rails_pulse 0.3.3 → 0.4.0.pre.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 36c07de8920dddd7bb85571c3c01b94c197866dfeb45c471cad71dc829c61601
-  data.tar.gz: c4cfbade2a92decf14272c76b32028918dab1bdc60d61bf95e9b6a9b69b0e07b
+  metadata.gz: 19b495bf5ea042672667ee099947d337731557f880af30f7d2dc26f507cbea0f
+  data.tar.gz: cb8946047ebb55a662742d42d143f47b5b3f3b982779fb289e4abfe418ac1c59
 SHA512:
-  metadata.gz: 65565ffc47a14f6b4402dd3c83bddd8c422732460b91bf4a07655cc9de034d8535e0ccc679bbeb83e33ca83694d2891868dc60ee2e90243f20c0503287bba8b2
-  data.tar.gz: b2b2c03e714bd1081ee152aadcc72f892b5a5927d2823725b10eb4ddaebaceedc5216ac48fbfe56372cb77f9b3701645f9eea27c62d400ad39ed4bef0840717c
+  metadata.gz: 428db96f32b2624638e99aacad09ef5dbeac23b6e11df316f7db66757c997777e846907830993657f4c76c0ea81dbfc92246ad93e1f5f3cc1c5b53ca80cb6065
+  data.tar.gz: 3f73d50c25352fc8a3dbaabe8cee59a51624fbebb1d23dfc58208bf42add67a33a56003d98769610559cd8211f8dab76a7a478da6cac0883f7a0d0e6d07f6ebb

data/CHANGELOG.md

@@ -0,0 +1,272 @@
+# Changelog
+
+All notable changes to Rails Pulse will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.4.0.pre.1] - 2026-09-03
+
+This release contains a **breaking schema change** and requires a one-time data
+migration. Read "Upgrading from 0.3.x" below before deploying. Take a database
+backup first: the route migration is irreversible.
+
+### Security
+
+- **Job failure messages are redacted and bounded.** `rails_pulse_job_runs.error_message`
+  used to be stored raw and unbounded. It now goes through the same sanitizer as
+  exception messages: `key=value` / `key: value` / `"key":"value"` fragments are
+  masked whenever the key matches `config.filter_parameters` (same rules as logged
+  params), and MySQL `Duplicate entry '<value>'` values are redacted alongside
+  PostgreSQL `DETAIL:` clauses.
+- **CSRF protection is now declared by the engine.** `RailsPulse::ApplicationController`
+  calls `protect_from_forgery with: :exception` itself instead of inheriting it from the
+  host's `default_protect_from_forgery`, which only `load_defaults 5.2+` enables. Hosts
+  on an older `load_defaults` had no CSRF protection on any engine endpoint (tags,
+  exception status, query reanalyze, session filters). Brakeman's `CheckForgerySetting`
+  is no longer skipped.
+- **Authentication hooks fail closed.** An `authentication_method` that returned
+  `false` without rendering or redirecting used to grant access — `proc { current_user&.admin? }`
+  looked right and let every non-admin in. Literal `false` is now a 403; `nil`
+  (what the documented `unless … redirect_to … end` style returns on success) still allows.
+- **EXPLAIN hardening.** The query analyzer now refuses SQL containing `;`, `--` or `/*`
+  anywhere (PostgreSQL's `execute` runs every statement in a string, so a captured
+  `SELECT …; UPDATE …` would have re-run the UPDATE on each page view), runs the
+  PostgreSQL EXPLAIN inside `SET LOCAL transaction_read_only = on` with a 5s
+  `statement_timeout` instead of `Timeout.timeout`, and always rolls its savepoint back.
+- **Deployments API input is bounded.** `revision` is capped at 255 characters,
+  serialized `metadata` at 4 KB, and `started_at` may be at most one hour in the future
+  (a forged future marker would have stamped every later exception with a revision
+  that never shipped). `rails_pulse_deployments` now has a count cap
+  (`max_table_records`, default 1 000) enforced by `CleanupService`; deployments are
+  never pruned by age.
+- **Backtrace source snippets are limited to `app/`, `lib/` and `config/routes.rb`**
+  (`.rb`, `.erb`, `.rake`, `.haml`, `.slim`, `.jbuilder`). Previously any file under
+  `Rails.root` was readable through a backtrace frame, including initializers with
+  inline keys, `config/database.yml`, and `.env`.
+- **Standalone dashboard session cookie is `Secure` in production** (override with
+  `RAILS_PULSE_INSECURE_SESSION=1`). The rackup's "no Rails app" branch, which could
+  never boot (`NameError: uninitialized constant Rails`), is replaced with a clear
+  error; the deployment docs now give the working invocation.
+
+### Added
+
+- **Exception tracking** — Captures unhandled exceptions from web requests and
+  background jobs, groups them by class and location, and displays backtraces (first
+  50 frames) with filtered request params in a new Exceptions tab. Exception
+  messages are redacted before storage: `key=value` / `key: value` / `"key":"value"`
+  fragments are masked whenever the key matches `config.filter_parameters`, and
+  MySQL `Duplicate entry '<value>'` values are redacted alongside PostgreSQL
+  `DETAIL:` clauses.
+- **`track_exceptions` config option** — Gem default is `false`, so existing installs
+  do not begin capturing on upgrade; the upgrade generator inserts `false`
+  explicitly. The install template sets `true` for new apps.
+- **`capture_exception_params` config option** — Captures request params alongside
+  each occurrence, filtered via Rails' `filter_parameters`. Occurrences whose params
+  exceed 10 KB after filtering are stored without params. Default `true`, and only
+  consulted while `track_exceptions` is on.
+- **`exception_message_filter` config option** — an optional `->(message, exception)`
+  hook applied after the built-in redaction for app-specific patterns. If the hook
+  raises, the message is stored as `[FILTERED]` rather than unfiltered.
+- **`authorize` config option** — a fail-closed predicate, `->(controller) { … }`
+  (or a zero-argument proc run in the controller). Anything falsy is a 403. Runs after
+  `authentication_method` when both are set, and replaces the HTTP Basic fallback on
+  its own. This is now the recommended way to gate the dashboard.
+- **Upgrade generator syncs new initializer settings** — Appends keys (and
+  `max_table_records` entries) the host file does not already mention, without
+  rewriting existing values. Review with `git diff`.
+
+### Changed
+
+- **BREAKING — route identity is now `[controller_action, path]`.** GET `/users`
+  (`users#index`) and POST `/users` (`users#create`) are distinct routes. Dynamic
+  paths are normalized at capture time (`/posts/42` → `/posts/:id`).
+- **A one-time backfill is mandatory.** `rails rails_pulse:migrate_routes` backfills
+  `controller_action` (from the live router, then from request history), collapses
+  historical literal paths, and merges routes sharing an action (GET+POST `/sign_in`
+  → `sessions#new`). A schema migrate alone leaves the Action column empty. The
+  upgrade generator and the dashboard both warn when the step is outstanding.
+- **The JavaScript bundle is 66% smaller: 2.19 MB → 759 KB (754 KB → 248 KB gzipped).**
+  ECharts is now tree-shaken — `application.js` imports from `echarts/core` and
+  registers only the series and components the dashboard uses, instead of the
+  `echarts` barrel that bundled every chart type including maps, sankey and gauge.
+  Charts outside that set must now register their module explicitly; see
+  `docs/stimulus_echarts_usage.md`. The stylesheet is 5% smaller.
+
+### Removed
+
+- **BREAKING — `rails_pulse_routes.method` is dropped.** The HTTP verb now lives on
+  each request (`rails_pulse_requests.method`); a route carries an `http_methods`
+  array instead. All application, worker, and dashboard processes must be restarted
+  together against the migrated schema. A rolling restart that leaves 0.3.x
+  processes running will silently drop request tracking and 500 the routes dashboard.
+- **BREAKING — the route migration is irreversible.** `db:rollback` raises
+  `ActiveRecord::IrreversibleMigration` on
+  `ChangeRailsPulseRoutesToMultiVerbModel`, and routes merged by
+  `rails_pulse:migrate_routes` are deleted with no audit trail. Recovery from a bad
+  upgrade is restore-from-backup only.
+- **Three unreachable Stimulus controllers** — `form`, `timezone` and
+  `period_selector` — were bundled and registered despite no view referencing them.
+  `timezone` also ran a `MutationObserver` over the whole document body.
+- **`theme.js`**, which registered a chart theme that `application.js` immediately
+  overwrote. Its UMD wrapper called `require('echarts')`, which alone would have
+  defeated the tree-shaking above.
+- **Dead CSS**: unused css-zero ports, the removed dashboard period selector's styles,
+  and the disabled `toolbox` chart option.
+- **`csp-test.js` is no longer shipped in the gem.** Its page is mounted only when
+  `Rails.env.local?`, so it was unreachable in a published gem. It remains in the
+  repository for development and the CSP compliance system test.
+
+### Fixed
+
+- **Tag filters work on SQLite for tags containing `_`.** The `LIKE` patterns were
+  escaped but issued without an `ESCAPE` clause; SQLite has no default escape
+  character, so `my_tag` never matched and "hide records tagged my_tag" hid nothing.
+  All three adapters now get an explicit `ESCAPE '!'`.
+- **Hand-edited query strings no longer 500.** `?q=string`, unparseable custom date
+  ranges, unparseable `occurred_at` filters, a non-array `enabled_tags`, and
+  oversized or unparseable session time filters all fall back to defaults instead of
+  raising. Session-stored presets and performance thresholds are validated against
+  the known values.
+- **Chart click/zoom got slower the more you switched chart tabs.** The requests,
+  routes and queries index pages attached a fresh `document` mouseup listener every
+  time a chart tab was re-selected, and only the most recent one was ever removed.
+  After N switches a single click anywhere on the page re-ran the zoom handler N
+  times. The listener is now bound once per controller.
+- **Zooming onto the first column of a category chart reset the range.** Visible-range
+  extraction used `dataZoom.startValue || 0`, so a legitimate index of `0` fell through
+  to the full-axis fallback.
+- **Hover popovers could throw after a table refresh.** `popover_controller` left its
+  show/hide timers running on disconnect, so a pending 700ms open could fire against
+  an element a fetch had already replaced.
+- **The time range selector's hover border was invisible.** It referenced
+  `--color-border-emphasis`, which is defined nowhere, so the declaration was invalid
+  at computed-value time and the border fell back to `currentColor`. Its light-mode
+  rules also never applied on a first visit, because `data-color-scheme` is only set
+  after an explicit toggle.
+- **`[popover].positioned` was declared twice** at equal specificity, so correct
+  popover placement depended on CSS file load order. Merged into one rule.
+- Fixed upgrading when using a separate database installation.
+- Separate-database installs set `schema_dump: false`, so `db:migrate` no longer
+  dumps or loads `db/rails_pulse_structure.sql` (#189).
+- Fixed `assets:precompile` failing on memory-constrained hosts by not registering
+  dashboard assets with the host Sprockets pipeline. Precompile copies the pre-built
+  files into `public/assets` (digested, no compressor) so `config.asset_host` and
+  CDN-only CSP work; development and hosts without a pipeline still use
+  `/rails-pulse-assets/<gem-version>/...`.
+- SQLite `schema.rb` now keeps the partial unique index on unrecognised routes
+  (`WHERE controller_action IS NULL`). A raw `CREATE INDEX` was dumped without the
+  predicate, so `db:schema:load` and parallel tests unique-constrained every path.
+
+### Upgrading from 0.3.x
+
+Applies to every 0.3.x release (0.3.0 through 0.3.3). **Back up your database first.**
+
+```bash
+bundle update rails_pulse
+rails generate rails_pulse:upgrade
+rails db:migrate                  # separate Pulse database: rails db:migrate:rails_pulse
+rails rails_pulse:migrate_routes  # required — schema migrate alone leaves Action empty
+```
+
+Then restart **all** processes together, not as a rolling deploy.
+
+Separate-database hosts: add `schema_dump: false` to the `rails_pulse` entry in
+`config/database.yml` and delete `db/rails_pulse_structure.sql` if it exists. Do not
+run `db:setup` / `db:prepare` as a substitute for `db:migrate:rails_pulse`.
+
+Exception tracking stays off after upgrading. Set `config.track_exceptions = true`
+once you have reviewed what is captured.
+
+## [0.3.3] - 2026-06-23
+
+- **Deployment tracking** — Record deployments via `POST /rails_pulse/deployments` or `rake rails_pulse:record_deployment[sha]`. Deployments appear as vertical marker lines on performance charts so you can correlate releases with regressions
+- **`deployment_api_token` config option** — Secures the deployments endpoint with a token header for CI/CD use
+- All multi-series charts now use a native ECharts time axis (`[timestamp_ms, value]` pairs) instead of a separate labels array, enabling deployment markers and better zoom behaviour
+
+## [0.3.0] - 2026-04-30
+
+This is the largest release to date — a full UI overhaul across every section of
+the dashboard. Charts are now switchable, the dashboard surfaces health status
+automatically, and the underlying controller and model code has been substantially
+refactored. Existing installs need to run the two new migrations. Hopefully future
+releases will be smaller and more incremental than this one.
+
+### Added
+
+- **New chart types across all sections** — Routes, queries, and jobs now have dedicated chart panels with switchable chart types (response time percentiles, request volume, error rate, execution volume, duration, failure rate)
+- **Dashboard health summary** — New `HealthSummary` model surfaces an overall health status and highlights routes/queries/jobs that need attention
+- **Dashboard "Needs Attention" section** — Automatically surfaces slow routes, high error rates, and problematic jobs without manual digging
+- **Storage pressure indicator** — Tracks and displays database storage growth so you know when to adjust retention settings
+- **Flame graph view for requests** — Request detail pages now include a flame graph visualisation of operation timing
+- **P95 duration tracking for jobs** — Job runs now record and display p95 duration alongside average duration
+- **Database load metric for queries** — New card and chart tracking cumulative database load (execution count × avg duration) over time
+- **Diagnostic fields for queries** — Query show pages now surface diagnostic information alongside existing analysis
+- **Chart series toggle** — Show/hide individual series on charts without leaving the page
+- **Performance status concern** — Shared `HasPerformanceStatus` concern for models that report a health status
+- **Metric strip component** — New compact summary strip component for displaying multiple metrics inline
+- **Setup banner** — Onboarding banner shown to users who haven't completed setup
+- **Time range selector** — Redesigned time range UI with a custom date range option
+- **Suggestions service** — Query show pages surface optimisation suggestions (caching, controller, SQL, HTTP, view) via dedicated suggestion services
+- **Statistics module** — New `RailsPulse::Statistics` module for shared statistical calculations
+- **Cleanup stats reporter** — Detailed reporting on what the cleanup job removed each run
+- **Cleanup task runner** — Extracted cleanup orchestration into `CleanupTaskRunner` for testability
+- **Config and migration installers** — Extracted install/upgrade logic into `ConfigInstaller` and `MigrationInstaller` classes
+- **Schema parser** — New `SchemaParser` for reading and diffing schema state during upgrades
+- **Icon helper** — Centralised `IconHelper` for rendering SVG icons
+- **Route helper** — Centralised `RouteHelper` for building internal dashboard links
+- **CSP helper** — Dedicated `CspHelper` for content security policy nonce management
+- **Backfill summaries job** — New job to backfill summary records for historical data
+
+### Changed
+
+- **Dashboard redesigned** — Full dashboard overhaul with health summary, attention sections, and chart panels replacing the previous card layout
+- **Routes, queries, and jobs index pages redesigned** — Consistent layout with metric cards, switchable chart tabs, and paginated tables
+- **Metric card component updated** — Cards now support a richer data structure with trend indicators
+- **Application controller refactored** — Controller concerns split into focused modules (`ChartTableConcern`, `MetricCardConcern`, `PaginationConcern`, `SessionFiltersConcern`, `TagFilterConcern`, `TimeRangeConcern`, `ZoomRangeConcern`)
+- **`normalized_sql` column expanded to `text`** — Removes the 1000-character limit on PostgreSQL and MySQL (migration provided for existing installs)
+- **Diagnostic fields added to queries table** — New columns captured at instrumentation time
+- **Summary job and service refactored** — Cleaner separation between job scheduling and summary calculation logic
+- **Cleanup job refactored** — Now uses `CleanupTaskRunner` and reports statistics via `CleanupStatsReporter`
+- **Configuration expanded** — New configuration options exposed in the initializer template
+- **Upgrade generator simplified** — Generator now delegates to `MigrationInstaller` and `ConfigInstaller`
+- **Asset server middleware updated** — Improved asset serving reliability
+- **Request collector middleware updated** — Performance improvements and cleaner instrumentation
+- **Operation subscriber refactored** — Cleaner event handling and reduced complexity
+- **Seeds refactored** — Dummy app seeds split into focused files under `db/seeds/rails_pulse/`
+- **Test coverage significantly expanded** — Controller concerns, helpers, models, services, and system tests all substantially extended
+
+### Removed
+
+- `StatusHelper` removed — status rendering consolidated into model concerns and view components
+- `ChartFormatters` helper removed — chart formatting moved into chart model classes
+- `chart_formatters_test.rb` removed alongside the helper
+- Slow queries and slow routes table models removed — replaced by the Needs Attention system
+- Unused `average_response_time` and `p95_response_time` dashboard chart classes removed
+- `requests/tables/index.rb` and related test removed — requests index now uses a shared approach
+- `routes/cards/average_response_times` and `routes/charts/average_response_times` removed — replaced by percentile-based equivalents
+- `jobs/cards/average_duration` and `jobs/cards/total_jobs` removed — replaced by updated cards
+- Timezone controller removed
+- Application mailer stub removed
+
+## [0.2.7] - 2026-04-17
+
+No changelog entry — see git history.
+
+## [0.2.6] - 2026-04-15
+
+No changelog entry — see git history.
+
+## [0.2.5] - 2026-04-14
+
+No changelog entry — see git history.
+
+[Unreleased]: https://github.com/railspulse/rails_pulse/compare/v0.4.0.pre.1...HEAD
+[0.4.0.pre.1]: https://github.com/railspulse/rails_pulse/compare/v0.3.3...v0.4.0.pre.1
+[0.3.3]: https://github.com/railspulse/rails_pulse/compare/v0.3.2...v0.3.3
+[0.3.0]: https://github.com/railspulse/rails_pulse/compare/v0.2.7...v0.3.0
+[0.2.7]: https://github.com/railspulse/rails_pulse/compare/v0.2.6...v0.2.7
+[0.2.6]: https://github.com/railspulse/rails_pulse/compare/v0.2.5...v0.2.6
+[0.2.5]: https://github.com/railspulse/rails_pulse/releases/tag/v0.2.5

data/README.md

@@ -13,7 +13,7 @@
 ![License](https://img.shields.io/badge/License-MIT-green)
 ![Ruby Version](https://img.shields.io/badge/Ruby-3.0%2B-red)
 
-Rails Pulse is a Rails engine that monitors your app's performance from the inside. It tracks slow requests, N+1 queries, SQL performance, and background jobs. All data stays in your own database, no third-party cloud, no SaaS subscription, no data leaving your servers.
+Rails Pulse is a Rails engine that monitors your app's performance from the inside. It tracks slow requests, N+1 queries, SQL performance, background jobs, and unhandled exceptions. All data stays in your own database, no third-party cloud, no SaaS subscription, no data leaving your servers.
 
 <table border="0">
   <tr border="0" style="border:0">
@@ -60,6 +60,32 @@ RailsPulse::CleanupJob.perform_later  # cron: 0 1 * * *
 
 Your dashboard is now at `http://localhost:3000/rails_pulse`.
 
+## Upgrading
+
+From 0.3.3:
+
+```bash
+bundle update rails_pulse
+rails generate rails_pulse:upgrade
+rails db:migrate                  # or: rails db:migrate:rails_pulse
+rails rails_pulse:migrate_routes  # required — fills Action and merges same-action paths
+```
+
+Restart all processes after migrate. This release changes how routes are stored (`method` moves off the route onto each request), so mixed old/new processes are not supported.
+
+The upgrade generator appends new settings to `config/initializers/rails_pulse.rb` without rewriting what you already set. Review with `git diff` and keep or discard hunks.
+
+Exception tracking is **off** for existing installs. The generator inserts `config.track_exceptions = false`; set it to `true` after migrating to opt in:
+
+```ruby
+config.track_exceptions = true
+config.capture_exception_params = true  # params are filtered via Rails' filter_parameters
+```
+
+Separate-database hosts: set `schema_dump: false` on the `rails_pulse` entry in `config/database.yml` and delete `db/rails_pulse_structure.sql` if that file exists.
+
+If you previously added `rails-pulse.js` / `rails-pulse.css` to `config.assets.precompile`, remove those entries — the gem no longer registers dashboard assets with Sprockets (that re-minify OOMs small hosts). Production deploys that use `config.asset_host` or a CDN-only CSP should run `assets:precompile` so `rails_pulse:install_assets` copies digested files into `public/assets`.
+
 Full install guide: [railspulse.com/documentation/installation](https://railspulse.com/documentation/installation)
 
 Separate database setup: [railspulse.com/documentation/database](https://railspulse.com/documentation/database)
@@ -81,6 +107,9 @@ RailsPulse.configure do |config|
   config.track_jobs = true
   config.capture_job_arguments = false  # keep false to protect sensitive data
 
+  config.track_exceptions = true
+  config.capture_exception_params = true  # params are filtered via Rails' filter_parameters
+
   config.full_retention_period = 30.days
 end
 ```
@@ -89,11 +118,20 @@ Full configuration reference: [railspulse.com/documentation/advanced](https://ra
 
 ## Authentication
 
-Rails Pulse has no built-in authentication, you protect the dashboard using your app's existing auth. Add an `authentication_method` to the initializer:
+Rails Pulse has no built-in user accounts; you protect the dashboard using your app's existing auth. Authentication is on by default outside development and test, and with nothing configured it falls back to HTTP Basic against `RAILS_PULSE_USERNAME` / `RAILS_PULSE_PASSWORD` (denying everything if the password is unset).
+
+The simplest hook is a predicate that receives the controller and returns `true` to allow — anything else is a 403:
+
+```ruby
+RailsPulse.configure do |config|
+  config.authorize = ->(controller) { controller.current_user&.admin? }
+end
+```
+
+If you need to redirect to a login page instead, use `authentication_method`, which runs inside the controller and denies by rendering or redirecting:
 
 ```ruby
 RailsPulse.configure do |config|
-  config.authentication_enabled = true
   config.authentication_redirect_path = "/login"
 
   config.authentication_method = proc {
@@ -104,6 +142,8 @@ RailsPulse.configure do |config|
 end
 ```
 
+Returning `false` from `authentication_method` without responding is also treated as a denial, but `nil` (what `unless … end` returns on success) allows the request — so keep predicate-style checks in `authorize`.
+
 Authentication guide: [railspulse.com/documentation/authentication](https://railspulse.com/documentation/authentication)
 
 ## Features
@@ -111,6 +151,7 @@ Authentication guide: [railspulse.com/documentation/authentication](https://rail
 - **Request monitoring** — every request is timed and stored with its route, status, SQL count, and duration. Slow requests are flagged automatically based on thresholds you control.
 - **Query analysis** — captures the queries behind each request, detects N+1 patterns, and tracks normalized SQL across requests so you can see which queries are hurting you in production, not just in development.
 - **Job tracking** — monitors background job duration, queue wait time, and failure rates. Works with any Active Job adapter.
+- **Exception tracking** — captures unhandled exceptions from web requests and background jobs, groups them by class and location, and shows full backtraces with filtered request params. See recurring errors in production without a separate error monitoring service.
 - **System health bar** — at-a-glance dashboard summary showing healthy, slow, and critical counts across your routes, queries, jobs, and storage. Lets you see the overall state of your app before drilling into specifics.
 - **No data leaves your app** — everything is stored in your own database. No third-party cloud, no SaaS subscription, no outbound connections.
 - **Low overhead** — tracking is async and uses a thread-local flag to skip recording Rails Pulse's own internal requests.

data/app/assets/stylesheets/rails_pulse/application.css

@@ -41,6 +41,27 @@ html[data-color-scheme="dark"] .badge--negative-inverse {
   --badge-background: rgb(47, 47, 47);
 }
 
+html[data-color-scheme="dark"] .badge--get {
+  --badge-background: var(--blue-950);
+  --badge-color: var(--blue-200);
+}
+
+html[data-color-scheme="dark"] .badge--post {
+  --badge-background: var(--green-950);
+  --badge-color: var(--green-200);
+}
+
+html[data-color-scheme="dark"] .badge--put,
+html[data-color-scheme="dark"] .badge--patch {
+  --badge-background: var(--amber-950);
+  --badge-color: var(--amber-200);
+}
+
+html[data-color-scheme="dark"] .badge--delete {
+  --badge-background: var(--red-950);
+  --badge-color: var(--red-200);
+}
+
 html[data-color-scheme="dark"] .input {
   --input-background: #535252;
   --input-border-color: #7e7d7d;
@@ -161,19 +182,6 @@ html[data-color-scheme="dark"] .input {
   z-index: 10;
 }
 
-.flame-bar-label {
-  font-size: 11px;
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  padding: 0 5px;
-  line-height: 20px;
-  color: rgba(255, 255, 255, 0.92);
-  display: block;
-  pointer-events: none;
-  user-select: none;
-}
-
 .flame-time-axis {
   position: relative;
   height: 20px;
@@ -232,22 +240,3 @@ html[data-color-scheme="dark"] .input {
   font-size: 11px;
 }
 
-/* REQUEST OPERATIONS BAR */
-.bar-container {
-  height:10px;
-  position:relative
-}
-.bar {
-  background-color:#727579;
-  height:100%;
-  position:absolute;
-  top:0
-}
-.bar:first-child {
-  border-bottom-left-radius:1px;
-  border-top-left-radius:1px
-}
-.bar:last-child {
-  border-bottom-right-radius:1px;
-  border-top-right-radius:1px
-}

data/app/assets/stylesheets/rails_pulse/components/backtrace.css

@@ -0,0 +1,238 @@
+.backtrace {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+  font-size: 12px;
+  border-radius: 6px;
+  overflow: hidden;
+}
+
+.backtrace__frame {
+  display: flex;
+  flex-direction: column;
+  border-bottom: 1px solid var(--color-border-light);
+}
+
+.backtrace__frame:last-child {
+  border-bottom: none;
+}
+
+.backtrace__row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  padding: 7px 12px 7px 0;
+}
+
+/* App frames: highlighted with a coloured left accent */
+.backtrace__frame--app {
+  background-color: rgba(59, 130, 246, 0.08);
+  border-left: 3px solid var(--blue-400, #3b82f6);
+}
+
+/* Gem/stdlib frames: muted */
+.backtrace__frame--gem {
+  background-color: var(--color-surface);
+  border-left: 3px solid transparent;
+  opacity: 0.75;
+}
+
+.backtrace__frame--gem:hover {
+  opacity: 1;
+}
+
+.backtrace__location {
+  display: flex;
+  align-items: baseline;
+  gap: 0;
+  flex: 1;
+  min-width: 0;
+  overflow: hidden;
+}
+
+.backtrace__path {
+  color: var(--color-text-subtle);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  flex-shrink: 1;
+  min-width: 0;
+}
+
+.backtrace__file {
+  color: var(--color-text);
+  font-weight: 700;
+  white-space: nowrap;
+  flex-shrink: 0;
+}
+
+.backtrace__method {
+  flex-shrink: 0;
+  color: var(--color-text-subtle);
+  white-space: nowrap;
+  font-size: 11px;
+}
+
+.backtrace__method span {
+  color: var(--color-text);
+  font-weight: 500;
+}
+
+/* Source expand toggle — only the chevron is interactive */
+
+.backtrace__source-details {
+  flex-shrink: 0;
+  line-height: 1;
+}
+
+.backtrace__toggle-spacer {
+  flex-shrink: 0;
+  width: 40px;
+}
+
+.backtrace__toggle {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 40px;
+  height: 40px;
+  cursor: pointer;
+  list-style: none;
+  color: var(--color-text-subtle);
+  font-size: 32px;
+  border-radius: 3px;
+  transition: background-color 0.1s ease, color 0.1s ease;
+  user-select: none;
+}
+
+.backtrace__toggle::-webkit-details-marker {
+  display: none;
+}
+
+.backtrace__toggle::after {
+  content: "›";
+  display: block;
+  transition: transform 0.15s ease;
+}
+
+.backtrace__toggle:hover {
+  background-color: var(--color-bg-hover, rgba(0,0,0,0.06));
+  color: var(--color-text);
+}
+
+.backtrace__source-details[open] .backtrace__toggle::after {
+  transform: rotate(90deg);
+}
+
+/* Source code panel */
+
+.backtrace__source {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+  font-size: 12px;
+  background-color: var(--color-bg-subtle, #f9fafb);
+  border-top: 1px solid var(--color-border-light);
+  overflow-x: auto;
+}
+
+.backtrace__source--hidden {
+  display: none;
+}
+
+.backtrace__frame:has(.backtrace__source-details[open]) .backtrace__source {
+  display: block;
+}
+
+.backtrace__source-line {
+  display: flex;
+  gap: 0;
+  line-height: 1.6;
+  white-space: pre;
+}
+
+.backtrace__source-line--current {
+  background-color: rgba(234, 179, 8, 0.15);
+}
+
+.backtrace__source-lineno {
+  flex-shrink: 0;
+  width: 44px;
+  padding: 0 12px 0 8px;
+  text-align: right;
+  color: var(--color-text-subtle);
+  border-right: 1px solid var(--color-border-light);
+  user-select: none;
+}
+
+.backtrace__source-line--current .backtrace__source-lineno {
+  color: rgba(161, 98, 7, 0.9);
+  background-color: rgba(234, 179, 8, 0.2);
+  font-weight: 700;
+}
+
+.backtrace__source-code {
+  padding: 0 12px;
+  color: var(--color-text);
+  flex: 1;
+}
+
+/* Request params */
+
+.exception-params {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+  font-size: 12px;
+  border-radius: 6px;
+  overflow: hidden;
+  border: 1px solid var(--color-border-light);
+}
+
+.exception-params__row {
+  display: flex;
+  gap: 16px;
+  padding: 6px 12px;
+  border-bottom: 1px solid var(--color-border-light);
+  align-items: baseline;
+}
+
+.exception-params__row:last-child {
+  border-bottom: none;
+}
+
+
+.exception-params__key {
+  flex-shrink: 0;
+  width: 200px;
+  color: var(--color-text-subtle);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.exception-params__value {
+  color: var(--color-text);
+  word-break: break-all;
+}
+
+/* Dark mode */
+html[data-color-scheme="dark"] .backtrace__frame--app {
+  background-color: rgba(59, 130, 246, 0.15);
+  border-left-color: var(--blue-400, #3b82f6);
+}
+
+html[data-color-scheme="dark"] .backtrace__frame--gem {
+  background-color: transparent;
+}
+
+html[data-color-scheme="dark"] .backtrace__source {
+  background-color: rgba(0, 0, 0, 0.3);
+}
+
+html[data-color-scheme="dark"] .backtrace__source-line--current {
+  background-color: rgba(234, 179, 8, 0.1);
+}
+
+html[data-color-scheme="dark"] .backtrace__source-line--current .backtrace__source-lineno {
+  color: rgba(253, 224, 71, 0.8);
+  background-color: rgba(234, 179, 8, 0.12);
+}