debugbundle 2.1.0 → 2.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa08dbcf220cb84131821cf546272d4d08d6f15f01ba4e8c7f41f77fbc53a1c0
-  data.tar.gz: fe1a46ab795df53b5dd1ac5bee6684b43ea35501d031a345b52c576e9a8881f9
+  metadata.gz: 25d32f695274543c343f714a99ec12668bb42c23c608c07469a6a0fb6d34d2c9
+  data.tar.gz: 42bb8c82354c4b8b06a81f8b4e462fbd1028c23650aff6d36cb28b5402781d5d
 SHA512:
-  metadata.gz: 69e7d24b4c4615dc8ff2da958c90427c0a19d9f781629ff31f9e2918912e97f4298d6a44bba5fd2f19e56cef5fcb426796ed26e7f71b73eefb6384eaa26e0ca7
-  data.tar.gz: 190296bc690b90b3113a59b99c7062ed5f3f95705bb633b4998577d884743f5f64570a727ca81334fb45fe7c3d02f13be4d38cda714244cca79998ad94a2887d
+  metadata.gz: a9086dd9cacdc78a475f77b0bbb84b247849a360f98db7d5a3024f9e653b0c14f9b513147526a04218ad67b2917db06ba0f85a729ec17996e174c6abfe43cac1
+  data.tar.gz: 34aa039ea542b4c395d25ea5e51b8222d0a00699dbb89caaacc08ece8077f074786615a65bf7b918babdd385e3dba5f7e89b867a2a7dad2d03eae4958e5bc4fb

data/README.md

@@ -1,5 +1,7 @@
 # debugbundle
 
+Patch 2.1.1 corrects native logger exception evidence and capture safety while preserving public APIs and event schemas. Upgrade the DebugBundle distribution to adopt the correction.
+
 Ruby SDK for DebugBundle.
 
 Use this gem to capture Ruby backend exceptions, request metadata, structured logs, runtime context, probe data, and browser relay traffic. It supports a singleton facade plus instance clients for Rack, Rails, Sidekiq, and explicit Ruby instrumentation.
@@ -8,7 +10,9 @@ The source test matrix covers Ruby 3.1 through 4.0. Rails 7.x remains an install
 
 Version 2.0 changes capture and hook timing. Existing installed 1.5.x applications continue to use their pinned gem until upgraded. Review [the migration guide](MIGRATION-2.0.md) before upgrading.
 
-`make sdk-safety-perf` runs a Docker-backed host-safety budget with 10,000 filtered INFO calls, 1,000 accepted ERROR calls with and without custom privacy fields, and 10,000 concurrent ERROR calls against a full queue while transport is held. CI and the release workflow run this gate before publication. These bounded synthetic checks supplement, but do not replace, installed runtime and workload qualification.
+`make sdk-safety-perf` runs a Docker-backed host-safety budget with 10,000 filtered INFO calls, 1,000 accepted ERROR calls with and without custom privacy fields, and 10,000 concurrent ERROR calls against a full queue while transport is held. It also bounds 200 enriched exceptions and 1,000 recovery observations. CI and the release workflow run this gate before publication. These bounded synthetic checks supplement, but do not replace, installed runtime and workload qualification.
+
+Mandatory privacy checks reuse at most 256 field-name decisions and 256 unchanged scalar strings of at most 128 bytes within each projection. Returned values remain independently owned. Every value and repeated key still counts against the existing resource budgets; both caches are discarded before the next event or policy.
 
 `make evidence-performance` compares the same exception/recovery calls with
 evidence disabled and enabled, including a full warning queue. It reports capture
@@ -16,10 +20,9 @@ time, allocated Ruby objects and retained bytes, and verifies original-error
 priority and the existing queue/diagnostic ceilings. Setup and cleanup are excluded;
 the existing `sdk-safety-perf` timing limits remain unchanged.
 
-## Unreleased evidence candidate
+## Evidence in 2.1.0
 
-The working candidate adds structured exception evidence and explicit recovery;
-it is not a published release. Enrichment requires a valid capability descriptor
+Version 2.1.0 adds structured exception evidence and explicit recovery. Enrichment requires a valid capability descriptor
 from the destination on an existing config/ingestion response. No extra discovery
 request is made. Unknown paths keep ordinary exception capture. The optional
 `evidence_capabilities: { version: 1, features: [...] }` pin asserts that every
@@ -116,7 +119,7 @@ Rack and Rails browser relays preserve validated evidence and server-owned
 credentials. Downstream chunks account for server metadata expansion; a durable
 spool is marked delivered only when every chunk has a complete canonical
 acknowledgement. Legacy custom transport success remains compatible and cannot
-create a delivered marker. Final installed/runtime qualification is in progress.
+create a delivered marker. Installed/runtime qualification passed before publication.
 
 ## Automatic capture and application filtering
 

data/lib/debugbundle/client.rb

@@ -149,6 +149,15 @@ module DebugBundle
       normalized_level = normalize_level(level || :warning)
       return unless level_enabled?(normalized_level)
 
+      error = message.is_a?(Exception) ? message : context.is_a?(Hash) && (context[:exception] || context['exception'])
+      if %i[error critical].include?(normalized_level) && error.is_a?(Exception)
+        fields = (context || {}).reject { |key, _value| %w[exception].include?(key.to_s) }
+        fields[:logger_name] ||= 'logger'
+        fields[:log_message] = message if message.is_a?(String)
+        capture_exception(error, context: fields)
+        return
+      end
+
       priority = LOG_LEVEL_RANKS.fetch(normalized_level) >= LOG_LEVEL_RANKS.fetch(:error) ? 2 : 0
       return unless preflight_capacity?(priority, normalized_level.to_s)
 

data/lib/debugbundle/client_exception_support.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'debugbundle/exception_identity'
+
 module DebugBundle
   class Client
     module ExceptionSupport
@@ -9,9 +11,15 @@ module DebugBundle
         return unless capture_enabled?
         return unless preflight_capacity?(3, 'exception')
 
+        merged_context = evidence_context(merge_context(context))
+        @exception_identity ||= ExceptionIdentity.new
+        logged = merged_context.key?('logger_name')
+        automatic = !run_before_send || logged
+        scope = config.before_send ? nil : @operations.scope
+        return unless @exception_identity.admit?(error, scope, automatic)
+
         request_remote_config_poll_if_due
 
-        merged_context = evidence_context(merge_context(context))
         payload = {
           'name' => safe_exception_name(error),
           'message' => safe_exception_message(error),
@@ -45,7 +53,9 @@ module DebugBundle
         return unless @suppression.should_capture(suppression_key, now: monotonic_now)
 
         event = enrich_exception(event, retained, causes, fatal: !run_before_send)
-        enqueue_event(event, skip_before_send: !run_before_send)
+        return unless enqueue_event(event, skip_before_send: !run_before_send)
+
+        @exception_identity.admit?(error, scope, automatic, accepted: true)
       end
     end
 

data/lib/debugbundle/exception_identity.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require 'weakref'
+
+module DebugBundle
+  class ExceptionIdentity
+    NATIVE_EQUAL = BasicObject.instance_method(:equal?)
+
+    def initialize
+      @entries = []
+      @lock = Mutex.new
+    end
+
+    def admit?(error, scope, automatic, accepted: false)
+      return true if scope.nil?
+      return true unless @lock.try_lock
+
+      begin
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        @entries.reject! { |entry| !entry[0].weakref_alive? || now - entry[3] >= 30 }
+        @entries.each do |entry|
+          next unless NATIVE_EQUAL.bind_call(entry[0].__getobj__, error) && entry[1] == scope
+
+          if !accepted && automatic != entry[2]
+            @entries.delete(entry)
+            return false
+          end
+          @entries.delete(entry) if accepted
+        end
+        if accepted
+          @entries.shift if @entries.length >= 128
+          @entries << [WeakRef.new(error), scope, automatic, now]
+        end
+        true
+      rescue WeakRef::RefError
+        true
+      ensure
+        @lock.unlock
+      end
+    end
+  end
+end

