deployangel 0.1.9 → 0.1.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2bc6936b563039a1c2caa91f3a8125f0c32582366505ab35dfabf2ec90af3c5
-  data.tar.gz: 22c805b0adef58922b3513afc19492433421358be2e75fd12513e650a7e57c9c
+  metadata.gz: 2fd5de9ae625d8780f853e4ee71b662be91f6dc702f59aa15806b359c075045a
+  data.tar.gz: 5823184602177d55b1abc39dd920b01879162a335afabe3dee46c5cdbfec1295
 SHA512:
-  metadata.gz: 361b042f1d885fc63442dff6d4f4c406b36fd14ea5c226cf04a5bea2f7537770c6b4f4ad169331b95e6f3bdacf37169f90ac70fc6567006203f4884fe021236a
-  data.tar.gz: 328b709591c7c5441390fb74dc535d0a515061fd64161bbe555ffe9f4f8602bf32f10676b6119458e44837ee539e96e5e2f4d72b97cafc05e203d3ef2eb77e7b
+  metadata.gz: 5c899072c049b8854d5772c05be7cb95588d427a571324ab303134418081b3815ae39eb6efaea92b1e46f6857f24379674f9298050435638bb674baca942aeb7
+  data.tar.gz: 3ce76ca3b6232505e4d1afaa95348939a1ffcac19fe02cf296f30fdf02fd447aba85991c5d8b292ace00d19b38a0e73418a668d0cef8993a86119a1a3d2abc26

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.1.10 (2026-10-04)
+
+- `config.exception_messages = false` (or `DEPLOYANGEL_EXCEPTION_MESSAGES=false`)
+  sends exceptions with their class, fingerprint, and application frames, and
+  no message. Grouping and verdicts work the same.
+- The request's host is replaced with `<host>` in exception messages, and with
+  ros-apartment, so are the tenants the request or job switched to
+  (`<tenant>`), including one that turned out not to exist. The default tenant
+  is left alone.
+- ECS, including Fargate: the release comes from the container's image, read
+  once at boot from `ECS_CONTAINER_METADATA_URI_V4`. A tag that's a commit is
+  the commit, another tag is the version, and a moving tag such as `latest` uses
+  the image digest. `DEPLOYANGEL_REVISION` and a `REVISION` file still win.
+
 ## 0.1.9 (2026-10-04)
 
 - A 4xx response to a request no route matched, such as a bot probing

data/README.md

@@ -34,9 +34,14 @@ The agent must know which release it is running. It finds it in this order:
    didn't come from GitHub
 7. Coolify: `SOURCE_COMMIT`. Dokku: `GIT_REV`
 8. a `REVISION` file in the app root, which Capistrano writes and any build step can
+9. ECS, including Fargate: the container's image, from the metadata endpoint ECS
+   provides (one local request at boot). The image tag is the release when it's a
+   commit or a version like `v1.4.2`; with a moving tag like `latest`, the image
+   digest is
 
-For other Docker deploys (compose, Swarm, ECS, Kubernetes), bake the commit into
-the image, since `.dockerignore` usually leaves `.git` out:
+For other Docker deploys (compose, Swarm, Kubernetes), and on ECS to see each
+release by its commit, bake the commit into the image, since `.dockerignore`
+usually leaves `.git` out:
 
 ```dockerfile
 ARG GIT_SHA
@@ -63,9 +68,13 @@ says so.
   middleware. Failures that `retry_on` or `discard_on` handle still count.
 - Release identity, runtime versions, and a per-process instance ID.
 
-- Exceptions: a stable fingerprint, the exception class, a sanitized message
-  (numbers, IDs, emails, and quoted values removed), and application frames
-  only.
+- Exceptions: a stable fingerprint, the exception class, the first line of the
+  message, and application frames only. In the message, numbers, IDs, emails,
+  UUIDs, long hex strings, and quoted values are replaced with placeholders, and
+  so are the request's host and, with ros-apartment, the tenants the request or
+  job switched to. Other words are kept: `Payment failed for Jane Doe` is sent
+  as it is. If your app's messages might hold personal or health data, [turn
+  messages off](#exception-messages).
 - Once per process: the route table, job classes, recurring schedules
   declared for Solid Queue, sidekiq-cron, or sidekiq-scheduler, critical
   flows, and file digests (relative paths and hashes, never file contents) so
@@ -140,6 +149,29 @@ DeployAngel.configure do |config|
 end
 ```
 
+`DEPLOYANGEL_ENABLED=true|false` forces reporting on or off in any environment.
+`DEPLOYANGEL_URL` overrides the API endpoint (default `https://api.deployangel.com`).
+
+### Exception messages
+
+To send exceptions without any message, only their class, fingerprint, and
+application frames:
+
+```ruby
+DeployAngel.configure do |config|
+  config.exception_messages = false # or DEPLOYANGEL_EXCEPTION_MESSAGES=false
+end
+```
+
+Grouping, new-exception detection, and verdicts work the same, since the
+fingerprint never uses the message. You lose the message text in the dashboard,
+notifications, and AI investigation. With messages off, what leaves your app is
+route patterns, counts, timings, job class names, exception classes, and
+application file paths and method names, plus the route table, job classes,
+schedules, and file digests described above.
+
+### Recurring jobs
+
 DeployAngel expects declared recurring jobs on schedule. It reads Solid Queue's
 `config/recurring.yml`, sidekiq-scheduler's section of Sidekiq's config, and
 sidekiq-cron's schedule file (`config/schedule.yml` unless sidekiq-cron is
@@ -156,9 +188,6 @@ end
 Jobs that exist only in Redis, such as ones created in code or in the
 Sidekiq web UI, aren't read.
 
-`DEPLOYANGEL_ENABLED=true|false` forces reporting on or off in any environment.
-`DEPLOYANGEL_URL` overrides the API endpoint (default `https://api.deployangel.com`).
-
 ## Checkpoints
 
 Errors and latency don't catch work that silently stops happening. Count the

data/lib/deployangel/agent.rb

@@ -91,7 +91,9 @@ module DeployAngel
 
       exception.instance_variable_set(SEEN, true) unless exception.frozen?
       start_reporter
-      @aggregator.record_exception(Fingerprint.for(exception, root: @root), source: source, handled: handled,
+      messages = config.exception_messages
+      details = Fingerprint.for(exception, root: @root, message: messages, redactions: messages ? Redaction.current : [])
+      @aggregator.record_exception(details, source: source, handled: handled,
         backtrace: Fingerprint.backtrace(exception, root: @root))
     rescue StandardError => e
       warn_once(:record_exception, "DeployAngel failed to record an exception: #{e.class}: #{e.message}")

data/lib/deployangel/apartment.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module DeployAngel
+  # Notes each tenant ros-apartment switches to, before switching, so even a
+  # tenant that turns out not to exist ("Could not find schema acme") is
+  # replaced in exception messages (Redaction). The default tenant, usually
+  # "public", is left alone.
+  module Apartment
+    module Switch
+      def switch!(tenant = nil)
+        begin
+          DeployAngel::Redaction.note_tenant(tenant) unless tenant.nil? || tenant.to_s == default_tenant.to_s
+        rescue StandardError
+          nil
+        end
+        super
+      end
+    end
+
+    def self.install
+      return unless defined?(::Apartment::Tenant)
+
+      require "apartment/adapters/abstract_adapter" unless defined?(::Apartment::Adapters::AbstractAdapter)
+      adapter = ::Apartment::Adapters::AbstractAdapter
+      adapter.prepend(Switch) unless adapter < Switch
+    rescue LoadError, StandardError
+      nil
+    end
+  end
+end

data/lib/deployangel/configuration.rb

@@ -11,7 +11,7 @@ module DeployAngel
 
     attr_accessor :token, :endpoint, :enabled, :environments, :release_version, :revision,
       :flush_interval, :open_timeout, :read_timeout, :max_queued_payloads, :max_routes, :logger,
-      :file_digests, :critical_flows, :ignored_routes, :sidekiq_cron_schedule_file
+      :file_digests, :critical_flows, :ignored_routes, :sidekiq_cron_schedule_file, :exception_messages
 
     def initialize(env = ENV)
       @token = env["DEPLOYANGEL_TOKEN"]
@@ -27,6 +27,9 @@ module DeployAngel
       @max_routes = 100
       @logger = Logger.new($stderr, level: Logger::WARN, progname: "deployangel")
       @file_digests = parse_boolean(env["DEPLOYANGEL_FILE_DIGESTS"]) != false
+      # Off, exceptions are sent with their class and frames only, never a
+      # message, for apps whose messages may hold personal or health data.
+      @exception_messages = parse_boolean(env["DEPLOYANGEL_EXCEPTION_MESSAGES"]) != false
       @critical_flows = {}
       # Route keys as the dashboard shows them, such as "GET /healthz".
       @ignored_routes = []

