rails-informant 0.6.1 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 69a62b35d2fcbee6378fff16208c4f1091f87c44ffd41baa638f59a42d4caefd
-  data.tar.gz: 97ecbe4eb82e39be5b42c42b6bb50d257d157eb507201bde373bca8e477222d2
+  metadata.gz: 85905d22093388e09e56afd089dcd870c3d33d066c51c8d0b4bb27beb1567a00
+  data.tar.gz: d2053f3a5655d02bf059d4876d268985017b675d49a7284aba7fb8f1f23aa2fa
 SHA512:
-  metadata.gz: fe94a07f7029f360b1517c2ce8f3b0b2a27872ce08ba5d6a5c9a631030e53865ad58fd1a289b67d61db66ad650c22c21b5863b8628103c568c92a5f5a0730a4e
-  data.tar.gz: f5356e08df971271b046a8f5a7387a3219b53fe64b3090ab63a9a89f3f1c7b1c2246f5dcd1b62ff107a25c3ca4b47fbf09a3feb4c4964e56b25a9994f17af0d4
+  metadata.gz: f961c33f024b36c00bd48f9c5356c311a81a08ebd6c1131f2e7a2a9f25d7810b29eae1d305530a95c87e131cdeb428c42f859f0170d88041274dc9443b9be41f
+  data.tar.gz: e3cba73cd5fde5af8368888a20668175f7ef8d47bca2755eab2837ceefaca1ec198c57e6ff06107dad7045e119ea00c0c42943d48773b110344dd8168635313e

data/README.md

@@ -14,6 +14,7 @@
     <a href="#quick-start">Quick Start</a>
     &#9670; <a href="#configuration">Configuration</a>
     &#9670; <a href="#noise-suppression">Noise Suppression</a>
+    &#9670; <a href="#browser-errors">Browser Errors</a>
     &#9670; <a href="#mcp-server">MCP Server</a>
     &#9670; <a href="#data-and-privacy">Data and Privacy</a>
   </p>
@@ -65,6 +66,13 @@ bin/rails generate rails_informant:skill
 
 With [Rails Hyperdrive](https://github.com/rails-hyperdrive/rails-hyperdrive), the `/informant` skill arrives through `bin/rails hyperdrive:sync` instead, and the generator installs the rest (see [With Rails Hyperdrive](#with-rails-hyperdrive)).
 
+Optionally, capture JavaScript errors from your pages too (see [Browser Errors](#browser-errors)):
+
+```sh
+bin/rails generate rails_informant:browser
+bin/rails db:migrate
+```
+
 Errors are captured automatically. To capture manually:
 
 ```ruby
@@ -88,12 +96,14 @@ Every option can be set via an environment variable. The initializer takes prece
 | Option | Env var | Default | Description |
 |--------|---------|---------|-------------|
 | `api_token` | `INFORMANT_API_TOKEN` | `nil` | Authentication token for API/MCP access |
+| `browser_new_group_limit` | `INFORMANT_BROWSER_NEW_GROUP_LIMIT` | `50` | Most new browser error groups created per hour; reports that would start another are dropped |
+| `capture_browser_errors` | `INFORMANT_CAPTURE_BROWSER_ERRORS` | `false` | Accept JavaScript error reports from your pages |
 | `capture_errors` | `INFORMANT_CAPTURE_ERRORS` | `true` | Enable/disable error capture |
 | `capture_runner_errors` | `INFORMANT_CAPTURE_RUNNER_ERRORS` | `true` | Capture errors raised under `rails runner` |
 | `capture_user_email` | _(none)_ | `false` | Capture email from detected user (PII -- opt-in) |
 | `ignored_exceptions` | `INFORMANT_IGNORED_EXCEPTIONS` | `[]` | Exception classes to skip (walks cause chain) |
 | `ignored_paths` | `INFORMANT_IGNORED_PATHS` | `[]` | Request paths to skip (exact or segment match) |
-| `job_attempt_threshold` | `INFORMANT_JOB_ATTEMPT_THRESHOLD` | `nil` | Suppress job errors until Nth retry |
+| `job_attempt_threshold` | `INFORMANT_JOB_ATTEMPT_THRESHOLD` | `nil` | Suppress job failures until the Nth attempt (handled reports are always recorded) |
 | `retention_days` | `INFORMANT_RETENTION_DAYS` | `nil` | Auto-purge resolved errors after N days |
 | `slack_webhook_url` | `INFORMANT_SLACK_WEBHOOK_URL` | `nil` | Slack incoming webhook URL |
 | `spike_protection` | _(none)_ | `nil` | Rate-limit per error group: `{ threshold: 50, window: 1.minute }` |
@@ -164,7 +174,7 @@ config.before_record do |event|
 end
 ```
 
-The `event` exposes: `error`, `error_class`, `message`, `severity`, `controller_action`, `job_class`, `request_path`, `fingerprint`. Callbacks that raise are logged and skipped.
