567)".
+     *
+     * Safe to log: the public key is never part of the result. Empty for a malformed DSN.
+     */
+    static QString describeDsn(const QString &dsn);
+
+    /**
+     * @brief Describe the captured-for DSN of a pending envelope when it points at a different
+     * destination than the DSN this session would upload it with; empty when they agree.
+     *
+     * sentry-native posts every envelope with the DSN held in the transport state of the session
+     * doing the sending (envelopes restored from disk are raw and their own "dsn" header is never
+     * read), so a cached crash envelope captured for one project can silently be uploaded to
+     * another - the exact way a tester's report lands in the wrong place. Compares destinations
+     * (host and project id), not raw strings, so a different key for the same project stays quiet.
+     */
+    static QString describeOriginMismatch(const QString &envelopePath, const QString &currentDsn);
+
+    /**
+     * @brief Claim this process's session lock, reporting a previous unclean exit.
+     * @return true if a leftover session lock from a dead process (or an unreadable
+     * garbage file) was found and cleaned; live concurrent instances are ignored.
+     */
+    bool beginSession(const QString &dir);
+    void endSession();
+
+    static QString sanitizeLogLine(const QString &line);
+    static QString redactCockatriceUrls(const QString &line);
+
+private:
+    bool ready = false;
+    QString sentryDatabasePath;
+    QString sessionLockPath;
+    std::unique_ptr<QLockFile> sessionLock;
+};
+
+#endif

cockatrice/src/interface/logger.cpp

@@ -5,6 +5,8 @@
 #include <QApplication>
 #include <QDateTime>
 #include <QDebug>
+#include <QDir>
+#include <QFileInfo>
 #include <QFlags>
 #include <QIODevice>
 #include <QLocale>
@@ -18,8 +20,11 @@
 
 #define LOGGER_MAX_ENTRIES 128
 #define LOGGER_FILENAME "qdebug.txt"
+#define LOGGER_SESSION_MARKER "Log session started at"
+#define LOGGER_PERSISTENT_MAX_BYTES (512 * 1024)
+#define LOGGER_PERSISTENT_KEEP_LINES 2000
 
-Logger::Logger() : logToFileEnabled(false)
+Logger::Logger() : logToFileEnabled(false), persistentLogEnabled(false)
 {
     logBuffer.append(getClientVersion());
     logBuffer.append(getSystemArchitecture());
@@ -35,6 +40,7 @@ Logger::Logger() : logToFileEnabled(false)
 Logger::~Logger()
 {
     closeLogfileSession();
+    closePersistentLogSession();
     logBuffer.clear();
 }
 
@@ -82,6 +88,137 @@ void Logger::closeLogfileSession()
     fileHandle.close();
 }
 
