rails-profiler 0.33.1 → 0.33.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d632e07d28796ba7902cd20f9466b4c529c77ab76b5627c2b946e6b059b23c1f
-  data.tar.gz: 7c91607d3ae24180f6708938a8dfa118ad297b11a6b9749cf155adeef5b81336
+  metadata.gz: 533fac499cbab38112f1be4ab7d066761f0f0cea1b22d76e4d355059ef03d9dd
+  data.tar.gz: b8d37a14501188a671be2ee4876b8ce9678641cca8acbd836e456ea62249ef48
 SHA512:
-  metadata.gz: a7781894a3b105e730d47d63c0e7a2a15b28a58a51a38fc4662fb193c0665c1cdb8fd7072cadc7926f38a96e6a68a350ae19f16ef2560a119c89355fdbe3f4a6
-  data.tar.gz: e626c7d2d344ad58473fdecbbbaf3bfae340faf17eb1dd25ca7f88325ffe87c9a9837fefcdc9b1dea3cdc3541ce46a4156d1d4b17acd3f4b049defd2c08fcd03
+  metadata.gz: 7daad08c5c0b6a119933341e7b1a1ba28d746c2801eef525a83dd54388c85a30bfa68a7240d2e99705992e622929df012b98676f0ec396a028fff759690910da
+  data.tar.gz: d205ba6d72f09ca00d1eb714db57f99052e64297caddb33999c8c6ae87ae380874cf015af986d0065d7b76c949388a813f3f397adae3fe23b7f5a1e6bdbcbc48

data/CHANGELOG.md

@@ -19,6 +19,76 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.33.3] - 2026-10-14
+
+<!-- stamped -->
+
+### Fixed
+
+- **Rake tasks:** `rake profiler:cleanup` with an empty or non-numeric `OLDER_THAN` (`""`,
+  `abc`) no longer removes every profile, and `OLDER_THAN=1h` is no longer read as one second.
+  `OLDER_THAN` and `LIMIT` take a whole number only; any other value stops the task with an error
+  and removes nothing. `OLDER_THAN=0` still removes every profile, when written so.
+- **Storage:** The SQLite store compares the start times of the profiles in UTC. Outside UTC,
+  `rake profiler:cleanup` and `cleanup` removed recent profiles (America/New_York) or kept old
+  ones (Asia/Tokyo), and the lists were out of order across a clock change. The profiles already
+  in the database are converted once, when the store opens it; the API shows the same times.
+- **Storage:** The Redis store takes expired profiles out of its lists at each save, and its list
+  keys now expire a TTL after the last save. Without `max_profiles`, or between two evictions,
+  the tokens of expired profiles stayed listed until a manual cleanup, and a page of the list
+  came back with fewer profiles than asked.
+- **Storage:** With the SQLite store, a profile saved again without a response body no longer
+  shows the response body of its previous save. The response bodies left on disk by profiles
+  removed outside the store are removed by `cleanup` and when the oldest profiles are evicted.
+
+### Limitations
+
+- **Storage:** Two SQLite stores that share a `blob_path` remove each other's response bodies:
+  give each `database` its own `blob_path` (see `docs/storage.md`).
+- **Storage:** On the first save after an upgrade, the Redis store can drop from its lists a job
+  that started more than a TTL ago and was saved recently. It happens once.
+
+## [0.33.2] - 2026-10-14
+
+<!-- stamped -->
+
+### Changed
+
+- **Configuration:** A String in `config.http_skip_hosts` is now a host name, compared whole and
+  ignoring case, instead of a pattern: `"example.com"` no longer leaves out `notexample.com`,
+  `exampleXcom` or `example.com.attacker.net`. A String that starts with a dot is a domain whose
+  subdomains are left out (`".internal"` leaves out `api.internal`). A Regexp is matched as
+  before. An entry that is not a host name, a wildcard String (`"*.internal"`), an empty one, or
+  anything that is neither a String nor a Regexp (`nil`), is left out when the list is set, with
+  a warning in the log that says what to write, and the other entries are kept. It does not
+  raise: the gem is loaded in production too, where a mistake in this list must not stop the
+  application from booting, even with the profiler disabled.
+- **Dumps:** A dump is stored as its formatted text only: the raw `value` field, which no tab
+  read and the API did not document, is no longer part of the dump data.
+
+### Fixed
+
+- **Configuration:** A String in `config.skip_paths` no longer fails every request with a
+  `TypeError`: it skips the path equal to it, and a Regexp is matched as before. A single
+  pattern, a String or a Regexp, set without a list is read as a list of one.
+- **Outbound HTTP:** A String in `config.http_skip_hosts` that is not a valid Regexp, such as
+  `"*.internal"` added with `<<`, no longer fails every `Net::HTTP` call of a profiled request
+  with a `RegexpError`.
+- **Database:** A query that binds bytes, a `blob` or `bytea` column such as an image, no longer
+  loses the profile of its request when it is saved: the bind shows as text when its bytes are
+  valid UTF-8, and as `[binary data, N bytes]` otherwise.
+- **Logs:** A line logged with bytes that are not valid UTF-8 no longer raises an
+  `Encoding::CompatibilityError` in the application's own logger call (Rails 7.1 and later), and
+  a binary line no longer loses the profile when it is saved: the line is kept as UTF-8, what
+  cannot be read replaced with U+FFFD, and a line in another encoding is converted.
+- **Dumps:** `Profiler.dump` of an object that refers to itself, directly or through an instance
+  variable, no longer fails the request with a `SystemStackError` (a 500 with the file store), and
+  an Array or a Hash holding itself no longer loses the profile. An object whose own `inspect`
+  recurses without end shows `[Error formatting value: stack level too deep]`.
+- **Middleware:** A page whose body is made of fragments of different encodings, a binary one
+  among UTF-8 ones, no longer fails with an `Encoding::CompatibilityError` once profiled: its
+  bytes are joined as the application gave them, and it gets its toolbar.
+
 ## [0.33.1] - 2026-10-14
 