+The `event` exposes: `error`, `error_class`, `message`, `severity`, `controller_action`, `job_class`, `request_path`, `source` (`"server"` or `"browser"`), `fingerprint`. Callbacks that raise are logged and skipped.
 
 ### Custom Exception Context
 
@@ -191,6 +201,73 @@ curl -X POST https://myapp.com/informant/api/v1/deploy \
 
 Resolved errors automatically reopen on regression. Also available as the `notify_deploy` MCP tool.
 
+## Browser Errors
+
+Informant can also record JavaScript errors from your pages, so the agent triages them with the same tools and lifecycle as server errors. It is off by default.
+
+### What is captured
+
+- Uncaught errors and unhandled promise rejections, including errors thrown in Stimulus controllers
+- Turbo failures that point to an app defect, such as a frame response missing its matching frame. Network failures (offline, aborted requests) are not reported.
+
+Identical errors are reported once per short window, and each page view has a report budget that resets on every Turbo visit. Cross-origin `Script error.`, the ResizeObserver loop warning, and errors raised by browser extensions or third-party scripts are dropped.
+
+Browser groups are named `JS::<Name>` (for example `JS::TypeError`) and tagged with `source: "browser"`. They are grouped by error name and the first frame in your own JavaScript (files under `app/javascript/`), so a new asset digest, host, line or column does not start a new group. The message is used only when the stack has no app frame. Frames name your source files, not digested asset URLs.
+
+Browser reports go through the same `ignored_exceptions` (use the `JS::` name), `ignored_paths` (matched against the page path), `before_record` callbacks, spike protection and notifications as server errors.
+
+A resolved browser group reopens only on a report from a page rendered after it was resolved. A report from an older open tab, or one with no verifiable render time, does not reopen it.
+
+### Setup
+
+```sh
+bin/rails generate rails_informant:browser
+bin/rails db:migrate
+```
+
+Then restart the app. The generator is safe to re-run. It:
+
+- writes a migration adding the browser columns (skipped when they already exist)
+- adds `pin "rails_informant"` to `config/importmap.rb`
+- inserts `<%= informant_browser_tag %>` before `javascript_importmap_tags` in `app/views/layouts/application.html.erb`
+- sets `config.capture_browser_errors = true` in the initializer
+
+The tag renders nothing while capture is off, so it can stay in the layout.
+
+### Requirements and caveats
+
+- Supported setup: importmap and Propshaft, with your JavaScript served from the same origin as the app. Bundled or minified builds (jsbundling, esbuild, Vite) and frontends served from another origin are not supported.
+- Content Security Policy: the tag's inline script carries the request's CSP nonce, and `connect-src 'self'` already covers the endpoint.
+- The tag finds the endpoint through the engine's `rails_informant` route helper. Mounting the engine with a custom `as:` name renames that helper and breaks the tag.
+- Mounting the engine inside an authentication constraint blocks reports from signed-out pages.
+- Until the migration has run, the endpoint answers 503 and logs which generator to run.
+- Keep `informant_browser_tag` out of cached output (HTTP or CDN page caching, or a cached layout fragment). The tag carries the signed-in user for the request that rendered it, so a cached copy attributes every visitor's errors to that user for up to 24 hours.
+- On PostgreSQL with a very large `informant_occurrences` table, the migration's index builds block error recording while they run. Run it in a quiet window, or change the generated migration to add the indexes with `algorithm: :concurrently` (and `disable_ddl_transaction!`).
+
+### The endpoint
+
+The client posts to `POST <mount path>/browser_reports` (for example `/informant/browser_reports`). The route exists only while `capture_browser_errors` is on. It takes no token: it accepts only same-origin requests, checked with `Sec-Fetch-Site` and, when a browser does not send that header, `Origin`.
+
+Each request is bounded:
+
+- 30 requests per minute per IP, via Rails `rate_limit` on your app's `Rails.cache`. Under `:null_store` the limit does nothing. Behind a proxy or CDN that Rails does not trust (see `config.action_dispatch.trusted_proxies`), every visitor has the same IP and shares one limit.
+- 64 KB request body and 10 reports per request
+- `browser_new_group_limit` new browser groups per hour. Once the cap is full, Informant records a `RailsInformant::BrowserGroupLimitReached` warning group, which alerts like any other error, so a flood of noise cannot silently hide a new bug.
+
+### What the client sends
+
+- Error name, message and stack
+- The page URL, without its fragment
+- The last 20 breadcrumbs: Turbo visits, clicks, and failing requests with their status and `X-Request-Id`. A click is recorded by element identity (tag, `id`, `data-controller`, `data-action`) and never by its text.
+- The request ID of the last failing request
+- An encrypted context the server wrote into the page when it rendered it: the user, the rendering request's ID, the app revision and the render time. The page cannot read or change it.
+
+The user on a browser occurrence always comes from that server-written context. Nothing in a report can set it.
+
+### Following a browser error to the server
+
+A browser occurrence records `request_id` (the request that rendered the page) and `failing_request_id` (the last request that failed). The `list_occurrences` MCP tool takes a `request_id` filter that matches either, so the agent can find the server occurrence for the same request. A miss is normal: the request may have raised nothing on the server, and cooldown and trimming drop repeat server occurrences. `list_errors` takes a `source` filter (`browser` or `server`) and lists both by default.
+
 ## MCP Server
 
 The bundled `informant-mcp` executable connects Claude Code to your error data via [Model Context Protocol](https://modelcontextprotocol.io).
@@ -310,13 +387,26 @@ Occurrences store: user ID (always), email (opt-in via `capture_user_email`), IP
 RailsInformant::Current.user_context = { id: current_user.id }
 ```
 
+Browser occurrences store the same user context, taken from the page's encrypted render-time context rather than from the report. Their page URL, breadcrumbs and context pass through `filter_parameters` like server request data, and click breadcrumbs never include visible text.
+
 ## Security
 
 - Token authentication (`secure_compare`), HTTPS enforced by default
 - All context filtered through `ActiveSupport::ParameterFilter`
 - Security headers: `Cache-Control: no-store`, `X-Content-Type-Options: nosniff`
 - Error capture never breaks the host application
-- No built-in rate limiting -- use [Rack::Attack](https://github.com/rack/rack-attack) on `/informant/`
+- The browser endpoint (`/informant/browser_reports`, only while `capture_browser_errors` is on) is unauthenticated: it accepts same-origin requests only and is rate limited per IP with Rails `rate_limit`. A scripted client can forge those headers, so every report is size-bounded and new browser groups are capped per hour.
+- Text in browser groups (message, frames, breadcrumbs, URLs) is written by anonymous visitors. The MCP instructions and skill tell the agent to treat it as data, never as instructions.
+- The API has no built-in rate limiting -- use [Rack::Attack](https://github.com/rack/rack-attack) on `/informant/api/`
+
+## Development
+
+```sh
+bin/test                                  # Ruby suite
+node --test 'test/javascript/*.test.js'   # browser client
+```
+
+The JavaScript tests use Node's built-in runner with no npm dependencies, and need Node 22.12 or later. Pass the quoted glob: Node 24 does not run a bare directory argument.
 
 ## License
 

data/app/assets/javascripts/rails_informant.js

@@ -0,0 +1,238 @@
+const BUDGET = 10
+const CRUMBS = 20
+const DEDUPE_MS = 5000
+const FLUSH_MS = 1000
+// The server rejects a body over 64 KB whole, and browsers cap keepalive and beacon bodies at 64 KiB.
+const MAX_BODY = 60000
+const MAX_REPORTS = 10
+// Turbo's minified build mangles the error class name, so its rejection is recognised by this text.
+const FRAME_MISSING = 'did not contain the expected <turbo-frame'
+const V8_FRAME = /^\s*at (?:.+? \()?(\S+?):\d+:\d+\)?$/
+const FIREFOX_FRAME = /^\s*[^@]*@(.+):\d+:\d+$/
+
+const clip = (value, length) => String(value ?? '').slice(0, length)
+const frameUrl = line => (line.match(V8_FRAME) || line.match(FIREFOX_FRAME))?.[1]
+const topFrame = stack => String(stack).split('\n').find(frameUrl) || ''
+const withoutFragment = href => href.split('#')[0]
+const meta = (document, name) => document.querySelector(`meta[name="${name}"]`)?.content
+
+export const isNoise = ({ error, message, stack }, origin) => {
+  if (!error && /^Script error\.?$/.test(message)) return true
+  if (/ResizeObserver loop/.test(message)) return true
+  const url = frameUrl(topFrame(stack))
+  return Boolean(url) && !url.startsWith(`${origin}/`)
+}
+
+export const signature = ({ message, name, stack }) => `${name}|${message}|${topFrame(stack)}`
+
+export const classifyFrameMissing = response => {
+  if (response.redirected) return 'drop'
+  return response.ok ? 'report' : 'breadcrumb'
+}
+
+export const chooseTransport = (trigger, navigator) =>
+  (trigger === 'pagehide' || trigger === 'visibilitychange') && navigator.sendBeacon ? 'beacon' : 'fetch'
+
+export const buildReport = (kind, { message, name, stack }, { breadcrumbs, context, failingRequestId, url }) => ({
+  breadcrumbs: breadcrumbs.slice(-CRUMBS),
+  context,
+  failing_request_id: failingRequestId,
+  kind,
+  message: clip(message, 1000),
+  name: clip(name, 100),
+  occurred_at: new Date().toISOString(),
+  stack: String(stack).split('\n').slice(0, 50).join('\n').slice(0, 20000),
+  url: clip(withoutFragment(url), 2000)
+})
+
+export class Budget {
+  #left = BUDGET
+
+  take () {
+    if (this.#left === 0) return false
+    this.#left--
+    return true
+  }
+
+  reset () {
+    this.#left = BUDGET
+  }
+}
+
+export class Breadcrumbs {
+  #crumbs = []
+  failingRequestId = null
+
+  add (category, message, metadata = {}) {
+    this.#crumbs.push({ category, duration: null, message: clip(message, 500), metadata, timestamp: new Date().toISOString() })
+    if (this.#crumbs.length > CRUMBS) this.#crumbs.shift()
+  }
+
+  // A Turbo request is seen by both the fetch wrapper and Turbo's own events.
+  fetchError (message, status, requestId) {
+    const last = this.#crumbs.at(-1)
+    const seen = requestId
+      ? this.#crumbs.some(it => it.metadata.request_id === requestId)
+      : last?.category === 'fetch.error' && last.message === clip(message, 500) && last.metadata.status === status
+    if (seen) return
+    this.add('fetch.error', message, { request_id: requestId, status })
+    if (requestId) this.failingRequestId = requestId
+  }
+
+  all () {
+    return [...this.#crumbs]
+  }
+}
+
+const describe = (value, fallback) => value && typeof value === 'object'
+  ? { error: value, message: String(value.message ?? value), name: String(value.name || 'Error'), stack: String(value.stack || '') }
+  : { error: value, message: String(value ?? fallback), name: 'Error', stack: '' }
+
+export function start (win) {
+  const { document, location, navigator } = win
+  const budget = new Budget()
+  const crumbs = new Breadcrumbs()
+  const networkFailures = new WeakSet()
+  const seen = new Map()
+  const send = win.fetch
+  const state = win.__railsInformant
+  let bytes = 0
+  let queue = []
+  let timer
+
+  const path = href => {
+    const url = new URL(href, location.href)
+    return (url.origin === location.origin ? '' : url.origin) + url.pathname + url.search
+  }
+  const endpoint = () => meta(document, 'informant-browser-endpoint')
+  const isEndpoint = href => withoutFragment(new URL(href, location.href).href).startsWith(new URL(endpoint(), location.href).href)
+
+  const flush = trigger => {
+    clearTimeout(timer)
+    if (!queue.length) return
+    const body = JSON.stringify({ v: 1, reports: queue })
+    queue = []
+    bytes = 0
+    if (chooseTransport(trigger, navigator) === 'beacon') {
+      navigator.sendBeacon(endpoint(), new Blob([body], { type: 'text/plain' }))
+    } else {
+      // A failed send must not surface as an unhandled rejection, which would be reported in turn.
+      send.call(win, endpoint(), {
+        body,
+        credentials: 'same-origin',
+        headers: { 'Content-Type': 'text/plain' },
+        keepalive: true,
+        method: 'POST'
+      }).catch(() => {})
+    }
+  }
+
+  const enqueue = report => {
+    const size = new TextEncoder().encode(JSON.stringify(report)).length + 1
+    if (queue.length && (bytes + size > MAX_BODY || queue.length >= MAX_REPORTS)) flush('size')
+    queue.push(report)
+    bytes += size
+    clearTimeout(timer)
+    timer = setTimeout(() => flush('timer'), FLUSH_MS)
+  }
+
+  const capture = (kind, details) => {
+    if (isNoise(details, location.origin)) return
+    const now = Date.now()
+    for (const [key, at] of seen) if (now - at >= DEDUPE_MS) seen.delete(key)
+    const key = signature(details)
+    if (seen.has(key)) return
+    seen.set(key, now)
+    if (!budget.take()) return
+    enqueue(buildReport(kind, details, {
+      breadcrumbs: crumbs.all(),
+      context: meta(document, 'informant-browser'),
+      failingRequestId: crumbs.failingRequestId,
+      url: location.href
+    }))
+  }
+
+  const onError = (message, source, lineno, colno, error) => {
+    const details = describe(error, message)
+    if (!details.stack && source) details.stack = `@${source}:${lineno}:${colno}`
+    capture('error', details)
+  }
+
+  // Turbo rethrows network failures and frame-missing errors from un-awaited promises; its events already classified them.
+  const onRejection = reason => {
+    if (networkFailures.has(reason)) return
+    const details = describe(reason)
+    if (!details.message.includes(FRAME_MISSING)) capture('rejection', details)
+  }
+
+  if (state) win.removeEventListener('unhandledrejection', state.onrejection)
+  const previous = state && win.onerror === state.onerror ? state.previousOnerror : win.onerror
+  win.onerror = (...args) => {
+    onError(...args)
+    return previous ? previous.apply(win, args) : false
+  }
+  win.addEventListener('unhandledrejection', event => onRejection(event.reason))
+
+  win.fetch = async function (input, init) {
+    const href = String(input?.url ?? input)
+    try {
+      const response = await send.call(win, input, init)
+      if (response.status >= 500 && !isEndpoint(href)) crumbs.fetchError(path(href), response.status, response.headers.get('X-Request-Id'))
+      return response
+    } catch (error) {
+      if (error?.name !== 'AbortError' && !isEndpoint(href)) crumbs.fetchError(path(href), null, null)
+      throw error
+    }
+  }
+
+  document.addEventListener('click', ({ target }) => {
+    if (!target?.closest) return
+    const element = target.closest('[data-action],a,button,input,select,textarea,label') || target
+    const tag = element.tagName.toLowerCase()
+    const metadata = { tag }
+    if (element.id) metadata.id = clip(element.id, 100)
+    const action = element.closest('[data-action]')?.getAttribute('data-action')
+    const controller = element.closest('[data-controller]')?.getAttribute('data-controller')
+    if (action) metadata.action = clip(action, 200)
+    if (controller) metadata.controller = clip(controller, 200)
+    crumbs.add('ui.click', element.id ? `${tag}#${metadata.id}` : tag, metadata)
+  }, true)
+
+  document.addEventListener('turbo:visit', ({ detail }) => crumbs.add('turbo.visit', path(detail.url), { action: detail.action }))
+  document.addEventListener('turbo:load', ({ detail }) => {
+    budget.reset()
+    crumbs.add('turbo.visit', path(detail?.url ?? location.href))
+  })
+  document.addEventListener('turbo:before-fetch-response', ({ detail: { fetchResponse } }) => {
+    const { response, statusCode } = fetchResponse
+    if (statusCode >= 500) crumbs.fetchError(path(response.url), statusCode, response.headers.get('X-Request-Id'))
+  })
+  document.addEventListener('turbo:fetch-request-error', ({ detail }) => {
+    networkFailures.add(detail.error)
+    crumbs.fetchError(path(detail.request.url.href), null, null)
