rails_error_dashboard 0.9.1 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 57296ebd76d5c90e1605cf26e0946418332a109b6a8e06e47764d0679d580180
-  data.tar.gz: c7c013e699b365aa6fe3ec520d57261eb9e81beabe32ae60e040e4dec60632f2
+  metadata.gz: 7065559d38e3152511024cd4a44698c3b215cc6cd60e4917d52cf4d893180b6c
+  data.tar.gz: 0d9237d4e89f4cb08392aecfe109dbb38bc1aaf673e834d827441bebf84a6e3f
 SHA512:
-  metadata.gz: eacb14ac3148b50729be1a2028df13699feab0c80bdd8d52094d275eabe55f159ed6d68bec6b6b6b8b7642bcb46fa9e0b27c1c23138da1cca277044de5dc1b26
-  data.tar.gz: 9ba438dd2e6efbe417a26846cc2c8e3784e568ba2f4c471ea92c25258a782ab7265d5cb27e488760d8871764a270e5299de76057c799c3a3220450b410c50f06
+  metadata.gz: 996b72e8406365ca4ee064464faa785b7a43dfa5f643ed9f2ca3be39d4d98b3dd13ed6426a1dbef3eb53fad3d6433d89b70b3f8a3d8e40434aad1e882cff0eb1
+  data.tar.gz: 4814ed8949397ce5ca0cd27cf4e9f52f5ba2e5bf243eff411eb0e7c80539fef978c0dc87505c02bb0e2a259725a8fec97a5897c62073eae2a9142c0f0b2c2ea8

data/app/controllers/rails_error_dashboard/errors_controller.rb

@@ -535,6 +535,12 @@ module RailsErrorDashboard
       @unique_rules = all_events.size
       @total_events = all_events.sum { |e| e[:count] }
       @unique_ips = all_events.flat_map { |e| e[:ips] }.uniq.size
+      # Events matched by a recognised AI agent. Counts requests, not addresses —
+      # one agent rotates through many IPs, so unique_ips overstates it (#170).
+      @ai_events = all_events.sum { |e| e[:ai_count].to_i }
+      # Counts the tracker's LRU eviction dropped; shown so the totals above are
+      # never silently understated.
+      @overflow_count = result[:overflow_count].to_i
 
       @pagy, @events = pagy(:offset, all_events, limit: params[:per_page] || 25)
     end

data/app/helpers/rails_error_dashboard/i18n_helper.rb

@@ -150,5 +150,31 @@ module RailsErrorDashboard
     rescue StandardError
       "%B %d, %Y %I:%M:%S %p"
     end
+
+    # A finished, localized date string for somewhere the browser will not
+    # re-render it.
+    #
+    # Almost every timestamp on the dashboard goes out as a <span data-format>
+    # that formatDateTime() localizes client-side. Chart labels cannot: they
+    # are serialized into a JS array and handed to Chart.js as plain strings,
+    # so whatever the server writes is what the axis shows. Calling strftime
+    # directly there is what put English month names on every locale's charts
+    # (#178) — Ruby's strftime is not locale-aware.
+    #
+    # Same formatter the mailers and the Slack/Discord payloads use, so a chart
+    # axis and an email agree about what a date looks like.
+    #
+    # @param time [Time, Date, nil]
+    # @param pattern [String] a strftime pattern
+    # @return [String] "" for nil — an axis label must never read "undefined"
+    def red_chart_date(time, pattern)
+      return "" if time.nil?
+
+      time = time.to_time if time.respond_to?(:to_time) && !time.is_a?(Time)
+      Services::LocalizedTimeFormatter.call(time, pattern: pattern, locale: red_locale)
+    rescue StandardError
+      # A chart with an English axis beats a chart that fails to render.
+      time.respond_to?(:strftime) ? time.strftime(pattern) : time.to_s
+    end
   end
 end

data/app/jobs/rails_error_dashboard/rack_attack_flush_job.rb

@@ -22,9 +22,13 @@ module RailsErrorDashboard
         # Mode 1: Persist provided snapshot (dispatched from tracker flush)
         Commands::FlushRackAttackEvents.call(counts: counts)
       else
-        # Mode 2: Flush current thread's buffer (scheduled cron safety net).
-        # sync: true because we are already off the request path.
-        Services::RackAttackTracker.flush!(sync: true)
+        # Mode 2: Flush EVERY live thread's buffer (scheduled cron safety net).
+        #
+        # This used to call flush!, which only ever sees Thread.current — the
+        # job worker's own buffer, which is always empty. The counts live on the
+        # Puma threads that served the requests, so the documented safety net
+        # swept nothing. flush_all_threads! is what makes the promise true.
+        Services::RackAttackTracker.flush_all_threads!
       end
     end
   end

data/app/models/rails_error_dashboard/rack_attack_event.rb

@@ -12,8 +12,12 @@ module RailsErrorDashboard
   class RackAttackEvent < ErrorLogsRecord
     self.table_name = "rails_error_dashboard_rack_attack_events"
 
-    # Event types emitted by Rack::Attack (v5.0+)
-    MATCH_TYPES = %w[throttle blocklist track safelist].freeze
+    # Event types emitted by Rack::Attack (v5.0+), plus "overflow" — not a
+    # Rack::Attack event at all, but a synthetic bucket holding counts dropped
+    # by the tracker's LRU eviction so totals stay truthful. Overflow rows are
+    # excluded from the per-rule listing and surfaced separately.
+    MATCH_TYPES = %w[throttle blocklist track safelist overflow].freeze
+    OVERFLOW_MATCH_TYPE = "overflow"
 
     belongs_to :application, optional: true
 

data/app/views/layouts/rails_error_dashboard.html.erb

@@ -1751,6 +1751,51 @@ document.addEventListener('DOMContentLoaded', function() {
       .replace('%H',pad(h)).replace('%I',pad(h12)).replace('%M',pad(mi)).replace('%S',pad(s)).replace('%p',ampm).replace('%P',ampm.toLowerCase());
   }
 
+  // Chart.js renders date axes through chartjs-adapter-date-fns, whose bundle
+  // ships English locale data only. Loading eleven date-fns locales from a CDN
+  // to fix that would be absurd when RED already carries localized month and
+  // day names in red.js.* for formatDateTime(). So the adapter's format() is
+  // redirected through the same vocabulary the rest of the dashboard uses, and
+  // a chart axis, a page timestamp and an email now agree.
+  //
+  // Only the tokens the adapter's own format table can emit are mapped:
+  //   datetime "MMM d, yyyy, h:mm:ss aaaa"   millisecond "h:mm:ss.SSS aaaa"
+  //   second "h:mm:ss aaaa"  minute "h:mm aaaa"  hour "ha"  day "MMM d"
+  //   week "PP"  month "MMM yyyy"  quarter "qqq - yyyy"  year "yyyy"
+  // Anything else — a caller-supplied pattern, a future adapter version — is
+  // handed back to the original implementation rather than half-translated.
+  function installRedChartDateAdapter() {
+    if (typeof Chart === 'undefined' || !Chart._adapters || !Chart._adapters._date) return;
+    var proto = Chart._adapters._date.prototype;
+    if (!proto || typeof proto.format !== 'function' || proto._redPatched) return;
+
+    // date-fns token -> strftime, for the patterns the adapter actually uses.
+    var TOKENS = {
+      'MMM d, yyyy, h:mm:ss aaaa': '%b %d, %Y, %I:%M:%S %p',
+      'h:mm:ss.SSS aaaa': '%I:%M:%S %p',
+      'h:mm:ss aaaa': '%I:%M:%S %p',
+      'h:mm aaaa': '%I:%M %p',
+      'ha': '%I %p',
+      'MMM d': '%b %d',
+      'PP': '%b %d, %Y',
+      'MMM yyyy': '%b %Y',
+      'yyyy': '%Y'
+    };
+
+    var original = proto.format;
+    proto.format = function(time, fmt) {
+      try {
+        var strf = TOKENS[fmt];
+        if (strf) return formatDateTime(new Date(time), strf);
+      } catch (e) {
+        // Fall through — a chart with English axes beats a chart that throws.
+      }
+      return original.call(this, time, fmt);
+    };
+    proto._redPatched = true;
+  }
+
+
   function getTimezoneAbbreviation(date) {
     // RED's locale set and the browser's Intl data need not agree, so an
     // unsupported tag throws RangeError here rather than degrading. Catch it
@@ -1801,6 +1846,16 @@ document.addEventListener('DOMContentLoaded', function() {
   }
 
   convertToLocalTime();
+
+  // Localize Chart.js date axes. Kept out of the block above on purpose: that
+  // region is extracted and run in bare node by js_date_parity_spec, where
+  // `document` is a stub, so it must contain definitions only — no top-level
+  // browser calls. The adapter is patched on the prototype, so charts drawn
+  // later pick it up; chartkick:load re-asserts for page scripts whose own
+  // DOMContentLoaded handler beat this one, and _redPatched makes that a no-op.
+  installRedChartDateAdapter();
+  document.addEventListener('chartkick:load', installRedChartDateAdapter);
+
   if (typeof Turbo !== 'undefined') {
     document.addEventListener('turbo:load', convertToLocalTime);
     document.addEventListener('turbo:frame-load', convertToLocalTime);

data/app/views/rails_error_dashboard/errors/analytics.html.erb

@@ -75,8 +75,6 @@
             curve: false,
             points: true,
             height: "300px",
-            xtitle: "Date",
-            ytitle: "Number of Errors",
             library: {
               scales: {
                 x: {
@@ -172,18 +170,19 @@
               new Chartkick.BarChart("errors-by-type-chart", <%= raw @errors_by_type.to_json %>, {
                 color: "#EF4444",
                 height: "400px",
-                xtitle: "Error Type",
-                ytitle: "Count",
                 library: {
                   scales: {
+                    // Chartkick's BarChart is horizontal (it sets indexAxis:"y"),
+                    // so the categories sit on y and the counts on x — the
+                    // opposite of the ColumnCharts on this page. #178.
                     x: {
                       ticks: { color: colors.textColor },
-                      title: { color: colors.textColor, display: true, text: '<%= red_js_t("red.ui_js.charts.axis_error_type") %>' },
+                      title: { color: colors.textColor, display: true, text: '<%= red_js_t("red.ui_js.charts.axis_count") %>' },
                       grid: { color: colors.gridColor }
                     },
                     y: {
                       ticks: { color: colors.textColor },
-                      title: { color: colors.textColor, display: true, text: '<%= red_js_t("red.ui_js.charts.axis_count") %>' },
+                      title: { color: colors.textColor, display: true, text: '<%= red_js_t("red.ui_js.charts.axis_error_type") %>' },
                       grid: { color: colors.gridColor }
                     }
                   },
@@ -214,8 +213,6 @@
               new Chartkick.ColumnChart("errors-by-hour-chart", <%= raw @errors_by_hour.to_json %>, {
                 color: "#DC2626",
                 height: "300px",
-                xtitle: "Hour",
-                ytitle: "Number of Errors",
                 library: {
                   scales: {
                     x: {
@@ -422,8 +419,6 @@
                 new Chartkick.ColumnChart("errors-by-version-chart", versionData, {
                   colors: ["#8B5CF6", "#EF4444", "#F59E0B", "#10B981"],
                   height: "300px",
-                  xtitle: "Version",
-                  ytitle: "Error Count",
                   library: window.getChartLibraryOptions()
                 });
               });
@@ -558,7 +553,7 @@
                 const colors = window.getChartColors();
                 new Chartkick.BarChart("mttr-by-platform-chart",
                   <%= raw @mttr_by_platform.to_json %>, {
-                  suffix: " hours",
+                  suffix: '<%= red_js_t("red.ui_js.charts.suffix_hours") %>',
                   height: "200px",
                   colors: ["#8B5CF6"],
                   library: window.getChartLibraryOptions()
@@ -611,7 +606,7 @@
                 const colors = window.getChartColors();
                 new Chartkick.LineChart("mttr-trend-chart",
                   <%= raw @mttr_stats[:mttr_trend].to_json %>, {
-                  suffix: " hours",
+                  suffix: '<%= red_js_t("red.ui_js.charts.suffix_hours") %>',
                   height: "250px",
                   colors: ["#10B981"],
                   curve: false,

data/app/views/rails_error_dashboard/errors/correlation.html.erb

@@ -36,8 +36,8 @@
             <div class="display-6"><%= @period_comparison[:current_period][:count] %></div>
             <small class="text-muted">
               <%= red_t("red.analytics.correlation.trend_analysis.period_range",
-                         start: @period_comparison[:current_period][:start].strftime("%b %d"),
-                         end: @period_comparison[:current_period][:end].strftime("%b %d")) %>
+                         start: red_chart_date(@period_comparison[:current_period][:start], "%b %d"),
+                         end: red_chart_date(@period_comparison[:current_period][:end], "%b %d")) %>
             </small>
           </div>
           <div class="col-md-4">
@@ -45,8 +45,8 @@
             <div class="display-6"><%= @period_comparison[:previous_period][:count] %></div>
             <small class="text-muted">
               <%= red_t("red.analytics.correlation.trend_analysis.period_range",
-                         start: @period_comparison[:previous_period][:start].strftime("%b %d"),
-                         end: @period_comparison[:previous_period][:end].strftime("%b %d")) %>
+                         start: red_chart_date(@period_comparison[:previous_period][:start], "%b %d"),
+                         end: red_chart_date(@period_comparison[:previous_period][:end], "%b %d")) %>
             </small>
           </div>
           <div class="col-md-4">

data/app/views/rails_error_dashboard/errors/platform_comparison.html.erb

@@ -358,7 +358,7 @@
     new Chart(dailyTrendCtx, {
       type: 'line',
       data: {
-        labels: <%= raw @daily_trends.values.first&.keys&.map { |d| d.strftime('%b %d') }&.to_json || [].to_json %>,
+        labels: <%= raw @daily_trends.values.first&.keys&.map { |d| red_chart_date(d, '%b %d') }&.to_json || [].to_json %>,
         datasets: datasets
       },
       options: {

data/app/views/rails_error_dashboard/errors/rack_attack_summary.html.erb

@@ -49,7 +49,7 @@
     </div>
   <% else %>
     <div class="row mb-4">
-      <div class="col-md-4">
+      <div class="col-md-3">
         <div class="card text-center">
           <div class="card-body">
             <div class="display-6 text-warning"><%= @unique_rules %></div>
@@ -57,7 +57,7 @@
           </div>
         </div>
       </div>
-      <div class="col-md-4">
+      <div class="col-md-3">
         <div class="card text-center">
           <div class="card-body">
             <div class="display-6 text-danger"><%= @total_events %></div>
@@ -65,7 +65,7 @@
           </div>
         </div>
       </div>
-      <div class="col-md-4">
+      <div class="col-md-3">
         <div class="card text-center">
           <div class="card-body">
             <div class="display-6 text-info"><%= @unique_ips %></div>
@@ -73,8 +73,27 @@
           </div>
         </div>
       </div>
+      <div class="col-md-3">
+        <div class="card text-center">
+          <div class="card-body">
+            <div class="display-6 text-primary"><%= @ai_events %></div>
+            <small class="text-muted"><%= red_t("red.errors.rack_attack_page.ai_events") %></small>
+          </div>
+        </div>
+      </div>
     </div>
 
+    <% if @overflow_count.to_i.positive? %>
+      <div class="alert alert-warning d-flex align-items-start" role="alert">
+        <i class="bi bi-exclamation-triangle me-2"></i>
+        <div>
+          <%= red_t("red.errors.rack_attack_page.overflow_notice_html",
+                    count: @overflow_count,
+                    option: content_tag(:code, "rack_attack_max_cache_size")) %>
+        </div>
+      </div>
+    <% end %>
+
     <div class="card mb-4">
       <div class="card-header d-flex justify-content-between align-items-center">
         <h5 class="mb-0">
@@ -94,6 +113,7 @@
                 <th width="80"><%= red_t("red.errors.rack_attack_page.column_count") %></th>
                 <th width="80"><%= red_t("red.errors.rack_attack_page.column_ips") %></th>
                 <th><%= red_t("red.errors.rack_attack_page.column_top_path") %></th>
+                <th width="160"><%= red_t("red.errors.rack_attack_page.column_top_agent") %></th>
                 <th width="140"><%= red_t("red.errors.pages.column_last_seen") %></th>
               </tr>
             </thead>
@@ -115,6 +135,19 @@
                   <td><strong><%= event[:count] %></strong></td>
                   <td><%= event[:unique_ips] %></td>
                   <td><code><%= event[:top_path] %></code></td>
+                  <td>
+                    <% if event[:top_agent].present? %>
+                      <%# AI agents are highlighted because "which agent" is the
+                          question IP counts cannot answer — one agent is a fleet. %>
+                      <span class="badge <%= event[:ai_count].to_i.positive? ? "bg-primary" : "bg-light text-dark" %>"
+                            title="<%= event[:top_agent] %>"><%= truncate(event[:top_agent], length: 22) %></span>
+                      <% if event[:unique_agents].to_i > 1 %>
+                        <small class="text-muted">+<%= event[:unique_agents].to_i - 1 %></small>
+                      <% end %>
+                    <% else %>
+                      <span class="text-muted">&mdash;</span>
+                    <% end %>
+                  </td>
                   <td><%= local_time_ago(event[:last_seen]) %></td>
                 </tr>
               <% end %>

data/config/locales/de.yml

@@ -833,12 +833,16 @@ de:
         unique_rules: Eindeutige Regeln
         total_events: Ereignisse gesamt
         unique_ips: Eindeutige IPs
+        ai_events: KI-Agent-Anfragen
         all_title: Rate-Limit-Ereignisse nach Regel
         column_rule: Regel
         column_type: Typ
         column_count: Anzahl
         column_ips: IPs
         column_top_path: Häufigster Pfad
+        column_top_agent: Häufigster Agent
+        overflow_notice_html: >-
+          %{count} Ereignisse konnten keiner Regel zugeordnet werden, da der Puffer des Trackers voll war. Erhöhen Sie %{option}, um mehr zu erfassen.
         match_type:
           blocklist: blocklist
           throttle: throttle
@@ -2003,5 +2007,6 @@ de:
         axis_count: Anzahl
         axis_number_of_errors: Anzahl der Fehler
         axis_hours: Stunden
+        suffix_hours: " Stunden"
         series_total_errors: Fehler gesamt
         series_hours_to_resolve: Stunden bis zur Behebung

data/config/locales/en.yml

@@ -1172,12 +1172,16 @@ en:
         unique_rules: "Unique Rules"
         total_events: "Total Events"
         unique_ips: "Unique IPs"
+        ai_events: "AI Agent Requests"
         all_title: "Rate Limit Events by Rule"
         column_rule: "Rule"
         column_type: "Type"
         column_count: "Count"
         column_ips: "IPs"
         column_top_path: "Top Path"
+        column_top_agent: "Top Agent"
+        overflow_notice_html: >-
+          %{count} events could not be attributed to a rule because the tracker's buffer was full. Raise %{option} to capture more.
         # Rack Attack match types. These are machine values the view also
         # compares by string equality, so the display is a lookup and the
         # comparison keeps the English literal.
@@ -2715,5 +2719,8 @@ en:
         axis_count: "Count"
         axis_number_of_errors: "Number of Errors"
         axis_hours: "Hours"
+        # Chartkick concatenates this after a number on the MTTR charts, so it
+        # carries its own leading space and is a bare unit, not a sentence.
+        suffix_hours: " hours"
         series_total_errors: "Total Errors"
         series_hours_to_resolve: "Hours to Resolve"

data/config/locales/es.yml

@@ -862,12 +862,16 @@ es:
         unique_rules: Reglas únicas
         total_events: Total de eventos
         unique_ips: IP únicas
+        ai_events: Solicitudes de agentes de IA
         all_title: Eventos de límite de tasa por regla
         column_rule: Regla
         column_type: Tipo
         column_count: Cantidad
         column_ips: IP
         column_top_path: Ruta principal
+        column_top_agent: Agente principal
+        overflow_notice_html: >-
+          No se pudieron atribuir %{count} eventos a ninguna regla porque el búfer del rastreador estaba lleno. Aumente %{option} para capturar más.
         match_type:
           blocklist: blocklist
           throttle: throttle
@@ -2075,5 +2079,6 @@ es:
         axis_count: Cantidad
         axis_number_of_errors: Número de errores
         axis_hours: Horas
+        suffix_hours: " horas"
         series_total_errors: Total de errores
         series_hours_to_resolve: Horas hasta la resolución

