rails-profiler 0.31.0 → 0.31.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c74753b10258047c15aafb6de0c2b5900bc16f01f4b499405b5b72d0d6d3b9e
-  data.tar.gz: 55ad17c8d51cf4eb8e2ed9ec3fd7158a15e23becba666b204b11d7b7c81f0e47
+  metadata.gz: e53e69cbdde6c7e775444a738e0069cef86994f505f77d86673a15e25adc768d
+  data.tar.gz: c134819ed6bff52aa1d5ad7309b752e1ed6c6a6e1803510d4387462f1607b73a
 SHA512:
-  metadata.gz: f1984f7c3ef795d9f318ddc33b64e964a8ed0171878fd913a927ad7c7d4479ba4523159598e75ddd3f52a8985bdaca9cb24bd49a8e0a0f6e1fbc025b904254ba
-  data.tar.gz: 855f08439f3cd174f3686150eed1f813b349e7591dd731b554941be172b9557ff835229268a3dce9605825e161b353a4456e444f1680ed239f40ebf1a6c37abc
+  metadata.gz: 1a277a3d46f4967dc8d875957e95b4d2df118c5a7a96dfcdac83e4a932c4aa4fbd73e1498ef5250bf714e96b5842d99814b617e7f530befcef2eac07984e571c
+  data.tar.gz: 978b1b85623419ca8fd8afe3c9550f24be03dbd5e1a8ef02f8ded99270cff218f2e2d68622b66b9edc7def30a46cb574c8b06bdb7b3cdb6f3502b91a919d7941

data/CHANGELOG.md

@@ -19,6 +19,145 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.31.2] - 2026-10-05
+
+<!-- stamped -->
+
+### Fixed
+
+- **Middleware:** Stream responses through instead of buffering them. The profiler read every
+  response body to the end before handing it to the server, so an `ActionController::Live`,
+  `response.stream` or enumerator response, or a server-sent events stream, left only once it was
+  over (a stream of 5 chunks 200 ms apart sent its first chunk after 1 s instead of 0.2 s, and an
+  endless event stream never answered), and a file sent with `send_file` lost `to_path`, so the
+  server could no longer send it by its path. A body that does not answer `to_ary`, a
+  `text/event-stream` or a body sent by its path now goes to the server chunk by chunk, keeps
+  `to_path` and `close`, and its profile is saved when the server closes it, also when the client
+  went away, with the body seen so far and the full duration. The collectors that only gather
+  what notifications and the logger hand them (SQL, views, cache, exceptions, timeline, logs,
+  outbound HTTP) stay subscribed until then, so the queries and views of a `render stream: true`
+  page or of an enumerator are still recorded; dumps, mailers, I18n and function profiling are
+  read when the application returns. While the server iterates the body, the log lines, outbound
+  HTTP calls and `Profiler.measure` blocks it runs are recorded as well. Until it is saved, a
+  streamed profile is not listed and its token answers 404: an endless event stream is never
+  listed. A body the server never closes is finished when the fiber that started it starts its
+  next profiled request, never cutting a stream that a fiber-based server such as Falcon runs
+  alongside, and its subscriptions are dropped after 5 minutes at the latest, which the profile
+  and the Request tab then say; the server still closes the application's body. Rails 7.0 pages, whose body has no `to_ary`, and pages a `Live`
+  controller renders whole still get the toolbar. The toolbar is only injected in pages returned
+  whole, so a `render stream: true` page has none.
+- **Middleware:** Stop turning an error raised while a response body is iterated (a stream that
+  fails part way, a file sent with `send_file` that disappeared) into an empty `200`. The error now
+  reaches the server, as it does without the profiler, and the profile keeps it.
+- **Middleware:** Keep the request and response bodies of a profile to the first
+  `config.max_captured_body_bytes` (256 KB by default) instead of copying them whole: a 2 MB upload
+  took 2.8 MB in its profile, plus transient copies. `rack.input` is read only up to that size, then
+  rewound for the application, and an input that cannot be rewound is no longer read at all. The
+  Request tab and the MCP profile detail say when a body was cut, with its whole size, or "at
+  least" that size when it is not known; the profile carries `request_body_truncated`,
+  `request_body_size`, `response_body_truncated`, `response_body_size` and their
+  `*_size_is_minimum`. Only the raw bodies are capped: the parsed `params` and the
+  `Parameters:` log line keep their full size, so a 5 MB JSON request still takes about 15 MB in
+  its profile. To keep whole bodies, as before, set `config.max_captured_body_bytes = nil`.
+- **Profiles:** Report the number of objects allocated (`allocated_objects`) instead of a figure
+  shown as memory. `GC.stat` has no `:total_allocated_size` on the supported Rubies, so `memory`
+  was always that number times 40, never a measured byte count. The toolbar, the dashboards, the
+  profile list and the MCP tools show "Allocations". The counter belongs to the process: on a
+  multi-threaded server it includes what other threads allocated meanwhile. Nothing to change on
+  upgrade: the API and the stored profiles still carry `memory` (deprecated, the count times 40),
+  and profiles saved by earlier versions are read back with their count. The option
+  `memory_warning_threshold`, which nothing ever compared with, is deprecated for
+  `allocated_objects_warning_threshold`, a number of objects, still without effect; setting the
+  old one warns and converts it.
+- **Toolbar:** Leave a response already framed with `Transfer-Encoding` untouched. Under Rails
+  7.0, a `render stream: true` page arrives chunked, and the toolbar was put among the chunks,
+  which broke the framing: the browser got an empty or cut page.
+- **Toolbar:** Correct the `Content-Length` of a page the toolbar is injected into. It kept the
+  length of the page without the toolbar, so a server that honours it cut the page short.
+- **Toolbar:** Inject the toolbar into a page whose headers are a plain `Hash` with a lower-case
+  `content-type`, the form Rack 3 requires; only `Content-Type` was looked up. Every response
+  header the profiler reads or writes now ignores the case.
+
+## [0.31.1] - 2026-10-05
+
+<!-- stamped -->
+
+### Fixed
+
+- **Storage:** Keep the file store's profiles in `tmp_path/profiles` by default, and take only the
+  files named after a profile token for profiles. Profiles shared `tmp_path` with
+  `env_overrides.json`, which the store listed as a profile with no token and deleted when the
+  profiles were cleared. An application that sets `storage_options[:path]` keeps its directory,
+  used as given (no subdirectory is added).
+- **MCP:** Keep the bodies saved by the MCP tools in `tmp_path/mcp-cache`, and let their hourly
+  cleanup remove only the token directories it wrote there. It removed every directory of
+  `tmp_path` older than an hour, the SQLite store's blobs included, at random (one save in
+  twenty), which lost the stored HTTP response bodies.
+- **Configuration:** `config.tmp_path` is always a `Pathname`: it was a `String` outside Rails, and
+  kept a `String` assigned to it, which made every env override operation fail with only a
+  warning. A failure to read or write the env overrides now reaches the Env tab (`500` with the
+  error, `ENV` left unchanged) and the MCP env tools (an error answer) instead of reporting a
+  success; at boot, before a Sidekiq job and before a console evaluation it is still a warning,
+  so an override never makes the application fail.
+- **Jobs:** A storage error while saving a profile no longer makes the application fail: a job,
+  a console command, a test, or an outbound HTTP call that ends after its profile was collected
+  now goes on, with its own result or its own exception, and the error is printed as a warning.
+  The save of a job, console or test profile ran with nothing to catch it, so a full disk, a
+  Redis that went away or, from this version, a symbolic link refused in place of the SQLite
+  database made the job fail, or replaced the job's own exception. The HTTP middleware already
+  kept requests going.
+- **Upgrading:** for the default `tmp_path`; adapt the paths if you set one.
+  - Profiles saved by the file store in `tmp/rails-profiler` itself are no longer listed, and are
+    not moved. To remove them, with the old MCP body cache, run from the application root:
+    ```sh
+    LC_ALL=C find tmp/rails-profiler -maxdepth 1 -type f -name '[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].json' -delete
+    LC_ALL=C find tmp/rails-profiler -mindepth 1 -maxdepth 1 -type d -name '[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]' -exec rm -rf {} +
+    ```
+    Both only match names made of 32 lower-case hexadecimal digits, a profile token (`LC_ALL=C`
+    keeps `[0-9a-f]` from matching upper-case letters in some locales): `env_overrides.json`, the
+    SQLite database, `blobs`, `profiles` and `mcp-cache` are left alone.
+  - To keep reading the old profiles instead, set
+    `config.storage_options = { path: Rails.root.join("tmp", "rails-profiler") }`, and then do
+    **not** run the first command: it would delete the current profiles.
+  - The directory `tmp/rails-profiler` created by an earlier version keeps its mode: run
+    `chmod 700 tmp/rails-profiler` to restrict it.
+  - If the web process and the workers reading the env overrides or a shared file or SQLite store
+    run as two different users, set `config.restrict_storage_permissions = false` to create new
+    files with the modes of the umask, as before. It does not reopen what was already created
+    `0700` and `0600`: run `chmod -R u=rwX,go=rX tmp/rails-profiler` for the modes earlier
+    versions created with the usual umask (`0755` and `0644`). A worker under another user that
+    also writes there (it opens `env_overrides.json.lock` for writing) needs the
+    files belonging to a group of both users (the same primary group for both, or
+    `chgrp -R <group> tmp/rails-profiler` then `find tmp/rails-profiler -type d -exec chmod g+s {} +`
+    so that new files inherit it), a umask of `002` for both processes, and
+    `chmod -R ug=rwX,o=rX tmp/rails-profiler`. The option also follows a symbolic link in place
+    of the SQLite database, its `-wal` or `-shm` file or the lock of the env overrides, and drops
+    the warning about a shared `tmp_path`, as before.
+
+### Security
+
+- **Storage:** Check every profile token against the format the profiler issues (32 hexadecimal
+  characters) in every storage backend (file, memory, Redis, SQLite and its blobs), before it
+  becomes a file name, a directory or a key. A token such as `../../config/important` reached the
+  file store as a path: `DELETE /_profiler/api/profiles/:id` deleted, and
+  `POST /_profiler/api/ajax/link` overwrote, a `.json` file outside the storage directory. A
+  malformed token is now not found (`404` from the API, `nil` from the storage, no exception),
+  whoever asks: the controllers, the cluster proxy, which no longer forwards it to a slave, or the
+  MCP tools. Saving under one raises an `ArgumentError`. `POST /_profiler/api/ajax/link` answers
+  `400` for a malformed `parent_token` instead of storing it. The MCP tools no longer save a body
+  (`save_bodies`) under a token sent by a slave that is not a profile token. There is no option to
+  accept other tokens: the profiler never issues them, and accepting them would reopen the path.
+- **Storage:** Create the profiler's directories `0700` and its files `0600`, whatever the umask:
+  the file store's profiles, the SQLite database and its `-wal` and `-shm` files, the blobs, the
+  env overrides with their lock and temporary files, and the MCP body cache. They were created
+  with the process defaults, usually `0755` and `0644`, readable by every local user although
+  profiles hold cookies, tokens and environment values. A file the profiler writes again (a
+  profile, the SQLite database at startup) is brought back to `0600`; a directory that already
+  exists keeps its mode. Writing a profile now goes through a temporary file renamed over it. A
+  symbolic link placed where the profiler keeps its SQLite database, its `-wal` or `-shm` file or
+  the lock of the env overrides is refused instead of followed, and an existing `tmp_path` that
+  belongs to another user or that group or others can write to is reported once with a warning.
+
 ## [0.31.0] - 2026-10-05
 
 <!-- stamped -->

data/app/assets/builds/profiler-toolbar.js

@@ -3831,6 +3831,16 @@
     ] });
   }
 
+  // app/assets/typescript/profiler/dashboard/utils.ts
+  function allocatedObjects(profile) {
+    if (profile.allocated_objects != null) return profile.allocated_objects;
+    return profile.memory != null ? Math.round(profile.memory / 40) : null;
+  }
+  function formatAllocations(count) {
+    return count == null ? "-" : `${count.toLocaleString("en")} objects`;
+  }
+  var ALLOCATIONS_HINT = "Objects allocated by the whole process while this ran: on a multi-threaded server, it includes what other threads allocated meanwhile.";
+
   // app/assets/typescript/profiler/components/toolbar/ToolbarApp.tsx
   function statusClass2(status) {
     if (status >= 200 && status < 300) return "profiler-text--success";
@@ -3903,12 +3913,9 @@
                     " ms"
                   ] })
                 ] }),
-                profile.memory && /* @__PURE__ */ u3("div", { class: "profiler-toolbar-panel-row", children: [
-                  /* @__PURE__ */ u3("span", { children: "Memory" }),
-                  /* @__PURE__ */ u3("strong", { children: [
-                    (profile.memory / 1024 / 1024).toFixed(2),
-                    " MB"
-                  ] })
+                allocatedObjects(profile) != null && /* @__PURE__ */ u3("div", { class: "profiler-toolbar-panel-row", title: ALLOCATIONS_HINT, children: [
+                  /* @__PURE__ */ u3("span", { children: "Allocations" }),
+                  /* @__PURE__ */ u3("strong", { children: formatAllocations(allocatedObjects(profile)) })
                 ] }),
                 /* @__PURE__ */ u3("div", { class: "profiler-toolbar-panel-row", children: [
                   /* @__PURE__ */ u3("span", { children: "Started" }),

data/app/assets/builds/profiler.js

@@ -3994,6 +3994,14 @@
   function getGemVersion() {
     return document.querySelector('meta[name="profiler-version"]')?.content ?? "";
   }
+  function allocatedObjects(profile) {
+    if (profile.allocated_objects != null) return profile.allocated_objects;
+    return profile.memory != null ? Math.round(profile.memory / 40) : null;
+  }
+  function formatAllocations(count) {
+    return count == null ? "-" : `${count.toLocaleString("en")} objects`;
+  }
+  var ALLOCATIONS_HINT = "Objects allocated by the whole process while this ran: on a multi-threaded server, it includes what other threads allocated meanwhile.";
 
   // app/assets/typescript/profiler/components/dashboard/tabs/shared/utils.ts
   function methodBadge(method) {
@@ -5556,10 +5564,6 @@
   function formatTime(iso) {
     return new Date(iso).toLocaleTimeString("en", { hour12: false });
   }
-  function formatMemory(bytes) {
-    if (!bytes) return "-";
-    return (bytes / 1024 / 1024).toFixed(2) + " MB";
-  }
   var PRESETS = [
     { key: "slow", label: "Slow" },
     { key: "many_queries", label: "Many queries" },
@@ -5797,8 +5801,8 @@
           bv = b.duration;
           break;
         case "memory":
-          av = a3.memory ?? 0;
-          bv = b.memory ?? 0;
+          av = allocatedObjects(a3) ?? 0;
+          bv = allocatedObjects(b) ?? 0;
           break;
         case "status":
           av = a3.status;
@@ -6043,8 +6047,8 @@
                   "Queries ",
                   sortIcon(httpSort.col, httpSort.dir, "queries")
                 ] }),
-                /* @__PURE__ */ u3("th", { class: `sortable${httpSort.col === "memory" ? " sortable--active" : ""}`, onClick: () => toggleHttpSort("memory"), children: [
-                  "Memory ",
+                /* @__PURE__ */ u3("th", { class: `sortable${httpSort.col === "memory" ? " sortable--active" : ""}`, onClick: () => toggleHttpSort("memory"), title: ALLOCATIONS_HINT, children: [
+                  "Allocations ",
                   sortIcon(httpSort.col, httpSort.dir, "memory")
                 ] }),
                 /* @__PURE__ */ u3("th", { class: `sortable${httpSort.col === "status" ? " sortable--active" : ""}`, onClick: () => toggleHttpSort("status"), children: [
@@ -6066,7 +6070,7 @@
                   " ms"
                 ] }) }),
                 /* @__PURE__ */ u3("td", { children: p3.collectors_data?.database?.total_queries ?? "\u2014" }),
-                /* @__PURE__ */ u3("td", { children: formatMemory(p3.memory ?? void 0) }),
+                /* @__PURE__ */ u3("td", { children: formatAllocations(allocatedObjects(p3)) }),
                 /* @__PURE__ */ u3("td", { children: /* @__PURE__ */ u3("span", { class: statusClass(p3.status), children: p3.status }) }),
                 /* @__PURE__ */ u3("td", { class: "profiler-text--xs profiler-text--mono profiler-text--muted", children: /* @__PURE__ */ u3("button", { class: "token-copy", onClick: () => copyToken(p3.token), title: "Copy full token", children: copiedToken === p3.token ? "\u2713" : p3.token.substring(0, 8) + "\u2026" }) }),
                 /* @__PURE__ */ u3("td", { children: /* @__PURE__ */ u3("button", { class: "btn-row-delete", onClick: () => deleteProfile2(p3.token), title: "Delete", children: "\xD7" }) })
@@ -6458,9 +6462,36 @@
     parts.push(`  '${url}'`);
     return parts.join(" \\\n");
   }
+  function truncationNotes(profile, routeData) {
+    const notes = [];
+    const describe = (what, truncated, size, minimum) => {
+      if (truncated) {
+        const total = size != null ? `${minimum ? "at least " : ""}${size.toLocaleString("en")} bytes, ` : "";
+        notes.push(`${what} body truncated: ${total}only the beginning was kept (max_captured_body_bytes).`);
+      }
+    };
+    describe(
+      "Request",
+      profile.request_body_truncated ?? routeData.request_body_truncated,
+      profile.request_body_size ?? routeData.request_body_size,
+      profile.request_body_size_is_minimum ?? routeData.request_body_size_is_minimum
+    );
+    describe(
+      "Response",
+      profile.response_body_truncated ?? routeData.response_body_truncated,
+      profile.response_body_size ?? routeData.response_body_size,
+      profile.response_body_size_is_minimum ?? routeData.response_body_size_is_minimum
+    );
+    const releasedAfter = profile.collectors_released_after_seconds ?? routeData.collectors_released_after_seconds;
+    if (releasedAfter != null) {
+      notes.push(`Incomplete profile: the collectors of this stream were released after ${releasedAfter} s, before the server closed it; what it did later is missing.`);
+    }
+    return notes;
+  }
   function RequestTab({ profile }) {
     const routeData = profile.collectors_data?.request ?? {};
     const hasParams = profile.params && Object.keys(profile.params).length > 0;
+    const notes = truncationNotes(profile, routeData);
     return /* @__PURE__ */ u3("div", { class: "profiler-ajax-card profiler-ajax-card--success", style: "margin-bottom:8px;background:var(--profiler-bg-elevated);transform:translateX(3px);box-shadow:var(--profiler-shadow-sm);transition:none", children: [
       /* @__PURE__ */ u3(
         HttpCardHeader,
@@ -6480,6 +6511,7 @@
           routeData.route_pattern
         ] })
       ] }),
+      notes.map((note) => /* @__PURE__ */ u3("div", { class: "profiler-ajax-card__row profiler-text--xs profiler-text--warning", children: note }, note)),
       /* @__PURE__ */ u3(
         HttpReqRespDetail,
         {
@@ -8878,12 +8910,9 @@
             "Status: ",
             /* @__PURE__ */ u3("strong", { children: profile.status })
           ] }),
-          profile.memory && /* @__PURE__ */ u3("span", { children: [
-            "Memory: ",
-            /* @__PURE__ */ u3("strong", { children: [
-              (profile.memory / 1024 / 1024).toFixed(2),
-              " MB"
-            ] })
+          allocatedObjects(profile) != null && /* @__PURE__ */ u3("span", { title: ALLOCATIONS_HINT, children: [
+            "Allocations: ",
+            /* @__PURE__ */ u3("strong", { children: formatAllocations(allocatedObjects(profile)) })
           ] }),
           /* @__PURE__ */ u3("span", { style: "color:var(--profiler-text-muted)", children: new Date(profile.started_at).toLocaleString("en", { hour12: false, month: "short", day: "numeric", hour: "2-digit", minute: "2-digit", second: "2-digit" }) }),
           profile.gem_version && /* @__PURE__ */ u3("span", { class: "profiler-version-badge", children: [
@@ -9038,12 +9067,9 @@
             "Status: ",
             /* @__PURE__ */ u3("strong", { children: /* @__PURE__ */ u3("span", { class: `badge-${isFailed ? "error" : "success"}`, children: isFailed ? "Failed" : "Completed" }) })
           ] }),
-          profile.memory != null && /* @__PURE__ */ u3("span", { children: [
-            "Memory: ",
-            /* @__PURE__ */ u3("strong", { children: [
-              (profile.memory / 1024 / 1024).toFixed(2),
-              " MB"
-            ] })
+          allocatedObjects(profile) != null && /* @__PURE__ */ u3("span", { title: ALLOCATIONS_HINT, children: [
+            "Allocations: ",
+            /* @__PURE__ */ u3("strong", { children: formatAllocations(allocatedObjects(profile)) })
           ] }),
           profile.gem_version && /* @__PURE__ */ u3("span", { class: "profiler-version-badge", children: [
             "v",
@@ -9170,12 +9196,9 @@
             "Status: ",
             /* @__PURE__ */ u3("strong", { children: /* @__PURE__ */ u3("span", { class: `badge-${isFailed ? "error" : "success"}`, children: isFailed ? "Error" : "OK" }) })
           ] }),
-          profile.memory != null && /* @__PURE__ */ u3("span", { children: [
-            "Memory: ",
-            /* @__PURE__ */ u3("strong", { children: [
-              (profile.memory / 1024 / 1024).toFixed(2),
-              " MB"
-            ] })
+          allocatedObjects(profile) != null && /* @__PURE__ */ u3("span", { title: ALLOCATIONS_HINT, children: [
+            "Allocations: ",
+            /* @__PURE__ */ u3("strong", { children: formatAllocations(allocatedObjects(profile)) })
           ] }),
           profile.gem_version && /* @__PURE__ */ u3("span", { class: "profiler-version-badge", children: [
             "v",
@@ -9300,12 +9323,9 @@
             "Status: ",
             /* @__PURE__ */ u3("strong", { children: /* @__PURE__ */ u3("span", { class: `badge-${isFailed ? "error" : testStatus === "pending" ? "warning" : "success"}`, children: testStatus === "failed" ? "\u2717 Failed" : testStatus === "pending" ? "\u23F8 Pending" : "\u2713 Passed" }) })
           ] }),
-          profile.memory != null && /* @__PURE__ */ u3("span", { children: [
-            "Memory: ",
-            /* @__PURE__ */ u3("strong", { children: [
-              (profile.memory / 1024 / 1024).toFixed(2),
-              " MB"
-            ] })
+          allocatedObjects(profile) != null && /* @__PURE__ */ u3("span", { title: ALLOCATIONS_HINT, children: [
+            "Allocations: ",
+            /* @__PURE__ */ u3("strong", { children: formatAllocations(allocatedObjects(profile)) })
           ] })
         ] }),
         testData?.test_file && /* @__PURE__ */ u3("div", { class: "profiler-text--xs profiler-text--muted profiler-mt-2", children: [

data/app/controllers/profiler/api/ajax_controller.rb

@@ -12,6 +12,12 @@ module Profiler
           return render json: { error: "Missing parent_token or child_token" }, status: :bad_request
         end
 
+        # The parent token is written into the child profile: a value the gem never issues is
+        # refused rather than stored. A malformed child token is not found by the storage.
+        unless Profiler::Storage::Token.valid?(parent_token)
+          return render json: { error: "Invalid parent_token" }, status: :bad_request
+        end
+
         # Load child profile
         child_profile = Profiler.storage.load(child_token)
         unless child_profile

data/app/controllers/profiler/api/env_vars_controller.rb

@@ -3,6 +3,13 @@
 module Profiler
   module Api
     class EnvVarsController < ApplicationController
+      # The overrides file could not be read or written: nothing was changed, ENV included.
+      rescue_from Profiler::EnvOverrideStore::Error do |error|
+        key = params[:key].to_s.strip
+        message = key.empty? ? "#{error.message}; nothing was changed" : "#{error.message}; #{key} was left unchanged"
+        render json: { error: message }, status: :internal_server_error
+      end
+
       def show
         variables = Profiler::Redaction.env_snapshot
         overrides = Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)
@@ -72,8 +79,11 @@ module Profiler
         ENV[key].nil? ? nil : Profiler::Redaction.env_value(key, ENV[key])
       end
 
+      # Read back after a change that succeeded: a failure here must not answer that nothing changed.
       def redacted_override(key)
         Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)[key]
+      rescue Profiler::EnvOverrideStore::Error
+        nil
       end
     end
   end

data/lib/profiler/allocation_counter.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Profiler
+  # What every profile reports as allocated_objects: the number of objects Ruby allocated
+  # between two readings. GC.stat has no byte count of allocations (no :total_allocated_size on
+  # the supported Rubies), so none is reported.
+  #
+  # The counter belongs to the process, not to the thread: on a multi-threaded server, or with
+  # jobs running alongside, the figure includes what the other threads allocated meanwhile.
+  module AllocationCounter
+    # The bytes per object that profiles saved by earlier versions multiplied the count by, as
+    # `memory`: kept to read them back, and to keep writing that field for older readers.
+    LEGACY_BYTES_PER_OBJECT = 40
+
+    module_function
+
+    def current
+      GC.stat(:total_allocated_objects)
+    end
+  end
+end

data/lib/profiler/cluster/slave_proxy.rb

@@ -4,6 +4,7 @@ require "net/http"
 require "json"
 require "uri"
 require_relative "security"
+require_relative "../storage/token"
 
 module Profiler
   module Cluster
@@ -39,7 +40,10 @@ module Profiler
         Array(data["profiles"]).map { |h| profile_from_api(h) }
       end
 
+      # A token that is not one the gem issues is not found, without asking the slave.
       def load(token)
+        return nil unless Storage::Token.valid?(token)
+
         data = get_json("/_profiler/api/profiles/#{Security.escape_segment(token)}")
         return nil unless data["token"] || data["profile"]
 
@@ -48,6 +52,8 @@ module Profiler
       end
 
       def find_by_parent(parent_token)
+        return [] unless Storage::Token.valid?(parent_token)
+
         data = get_json("/_profiler/api/profiles", parent_token: parent_token, all_types: true)
         Array(data["profiles"]).map { |h| profile_from_api(h) }
       end

data/lib/profiler/collectors/base_collector.rb

@@ -71,6 +71,36 @@ module Profiler
         # Override in subclasses to collect data
       end
 
+      # Whether collect reads nothing from the request's thread (thread-local slots, the
+      # locale): only then can a streamed response keep the collector subscribed until the
+      # server closes its body, and collect it from whichever thread closes it. The default
+      # is the safe answer: collected on the request's thread when the application returns.
+      def collect_from_any_thread?
+        false
+      end
+
+      # Gives back the thread-local slots subscribe took over, and nothing else: a streamed
+      # response does this on the request's thread when the application returns, and keeps the
+      # notification subscriptions until its body is closed. Idempotent, like unsubscribe.
+      def release_thread_slots
+        restore_thread_slots
+      end
+
+      # Puts the slots subscribe claimed back, for a while, on the thread (or fiber) that
+      # iterates a streamed body: the logs, outbound HTTP calls and measures it makes belong to
+      # this profile. Returns what the slots held there, for return_thread_slots.
+      def lend_thread_slots
+        (@thread_slot_values || {}).to_h do |key, value|
+          previous = Thread.current[key]
+          Thread.current[key] = value
+          [key, previous]
+        end
+      end
+
+      def return_thread_slots(previous)
+        previous&.each { |key, value| Thread.current[key] = value }
+      end
+
       def toolbar_summary
         # Override in subclasses to provide summary for toolbar
         ""
@@ -104,6 +134,7 @@ module Profiler
       def claim_thread_slot(key, value)
         @claimed_thread_slots ||= {}
         @claimed_thread_slots[key] = Thread.current[key] unless @claimed_thread_slots.key?(key)
+        (@thread_slot_values ||= {})[key] = value
         Thread.current[key] = value
       end
 

data/lib/profiler/collectors/cache_collector.rb

@@ -82,6 +82,11 @@ module Profiler
         store_data(data)
       end
 
+      # Collect reads only what the collector gathered itself.
+      def collect_from_any_thread?
+        true
+      end
+
       def unsubscribe
         unsubscribe_notifications(@subscriptions)
       end

data/lib/profiler/collectors/database_collector.rb

@@ -68,6 +68,11 @@ module Profiler
         store_data(data)
       end
 
+      # Collect reads only what the collector gathered itself.
+      def collect_from_any_thread?
+        true
+      end
+
       def unsubscribe
         return unless @subscription
 

data/lib/profiler/collectors/exception_collector.rb

@@ -48,6 +48,11 @@ module Profiler
         store_data(@exception_data || {})
       end
 
+      # Collect reads only what the collector gathered itself.
+      def collect_from_any_thread?
+        true
+      end
+
       def unsubscribe
         return unless @subscriber
 

data/lib/profiler/collectors/flamegraph_collector.rb

@@ -144,6 +144,11 @@ module Profiler
         })
       end
 
+      # Collect reads only what the collector gathered itself.
+      def collect_from_any_thread?
+        true
+      end
+
       def unsubscribe
         unsubscribe_notifications(@subscriptions)
         restore_thread_slots

data/lib/profiler/collectors/http_collector.rb

@@ -39,6 +39,11 @@ module Profiler
         claim_thread_slot(:profiler_http_collector, self)
       end
 
+      # Collect reads only what the collector gathered itself.
+      def collect_from_any_thread?
+        true
+      end
+
       # The Net::HTTP patch installed by subscribe stays: it is installed once per process and
       # records nothing when no collector holds the thread-local slot.
       def unsubscribe
@@ -125,7 +130,7 @@ module Profiler
           build_data(@requests)
         end
         store_data(data)
-        Profiler.storage.save(@profile.token, @profile)
+        Profiler.save_profile(@profile, from: "HttpCollector")
       end
 
       def group_by_host(requests)

data/lib/profiler/collectors/log_collector.rb

@@ -93,6 +93,11 @@ module Profiler
         warn "LogCollector#subscribe failed: #{e.message}"
       end
 
+      # Collect reads only what the collector gathered itself.
+      def collect_from_any_thread?
+        true
+      end
+
       def unsubscribe
         if @capture_logger
           @broadcaster.stop_broadcasting_to(@capture_logger) if @broadcaster.respond_to?(:stop_broadcasting_to)

data/lib/profiler/collectors/request_collector.rb

@@ -30,7 +30,8 @@ module Profiler
           method: @profile.method,
           status: @profile.status,
           duration: @profile.duration,
-          memory: @profile.memory,
+          allocated_objects: @profile.allocated_objects,
+          memory: @profile.memory, # deprecated, see Profile#memory
           params: @profile.params,
           headers: @profile.headers,
           response_headers: @profile.response_headers,
@@ -38,6 +39,14 @@ module Profiler
           request_body_encoding: @profile.request_body_encoding,
           response_body: @profile.response_body,
           response_body_encoding: @profile.response_body_encoding,
+          request_body_size: @profile.request_body_size,
+          request_body_truncated: @profile.request_body_truncated || false,
+          request_body_size_is_minimum: @profile.request_body_size_is_minimum || false,
+          response_body_size: @profile.response_body_size,
+          response_body_truncated: @profile.response_body_truncated || false,
+          response_body_size_is_minimum: @profile.response_body_size_is_minimum || false,
+          # A streamed response whose collectors were released before its body was closed.
+          collectors_released_after_seconds: @profile.collectors_released_after_seconds,
           started_at: @profile.started_at&.iso8601,
           finished_at: @profile.finished_at&.iso8601
         }
@@ -59,7 +68,7 @@ module Profiler
           text: "#{@profile.method} #{@profile.status}",
           color: status_color,
           duration: @profile.duration,
-          memory: format_memory(@profile.memory)
+          allocated_objects: format_allocations(@profile.allocated_objects)
         }
       end
 
@@ -98,16 +107,10 @@ module Profiler
         {}
       end
 
-      def format_memory(bytes)
-        return "0 B" unless bytes
+      def format_allocations(count)
+        return "0 objects" unless count
 
-        if bytes < 1024
-          "#{bytes} B"
-        elsif bytes < 1024 * 1024
-          "#{(bytes / 1024.0).round(2)} KB"
-        else
-          "#{(bytes / 1024.0 / 1024.0).round(2)} MB"
-        end
+        "#{count.to_s.reverse.scan(/\d{1,3}/).join(",").reverse} objects"
       end
     end
   end

data/lib/profiler/collectors/view_collector.rb

@@ -66,6 +66,11 @@ module Profiler
         store_data(data)
       end
 
+      # Collect reads only what the collector gathered itself.
+      def collect_from_any_thread?
+        true
+      end
+
       def unsubscribe
         unsubscribe_notifications(@subscriptions)
       end