devbench 0.7.0 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd716a7741353f88f381775e58d7d613d7a5d50ff69287feb65f86f25c38e13d
-  data.tar.gz: '03358a6c9d097c8b4adc3daacc8c032699aba2a81814284caa0287254134f95c'
+  metadata.gz: ec8b8b2c35e830db27e1c4136ea53cc039274d5e12c7947a38918d0ae8084591
+  data.tar.gz: '09b1b3a42c848c2fe6391913bcb1ed91592a2c522523bff4a807658ee0e56151'
 SHA512:
-  metadata.gz: bdc43a37a987bcc745a17bc957d704bbf93835a6ef475c66e7228acb9c64edcad1ee2ab4acd9b68020f21435d16f6cf263e378db615cd49242e20407115e6d9a
-  data.tar.gz: b0c9a3d9884106853d587c2944cb8436bd333ed197fd4630ae17a713e4f959068e96faaf40ea54bfe1cc87f21532f6b482686dd6451ee39d022d9d683e6229d5
+  metadata.gz: a51bedbbd9b518641a9956170b023dc713395b5da72b722fcb2545019c2697d4883be45cbcafea2d38bfc3dcf975c86a2b5dc94ba717be85fdd957b4ea9ae965
+  data.tar.gz: 5421b8ee58441f9b2f57f8c573e66494cd0b4fefd0f64ae6e30efbef08fd5882d1e413b0fbf15388cde8657cb5dc548300130324c3cccc22b19be2455424b954

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 RedpointRack LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -50,7 +50,7 @@ gem (upgrading the gem upgrades the sensor), with **only the public part**
 of `DEVBENCH_DSN`:
 
 ```html
-<script src="https://unpkg.com/devbench@0.7.0/dist/devbench.min.js"
+<script src="https://unpkg.com/devbench@0.8.1/dist/devbench.min.js"
         data-dsn="https://<public>@adt-ingest.onrender.com" data-release="<release>" defer></script>
 ```
 
@@ -78,6 +78,7 @@ All optional except the DSN.
 | `DEVBENCH_SERVICE` | your app's module, underscored (`AcmeShop` → `acme_shop`); `app` outside Rails; **`<that>-sidekiq` in a Sidekiq process** | Groups this app's issues. Set it and it wins everywhere. |
 | `DEVBENCH_RELEASE` | the first found of: a `REVISION` file in `Rails.root` (Capistrano writes one), `HEROKU_SLUG_COMMIT`, `KAMAL_VERSION`, `GITHUB_SHA`, `GIT_SHA`, `SOURCE_VERSION`, `RENDER_GIT_COMMIT`; else empty | Which deploy an occurrence came from. `c.release` in code wins over all of these. |
 | `DEVBENCH_ENABLED` | on | `false` turns everything off: no middleware, no hooks, no tag, nothing sent. |
+| `DEVBENCH_WIDGET_SECRET` | — | The chat widget's secret (`dbws_…`, from the account page). Set, signed-in pages carry the signed identity the widget needs (below). Never reaches the page. |
 
 Or from code, e.g. `config/initializers/devbench.rb`:
 
@@ -123,6 +124,39 @@ frames with paths relative to `Rails.root`, the trace, and the user.
   reporting is dropped, and the application's own exception always comes
   out unchanged.
 
+## Failed and slow requests
+
+`Devbench::Middleware` also reports what a request does *without*
+raising. Nothing to set up, and no new API:
+
+| Signal | When | Reported as |
+|---|---|---|
+| **Failed** | the app answered 500–599 and no exception was reported during the request | `http_503 at PUT DealsController#update` |
+| **Slow** | the app answered 100–499 after **more than 3 seconds** (3,000 ms exactly is not slow) | `slow_request at GET DealsController#index` |
+| **429 spike** | one action answered at least ten 429s in one minute, and at least 10% of its requests | `http_429_spike at GET DealsController#index` |
+
+- **The exception wins.** A 500 page Rails rendered for an exception, or a
+  5xx after `Rails.error.report` / `Devbench.capture_exception`, is
+  reported once, as the exception. An exception you ignore
+  (`Devbench.ignore_exceptions`) does not come back as an `http_500`. A
+  slow request is slow whatever else happened in it.
