devbench 0.5.0 → 0.7.0

data/lib/devbench/view_helper.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require 'erb'
+require_relative 'version'
+
+module Devbench
+  # The browser sensor's script tag, for the layout's <head>:
+  #
+  #   <%= devbench_script_tag %>
+  #
+  # renders
+  #
+  #   <script src="https://unpkg.com/devbench@0.7.0/dist/devbench.min.js"
+  #           data-dsn="https://<public>@<host>" data-release="<release>" defer></script>
+  #
+  # The DSN is the public part of DEVBENCH_DSN only (Devbench.browser_dsn),
+  # so the page needs no setting of its own and the secret never reaches
+  # HTML. No public part (no DSN, a 0.5 single-key DSN, reporting disabled)
+  # renders nothing at all. The src is pinned to this gem's version, so a
+  # gem upgrade upgrades the browser sensor with it. Where the app uses a
+  # CSP nonce (content_security_policy_nonce_generator), the tag carries it,
+  # as Rails' own `javascript_include_tag nonce: true` does.
+  #
+  # Included into ActionView by the Railtie. Never raises.
+  module ViewHelper
+    CDN = 'https://unpkg.com'
+
+    def self.src
+      "#{CDN}/devbench@#{Devbench::VERSION}/dist/devbench.min.js"
+    end
+
+    def devbench_script_tag
+      dsn = Devbench.browser_dsn
+      return devbench_safe('') if dsn.nil?
+
+      attrs = [['src', ViewHelper.src], ['data-dsn', dsn], ['data-release', Devbench.config.resolved_release]]
+      nonce = devbench_nonce
+      attrs << ['nonce', nonce] if nonce
+      html = attrs.map { |name, value| %(#{name}="#{ERB::Util.html_escape(value)}") }.join(' ')
+      devbench_safe("<script #{html} defer></script>")
+    rescue StandardError, SystemStackError
+      devbench_safe('')
+    end
+
+    private
+
+    # Rails' content_security_policy_nonce: nil unless the app configured a
+    # nonce generator.
+    def devbench_nonce
+      return nil unless respond_to?(:content_security_policy_nonce, true)
+
+      nonce = content_security_policy_nonce
+      nonce.nil? || nonce.to_s.empty? ? nil : nonce.to_s
+    rescue StandardError, SystemStackError
+      nil
+    end
+
+    def devbench_safe(html)
+      html.respond_to?(:html_safe) ? html.html_safe : html
+    end
+  end
+end

data/lib/devbench.rb

@@ -2,8 +2,9 @@
 
 # Dev Bench server SDK for Ruby/Rails (formerly "ADT"; DECISIONS #160).
 #
-#   gem 'devbench'          # Gemfile
-#   DEVBENCH_DSN=https://<key>@<ingest host>
+#   bundle add devbench
+#   bin/rails generate devbench
+#   DEVBENCH_DSN=https://<public>:<secret>@<ingest host>   (from `adt dsn create`)
 #
 # What it does:
 #   * accepts and forwards the correlation id  (Devbench::Middleware, Devbench::HTTP)
@@ -12,6 +13,8 @@
 #   * reports unhandled exceptions             (Devbench::Middleware, Devbench::Railtie,
 #                                               Devbench::SidekiqHooks,
 #                                               Devbench.capture_exception)
+#   * keeps recent log lines per trace         (Devbench::Logs; direct mode)
+#   * renders the browser sensor's tag         (devbench_script_tag)
 #
 # The old name is kept: `require 'adt'` and every `ADT.` / `ADT::` call in an
 # existing install resolve to this module.
@@ -27,6 +30,8 @@ require_relative 'devbench/session'
 require_relative 'devbench/session_middleware'
 require_relative 'devbench/rails_hooks'
 require_relative 'devbench/sidekiq_hooks'
+require_relative 'devbench/logs'
+require_relative 'devbench/view_helper'
 
 # The pre-0.5 name. The same module object, not a copy: ADT::Middleware *is*
 # Devbench::Middleware, so a stack holding either holds the one class.