+void Logger::setPersistentLogPath(const QString &path)
+{
+    QMutexLocker locker(&mutex);
+    if (path.isEmpty() || (persistentLogEnabled && persistentLogPath == path)) {
+        return;
+    }
+
+    QDir().mkpath(QFileInfo(path).absolutePath());
+    persistentLogPath = path;
+    openPersistentLog(path);
+}
+
+void Logger::prunePersistentLog(const QString &path)
+{
+    QFileInfo info(path);
+    if (!info.exists() || info.size() <= LOGGER_PERSISTENT_MAX_BYTES) {
+        return;
+    }
+
+    QFile file(path);
+    if (!file.open(QIODevice::ReadOnly | QIODevice::Text)) {
+        return;
+    }
+    QList<QString> allLines;
+    QTextStream in(&file);
+    while (!in.atEnd()) {
+        allLines.append(in.readLine());
+    }
+    file.close();
+
+    const int start =
+        allLines.size() > LOGGER_PERSISTENT_KEEP_LINES ? allLines.size() - LOGGER_PERSISTENT_KEEP_LINES : 0;
+    if (!file.open(QIODevice::WriteOnly | QIODevice::Truncate | QIODevice::Text)) {
+        return;
+    }
+    QTextStream out(&file);
+    for (int i = start; i < allLines.size(); ++i) {
+        out << allLines.at(i) << Qt::endl;
+    }
+    file.close();
+}
+
+void Logger::openPersistentLog(const QString &path)
+{
+    prunePersistentLog(path);
+
+    persistentFileHandle.setFileName(path);
+    if (!persistentFileHandle.open(QIODevice::WriteOnly | QIODevice::Append | QIODevice::Text)) {
+        qWarning() << "Logger failed to open persistent log" << path << "for writing";
+        return;
+    }
+    persistentFileStream.setDevice(&persistentFileHandle);
+    persistentFileStream << LOGGER_SESSION_MARKER << " " << QDateTime::currentDateTime().toString() << Qt::endl;
+    persistentFileStream << getClientVersion() << Qt::endl;
+    persistentFileStream << getSystemArchitecture() << Qt::endl;
+    persistentFileStream << getClientInstallInfo() << Qt::endl;
+    persistentFileStream.flush();
+    persistentLogEnabled = true;
+}
+
+void Logger::closePersistentLogSession()
+{
+    if (!persistentLogEnabled) {
+        return;
+    }
+
+    persistentLogEnabled = false;
+    persistentFileStream << "Log session closed at " << QDateTime::currentDateTime().toString() << Qt::endl;
+    persistentFileStream.flush();
+    persistentFileHandle.close();
+}
+
+QList<QString> Logger::getPreviousSessionTail(int maxLines) const
+{
+    QString path;
+    {
+        QMutexLocker locker(&mutex);
+        path = persistentLogPath;
+    }
+    if (path.isEmpty()) {
+        return {};
+    }
+    return extractPreviousSessionTail(path, maxLines);
+}
+
+QList<QString> Logger::extractPreviousSessionTail(const QString &filePath, int maxLines)
+{
+    QList<QString> result;
+    if (maxLines <= 0) {
+        return result;
+    }
+
+    QFile file(filePath);
+    if (!file.open(QIODevice::ReadOnly | QIODevice::Text)) {
+        return result;
+    }
+    QList<QString> allLines;
+    QTextStream in(&file);
+    while (!in.atEnd()) {
+        allLines.append(in.readLine());
+    }
+    file.close();
+
+    QList<int> markerIndexes;
+    for (int i = 0; i < allLines.size(); ++i) {
+        if (allLines.at(i).contains(QLatin1String(LOGGER_SESSION_MARKER))) {
+            markerIndexes.append(i);
+        }
+    }
+
+    QList<QString> tail;
+    if (markerIndexes.isEmpty()) {
+        tail = allLines;
+    } else if (markerIndexes.size() == 1) {
+        // Only the current session has been recorded; there is no previous session yet.
+        return result;
+    } else {
+        const int previousStart = markerIndexes.at(markerIndexes.size() - 2);
+        const int currentStart = markerIndexes.last();
+        for (int i = previousStart; i < currentStart; ++i) {
+            tail.append(allLines.at(i));
+        }
+    }
+
+    const int start = tail.size() > maxLines ? tail.size() - maxLines : 0;
+    for (int i = start; i < tail.size(); ++i) {
+        result.append(tail.at(i));
+    }
+    return result;
+}
+
 void Logger::log(QtMsgType /* type */, const QMessageLogContext & /* ctx */, const QString &message)
 {
     QMetaObject::invokeMethod(this, "internalLog", Qt::QueuedConnection, Q_ARG(const QString &, message));
@@ -102,6 +239,11 @@ void Logger::internalLog(const QString &message)
     if (logToFileEnabled) {
         fileStream << message << Qt::endl; // Print to fileStream
     }
+
+    if (persistentLogEnabled) {
+        persistentFileStream << message << Qt::endl;
+        persistentFileStream.flush();
+    }
 }
 
 QString Logger::getSystemArchitecture()

cockatrice/src/interface/logger.h

@@ -49,6 +49,9 @@ public:
     {
         return logBuffer;
     }
+    void setPersistentLogPath(const QString &path);
+    QList<QString> getPreviousSessionTail(int maxLines = 60) const;
+    static QList<QString> extractPreviousSessionTail(const QString &filePath, int maxLines = 60);
 
 private:
     Logger();
@@ -61,11 +64,18 @@ private:
     QTextStream fileStream;
     QFile fileHandle;
     QList<QString> logBuffer;
-    QMutex mutex;
+    mutable QMutex mutex;
+    QString persistentLogPath;
+    bool persistentLogEnabled;
+    QTextStream persistentFileStream;
+    QFile persistentFileHandle;
 
 protected:
     void openLogfileSession();
     void closeLogfileSession();
+    void openPersistentLog(const QString &path);
+    void prunePersistentLog(const QString &path);
+    void closePersistentLogSession();
 
 protected slots:
     void internalLog(const QString &message);

cockatrice/src/interface/widgets/dialogs/dlg_crash_report.cpp

@@ -0,0 +1,245 @@
+#include "dlg_crash_report.h"
+
+#include "../../../client/crash/crash_reporter.h"
+#include "../../../client/settings/cache_settings.h"
+#include "../../logger.h"
+
+#include <QCheckBox>
+#include <QDateTime>
+#include <QDebug>
+#include <QDir>
+#include <QEvent>
+#include <QFile>
+#include <QHBoxLayout>
+#include <QJsonDocument>
+#include <QJsonObject>
+#include <QLabel>
+#include <QList>
+#include <QMessageBox>
+#include <QPlainTextEdit>
+#include <QPushButton>
+#include <QVBoxLayout>
+#include <libcockatrice/settings/personal_settings.h>
+
+DlgCrashReport::DlgCrashReport(QWidget *parent, bool _realSending, CrashReporter *_reporter)
+    : QDialog(parent), realSending(_realSending), reporter(_reporter)
+{
+    infoLabel = new QLabel(this);
+    infoLabel->setWordWrap(true);
+
+    accountLabel = new QLabel(this);
+    accountLabel->setWordWrap(true);
+
+    // Constructed before previewArea: Qt derives the default Tab chain from construction
+    // order, and note sits visually above the log excerpt, so this keeps Tab moving downward.
+    noteArea = new QPlainTextEdit(this);
+    // Optional free text ("what I was doing when it crashed") — a few lines are
+    // enough for a description, leave the rest of the space to the log excerpt.
+    noteArea->setMaximumHeight(70);
+
+    previewArea = new QPlainTextEdit(this);
+    previewArea->setReadOnly(true);
+    previewArea->setPlainText(buildRedactedPreview());
+
+    rememberBox = new QCheckBox(this);
+
+    sendButton = new QPushButton(this);
+    sendButton->setDefault(true);
+    connect(sendButton, &QPushButton::clicked, this, &DlgCrashReport::actSend);
+
+    dontSendButton = new QPushButton(this);
+    dontSendButton->setAutoDefault(false);
+    connect(dontSendButton, &QPushButton::clicked, this, &DlgCrashReport::actDontSend);
+
+    auto *buttonLayout = new QHBoxLayout;
+    buttonLayout->addWidget(rememberBox);
+    buttonLayout->addStretch();
+    buttonLayout->addWidget(dontSendButton);
+    buttonLayout->addWidget(sendButton);
+
+    auto *mainLayout = new QVBoxLayout;
+    mainLayout->addWidget(infoLabel);
+    mainLayout->addWidget(accountLabel);
+    mainLayout->addWidget(noteArea);
+    mainLayout->addWidget(previewArea);
+    mainLayout->addLayout(buttonLayout);
+    setLayout(mainLayout);
+
+    resize(700, 500);
+    retranslateUi();
+}
+
+void DlgCrashReport::changeEvent(QEvent *event)
+{
+    if (event->type() == QEvent::LanguageChange) {
+        retranslateUi();
+    }
+    QDialog::changeEvent(event);
+}
+
+void DlgCrashReport::retranslateUi()
+{
+    setWindowTitle(tr("Send crash report"));
+    if (realSending) {
+        // The preview below prefers the crashed session's persisted log tail
+        // (Logger::getPreviousSessionTail), falling back to this restart's in-memory buffer only
+        // when no previous session was saved. On send it is attached as crash-log.txt to the
+        // pending native crash event (dump + stack + log + note in one report); when no native
+        // crash event exists, it rides the fallback message event instead.
+        infoLabel->setText(tr("Oops, we crashed — and now we need your help to make Cockatrice better!\n\n"
+                              "The good thing is, helping is easy and convenient. Sending uploads what the "
+                              "previous run left behind when it crashed: the crash dump with the stack trace, "
+                              "the app version and operating system info, the redacted log excerpt shown below, "
+                              "and anything you write in the note box. If no log from the crashed session was "
+                              "saved, this restart's early logs are shown instead.\n\n"
+                              "Reports are what let us fix crashes like this one. Check \u201cRemember my choice\u201d "
+                              "and Send, and future crash reports are sent automatically without interruption."));
+    } else {
+        infoLabel->setText(tr("(Mock preview — nothing will be uploaded.)\n\n"
+                              "Cockatrice closed unexpectedly. A real report would contain what the previous run "
+                              "left behind when it crashed: the crash dump with the stack trace, the app version "
+                              "and operating system info, the redacted log excerpt shown below, and anything you "
+                              "write in the note box. If no log from the crashed session was saved, this restart's "
+                              "early logs are shown instead.\n\n"
+                              "A mock file is written locally for inspection."));
+    }
+    accountLabel->setText(tr("No account needed, and no contact info is collected. Login links "
+                             "(cockatrice://...) are scrubbed before sending."));
+    noteArea->setPlaceholderText(tr("(Optional) Describe what you were doing when it crashed"));
+    // Direction-neutral on purpose: the same box also remembers a "Don't send" decision
+    // (reject() persists NeverSend when it is checked), so it must not promise sending.
+    rememberBox->setText(tr("Remember my choice"));
+    sendButton->setText(tr("Send"));
+    dontSendButton->setText(tr("Don't send"));
+}
+
+QString DlgCrashReport::buildRedactedPreview()
+{
+    Logger &logger = Logger::getInstance();
+
+    QStringList header;
+    header.append(logger.getClientVersion());
+    header.append(logger.getSystemArchitecture());