data/config/locales/fr.yml

@@ -861,12 +861,16 @@ fr:
         unique_rules: Règles uniques
         total_events: Total des événements
         unique_ips: IP uniques
+        ai_events: Requêtes d'agents IA
         all_title: Événements de limitation de débit par règle
         column_rule: Règle
         column_type: Type
         column_count: Nombre
         column_ips: IP
         column_top_path: Chemin principal
+        column_top_agent: Agent principal
+        overflow_notice_html: >-
+          %{count} événements n'ont pas pu être attribués à une règle car la mémoire tampon du traceur était pleine. Augmentez %{option} pour en capturer davantage.
         match_type:
           blocklist: blocklist
           throttle: throttle
@@ -2078,5 +2082,6 @@ fr:
         axis_count: Nombre
         axis_number_of_errors: Nombre d'erreurs
         axis_hours: Heures
+        suffix_hours: " heures"
         series_total_errors: Total des erreurs
         series_hours_to_resolve: Heures avant résolution

data/config/locales/it.yml

@@ -847,12 +847,16 @@ it:
         unique_rules: Regole uniche
         total_events: Eventi totali
         unique_ips: IP unici
+        ai_events: Richieste di agenti IA
         all_title: Eventi di limite di richieste per regola
         column_rule: Regola
         column_type: Tipo
         column_count: Conteggio
         column_ips: Indirizzi IP
         column_top_path: Percorso principale
+        column_top_agent: Agente principale
+        overflow_notice_html: >-
+          %{count} eventi non sono stati attribuiti a nessuna regola perché il buffer del tracker era pieno. Aumenta %{option} per acquisirne di più.
         match_type:
           blocklist: blocklist
           throttle: throttle
@@ -2056,5 +2060,6 @@ it:
         axis_count: Conteggio
         axis_number_of_errors: Numero di errori
         axis_hours: Ore
+        suffix_hours: " ore"
         series_total_errors: Errori totali
         series_hours_to_resolve: Ore per la risoluzione

data/config/locales/ja.yml

@@ -755,12 +755,16 @@ ja:
         unique_rules: ルール数
         total_events: 総イベント数
         unique_ips: ユニーク IP 数
+        ai_events: AI エージェントのリクエスト数
         all_title: ルール別レート制限イベント
         column_rule: ルール
         column_type: 種類
         column_count: 件数
         column_ips: IP 数
         column_top_path: 上位パス
+        column_top_agent: 主要エージェント
+        overflow_notice_html: >-
+          トラッカーのバッファが満杯だったため、%{count} 件のイベントをルールに割り当てられませんでした。より多く記録するには %{option} を増やしてください。
         match_type:
           blocklist: blocklist
           throttle: throttle
@@ -1798,5 +1802,6 @@ ja:
         axis_count: 件数
         axis_number_of_errors: エラー件数
         axis_hours: 時間
+        suffix_hours: "時間"
         series_total_errors: 総エラー数
         series_hours_to_resolve: 解決までの時間

data/config/locales/pl.yml

@@ -869,12 +869,16 @@ pl:
         unique_rules: Unikalne reguły
         total_events: Łącznie zdarzeń
         unique_ips: Unikalne adresy IP
+        ai_events: Żądania agentów AI
         all_title: Zdarzenia limitu żądań wg reguły
         column_rule: Reguła
         column_type: Typ
         column_count: Liczba
         column_ips: Adresy IP
         column_top_path: Najczęstsza ścieżka
+        column_top_agent: Główny agent
+        overflow_notice_html: >-
+          Nie udało się przypisać %{count} zdarzeń do żadnej reguły, ponieważ bufor mechanizmu śledzenia był pełny. Zwiększ %{option}, aby rejestrować więcej.
         match_type:
           blocklist: blocklist
           throttle: throttle
@@ -2104,5 +2108,6 @@ pl:
         axis_count: Liczba
         axis_number_of_errors: Liczba błędów
         axis_hours: Godziny
+        suffix_hours: " godz."
         series_total_errors: Łącznie błędów
         series_hours_to_resolve: Godzin do rozwiązania

data/config/locales/pt-BR.yml

@@ -859,12 +859,16 @@ pt-BR:
         unique_rules: Regras únicas
         total_events: Total de eventos
         unique_ips: IPs únicos
+        ai_events: Solicitações de agentes de IA
         all_title: Eventos de limite de taxa por regra
         column_rule: Regra
         column_type: Tipo
         column_count: Quantidade
         column_ips: IPs
         column_top_path: Caminho principal
+        column_top_agent: Agente principal
+        overflow_notice_html: >-
+          Não foi possível atribuir %{count} eventos a nenhuma regra porque o buffer do rastreador estava cheio. Aumente %{option} para capturar mais.
         match_type:
           blocklist: blocklist
           throttle: throttle
@@ -2060,5 +2064,6 @@ pt-BR:
         axis_count: Quantidade
         axis_number_of_errors: Número de erros
         axis_hours: Horas
+        suffix_hours: " horas"
         series_total_errors: Total de erros
         series_hours_to_resolve: Horas até a resolução

data/config/locales/ru.yml

@@ -871,12 +871,16 @@ ru:
         unique_rules: Уникальные правила
         total_events: Всего событий
         unique_ips: Уникальные IP
+        ai_events: Запросы ИИ-агентов
         all_title: События ограничения частоты по правилам
         column_rule: Правило
         column_type: Тип
         column_count: Количество
         column_ips: IP-адреса
         column_top_path: Частый путь
+        column_top_agent: Основной агент
+        overflow_notice_html: >-
+          Не удалось отнести %{count} событий ни к одному правилу, так как буфер трекера был заполнен. Увеличьте %{option}, чтобы записывать больше.
         match_type:
           blocklist: blocklist
           throttle: throttle
@@ -2105,5 +2109,6 @@ ru:
         axis_count: Количество
         axis_number_of_errors: Количество ошибок
         axis_hours: Часы
+        suffix_hours: " ч"
         series_total_errors: Всего ошибок
         series_hours_to_resolve: Часов до решения

data/config/locales/uk.yml

@@ -869,12 +869,16 @@ uk:
         unique_rules: Унікальні правила
         total_events: Усього подій
         unique_ips: Унікальні IP
+        ai_events: Запити ШІ-агентів
         all_title: Події обмеження запитів за правилами
         column_rule: Правило
         column_type: Тип
         column_count: Кількість
         column_ips: IP-адреси
         column_top_path: Найчастіший шлях
+        column_top_agent: Основний агент
+        overflow_notice_html: >-
+          Не вдалося віднести %{count} подій до жодного правила, оскільки буфер трекера був заповнений. Збільште %{option}, щоб записувати більше.
         match_type:
           blocklist: blocklist
           throttle: throttle
@@ -2102,5 +2106,6 @@ uk:
         axis_count: Кількість
         axis_number_of_errors: Кількість помилок
         axis_hours: Години
+        suffix_hours: " год"
         series_total_errors: Усього помилок
         series_hours_to_resolve: Годин до вирішення

data/config/locales/zh-CN.yml

@@ -751,12 +751,16 @@ zh-CN:
         unique_rules: 规则数
         total_events: 事件总数
         unique_ips: 独立 IP 数
+        ai_events: AI 代理请求数
         all_title: 按规则查看限流事件
         column_rule: 规则
         column_type: 类型
         column_count: 数量
         column_ips: IP 地址
         column_top_path: 主要路径
+        column_top_agent: 主要代理
+        overflow_notice_html: >-
+          由于跟踪器缓冲区已满，%{count} 个事件无法归属到任何规则。请调高 %{option} 以捕获更多事件。
         match_type:
           blocklist: blocklist
           throttle: throttle
@@ -1787,5 +1791,6 @@ zh-CN:
         axis_count: 数量
         axis_number_of_errors: 错误数量
         axis_hours: 小时
+        suffix_hours: "小时"
         series_total_errors: 错误总数
         series_hours_to_resolve: 解决耗时（小时）

data/db/migrate/20260824000001_add_user_agent_to_rack_attack_events.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class AddUserAgentToRackAttackEvents < ActiveRecord::Migration[7.0]
+  def change
+    # Guard against the squashed schema migration having already added this
+    # column — without it, every later migration is silently cancelled.
+    return if column_exists?(:rails_error_dashboard_rack_attack_events, :user_agent)
+
+    # Capped at 191 to match the other free-text columns on this table.
+    #
+    # Deliberately NOT added to index_rack_attack_events_upsert_key. That index
+    # is already budgeted at 250+50+191+191 chars = 2736 bytes against MySQL's
+    # 3072-byte utf8mb4 limit (see the create migration); a fourth 191-char
+    # column would blow it. User agents are also extremely high cardinality, so
+    # indexing them would fragment the hourly buckets this table exists to
+    # aggregate. It is stored first-write-wins per bucket, like http_method.
+    add_column :rails_error_dashboard_rack_attack_events, :user_agent, :string, limit: 191
+  end
+end

data/lib/generators/rails_error_dashboard/install/install_generator.rb

@@ -348,7 +348,19 @@ module RailsErrorDashboard
           end
         end
 
+        # Start after the highest timestamp already present, not at the current
+        # clock. The counter increments per copied file, so a re-run that happens
+        # within N seconds of the previous install (N = number of migrations)
+        # would otherwise reuse numbers the first install already consumed —
+        # and Rails aborts the whole `db:migrate` with "Multiple migrations have
+        # the version number ...", so the upgrade silently applies nothing.
         timestamp = Time.now.utc.strftime("%Y%m%d%H%M%S").to_i
+        highest_existing = [ "db/migrate", "db/error_dashboard_migrate" ].flat_map do |dir|
+          full_path = File.join(destination_root, dir)
+          next [] unless Dir.exist?(full_path)
+          Dir.glob(File.join(full_path, "*.rb")).map { |f| File.basename(f)[/^\d+/].to_i }
+        end.max
+        timestamp = highest_existing + 1 if highest_existing && highest_existing >= timestamp
 
         Dir.glob(File.join(source_dir, "*.rb")).sort.each do |source_file|
           basename = File.basename(source_file)

data/lib/rails_error_dashboard/commands/flush_rack_attack_events.rb

@@ -8,7 +8,10 @@ module RailsErrorDashboard
     # hourly-bucketed rows. Uses find_or_initialize_by + increment for
     # cross-database compatibility (no raw SQL upsert).
     #
-    # counts keys: "rule\x1Fmatch_type\x1Fdiscriminator\x1Fpath\x1Fhttp_method"
+    # counts keys: "rule\x1Fmatch_type\x1Fdiscriminator\x1Fpath\x1Fhttp_method\x1Fuser_agent"
+    #
+    # http_method and user_agent are carried on the key but are NOT part of the
+    # row's identity — see upsert_event.
     class FlushRackAttackEvents
       def self.call(counts:)
         new(counts: counts).call
@@ -25,7 +28,7 @@ module RailsErrorDashboard
         app_id = current_application_id
 
         @counts.each do |key, count|
-          rule, match_type, discriminator, path, http_method =
+          rule, match_type, discriminator, path, http_method, user_agent =
             Services::RackAttackTracker.parse_key(key)
 
           next if rule.blank? || match_type.blank?
@@ -36,6 +39,7 @@ module RailsErrorDashboard
             discriminator: discriminator,
             path: path,
             http_method: http_method,
+            user_agent: user_agent,
             period: period,
             app_id: app_id,
             count: count
@@ -49,7 +53,8 @@ module RailsErrorDashboard
 
       private
 
-      def upsert_event(rule:, match_type:, discriminator:, path:, http_method:, period:, app_id:, count:)
+      def upsert_event(rule:, match_type:, discriminator:, path:, http_method:, user_agent:,
+                       period:, app_id:, count:)
         # nil and "" must map to the same row — the unique index treats them as
         # distinct in some adapters, so normalize blanks to nil consistently.
         record = RackAttackEvent.find_or_initialize_by(
@@ -61,7 +66,11 @@ module RailsErrorDashboard
           application_id: app_id
         )
 
+        # http_method and user_agent are deliberately NOT part of the upsert key
+        # (the unique index is already at 2736 of MySQL's 3072 bytes), so they
+        # are first-write-wins attributes of the bucket rather than identity.
         record.http_method = http_method.presence if record.http_method.blank?
+        record.user_agent = user_agent.presence if record.user_agent.blank?
         record.event_count = (record.event_count || 0) + count
         record.last_seen_at = Time.current
         record.save!

data/lib/rails_error_dashboard/engine.rb

@@ -85,6 +85,13 @@ module RailsErrorDashboard
       if RailsErrorDashboard.configuration.enable_rack_attack_tracking &&
          defined?(Rack::Attack)
         RailsErrorDashboard::Subscribers::RackAttackSubscriber.subscribe!
+
+        # Buffered counts live on the Puma threads that served the requests and
+        # are only written out on the flush interval, which a low-traffic rule
+        # may never reach. Without this, everything still buffered at SIGTERM
+        # (every deploy) is lost. at_exit, not Signal.trap — trapping would
+        # clobber Puma's USR1/USR2 handlers (safety rule 9).
+        at_exit { RailsErrorDashboard::Services::RackAttackTracker.flush_all_threads! }
       end
 
       # Subscribe to ActionCable AS::Notifications events (requires breadcrumbs + ActionCable)

data/lib/rails_error_dashboard/queries/rack_attack_summary.rb

@@ -24,7 +24,8 @@ module RailsErrorDashboard
 
       def call
         {
-          events: aggregated_events
+          events: aggregated_events,
+          overflow_count: overflow_count
         }
       end
 
@@ -36,15 +37,27 @@ module RailsErrorDashboard
         scope
       end
 
+      # Counts dropped by the tracker's LRU eviction, kept out of the per-rule
+      # listing (they belong to no single rule) but reported so the dashboard
+      # never silently under-states volume.
+      def overflow_count
+        base_query.where(match_type: RackAttackEvent::OVERFLOW_MATCH_TYPE).sum(:event_count).to_i
+      rescue => e
+        0
+      end
+
       def aggregated_events
-        rows = base_query.pluck(
-          :rule, :match_type, :discriminator, :path, :event_count, :last_seen_at, :period_hour
-        )
+        rows = base_query
+          .where.not(match_type: RackAttackEvent::OVERFLOW_MATCH_TYPE)
+          .pluck(
+            :rule, :match_type, :discriminator, :path, :event_count, :last_seen_at,
+            :period_hour, :user_agent
+          )
         return [] if rows.empty?
 
         grouped = {}
 
-        rows.each do |rule, match_type, discriminator, path, event_count, last_seen_at, period_hour|
+        rows.each do |rule, match_type, discriminator, path, event_count, last_seen_at, period_hour, user_agent|
           key = rule.to_s.presence || "unknown"
           count = event_count.to_i
           seen_at = last_seen_at || period_hour
@@ -55,12 +68,19 @@ module RailsErrorDashboard
             count: 0,
             ips: Set.new,
             path_counts: Hash.new(0),
+            agent_counts: Hash.new(0),
+            ai_count: 0,
             last_seen: nil
           }
 
           entry[:count] += count
           entry[:ips] << discriminator.to_s if discriminator.present?
           entry[:path_counts][path.to_s] += count if path.present?
+          if user_agent.present?
+            agent = Services::AiAgentClassifier.name(user_agent) || user_agent.to_s
+            entry[:agent_counts][agent] += count
+            entry[:ai_count] += count if Services::AiAgentClassifier.ai?(user_agent)
+          end
           entry[:last_seen] = [ entry[:last_seen], seen_at ].compact.max
 
           # Prefer the most severe match type when a rule spans several. A rule
@@ -74,11 +94,17 @@ module RailsErrorDashboard
           r[:paths] = r[:path_counts].sort_by { |_p, c| -c }.map(&:first)
           r[:unique_ips] = r[:ips].size
           r[:ips] = r[:ips].to_a
+          # Which client matched most often — the question unique_ips cannot
+          # answer, because one AI agent is a whole fleet of addresses (#170).
+          r[:top_agent] = r[:agent_counts].max_by { |_agent, count| count }&.first
+          r[:agents] = r[:agent_counts].sort_by { |_a, c| -c }.map(&:first)
+          r[:unique_agents] = r[:agent_counts].size
           # Distinct rate-limited clients is the meaningful figure here; the old
           # breadcrumb-derived :error_count no longer applies now that events are
           # stored independently of errors.
           r[:error_count] = 0
           r.delete(:path_counts)
+          r.delete(:agent_counts)
         end
 
         grouped.values.sort_by { |r| -r[:count] }

data/lib/rails_error_dashboard/services/ai_agent_classifier.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  module Services
+    # Classifies a User-Agent string into a coarse traffic kind, and names the
+    # agent when it is a recognised one.
+    #
+    # WHY THIS EXISTS (issue #170): tracking which AI agents read an app is the
+    # reason people reach for Rack::Attack's `track` rules now. Counting IPs
+    # cannot answer it — one agent is a rotating fleet of hundreds of addresses,
+    # so unique-IP totals overstate the population badly. The user agent is the
+    # signal that actually identifies the reader.
+    #
+    # Deliberately plain string matching, NOT the `browser` gem: `browser` is an
+    # optional dependency that degrades gracefully everywhere else in this gem,
+    # and it does not know these agents anyway. This runs on the flush path, not
+    # the request path, but it stays allocation-cheap regardless.
+    #
+    # The bot lists are necessarily a snapshot. An unrecognised agent falls back
+    # to :other rather than being guessed at — a wrong attribution is worse than
+    # an honest "unknown" when the whole point is measurement.
+    class AiAgentClassifier
+      # Order matters: the first match wins, so more specific patterns lead.
+      #
+      # AI agents split into two behaviours worth telling apart, because they
+      # answer different questions:
+      # - :ai_assistant — fetches on demand, because a human asked something now
+      # - :ai_crawler   — bulk-fetches to build a training corpus or index
+      AI_ASSISTANTS = {
+        "ChatGPT-User" => /ChatGPT-User/i,
+        "Claude-User" => /Claude-User/i,
+        "Claude Code" => /Claude-?Code/i,
+        "Perplexity-User" => /Perplexity-User/i,
+        "Gemini-User" => /Gemini-User/i
+      }.freeze
+
+      AI_CRAWLERS = {
+        "GPTBot" => /GPTBot/i,
+        "OAI-SearchBot" => /OAI-SearchBot/i,
+        "ClaudeBot" => /ClaudeBot/i,
+        "anthropic-ai" => /anthropic-ai/i,
+        "PerplexityBot" => /PerplexityBot/i,
+        "Google-Extended" => /Google-Extended/i,
+        "Applebot-Extended" => /Applebot-Extended/i,
+        "Bytespider" => /Bytespider/i,
+        "CCBot" => /CCBot/i,
+        "Meta-ExternalAgent" => /Meta-ExternalAgent/i,
+        "Amazonbot" => /Amazonbot/i,
+        "cohere-ai" => /cohere-ai/i,
+        "DuckAssistBot" => /DuckAssistBot/i,
+        "YouBot" => /YouBot/i,
+        "Diffbot" => /Diffbot/i,
+        "Timpibot" => /Timpibot/i
+      }.freeze
+
+      # Conventional search/SEO crawlers. Not AI traffic, but worth naming so
+      # they can be excluded rather than silently inflating an "unknown" bucket.
+      CRAWLERS = {
+        "Googlebot" => /Googlebot/i,
+        "Bingbot" => /bingbot/i,
+        "DuckDuckBot" => /DuckDuckBot/i,
+        "Baiduspider" => /Baiduspider/i,
+        "YandexBot" => /YandexBot/i,
+        "AhrefsBot" => /AhrefsBot/i,
+        "SemrushBot" => /SemrushBot/i,
+        "Applebot" => /Applebot/i,
+        "facebookexternalhit" => /facebookexternalhit/i,
+        "LLMS-Txt-Scanner" => /LLMS-Txt-Scanner/i
+      }.freeze
+
+      # Checked only after every bot pattern has missed, because plenty of bots
+      # embed a full browser UA string and would match these first.
+      BROWSER_HINTS = /Mozilla|Chrome|Safari|Firefox|Edge|Opera|Gecko|WebKit/i
+
+      # Non-browser HTTP clients — usually scripts, monitors or scrapers.
+      LIBRARIES = {
+        "curl" => /\bcurl\//i,
+        "wget" => /\bWget\//i,
+        "python-requests" => /python-requests/i,
+        "httpx" => /\bhttpx\//i,
+        "Go-http-client" => /Go-http-client/i,
+        "Java" => /\bJava\//i,
+        "okhttp" => /\bokhttp\//i,
+        "axios" => /\baxios\//i,
+        "Faraday" => /Faraday/i,
+        "RubyGems" => /Ruby\b/i
+      }.freeze
+
+      KINDS = %i[ai_assistant ai_crawler crawler browser library other].freeze
+
+      class << self
+        # @param user_agent [String, nil]
+        # @return [Symbol] one of KINDS
+        def kind(user_agent)
+          ua = user_agent.to_s
+          return :other if ua.strip.empty?
+
+          return :ai_assistant if match_name(AI_ASSISTANTS, ua)
+          return :ai_crawler if match_name(AI_CRAWLERS, ua)
+          return :crawler if match_name(CRAWLERS, ua)
+          return :library if match_name(LIBRARIES, ua)
+          return :browser if ua.match?(BROWSER_HINTS)
+
+          :other
+        rescue => e
+          :other
+        end
+
+        # Canonical name for a recognised agent, or nil when unrecognised.
+        # Never invents a name — callers show the raw UA in that case.
+        #
+        # @param user_agent [String, nil]
+        # @return [String, nil]
+        def name(user_agent)
+          ua = user_agent.to_s
+          return nil if ua.strip.empty?
+
+          match_name(AI_ASSISTANTS, ua) ||
+            match_name(AI_CRAWLERS, ua) ||
+            match_name(CRAWLERS, ua) ||
+            match_name(LIBRARIES, ua)
+        rescue => e
+          nil
+        end
+
+        # Whether this agent is an LLM reader of either flavour. This is the
+        # predicate the dashboard's "AI agents" figure counts.
+        #
+        # @param user_agent [String, nil]
+        # @return [Boolean]
+        def ai?(user_agent)
+          %i[ai_assistant ai_crawler].include?(kind(user_agent))
+        end
+
+        # @return [Hash] { kind:, name:, ai: } — one pass for callers that want all three
+        def classify(user_agent)
+          k = kind(user_agent)
+          {
+            kind: k,
+            name: name(user_agent),
+            ai: %i[ai_assistant ai_crawler].include?(k)
+          }
+        end
+
+        private
+
+        def match_name(table, ua)
+          table.each { |agent_name, pattern| return agent_name if ua.match?(pattern) }
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/rails_error_dashboard/services/rack_attack_tracker.rb

@@ -32,6 +32,14 @@ module RailsErrorDashboard
       MAX_DISCRIMINATOR_LENGTH = 191
       MAX_PATH_LENGTH          = 191
       MAX_METHOD_LENGTH        = 10
+      MAX_USER_AGENT_LENGTH    = 191
+
+      # Reserved rule/match_type used to account for counts dropped by LRU
+      # eviction. Without this the evicted count vanishes silently and the
+      # dashboard under-reports with no indication anything was lost — the same
+      # problem StormProtection::CountBuffer solves with an overflow counter.
+      OVERFLOW_RULE       = "__overflow__"
+      OVERFLOW_MATCH_TYPE = "overflow"
 
       # Separator for the composite buffer key. Chosen because it cannot appear in
       # an HTTP method and is vanishingly unlikely in a rule name or path.
@@ -46,7 +54,9 @@ module RailsErrorDashboard
         # @param discriminator [String] rate-limit key (usually IP or user id)
         # @param path [String] request path
         # @param http_method [String] request method
-        def record(rule:, match_type:, discriminator: nil, path: nil, http_method: nil)
+        # @param user_agent [String] client user agent, for AI/crawler attribution
+        def record(rule:, match_type:, discriminator: nil, path: nil, http_method: nil,
+                   user_agent: nil)
           return unless enabled?
 
           key = build_key(
@@ -54,15 +64,21 @@ module RailsErrorDashboard
             match_type.to_s,
             truncate(discriminator, MAX_DISCRIMINATOR_LENGTH),
             truncate(path, MAX_PATH_LENGTH),
-            truncate(http_method, MAX_METHOD_LENGTH)
+            truncate(http_method, MAX_METHOD_LENGTH),
+            truncate(user_agent, MAX_USER_AGENT_LENGTH)
           )
 
           counts = (Thread.current[COUNTS_THREAD_KEY] ||= {})
           counts[key] = (counts[key] || 0) + 1
 
-          # LRU eviction — Ruby hashes preserve insertion order, so the first key
-          # is the oldest. Bounds memory under rotating-discriminator attacks.
-          evict_oldest!(counts) if counts.size > max_cache_size
+          # LRU eviction — bounds memory under rotating-discriminator attacks.
+          # Loops because the overflow bucket occupies a slot of its own once
+          # created, so a single eviction may not bring the map back under cap.
+          # evict_oldest! returns false once only the overflow key is left, which
+          # guarantees termination even if max_cache_size is misconfigured to 0.
+          while counts.size > max_cache_size
+            break unless evict_oldest!(counts)
+          end
 
           maybe_flush!
           nil
@@ -93,6 +109,46 @@ module RailsErrorDashboard
           nil
         end
 
+        # Flush every live thread's buffer, not just the caller's.
+        #
+        # WHY: flush! only ever sees Thread.current. Buffers live on the Puma
+        # threads that served the requests, so at shutdown (and from a background
+        # job) the caller's own buffer is empty while the real counts sit on
+        # threads nobody is asking. Without this, everything buffered at SIGTERM
+        # is lost, and a rule that matches once and then sees no further traffic
+        # on that thread is never persisted at all.
+        #
+        # Thread#[] reads another thread's fiber-locals directly, so no thread
+        # registry is needed — the same approach SwallowedExceptionTracker uses.
+        # sync: true because callers are already off the request path.
+        def flush_all_threads!
+          Thread.list.each do |thread|
+            # Rescue per thread, not just around the whole loop: one thread
+            # whose write fails must not strand the buffers of every thread
+            # after it in the list.
+            begin
+              counts = thread[COUNTS_THREAD_KEY]
+              next if counts.nil? || counts.empty?
+
+              snapshot = counts.dup
+              counts.clear
+              thread[FLUSH_THREAD_KEY] = nil
+
+              dispatch_flush(snapshot, sync: true)
+            rescue => e
+              RailsErrorDashboard::Logger.debug(
+                "[RailsErrorDashboard] RackAttackTracker.flush_all_threads! skipped a thread: #{e.class} - #{e.message}"
+              )
+            end
+          end
+          nil
+        rescue => e
+          RailsErrorDashboard::Logger.debug(
+            "[RailsErrorDashboard] RackAttackTracker.flush_all_threads! failed: #{e.class} - #{e.message}"
+          )
+          nil
+        end
+
         # Clear thread-local state without persisting. Used by specs and by
         # thread teardown paths.
         def reset!
@@ -111,9 +167,16 @@ module RailsErrorDashboard
         end
 
         # Decompose a buffer key back into its parts.
-        # @return [Array<String>] [rule, match_type, discriminator, path, http_method]
+        #
+        # The limit must match the field count exactly. With a limit of 5 the
+        # user agent would be glued onto http_method instead of standing alone.
+        # split also drops trailing empty fields without the limit, so a key
+        # whose user agent is blank must still yield six elements.
+        #
+        # @return [Array<String>] [rule, match_type, discriminator, path, http_method, user_agent]
         def parse_key(key)
-          key.to_s.split(KEY_SEPARATOR, 5)
+          parts = key.to_s.split(KEY_SEPARATOR, 6)
+          parts.fill("", parts.length, 6 - parts.length)
         end
 
         private
@@ -128,9 +191,28 @@ module RailsErrorDashboard
           parts.map(&:to_s).join(KEY_SEPARATOR)
         end
 
+        # Evict the oldest entry, rolling its count into the overflow bucket so
+        # the total stays truthful. Ruby hashes preserve insertion order, so the
+        # first key is the oldest.
+        #
+        # The overflow key is skipped when choosing a victim: it is written once
+        # and would otherwise be the oldest key forever, so evicting it would
+        # discard exactly the accounting this method exists to keep.
+        # @return [Boolean] true if an entry was evicted, false if the overflow
+        #   bucket is all that remains (which is what terminates the caller's loop)
         def evict_oldest!(hash)
-          oldest_key = hash.each_key.first
-          hash.delete(oldest_key) if oldest_key
+          oldest_key = hash.each_key.find { |k| k != overflow_key }
+          return false unless oldest_key
+
+          dropped = hash.delete(oldest_key).to_i
+          hash[overflow_key] = (hash[overflow_key] || 0) + dropped if dropped.positive?
+          true
+        end
+
+        def overflow_key
+          @overflow_key ||= build_key(
+            OVERFLOW_RULE, OVERFLOW_MATCH_TYPE, "", "", "", ""
+          )
         end
 
         # Cheap periodic flush check — a float subtraction, no I/O.

data/lib/rails_error_dashboard/subscribers/rack_attack_subscriber.rb

@@ -70,9 +70,10 @@ module RailsErrorDashboard
 
           match_type = event_name.split(".").first # "throttle", "blocklist", "track"
           rule = env["rack.attack.matched"].to_s
-          discriminator = env["rack.attack.match_discriminator"].to_s
+          discriminator = resolve_discriminator(env, request)
           path = request.respond_to?(:path) ? request.path.to_s : ""
           method = request.respond_to?(:request_method) ? request.request_method.to_s : ""
+          user_agent = resolve_user_agent(request, env)
 
           # Persist independently of error capture. A throttled request returns
           # HTTP 429 and raises nothing, so it would otherwise never reach the
@@ -82,7 +83,8 @@ module RailsErrorDashboard
             match_type: match_type,
             discriminator: discriminator,
             path: path,
-            http_method: method
+            http_method: method,
+            user_agent: user_agent
           )
 
           # Also record a breadcrumb so the event still shows up in the activity
@@ -102,6 +104,42 @@ module RailsErrorDashboard
 
           Services::BreadcrumbCollector.add("rack_attack", message, metadata: metadata)
         end
+
+        # Resolve the discriminator, falling back to the client IP.
+        #
+        # WHY (issue #170): a `track` rule declared without :limit/:period is a
+        # Rack::Attack::Check, and Check#matched_by? sets only "rack.attack.matched"
+        # and "rack.attack.match_type" — never "rack.attack.match_discriminator".
+        # Only Throttle#annotate_request_with_matched_data sets that key. The value
+        # the rule's block returns (typically `req.ip`) is used purely as a truthy
+        # match test and then discarded upstream.
+        #
+        # Without this fallback every track row stores a blank discriminator, so
+        # RackAttackSummary reports "Unique IPs: 0" for a rule that plainly matched
+        # real clients. We use request.ip rather than re-invoking the rule's block:
+        # the block is arbitrary host code that may have side effects or return a
+        # non-IP value, and re-running it from a notification subscriber would
+        # execute it a second time per request.
+        def resolve_discriminator(env, request)
+          explicit = env["rack.attack.match_discriminator"].to_s
+          return explicit unless explicit.empty?
+
+          # request.ip parses X-Forwarded-For and can raise on malformed input.
+          request.respond_to?(:ip) ? request.ip.to_s : ""
+        rescue => e
+          ""
+        end
+
+        # The user agent identifies WHICH client matched a rule — the question
+        # IP counts cannot answer, since one AI agent is a rotating fleet of
+        # addresses (issue #170). Falls back to the raw env key so a request
+        # object that does not implement #user_agent still yields the value.
+        def resolve_user_agent(request, env)
+          ua = request.respond_to?(:user_agent) ? request.user_agent : nil
+          (ua || env["HTTP_USER_AGENT"]).to_s
+        rescue => e
+          ""
+        end
       end
     end
   end

data/lib/rails_error_dashboard/version.rb

@@ -1,3 +1,3 @@
 module RailsErrorDashboard
-  VERSION = "0.9.1"
+  VERSION = "0.10.0"
 end

data/lib/rails_error_dashboard.rb

@@ -84,6 +84,7 @@ require "rails_error_dashboard/services/variable_serializer"
 require "rails_error_dashboard/services/local_variable_capturer"
 require "rails_error_dashboard/services/swallowed_exception_tracker"
 require "rails_error_dashboard/services/rack_attack_tracker"
+require "rails_error_dashboard/services/ai_agent_classifier"
 require "rails_error_dashboard/services/crash_capture"
 require "rails_error_dashboard/services/diagnostic_dump_generator"
 require "rails_error_dashboard/services/coverage_tracker"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_error_dashboard
 version: !ruby/object:Gem::Version
-  version: 0.9.1
+  version: 0.10.0
 platform: ruby
 authors:
 - Anjan Jagirdar
@@ -391,6 +391,7 @@ files:
 - db/migrate/20260503000001_backfill_resolved_status.rb
 - db/migrate/20260613000001_create_storm_events.rb
 - db/migrate/20260730000001_create_rails_error_dashboard_rack_attack_events.rb
+- db/migrate/20260824000001_add_user_agent_to_rack_attack_events.rb
 - lib/generators/rails_error_dashboard/install/install_generator.rb
 - lib/generators/rails_error_dashboard/install/templates/README
 - lib/generators/rails_error_dashboard/install/templates/initializer.rb
@@ -471,6 +472,7 @@ files:
 - lib/rails_error_dashboard/queries/storm_history.rb
 - lib/rails_error_dashboard/queries/swallowed_exception_summary.rb
 - lib/rails_error_dashboard/queries/user_impact_summary.rb
+- lib/rails_error_dashboard/services/ai_agent_classifier.rb
 - lib/rails_error_dashboard/services/analytics_cache_manager.rb
 - lib/rails_error_dashboard/services/backtrace_parser.rb
 - lib/rails_error_dashboard/services/backtrace_processor.rb
@@ -557,7 +559,7 @@ metadata:
   funding_uri: https://github.com/sponsors/AnjanJ
 post_install_message: |
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-    RED (Rails Error Dashboard) v0.9.1
+    RED (Rails Error Dashboard) v0.10.0
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
   First install: