rails_error_dashboard 0.12.0 → 0.13.0

data/lib/rails_error_dashboard/services/analytics_cache_manager.rb

@@ -2,29 +2,54 @@
 
 module RailsErrorDashboard
   module Services
-    # Infrastructure service: Clear analytics caches
+    # Infrastructure service: invalidate the dashboard's cached statistics
     #
-    # Clears dashboard_stats, analytics_stats, and platform_comparison
-    # cache entries. Handles cache stores that don't support delete_matched
-    # (e.g., SolidCache) gracefully.
+    # Every cached stats key (DashboardStats, AnalyticsStats) embeds a
+    # GENERATION number read from Rails.cache. Invalidation is one increment of
+    # that number: entries written under the old generation are simply never
+    # read again and age out by their own TTL.
+    #
+    # This replaced delete_matched("dashboard_stats/*") and friends, which is a
+    # SCAN of the HOST app's whole Redis keyspace, NotImplementedError on
+    # memcached, and used to run from ErrorLog's after_save -- i.e. inside the
+    # host's request thread on every captured error.
+    #
+    # Who calls .clear: user actions and maintenance that change what the cards
+    # show (resolve, status change, batch actions, mute, retention). Captures
+    # deliberately do NOT: they rely on the TTL (1 minute for the stat cards,
+    # 5 for analytics), which decouples capture cost from dashboard freshness.
+    #
+    # With :memory_store the generation is per process, so an action handled by
+    # one worker reaches the others when their entries expire. With :null_store
+    # nothing is cached and there is nothing to invalidate.
     class AnalyticsCacheManager
-      CACHE_PATTERNS = %w[
-        dashboard_stats/*
-        analytics_stats/*
-        platform_comparison/*
-      ].freeze
+      GENERATION_KEY = "red/cache_gen"
+
+      # @return [Integer] the current cache generation; 0 when unset or unreadable
+      def self.generation
+        Rails.cache.read(GENERATION_KEY).to_i
+      rescue => e
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] cache generation unreadable: #{e.class}: #{e.message}")
+        0
+      end
 
-      # Clear all analytics caches
+      # Invalidate every cached dashboard statistic. Never raises.
+      #
+      # A plain read + write, deliberately not Rails.cache.increment: increment
+      # is unimplemented on some stores, returns nil for a missing key on
+      # others, and on Redis is an INCRBY that fails against an entry written
+      # by #write. It does not need to be atomic either -- racing clears only
+      # need the number to differ from the one stale entries were written under.
+      #
+      # Never lower than the clock in milliseconds, so that a store which evicts
+      # the generation key cannot restart at a number that entries still inside
+      # their TTL were written under a few minutes earlier.
       def self.clear
-        if Rails.cache.respond_to?(:delete_matched)
-          CACHE_PATTERNS.each { |pattern| Rails.cache.delete_matched(pattern) }
-        else
-          Rails.logger.info("Cache store doesn't support delete_matched, skipping cache clear") if Rails.logger
-        end
-      rescue NotImplementedError => e
-        Rails.logger.info("Cache store doesn't support delete_matched: #{e.message}") if Rails.logger
+        Rails.cache.write(GENERATION_KEY, [ generation + 1, (Time.now.to_f * 1000).to_i ].max)
+        nil
       rescue => e
-        Rails.logger.error("Failed to clear analytics cache: #{e.message}") if Rails.logger
+        RailsErrorDashboard::Logger.error("[RailsErrorDashboard] Failed to clear analytics cache: #{e.class}: #{e.message}")
+        nil
       end
     end
   end

data/lib/rails_error_dashboard/services/backtrace_processor.rb

@@ -22,7 +22,9 @@ module RailsErrorDashboard
 
         max_lines ||= RailsErrorDashboard.configuration.max_backtrace_lines
 
-        limited_backtrace = backtrace.first(max_lines).map { |line| shorten_gem_path(line) }
+        # Scrubbed per line: a frame label can hold any bytes, and both the sub
+        # below and the join (mixed encodings) raise on an invalid one.
+        limited_backtrace = backtrace.first(max_lines).map { |line| shorten_gem_path(EncodingSanitizer.scrub(line)) }
         result = limited_backtrace.join("\n")
 
         if backtrace.length > max_lines

data/lib/rails_error_dashboard/services/cause_chain_extractor.rb

@@ -43,7 +43,9 @@ module RailsErrorDashboard
           depth += 1
         end
 
-        chain.empty? ? nil : chain.to_json
+        # to_json raises on a cause message or frame with invalid bytes, which
+        # used to drop the whole chain.
+        chain.empty? ? nil : EncodingSanitizer.scrub_deep(chain).to_json
       rescue => e
         # SAFETY: Never let cause chain extraction break error logging
         RailsErrorDashboard::Logger.debug(

data/lib/rails_error_dashboard/services/codeberg_issue_client.rb

@@ -40,7 +40,7 @@ module RailsErrorDashboard
           auth_headers
         )
 