data/lib/generators/devbench/devbench_generator.rb

@@ -0,0 +1,210 @@
+# frozen_string_literal: true
+
+require 'rails/generators'
+require 'devbench'
+
+module Devbench
+  # bin/rails generate devbench
+  #
+  # Step 2 of the install (DECISIONS #161):
+  #
+  #   1. bundle add devbench
+  #   2. bin/rails generate devbench
+  #   3. set DEVBENCH_DSN
+  #
+  # Does two things, and touches nothing else:
+  #
+  #   * puts <%= devbench_script_tag %> in the application layout's <head>
+  #     (.erb, .haml or .slim), or prints exactly what to add where;
+  #   * if config/initializers/content_security_policy.rb defines a policy,
+  #     allows the sensor's script (https://unpkg.com) in script_src, and
+  #     the ingest host plus evidence storage (https://*.storage.supabase.co)
+  #     in connect_src.
+  #
+  # Idempotent: a second run changes nothing. Prints what it changed.
+  class DevbenchGenerator < ::Rails::Generators::Base
+    namespace 'devbench'
+    desc 'Adds the Dev Bench browser tag to your layout and allows it in your CSP.'
+
+    TAG = 'devbench_script_tag'
+    SCRIPT_HOST = 'https://unpkg.com'
+    STORAGE_HOST = 'https://*.storage.supabase.co'
+    # Ruby code, not a host: evaluated when the CSP initializer runs, so the
+    # policy follows DEVBENCH_DSN (Devbench.csp_connect_sources).
+    RUNTIME_CONNECT = '*Devbench.csp_connect_sources'
+    LAYOUTS = %w[erb haml slim].map { |ext| "app/views/layouts/application.html.#{ext}" }.freeze
+    CSP = 'config/initializers/content_security_policy.rb'
+
+    def add_script_tag
+      path = LAYOUTS.find { |p| File.exist?(File.join(destination_root, p)) }
+      return manual_tag('no app/views/layouts/application.html.{erb,haml,slim} found') if path.nil?
+
+      full = File.join(destination_root, path)
+      text = File.read(full)
+      if text.include?(TAG)
+        say_status :identical, "#{path} (already has #{TAG})", :blue
+        return
+      end
+
+      updated = path.end_with?('.erb') ? insert_erb(text) : insert_indented(text, path.end_with?('.haml') ? /%head\b/ : /head\b/)
+      return manual_tag("could not find the <head> of #{path}") if updated.nil?
+
+      File.write(full, updated)
+      say_status :insert, "#{path}: <%= #{TAG} %> in <head>", :green
+    end
+
+    def allow_in_content_security_policy
+      full = File.join(destination_root, CSP)
+      unless File.exist?(full)
+        say_status :skip, "#{CSP} not found: no CSP to change", :blue
+        return
+      end
+
+      text = File.read(full)
+      var = text[/^[ \t]*(?:Rails\.application\.)?config\.content_security_policy[ \t]+do[ \t]*\|[ \t]*(\w+)[ \t]*\|/, 1]
+      if var.nil?
+        say_status :skip, "#{CSP} defines no policy (all commented out): nothing to change", :blue
+        return
+      end
+
+      changes = []
+      text = allow(text, var, 'script_src', [SCRIPT_HOST], changes)
+      text = allow(text, var, 'connect_src', [RUNTIME_CONNECT], changes)
+      if changes.empty?
+        say_status :identical, "#{CSP} (already allows Dev Bench)", :blue
+        return
+      end
+
+      File.write(full, text)
+      changes.each { |c| say_status :csp, "#{CSP}: #{c}", :green }
+    end
+
+    def print_next_steps
+      say ''
+      say 'Next:'
+      say '  1. Set DEVBENCH_DSN in this app\'s environment (the value `adt dsn create` printed).'
+      say '  2. Check it: bin/rails devbench:test'
+    end
+
+    private
+
+    def manual_tag(reason)
+      say_status :manual, reason, :yellow
+      say "  Add this to your layout, just before </head>:\n\n    <%= #{TAG} %>\n\n" \
+          "  (Haml or Slim: `= #{TAG}` as the last line inside head.)"
+    end
+
+    # Before </head>, indented one step deeper than it when it is on a line
+    # of its own.
+    def insert_erb(text)
+      at = text =~ %r{</head\s*>}i
+      return nil if at.nil?
+
+      line_start = text.rindex("\n", at - 1)
+      line_start = line_start.nil? ? 0 : line_start + 1
+      before = text[line_start...at]
+      if before.strip.empty?
+        "#{text[0...line_start]}#{before}  <%= #{TAG} %>\n#{text[line_start..]}"
+      else
+        "#{text[0...at]}<%= #{TAG} %>#{text[at..]}"
+      end
+    end
+
+    # Haml / Slim: `= devbench_script_tag` as the last child of the head
+    # element, at its children's indentation.
+    def insert_indented(text, head)
+      lines = text.lines
+      index = lines.index { |l| l =~ /\A([ \t]*)#{head}/ }
+      return nil if index.nil?
+
+      head_indent = lines[index][/\A[ \t]*/]
+      last = index
+      child_indent = nil
+      (index + 1...lines.length).each do |i|
+        line = lines[i]
+        next if line.strip.empty?
+
+        indent = line[/\A[ \t]*/]
+        break if indent.length <= head_indent.length
+
+        child_indent ||= indent
+        last = i
+      end
+      child_indent ||= "#{head_indent}  "
+      lines[last] = "#{lines[last]}\n" unless lines[last].end_with?("\n")
+      lines.insert(last + 1, "#{child_indent}= #{TAG}\n")
+      lines.join
+    end
+
+    # Adds each host to `var.directive`, or — when the directive is absent
+    # but default_src is set — adds the directive as default_src's sources
+    # plus the hosts, which is what the browser was falling back to. Leaves
+    # a policy that restricts neither alone.
+    def allow(text, var, directive, hosts, changes)
+      lines = text.lines
+      range = statement(lines, var, directive)
+      if range
+        hosts.each do |host|
+          stmt = lines[range].join
+          next if stmt.include?(host)
+
+          lines[range.last] = append_source(lines[range.last], host)
+          changes << "added #{host} to #{directive}"
+        end
+        return lines.join
+      end
+
+      # Neither: the policy does not restrict this kind of request at all.
+      default = statement(lines, var, 'default_src')
+      return text if default.nil?
+
+      first = lines[default.first]
+      indent = first[/\A[ \t]*/]
+      sources = lines[default].map { |l| strip_comment(l.chomp) }.join(' ')
+                              .sub(/\A[ \t]*#{var}\.default_src/, '').gsub(/\s+/, ' ').strip
+      new_line = "#{indent}#{var}.#{directive} #{[sources, *hosts.map { |h| source_code(h) }].reject(&:empty?).join(', ')}\n"
+      lines.insert(default.last + 1, new_line)
+      changes << "added #{directive} (default_src's sources + #{hosts.join(', ')})"
+      lines.join
+    end
+
+    # The line range of an uncommented `var.directive ...` statement,
+    # following continuation lines (a trailing comma or backslash).
+    def statement(lines, var, directive)
+      start = lines.index { |l| l =~ /\A[ \t]*#{Regexp.escape(var)}\.#{directive}\b/ }
+      return nil if start.nil?
+
+      last = start
+      last += 1 while last + 1 < lines.length && strip_comment(lines[last]).rstrip.end_with?(',', '\\')
+      start..last
+    end
+
+    def append_source(line, host)
+      body = line.chomp
+      newline = line.end_with?("\n") ? "\n" : ''
+      code = strip_comment(body).rstrip
+      comment = body[code.length..]
+      "#{code}, #{source_code(host)}#{comment}#{newline}"
+    end
+
+    # A trailing `# comment`, not counting '#' inside a string or #{}.
+    def strip_comment(line)
+      quote = nil
+      line.each_char.with_index do |ch, i|
+        if quote
+          quote = nil if ch == quote && line[i - 1] != '\\'
+        elsif ch == '"' || ch == "'"
+          quote = ch
+        elsif ch == '#' && line[i + 1] != '{'
+          return line[0...i]
+        end
+      end
+      line
+    end
+
+    # A host is written as a string literal; a runtime splat as code.
+    def source_code(source)
+      source.start_with?('*') ? source : source.inspect
+    end
+  end
+end

metadata

@@ -1,21 +1,23 @@
 --- !ruby/object:Gem::Specification
 name: devbench
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Dev Bench
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-10 00:00:00.000000000 Z
 dependencies: []
 description: |
   Reports unhandled exceptions, Rails.error reports, failed ActiveJob and
   Sidekiq jobs, and failures the application handled, with who was
   affected, to Dev Bench. Fingerprints and counts in-process and sends one
   small request a minute; detail is uploaded only when Dev Bench asks for
-  it, scrubbed first. Set DEVBENCH_DSN and it hooks itself into Rails.
+  it, scrubbed first. Keeps recent server log lines per user action for
+  triage, renders the browser sensor's tag, and hooks itself into Rails:
+  bundle add devbench, bin/rails generate devbench, set DEVBENCH_DSN.
 
   Adds no dependencies beyond the standard library, never alters a response
   body, and never raises: a diagnostics gem that can fail a request is worse
@@ -32,9 +34,11 @@ files:
 - lib/devbench/config.rb
 - lib/devbench/current.rb
 - lib/devbench/direct.rb
+- lib/devbench/egress_policy.rb
 - lib/devbench/fingerprint.rb
 - lib/devbench/http.rb
 - lib/devbench/identity.rb
+- lib/devbench/logs.rb
 - lib/devbench/middleware.rb
 - lib/devbench/rails_hooks.rb
 - lib/devbench/railtie.rb
@@ -47,6 +51,8 @@ files:
 - lib/devbench/trace.rb
 - lib/devbench/transport.rb
 - lib/devbench/version.rb
+- lib/devbench/view_helper.rb
+- lib/generators/devbench/devbench_generator.rb
 homepage: https://github.com/pasperry/devbench-sdk
 licenses:
 - LicenseRef-Proprietary