+    header.append(logger.getSystemLocale());
+    header.append(logger.getClientInstallInfo());
+    header.append(QStringLiteral("---"));
+
+    QList<QString> logLines = logger.getPreviousSessionTail();
+    if (logLines.isEmpty()) {
+        logLines = logger.getLogBuffer();
+    }
+    const int previewLines = 60;
+    int start = logLines.size() > previewLines ? logLines.size() - previewLines : 0;
+
+    QStringList lines = header;
+    for (int i = start; i < logLines.size(); ++i) {
+        lines.append(CrashReporter::redactCockatriceUrls(CrashReporter::sanitizeLogLine(logLines.at(i))));
+    }
+    return lines.join(QStringLiteral("\n"));
+}
+
+QString DlgCrashReport::writeMockReport(const QString &previewText, const QString &userNote)
+{
+    Logger &logger = Logger::getInstance();
+
+    QJsonObject report;
+    report[QStringLiteral("mock")] = true;
+    report[QStringLiteral("timestamp")] = QDateTime::currentDateTimeUtc().toString(Qt::ISODate);
+    report[QStringLiteral("clientVersion")] = logger.getClientVersion();
+    report[QStringLiteral("systemArchitecture")] = logger.getSystemArchitecture();
+    report[QStringLiteral("systemLocale")] = logger.getSystemLocale();
+    report[QStringLiteral("installInfo")] = logger.getClientInstallInfo();
+    report[QStringLiteral("logPreview")] = previewText;
+    report[QStringLiteral("userNote")] = userNote;
+
+    QString fileName = QStringLiteral("crash-report-mock-%1.json")
+                           .arg(QDateTime::currentDateTimeUtc().toString(QStringLiteral("yyyyMMdd-HHmmss")));
+    QString filePath = QDir::tempPath() + QStringLiteral("/") + fileName;
+
+    QFile file(filePath);
+    if (!file.open(QIODevice::WriteOnly | QIODevice::Text)) {
+        return QString();
+    }
+    file.write(QJsonDocument(report).toJson());
+    file.close();
+    return filePath;
+}
+
+void DlgCrashReport::actSend()
+{
+    if (rememberBox->isChecked()) {
+        SettingsCache::instance().personal().setCrashReportingMode(PersonalSettings::CrashReportingMode::AlwaysSend);
+    }
+    const QString preview = previewArea->toPlainText();
+    const QString userNote = noteArea->toPlainText().trimmed();
+    if (realSending && reporter != nullptr) {
+        // Fold log and note into the pending native crash event(s) BEFORE consent:
+        // giveConsent() releases the held envelopes for upload, so dump, stack,
+        // log and note arrive as one Sentry event. Without a pending crash event
+        // (unclean exit that produced no native crash) this returns 0 and
+        // sendReport() falls back to a standalone message event with the same
+        // attachments.
+        const int attached = reporter->attachToPendingCrashEnvelopes(preview, userNote);
+        reporter->giveConsent();
+        if (attached > 0 || reporter->sendReport(preview, userNote)) {
+            accept();
+            return;
+        }
+        qCWarning(CrashReportLog) << "Failed to send crash report";
+        // Outcome mapping for the failure box: Save = store locally and close
+        // as accepted (the follow-up info box shows the path, so the user
+        // knows it was NOT sent); Discard = revoke consent and close as
+        // rejected (dropped); Cancel/X = back to the dialog, neither sent nor
+        // dropped. The Remember checkbox governs only the original
+        // Send/Don't-send decision, so the Discard path below revokes and
+        // closes via QDialog::reject() without touching the setting (calling
+        // our reject() override here would wrongly persist NeverSend over the
+        // AlwaysSend stored above when Remember was checked).
+        QMessageBox failureBox(QMessageBox::Warning, tr("Send crash report"),
+                               tr("Sending the crash report failed. Save the report locally instead?"),
+                               QMessageBox::Save | QMessageBox::Discard | QMessageBox::Cancel, this);
+        failureBox.setDefaultButton(QMessageBox::Save);
+        failureBox.setEscapeButton(QMessageBox::Cancel);
+        const QMessageBox::StandardButton choice = static_cast<QMessageBox::StandardButton>(failureBox.exec());
+        if (choice == QMessageBox::Save) {
+            const QString savedPath = writeMockReport(preview, userNote);
+            if (savedPath.isEmpty()) {
+                QMessageBox::warning(this, tr("Send crash report"), tr("Could not save the crash report locally."));
+            } else {
+                QMessageBox::information(this, tr("Send crash report"),
+                                         tr("Crash report saved locally to:\n%1").arg(savedPath));
+            }
+            accept();
+            return;
+        }
+        if (choice == QMessageBox::Discard) {
+            reporter->revokeConsent();
+            QDialog::reject();
+            return;
+        }
+        return;
+    }
+    const QString savedPath = writeMockReport(preview, userNote);
+    if (savedPath.isEmpty()) {
+        qCWarning(CrashReportLog) << "Could not save the mock crash report locally";
+    } else {
+        qCInfo(CrashReportLog) << "Mock crash report saved locally to" << savedPath;
+    }
+    accept();
+}
+
+void DlgCrashReport::actDontSend()
+{
+    reject();
+}
+
+void DlgCrashReport::reject()
+{
+    if (rememberBox->isChecked()) {
+        SettingsCache::instance().personal().setCrashReportingMode(PersonalSettings::CrashReportingMode::NeverSend);
+    }
+    if (realSending && reporter != nullptr) {
+        reporter->revokeConsent();
+    }
+    QDialog::reject();
+}

cockatrice/src/interface/widgets/dialogs/dlg_crash_report.h

@@ -0,0 +1,63 @@
+/**
+ * @file dlg_crash_report.h
+ * @ingroup Dialogs
+ */
+
+#ifndef DLG_CRASH_REPORT_H
+#define DLG_CRASH_REPORT_H
+
+#include <QDialog>
+#include <QString>
+#include <qtmetamacros.h>
+
+class QCheckBox;
+class QLabel;
+class QPlainTextEdit;
+class QPushButton;
+
+class CrashReporter;
+
+/**
+ * @brief Crash-report dialog: mock fallback or real Sentry send.
+ *
+ * Mock mode (default): the Send path writes a redacted JSON file to the temp
+ * dir instead of uploading anything. Real mode (realSending, with a live
+ * CrashReporter): Send first folds the redacted log and the optional user note
+ * into the pending native crash event(s), then gives consent so dump, stack,
+ * log and note upload as one Sentry event; when no pending crash event exists
+ * it falls back to a standalone message event with the same attachments.
+ * Failure offers a local save instead.
+ */
+class DlgCrashReport : public QDialog
+{
+    Q_OBJECT
+public:
+    explicit DlgCrashReport(QWidget *parent = nullptr, bool realSending = false, CrashReporter *_reporter = nullptr);
+
+    static QString buildRedactedPreview();
+    static QString writeMockReport(const QString &previewText, const QString &userNote = QString());
+
+    void reject() override;
+
+protected:
+    void changeEvent(QEvent *event) override;
+
+private:
+    QLabel *infoLabel;
+    QLabel *accountLabel;
+    QPlainTextEdit *previewArea;
+    QPlainTextEdit *noteArea;
+    QCheckBox *rememberBox;
+    QPushButton *sendButton;
+    QPushButton *dontSendButton;
+    bool realSending = false;
+    CrashReporter *reporter = nullptr;
+
+    void retranslateUi();
+
+private slots:
+    void actSend();
+    void actDontSend();
+};
+
+#endif

cockatrice/src/interface/widgets/settings_page/general_settings_page.cpp

@@ -133,6 +133,27 @@ GeneralSettingsPage::GeneralSettingsPage()
     versionGroupBox = new QGroupBox;
     versionGroupBox->setLayout(versionGrid);
 
+    // crash reporting consent (stored in personal.ini, not debug.ini)
+    crashReportingBox.addItem(""); // texts set in retranslateUi
+    crashReportingBox.addItem("");
+    crashReportingBox.addItem("");
+    crashReportingBox.setCurrentIndex(static_cast<int>(settings.personal().getCrashReportingMode()));
+
+    connect(&crashReportingBox, qOverload<int>(&QComboBox::currentIndexChanged), this, [](int index) {
+        if (index < 0 || index > static_cast<int>(PersonalSettings::CrashReportingMode::NeverSend)) {
+            return;
+        }
+        SettingsCache::instance().personal().setCrashReportingMode(
+            static_cast<PersonalSettings::CrashReportingMode>(index));
+    });
+
+    auto *crashReportingGrid = new QGridLayout;
+    crashReportingGrid->addWidget(&crashReportingLabel, 0, 0);
+    crashReportingGrid->addWidget(&crashReportingBox, 0, 1);
+
+    crashReportingGroupBox = new QGroupBox;
+    crashReportingGroupBox->setLayout(crashReportingGrid);
+
     // card database settings
     startupCardUpdateCheckBehaviorSelector.addItem(""); // these will be set in retranslateUI
     startupCardUpdateCheckBehaviorSelector.addItem("");
@@ -336,6 +357,7 @@ GeneralSettingsPage::GeneralSettingsPage()
     auto *mainLayout = new QVBoxLayout;
     mainLayout->addWidget(languageGroupBox);
     mainLayout->addWidget(versionGroupBox);
+    mainLayout->addWidget(crashReportingGroupBox);
     mainLayout->addWidget(cardDatabaseGroupBox);
     mainLayout->addWidget(startupGroupBox);
     mainLayout->addWidget(pathsGroupBox);
@@ -569,13 +591,19 @@ void GeneralSettingsPage::retranslateUi()
                                       tr("English and selected card language"));
     advertiseTranslationPageLabel.setText(
         QString("<a href='%1'>%2</a>").arg(WIKI_TRANSLATION_FAQ).arg(tr("How to help with translations")));
-
     versionGroupBox->setTitle(tr("Version settings"));
     updateReleaseChannelLabel.setText(tr("Update channel"));
     startupUpdateCheckCheckBox.setText(tr("Check for client updates on startup"));
     updateNotificationCheckBox.setText(tr("Notify if a feature supported by the server is missing in my client"));
     newVersionOracleCheckBox.setText(tr("Automatically run Oracle when running a new version of Cockatrice"));
 
+    crashReportingGroupBox->setTitle(tr("Crash reporting"));
+    crashReportingLabel.setText(tr("Send crash reports:"));
+    crashReportingBox.setItemText(static_cast<int>(PersonalSettings::CrashReportingMode::Ask), tr("Ask every time"));
+    crashReportingBox.setItemText(static_cast<int>(PersonalSettings::CrashReportingMode::AlwaysSend),
+                                  tr("Always send"));
+    crashReportingBox.setItemText(static_cast<int>(PersonalSettings::CrashReportingMode::NeverSend), tr("Never send"));
+
     // We can't change the strings after they're put into the QComboBox, so this is our workaround
     int oldIndex = updateReleaseChannelBox.currentIndex();
     updateReleaseChannelBox.clear();

cockatrice/src/interface/widgets/settings_page/general_settings_page.h

@@ -49,6 +49,7 @@ private slots:
 private:
     QGroupBox *languageGroupBox;
     QGroupBox *versionGroupBox;
+    QGroupBox *crashReportingGroupBox;
     QGroupBox *cardDatabaseGroupBox;
     QGroupBox *startupGroupBox;
     QGroupBox *pathsGroupBox;
@@ -70,6 +71,9 @@ private:
     QCheckBox updateNotificationCheckBox;
     QCheckBox newVersionOracleCheckBox;
 
+    QLabel crashReportingLabel;
+    QComboBox crashReportingBox;
+
     QLabel startupCardUpdateCheckBehaviorLabel;
     QComboBox startupCardUpdateCheckBehaviorSelector;
     QLabel cardUpdateCheckIntervalLabel;

cockatrice/src/main.cpp

@@ -20,6 +20,7 @@
 
 #include "main.h"
 
+#include "client/crash/crash_reporter.h"
 #include "client/network/update/card_spoiler/spoiler_background_updater.h"
 #include "client/settings/cache_settings.h"
 #include "client/sound_engine.h"
@@ -30,6 +31,7 @@
 #include "interface/logger.h"
 #include "interface/pixel_map_generator.h"
 #include "interface/theme_manager.h"
+#include "interface/widgets/dialogs/dlg_crash_report.h"
 #include "interface/window_main.h"
 #include "libcockatrice/card/database/card_database.h"
 #include "libcockatrice/rng/rng_abstract.h"
@@ -103,60 +105,6 @@ static void CockatriceLogger(QtMsgType type, const QMessageLogContext &ctx, cons
     Logger::getInstance().log(type, ctx, logMessage);
 }
 
-#ifdef Q_OS_WIN
-// clang-format off
-#include <Windows.h>
-#include <DbgHelp.h>
-#include <ShlObj.h>
-#include <ctime>
-#include <filesystem>
-
-#pragma comment(lib, "DbgHelp.lib") // Link the DbgHelp library
-// clang-format on
-
-LONG WINAPI CockatriceUnhandledExceptionFilter(EXCEPTION_POINTERS *exceptionPointers)
-{
-    std::filesystem::path path;
-
-    // Find %LOCALAPPDATA% (or cheat at finding it)
-    wchar_t *localAppDataFolder;
-    if (SHGetKnownFolderPath(FOLDERID_LocalAppData, KF_FLAG_CREATE, NULL, &localAppDataFolder) != S_OK) {
-        path = std::filesystem::temp_directory_path().parent_path().parent_path();
-    } else {
-        path = std::filesystem::path(localAppDataFolder);
-    }
-
-    // Plan on writing crash files into %LOCALAPPDATA%/CrashDumps/Cockatrice/cockatrice.crash.*.dmp
-    path /= "CrashDumps";
-    path /= "Cockatrice";
-    if (!std::filesystem::exists(path)) {
-        std::filesystem::create_directories(path);
-    }
-    path /= "cockatrice.crash." + std::to_string(std::time(0)) + ".dmp";
-
-    // Create and write crash files
-#ifdef UNICODE
-    HANDLE hDumpFile =
-        CreateFile(path.wstring().c_str(), GENERIC_WRITE, 0, nullptr, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, nullptr);
-#else
-    HANDLE hDumpFile =
-        CreateFile(path.string().c_str(), GENERIC_WRITE, 0, nullptr, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, nullptr);
-#endif
-
-    MINIDUMP_EXCEPTION_INFORMATION mei;
-    mei.ExceptionPointers = exceptionPointers;
-    mei.ThreadId = GetCurrentThreadId();
-    mei.ClientPointers = 1;
-
-    MiniDumpWriteDump(GetCurrentProcess(), GetCurrentProcessId(), hDumpFile, MiniDumpWithFullMemory, &mei, nullptr,
-                      nullptr);
-
-    CloseHandle(hDumpFile);
-
-    return EXCEPTION_EXECUTE_HANDLER;
-}
-#endif
-
 void installNewTranslator()
 {
     QString lang = SettingsCache::instance().personal().getLang();
@@ -197,11 +145,52 @@ static QString redactActivationUrl(const QString &url)
     return parsed.scheme() + "://" + parsed.host();
 }
 
+/**
+ * @brief Run the startup crash-report flow for an unclean exit (or --simulate-crash).
+ *
+ * With a configured DSN the SDK owns capture and upload (consent-gated); with an
+ * empty DSN the flow falls back to a local mock file. AlwaysSend uploads silently
+ * (the log was folded into the pending native envelope(s) at startup); Ask offers
+ * the dialog; NeverSend skips silently.
+ *
+ * @param attachedEnvelopes number of pending native envelopes that already carry the
+ *                          redacted log, so an AlwaysSend run only sends a standalone
+ *                          log event when no crash event existed.
+ */
+static void runCrashReportFlow(CrashReporter &crashReporter, QWidget *parent, int attachedEnvelopes)
+{
+    const PersonalSettings::CrashReportingMode crashMode = SettingsCache::instance().personal().getCrashReportingMode();
+    const bool crashReady = crashReporter.isReady();
+    if (crashMode == PersonalSettings::CrashReportingMode::AlwaysSend) {
+        if (crashReady) {
+            // Silent path: the redacted log was folded into the pending native crash
+            // envelope(s) at startup and consent already released them. Only when no
+            // pending crash event existed (e.g. --simulate-crash) does a standalone
+            // log event still need to go out here.
+            if (attachedEnvelopes == 0) {
+                const QString crashPreview = DlgCrashReport::buildRedactedPreview();
+                if (!crashReporter.sendReport(crashPreview)) {
+                    const QString savedPath = DlgCrashReport::writeMockReport(crashPreview);
+                    qCWarning(MainLog) << "Failed to send crash report, saved locally to" << savedPath;
+                }
+            }
+        } else {
+            DlgCrashReport::writeMockReport(DlgCrashReport::buildRedactedPreview());
+        }
+    } else if (crashMode == PersonalSettings::CrashReportingMode::Ask) {
+        // Real mode: Send gives consent + captures the event, Don't send revokes
+        // consent; the dialog owns both via the reporter.
+        DlgCrashReport crashDialog(parent, crashReady, crashReady ? &crashReporter : nullptr);
+        crashDialog.exec();
+    }
+    // NeverSend: skip silently (no dialog, nothing written or sent).
+}
+
 int main(int argc, char *argv[])
 {
-#ifdef Q_OS_WIN
-    SetUnhandledExceptionFilter(CockatriceUnhandledExceptionFilter);
-#endif
+    // No custom unhandled-exception filter: sentry owns native crash capture on all
+    // platforms. (The legacy MiniDumpWithFullMemory writer was removed as a privacy
+    // liability; unclean exits are detected via CrashReporter::beginSession below.)
 
     // Logging setup
 #ifdef Q_OS_APPLE
@@ -259,6 +248,82 @@ int main(int argc, char *argv[])
     qApp->setAttribute(Qt::AA_DontShowIconsInMenus, true);
 #endif
 
+    // Persistent session log: keeps this run's logs on disk so the next-startup crash dialog can
+    // attach the crashed session's tail (the in-memory buffer is lost on crash). Opened in Append
+    // mode with a per-launch session marker; read back via Logger::getPreviousSessionTail().
+    // Declared before crash-reporter init: the startup attach below needs the log tail while the
+    // file still holds the crashed session's lines.
+    const QString persistentLogPath =
+        SettingsCache::instance().getSettingsPath() + QStringLiteral("logs/cockatrice.log");
+    Logger::getInstance().setPersistentLogPath(persistentLogPath);
+
+    // Crash reporting: init the SDK early so a crash anywhere below is captured into the
+    // local database. Uploads stay consent-gated (require_user_consent, armed in CrashReporter::init):
+    // AlwaysSend gives consent here so cached envelopes flush at startup; any other mode starts
+    // unconsented and the dialog below drives give/revoke. An empty DSN skips the SDK entirely and
+    // the mock fallback further below behaves exactly as before.
+    CrashReporter crashReporter;
+    const QString crashDatabasePath = SettingsCache::instance().getSettingsPath() + QStringLiteral("sentry");
+    // Envelopes that received the redacted log at startup (AlwaysSend path); 0 means the log was
+    // NOT folded into a pending crash event and a standalone log event is still needed below.
+    int crashLogAttachedEnvelopes = 0;
+    {
+        QString crashDsn = QString::fromUtf8(qgetenv("COCKATRICE_SENTRY_DSN"));
+        const bool dsnFromEnvironment = !crashDsn.isEmpty();
+        if (!dsnFromEnvironment) {
+            crashDsn = QString::fromUtf8(COCKATRICE_SENTRY_DSN);
+        }
+        if (crashDsn.isEmpty()) {
+            // Nothing is armed without a DSN, so no crash is ever captured and nothing is ever sent.
+            // It is the one disabled configuration a tester cannot see from the UI, so say it here.
+            qCWarning(CrashReportLog) << "crash reporting disabled: no DSN configured (COCKATRICE_SENTRY_DSN is "
+                                         "not set and this build has no DSN baked in)";
+        } else if (!CrashReporter::isDsnWellFormed(crashDsn)) {
+            // Same rule the installer applies (cmake/CrashReporting.cmake): a malformed DSN disables
+            // reporting rather than silently falling back to the project baked into the build, which
+            // would upload where the tester never chose. The SDK would otherwise refuse to build a
+            // request at all and report nothing about it.
+            qCWarning(CrashReportLog) << "crash reporting disabled:"
+                                      << (dsnFromEnvironment ? "COCKATRICE_SENTRY_DSN is set but malformed"
+                                                             : "the DSN baked into this build is malformed")
+                                      << "(expected <scheme>://<key>@<host>/<project-id>)";
+            crashDsn.clear();
+        } else if (dsnFromEnvironment) {
+            // Destination and mode are logged by CrashReporter::init() once it resolves them.
+            qCInfo(CrashReportLog) << "using COCKATRICE_SENTRY_DSN from the environment";
+        }
+        const PersonalSettings::CrashReportingMode crashMode =
+            SettingsCache::instance().personal().getCrashReportingMode();
+        // AlwaysSend folds the crashed session's redacted log into the pending crash
+        // envelope(s) BEFORE init: sentry_init replays the crashed run's *.run
+        // envelopes immediately when consent is already persisted, so attaching any
+        // later would be too late. Consent given below then releases them, and dump,
+        // stack and log upload as a single Sentry event. Ask mode attaches at the
+        // dialog instead — its cache-held envelopes stay untouched until giveConsent().
+        if (crashMode == PersonalSettings::CrashReportingMode::AlwaysSend &&
+            CrashReporter::isReportingEnabled(crashDsn, crashMode)) {
+            crashLogAttachedEnvelopes = CrashReporter::attachToPendingCrashEnvelopes(
+                crashDatabasePath, DlgCrashReport::buildRedactedPreview(), QString());
+        }
+        crashReporter.init(crashDsn, QString::fromUtf8(COCKATRICE_SENTRY_RELEASE), crashDatabasePath, crashMode);
+        if (crashReporter.isReady() && crashMode == PersonalSettings::CrashReportingMode::AlwaysSend) {
+            // Silent opt-in: cached native crash envelopes flush automatically once consent is given.
+            crashReporter.giveConsent();
+        }
+        // Mid-session mode changes must reach the SDK: without this, switching from AlwaysSend to
+        // NeverSend (or Ask) leaves consent given until restart, so a later crash in this session
+        // would still upload after the user opted out. crashReporter outlives main(), so capturing
+        // it here is safe.
+        QObject::connect(&SettingsCache::instance().personal(), &PersonalSettings::crashReportingModeChanged,
+                         [&crashReporter](PersonalSettings::CrashReportingMode mode) {
+                             if (mode == PersonalSettings::CrashReportingMode::AlwaysSend) {
+                                 crashReporter.giveConsent();
+                             } else {
+                                 crashReporter.revokeConsent();
+                             }
+                         });
+    }
+
     // Translations
 #ifdef Q_OS_MAC
     translationPath = qApp->applicationDirPath() + "/../Resources/translations";
@@ -276,7 +341,10 @@ int main(int argc, char *argv[])
 
     parser.addOptions(
         {{{"c", "connect"}, QCoreApplication::translate("main", "Connect on startup"), "user:pass@host:port"},
-         {{"d", "debug-output"}, QCoreApplication::translate("main", "Debug to file")}});
+         {{"d", "debug-output"}, QCoreApplication::translate("main", "Debug to file")},
+         {"simulate-crash",
+          QCoreApplication::translate("main",
+                                      "Show the crash-report dialog (saves a mock file when no DSN is configured)")}});
 
     parser.process(app);
 
@@ -320,6 +388,16 @@ int main(int argc, char *argv[])
         }
     }
 
+    // Unclean-exit detection (cross-platform QLockFile session tracking, replacing the
+    // legacy Windows-only .dmp scan): a leftover session lock means the previous run died
+    // without reaching endSession(). Our own lock is held until the event loop finishes.
+    // Deliberately placed after parser.process() (--help/--version exit inside it and must
+    // not leak a lock) and after the instance hand-off (a handed-off secondary exits
+    // immediately and must never take a lock). Note this counts any death without
+    // endSession() as a crash, including SIGTERM at logout, Task Manager kills and
+    // session-end shutdowns; in AlwaysSend those send a report too.
+    const bool uncleanExit = crashReporter.beginSession(crashDatabasePath);
+
     rng = new RNG_SFMT(CryptoUtil::randomUInt64());
     themeManager = new ThemeManager;
     soundEngine = new SoundEngine;
@@ -413,6 +491,13 @@ int main(int argc, char *argv[])
     ui.show();
     qCInfo(MainLog) << "ui.show() finished";
 
+    // Crash-report flow: the trigger is --simulate-crash or an unclean previous exit
+    // (leftover session lock; the old %LOCALAPPDATA%/CrashDumps .dmp scan is gone with
+    // the exception filter). See runCrashReportFlow() for the per-mode handling.
+    if (parser.isSet("simulate-crash") || uncleanExit) {
+        runCrashReportFlow(crashReporter, &ui, crashLogAttachedEnvelopes);
+    }
+
     // force shortcuts to be shown/hidden in right-click menus, regardless of system defaults
     qApp->setAttribute(Qt::AA_DontShowShortcutsInContextMenus,
                        !SettingsCache::instance().userInterface().getShowShortcuts());
@@ -444,5 +529,10 @@ int main(int argc, char *argv[])
     UserLevelPixmapGenerator::clear();
     ManaSymbolPixmapGenerator::clear();
 
+    // Released last: crashes anywhere in the teardown above (a common place for Qt apps to
+    // crash) are still captured by the SDK and detected as unclean exits on the next launch.
+    crashReporter.shutdown();
+    crashReporter.endSession();
+
     return ret;
 }