rails_error_dashboard 0.12.1 → 0.14.0

data/lib/rails_error_dashboard/services/swallowed_exception_tracker.rb

@@ -25,6 +25,17 @@ module RailsErrorDashboard
       RAISE_THREAD_KEY  = :red_swallowed_raises
       RESCUE_THREAD_KEY = :red_swallowed_rescues
       FLUSH_THREAD_KEY  = :red_swallowed_last_flush
+      # Monotonic time at which this thread's buffer stopped being empty. The
+      # flush is due one interval after THAT, whether or not anything else
+      # happens on the thread.
+      DEADLINE_THREAD_KEY = :red_swallowed_armed_at
+
+      # Where evicted counts go, so eviction bounds memory without losing the
+      # total. The flush command splits keys on "|" and "->", so these persist as
+      # ordinary rows under the class name "[overflow]".
+      OVERFLOW_LABEL      = "[overflow]"
+      RAISE_OVERFLOW_KEY  = "#{OVERFLOW_LABEL}|#{OVERFLOW_LABEL}".freeze
+      RESCUE_OVERFLOW_KEY = "#{OVERFLOW_LABEL}|#{OVERFLOW_LABEL}->#{OVERFLOW_LABEL}".freeze
       RAISE_LOC_IVAR    = :@_red_raise_loc
 
       # Flow-control exceptions that are commonly raised/rescued in normal Rails operation.
@@ -95,7 +106,7 @@ module RailsErrorDashboard
         end
 
         # Force flush the current thread's counters (used by job and tests)
-        def flush!
+        def flush!(sync: false)
           raises = Thread.current[RAISE_THREAD_KEY]
           rescues = Thread.current[RESCUE_THREAD_KEY]
           return if raises.nil? && rescues.nil?
@@ -107,14 +118,42 @@ module RailsErrorDashboard
           raises&.clear
           rescues&.clear
           Thread.current[FLUSH_THREAD_KEY] = Time.now.to_f
+          Thread.current[DEADLINE_THREAD_KEY] = nil
 
-          dispatch_flush(raise_snapshot, rescue_snapshot)
+          dispatch_flush(raise_snapshot, rescue_snapshot, sync: sync)
         rescue => e
           RailsErrorDashboard::Logger.debug(
             "[RailsErrorDashboard] SwallowedExceptionTracker.flush! failed: #{e.class} - #{e.message}"
           )
         end
 
+        # Drain this thread's buffer at the end of a unit of work (a request or a
+        # job) once it has been waiting for flush_interval.
+        #
+        # Without this the ONLY in-process drain was maybe_flush! inside the
+        # :rescue callback, so a buffer could only ever be flushed by a LATER
+        # rescue on the SAME thread: a swallowed exception that happened once
+        # stayed invisible until the process exited, and counts on a Puma thread
+        # that retired were lost. Same defect, same fix, as
+        # RackAttackTracker#flush_if_due!.
+        #
+        # Wired to Rails.application.executor.to_complete, which fires after the
+        # response body is closed, so this never delays a request. Deadline-gated:
+        # the usual cost is one thread-local read.
+        def flush_if_due!
+          return unless flush_due?
+
+          # sync: the response is already sent, and one upsert per interval is
+          # cheaper than enqueueing a job to do it.
+          flush!(sync: true)
+          nil
+        rescue => e
+          RailsErrorDashboard::Logger.debug(
+            "[RailsErrorDashboard] SwallowedExceptionTracker.flush_if_due! failed: #{e.class} - #{e.message}"
+          )
+          nil
+        end
+
         # Read current thread's counters (for testing/inspection)
         def current_raises
           Thread.current[RAISE_THREAD_KEY] || {}
@@ -129,6 +168,7 @@ module RailsErrorDashboard
           Thread.current[RAISE_THREAD_KEY] = nil
           Thread.current[RESCUE_THREAD_KEY] = nil
           Thread.current[FLUSH_THREAD_KEY] = nil
+          Thread.current[DEADLINE_THREAD_KEY] = nil
         end
 
         private
@@ -152,11 +192,9 @@ module RailsErrorDashboard
           class_name = exception.class.name || exception.class.to_s
           key = "#{class_name}|#{location}"
 
-          raises = (Thread.current[RAISE_THREAD_KEY] ||= {})
-          raises[key] = (raises[key] || 0) + 1
-
-          # 5. LRU eviction if over capacity
-          evict_oldest!(raises) if raises.size > max_cache_size
+          # 4b/5. Count it, most-recent-last, evicting into the overflow bucket
+          increment!((Thread.current[RAISE_THREAD_KEY] ||= {}), key, RAISE_OVERFLOW_KEY)
+          arm_deadline!
         end
 
         # TracePoint(:rescue) callback
@@ -181,11 +219,9 @@ module RailsErrorDashboard
           class_name = exception.class.name || exception.class.to_s
           key = "#{class_name}|#{raise_loc}->#{rescue_loc}"
 
-          rescues = (Thread.current[RESCUE_THREAD_KEY] ||= {})
-          rescues[key] = (rescues[key] || 0) + 1
-
-          # 5. LRU eviction if over capacity
-          evict_oldest!(rescues) if rescues.size > max_cache_size
+          # 4b/5. Count it, most-recent-last, evicting into the overflow bucket
+          increment!((Thread.current[RESCUE_THREAD_KEY] ||= {}), key, RESCUE_OVERFLOW_KEY)
+          arm_deadline!
 
           # 6. Maybe flush
           maybe_flush!
@@ -210,21 +246,60 @@ module RailsErrorDashboard
           false
         end
 
-        # LRU eviction: delete the oldest key (Ruby hashes maintain insertion order)
-        def evict_oldest!(hash)
-          oldest_key = hash.each_key.first
-          hash.delete(oldest_key) if oldest_key
+        # Count one event. delete-and-reinsert moves the key to the END of the
+        # Hash, so insertion order IS recency order and "oldest" below means least
+        # recently UPDATED. A plain `hash[key] += 1` leaves a key where it was
+        # first inserted, which made the busiest key in the process the first one
+        # evicted.
+        def increment!(hash, key, overflow_key)
+          hash[key] = hash.delete(key).to_i + 1
+
+          # Loops because the overflow bucket takes a slot of its own once it
+          # exists. evict_oldest! returns false when only that bucket is left,
+          # which terminates the loop even with max_cache_size misconfigured to 0.
+          while hash.size > max_cache_size
+            break unless evict_oldest!(hash, overflow_key)
+          end
         end
 
-        # Cheap periodic flush check
-        def maybe_flush!
-          now = Time.now.to_f
-          last_flush = Thread.current[FLUSH_THREAD_KEY] ||= now
-          interval = RailsErrorDashboard.configuration.swallowed_exception_flush_interval
+        # Evict the least recently updated key, folding its count into the
+        # overflow bucket so the total is conserved. The overflow bucket itself is
+        # never the victim. Mirrors RackAttackTracker#evict_oldest!.
+        # @return [Boolean] false once only the overflow bucket remains
+        def evict_oldest!(hash, overflow_key)
+          oldest_key = hash.each_key.find { |k| k != overflow_key }
+          return false unless oldest_key
 
-          return unless (now - last_flush) >= interval
+          dropped = hash.delete(oldest_key).to_i
+          hash[overflow_key] = hash[overflow_key].to_i + dropped if dropped.positive?
+          true
+        end
 
-          flush!
+        # Start the flush clock when the buffer becomes non-empty; a later event
+        # never pushes it out. The old guard (`last_flush ||= now`) was first
+        # evaluated by the SECOND event on a thread, so a lone event had no
+        # deadline at all.
+        def arm_deadline!
+          Thread.current[DEADLINE_THREAD_KEY] ||= monotonic_now
+        end
+
+        # Monotonic: Time.now can jump backwards and would defer the flush.
+        def flush_due?
+          armed_at = Thread.current[DEADLINE_THREAD_KEY]
+          return false if armed_at.nil?
+
+          (monotonic_now - armed_at) >= RailsErrorDashboard.configuration.swallowed_exception_flush_interval.to_f
+        rescue => e
+          false
+        end
+
+        def monotonic_now
+          Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        end
+
+        # Cheap periodic flush check on the :rescue path
+        def maybe_flush!
+          flush! if flush_due?
         end
 
         # Dispatch flush asynchronously via background job (zero I/O in request path).
@@ -263,6 +338,7 @@ module RailsErrorDashboard
             thread[RAISE_THREAD_KEY] = nil
             thread[RESCUE_THREAD_KEY] = nil
             thread[FLUSH_THREAD_KEY] = nil
+            thread[DEADLINE_THREAD_KEY] = nil
 
             dispatch_flush(raise_snapshot, rescue_snapshot, sync: true)
           end

data/lib/rails_error_dashboard/services/url_safety.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module RailsErrorDashboard
+  module Services
+    # Pure algorithm: decide whether a string is safe to use as a link target
+    #
+    # A URL that ends up in an `href` must be absolute http(s). Rails' `link_to`
+    # and ERB escaping stop attribute breakout, but neither rejects a scheme such
+    # as `javascript:` — that has to be an allowlist, and it has to be the same
+    # rule where the value is written and where it is rendered.
+    #
+    # The value is judged exactly as given (no stripping), so what passes here is
+    # byte-for-byte what the caller goes on to store or render.
+    #
+    # @example
+    #   UrlSafety.http_url?("https://github.com/a/b/issues/1") # => true
+    #   UrlSafety.http_url?("javascript:alert(1)")             # => false
+    class UrlSafety
+      # Browsers strip TAB/CR/LF from inside a URL before resolving the scheme,
+      # so "java\tscript:" is live. No legitimate URL contains these or a space.
+      UNSAFE_CHARACTERS = /[[:cntrl:][:space:]]/
+
+      # @param value [String, nil]
+      # @return [Boolean] true only for an absolute http:// or https:// URL with a host
+      def self.http_url?(value)
+        return false unless value.is_a?(String)
+        return false if value.empty? || value.match?(UNSAFE_CHARACTERS)
+
+        uri = URI.parse(value)
+        # URI::HTTPS is a subclass of URI::HTTP
+        uri.is_a?(URI::HTTP) && uri.host.present?
+      rescue URI::InvalidURIError, ArgumentError, EncodingError
+        # ArgumentError/EncodingError: a string with invalid bytes cannot be matched
+        false
+      end
+    end
+  end
+end

data/lib/rails_error_dashboard/services/variable_serializer.rb

@@ -175,19 +175,109 @@ module RailsErrorDashboard
           return { value: label, truncated: false }
         end
 
-        # Fallback: .inspect with truncation
+        # #inspect on an unknown object is arbitrary APPLICATION code, running
+        # on the failure path. Truncating its output bounds what is STORED,
+        # not what it COSTS: an inspect that sleeps or builds a megabyte pays
+        # that in full before a single character is discarded. So the default
+        # is a safe structural summary, and inspect runs only for types the
+        # host app opted in to -- under a wall-clock budget even then.
         max_len = config.local_variable_max_string_length || 200
+
+        # A Struct is serialized MEMBER-WISE, never through its own #inspect.
+        #
+        # Struct was allowlisted because it prints its attributes cheaply --
+        # true of the container, false of what it holds. Struct#inspect calls
+        # each member's #inspect, so a Struct wrapping an unknown object ran
+        # that object's arbitrary code in full. Walking the members instead
+        # gives every one of them the same safe-summary default an unknown
+        # object already gets, so the guarantee holds by construction rather
+        # than by measuring afterwards.
+        return serialize_struct(value, config, depth, max_depth) if struct?(value)
+
+        return { value: safe_summary(value), truncated: false } unless inspectable?(value, config)
+
+        started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         inspected = value.inspect
+        elapsed_ms = (Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000
+
+        # An OUTPUT-selection threshold, not an execution budget: the inspect
+        # above has already run to completion by the time this is measured.
+        # Only reachable for a type the host app explicitly opted in to, and
+        # that opt-in is documented as accepting unbounded execution -- the
+        # only way to interrupt arbitrary Ruby mid-call is Timeout, which is
+        # not safe on the capture path (safety rule 1).
+        budget = config.local_variable_inspect_budget_ms || 5
+        if elapsed_ms > budget
+          RailsErrorDashboard::Logger.debug(
+            "[RailsErrorDashboard] #{value.class}#inspect took #{elapsed_ms.round(1)}ms " \
+            "(budget #{budget}ms) — storing a summary instead"
+          )
+          return { value: safe_summary(value), truncated: true }
+        end
+
         if inspected.length > max_len
           { value: inspected[0, max_len], truncated: true }
         else
           { value: inspected, truncated: false }
         end
       rescue
-        { value: "#<#{value.class.name rescue "Object"}>", truncated: false }
+        { value: safe_summary(value), truncated: false }
       end
       private_class_method :serialize_object
 
+      def self.struct?(value)
+        value.is_a?(Struct)
+      rescue StandardError
+        false
+      end
+      private_class_method :struct?
+
+      # Serialize a Struct's members through the ordinary bounded path.
+      #
+      # Bounded twice over: member count is capped, and each member recurses
+      # with depth + 1, so a Struct of Structs cannot reintroduce unbounded
+      # work through recursion instead of through #inspect.
+      def self.serialize_struct(value, config, depth, max_depth)
+        max_members = config.local_variable_max_array_items || 10
+        members = value.members.first(max_members)
+        truncated = value.members.size > members.size
+
+        pairs = members.map do |member|
+          serialized = serialize_value(value[member], config, depth + 1, max_depth)
+          truncated ||= serialized[:truncated]
+          "#{member}=#{serialized[:value]}"
+        end
+
+        # An anonymous Struct has no class name; label it by shape rather than
+        # rendering "#<struct  a=1>" with a hole in it.
+        label = value.class.name.presence || "struct"
+        { value: "#<#{label} #{pairs.join(', ')}>", truncated: truncated }
+      rescue StandardError
+        { value: safe_summary(value), truncated: false }
+      end
+      private_class_method :serialize_struct
+
+      # What an object is, without asking the object. Costs one class-name read.
+      def self.safe_summary(value)
+        "#<#{value.class.name}>"
+      rescue StandardError
+        "#<Object>"
+      end
+      private_class_method :safe_summary
+
+      # True when this object's class (or an ancestor) is on the allowlist, so
+      # the host app has accepted the cost of its #inspect.
+      def self.inspectable?(value, config)
+        allowlist = Array(config.local_variable_inspect_allowlist)
+        return false if allowlist.empty?
+
+        ancestors = value.class.ancestors.map { |mod| mod.name }.compact
+        (ancestors & allowlist).any?
+      rescue StandardError
+        false
+      end
+      private_class_method :inspectable?
+
       # --- Sensitive data filtering (post-serialization) ---
       # Reuses SensitiveDataFilter.parameter_filter — same pattern as BreadcrumbCollector.
       # Applied AFTER serialization so ParameterFilter works on clean JSON-compatible values.
@@ -215,14 +305,39 @@ module RailsErrorDashboard
             info[:value] = SensitiveDataFilter.send(:filter_message, filter, info[:value])
           end
 
-          # Filter nested hash keys recursively
-          if info[:value].is_a?(Hash)
-            info[:value] = filter_hash_recursive(filter, info[:value])
-          end
-
-          # Filter nested array items
-          if info[:value].is_a?(Array)
-            info[:value] = filter_array_recursive(filter, info[:value])
+          # Path-aware filtering, in ONE call for every container type.
+          #
+          # The value is wrapped back under its own variable name so the filter
+          # sees the SAME key path Rails sees for request params. A dotted
+          # pattern like "profile.private_note" is a path, not a name: dropping
+          # the "profile" segment means the value Rails redacts in params stays
+          # readable here. Unwrapping afterwards leaves the stored shape
+          # unchanged.
+          #
+          # This must NOT ask "what shape is this?" first. Wrapping only Hashes
+          # and sending Arrays straight to the recursive walker is exactly how
+          # `profile = [{ private_note: ... }]` leaked while the identical
+          # request params were redacted: ParameterFilter already traverses
+          # arbitrary nesting of Hash and Array, so one wrap covers every shape
+          # and a new container type cannot reintroduce the gap.
+          #
+          # Parity with Rails is the contract in both directions -- a pattern
+          # that Rails does NOT match (profile.list.private_note, or a bare
+          # scalar) must survive here too. Over-redaction silently destroys
+          # data a developer needs to debug.
+          if info[:value].is_a?(Hash) || info[:value].is_a?(Array)
+            scoped = filter.filter(var_name => info[:value])[var_name]
+
+            # The recursive pass stays, and runs AFTER the path-aware filter:
+            # it scrubs sensitive CONTENT inside strings (credit-card and
+            # key=value patterns), which ParameterFilter does not do -- it only
+            # matches keys.
+            info[:value] =
+              case scoped
+              when Hash  then filter_hash_recursive(filter, scoped)
+              when Array then filter_array_recursive(filter, scoped)
+              else scoped
+              end
           end
         end
 

data/lib/rails_error_dashboard/subscribers/breadcrumb_subscriber.rb

@@ -16,6 +16,18 @@ module RailsErrorDashboard
     class BreadcrumbSubscriber
       SQL_MESSAGE_MAX = 200
 
+      # Where a failing job's trail waits for the reporter.
+      #
+      # ActiveJob reports a job error OUTSIDE the frame that runs
+      # `run_callbacks :perform`: perform_now's `rescue Exception` is one frame
+      # out (activejob execution.rb), and the report itself fires two frames
+      # further out still, from the :execute around-callback that the railtie
+      # registers (ExecutionWrapper.wrap's `rescue Exception` ->
+      # error_reporter.report). By the time LogError runs, our ensure has
+      # already cleared the buffer. So we snapshot on the way out and leave the
+      # snapshot here for LogError to pick up.
+      JOB_TRAIL_KEY = :rails_error_dashboard_job_breadcrumb_trail
+
       # Event subscriptions managed by this class
       @subscriptions = []
 
@@ -38,6 +50,105 @@ module RailsErrorDashboard
           @subscriptions
         end
 
+        # Open a breadcrumb buffer around every Active Job perform, so a job
+        # that fails outside a request still has an activity trail.
+        #
+        # Idempotent: the callback list belongs to ActiveJob::Base, and a
+        # second registration would open and close the buffer twice per job.
+        #
+        # The config check is INSIDE the callback, not around this method.
+        # enable_breadcrumbs defaults to false and the callback list is fixed
+        # once the class loads, so gating registration would permanently
+        # disable job breadcrumbs for any host that enables the feature in an
+        # initializer running after the engine's.
+        # @return [Boolean] true when the callback was installed
+        def install_job_buffer!
+          return false if @job_buffer_installed
+          return false unless defined?(ActiveJob::Base)
+
+          @job_buffer_installed = true
+          ActiveSupport.on_load(:active_job) do
+            around_perform do |job, block|
+              collector = RailsErrorDashboard::Services::BreadcrumbCollector
+              subscriber = RailsErrorDashboard::Subscribers::BreadcrumbSubscriber
+
+              # Drop any snapshot a previous perform on this pooled thread left
+              # behind. This, not the ensure below, is what bounds the leak:
+              # discard_on (and a host rescue_from) can swallow an exception so
+              # that nothing is ever reported and nothing ever consumes the
+              # snapshot. At most one job's serialized trail survives, and only
+              # until this thread's very next perform.
+              Thread.current[subscriber::JOB_TRAIL_KEY] = nil
+
+              owned =
+                if RailsErrorDashboard.configuration.enable_breadcrumbs &&
+                   !subscriber.capture_job?(job)
+                  collector.init_buffer_unless_present
+                else
+                  false
+                end
+
+              completed = false
+              begin
+                block.call
+                completed = true
+              ensure
+                # Snapshot BEFORE clearing, and only when the job did not
+                # finish normally -- see JOB_TRAIL_KEY: the error is reported
+                # two frames outside this one, long after the clear.
+                #
+                # `completed`, not a `rescue Exception`, because retry_on and
+                # discard_on with `report: true` report the error and then
+                # return normally: no exception passes through here, yet the
+                # capture still needs the trail.
+                #
+                # Gated on `owned`: a job running inline inside a request must
+                # not copy out -- or clear -- a buffer the request owns.
+                if owned && !completed
+                  begin
+                    trail = collector.current_breadcrumbs
+                    Thread.current[subscriber::JOB_TRAIL_KEY] = trail if trail.is_a?(Array) && trail.any?
+                  rescue StandardError
+                    nil # never raise from the capture path
+                  end
+                end
+
+                # ensure, always: a worker pool reuses threads, and a
+                # thread-local left behind would leak one job's trail into the
+                # next (safety rule 4).
+                collector.clear_buffer_if_owned(owned)
+              end
+            end
+          end
+          true
+        rescue StandardError => e
+          RailsErrorDashboard::Logger.debug(
+            "[RailsErrorDashboard] install_job_buffer! failed: #{e.class} - #{e.message}"
+          )
+          false
+        end
+
+        # Is the job now performing one of the gem's OWN capture jobs?
+        #
+        # AsyncErrorLoggingJob descends from ActiveJob::Base, so it runs
+        # through the around_perform above like any host job. Opening a buffer
+        # for it collects the gem's own write traffic -- its cache reads for
+        # the application record, its SAVEPOINT/RELEASE SAVEPOINT pairs -- and
+        # the anti-recursion filter does not catch those (it is a substring
+        # test for "rails_error_dashboard_" against the SQL text, and
+        # transaction control carries no table name).
+        #
+        # Today that noise is discarded because the envelope wins in LogError.
+        # Once a failing job's buffer is snapshotted and stored, it would
+        # become the trail on the gem's own failure path. Never open one.
+        # @param job [ActiveJob::Base]
+        # @return [Boolean]
+        def capture_job?(job)
+          job.class.name.to_s.start_with?("RailsErrorDashboard::")
+        rescue StandardError
+          false
+        end
+
         # Remove all breadcrumb subscribers
         def unsubscribe!
           @subscriptions.each do |sub|

data/lib/rails_error_dashboard/subscribers/issue_tracker_subscriber.rb

@@ -78,11 +78,20 @@ module RailsErrorDashboard
 
           if existing
             # Link this record to the existing issue instead of creating a new one
-            error_log.update_columns(
+            link = {
               external_issue_url: existing.external_issue_url,
               external_issue_number: existing.external_issue_number,
               external_issue_provider: existing.external_issue_provider
-            )
+            }
+            # The repository is half the issue's identity. Without it
+            # IssueTrackerClient.for_error falls back to the CONFIGURED repo,
+            # and every later comment/close/reopen for this row would hit
+            # whatever issue has that number there. Same column guard as
+            # LinkExistingIssue.
+            if ErrorLog.column_names.include?("external_issue_repo")
+              link[:external_issue_repo] = existing.external_issue_repo
+            end
+            error_log.update_columns(link)
             return false
           end
 

data/lib/rails_error_dashboard/value_objects/error_context.rb

@@ -7,7 +7,8 @@ module RailsErrorDashboard
     class ErrorContext
       attr_reader :user_id, :request_url, :request_params, :user_agent, :ip_address, :platform,
                   :controller_name, :action_name, :request_id, :session_id,
-                  :http_method, :hostname, :content_type, :request_duration_ms, :environment
+                  :http_method, :hostname, :content_type, :request_duration_ms, :environment,
+                  :occurred_at, :app_version
 
       def initialize(context, source = nil)
         @context = context
@@ -23,6 +24,8 @@ module RailsErrorDashboard
         @action_name = extract_action_name
         @request_id = extract_request_id
         @session_id = extract_session_id
+        @occurred_at = extract_occurred_at
+        @app_version = extract_app_version
         @http_method = extract_http_method
         @hostname = extract_hostname
         @content_type = extract_content_type
@@ -52,12 +55,40 @@ module RailsErrorDashboard
           hostname: hostname,
           content_type: content_type,
           request_duration_ms: request_duration_ms,
-          environment: environment
+          environment: environment,
+          # Both belong in to_h, not only in the readers: LogError builds a
+          # SECOND ErrorContext from this hash on the async path, and a key
+          # missing here is silently dropped there. That hop is what lost
+          # request_id and session_id before.
+          occurred_at: occurred_at,
+          app_version: app_version
         }
       end
 
       private
 
+      # A caller-supplied event time, e.g. a mobile client reporting a failure
+      # that happened while it was offline. Never in the future: a client clock
+      # can be wrong, and a future row would sort above every real error and
+      # never age out of a window.
+      def extract_occurred_at
+        raw = @context[:occurred_at]
+        return nil if raw.blank?
+
+        time = raw.is_a?(String) ? Time.zone.parse(raw) : raw
+        return nil unless time.respond_to?(:to_time)
+
+        [ time, Time.current ].min
+      rescue StandardError
+        nil
+      end
+
+      # The release the REPORTER was running, which for a mobile or frontend
+      # report is the whole point -- it differs from the server's version.
+      def extract_app_version
+        @context[:app_version].presence
+      end
+
       def extract_user_id
         @context[:current_user]&.id ||
           @context[:user_id] ||
@@ -120,12 +151,18 @@ module RailsErrorDashboard
         # Additional context (from mobile apps, etc.)
         params.merge!(@context[:additional_context]) if @context[:additional_context]
 
+        # Caller-supplied metadata, documented by ManualErrorReporter and
+        # previously accepted and discarded.
+        params.merge!(@context[:metadata]) if @context[:metadata].is_a?(Hash)
+
         # Pre-serialized params (from async logging or double-ErrorContext path).
         # LogError creates a second ErrorContext from error_context.to_h which
         # has :request_params as a JSON string but no :request object.
         return @context[:request_params] if params.empty? && @context[:request_params].present?
 
-        params.to_json
+        # Params read off a live request or job object never passed through the
+        # context scrub LogError does, and to_json raises on an invalid byte.
+        Services::EncodingSanitizer.scrub_deep(params).to_json
       end
 
       def extract_user_agent

data/lib/rails_error_dashboard/version.rb

@@ -1,3 +1,3 @@
 module RailsErrorDashboard
-  VERSION = "0.12.1"
+  VERSION = "0.14.0"
 end