data/lib/debugbundle/logging.rb

@@ -44,7 +44,7 @@ module DebugBundle
       was_capturing = Thread.current[RECURSION_GUARD_KEY]
       Thread.current[RECURSION_GUARD_KEY] = true
       client.capture_log(
-        message.to_s,
+        message.is_a?(Exception) ? message : message.to_s,
         level: LOGGER_LEVEL_NAMES.fetch(severity, :warning),
         context: { logger_name: progname }
       )
@@ -79,6 +79,7 @@ module DebugBundle
           level: log.level || :info,
           context: {
             logger_name: log.name,
+            exception: log.respond_to?(:exception) ? log.exception : nil,
             payload: log.payload,
             tags: log.tags
           }

data/lib/debugbundle/telemetry_privacy.rb

@@ -28,7 +28,7 @@ module DebugBundle
         raise ArgumentError, 'unsafe_input'
       end
 
-      work = { nodes: 0, bytes: 0, seen: {}.compare_by_identity,
+      work = { nodes: 0, bytes: 0, seen: {}.compare_by_identity, key_policy: {}, safe_text: {},
                fields: if additional_fields.empty?
                          CANONICAL_FIELDS
                        else
@@ -80,6 +80,23 @@ module DebugBundle
       end
     end
 
+    def key_policy(name, work)
+      cached = work[:key_policy][name]
+      return cached if cached
+
+      policy = if scrub_text(name, work) != name
+                 :omit
+               elsif sensitive_key?(name, work[:fields])
+                 :redact
+               else
+                 :retain
+               end
+      # Stack frames repeat the same keys. Cache decisions only in this bounded
+      # projection; values, byte accounting and later policies remain independent.
+      work[:key_policy][name] = policy if work[:key_policy].size < 256
+      policy
+    end
+
     def visit(value, work, depth, structured)
       work[:nodes] += 1
       raise ArgumentError, 'budget_exceeded' if work[:nodes] > 4096
@@ -115,9 +132,10 @@ module DebugBundle
           next if name.bytesize > 128
 
           count_bytes(work, name)
-          next if scrub_text(name, work) != name
+          policy = key_policy(name, work)
+          next if policy == :omit
 
-          result[name] = sensitive_key?(name, work[:fields]) ? REDACTED : visit(nested, work, depth + 1, structured)
+          result[name] = policy == :redact ? REDACTED : visit(nested, work, depth + 1, structured)
         end
       end
     ensure
@@ -142,13 +160,25 @@ module DebugBundle
           # Malformed structured content with a credential label is withheld below.
         end
       end
-      result = scrub_text(value, work)
+      result = scrub_value_text(value, work)
       return REDACTED if result == value && value.start_with?('{', '[') &&
                          /(?:password|token|secret|authorization|cookie)["']?\s*[:=]/i.match?(value)
 
       result
     end
 
+    def scrub_value_text(value, work)
+      # Only short, unchanged scalar text is reusable. Structured containers and
+      # redacted values always take the full path; every return owns its string.
+      cacheable = value.bytesize <= 128 && !value.start_with?('{', '[')
+      cached = work[:safe_text][value] if cacheable
+      return cached.dup if cached
+
+      result = scrub_text(value, work)
+      work[:safe_text][value] = result.dup.freeze if cacheable && result == value && work[:safe_text].size < 256
+      result
+    end
+
     def valid_card?(candidate)
       digits = candidate.delete(' -')
       return false unless digits.length.between?(13, 19) && digits.chars.uniq.length > 1

data/lib/debugbundle/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DebugBundle
-  VERSION = '2.1.0'
+  VERSION = '2.1.1'
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: debugbundle
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.1.1
 platform: ruby
 authors:
 - DebugBundle
 bindir: exe
 cert_chain: []
-date: 2026-11-01 00:00:00.000000000 Z
+date: 2026-11-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64
@@ -70,6 +70,7 @@ files:
 - lib/debugbundle/evidence_value.rb
 - lib/debugbundle/evidence_wire.rb
 - lib/debugbundle/exception_evidence.rb
+- lib/debugbundle/exception_identity.rb
 - lib/debugbundle/framework_operation.rb
 - lib/debugbundle/logging.rb
 - lib/debugbundle/operation_context.rb