rails_error_dashboard 0.14.4 → 0.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd115b4f0fa37f0b90cc22ceea5d5f8db5bdb59ceb40972c3d9ff70c6055a643
-  data.tar.gz: b1339930832c6e108d0e55aae93ad2cf14ed1935fa5af23bee24b9f9f4d8943d
+  metadata.gz: 84ad49626b8dddc0665ed515f3fc8e3357adadddcb5991679324cffa40d2aa2e
+  data.tar.gz: af06a63fb80ded2960e23f6e6c25ace1a741b85e13f014ae4bfbfd4b4b16980a
 SHA512:
-  metadata.gz: 9901f9f6fcc64cf53f71cdf43545e2314fe410638eafb414619159d9955763e8251007b13aa5d02e3967ebfbe4b87fb6dff3700694d27031d67ed39c8281e8ac
-  data.tar.gz: d039b6f3796fad5884ae83bbe374671d5d2f90137747c0f404fd917cbcf8088f3b4101caf5c9b77524562b4e4c2c2ca3581d99abadfc16797d9bd35122c83afc
+  metadata.gz: c3154ebfa3b1d46d497a86cfca33dca5a09ed98127a699e7a9eb17ce3d05380f807172b377a2a824fbffff806e6f1e9a6c6ba96e8cb61802368e81ffc56ea93a
+  data.tar.gz: 571ca72a5e588371357a427c02a2ebed3bf565cf70f03b8c8e5877245e060bd7d8ddff873ae50235ac1c4103c6944d4f5e852c221766f7292225b4af8406ceca

data/README.md

@@ -23,7 +23,7 @@ Open `/red`, then send a test error from its Settings page. No monitoring accoun
 
 [Try the live demo](https://rails-error-dashboard.anjan.dev) (`gandalf` / `youshallnotpass`) · [Read the documentation](https://anjanj.github.io/rails_error_dashboard/) · [View on RubyGems](https://rubygems.org/gems/rails_error_dashboard)
 
-> **Beta:** RED is functional and extensively tested, but configuration and APIs may change before 1.0. Supports Rails 7.0–8.1 and Ruby 3.2–4.0 (CI runs Ruby 3.2–3.4 against every supported Rails version; Ruby 4.0 is verified by the maintainer).
+> **Beta:** RED is functional and extensively tested, but configuration and APIs may change before 1.0. Supports Rails 7.0–8.1 and Ruby 3.2–4.0 (CI runs every Ruby from 3.2 to 4.0 against every supported Rails version).
 
 ## See the Ruby state and Rails runtime health behind every exception
 
@@ -208,6 +208,8 @@ Cross-error N+1 detection grouped by SQL fingerprint, and aggregate deprecation
 
 Requires breadcrumbs to be enabled. Deprecations are seen only when the host's `ActiveSupport::Deprecation` behaviour includes `:notify` (the production default does not) and only inside requests that later raised.
 
+**Missing translations** — opt in with `config.enable_missing_translation_tracking = true` and RED counts every key your app looked up and did not have, by locale, with the first call site, on its own page. No breadcrumbs needed; it wraps `I18n.exception_handler` and delegates to the handler you already had. [Details →](docs/FEATURES.md#missing-translation-tracking)
+
 [Complete documentation →](docs/FEATURES.md#n1-query-detection)
 </details>
 
@@ -232,12 +234,14 @@ Requires breadcrumbs to be enabled. Deprecations are seen only when the host's `
 config.enable_actioncable_tracking = true  # requires enable_breadcrumbs = true
 ```
 
-**ActiveStorage Health** — Track file uploads, downloads, deletes, and existence checks across storage services (Disk, S3, GCS, Azure — any ActiveStorage backend). Dashboard page at `/errors/activestorage_health_summary` with per-service operation counts, average and slowest durations. Helps identify slow storage operations correlating with errors.
+**ActiveStorage Health** — Track file uploads, downloads, deletes, and existence checks across storage services (Disk, S3, GCS, Azure — any ActiveStorage backend). Dashboard page at `/errors/activestorage_health_summary` with per-service operation counts, average and slowest durations. Helps identify slow storage operations correlating with errors. The page opens with a live reachability card (one `exist?` for a key that is never stored, against the configured service), and `GET /error_dashboard/health` reports the same probe as its `active_storage` check.
 
 ```ruby
 config.enable_activestorage_tracking = true  # requires enable_breadcrumbs = true
 ```
 
+**Health Check** — `GET /error_dashboard/health` answers in JSON whether the dashboard itself can still capture and show errors: the error database (`SELECT 1`, tables present), last capture time, the Active Job adapter and Solid Queue config problems, the storm breaker state and the gem version. 503 when the error database is down, so an uptime monitor can watch the watchmen. Authenticated like every other route. [Reference →](docs/API_REFERENCE.md#health-check)
+
 [Complete documentation →](docs/FEATURES.md#job-health-page)
 </details>
 
@@ -390,7 +394,7 @@ config.git_repository_url = "https://github.com/user/repo"  # enables SHA links
 <details>
 <summary><strong>Source Code Integration + Git Blame</strong></summary>
 
-View actual source code directly in error backtraces with +/-7 lines of context. Git blame shows who last modified the code, when, and the commit message. Repository links jump to GitHub/GitLab/Bitbucket at the exact line.
+View actual source code directly in error backtraces, 5 lines before and after the error line by default. Git blame shows who last modified the code, when, and the commit message. Repository links jump to the exact line on GitHub, GitLab, Bitbucket or Codeberg.
 
 ```ruby
 config.enable_source_code_integration = true
@@ -430,7 +434,7 @@ config.llm_model = "gpt-5"
 </details>
 
 <details>
-<summary><strong>Notifications — Slack, Discord, PagerDuty, Email, Webhooks</strong></summary>
+<summary><strong>Notifications — Slack, Discord, Telegram, PagerDuty, Email, Webhooks</strong></summary>
 
 Multi-channel alerting with severity filters, per-error cooldown, milestone threshold alerts, and a per-environment allowlist (`config.notification_environments = %w[production]`) so a staging deploy never pages anyone.
 
@@ -439,6 +443,8 @@ config.enable_slack_notifications = true
 config.slack_webhook_url = ENV['SLACK_WEBHOOK_URL']
 ```
 
+Custom webhooks can carry an HMAC-SHA256 signature (`config.webhook_signing_secret`) so the receiver can verify the sender and reject replays.
+
 [Notification setup guide →](docs/guides/NOTIFICATIONS.md)
 </details>
 
@@ -556,7 +562,8 @@ config.enable_rack_attack_tracking = true
 Capture unhandled exceptions that crash the Ruby process via an `at_exit` hook — the last line of defense.
 
 - Disk-based fallback: writes crash data to disk because the database may be unavailable during shutdown
-- Imported automatically on next boot
+- Imported automatically on next boot; a crash that repeats on every restart is one row with a count
+- Boot crashes too: the hook is registered before Rails eager-loads, so a `Zeitwerk::NameError` or a `SyntaxError` that kills the process before it serves a request lands on the **Boot Errors** page under Diagnostics, with the file and constant it names
 - Captures exception details, backtrace, uptime, GC stats, thread count, and cause chain
 - Honeybadger, Bugsnag and AppSignal have `at_exit` reporters too; RED's writes to disk and imports at next boot because the database may already be gone during shutdown
 
@@ -570,14 +577,18 @@ config.enable_crash_capture = true
 <details>
 <summary><strong>Plugin System</strong></summary>
 
-Event-driven extensibility with hooks for `on_error_logged`, `on_error_resolved`, `on_threshold_exceeded`. Built-in examples for Jira integration, metrics tracking, and audit logging.
+Event-driven extensibility with hooks such as `on_error_logged`, `on_error_reopened` and `on_error_resolved` (eleven in all). Built-in examples for Jira integration, metrics tracking, and audit logging.
 
 ```ruby
 class MyPlugin < RailsErrorDashboard::Plugin
+  def name = "My Plugin"
+
   def on_error_logged(error_log)
     # Your custom logic
   end
 end
+
+RailsErrorDashboard.register_plugin(MyPlugin.new)
 ```
 
 [Plugin System guide →](docs/PLUGIN_SYSTEM.md)
@@ -721,7 +732,7 @@ Users can also switch language per-session from the picker in the dashboard navb
 
 **Corrections are very welcome, and a one-key PR is a perfectly good PR.** If you read one of these languages, [every unreviewed locale has an open issue](https://github.com/AnjanJ/rails_error_dashboard/issues?q=is%3Aissue+is%3Aopen+label%3Atranslation%3Aneeds-review) tracking its review — comment there, or [report a bad translation](https://github.com/AnjanJ/rails_error_dashboard/issues/new?template=translation_report.yml) without touching any code. You do not need to know Ruby, and you are not expected to review a whole file.
 
-RED translates through its own private I18n backend, so it never reads, writes or mutates your application's `I18n` configuration — your locale and its `available_locales` are untouched.
+RED translates through its own private I18n backend, so it never reads, writes or mutates your application's `I18n` configuration — your locale and its `available_locales` are untouched. The one exception is opt-in: `enable_missing_translation_tracking` wraps `I18n.exception_handler` to count *your* app's missing keys, and delegates every call to the handler you had.
 
 [Translations guide →](docs/guides/TRANSLATIONS.md) — how the system works, how to correct a string, and how to add a locale.
 
@@ -779,7 +790,7 @@ Rails 7.0–8.1 and Ruby 3.2–4.0.
 ### Advanced
 - **[Multi-App Support](docs/MULTI_APP_PERFORMANCE.md)** — Track multiple applications
 - **[Plugin System](docs/PLUGIN_SYSTEM.md)** — Build custom integrations
-- **[API Reference](docs/API_REFERENCE.md)** — Complete API documentation
+- **[API Reference](docs/API_REFERENCE.md)** — The dashboard's HTTP routes and the Ruby API
 - **[Customization](docs/CUSTOMIZATION.md)** — Customize everything
 - **[Database Options](docs/guides/DATABASE_OPTIONS.md)** — Separate database setup
 - **[Database Optimization](docs/guides/DATABASE_OPTIMIZATION.md)** — Performance tuning

data/app/controllers/rails_error_dashboard/application_controller.rb

@@ -227,15 +227,39 @@ module RailsErrorDashboard
     end
 
     # Page size for every paginated action. Only the upper bound is enforced
-    # here: a value that is not a positive integer is passed through unchanged
-    # so that Pagy rejects it and the rescue above redirects, as it always has.
+    # here: a value Pagy would reject (0, a negative number, a Hash) is passed
+    # on so that it does and the rescue above redirects, as it always has.
+    #
+    # Strings are read the way Pagy reads them, with to_i, so the cap sees the
+    # same number Pagy would use: Integer() refused "150.5" and "0999" and the
+    # raw string went through, where Pagy's to_i made them 150 and 999.
     def per_page_param
       raw = params[:per_page]
       return DEFAULT_PER_PAGE if raw.blank?
 
-      number = Integer(raw, exception: false) if raw.is_a?(String)
-      number && number > MAX_PER_PAGE ? MAX_PER_PAGE : raw
+      value = raw.is_a?(String) ? raw.to_i : raw
+      value.is_a?(Integer) && value > MAX_PER_PAGE ? MAX_PER_PAGE : value
+    end
+
+    # The named query-string keys as a symbol-keyed Hash of their String values.
+    #
+    # Not params.permit: permit judges every key in the request, so a stray
+    # utm_source, or the `page` and `locale` the dashboard itself appends, was
+    # an "unpermitted parameter" on every index request. Under the default
+    # that is a log line; in a host with action_on_unpermitted_parameters =
+    # :raise it was a 500 on the errors page. Picking the keys we want and
+    # keeping only scalar values does what permit was meant to do here without
+    # passing judgement on the rest of the request.
+    #
+    # @param keys [Array<Symbol>]
+    # @return [Hash{Symbol => String}]
+    def scalar_params(keys)
+      keys.each_with_object({}) do |key, hash|
+        value = params[key]
+        hash[key] = value if value.is_a?(String)
+      end
     end
+    helper_method :scalar_params
 
     def render_dashboard_error(icon:, title:, message:, detail: nil, icon_style: nil, status: :internal_server_error)
       # The styled page runs queries and names the host app's applications. A

data/app/controllers/rails_error_dashboard/errors_controller.rb

@@ -119,6 +119,11 @@ module RailsErrorDashboard
       @related_errors = @error.related_errors(limit: 5, application_id: @current_application_id)
       @error_markdown = Services::MarkdownErrorFormatter.call(@error, related_errors: @related_errors)
 
+      # ?occurrence=ID: the context cards show that occurrence's stored context
+      @occurrence_context = find_occurrence_context(@error)
+      @snapshot = @occurrence_context ? ValueObjects::OccurrenceSnapshot.build(@error, @occurrence_context) : @error
+      @captured_occurrences = captured_occurrences(@error)
+
       # Fetch platform issue state and comments if linked
       @platform_issue = fetch_platform_issue(@error)
       @platform_comments = fetch_platform_comments(@error)
@@ -279,8 +284,6 @@ module RailsErrorDashboard
       @errors_by_hour = analytics[:errors_by_hour]
       @top_users = analytics[:top_users]
       @resolution_rate = analytics[:resolution_rate]
-      @mobile_errors = analytics[:mobile_errors]
-      @api_errors = analytics[:api_errors]
 
       # Get recurring issues data (pass application filter)
       recurring = Queries::RecurringIssues.call(days, application_id: @current_application_id)
@@ -583,6 +586,52 @@ module RailsErrorDashboard
       @pagy, @events = pagy(:offset, all_events, limit: per_page_param)
     end
 
+    def missing_translations
+      unless RailsErrorDashboard.configuration.enable_missing_translation_tracking
+        flash[:alert] = feature_disabled_message("missing_translations", options: "enable_missing_translation_tracking = true", set: true)
+        redirect_to errors_path(**app_context_params)
+        return
+      end
+
+      days = days_param(default: 30)
+      @days = days
+      result = Queries::MissingTranslationSummary.call(days, application_id: @current_application_id)
+      all_entries = result[:entries]
+
+      # Summary stats (computed before pagination). The list is one row per
+      # (locale, key), so the badge and pagination count rows; the tile
+      # counts distinct keys, which is what "how many keys are missing" means.
+      @entry_count = all_entries.size
+      @unique_keys = all_entries.map { |e| e[:key] }.uniq.size
+      @total_misses = all_entries.sum { |e| e[:count] }
+      @locale_count = result[:locales].size
+      # Misses the tracker's bounded buffer dropped; shown so the total above
+      # is never silently understated.
+      @overflow_count = result[:overflow_count].to_i
+
+      @pagy, @entries = pagy(:offset, all_entries, limit: per_page_param)
+    end
+
+    def boot_errors
+      unless RailsErrorDashboard.configuration.enable_crash_capture
+        flash[:alert] = feature_disabled_message("boot_errors", options: "enable_crash_capture = true", set: true)
+        redirect_to errors_path(**app_context_params)
+        return
+      end
+
+      days = days_param(default: 30)
+      @days = days
+      result = Queries::BootErrors.call(days, application_id: @current_application_id)
+      all_entries = result[:entries]
+
+      # Summary stats (computed before pagination)
+      @entry_count = all_entries.size
+      @unresolved_count = result[:unresolved_count]
+      @total_occurrences = all_entries.sum { |e| e[:count] }
+
+      @pagy, @entries = pagy(:offset, all_entries, limit: per_page_param)
+    end
+
     def actioncable_health_summary
       unless RailsErrorDashboard.configuration.enable_actioncable_tracking &&
              RailsErrorDashboard.configuration.enable_breadcrumbs
@@ -634,6 +683,9 @@ module RailsErrorDashboard
 
       days = days_param(default: 30)
       @days = days
+      # Live reachability of the configured service, shown above the
+      # historical breadcrumb stats. One existence check per page load.
+      @storage_probe = Services::ActiveStorageProbe.call
       result = Queries::ActiveStorageSummary.call(days, application_id: @current_application_id)
       all_services = result[:services]
 
@@ -719,7 +771,17 @@ module RailsErrorDashboard
       )
       exception.set_backtrace(caller)
 
-      Commands::LogError.call(exception, { request: request, source: "dashboard.test_error" })
+      started_at = Time.current
+      error_log = Commands::LogError.call(exception, { request: request, source: "dashboard.test_error" })
+
+      # The capture path notifies on a first occurrence and then on the
+      # 10th, 50th... A second click within 24 hours is occurrence two of the
+      # same row, so it used to notify nobody, which reads as "notifications
+      # are broken". This button exists to prove delivery: if the capture
+      # path did not claim a notification in this request, send one now.
+      if error_log && !notified_since?(error_log, started_at)
+        Services::ErrorNotificationDispatcher.call(error_log)
+      end
 
       flash[:notice] = red_t("red.flash.test_error.logged")
       redirect_to errors_path(**app_context_params)
@@ -785,7 +847,14 @@ module RailsErrorDashboard
     end
 
     def filter_params
-      params.permit(*FILTERABLE_PARAMS).to_h.symbolize_keys
+      scalar_params(FILTERABLE_PARAMS)
+    end
+
+    # True when NotificationThrottler claimed a notification for this error
+    # at or after +since+. The claim is an update_all, so the row is re-read.
+    def notified_since?(error_log, since)
+      stamp = error_log.class.where(id: error_log.id).pick(:last_notified_at)
+      stamp.present? && stamp >= since
     end
 
     # Coerce params[:days] into a sane integer in [1, 365]. Without clamping,
@@ -835,6 +904,30 @@ module RailsErrorDashboard
       red_t("red.errors.row.status.#{status}", default: status.to_s.tr("_", " "))
     end
 
+    # Looked up through the error, so another error's occurrence id finds
+    # nothing. nil (the page shows the latest snapshot) when there is no id, it
+    # is foreign or unknown, or its context is no longer kept.
+    def find_occurrence_context(error)
+      return if params[:occurrence].blank?
+      # An app that updated the gem but has not migrated yet
+      return unless ErrorOccurrenceContext.table_exists?
+
+      error.occurrence_contexts.find_by(error_occurrence_id: params[:occurrence])
+    end
+
+    # This error's occurrences that still have a stored context, newest first.
+    # The context table is read for its occurrence ids only, so listing them
+    # never loads the stored payloads.
+    def captured_occurrences(error)
+      return [] unless ErrorOccurrenceContext.table_exists?
+
+      error.error_occurrences
+        .where(id: ErrorOccurrenceContext.where(error_log_id: error.id).select(:error_occurrence_id))
+        .order(occurred_at: :desc, id: :desc)
+        .select(:id, :occurred_at, :app_version, :git_sha)
+        .to_a
+    end
+
     def fetch_platform_issue(error)
       return nil unless error.external_issue_url.present? && error.external_issue_number.present?
       return nil unless RailsErrorDashboard.configuration.enable_issue_tracking

data/app/controllers/rails_error_dashboard/health_controller.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  # GET /health — can the dashboard itself still capture and show errors?
+  #
+  # JSON only, for an uptime monitor: 200 when the error database answers,
+  # 503 when it does not (status "down"). "degraded" (a storm in progress,
+  # a Solid Queue config that will not run RED's jobs) is still a 200: the
+  # dashboard works, with a caveat the body spells out. See
+  # Queries::HealthStatus for what is probed and why.
+  #
+  # Authenticated like every other dashboard route (ApplicationController
+  # prepends the filter): the body names the database adapter and the queue
+  # backend, which is more than an anonymous caller should learn. Basic auth
+  # works from any monitor; with authenticate_with, point the monitor at
+  # whatever that lambda accepts.
+  #
+  # Its own controller rather than an ErrorsController action: no
+  # application context, no storm banner, no error data is loaded here.
+  class HealthController < ApplicationController
+    # ApplicationController's handler renders the HTML error page. A health
+    # endpoint must answer in JSON whatever happens, so this one, declared
+    # later, takes precedence.
+    rescue_from StandardError do |exception|
+      Rails.logger.error("[RailsErrorDashboard] Health check failed: #{exception.class} - #{exception.message}")
+      render json: { status: Queries::HealthStatus::DOWN, version: RailsErrorDashboard::VERSION,
+                     error: exception.class.name },
+             status: :service_unavailable
+    end
+
+    def show
+      result = Queries::HealthStatus.call
+
+      response.headers["Cache-Control"] = "no-store"
+      render json: result, status: Queries::HealthStatus.http_status_for(result)
+    end
+  end
+end

data/app/controllers/rails_error_dashboard/webhooks_controller.rb

@@ -14,7 +14,12 @@ module RailsErrorDashboard
   class WebhooksController < ActionController::Base
     skip_before_action :verify_authenticity_token
 
+    PROVIDERS = %w[github gitlab codeberg linear].freeze
+
     before_action :verify_webhook_enabled
+    # Before the signature check: an unknown provider is a wrong URL, and a 401
+    # would send the sender looking at a secret that is fine
+    before_action :verify_provider
     before_action :verify_signature
 
     def receive
@@ -32,9 +37,6 @@ module RailsErrorDashboard
         handle_codeberg(payload)
       when "linear"
         handle_linear(payload)
-      else
-        head :not_found
-        return
       end
 
       head :ok
@@ -52,16 +54,15 @@ module RailsErrorDashboard
       end
     end
 
+    def verify_provider
+      head :not_found unless PROVIDERS.include?(params[:provider])
+    end
+
     def verify_signature
       provider = params[:provider]
+      # Present: verify_webhook_enabled answers 404 without it
       secret = RailsErrorDashboard.configuration.issue_webhook_secret
 
-      unless secret.present?
-        Rails.logger.warn("[RailsErrorDashboard] Webhook received but no issue_webhook_secret configured")
-        head :unauthorized
-        return
-      end
-
       body = request.body.read
       request.body.rewind
 

data/app/helpers/rails_error_dashboard/application_helper.rb

@@ -163,8 +163,8 @@ module RailsErrorDashboard
     # @return [Hash] Whitelisted params for building URLs
     def permitted_filter_params(extra_keys: [])
       base_keys = RailsErrorDashboard::ErrorsController::FILTERABLE_PARAMS + %i[page per_page days]
-      allowed_keys = base_keys + Array(extra_keys)
-      params.permit(*allowed_keys).to_h.symbolize_keys
+      # scalar_params, not params.permit: see ApplicationController#scalar_params.
+      scalar_params(base_keys + Array(extra_keys))
     end
 
     # Generates a sortable column header link

data/app/helpers/rails_error_dashboard/backtrace_helper.rb

@@ -7,6 +7,59 @@ module RailsErrorDashboard
     # one view context.
     include I18nHelper
 
+    # The brand name for a repository link's tooltip, from the URL's host.
+    # A substring test on the whole URL called every non-GitHub, non-GitLab
+    # host "Bitbucket", Codeberg included, and a path containing "github"
+    # mislabelled any host.
+    def repository_host_label(url)
+      host = URI.parse(url.to_s).host.to_s.downcase
+      case host
+      when /github/    then "GitHub"
+      when /gitlab/    then "GitLab"
+      when /bitbucket/ then "Bitbucket"
+      when /codeberg/  then "Codeberg"
+      when /gitea/     then "Gitea"
+      when /forgejo/   then "Forgejo"
+      else host.presence || "Repository"
+      end
+    rescue URI::InvalidURIError
+      "Repository"
+    end
+
+    # The error-info fragment renders the source viewer, blame, repository
+    # links and the coverage overlay, none of which come from the error row
+    # the fragment is keyed on. These three helpers put the rest of the key's
+    # inputs in: the configuration those parts depend on, the source cache
+    # TTL as the fragment's lifetime, and no caching at all while coverage is
+    # active, because that overlay is live data.
+    def source_view_cache_key
+      config = RailsErrorDashboard.configuration
+      # The gem version too, for the same reason as read_source_code's key
+      parts = [
+        RailsErrorDashboard::VERSION,
+        config.enable_source_code_integration, config.enable_git_blame, config.only_show_app_code_source,
+        config.git_repository_url, config.git_branch_strategy
+      ]
+      Digest::SHA1.hexdigest(parts.map(&:to_s).join("|"))[0, 12]
+    rescue StandardError
+      "nocfg"
+    end
+
+    def source_view_cacheable?
+      !(defined?(Services::CoverageTracker) && Services::CoverageTracker.active?)
+    rescue StandardError
+      true
+    end
+
+    def source_view_cache_options
+      config = RailsErrorDashboard.configuration
+      return {} unless config.enable_source_code_integration
+
+      { expires_in: (config.source_code_cache_ttl || 3600).to_i.seconds }
+    rescue StandardError
+      {}
+    end
+
     # Language mapping for syntax highlighting
     LANGUAGE_MAP = {
       ".rb" => "ruby",
@@ -152,8 +205,9 @@ module RailsErrorDashboard
       return nil unless RailsErrorDashboard.configuration.enable_source_code_integration
       return nil unless frame[:file_path] && frame[:line_number]
 
-      # Cache key includes file path, line number, and git SHA if available
-      cache_key = "source_code/#{frame[:file_path]}/#{frame[:line_number]}"
+      # The gem version is in the key: a cached read must not outlive a change
+      # to the reader's rules for which files it may read.
+      cache_key = "source_code/#{RailsErrorDashboard::VERSION}/#{frame[:file_path]}/#{frame[:line_number]}"
       cache_ttl = RailsErrorDashboard.configuration.source_code_cache_ttl || 3600
 
       Rails.cache.fetch(cache_key, expires_in: cache_ttl) do
@@ -238,15 +292,19 @@ module RailsErrorDashboard
 
     # Determine which commit SHA to use based on strategy
     def determine_commit_sha(error_log)
-      strategy = RailsErrorDashboard.configuration.git_branch_strategy || :commit_sha
+      # A String (from ENV, say) means the same as the Symbol
+      strategy = (RailsErrorDashboard.configuration.git_branch_strategy || :commit_sha).to_s.to_sym
 
       case strategy
       when :commit_sha
         # Use the SHA from when the error occurred (most accurate)
         error_log.respond_to?(:git_sha) ? error_log.git_sha : nil
       when :current_branch
-        # Use current branch HEAD
-        get_current_git_sha
+        # The commit this process is running: config.git_sha, the deploy ENV
+        # variables, then the .git HEAD read once at boot. Never `git rev-parse`
+        # here: this renders on a host request thread, and a subprocess with
+        # no timeout is the pattern the capture path already removed.
+        Commands::LogError.capture_git_sha
       when :main
         # Use main/master branch
         nil # Will default to "main" in GithubLinkGenerator
@@ -254,16 +312,5 @@ module RailsErrorDashboard
         nil
       end
     end
-
-    # Get current git SHA from repository
-    def get_current_git_sha
-      return @current_git_sha if defined?(@current_git_sha)
-
-      @current_git_sha = begin
-        `git rev-parse HEAD 2>/dev/null`.strip.presence
-      rescue StandardError
-        nil
-      end
-    end
   end
 end

data/app/helpers/rails_error_dashboard/overview_helper.rb

@@ -67,6 +67,8 @@ module RailsErrorDashboard
         "success"
       when :warning
         "warning"
+      when :not_rated
+        "secondary"
       else
         "danger"
       end
@@ -82,6 +84,8 @@ module RailsErrorDashboard
         red_t("red.common.health_status.healthy")
       when :warning
         red_t("red.common.health_status.warning")
+      when :not_rated
+        red_t("red.common.health_status.not_rated")
       else
         red_t("red.common.health_status.critical")
       end

data/app/jobs/rails_error_dashboard/baseline_alert_job.rb

@@ -59,6 +59,11 @@ module RailsErrorDashboard
         send_discord_notification(error_log, anomaly_data, config, locale)
       end
 
+      # Telegram notification
+      if Services::TelegramDelivery.configured?(config)
+        send_telegram_notification(error_log, anomaly_data, config, locale)
+      end
+
       # Webhook notification
       if config.enable_webhook_notifications && config.webhook_urls.any?
         send_webhook_notification(error_log, anomaly_data, config, locale)
@@ -96,11 +101,24 @@ module RailsErrorDashboard
       Rails.logger.error("Failed to send baseline alert to Discord: #{e.message}")
     end
 
+    def send_telegram_notification(error_log, anomaly_data, _config, locale)
+      payload = Services::BaselineAlertPayloadBuilder.telegram_payload(error_log, anomaly_data, locale: locale)
+
+      Services::TelegramDelivery.post(payload)
+    rescue => e
+      Rails.logger.error("Failed to send baseline alert to Telegram: #{Services::TelegramDelivery.redact(e.message)}")
+    end
+
     def send_webhook_notification(error_log, anomaly_data, config, locale)
       payload = Services::BaselineAlertPayloadBuilder.webhook_payload(error_log, anomaly_data, locale: locale)
 
+      # Signed when webhook_signing_secret is set; Slack and Discord above
+      # keep post_json because their payloads are not ours to sign. Rescued
+      # per URL so one unreachable receiver does not stop the next.
       config.webhook_urls.each do |url|
-        post_json(url, payload)
+        Services::WebhookDelivery.post(url, payload)
+      rescue => e
+        Rails.logger.error("Failed to send baseline alert to webhook: #{e.message}")
       end
     rescue => e
       Rails.logger.error("Failed to send baseline alert to webhook: #{e.message}")
@@ -116,7 +134,7 @@ module RailsErrorDashboard
         http.use_ssl = uri.scheme == "https"
         http.open_timeout = 5
         http.read_timeout = 10
-        request = Net::HTTP::Post.new(uri.path, { "Content-Type" => "application/json" })
+        request = Net::HTTP::Post.new(uri.request_uri, { "Content-Type" => "application/json" })
         request.body = payload.to_json
         http.request(request)
       end

data/app/jobs/rails_error_dashboard/cascade_detection_job.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  # Finds error cascades (A reliably followed by B) in recent occurrences and
+  # upserts them as CascadePattern rows, which the error page's Cascades card
+  # reads.
+  #
+  # Nothing in the gem schedules this: run it from the host's scheduler like
+  # the other periodic jobs (docs/PRODUCTION.md). Before this job existed the
+  # docs said cascades were detected "hourly" by a background job that no
+  # code path ever ran, so the card stayed empty on every install.
+  #
+  # Use a lookback equal to the interval it runs at: an hourly run with a
+  # 24-hour lookback re-counts the same pairs 24 times a day.
+  class CascadeDetectionJob < ApplicationJob
+    queue_as :default
+
+    # @param lookback_hours [Integer] the window of occurrences to scan
+    def perform(lookback_hours: 1)
+      return { detected: 0, updated: 0, skipped: "enable_error_cascades is off" } unless RailsErrorDashboard.configuration.enable_error_cascades
+
+      result = Services::CascadeDetector.call(lookback_hours: lookback_hours.to_i.clamp(1, 24 * 30))
+      Rails.logger.info("[RailsErrorDashboard] Cascade detection: #{result[:detected]} detected, #{result[:updated]} updated")
+      result
+    rescue => e
+      Rails.logger.error("[RailsErrorDashboard] CascadeDetectionJob failed: #{e.class}: #{e.message}")
+      raise
+    end
+  end
+end