rails_pulse 0.4.0.pre.2 → 0.4.0.pre.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b102fc4776d7fe701b47011e02d682f47a2784500103f3cb7d7598a757b174ff
-  data.tar.gz: 34f4055047c1bb9151c9e811f14c4e90fe83e52508c61ea4433929b2b431d568
+  metadata.gz: 50a1c2016eee54e3ceda7d6e390669b7dc3f427a637cc975a50e9d682262411a
+  data.tar.gz: dfd20c8b99bdb1f3986aa143fb8cfe5aaf3935f7ba7cd43e4c6883721de30ad7
 SHA512:
-  metadata.gz: 974fcf20833ab11e46a00db96d21590f32a699a73de8d2af229d1fa5559f0817c107ba684f4ada34cdb067a77f6293ecc11ee3d24f7911f9fe074353a2991d79
-  data.tar.gz: 507afdae03f11fef23d0bbd7cc5ee8e8123656e41efbc219a10f8b6682602bfb7dcfa91e9ac424352d68ad05b3bceed4070eead220d053713f56aa1ade7bec01
+  metadata.gz: caaf4f2932c7c639e7684fe3a8f4a789b4fe2d7a6b888d9cbeaf302487319efe758b91699f0eef1372cdad385f12269a1a78d9989bf29f855c20bf86c1c322e2
+  data.tar.gz: 852e0524002c525ca784c981c21234a750a2e5d9bc29024290c49d653df4fc806edd0c23e767b9e26be945ed81fafa37cf7474a7354e89ff533cf92a142eafda

data/CHANGELOG.md

@@ -7,185 +7,94 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0.pre.4] - 2026-09-07
+
+## [0.4.0.pre.3] - 2026-09-06
+
+### Added
+
+- **Shell-based deployment tracking.** `rake rails_pulse:record_deployment` and the new `rake rails_pulse:finish_deployment[revision]` let release scripts record and close deployments without the HTTP API or a token.
+- **Standalone mode improvements.** Dashboard links now resolve correctly when served at `/`, and a new `config.standalone_authentication_method` (with an HTTP Basic fallback) replaces host-app authentication, which the standalone process can't use.
+- **`rails rails_pulse:status`.** Reports schema, migration, and tracking/auth config state in one command, and exits 1 if anything needs action before deploying.
+- **Schema drift guard.** `RailsPulse::SchemaCheck` detects tables or columns the running gem expects but that haven't been migrated yet, and pauses tracking (dashboard returns 503) with a clear warning instead of erroring. Disable with `config.schema_check_enabled = false`.
+
+### Fixed
+
+- Fixed breadcrumb links becoming protocol-relative (`//queries`) when the engine is mounted at `/`.
+- Fixed the standalone dashboard server 404ing on its own stylesheets and scripts.
+- Fixed asset responses using mixed-case headers, which `Rack::Lint` rejects under Rack 3.
+- Fixed `rails_pulse_server` ignoring `RAILS_ENV`/`RACK_ENV` and always booting `rackup` in development mode.
+- Fixed the standalone server requiring a literal `SECRET_KEY_BASE` instead of falling back to the host app's.
+
+### Security
+
+- Updated development dependencies mail, net-imap, and json for several CVEs (gem dev/CI only).
+- Updated development dependencies nokogiri, loofah, and rails-html-sanitizer for several CVEs (gem dev/CI only).
+- Updated development dependencies Rails, puma, websocket-driver, and concurrent-ruby for Dependabot's critical/high alerts. Host apps should update their own Rails to 8.1.3.1.
+
+### Changed
+
+- `rails generate rails_pulse:upgrade` now reports unrun migrations and outstanding route backfill instead of saying everything is up to date.
+- Cleaned up `rake test` output — no more RDoc warnings, stray blank lines, or leaked log noise.
+
 ## [0.4.0.pre.2] - 2026-09-04
 
 ### Fixed
 
-- **`rails generate rails_pulse:upgrade` wrote a migration that would not parse.**
-  The schema parser matched a column comment with `comment: "([^"]*)"`, which stops
-  at the first escaped quote. The `http_methods` comment embeds a `["GET","POST"]`
-  example, so it was truncated mid-escape and the trailing backslash escaped the
-  closing quote of the generated `comment:` string — the copied
-  `upgrade_rails_pulse_tables.rb` then failed to load with
-  `unterminated string meets end of file`. Comments are now matched as complete Ruby
-  string literals, decoded with `String#undump`, and re-escaped with `String#inspect`
-  when the migration is rendered.
-
-- **Background tracking writes corrupted the host app's test database connection.**
-  Under `use_transactional_tests` Rails pins one connection per pool and hands that
-  same connection to every thread, so the tracker's writer thread interleaved its
-  INSERTs with the test's own statements on a single socket. PostgreSQL reported
-  this as `message type 0x5a arrived from server while idle` and
-  `server sent data ("D" message) without prior row description`, and suites hung
-  or failed at random. The gem's own dummy app avoided it with
-  `config.async = false if Rails.env.test?`, but the installed initializer never
-  shipped that line. The tracker now writes inline whenever the pool's connection
-  is shared across threads, and `rails generate rails_pulse:install` adds the
-  test-environment line to the initializer. Existing installs should add
-  `config.async = false if Rails.env.test?` to `config/initializers/rails_pulse.rb`.
+- Fixed `rails generate rails_pulse:upgrade` writing a migration that failed to parse when a column comment contained an escaped quote.
+- Fixed background tracking writes corrupting the test database connection under transactional tests. Existing installs should add `config.async = false if Rails.env.test?` to their initializer.
 
 ## [0.4.0.pre.1] - 2026-09-03
 
-This release contains a **breaking schema change** and requires a one-time data
-migration. Read "Upgrading from 0.3.x" below before deploying. Take a database
-backup first: the route migration is irreversible.
+This release contains a **breaking schema change** and requires a one-time data migration. Back up your database first — the route migration is irreversible. See "Upgrading from 0.3.x" below.
 
 ### Security
 
-- **Job failure messages are redacted and bounded.** `rails_pulse_job_runs.error_message`
-  used to be stored raw and unbounded. It now goes through the same sanitizer as
-  exception messages: `key=value` / `key: value` / `"key":"value"` fragments are
-  masked whenever the key matches `config.filter_parameters` (same rules as logged
-  params), and MySQL `Duplicate entry '<value>'` values are redacted alongside
-  PostgreSQL `DETAIL:` clauses.
-- **CSRF protection is now declared by the engine.** `RailsPulse::ApplicationController`
-  calls `protect_from_forgery with: :exception` itself instead of inheriting it from the
-  host's `default_protect_from_forgery`, which only `load_defaults 5.2+` enables. Hosts
-  on an older `load_defaults` had no CSRF protection on any engine endpoint (tags,
-  exception status, query reanalyze, session filters). Brakeman's `CheckForgerySetting`
-  is no longer skipped.
-- **Authentication hooks fail closed.** An `authentication_method` that returned
-  `false` without rendering or redirecting used to grant access — `proc { current_user&.admin? }`
-  looked right and let every non-admin in. Literal `false` is now a 403; `nil`
-  (what the documented `unless … redirect_to … end` style returns on success) still allows.
-- **EXPLAIN hardening.** The query analyzer now refuses SQL containing `;`, `--` or `/*`
-  anywhere (PostgreSQL's `execute` runs every statement in a string, so a captured
-  `SELECT …; UPDATE …` would have re-run the UPDATE on each page view), runs the
-  PostgreSQL EXPLAIN inside `SET LOCAL transaction_read_only = on` with a 5s
-  `statement_timeout` instead of `Timeout.timeout`, and always rolls its savepoint back.
-- **Deployments API input is bounded.** `revision` is capped at 255 characters,
-  serialized `metadata` at 4 KB, and `started_at` may be at most one hour in the future
-  (a forged future marker would have stamped every later exception with a revision
-  that never shipped). `rails_pulse_deployments` now has a count cap
-  (`max_table_records`, default 1 000) enforced by `CleanupService`; deployments are
-  never pruned by age.
-- **Backtrace source snippets are limited to `app/`, `lib/` and `config/routes.rb`**
-  (`.rb`, `.erb`, `.rake`, `.haml`, `.slim`, `.jbuilder`). Previously any file under
-  `Rails.root` was readable through a backtrace frame, including initializers with
-  inline keys, `config/database.yml`, and `.env`.
-- **Standalone dashboard session cookie is `Secure` in production** (override with
-  `RAILS_PULSE_INSECURE_SESSION=1`). The rackup's "no Rails app" branch, which could
-  never boot (`NameError: uninitialized constant Rails`), is replaced with a clear
-  error; the deployment docs now give the working invocation.
+- Job failure messages (`rails_pulse_job_runs.error_message`) are now redacted the same way exception messages are.
+- CSRF protection is now declared directly by the engine instead of depending on the host's `load_defaults` version.
+- Fixed `authentication_method` granting access when it returned a falsy-but-not-`false`/redirect value; it's now fail-closed.
+- Hardened EXPLAIN analysis against SQL injection and added a statement timeout.
+- Bounded deployment API input (revision length, metadata size, future timestamps) and capped the `rails_pulse_deployments` row count.
+- Backtrace source snippets are now limited to `app/`, `lib/`, and `config/routes.rb`, instead of any file under `Rails.root`.
+- The standalone dashboard's session cookie is now `Secure` in production.
 
 ### Added
 
-- **Exception tracking** — Captures unhandled exceptions from web requests and
-  background jobs, groups them by class and location, and displays backtraces (first
-  50 frames) with filtered request params in a new Exceptions tab. Exception
-  messages are redacted before storage: `key=value` / `key: value` / `"key":"value"`
-  fragments are masked whenever the key matches `config.filter_parameters`, and
-  MySQL `Duplicate entry '<value>'` values are redacted alongside PostgreSQL
-  `DETAIL:` clauses.
-- **`track_exceptions` config option** — Gem default is `false`, so existing installs
-  do not begin capturing on upgrade; the upgrade generator inserts `false`
-  explicitly. The install template sets `true` for new apps.
-- **`capture_exception_params` config option** — Captures request params alongside
-  each occurrence, filtered via Rails' `filter_parameters`. Occurrences whose params
-  exceed 10 KB after filtering are stored without params. Default `true`, and only
-  consulted while `track_exceptions` is on.
-- **`exception_message_filter` config option** — an optional `->(message, exception)`
-  hook applied after the built-in redaction for app-specific patterns. If the hook
-  raises, the message is stored as `[FILTERED]` rather than unfiltered.
-- **`authorize` config option** — a fail-closed predicate, `->(controller) { … }`
-  (or a zero-argument proc run in the controller). Anything falsy is a 403. Runs after
-  `authentication_method` when both are set, and replaces the HTTP Basic fallback on
-  its own. This is now the recommended way to gate the dashboard.
-- **Upgrade generator syncs new initializer settings** — Appends keys (and
-  `max_table_records` entries) the host file does not already mention, without
-  rewriting existing values. Review with `git diff`.
+- **Exception tracking.** Captures unhandled exceptions from requests and jobs, with grouping, backtraces, and redacted params in a new Exceptions tab.
+- **`track_exceptions` config option**, off by default for existing installs and on by default for new ones.
+- **`capture_exception_params` config option** to include filtered request params with each exception occurrence.
+- **`exception_message_filter` config option** for app-specific redaction beyond the built-in rules.
+- **`authorize` config option** — a fail-closed predicate for gating dashboard access; now the recommended approach.
+- **The upgrade generator now syncs new initializer settings** into the host's config file without overwriting existing values.
 
 ### Changed
 
-- **BREAKING — route identity is now `[controller_action, path]`.** GET `/users`
-  (`users#index`) and POST `/users` (`users#create`) are distinct routes. Dynamic
-  paths are normalized at capture time (`/posts/42` → `/posts/:id`).
-- **A one-time backfill is mandatory.** `rails rails_pulse:migrate_routes` backfills
-  `controller_action` (from the live router, then from request history), collapses
-  historical literal paths, and merges routes sharing an action (GET+POST `/sign_in`
-  → `sessions#new`). A schema migrate alone leaves the Action column empty. The
-  upgrade generator and the dashboard both warn when the step is outstanding.
-- **The JavaScript bundle is 66% smaller: 2.19 MB → 759 KB (754 KB → 248 KB gzipped).**
-  ECharts is now tree-shaken — `application.js` imports from `echarts/core` and
-  registers only the series and components the dashboard uses, instead of the
-  `echarts` barrel that bundled every chart type including maps, sankey and gauge.
-  Charts outside that set must now register their module explicitly; see
-  `docs/stimulus_echarts_usage.md`. The stylesheet is 5% smaller.
+- **BREAKING — route identity is now `[controller_action, path]`**, so different HTTP methods on the same path are tracked as distinct routes.
+- **A one-time `rails rails_pulse:migrate_routes` backfill is required** after migrating; a schema migrate alone leaves the Action column empty.
+- **The JavaScript bundle is 66% smaller** (2.19 MB → 759 KB) after tree-shaking ECharts.
 
 ### Removed
 
-- **BREAKING — `rails_pulse_routes.method` is dropped.** The HTTP verb now lives on
-  each request (`rails_pulse_requests.method`); a route carries an `http_methods`
-  array instead. All application, worker, and dashboard processes must be restarted
-  together against the migrated schema. A rolling restart that leaves 0.3.x
-  processes running will silently drop request tracking and 500 the routes dashboard.
-- **BREAKING — the route migration is irreversible.** `db:rollback` raises
-  `ActiveRecord::IrreversibleMigration` on
-  `ChangeRailsPulseRoutesToMultiVerbModel`, and routes merged by
-  `rails_pulse:migrate_routes` are deleted with no audit trail. Recovery from a bad
-  upgrade is restore-from-backup only.
-- **Three unreachable Stimulus controllers** — `form`, `timezone` and
-  `period_selector` — were bundled and registered despite no view referencing them.
-  `timezone` also ran a `MutationObserver` over the whole document body.
-- **`theme.js`**, which registered a chart theme that `application.js` immediately
-  overwrote. Its UMD wrapper called `require('echarts')`, which alone would have
-  defeated the tree-shaking above.
-- **Dead CSS**: unused css-zero ports, the removed dashboard period selector's styles,
-  and the disabled `toolbox` chart option.
-- **`csp-test.js` is no longer shipped in the gem.** Its page is mounted only when
-  `Rails.env.local?`, so it was unreachable in a published gem. It remains in the
-  repository for development and the CSP compliance system test.
+- **BREAKING — `rails_pulse_routes.method` is dropped**; the HTTP verb now lives on each request. Restart all processes together after migrating.
+- **BREAKING — the route migration is irreversible.** Back up your database first.
+- Removed three unused Stimulus controllers (`form`, `timezone`, `period_selector`).
+- Removed `theme.js`, a chart theme that was immediately overwritten and would have defeated ECharts tree-shaking.
+- Removed dead CSS: unused css-zero ports, old period-selector styles, and a disabled toolbox option.
+- `csp-test.js` is no longer shipped in the published gem.
 
 ### Fixed
 
-- **Tag filters work on SQLite for tags containing `_`.** The `LIKE` patterns were
-  escaped but issued without an `ESCAPE` clause; SQLite has no default escape
-  character, so `my_tag` never matched and "hide records tagged my_tag" hid nothing.
-  All three adapters now get an explicit `ESCAPE '!'`.
-- **Hand-edited query strings no longer 500.** `?q=string`, unparseable custom date
-  ranges, unparseable `occurred_at` filters, a non-array `enabled_tags`, and
-  oversized or unparseable session time filters all fall back to defaults instead of
-  raising. Session-stored presets and performance thresholds are validated against
-  the known values.
-- **Chart click/zoom got slower the more you switched chart tabs.** The requests,
-  routes and queries index pages attached a fresh `document` mouseup listener every
-  time a chart tab was re-selected, and only the most recent one was ever removed.
-  After N switches a single click anywhere on the page re-ran the zoom handler N
-  times. The listener is now bound once per controller.
-- **Zooming onto the first column of a category chart reset the range.** Visible-range
-  extraction used `dataZoom.startValue || 0`, so a legitimate index of `0` fell through
-  to the full-axis fallback.
-- **Hover popovers could throw after a table refresh.** `popover_controller` left its
-  show/hide timers running on disconnect, so a pending 700ms open could fire against
-  an element a fetch had already replaced.
-- **The time range selector's hover border was invisible.** It referenced
-  `--color-border-emphasis`, which is defined nowhere, so the declaration was invalid
-  at computed-value time and the border fell back to `currentColor`. Its light-mode
-  rules also never applied on a first visit, because `data-color-scheme` is only set
-  after an explicit toggle.
-- **`[popover].positioned` was declared twice** at equal specificity, so correct
-  popover placement depended on CSS file load order. Merged into one rule.
+- Fixed tag filters not matching tags containing `_` on SQLite.
+- Fixed various hand-edited or malformed query strings causing 500s instead of falling back to defaults.
+- Fixed chart click/zoom handlers accumulating on every chart tab switch, slowing clicks down over time.
+- Fixed zooming to the first column of a category chart resetting the range instead of applying it.
+- Fixed hover popovers throwing after a table refresh replaced the underlying element.
+- Fixed the time range selector's hover border being invisible due to an undefined CSS variable.
+- Fixed a duplicate CSS rule that made popover placement depend on file load order.
 - Fixed upgrading when using a separate database installation.
-- Separate-database installs set `schema_dump: false`, so `db:migrate` no longer
-  dumps or loads `db/rails_pulse_structure.sql` (#189).
-- Fixed `assets:precompile` failing on memory-constrained hosts by not registering
-  dashboard assets with the host Sprockets pipeline. Precompile copies the pre-built
-  files into `public/assets` (digested, no compressor) so `config.asset_host` and
-  CDN-only CSP work; development and hosts without a pipeline still use
-  `/rails-pulse-assets/<gem-version>/...`.
-- SQLite `schema.rb` now keeps the partial unique index on unrecognised routes
-  (`WHERE controller_action IS NULL`). A raw `CREATE INDEX` was dumped without the
-  predicate, so `db:schema:load` and parallel tests unique-constrained every path.
+- Separate-database installs now set `schema_dump: false` so `db:migrate` doesn't dump or load `db/rails_pulse_structure.sql` (#189).
+- Fixed `assets:precompile` OOMing on memory-constrained hosts by not registering dashboard assets with Sprockets.
+- Fixed SQLite's `schema.rb` dropping the partial unique index on unrecognised routes, which over-constrained paths on `db:schema:load`.
 
 ### Upgrading from 0.3.x
 
@@ -209,21 +118,19 @@ once you have reviewed what is captured.
 
 ## [0.3.3] - 2026-06-23
 
-- **Deployment tracking** — Record deployments via `POST /rails_pulse/deployments` or `rake rails_pulse:record_deployment[sha]`. Deployments appear as vertical marker lines on performance charts so you can correlate releases with regressions
-- **`deployment_api_token` config option** — Secures the deployments endpoint with a token header for CI/CD use
-- All multi-series charts now use a native ECharts time axis (`[timestamp_ms, value]` pairs) instead of a separate labels array, enabling deployment markers and better zoom behaviour
+- **Deployment tracking** — Record deployments via `POST /rails_pulse/deployments` or `rake rails_pulse:record_deployment[sha]`, shown as marker lines on performance charts.
+- **`deployment_api_token` config option** — Secures the deployments endpoint with a token header for CI/CD use.
+- Charts now use a native ECharts time axis instead of a separate labels array, enabling deployment markers and better zoom behaviour.
 
 ## [0.3.0] - 2026-04-30
 
-This is the largest release to date — a full UI overhaul across every section of
-the dashboard. Charts are now switchable, the dashboard surfaces health status
-automatically, and the underlying controller and model code has been substantially
-refactored. Existing installs need to run the two new migrations. Hopefully future
-releases will be smaller and more incremental than this one.
+This is the largest release to date — a full UI overhaul with switchable charts and
+automatic health status across the dashboard. Existing installs need to run two new
+migrations.
 
 ### Added
 
-- **New chart types across all sections** — Routes, queries, and jobs now have dedicated chart panels with switchable chart types (response time percentiles, request volume, error rate, execution volume, duration, failure rate)
+- **New chart types across all sections** — Routes, queries, and jobs now have dedicated, switchable chart panels (percentiles, volume, error/failure rate, duration)
 - **Dashboard health summary** — New `HealthSummary` model surfaces an overall health status and highlights routes/queries/jobs that need attention
 - **Dashboard "Needs Attention" section** — Automatically surfaces slow routes, high error rates, and problematic jobs without manual digging
 - **Storage pressure indicator** — Tracks and displays database storage growth so you know when to adjust retention settings
@@ -249,16 +156,16 @@ releases will be smaller and more incremental than this one.
 
 ### Changed
 
-- **Dashboard redesigned** — Full dashboard overhaul with health summary, attention sections, and chart panels replacing the previous card layout
+- **Dashboard redesigned** — Full overhaul with health summary, attention sections, and chart panels replacing the previous card layout
 - **Routes, queries, and jobs index pages redesigned** — Consistent layout with metric cards, switchable chart tabs, and paginated tables
 - **Metric card component updated** — Cards now support a richer data structure with trend indicators
-- **Application controller refactored** — Controller concerns split into focused modules (`ChartTableConcern`, `MetricCardConcern`, `PaginationConcern`, `SessionFiltersConcern`, `TagFilterConcern`, `TimeRangeConcern`, `ZoomRangeConcern`)
-- **`normalized_sql` column expanded to `text`** — Removes the 1000-character limit on PostgreSQL and MySQL (migration provided for existing installs)
+- **Application controller refactored** — Split into focused concerns (`ChartTableConcern`, `MetricCardConcern`, `PaginationConcern`, `SessionFiltersConcern`, `TagFilterConcern`, `TimeRangeConcern`, `ZoomRangeConcern`)
+- **`normalized_sql` column expanded to `text`** — Removes the 1000-character limit on PostgreSQL and MySQL (migration provided)
 - **Diagnostic fields added to queries table** — New columns captured at instrumentation time
 - **Summary job and service refactored** — Cleaner separation between job scheduling and summary calculation logic
 - **Cleanup job refactored** — Now uses `CleanupTaskRunner` and reports statistics via `CleanupStatsReporter`
 - **Configuration expanded** — New configuration options exposed in the initializer template
-- **Upgrade generator simplified** — Generator now delegates to `MigrationInstaller` and `ConfigInstaller`
+- **Upgrade generator simplified** — Now delegates to `MigrationInstaller` and `ConfigInstaller`
 - **Asset server middleware updated** — Improved asset serving reliability
 - **Request collector middleware updated** — Performance improvements and cleaner instrumentation
 - **Operation subscriber refactored** — Cleaner event handling and reduced complexity
@@ -269,10 +176,9 @@ releases will be smaller and more incremental than this one.
 
 - `StatusHelper` removed — status rendering consolidated into model concerns and view components
 - `ChartFormatters` helper removed — chart formatting moved into chart model classes
-- `chart_formatters_test.rb` removed alongside the helper
 - Slow queries and slow routes table models removed — replaced by the Needs Attention system
 - Unused `average_response_time` and `p95_response_time` dashboard chart classes removed
-- `requests/tables/index.rb` and related test removed — requests index now uses a shared approach
+- `requests/tables/index.rb` removed — requests index now uses a shared approach
 - `routes/cards/average_response_times` and `routes/charts/average_response_times` removed — replaced by percentile-based equivalents
 - `jobs/cards/average_duration` and `jobs/cards/total_jobs` removed — replaced by updated cards
 - Timezone controller removed

data/README.md

@@ -75,6 +75,8 @@ Restart all processes after migrate. This release changes how routes are stored
 
 The upgrade generator appends new settings to `config/initializers/rails_pulse.rb` without rewriting what you already set. Review with `git diff` and keep or discard hunks.
 
+To see where an install stands at any point — schema, unrun migration files, route backfill, initializer — run `rails rails_pulse:status`. It exits 1 when something needs action, so it can gate a deploy.
+
 Exception tracking is **off** for existing installs. The generator inserts `config.track_exceptions = false`; set it to `true` after migrating to opt in:
 
 ```ruby

data/app/controllers/rails_pulse/application_controller.rb

@@ -15,6 +15,7 @@ module RailsPulse
     protect_from_forgery with: :exception
 
     before_action :authenticate_rails_pulse_user!
+    before_action :require_current_schema!
     before_action :set_onboarding_state
     before_action :load_deployment_markers
 
@@ -132,6 +133,8 @@ module RailsPulse
       config = RailsPulse.configuration
       return unless config.authentication_enabled
 
+      return authenticate_standalone!(config) if RailsPulse.standalone?
+
       if config.authentication_method.nil? && config.authorize.nil?
         return fallback_http_basic_auth
       end
@@ -144,7 +147,39 @@ module RailsPulse
       run_authorize_predicate(config.authorize) if config.authorize
     rescue StandardError => e
       logger.warn "RailsPulse authentication failed: #{e.message}"
-      redirect_to config.authentication_redirect_path
+      # The redirect target is a host app page; from the standalone server
+      # it would point at a route this process does not serve.
+      if RailsPulse.standalone?
+        render plain: "Forbidden", status: :forbidden
+      else
+        redirect_to config.authentication_redirect_path
+      end
+    end
+
+    # The standalone server has the host's models but not its middleware:
+    # no host session store, Warden, or Devise helpers, and a different
+    # hostname so no shared cookie. A session-based `authentication_method`
+    # or `authorize` would raise (rescued above into a useless redirect) or,
+    # worse, be written so that it silently allows. Ignore both here; use
+    # `standalone_authentication_method` when set, else HTTP Basic.
+    def authenticate_standalone!(config)
+      hook = config.standalone_authentication_method
+      if hook.nil?
+        note_ignored_host_authentication(config)
+        return fallback_http_basic_auth
+      end
+
+      run_authentication_method(hook)
+    end
+
+    def note_ignored_host_authentication(config)
+      return if config.authentication_method.nil? && config.authorize.nil?
+      return if self.class.instance_variable_get(:@_rails_pulse_standalone_auth_noted)
+
+      self.class.instance_variable_set(:@_rails_pulse_standalone_auth_noted, true)
+      logger.info "RailsPulse: standalone dashboard ignores config.authentication_method / config.authorize " \
+                  "(host session helpers are not available here); using HTTP Basic auth. " \
+                  "Set config.standalone_authentication_method to customise."
     end
 
     def run_authentication_method(hook)
@@ -196,6 +231,30 @@ module RailsPulse
       end
     end
 
+    # New gem code against un-migrated tables would otherwise 500 on every
+    # page that touches a missing column. Runs after authentication so the
+    # schema report is not exposed to anonymous callers.
+    def require_current_schema!
+      return if RailsPulse::SchemaCheck.current?
+
+      RailsPulse::SchemaCheck.warn_once!
+      missing = RailsPulse::SchemaCheck.missing
+
+      respond_to do |format|
+        format.html do
+          render template: "rails_pulse/shared/schema_outdated", layout: false,
+                 status: :service_unavailable, locals: { missing: missing }
+        end
+        format.any do
+          render json: {
+            error: "Rails Pulse #{RailsPulse::VERSION} requires a schema upgrade",
+            missing: missing,
+            instructions: RailsPulse::SchemaCheck::UPGRADE_INSTRUCTIONS
+          }, status: :service_unavailable
+        end
+      end
+    end
+
     def load_deployment_markers
       @deployment_markers = []
       @show_deployment_markers = session_show_deployment_markers

data/app/controllers/rails_pulse/deployments_controller.rb

@@ -36,10 +36,7 @@ module RailsPulse
     end
 
     def finish
-      deployment = RailsPulse::Deployment
-        .where(revision: finish_params[:revision])
-        .order(started_at: :desc)
-        .first
+      deployment = RailsPulse::Deployment.latest_for_revision(finish_params[:revision])
 
       return render json: { status: "error", error: "Deployment not found" }, status: :not_found unless deployment
 

data/app/helpers/rails_pulse/breadcrumbs_helper.rb

@@ -30,13 +30,16 @@ module RailsPulse
       # Only keep segments after the mount point
       path_segments = path_segments[(mount_end_index + 1)..-1]
 
-      # Build the engine root path directly from mount segments (avoids relying on named route helper)
-      engine_root = "/" + mount_segments.join("/")
+      # Build the engine root path directly from mount segments (avoids relying on named route helper).
+      # Served at "/" (standalone server, or a host that mounts the engine at root) the prefix
+      # is empty, not "/": segments are appended as "/#{segment}", and "/" + "/queries" would be
+      # "//queries" — a protocol-relative URL that browsers resolve to a host called "queries".
+      engine_root = mount_segments.empty? ? "" : "/" + mount_segments.join("/")
 
       # Start with the Home link
       crumbs = [ {
         title: "Home",
-        path: engine_root,
+        path: engine_root.empty? ? "/" : engine_root,
         current: path_segments.empty?
       } ]
 

data/app/models/rails_pulse/deployment.rb

@@ -18,6 +18,12 @@ module RailsPulse
     scope :for_range, ->(start_time, end_time) { where(started_at: start_time..end_time) }
     scope :recent,    -> { order(started_at: :desc) }
 
+    # A revision can be deployed more than once (rollbacks, re-deploys); both
+    # the finish API endpoint and rails_pulse:finish_deployment close this row.
+    def self.latest_for_revision(revision)
+      where(revision: revision).order(started_at: :desc).first
+    end
+
     def self.ransackable_attributes(auth_object = nil)
       %w[id revision started_at finished_at created_at]
     end

data/app/services/rails_pulse/exception_capture_service.rb

@@ -19,6 +19,8 @@ module RailsPulse
 
     class << self
       def capture(exception, request_url: nil, request_method: nil, request_params: nil, environment: nil, deploy_sha: nil)
+        return unless RailsPulse::SchemaCheck.tracking_allowed?
+
         new(exception, request_url: request_url, request_method: request_method, request_params: request_params, environment: environment, deploy_sha: deploy_sha).capture
       end
 

data/app/services/rails_pulse/route_controller_action_backfiller.rb

@@ -6,13 +6,9 @@ module RailsPulse
 
     def call
       results = { updated: 0, skipped: 0, already_set: 0, merged: 0 }
-      total = RailsPulse::Route.count
-      processed = 0
       RailsPulse::Route.find_each do |route|
         process_route(route, results)
-        processed += 1
       end
-      puts "" if total > 0
       consolidate_unrecognized_duplicates(results)
       results
     end

data/app/views/rails_pulse/shared/schema_outdated.html.erb

@@ -0,0 +1,96 @@
+<%# Rendered with layout: false from ApplicationController#require_current_schema!.
+    Mirrors the application layout's setup screen (same head, stylesheet and
+    setup-* classes) without depending on the before_actions or table reads the
+    real layout needs — the schema behind this page is, by definition, not one
+    this gem version can query. %>
+<!DOCTYPE html>
+<html data-color-scheme="light">
+  <head>
+    <title>Schema upgrade required — Rails Pulse</title>
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <%= csp_meta_tag %>
+
+    <script nonce="<%= rails_pulse_csp_nonce %>">
+      (function() {
+        var storageKey = 'color-scheme';
+        var root = document.documentElement;
+        var scheme = 'light';
+
+        try {
+          var stored = localStorage.getItem(storageKey);
+          if (stored === 'dark' || stored === 'light') {
+            scheme = stored;
+          } else if (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches) {
+            scheme = 'dark';
+          }
+        } catch (error) {
+          if (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches) {
+            scheme = 'dark';
+          }
+        }
+
+        root.setAttribute('data-color-scheme', scheme);
+      })();
+    </script>
+
+    <%# tag.link/script (not stylesheet_link_tag): middleware fallback paths must stay off asset_host. %>
+    <%= tag.link rel: "stylesheet", href: rails_pulse.asset_path("rails-pulse.css") %>
+    <%= tag.script "", src: rails_pulse.asset_path("rails-pulse-icons.js"), defer: true, nonce: rails_pulse_csp_nonce %>
+  </head>
+
+  <body class="header-layout">
+    <main id="main">
+      <div class="container flex flex-col gap">
+        <div class="setup-screen">
+          <div class="setup-screen__brand">
+            <%= tag.img src: rails_pulse.asset_path("rails-pulse-logo.png"),
+              width: 72,
+              height: 72,
+              alt: "Rails Pulse",
+              class: "setup-screen__logo" %>
+            <p class="setup-screen__brand-name">Rails Pulse</p>
+          </div>
+
+          <div class="setup-banner setup-banner--negative">
+            <p class="setup-banner__title">Rails Pulse <%= RailsPulse::VERSION %> needs a schema upgrade</p>
+            <p class="setup-banner__body">
+              The gem in this process is newer than the Rails Pulse tables it is connected to.
+              Request, job and exception tracking is paused, and the dashboard is unavailable,
+              until the database is migrated. Missing from the database:
+            </p>
+            <ul class="setup-banner__body">
+              <% missing.each do |table, columns| %>
+                <li>
+                  <code><%= table %></code>
+                  <% if columns == [ :table ] %>
+                    — table does not exist
+                  <% else %>
+                    — columns: <%= safe_join(columns.map { |column| tag.code(column) }, ", ") %>
+                  <% end %>
+                </li>
+              <% end %>
+            </ul>
+            <p class="setup-banner__body">Run these from the application root, then restart every process (web and workers) together:</p>
+            <% RailsPulse::SchemaCheck::UPGRADE_INSTRUCTIONS.each do |instruction| %>
+              <% command, _, comment = instruction.partition("#") %>
+              <code class="setup-banner__command"><span class="setup-banner__command-prefix">$</span>
+                <%= command.strip %><% if comment.present? %>
+                <span class="setup-banner__command-prefix"># <%= comment.strip %></span><% end %></code>
+            <% end %>
+            <p class="setup-banner__body">
+              A rolling restart that leaves older processes running against the migrated schema
+              breaks tracking the other way round. Back up the database first: the route identity
+              migration is irreversible.
+            </p>
+          </div>
+
+          <%= link_to "View upgrade docs →",
+            "https://railspulse.com/documentation/upgrade/",
+            class: "setup-screen__docs",
+            target: "_blank",
+            rel: "noopener" %>
+        </div>
+      </div>
+    </main>
+  </body>
+</html>

data/exe/rails_pulse_server

@@ -21,5 +21,14 @@ unless args.any? { |arg| arg.start_with?("-p") || arg == "--port" }
   args.unshift("-p", port)
 end
 
+# rackup's own environment defaults to "development" regardless of RAILS_ENV,
+# and in that mode it wraps the app in Rack::Lint and Rack::ShowExceptions.
+# Follow RACK_ENV, then RAILS_ENV, so a production dashboard is served without
+# the development middleware (an explicit -E/--env still wins).
+rack_env = ENV["RACK_ENV"].to_s.empty? ? ENV["RAILS_ENV"] : ENV["RACK_ENV"]
+unless rack_env.to_s.empty? || args.any? { |arg| arg.start_with?("-E") || arg == "--env" }
+  args.unshift("-E", rack_env)
+end
+
 # Execute rackup with the server file
 exec("rackup", rackup_file, *args)

data/lib/generators/rails_pulse/install_generator.rb

@@ -80,6 +80,8 @@ module RailsPulse
                  migrations_paths: db/rails_pulse_migrate
                  schema_dump: false
 
+          Repeat this entry for each environment (development, test, production).
+
           schema_dump: false is required so Rails does not dump or load
           db/rails_pulse_structure.sql. Keep database_tasks enabled so
           rails db:migrate:rails_pulse still runs upgrades.