+- **`report_handled` changes nothing here:** a 5xx after it is still
+  failed, and the `x-adt-handled` header is unchanged.
+- **Other 4xx are not reported.** A 404 or 422 is a status code, not a
+  problem; only a burst of 429s is.
+- The route is Rails' `Controller#action`, never the path (paths carry
+  ids). A request no route matched, and every request in a plain Rack
+  app, is `*`. The duration runs until the app hands back its response;
+  streaming the body after that does not count, and streaming responses
+  (`text/event-stream`, a websocket upgrade, a hijacked connection) are
+  never slow.
+- Failed and slow requests carry the trace and the user; a spike, which
+  is many requests, carries neither. Spikes are counted per process
+  (each Puma worker on its own) and reported when the minute is over, at
+  the next flush, or when the process exits.
+- The 3-second threshold is the same in every Dev Bench SDK and is not a
+  setting yet.
+
 ## What is sent, and when
 
 Like the browser sensor, the gem does not send one request per error:
@@ -153,7 +187,8 @@ Triage reads the server's log lines for the user action that failed. With
 
 - **What:** every line written to `Rails.logger` and `Sidekiq.logger`
   while a request or job carries a trace (`x-adt-trace` from the browser
-  sensor; a job inherits the trace of the request that enqueued it).
+  sensor; a job inherits the trace of the request that enqueued it — see
+  [Background jobs](#background-jobs)).
   Untraced lines are not kept. Rails 7.1+: a capturing logger joins
   `Rails.logger`'s broadcast (it follows the app's level and `silence`,
   and writes nothing); older Rails and `Sidekiq.logger`: a tee after the
@@ -190,6 +225,30 @@ end
 - The middleware clears it when the request ends (Sidekiq: when the job
   ends), so the next request on the same thread never inherits it.
 
+### Chat widget identity
+
+The chat widget (off by default) is shown only to signed-in users your
+server vouches for. With `DEVBENCH_WIDGET_SECRET` set, `devbench_script_tag`
+signs the user `set_user` recorded for the request into
+`data-widget-identity`, at render time. Nothing else to write. A signed-out
+page (no `set_user`) gets no attribute and no widget.
+
+Optionally, say what this user may do in the chat:
+
+```ruby
+Devbench.set_user(email: current_user.email, account: current_dealer.id,
+                  role: current_user.role,          # your role name; mapped in the widget settings
+                  chat: [:report, :howto, :handoff]) # overrides the mapping; [] = may not chat
+```
+
+Capabilities: `:report`, `:status`, `:howto`, `:feature_requests`,
+`:handoff`. `role` and `chat` go only into the signed token, never with
+sensor data. An identity that can't be signed exactly (a field over 255
+characters, a control character such as a line break, an unknown
+capability) gets no token rather than a truncated one, and one
+`[devbench]` warning. Pages carrying a token are
+per-user: don't serve them from a shared cache.
+
 ## Reporting what you caught
 
 An exception you rescued but want seen, like Sentry's `capture_exception`:
@@ -216,6 +275,25 @@ browser already knows whether the user was shown an error; this is the one
 fact it cannot know on its own. The header carries a count and nothing else,
 and it is added even when reporting is down.
 
+## Background jobs
+
+A job inherits the trace of the request that enqueued it, so its failure
+and its log lines join the user action that caused them:
+
+- **ActiveJob, on any adapter** — Solid Queue (Rails 8's default), GoodJob,
+  Sidekiq, Resque, Delayed Job, `:async`, `:inline` and the rest. The trace
+  rides in the job's own payload (`"adt_trace"`), so it survives the queue,
+  a process restart and `retry_on`. Nothing to add: the Railtie installs it.
+  ActiveJob without Rails: `Devbench::ActiveJobHooks.install(ActiveJob::Base)`.
+- **Native Sidekiq jobs** (`Sidekiq::Job`), below.
+
+The trace is the request's, unchanged; the job's identity is its own
+(`set_user` inside the job; it ends with the job, and a worker thread's
+previous job never lends it one). A job enqueued outside a request runs
+untraced, as does one enqueued by an earlier version of this gem. On Sidekiq, an
+ActiveJob job runs inside the Sidekiq middleware's scope — traced once, not
+twice — and `:inline` runs inside the request's.
+
 ## Sidekiq
 
 Under Rails there is nothing to add: the Railtie installs the hooks at boot
@@ -244,7 +322,8 @@ use Devbench::Middleware   # Rack
 ```
 
 Everything else (`set_user`, `capture_exception`, `report_handled`, the
-DSN) works the same.
+DSN, failed and slow requests) works the same. Plain Rack has no route
+pattern, so failed and slow requests are reported under the route `*`.
 
 ## Trace propagation
 

data/lib/devbench/active_job_hooks.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+require_relative 'trace'
+require_relative 'current'
+
+module Devbench
+  # Carries the request's trace into ActiveJob jobs on every adapter (Solid
+  # Queue, GoodJob, async, inline, Sidekiq, ...), so a job's failure and its
+  # log lines join the user action that enqueued it (docs/server-sdk/trace-propagation.md,
+  # Capability 1; README "Server log lines").
+  #
+  # The trace travels inside the job's own serialized payload, which every
+  # adapter stores and hands back verbatim to ActiveJob::Base.execute:
+  #
+  #   * serialize   — adds "adt_trace": the trace the job already carries (a
+  #                   job re-enqueued by retry_on keeps the request it came
+  #                   from), else the active one. Unchanged, as the Sidekiq
+  #                   client middleware carries it: a job is the same
+  #                   service, not a downstream hop.
+  #   * deserialize — reads it back. A payload from an older gem has no key:
+  #                   the job runs untraced.
+  #   * perform_now — a job that came through deserialize runs inside
+  #                   Current.with(its trace), outermost (before ActiveJob's
+  #                   logging and instrumentation), so the perform.active_job
+  #                   report and every line the job logs carry it; the
+  #                   thread's previous trace and identity come back after.
+  #                   Identity is scoped to the job, never inherited from the
+  #                   thread (a pool thread's last job is not this job's user).
+  #
+  # Not twice: a job that runs inside a scope already open on its thread —
+  # Sidekiq's server middleware (which scoped the trace from the outer job
+  # hash), or the request whose inline adapter runs it — belongs to that
+  # scope and opens no second one, unless it carries a different trace. A
+  # job built and run with perform_now (never serialized) is left alone: it
+  # runs in its caller's context.
+  #
+  # Plain Ruby: no ActiveJob constant is named at load time. The Railtie
+  # installs it with ActiveSupport.on_load(:active_job); ActiveJob without
+  # Rails calls Devbench::ActiveJobHooks.install(ActiveJob::Base). Every
+  # override is guarded: the job's own behaviour and its own exception are
+  # what come out, whatever happens in here.
+  module ActiveJobHooks
+    # The payload key, the same one Sidekiq jobs carry. ActiveJob ignores
+    # keys it does not know, so payloads stay readable by apps without the gem.
+    TRACE_KEY = 'adt_trace'
+
+    # Prepended to ActiveJob::Base.
+    module Job
+      def serialize
+        payload = super
+        ActiveJobHooks.tag(self, payload)
+        payload
+      end
+
+      def deserialize(job_data)
+        super
+        ActiveJobHooks.read(self, job_data)
+      end
+
+      def perform_now
+        trace = ActiveJobHooks.scope_for(self)
+        return super if trace == :none
+
+        Current.with(trace) { super }
+      end
+    end
+
+    class << self
+      # Prepends the hooks to ActiveJob::Base (or any class with its
+      # serialize/deserialize/perform_now). Safe to call more than once.
+      # Returns true when installed.
+      def install(base)
+        return false unless base.is_a?(Class) && base.method_defined?(:serialize)
+
+        base.prepend(Job) unless base <= Job
+        true
+      rescue StandardError, SystemStackError
+        false
+      end
+
+      # Adds the trace to a payload being built by serialize, and remembers
+      # it on the job so a later serialize (a retry) carries the same one.
+      def tag(job, payload)
+        return nil unless payload.is_a?(Hash)
+
+        trace = job.instance_variable_get(:@devbench_trace)
+        trace ||= Current.trace&.to_s
+        return nil if trace.nil?
