rails-profiler 0.34.0 → 0.34.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b6a0140a91e984bd6d06d7277a149c2a7eeace21ec53c3d3ddc1acb7eb137879
-  data.tar.gz: 730abdd8332a638e3d78db3d74378ab10fc1280f9d5f83f11b327409b076c1e3
+  metadata.gz: b6365d7a34d882d20ca0257247629d6099917508ad78cecc96726dc6788c7a75
+  data.tar.gz: e7dffe134ddcac64202aae83bb73963837068ae258b1cdc1d959e78504b31861
 SHA512:
-  metadata.gz: '09a3cac5a02d3407f8a03dad19154d8f36c5dd57e8c1f5d9b0021aad015e7e459a4305592e68defb796672a9cbd29b40c48b2933cff56b2fe340c3ae370de767'
-  data.tar.gz: dda83a3c7086e4679766abe06d0dc5e88befc5e9ebebb19a87ec605a3b268a2ab81fccef0274e8170043bb4c6ab452f68307e5a1546921b55b418289427fc805
+  metadata.gz: 8912bad06bc0824942c4e696d9fd408dff3a76238af92faaa7c262815e477e3850fe90c14d9acd6ceced45271180c990c8d6d597cf591d998eae48edf3dc9e11
+  data.tar.gz: aeb7cec816ce9de90ab3dcc72629d36c6f9b1ff69bfa618416e72fa5cbb6301cae5a5d12dd09d6d0a4c247c76095c397777dad9f42a18bbf5aaafa7d375b7248

data/CHANGELOG.md

@@ -19,6 +19,55 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.34.2] - 2026-10-15
+
+<!-- stamped -->
+
+### Changed
+
+- **Dependencies:** The gem now requires `mcp` below 2.0 (`>= 0.3, < 2`). The upper bound keeps
+  a future major of `mcp` from being picked up by `bundle update` and breaking the MCP server; the
+  test suite passes on both ends of the range, `mcp` 0.3.0 and 1.7.0. An application already on
+  `mcp` 2.x would have to stay on an earlier version of the gem until it supports it.
+
+### Fixed
+
+- **MCP:** `explain_query` called against an unknown, offline or refused slave profiler now answers the dedicated message (`Error: Unknown slave profiler: ...`) instead of the generic `EXPLAIN failed`.
+- **Assets:** The toolbar assets endpoints now answer a 404 that names the command to run (`yarn build:full` in the gem) when `app/assets/builds/` is empty or incomplete, instead of a 500.
+
+### Security
+
+- **Build:** The client the dashboard is built from is now generated with `orval` 8
+  (`^8.41.0`, locked at 8.41.0) instead of 7.21.0, which carried eleven critical advisories of
+  code execution while generating from an OpenAPI document. `orval` only runs when the assets are
+  built, never in an application using the gem, and the generated client calls the same URLs with
+  the same methods and cache keys as before. Building the assets now needs Node.js 22.18 or later.
+- **CI:** A `yarn:audit` job reports the advisories at level high and above on the JavaScript
+  build dependencies. It is informational: a finding shows as a warning and does not hold back a
+  publication.
+
+## [0.34.1] - 2026-10-15
+
+<!-- stamped -->
+
+### Security
+
+- **Explain:** The Explain button, `POST /_profiler/api/explain` and the MCP `explain_query` tool
+  now only run in the `development` and `test` environments, even where an application sets
+  `enabled = true`. Elsewhere, `production` and `staging` included, they are refused before
+  anything reaches the database: a `403` from the endpoint, an error from the tool. PostgreSQL's
+  `EXPLAIN ANALYZE` runs the query it explains, so a costly `SELECT` used to run for real on the
+  production database. Set `config.allow_explain_outside_development = true` to allow it there
+  anyway (false by default). The description of `explain_query` given to MCP clients now says so;
+  it claimed the tool was limited to development and test, which nothing enforced.
+- **API:** An unexpected error no longer sends its message to the client. `POST
+  /_profiler/api/explain` answers `500` with `Explain failed`, `POST /_profiler/api/ajax/link`
+  with `Could not link the Ajax request`, the slave proxy (`/_profiler/api/slaves/:name/...`)
+  `502` with `Proxy error`, and `explain_query` with `EXPLAIN failed`. The message, which could
+  hold the SQL of the query, an internal file path or the address of a slave, goes to the
+  application log instead. The profiler's own refusals (a query that is not read-only, an index
+  out of range, an unknown or offline slave) still give their reason.
+
 ## [0.34.0] - 2026-10-15
 
 <!-- stamped -->

data/app/assets/builds/profiler-toolbar.js

@@ -4211,6 +4211,18 @@
   }
 
   // app/assets/typescript/profiler/generated/api.ts
+  var withQueryKey = (query, queryKey) => {
+    const result = { queryKey };
+    for (const key of Object.keys(query)) {
+      if (key === "queryKey") continue;
+      Object.defineProperty(result, key, {
+        enumerable: true,
+        configurable: true,
+        get: () => query[key]
+      });
+    }
+    return result;
+  };
   var getToolbar = (token, signal) => {
     return apiFetch(
       {
@@ -4229,13 +4241,12 @@
     const { query: queryOptions } = options ?? {};
     const queryKey = queryOptions?.queryKey ?? getGetToolbarQueryKey(token);
     const queryFn = ({ signal }) => getToolbar(token, signal);
-    return { queryKey, queryFn, enabled: !!token, ...queryOptions };
+    return { queryKey, queryFn, enabled: token !== null && token !== void 0, ...queryOptions };
   };
   function useGetToolbar(token, options) {
     const queryOptions = getGetToolbarQueryOptions(token, options);
     const query = useQuery(queryOptions);
-    query.queryKey = queryOptions.queryKey;
-    return query;
+    return withQueryKey(query, queryOptions.queryKey);
   }
 
   // app/assets/typescript/profiler/hooks/profileUpdatePoller.ts

data/app/assets/builds/profiler.js

@@ -3472,6 +3472,18 @@
   }
 
   // app/assets/typescript/profiler/generated/api.ts
+  var withQueryKey = (query, queryKey) => {
+    const result = { queryKey };
+    for (const key of Object.keys(query)) {
+      if (key === "queryKey") continue;
+      Object.defineProperty(result, key, {
+        enumerable: true,
+        configurable: true,
+        get: () => query[key]
+      });
+    }
+    return result;
+  };
   var listConsoles = (params, signal) => {
     return apiFetch(
       {
@@ -3498,19 +3510,20 @@
   function useListConsolesInfinite(params, options) {
     const queryOptions = getListConsolesInfiniteQueryOptions(params, options);
     const query = useInfiniteQuery(queryOptions);
-    query.queryKey = queryOptions.queryKey;
-    return query;
+    return withQueryKey(query, queryOptions.queryKey);
   }
-  var deleteConsole = (id) => {
+  var deleteConsole = (id, signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/console/${id}`,
-        method: "DELETE"
+        method: "DELETE",
+        signal
       }
     );
   };
+  var getDeleteConsoleMutationKey = () => ["deleteConsole"];
   var getDeleteConsoleMutationOptions = (options) => {
-    const mutationKey = ["deleteConsole"];
+    const mutationKey = getDeleteConsoleMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = (props) => {
       const { id } = props ?? {};
@@ -3519,19 +3532,20 @@
     return { mutationFn, ...mutationOptions };
   };
   var useDeleteConsole = (options) => {
-    const mutationOptions = getDeleteConsoleMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getDeleteConsoleMutationOptions(options));
   };
-  var clearConsoles = () => {
+  var clearConsoles = (signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/console/clear`,
-        method: "DELETE"
+        method: "DELETE",
+        signal
       }
     );
   };
+  var getClearConsolesMutationKey = () => ["clearConsoles"];
   var getClearConsolesMutationOptions = (options) => {
-    const mutationKey = ["clearConsoles"];
+    const mutationKey = getClearConsolesMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = () => {
       return clearConsoles();
@@ -3539,8 +3553,7 @@
     return { mutationFn, ...mutationOptions };
   };
   var useClearConsoles = (options) => {
-    const mutationOptions = getClearConsolesMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getClearConsolesMutationOptions(options));
   };
   var getEnvVars = (signal) => {
     return apiFetch(
@@ -3565,21 +3578,22 @@
   function useGetEnvVars(options) {
     const queryOptions = getGetEnvVarsQueryOptions(options);
     const query = useQuery(queryOptions);
-    query.queryKey = queryOptions.queryKey;
-    return query;
+    return withQueryKey(query, queryOptions.queryKey);
   }
-  var updateEnvVar = (updateEnvVarBody) => {
+  var updateEnvVar = (updateEnvVarBody, signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/env_vars`,
         method: "PATCH",
         headers: { "Content-Type": "application/json" },
-        data: updateEnvVarBody
+        data: updateEnvVarBody,
+        signal
       }
     );
   };
+  var getUpdateEnvVarMutationKey = () => ["updateEnvVar"];
   var getUpdateEnvVarMutationOptions = (options) => {
-    const mutationKey = ["updateEnvVar"];
+    const mutationKey = getUpdateEnvVarMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = (props) => {
       const { data } = props ?? {};
@@ -3588,20 +3602,21 @@
     return { mutationFn, ...mutationOptions };
   };
   var useUpdateEnvVar = (options) => {
-    const mutationOptions = getUpdateEnvVarMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getUpdateEnvVarMutationOptions(options));
   };
-  var resetEnvVar = (params) => {
+  var resetEnvVar = (params, signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/env_vars/reset`,
         method: "DELETE",
-        params
+        params,
+        signal
       }
     );
   };
+  var getResetEnvVarMutationKey = () => ["resetEnvVar"];
   var getResetEnvVarMutationOptions = (options) => {
-    const mutationKey = ["resetEnvVar"];
+    const mutationKey = getResetEnvVarMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = (props) => {
       const { params } = props ?? {};
@@ -3610,19 +3625,20 @@
     return { mutationFn, ...mutationOptions };
   };
   var useResetEnvVar = (options) => {
-    const mutationOptions = getResetEnvVarMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getResetEnvVarMutationOptions(options));
   };
-  var resetAllEnvVars = () => {
+  var resetAllEnvVars = (signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/env_vars/reset_all`,
-        method: "DELETE"
+        method: "DELETE",
+        signal
       }
     );
   };
+  var getResetAllEnvVarsMutationKey = () => ["resetAllEnvVars"];
   var getResetAllEnvVarsMutationOptions = (options) => {
-    const mutationKey = ["resetAllEnvVars"];
+    const mutationKey = getResetAllEnvVarsMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = () => {
       return resetAllEnvVars();
@@ -3630,8 +3646,7 @@
     return { mutationFn, ...mutationOptions };
   };
   var useResetAllEnvVars = (options) => {
-    const mutationOptions = getResetAllEnvVarsMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getResetAllEnvVarsMutationOptions(options));
   };
   var explainQuery = (explainQueryBody, signal) => {
     return apiFetch(
@@ -3644,8 +3659,9 @@
       }
     );
   };
+  var getExplainQueryMutationKey = () => ["explainQuery"];
   var getExplainQueryMutationOptions = (options) => {
-    const mutationKey = ["explainQuery"];
+    const mutationKey = getExplainQueryMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = (props) => {
       const { data } = props ?? {};
@@ -3654,21 +3670,22 @@
     return { mutationFn, ...mutationOptions };
   };
   var useExplainQuery = (options) => {
-    const mutationOptions = getExplainQueryMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getExplainQueryMutationOptions(options));
   };
-  var updateFunctionProfiling = (updateFunctionProfilingBody) => {
+  var updateFunctionProfiling = (updateFunctionProfilingBody, signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/function_profiling`,
         method: "PATCH",
         headers: { "Content-Type": "application/json" },
-        data: updateFunctionProfilingBody
+        data: updateFunctionProfilingBody,
+        signal
       }
     );
   };
+  var getUpdateFunctionProfilingMutationKey = () => ["updateFunctionProfiling"];
   var getUpdateFunctionProfilingMutationOptions = (options) => {
-    const mutationKey = ["updateFunctionProfiling"];
+    const mutationKey = getUpdateFunctionProfilingMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = (props) => {
       const { data } = props ?? {};
@@ -3677,8 +3694,7 @@
     return { mutationFn, ...mutationOptions };
   };
   var useUpdateFunctionProfiling = (options) => {
-    const mutationOptions = getUpdateFunctionProfilingMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getUpdateFunctionProfilingMutationOptions(options));
   };
   var listJobs = (params, signal) => {
     return apiFetch(
@@ -3706,19 +3722,20 @@
   function useListJobsInfinite(params, options) {
     const queryOptions = getListJobsInfiniteQueryOptions(params, options);
     const query = useInfiniteQuery(queryOptions);
-    query.queryKey = queryOptions.queryKey;
-    return query;
+    return withQueryKey(query, queryOptions.queryKey);
   }
-  var deleteJob = (id) => {
+  var deleteJob = (id, signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/jobs/${id}`,
-        method: "DELETE"
+        method: "DELETE",
+        signal
       }
     );
   };
+  var getDeleteJobMutationKey = () => ["deleteJob"];
   var getDeleteJobMutationOptions = (options) => {
-    const mutationKey = ["deleteJob"];
+    const mutationKey = getDeleteJobMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = (props) => {
       const { id } = props ?? {};
@@ -3727,19 +3744,20 @@
     return { mutationFn, ...mutationOptions };
   };
   var useDeleteJob = (options) => {
-    const mutationOptions = getDeleteJobMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getDeleteJobMutationOptions(options));
   };
-  var clearJobs = () => {
+  var clearJobs = (signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/jobs/clear`,
-        method: "DELETE"
+        method: "DELETE",
+        signal
       }
     );
   };
+  var getClearJobsMutationKey = () => ["clearJobs"];
   var getClearJobsMutationOptions = (options) => {
-    const mutationKey = ["clearJobs"];
+    const mutationKey = getClearJobsMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = () => {
       return clearJobs();
@@ -3747,8 +3765,7 @@
     return { mutationFn, ...mutationOptions };
   };
   var useClearJobs = (options) => {
-    const mutationOptions = getClearJobsMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getClearJobsMutationOptions(options));
   };
   var listOutboundRequests = (signal) => {
     return apiFetch(
@@ -3773,8 +3790,7 @@
   function useListOutboundRequests(options) {
     const queryOptions = getListOutboundRequestsQueryOptions(options);
     const query = useQuery(queryOptions);
-    query.queryKey = queryOptions.queryKey;
-    return query;
+    return withQueryKey(query, queryOptions.queryKey);
   }
   var listProfiles = (params, signal) => {
     return apiFetch(
@@ -3802,19 +3818,20 @@
   function useListProfilesInfinite(params, options) {
     const queryOptions = getListProfilesInfiniteQueryOptions(params, options);
     const query = useInfiniteQuery(queryOptions);
-    query.queryKey = queryOptions.queryKey;
-    return query;
+    return withQueryKey(query, queryOptions.queryKey);
   }
-  var deleteProfile = (id) => {
+  var deleteProfile = (id, signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/profiles/${id}`,
-        method: "DELETE"
+        method: "DELETE",
+        signal
       }
     );
   };
+  var getDeleteProfileMutationKey = () => ["deleteProfile"];
   var getDeleteProfileMutationOptions = (options) => {
-    const mutationKey = ["deleteProfile"];
+    const mutationKey = getDeleteProfileMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = (props) => {
       const { id } = props ?? {};
@@ -3823,19 +3840,20 @@
     return { mutationFn, ...mutationOptions };
   };
   var useDeleteProfile = (options) => {
-    const mutationOptions = getDeleteProfileMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getDeleteProfileMutationOptions(options));
   };
-  var clearProfiles = () => {
+  var clearProfiles = (signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/profiles/clear`,
-        method: "DELETE"
+        method: "DELETE",
+        signal
       }
     );
   };
+  var getClearProfilesMutationKey = () => ["clearProfiles"];
   var getClearProfilesMutationOptions = (options) => {
-    const mutationKey = ["clearProfiles"];
+    const mutationKey = getClearProfilesMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = () => {
       return clearProfiles();
@@ -3843,8 +3861,7 @@
     return { mutationFn, ...mutationOptions };
   };
   var useClearProfiles = (options) => {
-    const mutationOptions = getClearProfilesMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getClearProfilesMutationOptions(options));
   };
   var getTestRunnerFiles = (params, signal) => {
     return apiFetch(
@@ -3871,8 +3888,7 @@
   function useGetTestRunnerFiles(params, options) {
     const queryOptions = getGetTestRunnerFilesQueryOptions(params, options);
     const query = useQuery(queryOptions);
-    query.queryKey = queryOptions.queryKey;
-    return query;
+    return withQueryKey(query, queryOptions.queryKey);
   }
   var createTestRun = (createTestRunBody, signal) => {
     return apiFetch(
@@ -3885,8 +3901,9 @@
       }
     );
   };
+  var getCreateTestRunMutationKey = () => ["createTestRun"];
   var getCreateTestRunMutationOptions = (options) => {
-    const mutationKey = ["createTestRun"];
+    const mutationKey = getCreateTestRunMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = (props) => {
       const { data } = props ?? {};
@@ -3895,19 +3912,20 @@
     return { mutationFn, ...mutationOptions };
   };
   var useCreateTestRun = (options) => {
-    const mutationOptions = getCreateTestRunMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getCreateTestRunMutationOptions(options));
   };
-  var deleteTestRun = (id) => {
+  var deleteTestRun = (id, signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/test_runner/runs/${id}`,
-        method: "DELETE"
+        method: "DELETE",
+        signal
       }
     );
   };
+  var getDeleteTestRunMutationKey = () => ["deleteTestRun"];
   var getDeleteTestRunMutationOptions = (options) => {
-    const mutationKey = ["deleteTestRun"];
+    const mutationKey = getDeleteTestRunMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = (props) => {
       const { id } = props ?? {};
@@ -3916,8 +3934,7 @@
     return { mutationFn, ...mutationOptions };
   };
   var useDeleteTestRun = (options) => {
-    const mutationOptions = getDeleteTestRunMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getDeleteTestRunMutationOptions(options));
   };
   var listTests = (params, signal) => {
     return apiFetch(
@@ -3945,19 +3962,20 @@
   function useListTestsInfinite(params, options) {
     const queryOptions = getListTestsInfiniteQueryOptions(params, options);
     const query = useInfiniteQuery(queryOptions);
-    query.queryKey = queryOptions.queryKey;
-    return query;
+    return withQueryKey(query, queryOptions.queryKey);
   }
-  var deleteTest = (id) => {
+  var deleteTest = (id, signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/tests/${id}`,
-        method: "DELETE"
+        method: "DELETE",
+        signal
       }
     );
   };
+  var getDeleteTestMutationKey = () => ["deleteTest"];
   var getDeleteTestMutationOptions = (options) => {
-    const mutationKey = ["deleteTest"];
+    const mutationKey = getDeleteTestMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = (props) => {
       const { id } = props ?? {};
@@ -3966,19 +3984,20 @@
     return { mutationFn, ...mutationOptions };
   };
   var useDeleteTest = (options) => {
-    const mutationOptions = getDeleteTestMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getDeleteTestMutationOptions(options));
   };
-  var clearTests = () => {
+  var clearTests = (signal) => {
     return apiFetch(
       {
         url: `/_profiler/api/tests/clear`,
-        method: "DELETE"
+        method: "DELETE",
+        signal
       }
     );
   };
+  var getClearTestsMutationKey = () => ["clearTests"];
   var getClearTestsMutationOptions = (options) => {
-    const mutationKey = ["clearTests"];
+    const mutationKey = getClearTestsMutationKey();
     const { mutation: mutationOptions } = options ? options.mutation && "mutationKey" in options.mutation && options.mutation.mutationKey ? options : { ...options, mutation: { ...options.mutation, mutationKey } } : { mutation: { mutationKey } };
     const mutationFn = () => {
       return clearTests();
@@ -3986,8 +4005,7 @@
     return { mutationFn, ...mutationOptions };
   };
   var useClearTests = (options) => {
-    const mutationOptions = getClearTestsMutationOptions(options);
-    return useMutation(mutationOptions);
+    return useMutation(getClearTestsMutationOptions(options));
   };
 
   // app/assets/typescript/profiler/dashboard/utils.ts

data/app/controllers/profiler/api/ajax_controller.rb

@@ -32,8 +32,10 @@ module Profiler
         Profiler.storage.save(child_token, child_profile)
 
         render json: { success: true }
-      rescue => e
-        render json: { error: e.message }, status: :internal_server_error
+      rescue StandardError => e
+        # The storage's message can name an internal path: the log only.
+        Profiler.log_error("Ajax: could not link the request #{child_token.to_s.inspect} to #{parent_token.inspect}", e)
+        render json: { error: "Could not link the Ajax request" }, status: :internal_server_error
       end
     end
   end

data/app/controllers/profiler/api/explain_controller.rb

@@ -6,8 +6,8 @@ module Profiler
   module Api
     class ExplainController < ApplicationController
       def create
-        unless Profiler.configuration.enabled
-          return render json: { error: "EXPLAIN is only available when the profiler is enabled" }, status: :forbidden
+        if (reason = Profiler::ExplainRunner.refusal)
+          return render json: { error: reason }, status: :forbidden
         end
 
         token       = params[:token].to_s
@@ -19,10 +19,12 @@ module Profiler
 
         result = Profiler::ExplainRunner.run(token, query_index)
         render json: result
-      rescue ArgumentError => e
+      rescue Profiler::ExplainRunner::RefusedError => e
         render json: { error: e.message }, status: :unprocessable_entity
-      rescue => e
-        render json: { error: e.message }, status: :internal_server_error
+      rescue StandardError => e
+        # The database's message carries the SQL, and sometimes a path: the log only.
+        Profiler.log_error("Explain: failed for query #{query_index} of profile #{token.inspect}", e)
+        render json: { error: "Explain failed" }, status: :internal_server_error
       end
     end
   end

data/app/controllers/profiler/api/slave_proxy_controller.rb

@@ -26,10 +26,13 @@ module Profiler
                  end
 
         render json: result
+      # The profiler's own refusals (unknown or offline slave, refused URL, missing secret).
       rescue Profiler::Error => e
         render json: { error: e.message }, status: :bad_gateway
-      rescue => e
-        render json: { error: "Proxy error: #{e.message}" }, status: :bad_gateway
+      rescue StandardError => e
+        # A network error names the slave's address, and sometimes a path: the log only.
+        Profiler.log_error("SlaveProxy: could not forward #{request.method} to slave profiler #{params[:slave_name].to_s.inspect}", e)
+        render json: { error: "Proxy error" }, status: :bad_gateway
       end
 
       private

data/app/controllers/profiler/assets_controller.rb

@@ -8,25 +8,28 @@ module Profiler
     skip_before_action :check_authorization
     skip_before_action :authorize_request
 
+    BUILD_MISSING = "Profiler assets are not built (%s is missing). Run `yarn build:full` in the profiler gem."
+
     def toolbar_js
-      path = Profiler::Engine.root.join("app", "assets", "builds", "profiler-toolbar.js")
-      js = File.read(path)
-      expires_in 1.hour, public: true
-      render plain: js, content_type: "application/javascript"
+      serve("profiler-toolbar.js", "application/javascript")
     end
 
     def main_js
-      path = Profiler::Engine.root.join("app", "assets", "builds", "profiler.js")
-      js = File.read(path)
-      expires_in 1.hour, public: true
-      render plain: js, content_type: "application/javascript"
+      serve("profiler.js", "application/javascript")
     end
 
     def main_css
-      path = Profiler::Engine.root.join("app", "assets", "builds", "profiler.css")
-      css = File.read(path)
+      serve("profiler.css", "text/css")
+    end
+
+    private
+
+    def serve(name, content_type)
+      body = File.read(Profiler::Engine.root.join("app", "assets", "builds", name))
       expires_in 1.hour, public: true
-      render plain: css, content_type: "text/css"
+      render plain: body, content_type: content_type
+    rescue Errno::ENOENT
+      render plain: format(BUILD_MISSING, name), status: :not_found
     end
   end
 end

data/lib/profiler/configuration.rb

@@ -48,7 +48,7 @@ module Profiler
                   :track_jobs,
                   :track_console,
                   :apply_env_overrides_when_disabled, :restrict_storage_permissions,
-                  :test_runner_allow_undiscovered_files,
+                  :test_runner_allow_undiscovered_files, :allow_explain_outside_development,
                   :track_mailers, :capture_mail_body, :sanitize_mailer_recipients, :mailer_skip_actions,
                   :compress_bodies, :compress_body_threshold, :max_captured_body_bytes, :max_captured_log_bytes,
                   :redact_sensitive_data, :filter_parameters, :env_allowlist,
@@ -108,6 +108,10 @@ module Profiler
       # The test runner only runs the files listed by its discovery. true restores the
       # previous behavior: any file under the Rails root.
       @test_runner_allow_undiscovered_files = false
+      # Explain (the Database tab button, POST /_profiler/api/explain, the explain_query MCP tool)
+      # only runs in the development and test environments, even with enabled = true elsewhere:
+      # PostgreSQL's EXPLAIN ANALYZE runs the query. true allows it in every environment.
+      @allow_explain_outside_development = false
       @track_mailers = true
       @capture_mail_body = false
       @sanitize_mailer_recipients = false

data/lib/profiler/explain_runner.rb

@@ -11,9 +11,39 @@ module Profiler
   # what no reading of the statement can rule out (a function with a side effect),
   # on a connection of its own that is closed afterwards, in a transaction that is
   # always rolled back, read-only and time-limited on PostgreSQL.
+  #
+  # It only runs in the development and test environments, whatever config.enabled says,
+  # unless config.allow_explain_outside_development is set: PostgreSQL's EXPLAIN ANALYZE runs
+  # the query, and a costly SELECT would run for real on the production database.
   module ExplainRunner
-    # An ArgumentError, so callers answer it as a bad request (422, MCP error).
-    class UnsafeStatementError < ArgumentError; end
+    # A request the runner refuses, with a message written for the caller: an ArgumentError,
+    # so callers answer it as a bad request (422, MCP error). Any other error is internal, and
+    # its message (SQL, paths) stays in the server log.
+    class RefusedError < ArgumentError; end
+
+    class UnsafeStatementError < RefusedError; end
+
+    # The environments EXPLAIN runs in without config.allow_explain_outside_development.
+    ENVIRONMENTS = %w[development test].freeze
+
+    NOT_ENABLED = "EXPLAIN is only available when the profiler is enabled"
+    OUTSIDE_DEVELOPMENT = "EXPLAIN is only available in the development and test environments " \
+                          "(config.allow_explain_outside_development allows it in the others)"
+
+    # Why EXPLAIN may not run in this process, or nil when it may. Without Rails, the
+    # environment is unknown and EXPLAIN is refused.
+    def self.refusal
+      config = Profiler.configuration
+      return NOT_ENABLED unless config.enabled
+      return nil if config.allow_explain_outside_development == true
+      return nil if ENVIRONMENTS.include?(current_environment)
+
+      OUTSIDE_DEVELOPMENT
+    end
+
+    def self.current_environment
+      Rails.env.to_s if defined?(Rails) && Rails.respond_to?(:env) && Rails.env
+    end
 
     # PostgreSQL's EXPLAIN ANALYZE runs the query: a slow one is stopped after this.
     PROBE_STATEMENT_TIMEOUT = "30s"
@@ -21,29 +51,29 @@ module Profiler
     # @param profile_token [String]
     # @param query_index   [Integer]
     # @return [Hash] { result:, format: "json"|"text", adapter: String }
-    #         or raises ArgumentError / RuntimeError
+    #         or raises SecurityError (see .refusal), RefusedError, or any error of the database
     def self.run(profile_token, query_index)
-      unless Profiler.configuration.enabled
-        raise SecurityError, "EXPLAIN is only available when the profiler is enabled"
+      if (reason = refusal)
+        raise SecurityError, reason
       end
 
       profile = Profiler.storage.load(profile_token)
-      raise ArgumentError, "Profile not found: #{profile_token}" unless profile
+      raise RefusedError, "Profile not found: #{profile_token}" unless profile
 
       db_data = profile.collector_data("database")
-      raise ArgumentError, "No database data in this profile" unless db_data && db_data["queries"]
+      raise RefusedError, "No database data in this profile" unless db_data && db_data["queries"]
 
       queries = db_data["queries"]
       query_index = query_index.to_i
       unless query_index >= 0 && query_index < queries.size
-        raise ArgumentError, "Query index #{query_index} out of range (0..#{queries.size - 1})"
+        raise RefusedError, "Query index #{query_index} out of range (0..#{queries.size - 1})"
       end
 
       query = queries[query_index]
       sql   = query["sql"].to_s
       binds = Array(query["binds"])
       if binds.include?(Redaction::MASK)
-        raise ArgumentError, "EXPLAIN refused for query #{query_index}: one of its bind values was " \
+        raise RefusedError, "EXPLAIN refused for query #{query_index}: one of its bind values was " \
                              "filtered when captured (config.filter_parameters), so the query cannot be rebuilt"
       end
 

data/lib/profiler/mcp/server.rb

@@ -176,7 +176,7 @@ module Profiler
           ),
           define_tool(
             name: "explain_query",
-            description: "Run EXPLAIN ANALYZE on a specific query from a profile. Returns the query execution plan with cost and row estimates. Only read-only statements (SELECT, WITH ... SELECT, TABLE, VALUES) are explained, in a transaction always rolled back; other queries return an error. Only available in development/test environments.",
+            description: "Run EXPLAIN ANALYZE on a specific query from a profile. Returns the query execution plan with cost and row estimates. Only read-only statements (SELECT, WITH ... SELECT, TABLE, VALUES) are explained, in a transaction always rolled back; other queries return an error. Refused with an error unless the application that runs it (this one, or the slave given) has the profiler enabled and runs in the development or test environment; config.allow_explain_outside_development = true lifts the environment check.",
             input_schema: {
               properties: {
                 token: { type: "string", description: "Profile token, or 'latest' for the most recent profile (required)" },

data/lib/profiler/mcp/tools/explain_query.rb

@@ -26,8 +26,8 @@ module Profiler
             return [{ type: "text", text: text }]
           end
 
-          unless Profiler.configuration.enabled
-            return [{ type: "text", text: "Error: EXPLAIN is only available when the profiler is enabled" }]
+          if (reason = Profiler::ExplainRunner.refusal)
+            return [{ type: "text", text: "Error: #{reason}" }]
           end
 
           data = Profiler::ExplainRunner.run(token, query_index.to_i)
@@ -47,10 +47,15 @@ module Profiler
           end
 
           [{ type: "text", text: lines.join("\n") }]
-        rescue ArgumentError => e
+        rescue Profiler::ExplainRunner::RefusedError => e
           [{ type: "text", text: "Error: #{e.message}" }]
-        rescue => e
-          [{ type: "text", text: "EXPLAIN failed: #{e.message}" }]
+        rescue Profiler::Error => e
+          # The profiler's own refusals (unknown, offline or refused slave) carry a message made for the caller.
+          [{ type: "text", text: "Error: #{e.message}" }]
+        rescue StandardError => e
+          # The database's message carries the SQL, and sometimes a path: the log only.
+          Profiler.log_error("MCP explain_query: failed for query #{query_index.to_i} of profile #{token.to_s.inspect}", e)
+          [{ type: "text", text: "EXPLAIN failed (the application log has the details)" }]
         end
       end
     end

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.34.0"
+  VERSION = "0.34.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.34.0
+  version: 0.34.2
 platform: ruby
 authors:
 - Sébastien Duplessy
@@ -59,6 +59,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0.3'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -66,6 +69,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0.3'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement