rails_error_dashboard 0.9.1 → 0.11.0

data/lib/rails_error_dashboard/services/ai_agent_classifier.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  module Services
+    # Classifies a User-Agent string into a coarse traffic kind, and names the
+    # agent when it is a recognised one.
+    #
+    # WHY THIS EXISTS (issue #170): tracking which AI agents read an app is the
+    # reason people reach for Rack::Attack's `track` rules now. Counting IPs
+    # cannot answer it — one agent is a rotating fleet of hundreds of addresses,
+    # so unique-IP totals overstate the population badly. The user agent is the
+    # signal that actually identifies the reader.
+    #
+    # Deliberately plain string matching, NOT the `browser` gem: `browser` is an
+    # optional dependency that degrades gracefully everywhere else in this gem,
+    # and it does not know these agents anyway. This runs on the flush path, not
+    # the request path, but it stays allocation-cheap regardless.
+    #
+    # The bot lists are necessarily a snapshot. An unrecognised agent falls back
+    # to :other rather than being guessed at — a wrong attribution is worse than
+    # an honest "unknown" when the whole point is measurement.
+    class AiAgentClassifier
+      # Order matters: the first match wins, so more specific patterns lead.
+      #
+      # AI agents split into two behaviours worth telling apart, because they
+      # answer different questions:
+      # - :ai_assistant — fetches on demand, because a human asked something now
+      # - :ai_crawler   — bulk-fetches to build a training corpus or index
+      AI_ASSISTANTS = {
+        "ChatGPT-User" => /ChatGPT-User/i,
+        "Claude-User" => /Claude-User/i,
+        "Claude Code" => /Claude-?Code/i,
+        "Perplexity-User" => /Perplexity-User/i,
+        "Gemini-User" => /Gemini-User/i
+      }.freeze
+
+      AI_CRAWLERS = {
+        "GPTBot" => /GPTBot/i,
+        "OAI-SearchBot" => /OAI-SearchBot/i,
+        "ClaudeBot" => /ClaudeBot/i,
+        "anthropic-ai" => /anthropic-ai/i,
+        "PerplexityBot" => /PerplexityBot/i,
+        "Google-Extended" => /Google-Extended/i,
+        "Applebot-Extended" => /Applebot-Extended/i,
+        "Bytespider" => /Bytespider/i,
+        "CCBot" => /CCBot/i,
+        "Meta-ExternalAgent" => /Meta-ExternalAgent/i,
+        "Amazonbot" => /Amazonbot/i,
+        "cohere-ai" => /cohere-ai/i,
+        "DuckAssistBot" => /DuckAssistBot/i,
+        "YouBot" => /YouBot/i,
+        "Diffbot" => /Diffbot/i,
+        "Timpibot" => /Timpibot/i
+      }.freeze
+
+      # Conventional search/SEO crawlers. Not AI traffic, but worth naming so
+      # they can be excluded rather than silently inflating an "unknown" bucket.
+      CRAWLERS = {
+        "Googlebot" => /Googlebot/i,
+        "Bingbot" => /bingbot/i,
+        "DuckDuckBot" => /DuckDuckBot/i,
+        "Baiduspider" => /Baiduspider/i,
+        "YandexBot" => /YandexBot/i,
+        "AhrefsBot" => /AhrefsBot/i,
+        "SemrushBot" => /SemrushBot/i,
+        "Applebot" => /Applebot/i,
+        "facebookexternalhit" => /facebookexternalhit/i,
+        "LLMS-Txt-Scanner" => /LLMS-Txt-Scanner/i
+      }.freeze
+
+      # Checked only after every bot pattern has missed, because plenty of bots
+      # embed a full browser UA string and would match these first.
+      BROWSER_HINTS = /Mozilla|Chrome|Safari|Firefox|Edge|Opera|Gecko|WebKit/i
+
+      # Non-browser HTTP clients — usually scripts, monitors or scrapers.
+      LIBRARIES = {
+        "curl" => /\bcurl\//i,
+        "wget" => /\bWget\//i,
+        "python-requests" => /python-requests/i,
+        "httpx" => /\bhttpx\//i,
+        "Go-http-client" => /Go-http-client/i,
+        "Java" => /\bJava\//i,
+        "okhttp" => /\bokhttp\//i,
+        "axios" => /\baxios\//i,
+        "Faraday" => /Faraday/i,
+        "RubyGems" => /Ruby\b/i
+      }.freeze
+
+      KINDS = %i[ai_assistant ai_crawler crawler browser library other].freeze
+
+      class << self
+        # @param user_agent [String, nil]
+        # @return [Symbol] one of KINDS
+        def kind(user_agent)
+          ua = user_agent.to_s
+          return :other if ua.strip.empty?
+
+          return :ai_assistant if match_name(AI_ASSISTANTS, ua)
+          return :ai_crawler if match_name(AI_CRAWLERS, ua)
+          return :crawler if match_name(CRAWLERS, ua)
+          return :library if match_name(LIBRARIES, ua)
+          return :browser if ua.match?(BROWSER_HINTS)
+
+          :other
+        rescue => e
+          :other
+        end
+
+        # Canonical name for a recognised agent, or nil when unrecognised.
+        # Never invents a name — callers show the raw UA in that case.
+        #
+        # @param user_agent [String, nil]
+        # @return [String, nil]
+        def name(user_agent)
+          ua = user_agent.to_s
+          return nil if ua.strip.empty?
+
+          match_name(AI_ASSISTANTS, ua) ||
+            match_name(AI_CRAWLERS, ua) ||
+            match_name(CRAWLERS, ua) ||
+            match_name(LIBRARIES, ua)
+        rescue => e
+          nil
+        end
+
+        # Whether this agent is an LLM reader of either flavour. This is the
+        # predicate the dashboard's "AI agents" figure counts.
+        #
+        # @param user_agent [String, nil]
+        # @return [Boolean]
+        def ai?(user_agent)
+          %i[ai_assistant ai_crawler].include?(kind(user_agent))
+        end
+
+        # @return [Hash] { kind:, name:, ai: } — one pass for callers that want all three
+        def classify(user_agent)
+          k = kind(user_agent)
+          {
+            kind: k,
+            name: name(user_agent),
+            ai: %i[ai_assistant ai_crawler].include?(k)
+          }
+        end
+
+        private
+
+        def match_name(table, ua)
+          table.each { |agent_name, pattern| return agent_name if ua.match?(pattern) }
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/rails_error_dashboard/services/discord_payload_builder.rb

@@ -47,6 +47,7 @@ module RailsErrorDashboard
                 value: error_log.platform || unknown,
                 inline: true
               },
+              *environment_fields(error_log, locale),
               {
                 name: NotificationHelpers.label(:occurrences, locale),
                 value: error_log.occurrence_count.to_s,
@@ -84,6 +85,13 @@ module RailsErrorDashboard
 
       # @param error_log [ErrorLog] The error
       # @return [Integer] Discord color integer
+      # One field when the error carries an environment, none for a legacy row.
+      def self.environment_fields(error_log, locale)
+        return [] unless error_log.respond_to?(:environment) && error_log.environment.present?
+
+        [ { name: NotificationHelpers.label(:environment, locale), value: error_log.environment, inline: true } ]
+      end
+
       def self.severity_color(error_log)
         SEVERITY_COLORS[error_log.severity] || DEFAULT_COLOR
       end

data/lib/rails_error_dashboard/services/error_broadcaster.rb

@@ -23,9 +23,11 @@ module RailsErrorDashboard
 
         platforms = ErrorLog.distinct.pluck(:platform).compact
         show_platform = platforms.size > 1
+        show_environment = ErrorLog.column_names.include?("environment") &&
+                           ErrorLog.distinct.pluck(:environment).compact.size > 1
 
         html = render_partial("rails_error_dashboard/errors/error_row",
-          error: error_log, show_platform: show_platform)
+          error: error_log, show_platform: show_platform, show_environment: show_environment)
 
         Turbo::StreamsChannel.broadcast_prepend_to(
           "error_list",
@@ -46,9 +48,11 @@ module RailsErrorDashboard
 
         platforms = ErrorLog.distinct.pluck(:platform).compact
         show_platform = platforms.size > 1
+        show_environment = ErrorLog.column_names.include?("environment") &&
+                           ErrorLog.distinct.pluck(:environment).compact.size > 1
 
         html = render_partial("rails_error_dashboard/errors/error_row",
-          error: error_log, show_platform: show_platform)
+          error: error_log, show_platform: show_platform, show_environment: show_environment)
 
         Turbo::StreamsChannel.broadcast_replace_to(
           "error_list",

data/lib/rails_error_dashboard/services/issue_body_formatter.rb

@@ -104,6 +104,7 @@ module RailsErrorDashboard
 
       def metadata_section
         items = []
+        items << "- **Environment:** #{@error.environment}" if @error.respond_to?(:environment) && @error.environment.present?
         items << "- **Platform:** #{@error.platform}" if @error.platform.present?
         items << "- **First seen:** #{@error.first_seen_at&.utc&.strftime("%Y-%m-%d %H:%M:%S UTC")}" if @error.first_seen_at
         items << "- **Occurrences:** #{@error.occurrence_count}" if @error.occurrence_count

data/lib/rails_error_dashboard/services/markdown_error_formatter.rb

@@ -435,6 +435,7 @@ module RailsErrorDashboard
 
       def metadata_section
         items = []
+        items << "- **Environment:** #{@error.environment}" if @error.respond_to?(:environment) && @error.environment.present?
         items << "- **Platform:** #{@error.platform}" if @error.platform.present?
         items << "- **First seen:** #{@error.first_seen_at&.utc&.strftime("%Y-%m-%d %H:%M:%S UTC")}" if @error.first_seen_at
         items << "- **Occurrences:** #{@error.occurrence_count}" if @error.occurrence_count

data/lib/rails_error_dashboard/services/notification_throttler.rb

@@ -29,6 +29,29 @@ module RailsErrorDashboard
           true
         end
 
+        # Does this error's environment pass config.notification_environments?
+        #
+        # nil list → everything notifies (the pre-0.11 behaviour). Accepts an
+        # ErrorLog, a bare environment name, or nothing (the process
+        # environment) — the storm and baseline paths have no row to hand over.
+        # A legacy row with a NULL environment is judged as the process
+        # environment, so upgrading never silences an error that was notifying
+        # before. Fails open: an allowlist bug must not lose a page.
+        #
+        # @param subject [ErrorLog, String, nil]
+        # @return [Boolean]
+        def environment_allowed?(subject = nil)
+          allowed = RailsErrorDashboard.configuration.notification_environments
+          return true if allowed.nil?
+
+          name = subject.respond_to?(:environment) ? subject.environment : subject
+          name = RailsErrorDashboard.configuration.current_environment if name.blank?
+          allowed.include?(name.to_s)
+        rescue => e
+          RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] NotificationThrottler.environment_allowed? failed: #{e.message}")
+          true
+        end
+
         # Does the error's severity meet the configured minimum?
         # @param error_log [ErrorLog] The error to check
         # @return [Boolean] true if severity is at or above minimum

data/lib/rails_error_dashboard/services/pagerduty_payload_builder.rb

@@ -46,6 +46,7 @@ module RailsErrorDashboard
               controller: error_log.controller_name,
               action: error_log.action_name,
               platform: error_log.platform,
+              environment: error_log.environment,
               occurrences: error_log.occurrence_count,
               first_seen_at: error_log.first_seen_at&.iso8601,
               last_seen_at: error_log.last_seen_at&.iso8601,