data/lib/deployangel/core/fingerprint.rb

@@ -21,13 +21,15 @@ module DeployAngel
 
     module_function
 
-    def for(exception, root:)
+    # message: false leaves the message out entirely. redactions are
+    # [value, placeholder] pairs replaced first (Redaction).
+    def for(exception, root:, message: true, redactions: [])
       frame = top_frame(exception, root: root)
       {
         "fingerprint" => Digest::SHA256.hexdigest([ "v#{VERSION}", exception.class.name, frame ].join("|"))[0, 32],
         "fingerprint_version" => VERSION,
         "exception_class" => exception.class.name,
-        "message" => normalize_message(exception.message),
+        "message" => (normalize_message(exception.message, redactions) if message),
         "top_frame" => frame,
         "app_frame" => app_frame?(frame)
       }
@@ -50,8 +52,13 @@ module DeployAngel
         .map { |path, label| "#{normalize_path(path, root)}##{label}" }
     end
 
-    def normalize_message(message)
+    # Only quoted values, numbers, emails, UUIDs, and long hex are replaced;
+    # unquoted words, such as a name in a message the app builds, are kept.
+    def normalize_message(message, redactions = [])
       text = message.to_s.lines.first.to_s.strip
+      redactions.each do |value, placeholder|
+        text = text.gsub(/(?<![[:alnum:]])#{Regexp.escape(value)}(?![[:alnum:]])/i, placeholder)
+      end
       MESSAGE_PLACEHOLDERS.each { |pattern, placeholder| text = text.gsub(pattern, placeholder) }
       text[0, MAX_MESSAGE]
     end

data/lib/deployangel/core/redaction.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module DeployAngel
+  # Values that name a customer of the app rather than its code, replaced in
+  # exception messages before they're cleaned: the request's host and, with
+  # ros-apartment, the tenants this thread last switched to. Kept per thread
+  # (per fiber), where the request or job that raised ran.
+  module Redaction
+    HOST = :deployangel_request_host
+    TENANTS = :deployangel_tenants
+    MAX_TENANTS = 5
+    # Shorter names would replace ordinary words.
+    MIN_LENGTH = 3
+
+    module_function
+
+    def request_host=(host)
+      Thread.current[HOST] = host
+    end
+
+    def note_tenant(tenant)
+      name = tenant.to_s.strip
+      return if name.length < MIN_LENGTH
+
+      tenants = (Thread.current[TENANTS] ||= [])
+      tenants.delete(name)
+      tenants.unshift(name)
+      tenants.pop while tenants.size > MAX_TENANTS
+    end
+
+    # [value, placeholder] pairs, longest first, so a host is replaced before
+    # a tenant name inside it.
+    def current
+      host = Thread.current[HOST].to_s.sub(/:\d+\z/, "")
+      pairs = Array(Thread.current[TENANTS]).map { |tenant| [ tenant, "<tenant>" ] }
+      pairs << [ host, "<host>" ] if host.length >= MIN_LENGTH
+      pairs.sort_by { |value, _| -value.length }
+    end
+  end
+end

data/lib/deployangel/core/release.rb

@@ -1,15 +1,22 @@
 # frozen_string_literal: true
 
+require "json"
+require "net/http"
+require "uri"
+
 module DeployAngel
   # Which release this process is running, resolved once at boot so that
   # telemetry can be attributed to a deployment.
   class Release < Struct.new(:version, :commit, :source)
     COMMIT_FORMAT = /\A[0-9a-f]{7,40}\z/
 
+    # Tags that move from build to build, so they can't identify a release.
+    MOVING_TAGS = %w[latest main master production prod staging stable release].freeze
+
     # Order: explicit configuration, Heroku dyno metadata, the hosting
     # platform's own variables (Kamal, Render, Fly.io, Railway, Coolify, and
-    # Dokku's GIT_REV), then a REVISION file.
-    def self.resolve(config:, env: ENV, root: nil)
+    # Dokku's GIT_REV), a REVISION file, then ECS container metadata.
+    def self.resolve(config:, env: ENV, root: nil, http: method(:fetch_metadata))
       if present?(config.release_version) || present?(config.revision)
         build(config.release_version, config.revision, "config")
       elsif present?(env["HEROKU_RELEASE_VERSION"]) || present?(env["HEROKU_SLUG_COMMIT"])
@@ -29,6 +36,8 @@ module DeployAngel
         build(nil, env["GIT_REV"], "git_rev")
       elsif root && File.file?(revision_path = File.join(root, "REVISION"))
         build(nil, File.read(revision_path, 100), "revision_file")
+      elsif present?(env["ECS_CONTAINER_METADATA_URI_V4"]) && (release = ecs(http.call(env["ECS_CONTAINER_METADATA_URI_V4"])))
+        release
       else
         new(nil, nil, "unknown")
       end
@@ -64,6 +73,38 @@ module DeployAngel
       tag unless tag.empty?
     end
 
+    # ECS (Fargate, and EC2 with a recent agent) serves each container's
+    # metadata at ECS_CONTAINER_METADATA_URI_V4. The image tag identifies the
+    # release, and is the commit when it looks like one. A moving tag such
+    # as "latest" can't, so the image digest does instead.
+    def self.ecs(body)
+      data = JSON.parse(body.to_s)
+      return unless data.is_a?(Hash)
+
+      tag = data["Image"].to_s.split("@", 2).first.to_s.split("/").last.to_s.split(":", 2)[1].to_s.strip
+      if tag.downcase.match?(COMMIT_FORMAT)
+        build(nil, tag, "ecs")
+      elsif present?(tag) && !MOVING_TAGS.include?(tag.downcase)
+        build(tag, nil, "ecs")
+      elsif (digest = data["ImageID"].to_s[/\Asha256:(\h{12})/, 1])
+        build("sha256:#{digest}", nil, "ecs")
+      end
+    rescue JSON::ParserError
+      nil
+    end
+
+    # One request at boot to the container's own metadata endpoint, which
+    # is local, so the timeouts are short. Nil on any failure.
+    def self.fetch_metadata(uri)
+      uri = URI.parse(uri)
+      Net::HTTP.start(uri.host, uri.port, open_timeout: 0.5, read_timeout: 1) do |http|
+        response = http.get(uri.request_uri)
+        response.body if response.is_a?(Net::HTTPSuccess)
+      end
+    rescue StandardError
+      nil
+    end
+
     # The cloud rejects malformed commits, which would drop every payload,
     # so anything that is not a hex SHA is left out.
     def self.build(version, commit, source)

data/lib/deployangel/rails/http.rb

@@ -25,6 +25,7 @@ module DeployAngel
         return @app.call(env) unless DeployAngel.recording?
 
         started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        Redaction.request_host = env["HTTP_HOST"]
         begin
           status, headers, body = @app.call(env)
         rescue Exception => e # rubocop:disable Lint/RescueException -- recorded, then re-raised untouched

data/lib/deployangel/rails/railtie.rb

@@ -21,6 +21,7 @@ module DeployAngel
       end
 
       config.after_initialize do |app|
+        DeployAngel::Apartment.install if DeployAngel.configuration.exception_messages
         agent = DeployAngel.start(
           environment: ::Rails.env,
           root: ::Rails.root.to_s,

data/lib/deployangel/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DeployAngel
-  VERSION = "0.1.9"
+  VERSION = "0.1.10"
 end

data/lib/deployangel.rb

@@ -3,6 +3,7 @@
 require_relative "deployangel/version"
 require_relative "deployangel/configuration"
 require_relative "deployangel/core/histogram"
+require_relative "deployangel/core/redaction"
 require_relative "deployangel/core/fingerprint"
 require_relative "deployangel/core/release"
 require_relative "deployangel/core/instance"
@@ -115,4 +116,5 @@ require_relative "deployangel/rails/active_job"
 require_relative "deployangel/rails/error_subscriber"
 require_relative "deployangel/rails/metadata"
 require_relative "deployangel/sidekiq"
+require_relative "deployangel/apartment"
 require_relative "deployangel/rails/railtie" if defined?(::Rails::Railtie)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: deployangel
 version: !ruby/object:Gem::Version
-  version: 0.1.9
+  version: 0.1.10
 platform: ruby
 authors:
 - Jordan Owens
@@ -25,6 +25,7 @@ files:
 - exe/deployangel
 - lib/deployangel.rb
 - lib/deployangel/agent.rb
+- lib/deployangel/apartment.rb
 - lib/deployangel/capistrano.rb
 - lib/deployangel/capistrano/steps.rb
 - lib/deployangel/capistrano/tasks.rake
@@ -39,6 +40,7 @@ files:
 - lib/deployangel/core/histogram.rb
 - lib/deployangel/core/instance.rb
 - lib/deployangel/core/protocol.rb
+- lib/deployangel/core/redaction.rb
 - lib/deployangel/core/release.rb
 - lib/deployangel/core/transport.rb
 - lib/deployangel/fork_hook.rb