+  })
+  document.addEventListener('turbo:frame-missing', ({ detail: { response }, target }) => {
+    const verdict = classifyFrameMissing(response)
+    if (verdict === 'report') {
+      capture('turbo', {
+        message: `The response (${response.status}) did not contain the expected <turbo-frame id="${target.id}">`,
+        name: 'TurboFrameMissingError',
+        stack: ''
+      })
+    } else if (verdict === 'breadcrumb') {
+      crumbs.fetchError(path(response.url), response.status, response.headers.get('X-Request-Id'))
+    }
+  })
+
+  win.addEventListener('pagehide', () => flush('pagehide'))
+  document.addEventListener('visibilitychange', () => {
+    if (document.visibilityState === 'hidden') flush('visibilitychange')
+  })
+
+  if (state) {
+    for (const item of state.queue) item.type === 'error' ? onError(...item.args) : onRejection(item.reason)
+    delete win.__railsInformant
+  }
+}
+
+if (typeof document !== 'undefined' && document.querySelector('meta[name="informant-browser"]')) start(window)

data/app/controllers/concerns/rails_informant/security_headers.rb

@@ -0,0 +1,18 @@
+module RailsInformant
+  module SecurityHeaders
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :set_security_headers
+    end
+
+    private
+
+    def set_security_headers
+      response.headers["Cache-Control"] = "no-store"
+      response.headers["Content-Security-Policy"] = "default-src 'none'"
+      response.headers["X-Content-Type-Options"] = "nosniff"
+      response.headers["X-Frame-Options"] = "DENY"
+    end
+  end
+end

data/app/controllers/rails_informant/api/base_controller.rb

@@ -2,7 +2,7 @@ module RailsInformant
   module Api
     class BaseController < ActionController::API
       before_action :authenticate_token!
-      before_action :set_security_headers
+      include SecurityHeaders
 
       rescue_from RailsInformant::InvalidParameterError do |e|
         render json: { error: e.message }, status: :bad_request
@@ -18,6 +18,13 @@ module RailsInformant
 
       private
 
+      def require_browser_schema_for!(param)
+        return if RailsInformant.browser_schema_ready?
+
+        raise RailsInformant::InvalidParameterError,
+          "#{param} needs the browser capture columns: run `bin/rails generate rails_informant:browser` and migrate"
+      end
+
       def parse_time(value)
         Time.parse(value)
       rescue ArgumentError
@@ -39,13 +46,6 @@ module RailsInformant
         end
       end
 
-      def set_security_headers
-        response.headers["Cache-Control"] = "no-store"
-        response.headers["Content-Security-Policy"] = "default-src 'none'"
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        response.headers["X-Frame-Options"] = "DENY"
-      end
-
       def paginate(scope, only:)
         page = [ params.fetch(:page, 1).to_i, 1 ].max
         per_page = [ [ params.fetch(:per_page, 20).to_i, 1 ].max, 100 ].min

data/app/controllers/rails_informant/api/errors_controller.rb

@@ -4,12 +4,14 @@ module RailsInformant
       before_action :find_error_group, only: [ :show, :update, :destroy, :fix_pending, :duplicate ]
 
       def index
+        require_browser_schema_for!("source") if params[:source]
         groups = params[:status] == "duplicate" ? ErrorGroup.all : ErrorGroup.active
         groups = groups
           .by_controller_action(params[:controller_action])
           .by_error_class(params[:error_class])
           .by_job_class(params[:job_class])
           .by_severity(params[:severity])
+          .by_source(params[:source])
           .by_status(params[:status])
           .search(params[:q])
           .since(params[:since] && parse_time(params[:since]))

data/app/controllers/rails_informant/api/occurrences_controller.rb

@@ -2,8 +2,10 @@ module RailsInformant
   module Api
     class OccurrencesController < BaseController
       def index
+        require_browser_schema_for!("request_id") if params[:request_id]
         occurrences = Occurrence.order(created_at: :desc)
         occurrences = occurrences.where(error_group_id: params[:error_group_id]) if params[:error_group_id]
+        occurrences = occurrences.where(request_id: params[:request_id]).or(occurrences.where(failing_request_id: params[:request_id])) if params[:request_id]
         occurrences = occurrences.where(created_at: parse_time(params[:since])..) if params[:since]
         occurrences = occurrences.where(created_at: ..parse_time(params[:until])) if params[:until]
 

data/app/controllers/rails_informant/api/status_controller.rb

@@ -10,12 +10,22 @@ module RailsInformant
           resolved_count: counts.fetch("resolved", 0),
           unresolved_count: counts.fetch("unresolved", 0),
           deploy_sha: RailsInformant.current_git_sha,
-          top_errors: top_errors
+          top_errors: top_errors,
+          **browser_group_limit
         }
       end
 
       private
 
+      def browser_group_limit
+        return {} unless RailsInformant.config.capture_browser_errors && RailsInformant.browser_schema_ready?
+
+        {
+          browser_groups_created_this_hour: ErrorGroup.browser_created_this_hour.count,
+          browser_new_group_limit: RailsInformant.config.browser_new_group_limit
+        }
+      end
+
       def top_errors
         ErrorGroup
           .where(status: "unresolved")

data/app/controllers/rails_informant/browser_reports_controller.rb

@@ -0,0 +1,82 @@
+module RailsInformant
+  # Receives reports from the browser module. It does not inherit the API
+  # base controller: pages post here with no token, so the trust boundary is
+  # the same-origin check, and every field in the body is attacker-controlled.
+  class BrowserReportsController < ActionController::API
+    MAX_BODY_BYTES = 64.kilobytes
+    MAX_REPORTS = 10
+
+    # rate_limit captures its store when the class loads, so this reads the
+    # controller's cache_store per request instead; under a null store the
+    # limit is inert.
+    module LiveCacheStore
+      def self.increment(...) = BrowserReportsController.cache_store.increment(...)
+    end
+
+    class_attribute :schema_warning_logged, default: false
+
+    include SecurityHeaders
+
+    # Parameter wrapping would parse the body before the size check.
+    wrap_parameters false
+
+    # Instrumentation parses a JSON body and logs it as Parameters before any
+    # callback runs, so a declared oversize body is refused ahead of it.
+    def process_action(...)
+      return head :content_too_large if request.content_length.to_i > MAX_BODY_BYTES
+
+      super
+    end
+
+    before_action :verify_same_origin!
+    rate_limit to: 30, within: 1.minute, store: LiveCacheStore, with: -> { head :too_many_requests }
+    before_action :require_browser_schema!
+    before_action { Current.ingesting_browser_report = true }
+
+    def create
+      body = request.body.read(MAX_BODY_BYTES + 1).to_s
+      return head :content_too_large if body.bytesize > MAX_BODY_BYTES
+
+      reports = parse_reports(body) or return head :bad_request
+
+      reports.first(MAX_REPORTS).each do |report|
+        next unless report.is_a?(Hash) && report.key?("name") && report.key?("message")
+
+        ErrorRecorder.record_browser report,
+          base_url: request.base_url,
+          context: BrowserContext.verify(report["context"]),
+          remote_ip: request.remote_ip,
+          user_agent: request.user_agent
+      end
+
+      head :no_content
+    end
+
+    private
+
+    # Browsers set both headers and pages cannot forge them. Without
+    # Sec-Fetch-Site (older browsers), Origin must name this app exactly.
+    def verify_same_origin!
+      fetch_site = request.headers["Sec-Fetch-Site"]
+      same_origin = fetch_site ? fetch_site == "same-origin" : request.origin == request.base_url
+      head :forbidden unless same_origin
+    end
+
+    def require_browser_schema!