-        response[:status] == 201 ? success_response({}) : error_response("Codeberg API error (#{response[:status]})")
+        patch_result(response)
       end
 
       def reopen_issue(number:)
@@ -50,7 +50,7 @@ module RailsErrorDashboard
           auth_headers
         )
 
-        response[:status] == 201 ? success_response({}) : error_response("Codeberg API error (#{response[:status]})")
+        patch_result(response)
       end
 
       def add_comment(number:, body:)
@@ -114,6 +114,17 @@ module RailsErrorDashboard
 
       private
 
+      # Gitea/Forgejo answer a successful PATCH with 200; 201 is what they
+      # return for creation. Accepting only 201 reported every close and reopen
+      # as failed although the forge had applied it.
+      def patch_result(response)
+        if [ 200, 201 ].include?(response[:status])
+          success_response({})
+        else
+          error_response("Codeberg API error (#{response[:status]})")
+        end
+      end
+
       def auth_headers
         { "Authorization" => "token #{@token}" }
       end

data/lib/rails_error_dashboard/services/diagnostic_dump_generator.rb

@@ -27,7 +27,9 @@ module RailsErrorDashboard
       end
 
       def call
-        {
+        # Thread names and breadcrumb text are arbitrary bytes; both callers
+        # immediately to_json this, which raises on an invalid one.
+        EncodingSanitizer.scrub_deep(
           captured_at: Time.current.iso8601,
           pid: Process.pid,
           uptime_seconds: process_uptime,
@@ -37,9 +39,9 @@ module RailsErrorDashboard
           threads: thread_info,
           gc: gc_info,
           object_counts: object_counts
-        }
+        )
       rescue => e
-        { captured_at: Time.current.iso8601, error: e.message }
+        { captured_at: Time.current.iso8601, error: EncodingSanitizer.scrub(e.message) }
       end
 
       private

data/lib/rails_error_dashboard/services/encoding_sanitizer.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  module Services
+    # Pure algorithm: make every String in a value safe to store, serialize and render
+    #
+    # Exception messages, backtrace lines, request URLs, user agents and params can
+    # carry bytes that are not valid UTF-8 (a binary upload echoed in a message, a
+    # Latin-1 query string, a NUL from a fuzzer). Left alone they raise at the
+    # worst possible moments: ActiveJob JSON-encoding the async payload in the
+    # host's request thread, the PostgreSQL INSERT, or `blank?` while rendering the
+    # error's own page.
+    #
+    # Invalid sequences become "?" and NUL bytes are removed (PostgreSQL text
+    # columns reject them). Strings tagged ASCII-8BIT (or any other encoding) are
+    # re-tagged UTF-8 and then scrubbed — not transcoded, because a binary tag
+    # says nothing about what the bytes mean and transcoding would raise.
+    #
+    # The common case costs one `valid_encoding?` scan and returns the SAME
+    # object. Nothing here raises, and the caller's objects are never mutated.
+    #
+    # @example
+    #   EncodingSanitizer.scrub("caf\xC3 \xFF".b)          # => "caf? ?"
+    #   EncodingSanitizer.scrub_deep({ url: "/?q=\xFF" })   # => { url: "/?q=?" }
+    class EncodingSanitizer
+      REPLACEMENT = "?"
+      UNREADABLE = "[unreadable]"
+      TOO_DEEP = "[truncated: nested too deep]"
+      MAX_DEPTH = 10
+      NUL = "\0"
+
+      # @param str [Object] anything; only Strings are touched
+      # @return [Object] the same object when already clean, otherwise a clean copy
+      def self.scrub(str)
+        return str unless String === str
+
+        s = str.encoding == Encoding::UTF_8 ? str : str.dup.force_encoding(Encoding::UTF_8)
+        return s if s.valid_encoding? && !s.include?(NUL)
+
+        s = s.scrub(REPLACEMENT) unless s.valid_encoding?
+        s.delete(NUL)
+      rescue => e
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] EncodingSanitizer.scrub failed: #{e.class}")
+        UNREADABLE
+      end
+
+      # Recursively scrub Strings inside Hashes (keys and values) and Arrays.
+      # Anything else is returned untouched. A container nested deeper than
+      # MAX_DEPTH is replaced by a placeholder rather than passed through: an
+      # unscrubbed subtree would defeat the point, and a self-referencing one
+      # would never end.
+      #
+      # @param obj [Object]
+      # @return [Object]
+      def self.scrub_deep(obj, depth = 0)
+        case obj
+        when String
+          scrub(obj)
+        when Hash
+          return TOO_DEEP if depth >= MAX_DEPTH
+
+          # Build into an empty copy of the same class so a
+          # HashWithIndifferentAccess stays one.
+          obj.each_with_object(obj.class.new) do |(key, value), result|
+            result[scrub_deep(key, depth + 1)] = scrub_deep(value, depth + 1)
+          end
+        when Array
+          return TOO_DEEP if depth >= MAX_DEPTH
+
+          obj.map { |value| scrub_deep(value, depth + 1) }
+        else
+          obj
+        end
+      rescue => e
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] EncodingSanitizer.scrub_deep failed: #{e.class}")
+        String === obj ? UNREADABLE : obj
+      end
+    end
+  end
+end

data/lib/rails_error_dashboard/services/error_broadcaster.rb

@@ -15,26 +15,71 @@ module RailsErrorDashboard
     # are NOT available there. We render via the engine's own controller renderer
     # and pass pre-rendered HTML to the broadcast to ensure route helpers work.
     class ErrorBroadcaster
+      # Minimum seconds between two stats broadcasts on one stream, per process.
+      # The row broadcasts are cheap (one partial); the stats payload is a full
+      # DashboardStats computation, and a capture runs it from inside the host
+      # app's request thread. Leading edge: the first event in a window
+      # broadcasts, later ones are dropped and corrected by the next window or
+      # the next page load.
+      STATS_BROADCAST_INTERVAL = 5
+
+      # Stream names, in ONE place for the view (turbo_stream_from) and for this
+      # class. Three kinds, because a Turbo subscription is all-or-nothing per
+      # stream and the index needs them separately: a view filtered by platform
+      # wants row REPLACES (harmless: they only touch rows already on the page)
+      # but not PREPENDS (a new row may not match its filter).
+      #
+      # Every kind exists globally and per application ("error_list_app_7"), so
+      # a view filtered to one application never receives another's rows.
+      STREAMS = { list: "error_list", updates: "error_updates", stats: "error_stats" }.freeze
+
+      # Column visibility (which optional cells a row has) used to be two
+      # SELECT DISTINCT scans per broadcast. It changes about never.
+      COLUMN_VISIBILITY_TTL = 60.seconds
+
+      # One throttle entry per stats stream, i.e. per application. Bounded so a
+      # host with thousands of applications cannot grow it without limit.
+      MAX_THROTTLED_STREAMS = 200
+
+      THROTTLE_MUTEX = Mutex.new
+      private_constant :THROTTLE_MUTEX
+
+      # @param kind [Symbol] :list (new rows), :updates (row replaces) or :stats
+      # @param application_id [Integer, String, nil] nil/blank for the global stream
+      # @return [String]
+      def self.stream_name(kind, application_id = nil)
+        base = STREAMS.fetch(kind)
+        return base if application_id.blank?
+
+        # to_i: the id reaches here from a request parameter in the view.
+        "#{base}_app_#{application_id.to_s[/\A\d+\z/].to_i}"
+      end
+
+      # The streams a dashboard index page subscribes to.
+      # @param application_id [Integer, String, nil] the page's application filter
+      # @param filtered [Boolean] any OTHER filter, a sort or a later page is active,
+      #   so a new row cannot simply be put on top of the list
+      # @return [Array<String>]
+      def self.streams_for_view(application_id: nil, filtered: false)
+        kinds = filtered ? %i[updates stats] : %i[list updates stats]
+        kinds.map { |kind| stream_name(kind, application_id) }
+      end
+
       # Broadcast a new error (prepend to error list + refresh stats)
       # @param error_log [ErrorLog] The newly created error
       def self.broadcast_new(error_log)
         return unless error_log
         return unless available?
+        return unless calm?
 