data/lib/rails_error_dashboard/services/rack_attack_tracker.rb

@@ -32,6 +32,14 @@ module RailsErrorDashboard
       MAX_DISCRIMINATOR_LENGTH = 191
       MAX_PATH_LENGTH          = 191
       MAX_METHOD_LENGTH        = 10
+      MAX_USER_AGENT_LENGTH    = 191
+
+      # Reserved rule/match_type used to account for counts dropped by LRU
+      # eviction. Without this the evicted count vanishes silently and the
+      # dashboard under-reports with no indication anything was lost — the same
+      # problem StormProtection::CountBuffer solves with an overflow counter.
+      OVERFLOW_RULE       = "__overflow__"
+      OVERFLOW_MATCH_TYPE = "overflow"
 
       # Separator for the composite buffer key. Chosen because it cannot appear in
       # an HTTP method and is vanishingly unlikely in a rule name or path.
@@ -46,7 +54,9 @@ module RailsErrorDashboard
         # @param discriminator [String] rate-limit key (usually IP or user id)
         # @param path [String] request path
         # @param http_method [String] request method
-        def record(rule:, match_type:, discriminator: nil, path: nil, http_method: nil)
+        # @param user_agent [String] client user agent, for AI/crawler attribution
+        def record(rule:, match_type:, discriminator: nil, path: nil, http_method: nil,
+                   user_agent: nil)
           return unless enabled?
 
           key = build_key(
@@ -54,15 +64,21 @@ module RailsErrorDashboard
             match_type.to_s,
             truncate(discriminator, MAX_DISCRIMINATOR_LENGTH),
             truncate(path, MAX_PATH_LENGTH),
-            truncate(http_method, MAX_METHOD_LENGTH)
+            truncate(http_method, MAX_METHOD_LENGTH),
+            truncate(user_agent, MAX_USER_AGENT_LENGTH)
           )
 
           counts = (Thread.current[COUNTS_THREAD_KEY] ||= {})
           counts[key] = (counts[key] || 0) + 1
 
-          # LRU eviction — Ruby hashes preserve insertion order, so the first key
-          # is the oldest. Bounds memory under rotating-discriminator attacks.
-          evict_oldest!(counts) if counts.size > max_cache_size
+          # LRU eviction — bounds memory under rotating-discriminator attacks.
+          # Loops because the overflow bucket occupies a slot of its own once
+          # created, so a single eviction may not bring the map back under cap.
+          # evict_oldest! returns false once only the overflow key is left, which
+          # guarantees termination even if max_cache_size is misconfigured to 0.
+          while counts.size > max_cache_size
+            break unless evict_oldest!(counts)
+          end
 
           maybe_flush!
           nil
@@ -93,6 +109,46 @@ module RailsErrorDashboard
           nil
         end
 
+        # Flush every live thread's buffer, not just the caller's.
+        #
+        # WHY: flush! only ever sees Thread.current. Buffers live on the Puma
+        # threads that served the requests, so at shutdown (and from a background
+        # job) the caller's own buffer is empty while the real counts sit on
+        # threads nobody is asking. Without this, everything buffered at SIGTERM
+        # is lost, and a rule that matches once and then sees no further traffic
+        # on that thread is never persisted at all.
+        #
+        # Thread#[] reads another thread's fiber-locals directly, so no thread
+        # registry is needed — the same approach SwallowedExceptionTracker uses.
+        # sync: true because callers are already off the request path.
+        def flush_all_threads!
+          Thread.list.each do |thread|
+            # Rescue per thread, not just around the whole loop: one thread
+            # whose write fails must not strand the buffers of every thread
+            # after it in the list.
+            begin
+              counts = thread[COUNTS_THREAD_KEY]
+              next if counts.nil? || counts.empty?
+
+              snapshot = counts.dup
+              counts.clear
+              thread[FLUSH_THREAD_KEY] = nil
+
+              dispatch_flush(snapshot, sync: true)
+            rescue => e
+              RailsErrorDashboard::Logger.debug(
+                "[RailsErrorDashboard] RackAttackTracker.flush_all_threads! skipped a thread: #{e.class} - #{e.message}"
+              )
+            end
+          end
+          nil
+        rescue => e
+          RailsErrorDashboard::Logger.debug(
+            "[RailsErrorDashboard] RackAttackTracker.flush_all_threads! failed: #{e.class} - #{e.message}"
+          )
+          nil
+        end
+
         # Clear thread-local state without persisting. Used by specs and by
         # thread teardown paths.
         def reset!
@@ -111,9 +167,16 @@ module RailsErrorDashboard
         end
 
         # Decompose a buffer key back into its parts.
-        # @return [Array<String>] [rule, match_type, discriminator, path, http_method]
+        #
+        # The limit must match the field count exactly. With a limit of 5 the
+        # user agent would be glued onto http_method instead of standing alone.
+        # split also drops trailing empty fields without the limit, so a key
+        # whose user agent is blank must still yield six elements.
+        #
+        # @return [Array<String>] [rule, match_type, discriminator, path, http_method, user_agent]
         def parse_key(key)
-          key.to_s.split(KEY_SEPARATOR, 5)
+          parts = key.to_s.split(KEY_SEPARATOR, 6)
+          parts.fill("", parts.length, 6 - parts.length)
         end
 
         private
@@ -128,9 +191,28 @@ module RailsErrorDashboard
           parts.map(&:to_s).join(KEY_SEPARATOR)
         end
 
+        # Evict the oldest entry, rolling its count into the overflow bucket so
+        # the total stays truthful. Ruby hashes preserve insertion order, so the
+        # first key is the oldest.
+        #
+        # The overflow key is skipped when choosing a victim: it is written once
+        # and would otherwise be the oldest key forever, so evicting it would
+        # discard exactly the accounting this method exists to keep.
+        # @return [Boolean] true if an entry was evicted, false if the overflow
+        #   bucket is all that remains (which is what terminates the caller's loop)
         def evict_oldest!(hash)
-          oldest_key = hash.each_key.first
-          hash.delete(oldest_key) if oldest_key
+          oldest_key = hash.each_key.find { |k| k != overflow_key }
+          return false unless oldest_key
+
+          dropped = hash.delete(oldest_key).to_i
+          hash[overflow_key] = (hash[overflow_key] || 0) + dropped if dropped.positive?
+          true
+        end
+
+        def overflow_key
+          @overflow_key ||= build_key(
+            OVERFLOW_RULE, OVERFLOW_MATCH_TYPE, "", "", "", ""
+          )
         end
 
         # Cheap periodic flush check — a float subtraction, no I/O.

data/lib/rails_error_dashboard/services/slack_payload_builder.rb

@@ -64,6 +64,7 @@ module RailsErrorDashboard
                 locale
               )
             },
+            *environment_fields(error_log, locale),
             {
               type: "mrkdwn",
               text: NotificationHelpers.field(
@@ -74,6 +75,14 @@ module RailsErrorDashboard
         }
       end
 
+      # One field when the error carries an environment, none for a legacy
+      # row — so pre-0.11 notifications render exactly as they did.
+      def self.environment_fields(error_log, locale)
+        return [] unless error_log.respond_to?(:environment) && error_log.environment.present?
+
+        [ { type: "mrkdwn", text: NotificationHelpers.field(:environment, error_log.environment, locale) } ]
+      end
+
       def self.message_block(error_log, locale)
         {
           type: "section",

data/lib/rails_error_dashboard/services/storm_protection/gate.rb

@@ -232,6 +232,8 @@ module RailsErrorDashboard
           def maybe_storm_notification(state)
             return if state == :closed
             return unless RailsErrorDashboard.configuration.storm_notification
+            # A storm on staging should not page whoever is on call for production.
+            return unless RailsErrorDashboard::Services::NotificationThrottler.environment_allowed?
 
             episode = breaker.episode_snapshot
             return unless episode

data/lib/rails_error_dashboard/services/webhook_payload_builder.rb

@@ -37,6 +37,7 @@ module RailsErrorDashboard
             message: error_log.message,
             severity: error_log.severity.to_s,
             platform: error_log.platform,
+            environment: error_log.environment,
             controller: error_log.controller_name,
             action: error_log.action_name,
             occurrence_count: error_log.occurrence_count,

data/lib/rails_error_dashboard/subscribers/rack_attack_subscriber.rb

@@ -70,9 +70,10 @@ module RailsErrorDashboard
 
           match_type = event_name.split(".").first # "throttle", "blocklist", "track"
           rule = env["rack.attack.matched"].to_s
-          discriminator = env["rack.attack.match_discriminator"].to_s
+          discriminator = resolve_discriminator(env, request)
           path = request.respond_to?(:path) ? request.path.to_s : ""
           method = request.respond_to?(:request_method) ? request.request_method.to_s : ""
+          user_agent = resolve_user_agent(request, env)
 
           # Persist independently of error capture. A throttled request returns
           # HTTP 429 and raises nothing, so it would otherwise never reach the
@@ -82,7 +83,8 @@ module RailsErrorDashboard
             match_type: match_type,
             discriminator: discriminator,
             path: path,
-            http_method: method
+            http_method: method,
+            user_agent: user_agent
           )
 
           # Also record a breadcrumb so the event still shows up in the activity
@@ -102,6 +104,42 @@ module RailsErrorDashboard
 
           Services::BreadcrumbCollector.add("rack_attack", message, metadata: metadata)
         end
+
+        # Resolve the discriminator, falling back to the client IP.
+        #
+        # WHY (issue #170): a `track` rule declared without :limit/:period is a
+        # Rack::Attack::Check, and Check#matched_by? sets only "rack.attack.matched"
+        # and "rack.attack.match_type" — never "rack.attack.match_discriminator".
+        # Only Throttle#annotate_request_with_matched_data sets that key. The value
+        # the rule's block returns (typically `req.ip`) is used purely as a truthy
+        # match test and then discarded upstream.
+        #
+        # Without this fallback every track row stores a blank discriminator, so
+        # RackAttackSummary reports "Unique IPs: 0" for a rule that plainly matched
+        # real clients. We use request.ip rather than re-invoking the rule's block:
+        # the block is arbitrary host code that may have side effects or return a
+        # non-IP value, and re-running it from a notification subscriber would
+        # execute it a second time per request.
+        def resolve_discriminator(env, request)
+          explicit = env["rack.attack.match_discriminator"].to_s
+          return explicit unless explicit.empty?
+
+          # request.ip parses X-Forwarded-For and can raise on malformed input.
+          request.respond_to?(:ip) ? request.ip.to_s : ""
+        rescue => e
+          ""
+        end
+
+        # The user agent identifies WHICH client matched a rule — the question
+        # IP counts cannot answer, since one AI agent is a rotating fleet of
+        # addresses (issue #170). Falls back to the raw env key so a request
+        # object that does not implement #user_agent still yields the value.
+        def resolve_user_agent(request, env)
+          ua = request.respond_to?(:user_agent) ? request.user_agent : nil
+          (ua || env["HTTP_USER_AGENT"]).to_s
+        rescue => e
+          ""
+        end
       end
     end
   end

data/lib/rails_error_dashboard/version.rb

@@ -1,3 +1,3 @@
 module RailsErrorDashboard
-  VERSION = "0.9.1"
+  VERSION = "0.11.0"
 end

data/lib/rails_error_dashboard.rb

@@ -84,6 +84,7 @@ require "rails_error_dashboard/services/variable_serializer"
 require "rails_error_dashboard/services/local_variable_capturer"
 require "rails_error_dashboard/services/swallowed_exception_tracker"
 require "rails_error_dashboard/services/rack_attack_tracker"
+require "rails_error_dashboard/services/ai_agent_classifier"
 require "rails_error_dashboard/services/crash_capture"
 require "rails_error_dashboard/services/diagnostic_dump_generator"
 require "rails_error_dashboard/services/coverage_tracker"
@@ -108,6 +109,7 @@ require "rails_error_dashboard/commands/resolve_error"
 require "rails_error_dashboard/commands/create_issue"
 require "rails_error_dashboard/commands/link_existing_issue"
 require "rails_error_dashboard/commands/flush_storm_counts"
+require "rails_error_dashboard/commands/backfill_environments"
 require "rails_error_dashboard/services/issue_body_formatter"
 require "rails_error_dashboard/commands/batch_resolve_errors"
 require "rails_error_dashboard/commands/batch_delete_errors"

data/lib/tasks/rails_error_dashboard_tasks.rake

@@ -1,6 +1,12 @@
 # frozen_string_literal: true
 
 namespace :rails_error_dashboard do
+  desc "Fill in environment on error logs captured before the column existed (from environment_info.rails_env)"
+  task backfill_environments: :environment do
+    updated = RailsErrorDashboard::Commands::BackfillEnvironments.call
+    puts "rails_error_dashboard: backfilled environment on #{updated} error log(s)."
+  end
+
   namespace :db do
     desc "Drop all Rails Error Dashboard database tables (⚠️  DESTRUCTIVE - deletes all error data)"
     task drop: :environment do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_error_dashboard
 version: !ruby/object:Gem::Version
-  version: 0.9.1
+  version: 0.11.0
 platform: ruby
 authors:
 - Anjan Jagirdar
@@ -391,6 +391,8 @@ files:
 - db/migrate/20260503000001_backfill_resolved_status.rb
 - db/migrate/20260613000001_create_storm_events.rb
 - db/migrate/20260730000001_create_rails_error_dashboard_rack_attack_events.rb
+- db/migrate/20260824000001_add_user_agent_to_rack_attack_events.rb
+- db/migrate/20260826000001_add_environment_to_error_logs.rb
 - lib/generators/rails_error_dashboard/install/install_generator.rb
 - lib/generators/rails_error_dashboard/install/templates/README
 - lib/generators/rails_error_dashboard/install/templates/initializer.rb
@@ -400,6 +402,7 @@ files:
 - lib/rails_error_dashboard.rb
 - lib/rails_error_dashboard/commands/add_error_comment.rb
 - lib/rails_error_dashboard/commands/assign_error.rb
+- lib/rails_error_dashboard/commands/backfill_environments.rb
 - lib/rails_error_dashboard/commands/batch_delete_errors.rb
 - lib/rails_error_dashboard/commands/batch_mute_errors.rb
 - lib/rails_error_dashboard/commands/batch_resolve_errors.rb
@@ -471,6 +474,7 @@ files:
 - lib/rails_error_dashboard/queries/storm_history.rb
 - lib/rails_error_dashboard/queries/swallowed_exception_summary.rb
 - lib/rails_error_dashboard/queries/user_impact_summary.rb
+- lib/rails_error_dashboard/services/ai_agent_classifier.rb
 - lib/rails_error_dashboard/services/analytics_cache_manager.rb
 - lib/rails_error_dashboard/services/backtrace_parser.rb
 - lib/rails_error_dashboard/services/backtrace_processor.rb
@@ -557,7 +561,7 @@ metadata:
   funding_uri: https://github.com/sponsors/AnjanJ
 post_install_message: |
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-    RED (Rails Error Dashboard) v0.9.1
+    RED (Rails Error Dashboard) v0.11.0
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
   First install: