rails_pulse 0.3.3 → 0.4.0.pre.2

data/app/controllers/rails_pulse/application_controller.rb

@@ -2,11 +2,30 @@ module RailsPulse
   class ApplicationController < ActionController::Base
     include PaginationConcern
     include SessionFiltersConcern
+    include RansackParamsConcern
+
+    # Declared here rather than inherited. ActionController::Base only gets
+    # protect_from_forgery from the host's `default_protect_from_forgery`,
+    # which load_defaults 5.2+ turns on — a host still on an older
+    # load_defaults (or one that set the flag false and calls
+    # protect_from_forgery in its own ApplicationController) would leave every
+    # state-changing engine endpoint forgeable. Idempotent when the host
+    # already has it; the deployments API and assets controller keep their
+    # explicit skips.
+    protect_from_forgery with: :exception
 
     before_action :authenticate_rails_pulse_user!
     before_action :set_onboarding_state
     before_action :load_deployment_markers
 
+    # Values accepted into the cookie session. Everything else is dropped:
+    # the session has a 4 KB ceiling and a stored value is re-parsed on every
+    # later request, so an unbounded or unparseable string would 500 the
+    # dashboard until the cookie is cleared.
+    TIME_RANGE_PRESETS = %w[last_24_hours last_7_days last_14_days last_30_days].freeze
+    PERFORMANCE_THRESHOLDS = %w[slow very_slow critical].freeze
+    MAX_TIME_PARAM_LENGTH = 64
+
     def set_global_filters
       if params[:clear] == "true"
         session.delete(:global_filters)
@@ -15,21 +34,24 @@ module RailsPulse
         filters = session[:global_filters] || {}
 
         # Update time filters if provided
-        if params[:start_time].present? && params[:end_time].present?
-          filters["start_time"] = params[:start_time]
-          filters["end_time"] = params[:end_time]
+        start_time = valid_time_param(params[:start_time])
+        end_time = valid_time_param(params[:end_time])
+        if start_time && end_time
+          filters["start_time"] = start_time
+          filters["end_time"] = end_time
         end
 
-        # Update performance threshold if provided (or remove if empty)
-        if params[:performance_threshold].present?
-          filters["performance_threshold"] = params[:performance_threshold]
+        # Update performance threshold if provided (or remove if empty/unknown)
+        threshold = params[:performance_threshold].to_s
+        if PERFORMANCE_THRESHOLDS.include?(threshold)
+          filters["performance_threshold"] = threshold
         else
           filters.delete("performance_threshold")
         end
 
         # Update tag visibility - convert enabled tags to disabled tags
         all_tags = RailsPulse.configuration.tags
-        enabled_tags = params[:enabled_tags] || []
+        enabled_tags = Array(params[:enabled_tags]).map(&:to_s)
 
         # Handle "non_tagged" separately
         session[:show_non_tagged] = enabled_tags.include?("non_tagged")
@@ -50,28 +72,45 @@ module RailsPulse
       end
 
       # Redirect back to the referring page or root
-      redirect_back(fallback_location: root_path)
+      redirect_back(fallback_location: root_path, allow_other_host: false)
     end
 
     def set_time_range
-      if params[:preset].present?
+      preset = params[:preset].to_s
+      start_time = valid_time_param(params[:start_time])
+      end_time = valid_time_param(params[:end_time])
+
+      if preset.present?
         # Store preset selection
-        session[:time_range_preference] = params[:preset]
-      elsif params[:start_time].present? && params[:end_time].present?
+        session[:time_range_preference] = preset if TIME_RANGE_PRESETS.include?(preset)
+      elsif start_time && end_time
         # Store custom range
         session[:time_range_preference] = {
           type: "custom",
-          start_time: params[:start_time],
-          end_time: params[:end_time]
+          start_time: start_time,
+          end_time: end_time
         }
       end
 
       # Redirect back to the referring page or root
-      redirect_back(fallback_location: root_path)
+      redirect_back(fallback_location: root_path, allow_other_host: false)
     end
 
     private
 
+    # The original string if it is short enough to live in the session and
+    # Time.parse accepts it (TimeRangeConcern parses it back the same way);
+    # nil otherwise.
+    def valid_time_param(value)
+      value = value.to_s.strip
+      return nil if value.blank? || value.length > MAX_TIME_PARAM_LENGTH
+
+      Time.parse(value)
+      value
+    rescue ArgumentError, TypeError
+      nil
+    end
+
     def partial_request?
       request.headers["X-Partial-Request"] == "true"
     end
@@ -80,33 +119,65 @@ module RailsPulse
       RailsPulse.logger
     end
 
+    # Two hooks, run in order:
+    #
+    # * `authentication_method` — the legacy hook. It denies by rendering or
+    #   redirecting (the documented `unless signed_in? then redirect_to`
+    #   style). Returning literal `false` without responding is also a
+    #   denial; returning nil (which `unless … end` does on success) allows.
+    # * `authorize` — a fail-closed predicate. Anything falsy is a 403.
+    #
+    # With neither configured, HTTP Basic against RAILS_PULSE_PASSWORD.
     def authenticate_rails_pulse_user!
-      return unless RailsPulse.configuration.authentication_enabled
+      config = RailsPulse.configuration
+      return unless config.authentication_enabled
 
-      # If no authentication method is configured, use fallback HTTP Basic Auth
-      if RailsPulse.configuration.authentication_method.nil?
+      if config.authentication_method.nil? && config.authorize.nil?
         return fallback_http_basic_auth
       end
 
-      # Safely execute authentication method in controller context
-      case RailsPulse.configuration.authentication_method
+      unless config.authentication_method.nil?
+        run_authentication_method(config.authentication_method)
+        return if performed?
+      end
+
+      run_authorize_predicate(config.authorize) if config.authorize
+    rescue StandardError => e
+      logger.warn "RailsPulse authentication failed: #{e.message}"
+      redirect_to config.authentication_redirect_path
+    end
+
+    def run_authentication_method(hook)
+      result = case hook
       when Proc
-        instance_exec(&RailsPulse.configuration.authentication_method)
+        instance_exec(&hook)
       when Symbol, String
-        method_name = RailsPulse.configuration.authentication_method.to_s
-        if respond_to?(method_name, true)
-          send(method_name)
-        else
+        method_name = hook.to_s
+        unless respond_to?(method_name, true)
           logger.error "RailsPulse: Authentication method '#{method_name}' not found"
-          render plain: "Authentication configuration error", status: :internal_server_error
+          return render plain: "Authentication configuration error", status: :internal_server_error
         end
+        send(method_name)
       else
-        logger.error "RailsPulse: Invalid authentication method type: #{RailsPulse.configuration.authentication_method.class}"
-        render plain: "Authentication configuration error", status: :internal_server_error
+        logger.error "RailsPulse: Invalid authentication method type: #{hook.class}"
+        return render plain: "Authentication configuration error", status: :internal_server_error
       end
-    rescue StandardError => e
-      logger.warn "RailsPulse authentication failed: #{e.message}"
-      redirect_to RailsPulse.configuration.authentication_redirect_path
+
+      return if performed?
+      return unless result == false
+
+      # `proc { current_user&.admin? }` reads as a predicate but never halts
+      # the chain. Treat an explicit false as the denial it was meant to be.
+      logger.warn "RailsPulse: authentication_method returned false without rendering or redirecting; " \
+                  "denying access. Use config.authorize for predicate-style checks."
+      render plain: "Forbidden", status: :forbidden
+    end
+
+    def run_authorize_predicate(predicate)
+      allowed = predicate.arity.zero? ? instance_exec(&predicate) : predicate.call(self)
+      return if allowed
+
+      render plain: "Forbidden", status: :forbidden
     end
 
     def fallback_http_basic_auth
@@ -119,7 +190,8 @@ module RailsPulse
           logger.error "RailsPulse: No authentication method configured and RAILS_PULSE_PASSWORD not set. Access denied."
           false
         else
-          username == expected_username && password == expected_password
+          ActiveSupport::SecurityUtils.secure_compare(username.to_s, expected_username) &&
+            ActiveSupport::SecurityUtils.secure_compare(password.to_s, expected_password)
         end
       end
     end
@@ -134,6 +206,7 @@ module RailsPulse
       last_summary_at = RailsPulse::Summary.maximum(:updated_at)
       @has_summaries = last_summary_at.present?
       @summaries_stale = RailsPulse.configuration.warn_on_stale_summaries && @has_summaries && last_summary_at < 2.hours.ago
+      @route_backfill_pending = RailsPulse::Route.needs_action_backfill?
     end
   end
 end

data/app/controllers/rails_pulse/dashboard_controller.rb

@@ -33,6 +33,15 @@ module RailsPulse
 
       # System Health bar
       @health_summary = RailsPulse::Dashboard::HealthSummary.new(disabled_tags: disabled_tags, show_non_tagged: show_non_tagged, period: @period).to_health_data
+
+      @storage_status = RailsPulse::Dashboard::StorageStatus.new
+
+      # Deployments panel — scoped to the same window as the chart markers so
+      # the panel and the markers drawn on the charts always agree.
+      deployments_in_range = RailsPulse::Deployment.for_range(Time.zone.at(@start_time), Time.zone.at(@end_time))
+      @deployment_count = deployments_in_range.count
+      @recent_deployments = deployments_in_range.recent.limit(4)
+      @last_deployment = RailsPulse::Deployment.recent.first
     end
   end
 end

data/app/controllers/rails_pulse/deployments_controller.rb

@@ -1,7 +1,22 @@
 module RailsPulse
   class DeploymentsController < ApplicationController
-    skip_before_action :authenticate_rails_pulse_user!
-    before_action :authenticate_deployment_request!
+    # The API actions authenticate by token so CI can post without a session;
+    # the browsable pages use the dashboard's own authentication like every
+    # other page. Scoping the skip to create/finish means adding a UI does not
+    # widen the hole the 0.4.0 audit closed.
+    skip_before_action :authenticate_rails_pulse_user!, only: %i[create finish]
+    skip_before_action :verify_authenticity_token, only: %i[create finish]
+    before_action :authenticate_deployment_request!, only: %i[create finish]
+
+    def index
+      @ransack_query = Deployment.ransack(ransack_params)
+      @ransack_query.sorts = "started_at desc" if @ransack_query.sorts.empty?
+      @pagination, @table_data = paginate(@ransack_query.result, limit: session_pagination_limit)
+    end
+
+    def show
+      @deployment = Deployment.find(params[:id])
+    end
 
     def create
       deployment = RailsPulse::Deployment.new(
@@ -44,10 +59,16 @@ module RailsPulse
     def authenticate_deployment_request!
       token = RailsPulse.configuration.deployment_api_token
       if token.present?
-        provided = request.headers["X-Rails-Pulse-Token"]
-        render json: { error: "Unauthorized" }, status: :unauthorized unless provided == token
-      else
+        provided = request.headers["X-Rails-Pulse-Token"].to_s
+        unless ActiveSupport::SecurityUtils.secure_compare(provided, token)
+          render json: { error: "Unauthorized" }, status: :unauthorized
+        end
+      elsif RailsPulse.configuration.authentication_enabled
         authenticate_rails_pulse_user!
+      else
+        # No token configured and authentication disabled — fail closed.
+        # Without a token there is no way to verify the caller.
+        render json: { error: "Unauthorized — set deployment_api_token or enable authentication" }, status: :unauthorized
       end
     end
 

data/app/controllers/rails_pulse/exception_occurrences_controller.rb

@@ -0,0 +1,19 @@
+module RailsPulse
+  class ExceptionOccurrencesController < ApplicationController
+    before_action :set_exception_group
+    before_action :set_occurrence
+
+    def show
+    end
+
+    private
+
+    def set_exception_group
+      @exception_group = ExceptionGroup.find(params[:exception_id])
+    end
+
+    def set_occurrence
+      @occurrence = @exception_group.occurrences.find(params[:id])
+    end
+  end
+end

data/app/controllers/rails_pulse/exceptions_controller.rb

@@ -0,0 +1,119 @@
+module RailsPulse
+  class ExceptionsController < ApplicationController
+    include TimeRangeConcern
+    include TagFilterConcern
+    include DeploymentMarkersConcern
+
+    before_action :set_exception_group, only: %i[show update]
+
+    def index
+      ransack_params = self.ransack_params.dup
+      apply_default_status_filter!(ransack_params)
+
+      @ransack_query = ExceptionGroup.ransack(ransack_params)
+      @ransack_query.sorts = "last_seen_at desc" if @ransack_query.sorts.empty?
+      @pagination, @table_data = paginate(@ransack_query.result, limit: session_pagination_limit)
+
+      setup_frequency_view
+    end
+
+    def show
+      occurrences = @exception_group.occurrences.order(occurred_at: :desc)
+      @latest_occurrence = occurrences.first
+      @pagination, @occurrences = paginate(occurrences, limit: session_pagination_limit)
+    end
+
+    def update
+      if params.key?(:preserve)
+        update_preserve
+      else
+        update_status
+      end
+    end
+
+    private
+
+    # The index is a list of groups, not an aggregate table, so it does not use
+    # ChartTableConcern. It still needs a time range and a frequency series:
+    # without them the page can say what is failing but not whether it is
+    # getting worse, which is the question users actually arrive with.
+    def setup_frequency_view
+      # Timestamps, not Times, to match every other index controller — the
+      # shared concerns and helpers that read @start_time expect integers.
+      @start_time, @end_time, @selected_time_range, @time_diff_hours = setup_time_range
+
+      @period_type = @time_diff_hours <= 25 ? "hour" : "day"
+      period_days  = window_days_for(@selected_time_range)
+
+      populate_deployment_markers
+
+      @occurrence_volume_chart = Exceptions::Charts::OccurrenceVolume.new(
+        start_time: Time.zone.at(@start_time),
+        end_time: Time.zone.at(@end_time),
+        period_type: @period_type
+      ).to_chart_data
+
+      card_params = { period: period_days, period_type: @period_type }
+
+      @total_occurrences_metric_card = Exceptions::Cards::TotalOccurrences.new(**card_params).to_metric_card
+      @exception_rate_metric_card    = Exceptions::Cards::ExceptionRate.new(**card_params).to_metric_card
+      @open_groups_metric_card       = Exceptions::Cards::OpenGroups.new(**card_params).to_metric_card
+    end
+
+    def set_exception_group
+      @exception_group = ExceptionGroup.find(params[:id])
+    end
+
+    # The card copy ("compared to previous N days") has to name the range the
+    # user picked. Measuring the span instead reads one day long, because the
+    # range runs from the start of the first day to the end of the last.
+    def window_days_for(selected_range)
+      case selected_range.to_s
+      when "last_24_hours" then 1
+      when "last_7_days"   then 7
+      when "last_14_days"  then 14
+      when "last_30_days"  then 30
+      else [ ((@end_time - @start_time) / 1.day.to_i).round, 1 ].max
+      end
+    end
+
+    # Exceptions are low-volume compared with requests, so a day is rarely
+    # enough to see a trend. Matches the jobs and queries defaults.
+    def default_time_range_key
+      :last_7_days
+    end
+
+    # Default the list to open groups. An explicit blank status ("All")
+    # clears the filter; any other value is passed through to ransack.
+    def apply_default_status_filter!(ransack_params)
+      if !ransack_params.key?(:status_eq) && !ransack_params.key?("status_eq")
+        ransack_params[:status_eq] = "open"
+      elsif ransack_params[:status_eq].blank? && ransack_params["status_eq"].blank?
+        ransack_params.delete(:status_eq)
+        ransack_params.delete("status_eq")
+      end
+    end
+
+    def update_preserve
+      @exception_group.update!(preserve: ActiveModel::Type::Boolean.new.cast(params[:preserve]))
+      flash[:notice] = @exception_group.preserve? ? "Exception preserved from cleanup." : "Exception no longer preserved."
+      redirect_to exception_path(@exception_group)
+    end
+
+    def update_status
+      new_status = params[:status]
+      unless ExceptionGroup::STATUSES.include?(new_status)
+        head :unprocessable_entity
+        return
+      end
+
+      @exception_group.update!(
+        status: new_status,
+        resolved_at: new_status == "resolved" ? Time.current : nil
+      )
+
+      flash[:notice] = "Exception marked as #{new_status}."
+      redirect_to exception_path(@exception_group)
+    end
+  end
+end

data/app/controllers/rails_pulse/job_runs_controller.rb

@@ -6,7 +6,7 @@ module RailsPulse
     before_action :set_run, only: :show
 
     def index
-      @ransack_query = @job.runs.ransack(params[:q])
+      @ransack_query = @job.runs.ransack(ransack_params)
       @pagination, @runs = paginate(@ransack_query.result.order(occurred_at: :desc), limit: session_pagination_limit)
       @table_data = @runs
     end

data/app/controllers/rails_pulse/requests_controller.rb

@@ -109,7 +109,7 @@ module RailsPulse
 
       # If filtering or sorting by route_path, we need to join the routes table
       needs_join = @ransack_query.sorts.any? { |sort| sort.name == "route_path" } ||
-                   params.dig(:q, :route_path_cont).present?
+                   ransack_params[:route_path_cont].present?
 
       if needs_join
         base_query = base_query.joins(:route)

data/app/controllers/rails_pulse/routes_controller.rb

@@ -54,7 +54,6 @@ module RailsPulse
       show_action? ? { route: @route } : {}
     end
 
-    # Filter to scope table results to a specific route on show pages
     def show_resource_filter
       { route_id_eq: @route.id }
     end
@@ -92,6 +91,8 @@ module RailsPulse
 
         # For PostgreSQL compatibility with DISTINCT + ORDER BY
         # we need to include computed columns in SELECT when ordering by them
+        base_query = base_query.joins(:route).preload(:route)
+
         if ordering_by_computed_column?
           base_query.select("rails_pulse_requests.*, #{status_indicator_sql} as status_indicator_value").distinct
         else
@@ -109,6 +110,11 @@ module RailsPulse
       end
     end
 
+    # Request/route-name filters that Summary chart queries don't join for.
+    def chart_filter_exclusions
+      %w[route_path_cont route_controller_action_cont controller_action_cont http_method_eq]
+    end
+
     def default_time_range_key
       :last_14_days
     end

data/app/controllers/rails_pulse/storage_controller.rb

@@ -0,0 +1,7 @@
+module RailsPulse
+  class StorageController < ApplicationController
+    def show
+      @status = RailsPulse::Dashboard::StorageStatus.new
+    end
+  end
+end

data/app/controllers/rails_pulse/tags_controller.rb

@@ -19,7 +19,7 @@ module RailsPulse
         flash[:alert] = "Failed to add tag"
       end
 
-      redirect_back(fallback_location: root_path)
+      redirect_back(fallback_location: root_path, allow_other_host: false)
     end
 
     def destroy
@@ -30,7 +30,7 @@ module RailsPulse
         flash[:alert] = "Failed to remove tag"
       end
 
-      redirect_back(fallback_location: root_path)
+      redirect_back(fallback_location: root_path, allow_other_host: false)
     end
 
     private

data/app/helpers/rails_pulse/application_helper.rb

@@ -1,5 +1,6 @@
 module RailsPulse
   module ApplicationHelper
+    include BacktraceHelper
     include BreadcrumbsHelper
     include ChartHelper
     include CspHelper

data/app/helpers/rails_pulse/backtrace_helper.rb

@@ -0,0 +1,85 @@
+module RailsPulse
+  module BacktraceHelper
+    APP_FRAME_PATTERN = %r{/app/|/config/|/lib/}
+    GEM_FRAME_PATTERN = %r{/gems/|/rubygems/|/bundler/|/lib/ruby/}
+
+    def app_frame?(frame)
+      file = frame["file"].to_s
+      file.match?(APP_FRAME_PATTERN) && !file.match?(GEM_FRAME_PATTERN)
+    end
+
+    # Strip everything before /app/, /lib/, /config/ so paths are relative.
+    # Falls back to gem-name/rest for gem frames, or just basename for stdlib.
+    def frame_display_path(frame)
+      file = frame["file"].to_s
+      # Gem frames: /…/gems/[ruby-ver]/gems/[gem-name]/lib/… → gem-name/lib/…
+      if (match = file.match(%r{/gems/[^/]+/gems/([^/]+)/(.+)}))
+        "#{match[1]}/#{match[2]}"
+      # Bundler path gems: /…/gems/[gem-name]/lib/… → gem-name/lib/…
+      elsif (match = file.match(%r{/gems/([^/]+)/(.+)}))
+        "#{match[1]}/#{match[2]}"
+      # App frames: strip absolute prefix, keep /app/…, /lib/…, /config/…
+      elsif (match = file.match(%r{(/(?:app|lib|config)/.+)}))
+        match[1]
+      else
+        File.basename(file)
+      end
+    end
+
+    def frame_dirname(frame)
+      File.dirname(frame_display_path(frame)) + "/"
+    end
+
+    def frame_basename(frame)
+      File.basename(frame_display_path(frame))
+    end
+
+    # Directories (relative to Rails.root) whose source may be shown, and the
+    # file types within them. Everything else under Rails.root — initializers
+    # with inline keys, credentials, database.yml, .env, tmp/ — stays
+    # unreadable even when a backtrace frame points at it.
+    SOURCE_ALLOWED_DIRECTORIES = %w[app/ lib/].freeze
+    SOURCE_ALLOWED_FILES = %w[config/routes.rb].freeze
+    SOURCE_ALLOWED_EXTENSIONS = %w[.rb .erb .rake .haml .slim .jbuilder].freeze
+
+    def frame_source_lines(frame, radius: 3)
+      file = frame["file"].to_s
+      line = frame["line"].to_i
+      return nil if file.blank? || line < 1
+      return nil unless File.exist?(file) && File.file?(file)
+      return nil unless source_readable?(file)
+
+      first_line = [ line - radius, 1 ].max
+      last_line  = line + radius
+
+      lines = {}
+      File.foreach(file).with_index(1) do |content, lineno|
+        break if lineno > last_line
+        lines[lineno] = content.rstrip if lineno >= first_line
+      end
+      lines
+    rescue Errno::EACCES, Errno::ENOENT
+      nil
+    end
+
+    private
+
+    # Only read source for code files under Rails.root's app/ and lib/ (plus
+    # config/routes.rb). Resolved through realpath so symlinks cannot point
+    # outside, and matched on the relative path so a directory merely named
+    # "app" elsewhere on disk does not qualify.
+    def source_readable?(file)
+      real = File.realpath(file)
+      root = "#{Rails.root.realpath}#{File::SEPARATOR}"
+      return false unless real.start_with?(root)
+
+      relative = real.delete_prefix(root)
+      return false unless SOURCE_ALLOWED_EXTENSIONS.include?(File.extname(relative))
+
+      SOURCE_ALLOWED_FILES.include?(relative) ||
+        SOURCE_ALLOWED_DIRECTORIES.any? { |dir| relative.start_with?(dir) }
+    rescue Errno::ENOENT
+      false
+    end
+  end
+end

data/app/helpers/rails_pulse/breadcrumbs_helper.rb

@@ -3,7 +3,9 @@ module RailsPulse
     # Maps singularized path segments to their actual model class names
     # when the default classify convention doesn't match
     SEGMENT_CLASS_OVERRIDES = {
-      "run" => "JobRun"
+      "run" => "JobRun",
+      "exception" => "ExceptionGroup",
+      "occurrence" => "ExceptionOccurrence"
     }.freeze
 
     def breadcrumbs
@@ -88,6 +90,7 @@ module RailsPulse
 
       crumbs
     end
+
     def page_title
       crumbs = breadcrumbs
       return "Rails Pulse" if crumbs.empty?

data/app/helpers/rails_pulse/chart_helper.rb

@@ -43,9 +43,6 @@ module RailsPulse
           axisPointer: { type: "shadow" },
           formatter: tooltip_formatter
         },
-        toolbox: {
-          feature: { saveAsImage: { show: false } }
-        },
         xAxis: {
           axisLine: { show: false },
           axisTick: { show: false },

data/app/helpers/rails_pulse/route_helper.rb

@@ -25,24 +25,16 @@ module RailsPulse
         RailsPulse::Engine.routes.url_helpers.respond_to?(method, include_private) || super
       end
 
-      # Generate asset paths using Rails asset pipeline
-      # This allows assets to work with CDN, digests, and precompiled manifests
+      # After `assets:precompile`, files live in public/assets with a digest
+      # so config.asset_host / CDN-only CSP work. Until then (development,
+      # or hosts with no pipeline) serve from the gem via AssetServer.
+      # Always pass the result to tag.link / tag.script, not stylesheet_link_tag:
+      # a middleware path must not be rewritten onto the CDN.
       def asset_path(asset_name)
-        # Only use asset pipeline if we have Sprockets/Propshaft configured
-        # Otherwise fall back to middleware serving
-        if defined?(::Sprockets) || defined?(::Propshaft)
-          # Use the main application's asset_path helper to ensure we get
-          # the correct digested paths from the precompiled manifest
-          begin
-            ActionController::Base.helpers.asset_path(asset_name)
-          rescue => e
-            # Fallback to direct path if asset pipeline is not available
-            Rails.logger.warn "[Rails Pulse] Asset pipeline error for #{asset_name}: #{e.message}"
-            "/rails-pulse-assets/#{asset_name}"
-          end
+        if (packaged = RailsPulse::PackagedAssets.url_path(asset_name))
+          ActionController::Base.helpers.asset_path(packaged)
         else
-          # No asset pipeline - use middleware serving
-          "/rails-pulse-assets/#{asset_name}"
+          "/rails-pulse-assets/#{RailsPulse::VERSION}/#{asset_name}"
         end
       end
     end