wurk 1.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d6d1517377dd46c320f3e03fc705dd4877530c948a51c525a375aa6caacfe964
-  data.tar.gz: aa4e80a91da88be21978b22a776f79bd5fb89d6c793cd7826f4e9292041071ea
+  metadata.gz: 8911da9e550c5d8078c4293ebb69f3b8620a4285692f6e3a6b37d41b711c9219
+  data.tar.gz: 9cc0cf226409e7fb5f9ffce6749b2a7328324e9319350d7752c8bdf8d33e7437
 SHA512:
-  metadata.gz: 35c6371f7561bbd62340002b9bf9850abaf79745b8e330ce7a6fe06cd265cc564ab65a47d279e7b0cfe0f9f058758f0e31af0d3ed1ec5e1ee449fbdf9a7e5506
-  data.tar.gz: 7694620688b95769ed0713e827cd1c9c6b78372d0e735eee4c3244835ccc19c7a0be1be18bfc0d42bcc364e449176d423455242a9f7cfe6522b578b75045f3f4
+  metadata.gz: '093767442c103fc2a99fc8b8d0b5fa21c16d50a46cd90be6826b948c82c871217e725c07af71b6df3c98d501788199104601262081cfe8810b7bbd510c099191'
+  data.tar.gz: fe4977ee515f59cbb6758fe4f42a5d6a8a198c863efc5bebccd211e1c47a2f1ff3f11d90ce85ad1e7faa8f335e1b865ff0bb8efbc0a827773c4d977c968e149b

data/README.md

@@ -75,6 +75,25 @@ Plus Wurk extras: a worker topology DSL, a Kubernetes liveness/readiness listene
 
 JRuby, TruffleRuby, and Windows fall back to threads-only mode (no fork) — behaviorally equivalent to stock Sidekiq.
 
+## Running the workers
+
+Under Rails the engine **auto-starts** the swarm on boot — a plain `rails server` already forks workers and fetches. Set `WURK_DISABLED=1` on any process that shouldn't (e.g. the web tier when you run workers on their own dyno).
+
+**One exception — preforking web servers.** A clustered Puma, Unicorn, or Passenger forks its own web workers, so Wurk **refuses** to also fork the swarm there — it would multiply the swarm by the web-worker count, or entangle its supervisor with the server's own fork/signal handling — and logs how to proceed. Either run the swarm as its own process (recommended):
+
+```bash
+bundle exec wurkswarm   # forked swarm, real parallelism
+```
+
+…or run it inside the web process as threads only, no fork (like Sidekiq embedded):
+
+```ruby
+# config/application.rb  (here, not an initializer — server mode is decided before initializers load)
+config.wurk.embed_in_web = true
+```
+
+Single-mode Puma (the `rails server` default) isn't preforking, so auto-start is unaffected. Full details, flags, and the standalone runners: **[Starting the worker](https://github.com/developerz-ai/wurk/blob/main/docs/running.md)**.
+
 ## The dashboard
 
 Mount the engine wherever you like:
@@ -92,6 +111,12 @@ Wurk::Web.use(Rack::Auth::Basic, "Wurk") { |user, pass| user == ENV["WURK_USER"]
 
 Ship a viewer-only board (e.g. a public demo) with no auth code at all by setting `WURK_WEB_READ_ONLY=1` — every mutating request returns 403 and the SPA hides destructive actions.
 
+### Security notes
+
+- **`Wurk::Web.use` and the `authorization` hook gate the dashboard's routes and JSON API** — every controller under the engine mount goes through them.
+- **`/wurk-assets/*` (the precompiled SPA's JS/CSS/font bundle) is served unauthenticated, by design.** It's inserted into the host app's own middleware stack ahead of the engine's routes, so it never reaches `Wurk::Web.use`/`authorization`. This is safe because the bundle carries no data — no job payloads, no Redis reads, nothing per-user — it's a static shell, same trust model as any Rails app's `public/assets`. Everything data-bearing (stats, queues, jobs) is served by the JSON API, which *is* gated. If you need to hide even the existence of the bundle (e.g. compliance requires the mount path itself stay secret), put a reverse-proxy rule in front of `/wurk-assets` rather than relying on the engine.
+- Redis being unreachable surfaces to the SPA as a structured `503 {"error": "redis_unavailable"}` (JSON endpoints) or an SSE `error` event (the live stream), never a raw 500 — the client can branch on it instead of parsing an HTML error page.
+
 ## Encryption
 
 A drop-in for `Sidekiq::Enterprise::Crypto`. It encrypts the **last** positional argument of a job with AES-256-GCM — the client middleware seals it on push, the server middleware opens it before `perform`. Earlier args stay plaintext so you can still triage on `user_id`.

data/app/controllers/concerns/wurk/same_origin_guard.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Wurk
+  # Sidekiq's CSRF model (spec §25.1) for the dashboard's token-less, cookie-
+  # authenticated surfaces. The SolidJS SPA (JSON fetch) and host-registered
+  # extension forms send no Rails authenticity token, so `protect_from_forgery`
+  # can't apply — guard unsafe methods with a same-origin check instead. A
+  # cross-site page can drive a victim's browser but cannot forge
+  # `Sec-Fetch-Site: same-origin` (the browser sets it); a missing header is
+  # denied too, since only a non-browser client omits it and it carries no
+  # ambient session cookie to abuse.
+  #
+  # Mirrors the standalone Rack surface (Wurk::Web#safe_request?) so every
+  # mutating dashboard entry point enforces one rule.
+  module SameOriginGuard
+    extend ActiveSupport::Concern
+
+    # Non-mutating methods need no origin check. Matches Wurk::Web::SAFE_METHODS;
+    # kept local so this engine concern carries no lib load-order dependency.
+    SAFE_METHODS = %w[GET HEAD OPTIONS TRACE].freeze
+
+    included do
+      # SPA/extension requests never carry a Rails CSRF token; the same-origin
+      # check below is the CSRF defense in its place.
+      skip_forgery_protection
+      before_action :verify_same_origin!
+    end
+
+    private
+
+    def verify_same_origin!
+      head :forbidden unless safe_request?
+    end
+
+    def safe_request?
+      SAFE_METHODS.include?(request.request_method) ||
+        request.headers['Sec-Fetch-Site'] == 'same-origin'
+    end
+  end
+end

data/app/controllers/concerns/wurk/sse_streaming.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Wurk
+  # Drives the `/api/stream` SSE loop (headers, tick cadence, tear-down).
+  # Split out of ApiController so the periodic-stats-push mechanics — which
+  # don't change per action — stay separate from the request/response mapping
+  # ApiController owns.
+  module SseStreaming
+    extend ActiveSupport::Concern
+
+    private
+
+    def stream_headers!
+      response.headers['Content-Type'] = 'text/event-stream'
+      response.headers['Cache-Control'] = 'no-cache'
+      response.headers['X-Accel-Buffering'] = 'no'
+    end
+
+    def drive_stream(sse, tick, max_dur)
+      deadline = monotime + max_dur
+      loop do
+        sse.write(stream_tick_payload, event: 'stats')
+        break if monotime >= deadline
+
+        sleep tick
+      end
+    rescue ::IOError, ::ActionController::Live::ClientDisconnected
+      # client closed; nothing to clean up.
+    rescue *::Wurk::Configuration::REDIS_ERROR_CLASSES => e
+      # Headers are already flushed by the time a tick hits Redis, so the
+      # 503 ApplicationController's rescue_from renders for a plain request
+      # can't happen here — emit a structured SSE event instead and close;
+      # the SPA's EventSource reconnects and gets a fresh chance at Redis.
+      logger.warn("wurk web: stream redis unavailable (#{e.class}: #{e.message})")
+      sse.write({ error: 'redis_unavailable' }, event: 'error')
+    ensure
+      sse.close
+    end
+
+    def monotime
+      ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+    end
+
+    def stream_tick_payload
+      ::Wurk::Api::Serializers.stats_payload(::Wurk::Stats.new).merge(at: ::Time.now.to_f)
+    end
+  end
+end

data/app/controllers/concerns/wurk/stream_concurrency_guard.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Wurk
+  # Per-process cap on concurrent SSE streams. ActionController::Live pins one
+  # Puma thread for every open `/api/stream`; without a bound, a burst of stale
+  # browser tabs could hold every thread and starve the JSON API. Past the cap
+  # we 503 with Retry-After — the SPA's EventSource reconnects (and its polling
+  # fallback honors Retry-After) once a slot frees. Per-process is the right
+  # scope: it's this process's own thread pool we're protecting.
+  module StreamConcurrencyGuard
+    extend ActiveSupport::Concern
+
+    MAX_CONCURRENT_STREAMS = 10
+    RETRY_AFTER_SECONDS = 3
+
+    @open = 0
+    @lock = Mutex.new
+
+    class << self
+      # Reserve a stream slot; false when the cap is already reached.
+      def acquire
+        @lock.synchronize do
+          return false if @open >= MAX_CONCURRENT_STREAMS
+
+          @open += 1
+          true
+        end
+      end
+
+      def release
+        @lock.synchronize { @open -= 1 if @open.positive? }
+      end
+    end
+
+    private
+
+    # Runs the SSE body only while holding a slot, releasing it however the
+    # stream ends (client disconnect, cap-duration, error). 503 + Retry-After
+    # past the cap instead of tying up a thread on an unservable request.
+    def with_stream_slot
+      unless StreamConcurrencyGuard.acquire
+        response.headers['Retry-After'] = RETRY_AFTER_SECONDS.to_s
+        return head :service_unavailable
+      end
+
+      begin
+        yield
+      ensure
+        StreamConcurrencyGuard.release
+      end
+    end
+  end
+end

data/app/controllers/wurk/api/pagination.rb

@@ -13,12 +13,22 @@ module Wurk
     module Pagination
       DEFAULT_PAGE_SIZE = 25
       MAX_PAGE_SIZE = 200
+      # Offset pagination reaches page N by walking N*count rows through Ruby
+      # (and their Redis round-trips). An unclamped ?page= lets one request
+      # walk an entire million-row set; 1000 pages is far beyond any real UI
+      # depth while bounding the worst-case walk.
+      MAX_PAGE = 1_000
+      # A substr that matches nothing would otherwise stream the whole backing
+      # set through Ruby (same DoS shape Web::Search bounds with SCAN_BUDGET).
+      # Raw rows examined per filtered request; results within the budget are
+      # exact, beyond it the page just comes back short.
+      FILTER_SCAN_LIMIT = 20_000
 
       module_function
 
       def window(params)
         {
-          page: [params[:page].to_i, 0].max,
+          page: clamp_int(params[:page], 0, MAX_PAGE, 0),
           count: clamp_int(params[:count], 1, MAX_PAGE_SIZE, DEFAULT_PAGE_SIZE),
           substr: params[:substr].to_s
         }
@@ -39,19 +49,58 @@ module Wurk
       # Iterates `enumerable` and collects up to `count` payloads from the
       # requested page after substr filtering. `block` maps each member to a
       # JSON Hash; nil from the block skips the member entirely.
-      def slice(enumerable, page)
-        results = []
+      #
+      # With a substr filter the offset must count *matching* rows, not raw
+      # rows — otherwise page N restarts at raw index N*count and re-emits
+      # (or skips) matches already assigned to earlier pages. Without a
+      # filter we keep the fast path that skips serialization before the
+      # offset.
+      def slice(enumerable, page, &)
         offset = page[:page] * page[:count]
-        idx = 0
+        if page[:substr].empty?
+          slice_raw(enumerable, offset, page[:count], &)
+        else
+          slice_filtered(enumerable, offset, page, &)
+        end
+      end
+
+      # Fast path: skip serialization entirely for rows before the offset.
+      def slice_raw(enumerable, offset, count)
+        results = []
+        seen = 0
+        enumerable.each do |member|
+          if seen < offset
+            seen += 1
+            next
+          end
+
+          payload = yield(member)
+          next unless payload
+
+          results << payload
+          break if results.size >= count
+        end
+        results
+      end
+
+      # Filtered path: the offset counts MATCHING rows, so page boundaries
+      # stay stable (raw-index offsets re-emit or skip matches across pages).
+      def slice_filtered(enumerable, offset, page)
+        results = []
+        matched = 0
+        examined = 0
         enumerable.each do |member|
-          if idx >= offset
-            payload = yield(member)
-            if payload && match?(payload, page[:substr])
-              results << payload
-              break if results.size >= page[:count]
-            end
+          examined += 1
+          break if examined > FILTER_SCAN_LIMIT
+
+          payload = yield(member)
+          next unless payload && match?(payload, page[:substr])
+
+          if matched >= offset
+            results << payload
+            break if results.size >= page[:count]
           end
-          idx += 1
+          matched += 1
         end
         results
       end

data/app/controllers/wurk/api/serializers.rb

@@ -63,7 +63,10 @@ module Wurk
         )
       end
 
-      def process_row(process)
+      # `leader_identity` is the cluster's `dear-leader` value (ProcessSet#leader,
+      # memoized to one Redis GET per request) — comparing here avoids the N+1
+      # `Process#leader?` GET-per-row that a per-process lookup would cost.
+      def process_row(process, leader_identity: nil)
         {
           identity: process.identity,
           hostname: process['hostname'],
@@ -73,6 +76,7 @@ module Wurk
           busy: process['busy'],
           beat: process['beat'],
           quiet: process.stopping?,
+          leader: !leader_identity.to_s.empty? && process.identity == leader_identity,
           rss: process['rss'],
           rtt_us: process['rtt_us'],
           started_at: process['started_at'],

data/app/controllers/wurk/api_controller.rb

@@ -15,22 +15,26 @@ module Wurk
   # in `docs/target/sidekiq-{free,pro,ent}.md`.
   class ApiController < ApplicationController
     include ActionController::Live
+    # The SPA is a token-less JSON client; SameOriginGuard supplies Sidekiq's
+    # same-origin CSRF defense (spec §25.1) so every mutating endpoint is
+    # protected — GET reads (incl. #stream SSE) stay reachable.
+    include SameOriginGuard
+    # Bounds concurrent SSE streams per process (503 past the cap) so stale
+    # dashboard tabs can't pin every Puma thread. Provides #with_stream_slot.
+    include StreamConcurrencyGuard
+    # Owns the #stream action's tick loop (headers, cadence, tear-down).
+    include SseStreaming
 
     STREAM_TICK_SECONDS = 2.0
-    STREAM_MAX_DURATION = 600.0
+    STREAM_MAX_DURATION = 120.0
+    # Positive floor for `?tick=`: a zero/negative tick would `sleep 0` the SSE
+    # loop into a tight Redis-read/write spin (Live runs it in a spawned thread)
+    # for up to STREAM_MAX_DURATION. Clamp before it reaches drive_stream.
+    STREAM_MIN_TICK_SECONDS = 0.1
 
     HISTORY_WINDOW_UNITS = { 's' => 1, 'm' => 60, 'h' => 3600, 'd' => 86_400 }.freeze
     DEFAULT_HISTORY_WINDOW = 24 * 3600
 
-    skip_forgery_protection only: %i[
-      stream reset_limiter pause_cron unpause_cron enqueue_cron
-      clear_queue delete_queue_job pause_queue unpause_queue
-      retries_bulk retries_all retry_job
-      scheduled_bulk scheduled_all scheduled_job
-      dead_bulk dead_all dead_job
-      quiet_process stop_process
-    ]
-
     # Per-set action whitelists. Maps the SPA's action name to the
     # SortedEntry/JobSet method. Anything not listed 400s — keeps the bulk/
     # single dispatchers from reaching arbitrary methods off a request param.
@@ -75,13 +79,13 @@ module Wurk
       render json: { ok: true }
     end
 
-    # Removes a single job from a queue by jid. LREM matches exact bytes, so we
-    # locate the record (Queue#find_job) and let it delete its own value.
+    # Removes a single job from a queue by jid — one Lua round-trip
+    # (Fast::QueueExt#delete_job) instead of a paged find_job walk.
     def delete_queue_job
-      record = ::Wurk::Queue.new(params[:name].to_s).find_job(params[:jid].to_s)
-      return render(json: { error: 'unknown job' }, status: :not_found) unless record
+      removed = ::Wurk::Queue.new(params[:name].to_s).delete_job(params[:jid].to_s)
+      return render(json: { error: 'unknown job' }, status: :not_found) if removed.zero?
 
-      render json: { ok: true, deleted: record.delete }
+      render json: { ok: true, deleted: true }
     end
 
     # Pause/unpause a queue (Pro §6, §10.1). Idempotent; returns the resulting
@@ -144,7 +148,9 @@ module Wurk
     end
 
     def processes
-      render json: ::Wurk::ProcessSet.new.map { |p| ::Wurk::Api::Serializers.process_row(p) }
+      set = ::Wurk::ProcessSet.new
+      leader_identity = set.leader
+      render json: set.map { |p| ::Wurk::Api::Serializers.process_row(p, leader_identity: leader_identity) }
     end
 
     # Currently-executing jobs across the cluster (WorkSet), oldest first.
@@ -265,10 +271,11 @@ module Wurk
 
     def search
       substr = params[:substr].to_s
-      return render(json: { substr: substr, total: 0, hits: [] }) if substr.empty?
+      return render(json: { substr: substr, total: 0, hits: [], truncated: false }) if substr.empty?
 
-      hits = ::Wurk::Web::Search.new(substr, kinds: parse_search_kinds(params), limit: parse_search_limit(params)).to_a
-      render json: { substr: substr, total: hits.size, hits: hits }
+      search = ::Wurk::Web::Search.new(substr, kinds: parse_search_kinds(params), limit: parse_search_limit(params))
+      hits = search.to_a
+      render json: { substr: substr, total: hits.size, hits: hits, truncated: search.truncated? }
     end
 
     # Profiles list (v8.0+). The SPA links each row to /profiles/:key (view)
@@ -281,16 +288,20 @@ module Wurk
     # SSE: one `event: stats` per tick with a fresh Stats snapshot. Caps at
     # `STREAM_MAX_DURATION` so a stale browser tab can't tie a Rails worker
     # forever — the client reconnects automatically when the stream closes.
+    # Bounded per process by StreamConcurrencyGuard (503 + Retry-After past the
+    # cap) so a burst of tabs can't pin every Puma thread.
     #
     # `?max_duration=` and `?tick=` are test/debug knobs; the SPA never sets
     # them. `?max_duration=0` emits one tick and closes.
     def stream
-      stream_headers!
-      clamp = ::Wurk::Api::Pagination.method(:clamp_float)
-      tick = clamp.call(params[:tick], 0.0, STREAM_TICK_SECONDS, STREAM_TICK_SECONDS)
-      max_dur = clamp.call(params[:max_duration], 0.0, STREAM_MAX_DURATION, STREAM_MAX_DURATION)
-      sse = ::ActionController::Live::SSE.new(response.stream, retry: (STREAM_TICK_SECONDS * 1000).to_i)
-      drive_stream(sse, tick, max_dur)
+      with_stream_slot do
+        stream_headers!
+        clamp = ::Wurk::Api::Pagination.method(:clamp_float)
+        tick = clamp.call(params[:tick], STREAM_MIN_TICK_SECONDS, STREAM_TICK_SECONDS, STREAM_TICK_SECONDS)
+        max_dur = clamp.call(params[:max_duration], 0.0, STREAM_MAX_DURATION, STREAM_MAX_DURATION)
+        sse = ::ActionController::Live::SSE.new(response.stream, retry: (STREAM_TICK_SECONDS * 1000).to_i)
+        drive_stream(sse, tick, max_dur)
+      end
     end
 
     private
@@ -337,6 +348,11 @@ module Wurk
 
       count = 0
       keys = Array(params[:keys]).map(&:to_s).uniq
+      # Each key costs a ZRANGEBYSCORE plus per-entry mutations; an uncapped
+      # list lets one POST issue tens of thousands of round-trips. The UI
+      # selects at most a page (200).
+      return render(json: { error: 'too many keys (max 1000)' }, status: :bad_request) if keys.size > 1000
+
       entries_for(set, keys).each do |entry|
         entry.public_send(method)
         count += 1
@@ -382,18 +398,16 @@ module Wurk
       total
     end
 
-    # Drains a set by applying `method` to every entry until empty. Used for
-    # scheduled "add to queue all", where each call removes the entry and would
-    # otherwise shift the paged iterator's indices mid-scan.
+    # Drains a set by applying `method` to every entry. Snapshot first, then
+    # apply: mutating while the paged iterator scans would shift ZRANGE
+    # offsets mid-scan, and the old "loop until empty" alternative never
+    # terminates on a busy app (concurrent perform_in keeps the set non-empty)
+    # while wrongly enqueueing jobs scheduled *after* the operator clicked.
+    # Entries removed concurrently no-op their apply.
     def drain_set(set, method)
-      count = 0
-      until set.size.zero?
-        set.each do |entry|
-          entry.public_send(method)
-          count += 1
-        end
-      end
-      count
+      entries = set.to_a
+      entries.each { |entry| entry.public_send(method) }
+      entries.size
     end
 
     def render_sorted_set(set)
@@ -408,41 +422,8 @@ module Wurk
     # reads in limiter_row (which folds in live status).
     def limiter_rows(names, page)
       (names.slice(page[:page] * page[:count], page[:count]) || []).map do |name|
-        ::Wurk::Api::Serializers.limiter_row(name, limiter_meta(name))
-      end
-    end
-
-    def limiter_meta(name)
-      raw = ::Wurk.redis { |c| c.call('HGETALL', "lmtr:#{name}") }
-      raw.is_a?(Array) ? raw.each_slice(2).to_h : raw
-    end
-
-    def stream_headers!
-      response.headers['Content-Type'] = 'text/event-stream'
-      response.headers['Cache-Control'] = 'no-cache'
-      response.headers['X-Accel-Buffering'] = 'no'
-    end
-
-    def drive_stream(sse, tick, max_dur)
-      deadline = monotime + max_dur
-      loop do
-        sse.write(stream_tick_payload, event: 'stats')
-        break if monotime >= deadline
-
-        sleep tick
+        ::Wurk::Api::Serializers.limiter_row(name, ::Wurk::Web::Enterprise::Limits.metadata(name))
       end
-    rescue ::IOError, ::ActionController::Live::ClientDisconnected
-      # client closed; nothing to clean up.
-    ensure
-      sse.close
-    end
-
-    def monotime
-      ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
-    end
-
-    def stream_tick_payload
-      ::Wurk::Api::Serializers.stats_payload(::Wurk::Stats.new).merge(at: ::Time.now.to_f)
     end
 
     def render_cron_action(success)

data/app/controllers/wurk/application_controller.rb

@@ -1,7 +1,33 @@
 # frozen_string_literal: true
 
+require 'wurk/web'
+
 module Wurk
   class ApplicationController < ::ActionController::Base
     protect_from_forgery with: :exception
+
+    # Route every dashboard/API/SSE Redis read through the dedicated web pool
+    # (disjoint from the worker pool, #101) so dashboard load can't exhaust the
+    # connections a co-located worker needs. Wraps the whole action — including
+    # the SSE stream, which ActionController::Live runs (filters and all) in a
+    # spawned thread, so the thread-local set here still covers each tick's
+    # checkout.
+    around_action :scope_web_redis_pool
+
+    # A blip/outage surfacing here is the *same* condition RedisPool already
+    # retried and gave up on (its `on_error` hook already fired — #101).
+    # Report it to the SPA as a structured, retryable 503 instead of letting
+    # it fall through to Rails' generic 500 error page, which would leak a
+    # backtrace and give the client nothing to branch on.
+    rescue_from(*::Wurk::Configuration::REDIS_ERROR_CLASSES) { |ex| render_redis_unavailable(ex) }
+
+    private
+
+    def scope_web_redis_pool(&) = ::Wurk::Web::PoolScope.scope(&)
+
+    def render_redis_unavailable(ex)
+      logger.warn("wurk web: redis unavailable (#{ex.class}: #{ex.message})")
+      render json: { error: 'redis_unavailable' }, status: :service_unavailable
+    end
   end
 end

data/app/controllers/wurk/dashboard_controller.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'json'
 require 'net/http'
 require 'uri'
 
@@ -26,7 +27,7 @@ module Wurk
     INDEX_REL_PATH = ['vendor', 'assets', 'dashboard', 'index.html'].freeze
 
     def index
-      render layout: false, html: spa_html.html_safe
+      render layout: false, html: inject_mount_base(spa_html).html_safe
     end
 
     private
@@ -35,6 +36,27 @@ module Wurk
       ENV['WURK_VITE_DEV'] == '1' ? fetch_vite_dev_shell : read_built_index
     end
 
+    # The SPA is mount-agnostic: it reads window.__WURK_BASE__ to build every API
+    # URL and its client-router base, so the same precompiled bundle works whether
+    # the host mounts the engine at /wurk, /sidekiq, or /admin/jobs. script_name
+    # is the mount prefix ("/sidekiq"), or "" at the app root. Injected into every
+    # served shell (built and Vite-dev) so a non-/wurk mount needs no rebuild.
+    def inject_mount_base(html)
+      html.sub('</head>', "#{mount_base_script}</head>")
+    end
+
+    def mount_base_script
+      base = request.script_name.to_s.chomp('/')
+      %(<script>window.__WURK_BASE__ = #{js_string(base)};</script>\n  )
+    end
+
+    # JSON-quote the mount prefix as a literal inside <script>, escaping the
+    # sequences that could otherwise break out of the tag. The mount is
+    # host-configured, not request input, but the injection stays safe regardless.
+    def js_string(str)
+      str.to_json.gsub(/[<>&]/) { |c| format('\u%04x', c.ord) }
+    end
+
     def fetch_vite_dev_shell
       uri = ::URI.parse(VITE_DEV_URL)
       rewrite_dev_asset_urls(::Net::HTTP.get(uri))

data/app/controllers/wurk/extensions_controller.rb

@@ -12,11 +12,9 @@ module Wurk
   # client-side route (no extension registered under that name — e.g. a browser
   # refresh on /wurk/ext/<tab>/) falls through to the SPA shell instead of 404.
   class ExtensionsController < DashboardController
-    # Extension forms carry no Rails CSRF token. Parity with Sidekiq's own
-    # CSRF model instead (spec §25.1): unsafe methods must be same-origin per
-    # Sec-Fetch-Site; cross-site requests are denied. GETs are unaffected.
-    skip_forgery_protection
-    before_action :verify_same_origin!, unless: -> { request.get? || request.head? }
+    # Extension forms carry no Rails CSRF token — SameOriginGuard supplies
+    # Sidekiq's same-origin CSRF defense (spec §25.1) in its place.
+    include SameOriginGuard
 
     def show
       result = Web::Extension::Renderer.call(
@@ -45,12 +43,5 @@ module Wurk
       # Sidekiq::Web rendering its extensions — not user input.
       render html: body.html_safe, layout: false, status: status
     end
-
-    # Spec §25.1: unsafe methods require `Sec-Fetch-Site: same-origin` — a
-    # missing header is denied too, like stock Sidekiq (a non-browser client
-    # must spoof the header deliberately; a cookie-carrying browser can't).
-    def verify_same_origin!
-      head :forbidden unless request.headers['Sec-Fetch-Site'] == 'same-origin'
-    end
   end
 end

data/app/controllers/wurk/profiles_controller.rb

@@ -26,6 +26,11 @@ module Wurk
     end
 
     def show
+      # GET-shaped for Sidekiq parity, but uploading the profile to the public
+      # Firefox profiler store is a side effect — read-only deploys (e.g. the
+      # public demo) must not let any visitor exfiltrate profiling data.
+      return head(:forbidden) if ::Wurk::Web.config.read_only?
+
       blob = profile_blob(params[:key])
       return head(:not_found) unless blob
 
@@ -38,7 +43,7 @@ module Wurk
     private
 
     def profile_blob(key)
-      Wurk.redis { |conn| conn.call('HGET', key, 'data') }
+      ::Wurk::ProfileRecord.data_for(key)
     end
 
     # POSTs the gzipped profile to the Firefox profiler's compressed-store.

data/lib/wurk/batch/death_handler.rb

@@ -26,6 +26,8 @@ module Wurk
         end
         live, _died, first_death = Array(result).map(&:to_i)
 
+        restamp_ttls(bid)
+
         Wurk::Batch::Callbacks.fire_death(bid) if first_death == 1
         return unless live.zero?
 
@@ -35,6 +37,17 @@ module Wurk
         # suppressed regardless — the death above set the durable death flag.
         Wurk::Batch::Callbacks.maybe_fire(bid, pending: Wurk::Batch::Callbacks.pending_for(bid), live: 0)
       end
+
+      # A stale job can die AFTER its batch keys expired; the ack writes
+      # recreate them with no TTL — permanent key leakage. EXPIRE NX stamps
+      # only keys that lost their TTL, leaving live batches' clocks alone.
+      def self.restamp_ttls(bid)
+        Wurk.redis do |conn|
+          conn.pipelined do |pipe|
+            Batch.keys_for(bid).each { |key| pipe.call('EXPIRE', key, Batch::DEFAULT_EXPIRY_SECONDS, 'NX') }
+          end
+        end
+      end
     end
   end
 end