+
+        job.instance_variable_set(:@devbench_trace, trace)
+        payload[TRACE_KEY] = trace
+        nil
+      rescue StandardError, SystemStackError
+        nil
+      end
+
+      def read(job, job_data)
+        trace = job_data.is_a?(Hash) ? Trace.parse(job_data[TRACE_KEY]) : nil
+        job.instance_variable_set(:@devbench_trace, trace&.to_s)
+        job.instance_variable_set(:@devbench_deserialized, true)
+        nil
+      rescue StandardError, SystemStackError
+        nil
+      end
+
+      # The trace perform_now runs the job under, or :none to leave the
+      # thread's context as it is.
+      def scope_for(job)
+        return :none unless job.instance_variable_get(:@devbench_deserialized)
+
+        trace = Trace.parse(job.instance_variable_get(:@devbench_trace))
+        return trace unless Current.scoped?
+        return :none if trace.nil? || Current.trace&.to_s == trace.to_s
+
+        trace
+      rescue StandardError, SystemStackError
+        :none
+      end
+    end
+  end
+end

data/lib/devbench/config.rb

@@ -3,7 +3,7 @@
 require 'uri'
 
 module Devbench
-  # Where reports go, parsed from DEVBENCH_DSN (docs/SERVER_SDK_SPEC.md, "Dev
+  # Where reports go, parsed from DEVBENCH_DSN (docs/server-sdk/configuration.md, "Dev
   # Bench naming and configuration"; DECISIONS #161):
   #
   #   https://<public>:<secret>@<host>[:port]    from `adt dsn create`
@@ -130,11 +130,16 @@ module Devbench
     # Seconds between background flushes in direct mode (spec: 60).
     attr_accessor :flush_interval
     attr_writer :enabled
+    # The tenant's chat widget secret (dbws_…, DEVBENCH_WIDGET_SECRET), or
+    # nil. Signs the widget identity on the browser tag; never leaves the
+    # server.
+    attr_accessor :widget_secret
 
     def initialize(env = ENV)
       @dsn = presence(env['DEVBENCH_DSN']) || presence(env['ADT_DSN'])
       @service = presence(env['DEVBENCH_SERVICE'])
       @release = presence(env['DEVBENCH_RELEASE'])
+      @widget_secret = presence(env['DEVBENCH_WIDGET_SECRET'])
       @release_env = RELEASE_FALLBACKS.lazy.map { |name| presence(env[name]) }.find(&:itself)
       @enabled = !OFF.include?(env['DEVBENCH_ENABLED'].to_s.strip.downcase)
       @flush_interval = 60

data/lib/devbench/current.rb

@@ -10,6 +10,9 @@ module Devbench
     KEY = :__adt_trace
     HANDLED_KEY = :__adt_handled
     USER_KEY = :__adt_user
+    WIDGET_USER_KEY = :__adt_widget_user
+    SCOPE_KEY = :__adt_scope
+    EXCEPTION_KEY = :__adt_exception_reported
 
     # Counts failures handled during this request.
     #
@@ -24,6 +27,18 @@ module Devbench
       Thread.current[HANDLED_KEY] = handled_count + 1
     end
 
+    # Whether an `exception` was reported during this scope (any context:
+    # request, rails_error, job, explicit). A 5xx after one is not also a
+    # `failed` request: the exception is the report (Capability 2b). A
+    # handled failure (report_handled) does not set it.
+    def self.exception_reported?
+      Thread.current[EXCEPTION_KEY] == true
+    end
+
+    def self.record_exception
+      Thread.current[EXCEPTION_KEY] = true
+    end
+
     # Who this request is for, as set by Devbench.set_user: a frozen hash with
     # :email and/or :account, or nil. Normalised before it gets here.
     def self.user
@@ -34,6 +49,17 @@ module Devbench
       Thread.current[USER_KEY] = value
     end
 
+    # The raw identity, role and chat permission Devbench.set_user was given,
+    # for the chat widget's signed token (Devbench::WidgetIdentity); nil when
+    # no user is set. Never sent with sensor data.
+    def self.widget_user
+      Thread.current[WIDGET_USER_KEY]
+    end
+
+    def self.widget_user=(value)
+      Thread.current[WIDGET_USER_KEY] = value
+    end
+
     def self.trace
       Thread.current[KEY]
     end
@@ -42,6 +68,14 @@ module Devbench
       Thread.current[KEY] = value
     end
 
+    # True while a scope (Current.with: a request in the middleware, a
+    # Sidekiq job, an ActiveJob job) is open on this thread, traced or not.
+    # An ActiveJob job run inside one (the inline adapter in a request,
+    # ActiveJob on Sidekiq) belongs to it and opens no second scope.
+    def self.scoped?
+      Thread.current[SCOPE_KEY] == true
+    end
+
     # Runs the block with trace active, restoring whatever was there before.
     #
     # Restores rather than clearing, because servers reuse threads: clearing
@@ -50,7 +84,11 @@ module Devbench
       previous = Thread.current[KEY]
       previous_handled = Thread.current[HANDLED_KEY]
       previous_user = Thread.current[USER_KEY]
+      previous_widget_user = Thread.current[WIDGET_USER_KEY]
+      previous_scope = Thread.current[SCOPE_KEY]
+      previous_exception = Thread.current[EXCEPTION_KEY]
       Thread.current[KEY] = trace
+      Thread.current[SCOPE_KEY] = true
       # Reset rather than inherit: servers reuse threads, and carrying a count
       # across requests would mark an innocent response as having swallowed
       # the previous request's failure.
@@ -58,17 +96,28 @@ module Devbench
       # Same for identity, and more so: inheriting it would attribute one
       # user's failure to whoever this thread served before.
       Thread.current[USER_KEY] = nil
+      Thread.current[WIDGET_USER_KEY] = nil
+      Thread.current[EXCEPTION_KEY] = nil
       yield
     ensure
+      # An exception reported in a nested scope (a second middleware, a job
+      # run inside the request) was reported during the enclosing one too.
+      nested_exception = previous_scope == true && Thread.current[EXCEPTION_KEY] == true
+      Thread.current[EXCEPTION_KEY] = nested_exception ? true : previous_exception
       Thread.current[KEY] = previous
       Thread.current[HANDLED_KEY] = previous_handled
       Thread.current[USER_KEY] = previous_user
+      Thread.current[WIDGET_USER_KEY] = previous_widget_user
+      Thread.current[SCOPE_KEY] = previous_scope
     end
 
     def self.clear
       Thread.current[KEY] = nil
       Thread.current[HANDLED_KEY] = nil
       Thread.current[USER_KEY] = nil
+      Thread.current[WIDGET_USER_KEY] = nil
+      Thread.current[SCOPE_KEY] = nil
+      Thread.current[EXCEPTION_KEY] = nil
     end
   end
 end

data/lib/devbench/direct.rb

@@ -8,9 +8,10 @@ require_relative 'fingerprint'
 require_relative 'scrub'
 require_relative 'egress_policy'
 require_relative 'logs'
+require_relative 'request_signals'
 
 module Devbench
-  # Direct mode (docs/SERVER_SDK_SPEC.md, "Direct mode"): fingerprint and
+  # Direct mode (docs/server-sdk/transports.md, "Direct mode"): fingerprint and
   # count in-process, flush counts to ingest once a minute, upload one
   # redacted evidence bundle per fingerprint only when ingest asks, and
   # answer ingest's requests for the log lines of a trace (need_logs) from
@@ -125,13 +126,12 @@ module Devbench
       @lock.synchronize { @window.transform_values { |c| c.n } }
     end
 
-    # rake devbench:test. Sends one synthetic exception straight to ingest
-    # (not via the background thread), uploads its evidence if asked, and
-    # prints what happened. Returns true when ingest accepted it.
-    # The self-test (Devbench.test!): asks ingest whether this DSN's key is
-    # valid, and for which tenant and environment. Creates nothing — it used
-    # to send a synthetic exception, which became a real issue on a new
-    # customer's punch list.
+    # The self-test behind `rake devbench:test` (Devbench.test!): POSTs
+    # /v1/check straight to ingest (not via the background thread) to ask
+    # whether this DSN's key is valid, and for which tenant and environment,
+    # and prints the answer. Returns true when ingest accepted the key.
+    # Creates nothing — it used to send a synthetic exception, which became a
+    # real issue on a new customer's punch list.
     def self_test(io)
       io.puts "Dev Bench: checking the DSN against #{@dsn} (service #{@service.inspect})"
       response, error = attempt(:post, @check_uri, '{}', flush_headers, HTTP_TIMEOUT)
@@ -176,9 +176,26 @@ module Devbench
       case payload[:kind]
       when 'exception' then exception_signal(payload)
       when 'handled_failure' then handled_signal(payload)
+      when 'request' then request_signal(payload)
       end
     end
 
+    # recordRequest (internal/reqsignal): {error|degradation, server,
+    # service, http_<status>|slow_request|http_429_spike, "<METHOD> <route>"},
+    # no frames. A signal/status pair the sidecar would drop is dropped.
+    def request_signal(payload)
+      built = RequestSignals.build(signal: payload[:signal], method: payload[:method], route: payload[:route],
+                                   status: payload[:status], duration_ms: payload[:duration_ms],
+                                   count: payload[:count], total: payload[:total])
+      return nil if built.nil?
+
+      fp = Fingerprint.compute(kind: built.kind, source: 'server', service: @service,
+                               type: built.type, message: built.message)
+      return nil if fp.nil?
+
+      Signal.new(fp, built.kind, built.text, user(payload[:user]), [], built.exemplar)
+    end
+
     # recordException: {error, server, service, type, message[0,2000], frames}.
     def exception_signal(payload)
       type = payload[:error].to_s
@@ -338,6 +355,9 @@ module Devbench
     # (a rule arriving with a request for the shape it governs applies to
     # that request), then log slices, then evidence.
     def flush_cycle(deadline)
+      # A 429 spike window the clock has left closes at a flush: counted
+      # here, so it goes out with this one.
+      RequestSignals.tick!(self)
       counts, overflowed = @lock.synchronize do
         taken = [@window, @overflowed]
         @window = {}
@@ -406,9 +426,14 @@ module Devbench
       out
     end
 
+    # Which SDK sent a flush, on every request of it (#308): counts, each
+    # request of a split window and the empty poll are all built here.
+    SDK_FIELD = { name: SDK_NAME, version: VERSION }.freeze
+    private_constant :SDK_FIELD
+
     def envelope(counts, overflowed)
-      body = { v: 1, tenant: '', source: 'server', service: @service, release: @release,
-               sensor_id: @sensor_id, counts: counts }
+      body = { v: PROTOCOL_VERSION, tenant: '', source: 'server', service: @service, release: @release,
+               sensor_id: @sensor_id, sdk: SDK_FIELD, counts: counts }
       body[:overflowed] = overflowed if overflowed.positive?
       JSON.generate(body)
     end
@@ -543,7 +568,7 @@ module Devbench
       return nil if detail.nil?
 
       bundle = {
-        v: 1, fp: fp, kind: detail.kind,
+        v: PROTOCOL_VERSION, fp: fp, kind: detail.kind,
         template: Scrub.template_text(detail.text, @policy, fp), service: @service,
         exemplars: detail.exemplar.empty? ? [] : [Scrub.egress(detail.exemplar, @policy, @service)]
       }

data/lib/devbench/fingerprint.rb

@@ -39,7 +39,9 @@ module Devbench
       [go_re('\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b', Regexp::IGNORECASE), '<uuid>'],
       [go_re('\b\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?'), '<ts>'],
       [go_re('\b\d{4}-\d{2}-\d{2}\b'), '<date>'],
-      [go_re('\b[^\t\n\f\r <>@]+@[^\t\n\f\r <>@]+\.[A-Za-z]{2,}\b'), '<email>'],
+      # The local part stops at `=` and `:` (#148): `customer=sam@x.com`
+      # templates to `customer=<email>`. Same class as Scrub's email rule.
+      [go_re('\b[^\t\n\f\r <>@=:]+@[^\t\n\f\r <>@]+\.[A-Za-z]{2,}\b'), '<email>'],
       [go_re("\\b[a-z][a-z0-9+.-]*://#{GO_NOT_WS}+"), '<url>'],
       [go_re('\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b'), '<ip>'],
       [go_re('\b(?:0x)?[0-9a-fA-F]{8,}\b'), '<hex>'],
@@ -55,9 +57,18 @@ module Devbench
 
     DEPENDENCY_FRAGMENTS = [
       '/node_modules/', '/vendor/', '/gems/', '/ruby/gems/', '/usr/local/go/src/',
-      '/go/pkg/mod/', '/.bundle/', '<anonymous>'
+      '/go/pkg/mod/', '/.bundle/', '<anonymous>',
+      # Python (#235): pip packages (site-packages, Debian's dist-packages)
+      # and the standard library (lib/python3.X, RHEL's lib64/python3.X);
+      # frozen stdlib modules report a file like "<frozen runpy>".
+      '/site-packages/', '/dist-packages/', '/lib/python3.', '/lib64/python3.', '<frozen '
     ].freeze
 
+    # .NET framework frames (#235) ship without PDBs: no file, only a
+    # namespace-qualified function. A prefix of the trimmed function, so
+    # `Shop.System.Clock.Now` stays in-app.
+    DEPENDENCY_FUNCTION_PREFIXES = ['System.', 'Microsoft.'].freeze
+
     ASSET_DIGEST = /\A(.+)[-.]([A-Za-z0-9_]{8,})((?:\.chunk|\.bundle)?\.(?:js|mjs|cjs|css)(?:\.map)?)\z/
 
     class << self
@@ -145,7 +156,10 @@ module Devbench
 
       def dependency?(file, function)
         hay = "#{file} #{function}"
-        DEPENDENCY_FRAGMENTS.any? { |frag| hay.include?(frag) }
+        return true if DEPENDENCY_FRAGMENTS.any? { |frag| hay.include?(frag) }
+
+        fn = trim(function)
+        DEPENDENCY_FUNCTION_PREFIXES.any? { |prefix| fn.start_with?(prefix) }
       end
 
       def strip_asset_digest(name)

data/lib/devbench/identity.rb

@@ -3,7 +3,7 @@
 require_relative 'current'
 
 module Devbench
-  # Who was affected (docs/SERVER_SDK_SPEC.md, Capability 5).
+  # Who was affected (docs/server-sdk/identity.md, Capability 5).
   #
   # Identity travels in its own field of every control message and nowhere
   # else: never in a message, a symbol or a log line, so it can never move a
@@ -44,8 +44,22 @@ module Devbench
   #
   # Each field is optional. Calling again replaces the whole identity, and
   # calling with neither clears it. Never raises.
-  def self.set_user(email: nil, account: nil)
-    Current.user = Identity.normalize(email, account)
+  #
+  # role: and chat: are for the chat widget only (docs/server-sdk/chat-widget.md,
+  # Capability 6): devbench_script_tag signs them, with the email and
+  # account, into the widget's identity token when DEVBENCH_WIDGET_SECRET is
+  # set. They are never sent with sensor data. role is the app's own role
+  # name for the user (mapped to chat capabilities in the tenant's settings);
+  # chat, when given, overrides that mapping: a list of capabilities
+  # (:report, :status, :howto, :feature_requests, :handoff), [] for "may not
+  # chat", nil (the default) for "not stated".
+  def self.set_user(email: nil, account: nil, role: nil, chat: nil)
+    user = Identity.normalize(email, account)
+    Current.user = user
+    # The raw values, not the sensor identity's truncated ones: the widget
+    # signer refuses what it cannot sign exactly instead of signing a
+    # different person.
+    Current.widget_user = user && { email: email, account: account, role: role, chat: chat.is_a?(Array) ? chat.dup.freeze : chat }.freeze
     nil
   rescue StandardError, SystemStackError
     nil

data/lib/devbench/logs.rb

@@ -4,7 +4,7 @@ require 'logger'
 require_relative 'current'
 
 module Devbench
-  # In-process log capture (docs/SERVER_SDK_SPEC.md, "In-process log capture
+  # In-process log capture (docs/server-sdk/configuration.md, "In-process log capture
   # (direct mode)"; DECISIONS #161): recent log lines kept in memory, keyed
   # by the trace that was current when each was written, so triage can be
   # handed the server lines of one user action without a sidecar.