-        platforms = ErrorLog.distinct.pluck(:platform).compact
-        show_platform = platforms.size > 1
-        show_environment = ErrorLog.column_names.include?("environment") &&
-                           ErrorLog.distinct.pluck(:environment).compact.size > 1
-
-        html = render_partial("rails_error_dashboard/errors/error_row",
-          error: error_log, show_platform: show_platform, show_environment: show_environment)
-
-        Turbo::StreamsChannel.broadcast_prepend_to(
-          "error_list",
-          target: "error_list",
-          html: html
-        )
-        broadcast_stats
+        each_row_html(error_log) do |application_id, html|
+          Turbo::StreamsChannel.broadcast_prepend_to(
+            stream_name(:list, application_id),
+            target: "error_list",
+            html: html
+          )
+        end
+        broadcast_stats(error_log.application_id)
       rescue => e
         Rails.logger.error("[RailsErrorDashboard] Failed to broadcast new error: #{e.class} - #{e.message}")
         Rails.logger.debug("[RailsErrorDashboard] Backtrace: #{e.backtrace&.first(3)&.join("\n")}")
@@ -45,37 +90,45 @@ module RailsErrorDashboard
       def self.broadcast_update(error_log)
         return unless error_log
         return unless available?
+        return unless calm?
 
-        platforms = ErrorLog.distinct.pluck(:platform).compact
-        show_platform = platforms.size > 1
-        show_environment = ErrorLog.column_names.include?("environment") &&
-                           ErrorLog.distinct.pluck(:environment).compact.size > 1
-
-        html = render_partial("rails_error_dashboard/errors/error_row",
-          error: error_log, show_platform: show_platform, show_environment: show_environment)
-
-        Turbo::StreamsChannel.broadcast_replace_to(
-          "error_list",
-          target: "error_#{error_log.id}",
-          html: html
-        )
-        broadcast_stats
+        each_row_html(error_log) do |application_id, html|
+          Turbo::StreamsChannel.broadcast_replace_to(
+            stream_name(:updates, application_id),
+            target: "error_#{error_log.id}",
+            html: html
+          )
+        end
+        broadcast_stats(error_log.application_id)
       rescue => e
         Rails.logger.error("[RailsErrorDashboard] Failed to broadcast error update: #{e.class} - #{e.message}")
         Rails.logger.debug("[RailsErrorDashboard] Backtrace: #{e.backtrace&.first(3)&.join("\n")}")
       end
 
-      # Broadcast stats refresh
-      def self.broadcast_stats
+      # Broadcast a stats refresh: all-application stats to the global stream,
+      # application-scoped stats to that application's stream.
+      #
+      # ONE event computes at most ONE payload. Each stream is throttled on its
+      # own (STATS_BROADCAST_INTERVAL); when both are due, the one that has
+      # waited longest goes and the other is served by the next event. Computing
+      # both would double the most expensive thing a capture does, and a
+      # fixed order would starve the second stream whenever events are rare.
+      #
+      # @param application_id [Integer, nil] the application of the event, if any
+      def self.broadcast_stats(application_id = nil)
         return unless available?
+        return unless calm?
 
-        stats = Queries::DashboardStats.call
+        scope = claim_stats_window!([ nil, application_id.presence ].uniq)
+        return if scope == :none
+
+        stats = scope ? Queries::DashboardStats.call(application_id: scope) : Queries::DashboardStats.call
         return unless stats.is_a?(Hash) && stats.present?
 
         html = render_partial("rails_error_dashboard/errors/stats", stats: stats)
 
         Turbo::StreamsChannel.broadcast_replace_to(
-          "error_list",
+          stream_name(:stats, scope),
           target: "dashboard_stats",
           html: html
         )
@@ -84,6 +137,101 @@ module RailsErrorDashboard
         Rails.logger.debug("[RailsErrorDashboard] Backtrace: #{e.backtrace&.first(3)&.join("\n")}")
       end
 
+      # Yields [application_id_or_nil, row_html] once per row stream. The global
+      # table has an Application column when there is more than one application;
+      # an application's own table never does, so the two need different cells.
+      # Rendered once when they come out the same.
+      def self.each_row_html(error_log)
+        render = lambda do |visibility, show_application|
+          render_partial("rails_error_dashboard/errors/error_row",
+            error: error_log, show_platform: visibility[:platform],
+            show_environment: visibility[:environment], show_application: show_application)
+        end
+
+        global = column_visibility(nil)
+        yield nil, render.call(global, global[:application])
+
+        application_id = error_log.application_id
+        return if application_id.blank?
+
+        yield application_id, render.call(column_visibility(application_id), false)
+      end
+
+      # Which optional columns the index table shows, for the global view or for
+      # one application -- the same rule the index itself applies. Cached for
+      # COLUMN_VISIBILITY_TTL and keyed on the cache generation, so a user
+      # action that could change it (a batch delete) refreshes it at once.
+      def self.column_visibility(application_id)
+        key = [ "red/columns", AnalyticsCacheManager.generation, application_id || "all" ].join("/")
+
+        Rails.cache.fetch(key, expires_in: COLUMN_VISIBILITY_TTL) do
+          scope = application_id ? ErrorLog.where(application_id: application_id) : ErrorLog.all
+          {
+            platform: scope.distinct.pluck(:platform).compact.size > 1,
+            environment: ErrorLog.column_names.include?("environment") &&
+              scope.distinct.pluck(:environment).compact.size > 1,
+            application: application_id.nil? && Application.count > 1
+          }
+        end
+      end
+
+      # Live updates are a convenience; during a storm they are load. While the
+      # breaker is anything but :closed nothing is broadcast -- the page catches
+      # up on its next load. Fails towards broadcasting: Gate.state itself
+      # answers :closed when storm protection is off or unreadable.
+      def self.calm?
+        StormProtection::Gate.state == :closed
+      rescue StandardError
+        true
+      end
+
+      # Picks which stats scope this event may broadcast, and claims its window.
+      #
+      # @param scopes [Array<Integer, nil>] candidate scopes (nil = all applications)
+      # @return [Integer, nil, :none] the claimed scope, or :none when every
+      #   candidate is still inside its window
+      #
+      # The claim is taken BEFORE the stats are computed, so concurrent captures
+      # cannot all decide to compute at once, and a computation that fails does
+      # not get retried by every event that follows it.
+      def self.claim_stats_window!(scopes = [ nil ])
+        THROTTLE_MUTEX.synchronize do
+          @stats_claimed_at ||= {}
+          now = monotonic_now
+
+          due = scopes.select do |scope|
+            last = @stats_claimed_at[scope]
+            last.nil? || (now - last) >= STATS_BROADCAST_INTERVAL
+          end
+          return :none if due.empty?
+
+          # Longest-waiting first; never-claimed counts as waiting forever.
+          # min_by is stable, so the global stream wins a tie.
+          chosen = due.min_by { |scope| @stats_claimed_at[scope] || -Float::INFINITY }
+          @stats_claimed_at[chosen] = now
+
+          if @stats_claimed_at.size > MAX_THROTTLED_STREAMS
+            stalest = @stats_claimed_at.min_by { |_scope, at| at }.first
+            @stats_claimed_at.delete(stalest)
+          end
+
+          chosen
+        end
+      end
+
+      def self.throttled_stream_count
+        THROTTLE_MUTEX.synchronize { (@stats_claimed_at || {}).size }
+      end
+
+      def self.monotonic_now
+        Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+
+      # For specs and for a forked worker that wants a clean slate.
+      def self.reset_throttle!
+        THROTTLE_MUTEX.synchronize { @stats_claimed_at = {} }
+      end
+
       # Render a partial using the engine's controller renderer.
       # This ensures engine route helpers (error_path, etc.) are available,
       # unlike Turbo's default ApplicationController.render which uses the host app's context.

data/lib/rails_error_dashboard/services/error_hash_generator.rb

@@ -121,8 +121,13 @@ module RailsErrorDashboard
       # @param message [String, nil] The error message
       # @return [String, nil] Normalized message
       def self.normalize_message(message)
-        message
-          &.[](0, HASH_MESSAGE_LIMIT)
+        # Slice, THEN scrub, then match: every path (sync, async, storm gate)
+        # goes through here, so they all hash the same text. gsub raises on a
+        # string with invalid bytes; a valid message is returned by scrub as-is,
+        # so no existing fingerprint changes.
+        prefix = message&.[](0, HASH_MESSAGE_LIMIT)
+
+        EncodingSanitizer.scrub(prefix)
           &.gsub(/0x[0-9a-f]+/i, "HEX")          # Replace hex addresses (before numbers)
           &.gsub(/#<[^>]+>/, "#<OBJ>")           # Replace object inspections
           &.gsub(/\d+/, "N")                     # Replace numbers
@@ -161,7 +166,8 @@ module RailsErrorDashboard
           !frame.include?("/gems/")
         }
 