 <!-- stamped -->

data/lib/profiler/collectors/database_collector.rb

@@ -9,6 +9,8 @@ module Profiler
       BACKTRACE_DEPTH = 10
       MAX_SCANNED_FRAMES = 100
       FRAMES_PAST_APPLICATION = 15
+      # What a bind holding bytes that are not text shows instead (see #displayable_bind).
+      BINARY_BIND = "[binary data, %d bytes]"
 
 
       # Frames between the application's code and the subscriber: the profiler itself, the
@@ -122,9 +124,9 @@ module Profiler
         binds.map do |bind|
           if bind.respond_to?(:value)
             name = bind.name if bind.respond_to?(:name)
-            Profiler::Redaction.filter_named(name, bind.value)
+            displayable_bind(Profiler::Redaction.filter_named(name, bind.value))
           else
-            bind
+            displayable_bind(bind)
           end
         end
       rescue StandardError
@@ -132,6 +134,18 @@ module Profiler
         binds.map { Profiler::Redaction::MASK }
       end
 
+      # A blob or bytea value is bytes, not text: kept as it is, it fails the JSON of the whole
+      # profile when it is saved. Bytes that are valid UTF-8 are shown as text, others as their
+      # size. Text in another encoding stays as it is: JSON converts it.
+      def displayable_bind(value)
+        value = value.to_s if defined?(ActiveModel::Type::Binary::Data) && value.is_a?(ActiveModel::Type::Binary::Data)
+        return value unless value.is_a?(String)
+        return value if value.valid_encoding? && value.encoding != Encoding::BINARY
+
+        utf8 = value.dup.force_encoding(Encoding::UTF_8)
+        utf8.valid_encoding? ? utf8 : format(BINARY_BIND, value.bytesize)
+      end
+
       # Capturing the caller costs tens of microseconds. The first run of a statement locates
       # it, an N+1 loop included (its repeats are the same statement with other values); a slow
       # query is always located.