+      return if RailsInformant.browser_schema_ready?
+
+      unless schema_warning_logged
+        self.class.schema_warning_logged = true
+        Rails.logger.warn "[RailsInformant] Browser reports rejected: run `bin/rails generate rails_informant:browser` and migrate to add the browser capture columns"
+      end
+      head :service_unavailable
+    end
+
+    def parse_reports(body)
+      payload = JSON.parse(body)
+      payload["reports"] if payload.is_a?(Hash) && payload.key?("v") && payload["reports"].is_a?(Array)
+    rescue JSON::ParserError
+      nil
+    end
+  end
+end

data/app/helpers/rails_informant/browser_helper.rb

@@ -0,0 +1,34 @@
+module RailsInformant
+  module BrowserHelper
+    # Module scripts run in document order, so an app module that throws while
+    # evaluating would beat the pinned module to it. This classic script buffers
+    # errors from the start and hands them to the module once it loads.
+    EARLY_HOOK = <<~JS.freeze
+      (() => {
+        const state = { queue: [], previousOnerror: window.onerror }
+        state.onerror = (...args) => {
+          state.queue.push({ type: 'error', args })
+          return state.previousOnerror ? state.previousOnerror(...args) : false
+        }
+        state.onrejection = event => state.queue.push({ type: 'rejection', reason: event.reason })
+        window.onerror = state.onerror
+        window.addEventListener('unhandledrejection', state.onrejection)
+        window.__railsInformant = state
+        const load = () => import('rails_informant')
+        document.readyState === 'loading' ? document.addEventListener('DOMContentLoaded', load, { once: true }) : load()
+      })()
+    JS
+
+    # The flag is read here rather than at boot because hosts set it in an
+    # initializer, which runs after the engine's.
+    def informant_browser_tag
+      return unless RailsInformant.config.capture_browser_errors
+
+      safe_join [
+        tag.meta(name: "informant-browser", content: RailsInformant::BrowserContext.generate(request)),
+        tag.meta(name: "informant-browser-endpoint", content: rails_informant.browser_reports_path),
+        javascript_tag(EARLY_HOOK, nonce: true)
+      ], "\n"
+    end
+  end
+end

data/app/models/rails_informant/error_group.rb

@@ -20,6 +20,7 @@ module RailsInformant
       original_sha
       resolved_at
       severity
+      source
       status
       total_occurrences
       updated_at
@@ -53,10 +54,12 @@ module RailsInformant
 
     scope :active, -> { where.not(status: "duplicate") }
     scope :before, ->(time) { where(last_seen_at: ..time) if time }
+    scope :browser_created_this_hour, -> { where(source: "browser", created_at: 1.hour.ago..) }
     scope :by_controller_action, ->(action) { where(controller_action: action) if action }
     scope :by_error_class, ->(error_class) { where(error_class:) if error_class }
     scope :by_job_class, ->(job_class) { where(job_class:) if job_class }
     scope :by_severity, ->(severity) { where(severity:) if severity }
+    scope :by_source, ->(source) { where(source:) if source }
     scope :by_status, ->(status) { where(status:) if status }
     scope :search, ->(q) { where(arel_table[:message].matches("%#{sanitize_sql_like(q)}%")) if q }
     scope :since, ->(time) { where(last_seen_at: time..) if time }
@@ -130,6 +133,20 @@ module RailsInformant
       update!(status: "duplicate", duplicate_of: target)
     end
 
+    # A page rendered before the group was resolved is still running the code
+    # the fix replaced, so its errors are not evidence the fix failed.
+    # A page with no verified render time could be a forged report, so only a
+    # page the server vouches for as newer than the fix may reopen the group.
+    # Installs that have not run the browser migration have no source column,
+    # and every group they hold is a server group.
+    def source
+      RailsInformant.browser_schema_ready? ? super : "server"
+    end
+
+    def rendered_before_resolution?(rendered_at)
+      status == "resolved" && (rendered_at.nil? || rendered_at <= resolved_at)
+    end
+
     def detect_regression!
       return unless status == "resolved"