devbench 0.8.0 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 733817dd1561a76917c0426c041129aa4fefe9200c21ffb462bdaf60c6db801c
-  data.tar.gz: 9f17ddc4d783f8c666737406df6ddc5c79ff776b299af8b25f2e6d31b43baa9d
+  metadata.gz: ec8b8b2c35e830db27e1c4136ea53cc039274d5e12c7947a38918d0ae8084591
+  data.tar.gz: '09b1b3a42c848c2fe6391913bcb1ed91592a2c522523bff4a807658ee0e56151'
 SHA512:
-  metadata.gz: 82993e99341857d99a11475d9805b1ba7d9dda794e5415a8b27ed121c8eb2f4c8a0ca63df58dcb89b1824a094a8d8f84cd43a1bae7e1d8aaa019e91a44827fda
-  data.tar.gz: 44038eba715ea44b2423beb8d0c763f7c20430daf272d5e82be7b5e6af1993fbc655160a4d854520d91a27c3e0da6d0185103a5b71fac2092b226cfd9886a839
+  metadata.gz: a51bedbbd9b518641a9956170b023dc713395b5da72b722fcb2545019c2697d4883be45cbcafea2d38bfc3dcf975c86a2b5dc94ba717be85fdd957b4ea9ae965
+  data.tar.gz: 5421b8ee58441f9b2f57f8c573e66494cd0b4fefd0f64ae6e30efbef08fd5882d1e413b0fbf15388cde8657cb5dc548300130324c3cccc22b19be2455424b954

data/README.md

@@ -50,7 +50,7 @@ gem (upgrading the gem upgrades the sensor), with **only the public part**
 of `DEVBENCH_DSN`:
 
 ```html
-<script src="https://unpkg.com/devbench@0.8.0/dist/devbench.min.js"
+<script src="https://unpkg.com/devbench@0.8.1/dist/devbench.min.js"
         data-dsn="https://<public>@adt-ingest.onrender.com" data-release="<release>" defer></script>
 ```
 

data/lib/devbench/direct.rb

@@ -126,13 +126,12 @@ module Devbench
       @lock.synchronize { @window.transform_values { |c| c.n } }
     end
 
-    # rake devbench:test. Sends one synthetic exception straight to ingest
-    # (not via the background thread), uploads its evidence if asked, and
-    # prints what happened. Returns true when ingest accepted it.
-    # The self-test (Devbench.test!): asks ingest whether this DSN's key is
-    # valid, and for which tenant and environment. Creates nothing — it used
-    # to send a synthetic exception, which became a real issue on a new
-    # customer's punch list.
+    # The self-test behind `rake devbench:test` (Devbench.test!): POSTs
+    # /v1/check straight to ingest (not via the background thread) to ask
+    # whether this DSN's key is valid, and for which tenant and environment,
+    # and prints the answer. Returns true when ingest accepted the key.
+    # Creates nothing — it used to send a synthetic exception, which became a
+    # real issue on a new customer's punch list.
     def self_test(io)
       io.puts "Dev Bench: checking the DSN against #{@dsn} (service #{@service.inspect})"
       response, error = attempt(:post, @check_uri, '{}', flush_headers, HTTP_TIMEOUT)

data/lib/devbench/fingerprint.rb

@@ -39,7 +39,9 @@ module Devbench
       [go_re('\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b', Regexp::IGNORECASE), '<uuid>'],
       [go_re('\b\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?'), '<ts>'],
       [go_re('\b\d{4}-\d{2}-\d{2}\b'), '<date>'],
-      [go_re('\b[^\t\n\f\r <>@]+@[^\t\n\f\r <>@]+\.[A-Za-z]{2,}\b'), '<email>'],
+      # The local part stops at `=` and `:` (#148): `customer=sam@x.com`
+      # templates to `customer=<email>`. Same class as Scrub's email rule.
+      [go_re('\b[^\t\n\f\r <>@=:]+@[^\t\n\f\r <>@]+\.[A-Za-z]{2,}\b'), '<email>'],
       [go_re("\\b[a-z][a-z0-9+.-]*://#{GO_NOT_WS}+"), '<url>'],
       [go_re('\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b'), '<ip>'],
       [go_re('\b(?:0x)?[0-9a-fA-F]{8,}\b'), '<hex>'],
@@ -55,9 +57,18 @@ module Devbench
 
     DEPENDENCY_FRAGMENTS = [
       '/node_modules/', '/vendor/', '/gems/', '/ruby/gems/', '/usr/local/go/src/',
-      '/go/pkg/mod/', '/.bundle/', '<anonymous>'
+      '/go/pkg/mod/', '/.bundle/', '<anonymous>',
+      # Python (#235): pip packages (site-packages, Debian's dist-packages)
+      # and the standard library (lib/python3.X, RHEL's lib64/python3.X);
+      # frozen stdlib modules report a file like "<frozen runpy>".
+      '/site-packages/', '/dist-packages/', '/lib/python3.', '/lib64/python3.', '<frozen '
     ].freeze
 
+    # .NET framework frames (#235) ship without PDBs: no file, only a
+    # namespace-qualified function. A prefix of the trimmed function, so
+    # `Shop.System.Clock.Now` stays in-app.
+    DEPENDENCY_FUNCTION_PREFIXES = ['System.', 'Microsoft.'].freeze
+
     ASSET_DIGEST = /\A(.+)[-.]([A-Za-z0-9_]{8,})((?:\.chunk|\.bundle)?\.(?:js|mjs|cjs|css)(?:\.map)?)\z/
 
     class << self
@@ -145,7 +156,10 @@ module Devbench
 
       def dependency?(file, function)
         hay = "#{file} #{function}"
-        DEPENDENCY_FRAGMENTS.any? { |frag| hay.include?(frag) }
+        return true if DEPENDENCY_FRAGMENTS.any? { |frag| hay.include?(frag) }
+
+        fn = trim(function)
+        DEPENDENCY_FUNCTION_PREFIXES.any? { |prefix| fn.start_with?(prefix) }
       end
 
       def strip_asset_digest(name)

data/lib/devbench/reporter.rb

@@ -148,9 +148,9 @@ module Devbench
         false
       end
 
-      # The `exception` report for an error, without sending it. Used by
-      # the self-test (Devbench.test!), which sends one synthetic report
-      # straight to ingest, built exactly as a real one would be.
+      # The `exception` report for an error, built exactly as a real one
+      # would be, without sending it. (The self-test no longer uses it: it
+      # POSTs /v1/check and sends no report.)
       def report_for(error, context:, handled:, symbol: nil)
         exception_payload(error, context, handled, symbol)
       end

data/lib/devbench/scrub.rb

@@ -58,7 +58,9 @@ module Devbench
       [go_re('\b(password|passwd|pwd|secret|api[_\-]?key|access[_\-]?token|refresh[_\-]?token|' \
              'client[_\-]?secret|private[_\-]?key|session[_\-]?id|csrf[_\-]?token)' \
              "(#{WS}*[:=]#{WS}*)(\"[^\"]*\"|'[^']*'|#{NOT_WS}+)", Regexp::IGNORECASE), '\1\2<redacted:secret>'],
-      [go_re('\b[^\t\n\f\r <>@]+@[^\t\n\f\r <>@]+\.[A-Za-z]{2,}\b'), '<redacted:email>'],
+      # The local part stops at `=` and `:` (#148): `customer=sam@x.com`
+      # keeps its key. Same class as the template's email rule.
+      [go_re('\b[^\t\n\f\r <>@=:]+@[^\t\n\f\r <>@]+\.[A-Za-z]{2,}\b'), '<redacted:email>'],
       [go_re('\b\d{3}-\d{2}-\d{4}\b'), '<redacted:ssn>'],
       # The card and phone rules (#186) judge each candidate in the block.
       [CARD_CANDIDATE, ->(m) { card?(m[0]) ? CARD : m[0] }],