data/lib/profiler/collectors/dump_collector.rb

@@ -33,9 +33,10 @@ module Profiler
         dumps = @dumps || Thread.current[:profiler_dumps] || []
         unsubscribe
 
+        # Only the formatted text is kept: the object itself can refer to itself, or hold what
+        # JSON cannot write, and would make the profile fail when it is saved.
         formatted_dumps = dumps.map do |dump|
           {
-            value: dump[:value],
             formatted: format_value(dump[:value]),
             file: dump[:file],
             line: dump[:line],
@@ -97,7 +98,8 @@ module Profiler
           formatted += ">"
           formatted
         end
-      rescue => e
+      # An inspect of the application's that recurses without end is said, like any other error.
+      rescue StandardError, SystemStackError => e
         "[Error formatting value: #{e.message}]"
       end
     end

data/lib/profiler/collectors/log_collector.rb

@@ -68,7 +68,7 @@ module Profiler
 
           entry = {
             level: SEVERITY_LABELS[severity] || "UNKNOWN",
-            message: msg.to_s.strip,
+            message: self.class.readable(msg.to_s).strip,
             timestamp: Time.now.iso8601(3)
           }
           logs.respond_to?(:record) ? logs.record(entry) : logs << entry
@@ -78,6 +78,20 @@ module Profiler
         def <<(msg)
           add(0, msg.to_s)
         end
+
+        # The line as valid UTF-8, a copy when it has to change: bytes that are not text in its
+        # encoding would raise in strip, inside the application's own logger call, or fail the
+        # JSON of the profile when it is saved. Binary bytes are read as UTF-8; a line in another
+        # encoding is converted. What cannot be read becomes U+FFFD.
+        def self.readable(text)
+          return text if text.encoding == Encoding::UTF_8 && text.valid_encoding?
+
+          if [Encoding::UTF_8, Encoding::BINARY, Encoding::US_ASCII].include?(text.encoding)
+            text.dup.force_encoding(Encoding::UTF_8).scrub
+          else
+            text.encode(Encoding::UTF_8, invalid: :replace, undef: :replace)
+          end
+        end
       end
 
       def icon

data/lib/profiler/configuration.rb

@@ -38,13 +38,13 @@ module Profiler
     LOCAL_HTTP_HOSTS = [/\A127\.0\.0\.1\z/, /\Alocalhost\z/i, /\A::1\z/].freeze
 
     attr_accessor :storage_options, :collectors,
-                  :skip_paths, :slow_query_threshold, :max_queries_warning, :sql_backtrace,
+                  :slow_query_threshold, :max_queries_warning, :sql_backtrace,
                   :track_memory, :allocated_objects_warning_threshold,
                   :mcp_enabled, :mcp_transport, :mcp_port,
                   :authorization_mode, :extension_cors_enabled,
                   :cors_allowed_origins, :api_forgery_protection, :frame_ancestors,
                   :track_ajax, :ajax_skip_paths,
-                  :track_http, :slow_http_threshold, :http_skip_hosts, :http_backtrace_depth,
+                  :track_http, :slow_http_threshold, :http_backtrace_depth,
                   :track_jobs,
                   :track_console,
                   :apply_env_overrides_when_disabled, :restrict_storage_permissions,
@@ -148,7 +148,23 @@ module Profiler
       @tmp_path = value.nil? ? nil : Pathname.new(value)
     end
 
