catpm 0.10.3 → 0.11.0

data/lib/catpm/collector.rb

@@ -11,6 +11,19 @@ module Catpm
     @active_instrumented_count = 0
 
     class << self
+      # Build minimal context for unhandled exceptions caught by middleware
+      # (before Rails has a chance to process the request).
+      def build_exception_context(env)
+        ctx = {
+          method: env['REQUEST_METHOD'],
+          path: env['PATH_INFO']
+        }
+        ctx[:remote_ip] = extract_remote_ip(env)
+        headers = extract_request_headers(env)
+        ctx[:request_headers] = headers if headers.any?
+        ctx
+      end
+
       def process_action_controller(event)
         return unless Catpm.enabled?
 
@@ -108,6 +121,12 @@ module Catpm
                 # Add to summary so Time Breakdown shows middleware
                 segment_data[:segment_summary][:middleware_count] = 1
                 segment_data[:segment_summary][:middleware_duration] = ctrl_offset.round(2)
+
+                # Re-parent pre-controller root-children under Middleware Stack.
+                # Without MiddlewareProbe, SQL/cache during middleware processing
+                # have no span parent and end up orphaned under root.
+                ctrl_idx = segments.index { |s| s[:type] == 'controller' }
+                reparent_pre_controller_segments(segments, ctrl_idx)
               end
             end
 
@@ -116,12 +135,7 @@ module Catpm
             if Catpm.config.instrument_call_tree && req_segments
               tree_segs = req_segments.call_tree_segments
               if tree_segs.any?
-                base_idx = segments.size
-                tree_segs.each do |seg|
-                  tree_parent = seg.delete(:_tree_parent)
-                  seg[:parent_index] = tree_parent ? (tree_parent + base_idx) : (ctrl_idx || 0)
-                  segments << seg
-                end
+                inject_call_tree_segments(segments, tree_segs, ctrl_idx)
                 reparent_under_call_tree(segments, ctrl_idx)
               end
             end
@@ -143,6 +157,11 @@ module Catpm
               end
             end
 
+            # Final pass: move any remaining pre-controller root-children under Middleware Stack.
+            # This catches call tree and gap-fill segments added after the initial re-parenting.
+            ctrl_idx = segments.index { |s| s[:type] == 'controller' }
+            reparent_pre_controller_segments(segments, ctrl_idx) if ctrl_idx
+
             context[:segments] = segments
             context[:segment_summary] = segment_data[:segment_summary]
             context[:segments_capped] = segment_data[:segments_capped]
@@ -194,6 +213,9 @@ module Catpm
       def process_active_job(event)
         return unless Catpm.enabled?
 
+        # No middleware in job workers — restart flusher after fork
+        Catpm.flusher&.ensure_running!
+
         payload = event.payload
         job = payload[:job]
         target = job.class.name
@@ -241,39 +263,23 @@ module Catpm
             segments = segment_data[:segments]
             collapse_code_wrappers(segments)
 
-            # Inject root job segment with full duration
-            root_segment = {
-              type: 'request',
-              detail: "job #{target}",
-              duration: duration.round(2),
-              offset: 0.0
-            }
-            segments.each do |seg|
-              if seg.key?(:parent_index)
-                seg[:parent_index] += 1
-              else
-                seg[:parent_index] = 0
-              end
+            # Job span is already the root — no synthetic wrapper needed.
+            # Clamp its duration to the event duration to avoid >100% in breakdown.
+            ctrl_idx = segments.index { |s| s[:type] == 'job' }
+            if ctrl_idx
+              segments[ctrl_idx][:duration] = duration.round(2)
             end
-            segments.unshift(root_segment)
 