data/lib/devbench/session.rb

@@ -14,9 +14,9 @@ module Devbench
   # This must agree byte for byte with the Go SDK, because a token minted by a
   # Rails app is verified by ingest, which uses the Go SDK's VerifySession.
   # Divergence produces a request that succeeds locally and is rejected in
-  # production, with nothing to say why. There are no shared testdata/ vectors
-  # for session tokens yet: test/session_test.rb pins known-answer tokens the Go
-  # SDK minted, and sdk/server/go/session_kat_test.go pins the same table.
+  # production, with nothing to say why. Both SDKs are held to the shared
+  # vectors in testdata/session_vectors.json (#181, #563): test/session_test.rb
+  # here, sdk/server/go/session_kat_test.go there.
   module Session
     HEADER = 'x-adt-session'
     META_NAME = 'adt-session'
@@ -63,7 +63,9 @@ module Devbench
       raise Invalid if secret.nil? || secret.strip.empty?
       raise Invalid unless token.is_a?(String)
 
-      parts = token.strip.split('.')
+      # -1 keeps trailing empty fields, as Go's strings.Split does: without
+      # it "adts1.<payload>.<sig>." is three parts here and four in ingest.
+      parts = token.strip.split('.', -1)
       raise Invalid unless parts.length == 3 && parts[0] == PREFIX
 
       # Constant time: a signature check that leaks timing can be brute-forced
@@ -111,10 +113,16 @@ module Devbench
       Base64.urlsafe_encode64(bytes, padding: false)
     end
 
+    # Decodes as Go's base64.RawURLEncoding does, and refuses what it refuses:
+    # padding (=), the standard alphabet's + and /, whitespace, and a length
+    # that leaves one character over. (Base64.urlsafe_decode64 accepts the
+    # first two, so a padded payload verified here but not in ingest, #563.)
+    # Like Go, non-zero bits left over in the last character are ignored.
     def self.unb64(text)
-      Base64.urlsafe_decode64(text)
-    rescue ArgumentError
-      nil
+      return nil unless text.match?(/\A[A-Za-z0-9_-]*\z/) && text.length % 4 != 1
+
+      std = text.tr('-_', '+/')
+      (std + ('=' * ((4 - (std.length % 4)) % 4))).unpack1('m')
     end
   end
 end

data/lib/devbench/transport.rb

@@ -133,10 +133,10 @@ module Devbench
       false
     end
 
-    # Sends one synthetic exception straight to Dev Bench and prints the
-    # result, so an operator can check the DSN without waiting for a flush
-    # (`rake devbench:test` under Rails). Returns true when ingest accepted
-    # it. Never raises.
+    # Asks ingest whether the DSN's key is valid (`POST /v1/check`) and prints
+    # the answer, so an operator can check the DSN without waiting for a
+    # flush (`rake devbench:test` under Rails). Creates nothing: no event,
+    # no issue. Returns true when ingest accepted the key. Never raises.
     def test!(io: $stdout)
       cfg = config
       unless cfg.enabled?

data/lib/devbench/version.rb

@@ -4,7 +4,7 @@ module Devbench
   # The gem's release version. Each SDK has its own version and release tag;
   # the Ruby release (tag ruby-vX.Y.Z in the public repo) checks this equals
   # the tag. The wire format is PROTOCOL_VERSION below.
-  VERSION = '0.8.0'
+  VERSION = '0.8.1'
 
   # This SDK's name in every flush's `sdk` field: the key
   # testdata/protocol_vectors.json `sdk.names` gives sdk/server/ruby

data/lib/devbench/view_helper.rb

@@ -12,7 +12,7 @@ module Devbench
   #
   # renders
   #
-  #   <script src="https://unpkg.com/devbench@0.8.0/dist/devbench.min.js"
+  #   <script src="https://unpkg.com/devbench@0.8.1/dist/devbench.min.js"
   #           data-dsn="https://<public>@<host>" data-release="<release>" defer></script>
   #
   # The DSN is the public part of DEVBENCH_DSN only (Devbench.browser_dsn),

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devbench
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.8.1
 platform: ruby
 authors:
 - Dev Bench
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-13 00:00:00.000000000 Z
+date: 2026-10-15 00:00:00.000000000 Z
 dependencies: []
 description: |
   Reports unhandled exceptions, Rails.error reports, failed ActiveJob and