-        first_app_frame&.split(":")&.first
+        # split raises on a frame with invalid bytes (a method name can hold any).
+        EncodingSanitizer.scrub(first_app_frame)&.split(":")&.first
       end
 
       # Try custom fingerprint lambda if configured

data/lib/rails_error_dashboard/services/error_notification_dispatcher.rb

@@ -10,6 +10,19 @@ module RailsErrorDashboard
     # @example
     #   ErrorNotificationDispatcher.call(error_log)
     class ErrorNotificationDispatcher
+      # Is any channel configured to the point where .call would enqueue
+      # something? The same conditions as below, without the side effects.
+      # @return [Boolean]
+      def self.any_channel?
+        config = RailsErrorDashboard.configuration
+
+        (config.enable_slack_notifications && config.slack_webhook_url.present?) ||
+          (config.enable_email_notifications && config.notification_email_recipients.present?) ||
+          (config.enable_discord_notifications && config.discord_webhook_url.present?) ||
+          (config.enable_pagerduty_notifications && config.pagerduty_integration_key.present?) ||
+          (config.enable_webhook_notifications && config.webhook_urls.present?) || false
+      end
+
       # @param error_log [ErrorLog] The error to notify about
       def self.call(error_log)
         # OTel: emit a child span around the dispatch so operators can see

data/lib/rails_error_dashboard/services/exception_filter.rb

@@ -10,6 +10,14 @@ module RailsErrorDashboard
     # @example
     #   ExceptionFilter.should_log?(exception) # => true/false
     class ExceptionFilter
+      # Distinct errors remembered for first-seen admission (see sampled_out?).
+      # Eviction only costs one extra admitted sample, so there is no overflow
+      # accounting here.
+      MAX_SEEN = 1_000
+
+      @seen = {}
+      @seen_mutex = Mutex.new
+
       # Check if an exception should be logged (not ignored, not sampled out)
       # @param exception [Exception] The exception to check
       # @return [Boolean] true if the exception should be logged
@@ -48,16 +56,63 @@ module RailsErrorDashboard
       # Critical errors are ALWAYS logged regardless of sampling
       # @param exception [Exception] The exception to check
       # @return [Boolean] true if the exception should be skipped
+      #
+      # The FIRST event of each error in this process is always admitted.
+      # Sampling is a dice roll taken before anything is known about the error,
+      # so at a rate of 0.01 an error that happens three times is usually never
+      # recorded at all. Sampling is there to cut volume; it must not hide that
+      # an error exists. A rate of 0.0 stays a hard off switch.
       def self.sampled_out?(exception)
         sampling_rate = RailsErrorDashboard.configuration.sampling_rate
 
         return false if sampling_rate >= 1.0
         return false if critical?(exception)
         return true if sampling_rate <= 0.0
+        return false if first_sighting?(exception)
 
         rand > sampling_rate
       end
 
+      # True exactly once per process for each (exception class, first
+      # application frame). Coarser than the real fingerprint on purpose: the
+      # fingerprint needs the application id (a query) and this runs before the
+      # storm gate. Two errors raised from one line share a "first".
+      #
+      # Per process, so N workers admit N firsts. Bounded at MAX_SEEN, least
+      # recently seen evicted first. Any failure means "not seen": admit.
+      def self.first_sighting?(exception)
+        key = seen_key(exception)
+
+        @seen_mutex.synchronize do
+          seen_before = !@seen.delete(key).nil?
+          @seen.shift while @seen.size >= MAX_SEEN
+          @seen[key] = true
+          !seen_before
+        end
+      rescue => e
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] ExceptionFilter.first_sighting? failed: #{e.class}: #{e.message}")
+        true
+      end
+
+      # "ClassName|first application frame". The first backtrace line that is
+      # not inside a gem or the Ruby core; the first line when there is no such
+      # frame; nothing when the exception was never raised.
+      def self.seen_key(exception)
+        backtrace = exception.backtrace || []
+        frame = backtrace.find { |line| !line.include?("/gems/") && !line.start_with?("<internal:") } || backtrace.first
+
+        "#{exception.class.name}|#{frame.to_s.sub(/:in .*\z/, "")}"
+      end
+
+      def self.seen_size
+        @seen_mutex.synchronize { @seen.size }
+      end
+
+      # Forget every sighting (specs, and after a fork).
+      def self.reset_seen!
+        @seen_mutex.synchronize { @seen.clear }
+      end
+
       # Check if exception is a critical error type
       # @param exception [Exception] The exception to check
       # @return [Boolean] true if the exception is critical