-    attr_reader :cluster_allowed_slave_urls, :mcp_allowed_hosts
+    attr_reader :cluster_allowed_slave_urls, :mcp_allowed_hosts, :skip_paths, :http_skip_hosts
+
+    # Paths that are not profiled: a Regexp matched against the path, or a String equal to it.
+    # A single pattern is a list of one.
+    def skip_paths=(value)
+      @skip_paths = Array(value)
+    end
+
+    # Hosts whose outbound calls are left out: a String is a host name, matched whole and
+    # case-insensitively, or, when it starts with a dot (".internal"), a domain whose subdomains
+    # are left out; a Regexp is matched against the host name. Any other entry (a wildcard
+    # "*.internal", an empty String, nil) is left out with a warning in the log, the others kept:
+    # the gem is loaded in production too, where a mistake here must not stop the application
+    # from booting.
+    def http_skip_hosts=(value)
+      @http_skip_hosts = Array(value).select { |entry| valid_http_skip_host?(entry) }
+    end
 
     # Host names the MCP HTTP endpoint accepts beyond the loopback ones and config.hosts: a String
     # (a host name, any port, or a host:port) or a Regexp anchored with \A and \z, matched
@@ -323,6 +339,22 @@ module Profiler
       end
     end
 
+    def valid_http_skip_host?(entry)
+      problem =
+        case entry
+        when Regexp then nil
+        when String
+          if entry.strip.empty? || entry.match?(/[*\s]/)
+            "is not a host name; list each host, a domain as \".internal\" for its subdomains, or use a Regexp"
+          end
+        else "must be a String or a Regexp"
+        end
+      return true unless problem
+
+      Profiler.log_warn("config.http_skip_hosts: #{entry.inspect} #{problem}; ignored")
+      false
+    end
+
     def validate_mcp_allowed_host_pattern(pattern)
       unless Profiler::Cluster::Security.anchored_pattern?(pattern)
         raise ArgumentError, "config.mcp_allowed_hosts: #{pattern.inspect} must start with \\A and end with \\z, " \

data/lib/profiler/instrumentation/net_http_instrumentation.rb

@@ -122,12 +122,29 @@ module Profiler
       # it are the profiler's, whichever code makes them.
       def self.skip_host?(host, port = nil)
         config = Profiler.configuration
-        return true if config.http_skip_hosts.any? { |pattern| host.match?(pattern) }
+        return true if config.http_skip_hosts.any? { |pattern| skip_host_pattern?(pattern, host) }
 
         master = master_address(config.master_url)
         !master.nil? && master[0].casecmp?(host) && (port.nil? || master[1] == port)
       end
 
+      # A String is never read as a Regexp: "example.com" would match notexample.com, and
+      # "*.internal" would raise on every call. It is the host name, or, starting with a dot, a
+      # domain whose subdomains match. A list changed in place (<<) is not validated: anything
+      # else matches nothing.
+      def self.skip_host_pattern?(pattern, host)
+        case pattern
+        when Regexp then pattern.match?(host)
+        when String
+          if pattern.start_with?(".")
+            host.length > pattern.length && host.downcase.end_with?(pattern.downcase)
+          else
+            pattern.casecmp?(host)
+          end
+        else false
+        end
+      end
+
       def self.master_address(url)
         return nil if url.nil? || url.to_s.empty?
 

data/lib/profiler/middleware/profiler_middleware.rb

@@ -278,7 +278,8 @@ module Profiler
 
         # Skip profiler's own paths and static assets
         path = env["PATH_INFO"]
-        Profiler.configuration.skip_paths.none? { |pattern| path =~ pattern }
+        # === matches a Regexp against the path and compares a String with it.
+        Profiler.configuration.skip_paths.none? { |pattern| pattern === path }
       end
 
       def build_request(env)
@@ -371,13 +372,7 @@ module Profiler
       def read_buffered_body(body)
         content =
           begin
-            if body.respond_to?(:to_ary)
-              body.to_ary.join
-            else
-              parts = +""
-              body.each { |part| parts << part }
-              parts
-            end
+            join_parts(body.respond_to?(:to_ary) ? body.to_ary : body)
           rescue Exception # rubocop:disable Lint/RescueException
             begin
               close_body(body)
@@ -390,6 +385,20 @@ module Profiler
         content
       end
 
+      # The fragments' bytes, joined as they are: fragments of different encodings (a binary one
+      # among UTF-8 ones) cannot be joined as text, and converting them would change the page.
+      # The result takes the encoding of the first fragment, as CapturingBody does.
+      def join_parts(parts)
+        content = String.new(encoding: Encoding::BINARY)
+        encoding = nil
+        parts.each do |part|
+          part = part.to_s
+          encoding ||= part.encoding
+          content << part.b
+        end
+        content.force_encoding(encoding || Encoding::UTF_8)
+      end
+
       def close_body(body)
         body.close if body.respond_to?(:close) && !(body.respond_to?(:closed?) && body.closed?)
       end

data/lib/profiler/storage/blob_store.rb

@@ -2,6 +2,7 @@
 
 require "fileutils"
 require "json"
+require "set"
 require_relative "private_files"
 require_relative "token"
 
@@ -12,6 +13,8 @@ module Profiler
     # find nothing and writes are refused.
     class BlobStore
       NAME_FORMAT = /\A[a-z0-9_]+\z/
+      # A save writes its blobs before its row: prune leaves the directories this recent alone.
+      PRUNE_GRACE = 60
 
       def initialize(path)
         @path = path.to_s
@@ -46,6 +49,36 @@ module Profiler
         FileUtils.rm_rf(dir) if File.directory?(dir)
       end
 
+      # Removes one blob of token, and its directory once it holds no other.
+      def delete_blob(token, collector_name)
+        return unless valid?(token, collector_name)
+
+        dir = token_dir(token)
+        FileUtils.rm_f(File.join(dir, "#{collector_name}.json"))
+        Dir.rmdir(dir) if File.directory?(dir) && Dir.empty?(dir)
+      rescue SystemCallError => e
+        Profiler.log_error("BlobStore: could not delete #{token}/#{collector_name}", e)
+      end
+
+      # Removes the directories of the tokens not in except_tokens: those whose row was deleted
+      # outside the store, or that a failed save left behind. Only the directories named as a
+      # token and unchanged for grace seconds are considered.
+      def prune(except_tokens, grace: PRUNE_GRACE)
+        keep = except_tokens.to_set
+        cutoff = Time.now - grace
+        Dir.each_child(@path) do |name|
+          next if !Token.valid?(name) || keep.include?(name)
+
+          dir = token_dir(name)
+          stat = File.lstat(dir)
+          FileUtils.rm_rf(dir) if stat.directory? && stat.mtime < cutoff
+        rescue SystemCallError => e
+          Profiler.log_error("BlobStore: could not prune #{name}", e)
+        end
+      rescue SystemCallError => e
+        Profiler.log_error("BlobStore: could not prune #{@path}", e)
+      end
+
       def exists?(token, collector_name)
         return false unless valid?(token, collector_name)
 

data/lib/profiler/storage/redis_store.rb

@@ -28,6 +28,9 @@ module Profiler
       # of an earlier version) is removed by one process, under a lock, by batches of INDEX_BATCH.
       EVICT_BATCH = 100
       EVICT_LOCK_SECONDS = 60
+      # A page that held expired profiles is read again, once they are out of the indexes, at
+      # most this many times.
+      LIST_REPAIRS = 3
       # Deletes a lock only while it still holds the value its owner set: one that expired and was
       # taken by another process is left to it.
       RELEASE_LOCK = <<~LUA
@@ -50,7 +53,8 @@ module Profiler
         data = profile.to_h
         unindex(token, read_summary(token))
         @redis.setex(profile_key(token), @ttl, data.to_json)
-        index(token, profile.started_at.to_f, Summary.build(data))
+        @redis.pipelined { |pipe| index(token, profile.started_at.to_f, Summary.build(data), client: pipe) }
+        prune_expired
         evict_first_saved(token)
         token
       end
@@ -68,19 +72,18 @@ module Profiler
         nil
       end
 
-      # Newest first. summary: true reads the summaries only.
+      # Newest first. summary: true reads the summaries only. The profiles found expired are taken
+      # out of the indexes and the page read again, for it to hold limit profiles when there are.
       def list(limit: 50, offset: 0, type: nil, summary: false)
         ensure_index
-        tokens = @redis.zrevrange(type ? type_list_key(type) : list_key, offset, offset + limit - 1)
-        return tokens.filter_map { |token| load(token) } unless summary
+        key = type ? type_list_key(type) : list_key
+        LIST_REPAIRS.times do
+          page, expired = list_page(key, offset, limit, summary)
+          return page if expired.empty?
 
-        summaries = tokens.empty? ? [] : @redis.mget(*tokens.map { |token| summary_key(token) })
-        tokens.zip(summaries).filter_map do |token, json|
-          next Summary.to_profile(JSON.parse(json)) if json
-
-          profile = load(token)
-          profile && Summary.to_profile(Summary.build(profile))
+          remove_tokens(expired)
         end
+        list_page(key, offset, limit, summary).first
       end
 
       def cleanup(older_than: 24 * 60 * 60)
@@ -118,6 +121,46 @@ module Profiler
         Redis.new(url: url)
       end
 
+      # The page at offset, and the tokens of it whose profile has expired.
+      def list_page(key, offset, limit, summary)
+        tokens = @redis.zrevrange(key, offset, offset + limit - 1)
+        return [[], []] if tokens.empty?
+
+        expired = []
+        page = if summary
+          summaries = @redis.mget(*tokens.map { |token| summary_key(token) })
+          tokens.zip(summaries).filter_map do |token, json|
+            next Summary.to_profile(JSON.parse(json)) if json
+
+            profile = load(token)
+            expired << token if profile.nil? && !@redis.exists?(profile_key(token))
+            profile && Summary.to_profile(Summary.build(profile))
+          end
+        else
+          profiles = @redis.mget(*tokens.map { |token| profile_key(token) })
+          tokens.zip(profiles).filter_map do |token, json|
+            if json.nil?
+              expired << token
+              next
+            end
+
+            Models::Profile.from_json(json)
+          rescue => e
+            Profiler.log_error("RedisStore: could not load profile #{token}", e)
+            nil
+          end
+        end
+        [page, expired]
+      end
+
+      # A profile expires a TTL after its last save, with its keys, and Redis says nothing to the
+      # indexes: the tokens saved before that are taken out of them at each save. The indexes
+      # themselves expire a TTL after the last save, when every profile they list has.
+      def prune_expired
+        expired = @redis.zrangebyscore(saved_key, "-inf", Time.now.to_f - @ttl)
+        expired.each_slice(INDEX_BATCH) { |tokens| remove_tokens(tokens) }
+      end
+
       # score: the start time, the order of the lists. saved_at: the order of the saves, which the
       # eviction follows.
       def index(token, score, summary, saved_at: Time.now.to_f, client: @redis)
@@ -128,6 +171,7 @@ module Profiler
         client.zadd(type_list_key(type), score, token)
         client.zadd(saved_key, saved_at, token)
         client.sadd(types_key, type)
+        [list_key, type_list_key(type), saved_key, types_key].each { |key| client.expire(key, @ttl) }
         return unless Token.valid?(parent)
 
         client.sadd(children_key(parent), token)

data/lib/profiler/storage/sqlite_store.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "fileutils"
+require "time"
 require_relative "base_store"
 require_relative "blob_store"
 require_relative "private_files"
@@ -14,6 +15,7 @@ module Profiler
     class SqliteStore < BaseStore
       # Past max_profiles, the oldest profiles are evicted down to this share of it.
       LOW_WATER = 0.8
+      HTTP_BODIES = "http_response_bodies"
 
