rails_pulse 0.3.3 → 0.4.0.pre.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 36c07de8920dddd7bb85571c3c01b94c197866dfeb45c471cad71dc829c61601
-  data.tar.gz: c4cfbade2a92decf14272c76b32028918dab1bdc60d61bf95e9b6a9b69b0e07b
+  metadata.gz: b102fc4776d7fe701b47011e02d682f47a2784500103f3cb7d7598a757b174ff
+  data.tar.gz: 34f4055047c1bb9151c9e811f14c4e90fe83e52508c61ea4433929b2b431d568
 SHA512:
-  metadata.gz: 65565ffc47a14f6b4402dd3c83bddd8c422732460b91bf4a07655cc9de034d8535e0ccc679bbeb83e33ca83694d2891868dc60ee2e90243f20c0503287bba8b2
-  data.tar.gz: b2b2c03e714bd1081ee152aadcc72f892b5a5927d2823725b10eb4ddaebaceedc5216ac48fbfe56372cb77f9b3701645f9eea27c62d400ad39ed4bef0840717c
+  metadata.gz: 974fcf20833ab11e46a00db96d21590f32a699a73de8d2af229d1fa5559f0817c107ba684f4ada34cdb067a77f6293ecc11ee3d24f7911f9fe074353a2991d79
+  data.tar.gz: 507afdae03f11fef23d0bbd7cc5ee8e8123656e41efbc219a10f8b6682602bfb7dcfa91e9ac424352d68ad05b3bceed4070eead220d053713f56aa1ade7bec01

data/CHANGELOG.md

@@ -0,0 +1,299 @@
+# Changelog
+
+All notable changes to Rails Pulse will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.4.0.pre.2] - 2026-09-04
+
+### Fixed
+
+- **`rails generate rails_pulse:upgrade` wrote a migration that would not parse.**
+  The schema parser matched a column comment with `comment: "([^"]*)"`, which stops
+  at the first escaped quote. The `http_methods` comment embeds a `["GET","POST"]`
+  example, so it was truncated mid-escape and the trailing backslash escaped the
+  closing quote of the generated `comment:` string — the copied
+  `upgrade_rails_pulse_tables.rb` then failed to load with
+  `unterminated string meets end of file`. Comments are now matched as complete Ruby
+  string literals, decoded with `String#undump`, and re-escaped with `String#inspect`
+  when the migration is rendered.
+
+- **Background tracking writes corrupted the host app's test database connection.**
+  Under `use_transactional_tests` Rails pins one connection per pool and hands that
+  same connection to every thread, so the tracker's writer thread interleaved its
+  INSERTs with the test's own statements on a single socket. PostgreSQL reported
+  this as `message type 0x5a arrived from server while idle` and
+  `server sent data ("D" message) without prior row description`, and suites hung
+  or failed at random. The gem's own dummy app avoided it with
+  `config.async = false if Rails.env.test?`, but the installed initializer never
+  shipped that line. The tracker now writes inline whenever the pool's connection
+  is shared across threads, and `rails generate rails_pulse:install` adds the
+  test-environment line to the initializer. Existing installs should add
+  `config.async = false if Rails.env.test?` to `config/initializers/rails_pulse.rb`.
+
+## [0.4.0.pre.1] - 2026-09-03
+
+This release contains a **breaking schema change** and requires a one-time data
+migration. Read "Upgrading from 0.3.x" below before deploying. Take a database
+backup first: the route migration is irreversible.
+
+### Security
+
+- **Job failure messages are redacted and bounded.** `rails_pulse_job_runs.error_message`
+  used to be stored raw and unbounded. It now goes through the same sanitizer as
+  exception messages: `key=value` / `key: value` / `"key":"value"` fragments are
+  masked whenever the key matches `config.filter_parameters` (same rules as logged
+  params), and MySQL `Duplicate entry '<value>'` values are redacted alongside
+  PostgreSQL `DETAIL:` clauses.
+- **CSRF protection is now declared by the engine.** `RailsPulse::ApplicationController`
+  calls `protect_from_forgery with: :exception` itself instead of inheriting it from the
+  host's `default_protect_from_forgery`, which only `load_defaults 5.2+` enables. Hosts
+  on an older `load_defaults` had no CSRF protection on any engine endpoint (tags,
+  exception status, query reanalyze, session filters). Brakeman's `CheckForgerySetting`
+  is no longer skipped.
+- **Authentication hooks fail closed.** An `authentication_method` that returned
+  `false` without rendering or redirecting used to grant access — `proc { current_user&.admin? }`
+  looked right and let every non-admin in. Literal `false` is now a 403; `nil`
+  (what the documented `unless … redirect_to … end` style returns on success) still allows.
+- **EXPLAIN hardening.** The query analyzer now refuses SQL containing `;`, `--` or `/*`
+  anywhere (PostgreSQL's `execute` runs every statement in a string, so a captured
+  `SELECT …; UPDATE …` would have re-run the UPDATE on each page view), runs the
+  PostgreSQL EXPLAIN inside `SET LOCAL transaction_read_only = on` with a 5s
+  `statement_timeout` instead of `Timeout.timeout`, and always rolls its savepoint back.
+- **Deployments API input is bounded.** `revision` is capped at 255 characters,
+  serialized `metadata` at 4 KB, and `started_at` may be at most one hour in the future
+  (a forged future marker would have stamped every later exception with a revision
+  that never shipped). `rails_pulse_deployments` now has a count cap
+  (`max_table_records`, default 1 000) enforced by `CleanupService`; deployments are
+  never pruned by age.
+- **Backtrace source snippets are limited to `app/`, `lib/` and `config/routes.rb`**
+  (`.rb`, `.erb`, `.rake`, `.haml`, `.slim`, `.jbuilder`). Previously any file under
+  `Rails.root` was readable through a backtrace frame, including initializers with
+  inline keys, `config/database.yml`, and `.env`.
+- **Standalone dashboard session cookie is `Secure` in production** (override with
+  `RAILS_PULSE_INSECURE_SESSION=1`). The rackup's "no Rails app" branch, which could
+  never boot (`NameError: uninitialized constant Rails`), is replaced with a clear
+  error; the deployment docs now give the working invocation.
+
+### Added
+
+- **Exception tracking** — Captures unhandled exceptions from web requests and
+  background jobs, groups them by class and location, and displays backtraces (first
+  50 frames) with filtered request params in a new Exceptions tab. Exception
+  messages are redacted before storage: `key=value` / `key: value` / `"key":"value"`
+  fragments are masked whenever the key matches `config.filter_parameters`, and
+  MySQL `Duplicate entry '<value>'` values are redacted alongside PostgreSQL
+  `DETAIL:` clauses.
+- **`track_exceptions` config option** — Gem default is `false`, so existing installs
+  do not begin capturing on upgrade; the upgrade generator inserts `false`
+  explicitly. The install template sets `true` for new apps.
+- **`capture_exception_params` config option** — Captures request params alongside
+  each occurrence, filtered via Rails' `filter_parameters`. Occurrences whose params
+  exceed 10 KB after filtering are stored without params. Default `true`, and only
+  consulted while `track_exceptions` is on.
+- **`exception_message_filter` config option** — an optional `->(message, exception)`
+  hook applied after the built-in redaction for app-specific patterns. If the hook
+  raises, the message is stored as `[FILTERED]` rather than unfiltered.
+- **`authorize` config option** — a fail-closed predicate, `->(controller) { … }`
+  (or a zero-argument proc run in the controller). Anything falsy is a 403. Runs after
+  `authentication_method` when both are set, and replaces the HTTP Basic fallback on
+  its own. This is now the recommended way to gate the dashboard.
+- **Upgrade generator syncs new initializer settings** — Appends keys (and
+  `max_table_records` entries) the host file does not already mention, without
+  rewriting existing values. Review with `git diff`.
+
+### Changed
+
+- **BREAKING — route identity is now `[controller_action, path]`.** GET `/users`
+  (`users#index`) and POST `/users` (`users#create`) are distinct routes. Dynamic
+  paths are normalized at capture time (`/posts/42` → `/posts/:id`).
+- **A one-time backfill is mandatory.** `rails rails_pulse:migrate_routes` backfills
+  `controller_action` (from the live router, then from request history), collapses
+  historical literal paths, and merges routes sharing an action (GET+POST `/sign_in`
+  → `sessions#new`). A schema migrate alone leaves the Action column empty. The
+  upgrade generator and the dashboard both warn when the step is outstanding.
+- **The JavaScript bundle is 66% smaller: 2.19 MB → 759 KB (754 KB → 248 KB gzipped).**
+  ECharts is now tree-shaken — `application.js` imports from `echarts/core` and
+  registers only the series and components the dashboard uses, instead of the
+  `echarts` barrel that bundled every chart type including maps, sankey and gauge.
+  Charts outside that set must now register their module explicitly; see
+  `docs/stimulus_echarts_usage.md`. The stylesheet is 5% smaller.
+
+### Removed
+
+- **BREAKING — `rails_pulse_routes.method` is dropped.** The HTTP verb now lives on
+  each request (`rails_pulse_requests.method`); a route carries an `http_methods`
+  array instead. All application, worker, and dashboard processes must be restarted
+  together against the migrated schema. A rolling restart that leaves 0.3.x
+  processes running will silently drop request tracking and 500 the routes dashboard.
+- **BREAKING — the route migration is irreversible.** `db:rollback` raises
+  `ActiveRecord::IrreversibleMigration` on
+  `ChangeRailsPulseRoutesToMultiVerbModel`, and routes merged by
+  `rails_pulse:migrate_routes` are deleted with no audit trail. Recovery from a bad
+  upgrade is restore-from-backup only.
+- **Three unreachable Stimulus controllers** — `form`, `timezone` and
+  `period_selector` — were bundled and registered despite no view referencing them.
+  `timezone` also ran a `MutationObserver` over the whole document body.
+- **`theme.js`**, which registered a chart theme that `application.js` immediately
+  overwrote. Its UMD wrapper called `require('echarts')`, which alone would have
+  defeated the tree-shaking above.
+- **Dead CSS**: unused css-zero ports, the removed dashboard period selector's styles,
+  and the disabled `toolbox` chart option.
+- **`csp-test.js` is no longer shipped in the gem.** Its page is mounted only when
+  `Rails.env.local?`, so it was unreachable in a published gem. It remains in the
+  repository for development and the CSP compliance system test.
+
+### Fixed
+
+- **Tag filters work on SQLite for tags containing `_`.** The `LIKE` patterns were
+  escaped but issued without an `ESCAPE` clause; SQLite has no default escape
+  character, so `my_tag` never matched and "hide records tagged my_tag" hid nothing.
+  All three adapters now get an explicit `ESCAPE '!'`.
+- **Hand-edited query strings no longer 500.** `?q=string`, unparseable custom date
+  ranges, unparseable `occurred_at` filters, a non-array `enabled_tags`, and
+  oversized or unparseable session time filters all fall back to defaults instead of
+  raising. Session-stored presets and performance thresholds are validated against
+  the known values.
+- **Chart click/zoom got slower the more you switched chart tabs.** The requests,
+  routes and queries index pages attached a fresh `document` mouseup listener every
+  time a chart tab was re-selected, and only the most recent one was ever removed.
+  After N switches a single click anywhere on the page re-ran the zoom handler N
+  times. The listener is now bound once per controller.
+- **Zooming onto the first column of a category chart reset the range.** Visible-range
+  extraction used `dataZoom.startValue || 0`, so a legitimate index of `0` fell through
+  to the full-axis fallback.
+- **Hover popovers could throw after a table refresh.** `popover_controller` left its
+  show/hide timers running on disconnect, so a pending 700ms open could fire against
+  an element a fetch had already replaced.
+- **The time range selector's hover border was invisible.** It referenced
+  `--color-border-emphasis`, which is defined nowhere, so the declaration was invalid
+  at computed-value time and the border fell back to `currentColor`. Its light-mode
+  rules also never applied on a first visit, because `data-color-scheme` is only set
+  after an explicit toggle.
+- **`[popover].positioned` was declared twice** at equal specificity, so correct
+  popover placement depended on CSS file load order. Merged into one rule.
+- Fixed upgrading when using a separate database installation.
+- Separate-database installs set `schema_dump: false`, so `db:migrate` no longer
+  dumps or loads `db/rails_pulse_structure.sql` (#189).
+- Fixed `assets:precompile` failing on memory-constrained hosts by not registering
+  dashboard assets with the host Sprockets pipeline. Precompile copies the pre-built
+  files into `public/assets` (digested, no compressor) so `config.asset_host` and
+  CDN-only CSP work; development and hosts without a pipeline still use
+  `/rails-pulse-assets/<gem-version>/...`.
+- SQLite `schema.rb` now keeps the partial unique index on unrecognised routes
+  (`WHERE controller_action IS NULL`). A raw `CREATE INDEX` was dumped without the
+  predicate, so `db:schema:load` and parallel tests unique-constrained every path.
+
+### Upgrading from 0.3.x
+
+Applies to every 0.3.x release (0.3.0 through 0.3.3). **Back up your database first.**
+
+```bash
+bundle update rails_pulse
+rails generate rails_pulse:upgrade
+rails db:migrate                  # separate Pulse database: rails db:migrate:rails_pulse
+rails rails_pulse:migrate_routes  # required — schema migrate alone leaves Action empty
+```
+
+Then restart **all** processes together, not as a rolling deploy.
+
+Separate-database hosts: add `schema_dump: false` to the `rails_pulse` entry in
+`config/database.yml` and delete `db/rails_pulse_structure.sql` if it exists. Do not
+run `db:setup` / `db:prepare` as a substitute for `db:migrate:rails_pulse`.
+
+Exception tracking stays off after upgrading. Set `config.track_exceptions = true`
+once you have reviewed what is captured.
+
+## [0.3.3] - 2026-06-23
+
+- **Deployment tracking** — Record deployments via `POST /rails_pulse/deployments` or `rake rails_pulse:record_deployment[sha]`. Deployments appear as vertical marker lines on performance charts so you can correlate releases with regressions
+- **`deployment_api_token` config option** — Secures the deployments endpoint with a token header for CI/CD use
+- All multi-series charts now use a native ECharts time axis (`[timestamp_ms, value]` pairs) instead of a separate labels array, enabling deployment markers and better zoom behaviour
+
+## [0.3.0] - 2026-04-30
+
+This is the largest release to date — a full UI overhaul across every section of
+the dashboard. Charts are now switchable, the dashboard surfaces health status
+automatically, and the underlying controller and model code has been substantially
+refactored. Existing installs need to run the two new migrations. Hopefully future
+releases will be smaller and more incremental than this one.
+
+### Added
+
+- **New chart types across all sections** — Routes, queries, and jobs now have dedicated chart panels with switchable chart types (response time percentiles, request volume, error rate, execution volume, duration, failure rate)
+- **Dashboard health summary** — New `HealthSummary` model surfaces an overall health status and highlights routes/queries/jobs that need attention
+- **Dashboard "Needs Attention" section** — Automatically surfaces slow routes, high error rates, and problematic jobs without manual digging
+- **Storage pressure indicator** — Tracks and displays database storage growth so you know when to adjust retention settings
+- **Flame graph view for requests** — Request detail pages now include a flame graph visualisation of operation timing
+- **P95 duration tracking for jobs** — Job runs now record and display p95 duration alongside average duration
+- **Database load metric for queries** — New card and chart tracking cumulative database load (execution count × avg duration) over time
+- **Diagnostic fields for queries** — Query show pages now surface diagnostic information alongside existing analysis
+- **Chart series toggle** — Show/hide individual series on charts without leaving the page
+- **Performance status concern** — Shared `HasPerformanceStatus` concern for models that report a health status
+- **Metric strip component** — New compact summary strip component for displaying multiple metrics inline
+- **Setup banner** — Onboarding banner shown to users who haven't completed setup
+- **Time range selector** — Redesigned time range UI with a custom date range option
+- **Suggestions service** — Query show pages surface optimisation suggestions (caching, controller, SQL, HTTP, view) via dedicated suggestion services
+- **Statistics module** — New `RailsPulse::Statistics` module for shared statistical calculations
+- **Cleanup stats reporter** — Detailed reporting on what the cleanup job removed each run
+- **Cleanup task runner** — Extracted cleanup orchestration into `CleanupTaskRunner` for testability
+- **Config and migration installers** — Extracted install/upgrade logic into `ConfigInstaller` and `MigrationInstaller` classes
+- **Schema parser** — New `SchemaParser` for reading and diffing schema state during upgrades
+- **Icon helper** — Centralised `IconHelper` for rendering SVG icons
+- **Route helper** — Centralised `RouteHelper` for building internal dashboard links
+- **CSP helper** — Dedicated `CspHelper` for content security policy nonce management
+- **Backfill summaries job** — New job to backfill summary records for historical data
+
+### Changed
+
+- **Dashboard redesigned** — Full dashboard overhaul with health summary, attention sections, and chart panels replacing the previous card layout
+- **Routes, queries, and jobs index pages redesigned** — Consistent layout with metric cards, switchable chart tabs, and paginated tables
+- **Metric card component updated** — Cards now support a richer data structure with trend indicators
+- **Application controller refactored** — Controller concerns split into focused modules (`ChartTableConcern`, `MetricCardConcern`, `PaginationConcern`, `SessionFiltersConcern`, `TagFilterConcern`, `TimeRangeConcern`, `ZoomRangeConcern`)
+- **`normalized_sql` column expanded to `text`** — Removes the 1000-character limit on PostgreSQL and MySQL (migration provided for existing installs)
+- **Diagnostic fields added to queries table** — New columns captured at instrumentation time
+- **Summary job and service refactored** — Cleaner separation between job scheduling and summary calculation logic
+- **Cleanup job refactored** — Now uses `CleanupTaskRunner` and reports statistics via `CleanupStatsReporter`
+- **Configuration expanded** — New configuration options exposed in the initializer template
+- **Upgrade generator simplified** — Generator now delegates to `MigrationInstaller` and `ConfigInstaller`
+- **Asset server middleware updated** — Improved asset serving reliability
+- **Request collector middleware updated** — Performance improvements and cleaner instrumentation
+- **Operation subscriber refactored** — Cleaner event handling and reduced complexity
+- **Seeds refactored** — Dummy app seeds split into focused files under `db/seeds/rails_pulse/`
+- **Test coverage significantly expanded** — Controller concerns, helpers, models, services, and system tests all substantially extended
+
+### Removed
+
+- `StatusHelper` removed — status rendering consolidated into model concerns and view components
+- `ChartFormatters` helper removed — chart formatting moved into chart model classes
+- `chart_formatters_test.rb` removed alongside the helper
+- Slow queries and slow routes table models removed — replaced by the Needs Attention system
+- Unused `average_response_time` and `p95_response_time` dashboard chart classes removed
+- `requests/tables/index.rb` and related test removed — requests index now uses a shared approach
+- `routes/cards/average_response_times` and `routes/charts/average_response_times` removed — replaced by percentile-based equivalents
+- `jobs/cards/average_duration` and `jobs/cards/total_jobs` removed — replaced by updated cards
+- Timezone controller removed
+- Application mailer stub removed
+
+## [0.2.7] - 2026-04-17
+
+No changelog entry — see git history.
+
+## [0.2.6] - 2026-04-15
+
+No changelog entry — see git history.
+
+## [0.2.5] - 2026-04-14
+
+No changelog entry — see git history.
+
+[Unreleased]: https://github.com/railspulse/rails_pulse/compare/v0.4.0.pre.1...HEAD
+[0.4.0.pre.1]: https://github.com/railspulse/rails_pulse/compare/v0.3.3...v0.4.0.pre.1
+[0.3.3]: https://github.com/railspulse/rails_pulse/compare/v0.3.2...v0.3.3
+[0.3.0]: https://github.com/railspulse/rails_pulse/compare/v0.2.7...v0.3.0
+[0.2.7]: https://github.com/railspulse/rails_pulse/compare/v0.2.6...v0.2.7
+[0.2.6]: https://github.com/railspulse/rails_pulse/compare/v0.2.5...v0.2.6
+[0.2.5]: https://github.com/railspulse/rails_pulse/releases/tag/v0.2.5

data/README.md

@@ -13,7 +13,7 @@
 ![License](https://img.shields.io/badge/License-MIT-green)
 ![Ruby Version](https://img.shields.io/badge/Ruby-3.0%2B-red)
 
-Rails Pulse is a Rails engine that monitors your app's performance from the inside. It tracks slow requests, N+1 queries, SQL performance, and background jobs. All data stays in your own database, no third-party cloud, no SaaS subscription, no data leaving your servers.
+Rails Pulse is a Rails engine that monitors your app's performance from the inside. It tracks slow requests, N+1 queries, SQL performance, background jobs, and unhandled exceptions. All data stays in your own database, no third-party cloud, no SaaS subscription, no data leaving your servers.
 
 <table border="0">
   <tr border="0" style="border:0">
@@ -60,6 +60,32 @@ RailsPulse::CleanupJob.perform_later  # cron: 0 1 * * *
 
 Your dashboard is now at `http://localhost:3000/rails_pulse`.
 
+## Upgrading
+
+From 0.3.3:
+
+```bash
+bundle update rails_pulse
+rails generate rails_pulse:upgrade
+rails db:migrate                  # or: rails db:migrate:rails_pulse
+rails rails_pulse:migrate_routes  # required — fills Action and merges same-action paths
+```
+
+Restart all processes after migrate. This release changes how routes are stored (`method` moves off the route onto each request), so mixed old/new processes are not supported.
+
+The upgrade generator appends new settings to `config/initializers/rails_pulse.rb` without rewriting what you already set. Review with `git diff` and keep or discard hunks.
+
+Exception tracking is **off** for existing installs. The generator inserts `config.track_exceptions = false`; set it to `true` after migrating to opt in:
+
+```ruby
+config.track_exceptions = true
+config.capture_exception_params = true  # params are filtered via Rails' filter_parameters
+```
+
+Separate-database hosts: set `schema_dump: false` on the `rails_pulse` entry in `config/database.yml` and delete `db/rails_pulse_structure.sql` if that file exists.
+
+If you previously added `rails-pulse.js` / `rails-pulse.css` to `config.assets.precompile`, remove those entries — the gem no longer registers dashboard assets with Sprockets (that re-minify OOMs small hosts). Production deploys that use `config.asset_host` or a CDN-only CSP should run `assets:precompile` so `rails_pulse:install_assets` copies digested files into `public/assets`.
+
 Full install guide: [railspulse.com/documentation/installation](https://railspulse.com/documentation/installation)
 
 Separate database setup: [railspulse.com/documentation/database](https://railspulse.com/documentation/database)
@@ -81,6 +107,9 @@ RailsPulse.configure do |config|
   config.track_jobs = true
   config.capture_job_arguments = false  # keep false to protect sensitive data
 
+  config.track_exceptions = true
+  config.capture_exception_params = true  # params are filtered via Rails' filter_parameters
+
   config.full_retention_period = 30.days
 end
 ```
@@ -89,11 +118,20 @@ Full configuration reference: [railspulse.com/documentation/advanced](https://ra
 
 ## Authentication
 
-Rails Pulse has no built-in authentication, you protect the dashboard using your app's existing auth. Add an `authentication_method` to the initializer:
+Rails Pulse has no built-in user accounts; you protect the dashboard using your app's existing auth. Authentication is on by default outside development and test, and with nothing configured it falls back to HTTP Basic against `RAILS_PULSE_USERNAME` / `RAILS_PULSE_PASSWORD` (denying everything if the password is unset).
+
+The simplest hook is a predicate that receives the controller and returns `true` to allow — anything else is a 403:
+
+```ruby
+RailsPulse.configure do |config|
+  config.authorize = ->(controller) { controller.current_user&.admin? }
+end
+```
+
+If you need to redirect to a login page instead, use `authentication_method`, which runs inside the controller and denies by rendering or redirecting:
 
 ```ruby
 RailsPulse.configure do |config|
-  config.authentication_enabled = true
   config.authentication_redirect_path = "/login"
 
   config.authentication_method = proc {
@@ -104,6 +142,8 @@ RailsPulse.configure do |config|
 end
 ```
 
+Returning `false` from `authentication_method` without responding is also treated as a denial, but `nil` (what `unless … end` returns on success) allows the request — so keep predicate-style checks in `authorize`.
+
 Authentication guide: [railspulse.com/documentation/authentication](https://railspulse.com/documentation/authentication)
 
 ## Features
@@ -111,6 +151,7 @@ Authentication guide: [railspulse.com/documentation/authentication](https://rail
 - **Request monitoring** — every request is timed and stored with its route, status, SQL count, and duration. Slow requests are flagged automatically based on thresholds you control.
 - **Query analysis** — captures the queries behind each request, detects N+1 patterns, and tracks normalized SQL across requests so you can see which queries are hurting you in production, not just in development.
 - **Job tracking** — monitors background job duration, queue wait time, and failure rates. Works with any Active Job adapter.
+- **Exception tracking** — captures unhandled exceptions from web requests and background jobs, groups them by class and location, and shows full backtraces with filtered request params. See recurring errors in production without a separate error monitoring service.
 - **System health bar** — at-a-glance dashboard summary showing healthy, slow, and critical counts across your routes, queries, jobs, and storage. Lets you see the overall state of your app before drilling into specifics.
 - **No data leaves your app** — everything is stored in your own database. No third-party cloud, no SaaS subscription, no outbound connections.
 - **Low overhead** — tracking is async and uses a thread-local flag to skip recording Rails Pulse's own internal requests.

data/app/assets/stylesheets/rails_pulse/application.css

@@ -41,6 +41,27 @@ html[data-color-scheme="dark"] .badge--negative-inverse {
   --badge-background: rgb(47, 47, 47);
 }
 
+html[data-color-scheme="dark"] .badge--get {
+  --badge-background: var(--blue-950);
+  --badge-color: var(--blue-200);
+}
+
+html[data-color-scheme="dark"] .badge--post {
+  --badge-background: var(--green-950);
+  --badge-color: var(--green-200);
+}
+
+html[data-color-scheme="dark"] .badge--put,
+html[data-color-scheme="dark"] .badge--patch {
+  --badge-background: var(--amber-950);
+  --badge-color: var(--amber-200);
+}
+
+html[data-color-scheme="dark"] .badge--delete {
+  --badge-background: var(--red-950);
+  --badge-color: var(--red-200);
+}
+
 html[data-color-scheme="dark"] .input {
   --input-background: #535252;
   --input-border-color: #7e7d7d;
@@ -161,19 +182,6 @@ html[data-color-scheme="dark"] .input {
   z-index: 10;
 }
 
-.flame-bar-label {
-  font-size: 11px;
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  padding: 0 5px;
-  line-height: 20px;
-  color: rgba(255, 255, 255, 0.92);
-  display: block;
-  pointer-events: none;
-  user-select: none;
-}
-
 .flame-time-axis {
   position: relative;
   height: 20px;
@@ -232,22 +240,3 @@ html[data-color-scheme="dark"] .input {
   font-size: 11px;
 }
 
-/* REQUEST OPERATIONS BAR */
-.bar-container {
-  height:10px;
-  position:relative
-}
-.bar {
-  background-color:#727579;
-  height:100%;
-  position:absolute;
-  top:0
-}
-.bar:first-child {
-  border-bottom-left-radius:1px;
-  border-top-left-radius:1px
-}
-.bar:last-child {
-  border-bottom-right-radius:1px;
-  border-top-right-radius:1px
-}