-            # Inject call tree segments from sampler
-            ctrl_idx = segments.index { |s| s[:type] == 'controller' }
             if Catpm.config.instrument_call_tree && req_segments
               tree_segs = req_segments.call_tree_segments
               if tree_segs.any?
-                base_idx = segments.size
-                tree_segs.each do |seg|
-                  tree_parent = seg.delete(:_tree_parent)
-                  seg[:parent_index] = tree_parent ? (tree_parent + base_idx) : (ctrl_idx || 0)
-                  segments << seg
-                end
+                inject_call_tree_segments(segments, tree_segs, ctrl_idx)
                 reparent_under_call_tree(segments, ctrl_idx)
               end
             end
 
-            # Fill untracked controller time with sampler data or synthetic segment
-            ctrl_idx = segments.index { |s| s[:type] == 'controller' }
+            # Fill untracked job time with sampler data or synthetic segment
+            ctrl_idx = segments.index { |s| s[:type] == 'job' }
             if ctrl_idx
               ctrl_seg = segments[ctrl_idx]
               ctrl_dur = (ctrl_seg[:duration] || 0).to_f
@@ -289,12 +295,18 @@ module Catpm
               end
             end
 
+            # Normalize job_duration in summary to match event duration
+            summary = segment_data[:segment_summary].dup
+            if summary[:job_duration]
+              summary[:job_duration] = [summary[:job_duration], duration.round(2)].min
+            end
+
             context[:segments] = segments
-            context[:segment_summary] = segment_data[:segment_summary]
+            context[:segment_summary] = summary
             context[:segments_capped] = segment_data[:segments_capped]
             context[:segments_filtered] = segment_data[:segments_filtered] if segment_data[:segments_filtered] > 0
 
-            # Append error marker segment inside the controller
+            # Append error marker segment
             if exception
               error_parent = ctrl_idx || 0
               error_offset = if ctrl_idx
@@ -341,6 +353,125 @@ module Catpm
         end
       end
 
+      # Process a native Sidekiq::Worker job (not ActiveJob).
+      # Called from SidekiqServerMiddleware after job execution.
+      def process_sidekiq_job(target:, job_id:, queue:, retry_count:, queue_wait:, duration:, error:, req_segments:, instrumented:)
+        return unless Catpm.enabled?
+
+        metadata = { queue_wait: queue_wait }.compact
+
+        if req_segments
+          segment_data = req_segments.to_h
+          segment_data[:segment_summary].each { |k, v| metadata[k] = v }
+        end
+
+        metadata[:_instrumented] = 1 if instrumented
+
+        sample_type = early_sample_type(
+          error: error,
+          duration: duration,
+          kind: :job,
+          target: target,
+          operation: queue,
+          instrumented: instrumented
+        )
+
+        context = nil
+        if sample_type
+          context = {
+            job_class: target,
+            job_id: job_id,
+            queue: queue,
+            attempts: retry_count
+          }
+
+          if req_segments && segment_data
+            segments = segment_data[:segments]
+            collapse_code_wrappers(segments)
+
+            # Job span is already the root — no synthetic wrapper needed.
+            # Clamp its duration to the event duration to avoid >100% in breakdown.
+            ctrl_idx = segments.index { |s| s[:type] == 'job' }
+            if ctrl_idx
+              segments[ctrl_idx][:duration] = duration.round(2)
+            end
+
+            if Catpm.config.instrument_call_tree && req_segments
+              tree_segs = req_segments.call_tree_segments
+              if tree_segs.any?
+                inject_call_tree_segments(segments, tree_segs, ctrl_idx)
+                reparent_under_call_tree(segments, ctrl_idx)
+              end
+            end
+
+            # Fill untracked job time
+            ctrl_idx = segments.index { |s| s[:type] == 'job' }
+            if ctrl_idx
+              ctrl_seg = segments[ctrl_idx]
+              ctrl_dur = (ctrl_seg[:duration] || 0).to_f
+              child_dur = segments.each_with_index.sum do |pair|
+                seg, i = pair
+                next 0.0 if i == ctrl_idx
+                (seg[:parent_index] == ctrl_idx) ? (seg[:duration] || 0).to_f : 0.0
+              end
+              gap = ctrl_dur - child_dur
+
+              if gap > MIN_GAP_MS && Catpm.config.show_untracked_segments
+                inject_gap_segments(segments, req_segments, gap, ctrl_idx, ctrl_seg)
+              end
+            end
+
+            # Normalize job_duration in summary to match event duration
+            summary = segment_data[:segment_summary].dup
+            if summary[:job_duration]
+              summary[:job_duration] = [summary[:job_duration], duration.round(2)].min
+            end
+
+            context[:segments] = segments
+            context[:segment_summary] = summary
+            context[:segments_capped] = segment_data[:segments_capped]
+            context[:segments_filtered] = segment_data[:segments_filtered] if segment_data[:segments_filtered] > 0
+
+            if error
+              error_parent = ctrl_idx || 0
+              error_offset = if ctrl_idx
+                ctrl = segments[ctrl_idx]
+                ((ctrl[:offset] || 0) + (ctrl[:duration] || 0)).round(2)
+              else
+                duration.round(2)
+              end
+
+              context[:segments] << {
+                type: 'error',
+                detail: "#{error.class.name}: #{error.message}".truncate(Catpm.config.max_error_detail_length),
+                source: error.backtrace&.first,
+                duration: 0,
+                offset: error_offset,
+                parent_index: error_parent
+              }
+            end
+          end
+
+          context = scrub(context)
+        end
+
+        ev = Event.new(
+          kind: :job,
+          target: target,
+          operation: queue,
+          duration: duration,
+          started_at: Time.current,
+          context: context,
+          sample_type: sample_type,
+          metadata: metadata,
+          error_class: error&.class&.name,
+          error_message: error&.message,
+          backtrace: error&.backtrace
+        )
+
+        Catpm.buffer&.push(ev)
+      end
+
       def process_tracked(kind:, target:, operation:, duration:, context:, metadata:, error:, req_segments:)
         return unless Catpm.enabled?
         return if Catpm.config.ignored?(target)
@@ -389,22 +520,17 @@ module Catpm
             segments.unshift(root_segment)
 
             # Inject call tree segments from sampler
-            ctrl_idx = segments.index { |s| s[:type] == 'controller' }
+            ctrl_idx = segments.index { |s| s[:type] == 'controller' || s[:type] == 'job' }
             if Catpm.config.instrument_call_tree && req_segments
               tree_segs = req_segments.call_tree_segments
               if tree_segs.any?
-                base_idx = segments.size
-                tree_segs.each do |seg|
-                  tree_parent = seg.delete(:_tree_parent)
-                  seg[:parent_index] = tree_parent ? (tree_parent + base_idx) : (ctrl_idx || 0)
-                  segments << seg
-                end
+                inject_call_tree_segments(segments, tree_segs, ctrl_idx)
                 reparent_under_call_tree(segments, ctrl_idx)
               end
             end
 
-            # Fill untracked controller time with sampler data or synthetic segment
-            ctrl_idx = segments.index { |s| s[:type] == 'controller' }
+            # Fill untracked time with sampler data or synthetic segment
+            ctrl_idx = segments.index { |s| s[:type] == 'controller' || s[:type] == 'job' }
             if ctrl_idx
               ctrl_seg = segments[ctrl_idx]
               ctrl_dur = (ctrl_seg[:duration] || 0).to_f
@@ -535,6 +661,122 @@ module Catpm
 
       private
 
+      # Check whether segment at idx is a transitive child of ancestor_idx.
+      def in_subtree?(segments, idx, ancestor_idx)
+        current = idx
+        depth = 0
+        while current
+          return true if current == ancestor_idx
+          current = segments[current]&.[](:parent_index)
+          depth += 1
+          return false if depth > segments.size # cycle guard
+        end
+        false
+      end
+
+      # Inject call tree segments with correct parenting.
+      # Middleware-type nodes from the call tree are filtered out — they duplicate
+      # the synthetic/real Middleware Stack and create impossible timeline nesting
+      # (outer middleware wraps everything including the controller).
+      # Code children of filtered middleware nodes are re-rooted: walk up to the
+      # nearest surviving code ancestor, or default to controller/MW Stack by offset.
+      def inject_call_tree_segments(segments, tree_segs, ctrl_idx)
+        ctrl_offset = ctrl_idx ? (segments[ctrl_idx][:offset] || 0).to_f : 0.0
+        mw_idx = segments.index { |s| s[:type] == 'middleware' }
+
+        # Extract tree parent info before modifying segments
+        tree_parents = tree_segs.map { |seg| seg[:_tree_parent] }
+
+        # Pass 1: Assign new indices for kept (non-middleware) segments
+        old_to_new = {}
+        next_idx = segments.size
+        tree_segs.each_with_index do |seg, i|
+          if seg[:type] == 'middleware'
+            old_to_new[i] = nil
+          else
+            old_to_new[i] = next_idx
+            next_idx += 1
+          end
+        end
+
+        # Pass 2: Resolve parents and append kept segments.
+        # A code node in controller phase (offset ≥ ctrl_offset) must not end up
+        # under a pre-controller parent — if its resolved tree ancestor is in the
+        # middleware phase, re-parent under controller instead.
+        tree_segs.each_with_index do |seg, i|
+          next unless old_to_new[i] # skip filtered middleware nodes
+
+          seg.delete(:_tree_parent)
+          tree_parent = tree_parents[i]
+          seg_offset = (seg[:offset] || 0).to_f
+          in_ctrl_phase = ctrl_idx && seg_offset >= ctrl_offset
+
+          new_parent = nil
+          if tree_parent
+            resolved = resolve_filtered_tree_parent(tree_parents, tree_parent, old_to_new)
+            if resolved
+              # Check if parent is pre-controller but this segment is in controller phase
+              parent_offset = (segments[resolved][:offset] || 0).to_f
+              if in_ctrl_phase && parent_offset < ctrl_offset
+                new_parent = ctrl_idx
+              else
+                new_parent = resolved
+              end
+            end
+          end
+
+          # Determine default parent based on phase.
+          # A code segment that starts before the controller but extends past
+          # ctrl_offset is a wrapping middleware (e.g. Bullet::Rack#call) —
+          # parent it under root so it doesn't visually overflow the
+          # synthetic Middleware Stack segment.
+          seg_end = seg_offset + (seg[:duration] || 0).to_f
+          spans_both_phases = !in_ctrl_phase && ctrl_idx && seg_end > ctrl_offset
+          default_parent = if in_ctrl_phase
+            ctrl_idx
+          elsif spans_both_phases
+            0
+          else
+            mw_idx || 0
+          end
+          seg[:parent_index] = new_parent || default_parent
+          segments << seg
+        end
+      end
+
+      # Walk up the call tree to find the nearest surviving (non-middleware) ancestor.
+      def resolve_filtered_tree_parent(tree_parents, parent_idx, old_to_new)
+        visited = Set.new
+        current = parent_idx
+        while current && !visited.include?(current)
+          visited << current
+          return old_to_new[current] if old_to_new[current]
+          current = tree_parents[current]
+        end
+        nil
+      end
+
+      # Re-parent leaf segments (SQL, cache, etc.) that fired during middleware
+      # processing under the Middleware Stack segment. Only moves segments that
+      # end entirely before the controller starts — call tree spans (code/middleware)
+      # that wrap the controller are left under root.
+      REPARENTABLE_TYPES = Set.new(%w[sql cache http view storage mailer instantiation]).freeze
+
+      def reparent_pre_controller_segments(segments, ctrl_idx)
+        mw_idx = segments.index { |s| s[:type] == 'middleware' }
+        return unless mw_idx
+
+        ctrl_offset = (segments[ctrl_idx][:offset] || 0).to_f
+
+        segments.each_with_index do |seg, i|
+          next if i == mw_idx || i == 0
+          next unless seg[:parent_index] == 0
+          next unless REPARENTABLE_TYPES.include?(seg[:type])
+          seg_end = (seg[:offset] || 0).to_f + (seg[:duration] || 0).to_f
+          seg[:parent_index] = mw_idx if seg_end <= ctrl_offset
+        end
+      end
+
       # Re-parent non-code segments (sql, cache, etc.) under call tree code segments
       # when their offset falls within the code segment's time range.
       # This gives proper nesting: code → sql, instead of both being siblings under controller.
@@ -545,9 +787,13 @@ module Catpm
       # sample cap before the code finishes (e.g. during a long I/O call).
       def reparent_under_call_tree(segments, ctrl_idx)
         # Build index of code segments with their time ranges: [index, offset, end]
+        # Only consider code segments that belong to the controller's subtree —
+        # wrapping middleware code segments (parented under root) must not
+        # steal controller-phase children via time-range overlap.
         code_nodes = []
         segments.each_with_index do |seg, i|
           next unless seg[:type] == 'code' && seg[:offset] && seg[:duration]
+          next unless in_subtree?(segments, i, ctrl_idx)
           code_nodes << [i, seg[:offset].to_f, seg[:offset].to_f + seg[:duration].to_f]
         end
         return if code_nodes.empty?
@@ -560,7 +806,7 @@ module Catpm
 
         segments.each_with_index do |seg, i|
           # Only reparent direct children of controller that aren't code segments
-          next if seg[:type] == 'code' || seg[:type] == 'controller' || seg[:type] == 'request'
+          next if seg[:type] == 'code' || seg[:type] == 'controller' || seg[:type] == 'job' || seg[:type] == 'request'
           next unless seg[:parent_index] == ctrl_idx
           next unless seg[:offset]
 
@@ -584,12 +830,62 @@ module Catpm
           seg[:parent_index] = best_idx if best_idx
         end
 
+        # Extend code segment offsets backwards when reparented children start
+        # before the code segment's recorded start. This happens because the sampler
+        # captures at intervals — the code's real start may be up to one sample
+        # interval before the first capture. Without this, the child's offset
+        # visually precedes its parent, breaking the waterfall timeline.
+        extend_call_tree_offsets(segments)
+
         # Extend code segment durations when reparented children extend beyond them.
         # The stack sampler may hit its cap early, producing short code segments that
         # don't cover the full wall-clock time of long I/O calls within them.
         extend_call_tree_durations(segments)
       end
 
+      # Extend code segment start time backwards when reparented children
+      # have offsets before the code segment's recorded start.
+      def extend_call_tree_offsets(segments)
+        segments.each do |seg|
+          parent_idx = seg[:parent_index]
+          next unless parent_idx
+
+          parent = segments[parent_idx]
+          next unless parent && parent[:type] == 'code'
+
+          seg_offset = (seg[:offset] || 0).to_f
+          parent_offset = (parent[:offset] || 0).to_f
+
+          next unless seg_offset < parent_offset
+
+          extension = parent_offset - seg_offset
+          parent[:offset] = seg_offset.round(2)
+          parent[:duration] = ((parent[:duration] || 0).to_f + extension).round(2)
+
+          # Propagate up the chain
+          propagate_offset_up(segments, parent_idx)
+        end
+      end
+
+      def propagate_offset_up(segments, idx)
+        seg = segments[idx]
+        parent_idx = seg[:parent_index]
+        return unless parent_idx
+
+        parent = segments[parent_idx]
+        return unless parent && parent[:type] == 'code'
+
+        seg_offset = (seg[:offset] || 0).to_f
+        parent_offset = (parent[:offset] || 0).to_f
+
+        return unless seg_offset < parent_offset
+
+        extension = parent_offset - seg_offset
+        parent[:offset] = seg_offset.round(2)
+        parent[:duration] = ((parent[:duration] || 0).to_f + extension).round(2)
+        propagate_offset_up(segments, parent_idx)
+      end
+
       # Walk all segments; when a child's end time exceeds its parent code segment's
       # end time, extend the parent (and propagate up the chain).
       def extend_call_tree_durations(segments)
@@ -640,7 +936,7 @@ module Catpm
         # Pre-build set of parent indices that have a controller child — O(n)
         parents_with_controller = {}
         segments.each do |seg|
-          parents_with_controller[seg[:parent_index]] = true if seg[:type] == 'controller' && seg[:parent_index]
+          parents_with_controller[seg[:parent_index]] = true if (seg[:type] == 'controller' || seg[:type] == 'job') && seg[:parent_index]
         end
 
         # Identify code spans to collapse: near-zero duration wrapping a controller child
@@ -700,16 +996,29 @@ module Catpm
         sampler_groups = req_segments&.sampler_segments || []
 
         if sampler_groups.any?
+          ctrl_offset = (ctrl_seg[:offset] || 0.0).to_f
+          ctrl_end = ctrl_offset + (ctrl_seg[:duration] || 0.0).to_f
+          mw_idx = segments.index { |s| s[:type] == 'middleware' }
+
           sampler_dur = 0.0
 
           sampler_groups.each do |group|
             parent = group[:parent]
             children = group[:children] || []
+            parent_offset = (parent[:offset] || 0.0).to_f
 
             parent_idx = segments.size
-            parent[:parent_index] = ctrl_idx
+
+            # Parent under controller only if segment falls within controller's time range;
+            # otherwise parent under middleware span or root request.
+            if parent_offset >= ctrl_offset && parent_offset < ctrl_end
+              parent[:parent_index] = ctrl_idx
+              sampler_dur += (parent[:duration] || 0).to_f
+            else
+              parent[:parent_index] = mw_idx || 0
+            end
+
             segments << parent
-            sampler_dur += (parent[:duration] || 0).to_f
 
             children.each do |child|
               child[:parent_index] = parent_idx
@@ -792,13 +1101,33 @@ module Catpm
         end
       end
 
+      RACK_HTTP_PREFIX = 'HTTP_'
+      RACK_HTTP_PREFIX_LENGTH = RACK_HTTP_PREFIX.length
+
+      # Rack env keys that are not prefixed with HTTP_ but still relevant
+      RACK_EXTRA_KEYS = %w[CONTENT_TYPE CONTENT_LENGTH REMOTE_ADDR].freeze
+
+      # env keys to skip — internal Rack/Rails metadata, not real headers
+      RACK_SKIP_KEYS = %w[HTTP_VERSION HTTP_HOST].freeze
+
+      FILTERED_HEADER_VALUE = '[FILTERED]'
+
       def build_http_context(payload)
-        {
+        context = {
           method: payload[:method],
           path: payload[:path],
           params: (payload[:params] || {}).except('controller', 'action'),
           status: payload[:status]
         }
+
+        env = Thread.current[:catpm_request_env]
+        if env
+          context[:remote_ip] = extract_remote_ip(env)
+          headers = extract_request_headers(env)
+          context[:request_headers] = headers if headers.any?
+        end
+
+        context
       end
 
       def build_http_metadata(payload)
@@ -818,6 +1147,65 @@ module Catpm
           ActiveSupport::ParameterFilter.new(filters)
         end
       end
+
+      # Extract client IP, preferring X-Forwarded-For (common behind proxies).
+      # Optionally anonymizes by zeroing the last octet (IPv4) or last 80 bits (IPv6).
+      def extract_remote_ip(env)
+        raw_ip = env['HTTP_X_FORWARDED_FOR']&.split(',')&.first&.strip || env['REMOTE_ADDR']
+        return nil unless raw_ip
+
+        Catpm.config.anonymize_ip ? anonymize_ip(raw_ip) : raw_ip
+      end
+
+      def anonymize_ip(ip)
+        if ip.include?(':')
+          # IPv6: zero last 80 bits (keep /48 prefix)
+          parts = ip.split(':')
+          parts[3..] = Array.new([parts.length - 3, 0].max, '0')
+          parts.join(':')
+        else
+          # IPv4: zero last octet
+          parts = ip.split('.')
+          parts[3] = '0' if parts.length == 4
+          parts.join('.')
+        end
+      end
+
+      # Extract HTTP headers from Rack env, normalizing names and filtering sensitive values.
+      def extract_request_headers(env)
+        sensitive = Catpm.config.sensitive_headers.map { |h| normalize_header_name(h) }.to_set
+        headers = {}
+
+        env.each do |key, value|
+          next unless value.is_a?(String)
+
+          if key.start_with?(RACK_HTTP_PREFIX)
+            next if RACK_SKIP_KEYS.include?(key)
+            header_name = rack_key_to_header(key)
+          elsif RACK_EXTRA_KEYS.include?(key)
+            header_name = rack_key_to_header(key)
+          else
+            next
+          end
+
+          headers[header_name] = sensitive.include?(header_name) ? FILTERED_HEADER_VALUE : value
+        end
+
+        headers
+      end
+
+      # Convert Rack env key to normalized header name:
+      # HTTP_USER_AGENT -> User-Agent, CONTENT_TYPE -> Content-Type
+      def rack_key_to_header(key)
+        key.delete_prefix(RACK_HTTP_PREFIX)
+            .split('_')
+            .map(&:capitalize)
+            .join('-')
+      end
+
+      def normalize_header_name(name)
+        name.tr('_', '-').split('-').map(&:capitalize).join('-')
+      end
     end
   end
 end

data/lib/catpm/configuration.rb

@@ -43,7 +43,9 @@ module Catpm
                   :track_own_requests,
                   :downsampling_thresholds,
                   :show_untracked_segments,
-                  :always_sample_targets
+                  :always_sample_targets,
+                  :anonymize_ip,
+                  :sensitive_headers
 
     # Numeric settings that must be positive numbers (nil not allowed)
     REQUIRED_NUMERIC = %i[
@@ -82,7 +84,7 @@ module Catpm
     end
 
     def initialize
-      @enabled = true
+      @enabled = false
       @instrument_http = true
       @instrument_jobs = false
       @instrument_segments = true
@@ -136,6 +138,8 @@ module Catpm
       @instrument_call_tree = false
       @show_untracked_segments = false
       @always_sample_targets = []
+      @anonymize_ip = false
+      @sensitive_headers = %w[Authorization Cookie Set-Cookie X-API-Key X-CSRF-Token]
     end
 
     # Buffer gets BUFFER_MEMORY_SHARE of max_memory, scaled by thread count

data/lib/catpm/engine.rb

@@ -22,6 +22,15 @@ module Catpm
             # Middleware not found in stack — skip
           end
         end
+
+        if Catpm.config.instrument_jobs && defined?(::Sidekiq)
+          require 'catpm/sidekiq_server_middleware' unless defined?(Catpm::SidekiqServerMiddleware)
+          ::Sidekiq.configure_server do |config|
+            config.server_middleware do |chain|
+              chain.add Catpm::SidekiqServerMiddleware
+            end
+          end
+        end
       end
     end
 

data/lib/catpm/fingerprint.rb

@@ -74,6 +74,12 @@ module Catpm
       line.sub(/:\d+:in /, ':in ')
     end
 
+    # Classify app-code path: middleware vs regular code.
+    # Files under a /middleware/ or /middlewares/ directory are middleware.
+    def self.app_code_type(path)
+      path.include?('/middleware/') || path.include?('/middlewares/') ? 'middleware' : 'code'
+    end
+
     # The actual classification logic (uncached).
     def self._app_frame?(line)
       return false if line.include?('/gems/')