       def initialize(options = {})
         require "sqlite3"
@@ -40,13 +42,14 @@ module Profiler
         data = profile.to_h
 
         collectors_meta = {}
+        bodies_saved = false
         (data[:collectors_data] || {}).each do |collector_name, collector_data|
           next unless collector_data.is_a?(Hash)
 
           if collector_name.to_s == "http"
             requests = collector_data["requests"]
             if requests
-              stripped = save_http_response_bodies(token, requests)
+              stripped, bodies_saved = save_http_response_bodies(token, requests)
               collectors_meta[collector_name] = collector_data.merge("requests" => stripped)
             else
               collectors_meta[collector_name] = collector_data
@@ -55,6 +58,9 @@ module Profiler
             collectors_meta[collector_name] = collector_data
           end
         end
+        # A profile saved again without response bodies keeps none of its previous save: they
+        # would be merged into its requests on load.
+        @blob_store.delete_blob(token, HTTP_BODIES) unless bodies_saved
 
         @db.execute(
           <<~SQL,
@@ -76,8 +82,8 @@ module Profiler
           status:           data[:status],
           duration:         data[:duration],
           memory:           data[:memory],
-          started_at:       data[:started_at],
-          finished_at:      data[:finished_at],
+          started_at:       utc_iso8601(data[:started_at]),
+          finished_at:      utc_iso8601(data[:finished_at]),
           parent_token:     data[:parent_token],
           is_ajax:          data[:is_ajax] ? 1 : 0,
           tabs:             JSON.generate(data[:tabs] || []),
@@ -157,6 +163,7 @@ module Profiler
         ).map { |r| r["token"] }
         @db.execute("DELETE FROM profiler_profiles WHERE started_at < :cutoff", cutoff: cutoff)
         tokens.each { |token| @blob_store.delete(token) }
+        prune_blobs
       end
 
       private
@@ -179,6 +186,12 @@ module Profiler
           @db.execute("DELETE FROM profiler_profiles WHERE token IN (#{(["?"] * slice.size).join(",")})", slice)
         end
         tokens.each { |token| @blob_store.delete(token) }
+        prune_blobs
+      end
+
+      # The blobs of the rows deleted outside the store (a database removed or recreated).
+      def prune_blobs
+        @blob_store.prune(@db.execute("SELECT token FROM profiler_profiles").map { |r| r["token"] })
       end
 
       # A row written before the summary column falls back to the whole row, summarized.
@@ -195,24 +208,26 @@ module Profiler
         nil
       end
 
+      # The requests without their response bodies, and whether a blob of bodies was written.
       def save_http_response_bodies(token, requests)
         bodies = requests.map do |req|
           { "response_body" => req["response_body"], "response_body_encoding" => req["response_body_encoding"] }
         end
 
-        return requests unless bodies.any? { |b| !b["response_body"].nil? }
+        return [requests, false] unless bodies.any? { |b| !b["response_body"].nil? }
 
-        @blob_store.write(token, "http_response_bodies", bodies)
+        @blob_store.write(token, HTTP_BODIES, bodies)
 
-        requests.map do |req|
+        stripped = requests.map do |req|
           req.reject { |k, _| %w[response_body response_body_encoding].include?(k) }
         end
+        [stripped, true]
       end
 
       def load_http_response_bodies(token, requests)
         return requests if requests.nil? || requests.empty?
 
-        bodies = @blob_store.read(token, "http_response_bodies")
+        bodies = @blob_store.read(token, HTTP_BODIES)
         return requests if bodies.nil? || bodies.empty?
 
         requests.each_with_index.map do |req, i|
@@ -266,6 +281,26 @@ module Profiler
         rescue SQLite3::Exception
           # column already exists
         end
+
+        migrate_times_to_utc
+      end
+
+      # Version 1 stores the times in UTC. The rows written before it carry the local offset of
+      # the process that saved them, and the default database outlives a restart: they are
+      # rewritten once, by SQLite, which reads the offset. A value it cannot read is left as is.
+      def migrate_times_to_utc
+        return if @db.get_first_value("PRAGMA user_version").to_i >= 1
+
+        @db.transaction do
+          %w[started_at finished_at].each do |column|
+            @db.execute(<<~SQL)
+              UPDATE profiler_profiles
+                 SET #{column} = strftime('%Y-%m-%dT%H:%M:%SZ', #{column})
+               WHERE #{column} NOT LIKE '%Z' AND strftime('%Y-%m-%dT%H:%M:%SZ', #{column}) IS NOT NULL
+            SQL
+          end
+          @db.execute("PRAGMA user_version = 1")
+        end
       end
 
       def row_to_profile(row, load_blobs: true)
@@ -293,8 +328,8 @@ module Profiler
           status:                 row["status"],
           duration:               row["duration"],
           memory:                 row["memory"],
-          started_at:             row["started_at"],
-          finished_at:            row["finished_at"],
+          started_at:             local_iso8601(row["started_at"]),
+          finished_at:            local_iso8601(row["finished_at"]),
           parent_token:           row["parent_token"],
           is_ajax:                row["is_ajax"] == 1,
           tabs:                   parse_json(row["tabs"], []),
@@ -312,6 +347,25 @@ module Profiler
         nil
       end
 
+      # The times are stored in UTC, all in the same form, for the cleanup and the lists to compare
+      # them as text; a profile gives them with the offset of the process that recorded it.
+      def utc_iso8601(value)
+        return value if value.nil?
+
+        Time.iso8601(value.to_s).utc.iso8601
+      rescue ArgumentError
+        value
+      end
+
+      # Read back in local time, as the profile gave them.
+      def local_iso8601(value)
+        return value if value.nil?
+
+        Time.iso8601(value).localtime.iso8601
+      rescue ArgumentError
+        value
+      end
+
       def parse_json(value, default)
         return default if value.nil? || value.empty?
 

data/lib/profiler/tasks/profiler.rake

@@ -1,17 +1,33 @@
 # frozen_string_literal: true
 
+module Profiler
+  module Tasks
+    # The whole number an environment variable gives, or default when it is not set. An empty or
+    # non-numeric value ("", "abc", "1h") stops the task: read as 0, OLDER_THAN would delete every
+    # profile.
+    def self.integer_env(name, default, minimum:, unit:)
+      value = ENV[name]
+      return default if value.nil?
+      return Integer(value, 10) if value.match?(/\A\d+\z/) && Integer(value, 10) >= minimum
+
+      warn "#{name} must be a whole number of #{unit} (#{minimum} or more), got #{value.inspect}."
+      exit 1
+    end
+  end
+end
+
 namespace :profiler do
-  desc "Clean up old profiles"
+  desc "Clean up old profiles (OLDER_THAN: seconds, 86400 by default)"
   task cleanup: :environment do
-    older_than = ENV["OLDER_THAN"]&.to_i || 24 * 60 * 60
+    older_than = Profiler::Tasks.integer_env("OLDER_THAN", 24 * 60 * 60, minimum: 0, unit: "seconds")
     puts "Cleaning up profiles older than #{older_than} seconds..."
     Profiler.storage.cleanup(older_than: older_than)
     puts "Cleanup complete!"
   end
 
-  desc "List recent profiles"
+  desc "List recent profiles (LIMIT: 20 by default)"
   task list: :environment do
-    limit = ENV["LIMIT"]&.to_i || 20
+    limit = Profiler::Tasks.integer_env("LIMIT", 20, minimum: 1, unit: "profiles")
     profiles = Profiler.storage.list(limit: limit)
 
     if profiles.empty?

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.33.1"
+  VERSION = "0.33.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.33.1
+  version: 0.33.3
 platform: ruby
 authors:
 - Sébastien Duplessy