gina 0.3.7-alpha.1 → 0.3.7-alpha.10

package/.github/scripts/scan-vendored-cves.js

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+/*
+ * This file is part of the gina package.
+ * Copyright (c) 2009-2026 Rhinostone <contact@gina.io>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+/**
+ * OSV-based CVE scan for vendored deps.
+ *
+ * Walks every `package.json` under `framework/v*\/core/deps/`, extracts
+ * `(name, version)` pairs, queries `api.osv.dev`, and exits non-zero if
+ * any vulnerability is matched.
+ *
+ * Pinning convention (see .claude/architecture/vendored-deps.md): the
+ * vendored `package.json` stays byte-identical to upstream until
+ * patched; on patch, `version` is bumped to `<upstream>-rhinostone.N`
+ * (e.g. `1.6.0-rhinostone.1`). This script strips the
+ * `-rhinostone.N` suffix before querying so OSV still matches the base
+ * upstream version.
+ *
+ * Exit codes:
+ *   0 — clean, no CVEs matched
+ *   1 — at least one vulnerability matched (build fails)
+ *   2 — scan error (malformed package.json, network failure)
+ *
+ * @module .github/scripts/scan-vendored-cves
+ */
+
+'use strict';
+
+var fs    = require('fs');
+var path  = require('path');
+var https = require('https');
+
+var ROOT = path.resolve(__dirname, '..', '..');
+
+/**
+ * Walk every `framework/v*\/core/deps/<dep>/package.json` and return the
+ * list of absolute paths.
+ *
+ * @returns {string[]}
+ */
+function walkDepsPackageJsons() {
+    var frameworkDir = path.join(ROOT, 'framework');
+    if (!fs.existsSync(frameworkDir)) return [];
+    var results = [];
+    var fws = fs.readdirSync(frameworkDir);
+    for (var i = 0; i < fws.length; i++) {
+        var depsDir = path.join(frameworkDir, fws[i], 'core', 'deps');
+        if (!fs.existsSync(depsDir)) continue;
+        if (!fs.statSync(depsDir).isDirectory()) continue;
+        var deps = fs.readdirSync(depsDir);
+        for (var j = 0; j < deps.length; j++) {
+            var pkgPath = path.join(depsDir, deps[j], 'package.json');
+            if (fs.existsSync(pkgPath)) results.push(pkgPath);
+        }
+    }
+    return results;
+}
+
+/**
+ * Strip the local-patch suffix (`-rhinostone.N`) so OSV sees the base
+ * upstream version. If the version has no such suffix, returned as-is.
+ *
+ * @param {string} v
+ * @returns {string}
+ */
+function normalizeVersion(v) {
+    return String(v).replace(/-rhinostone\.\d+$/, '');
+}
+
+/**
+ * POST a single `(name, version)` query to api.osv.dev/v1/query.
+ * Resolves with the parsed JSON response (which may carry `{vulns: [...]}`
+ * or be empty `{}` on a clean match).
+ *
+ * @param {string} name
+ * @param {string} version
+ * @returns {Promise<object>}
+ */
+function queryOSV(name, version) {
+    return new Promise(function (resolve, reject) {
+        var body = JSON.stringify({
+            package: { name: name, ecosystem: 'npm' },
+            version: version
+        });
+        var req = https.request({
+            method:   'POST',
+            hostname: 'api.osv.dev',
+            path:     '/v1/query',
+            headers: {
+                'Content-Type':   'application/json',
+                'Content-Length': Buffer.byteLength(body)
+            }
+        }, function (res) {
+            var data = '';
+            res.on('data', function (chunk) { data += chunk; });
+            res.on('end', function () {
+                if (res.statusCode !== 200) {
+                    return reject(new Error('OSV HTTP ' + res.statusCode + ': ' + data));
+                }
+                try {
+                    resolve(JSON.parse(data));
+                } catch (e) {
+                    reject(e);
+                }
+            });
+        });
+        req.on('error', reject);
+        req.write(body);
+        req.end();
+    });
+}
+
+/**
+ * Scan driver. Walks the target package.jsons, queries OSV for each,
+ * prints a one-line status per dep, exits with the appropriate code.
+ *
+ * @returns {Promise<number>} exit code
+ */
+async function main() {
+    var pkgs = walkDepsPackageJsons();
+    if (pkgs.length === 0) {
+        console.log('[osv] no vendored package.json files found under framework/v*/core/deps/');
+        return 0;
+    }
+
+    var failures = 0;
+    var scanned  = 0;
+    for (var i = 0; i < pkgs.length; i++) {
+        var pkgPath = pkgs[i];
+        var rel     = path.relative(ROOT, pkgPath);
+        var pkg;
+        try {
+            pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+        } catch (e) {
+            console.error('[osv] ' + rel + ': cannot parse (' + e.message + ')');
+            return 2;
+        }
+        if (!pkg.name || !pkg.version) {
+            console.log('[osv] SKIP ' + rel + ': missing name or version');
+            continue;
+        }
+
+        var baseVersion = normalizeVersion(pkg.version);
+        var suffix      = (pkg.version !== baseVersion) ? ' (patched: ' + pkg.version + ')' : '';
+        var result;
+        try {
+            result = await queryOSV(pkg.name, baseVersion);
+        } catch (e) {
+            console.error('[osv] ' + rel + ': query failed — ' + e.message);
+            return 2;
+        }
+
+        scanned++;
+        var vulns = result.vulns || [];
+        if (vulns.length > 0) {
+            failures++;
+            console.error('[osv] VULNERABLE ' + pkg.name + '@' + baseVersion + suffix + ' (' + rel + ')');
+            for (var v = 0; v < vulns.length; v++) {
+                var entry   = vulns[v];
+                var aliases = (entry.aliases || []).join(', ');
+                var summary = (entry.summary || entry.details || '').replace(/\s+/g, ' ').slice(0, 140);
+                console.error('       ' + entry.id + (aliases ? ' (' + aliases + ')' : '') + ' — ' + summary);
+            }
+        } else {
+            console.log('[osv] OK ' + pkg.name + '@' + baseVersion + suffix + ' (' + rel + ')');
+        }
+    }
+
+    console.log('');
+    if (failures > 0) {
+        console.error('[osv] ' + failures + ' vendored dep(s) with matching CVEs — failing the build.');
+        return 1;
+    }
+    console.log('[osv] clean — no CVEs matched across ' + scanned + ' vendored dep(s).');
+    return 0;
+}
+
+main().then(function (code) {
+    process.exit(code);
+}).catch(function (err) {
+    console.error('[osv] uncaught:', err);
+    process.exit(2);
+});

package/.github/workflows/bundle-freshness.yml

@@ -0,0 +1,116 @@
+name: Bundle Freshness
+
+# Verifies that the committed dist/vendor/gina/ bundle matches what would
+# be produced by rebuilding from the current source.  Catches the
+# source-committed-without-rebuild gap that .githooks/pre-commit (cheap,
+# "did you stage dist?") cannot detect — i.e. a stale dist was staged
+# alongside a fresh source change.
+#
+# Precedent: #SCS1e (commit 48b8fd26) shipped four validator walker
+# replacements as source-only.  The bundle was not rebuilt until commit
+# 69fb32fc picked it up as a side effect of toolbar removal.  Any browser
+# loading gina.min.js between those two commits still ran the original
+# eval('data.' + localValue).  See llms.txt §72.
+
+on:
+  push:
+    branches: [develop, master]
+  pull_request:
+    branches: [develop, master]
+  workflow_dispatch:
+
+# Cancel any in-flight check for the same ref when a newer one kicks off.
+concurrency:
+  group: bundle-freshness-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  freshness:
+    name: Verify dist matches source
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Set up Java (for Closure Compiler)
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+
+      - name: Install build prerequisites
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y brotli
+
+      - name: Install dev dependencies
+        run: |
+          # `npm ci` (not `npm install`) — strictly respects package-lock.json
+          # so devDeps like engine.io-client (which gets baked into the bundle
+          # via build.json) don't drift between local rebuilds and CI rebuilds.
+          # See llms.txt §72 / 2026-04-24 incident.
+          npm ci --ignore-scripts
+          ln -sf $(pwd) node_modules/gina
+
+      - name: Prepare framework dependencies
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          FW_DIR="framework/v${VERSION}"
+          if [ ! -f "${FW_DIR}/package.json" ]; then
+            cat > "${FW_DIR}/package.json" <<EOF
+          {
+            "name": "gina-framework",
+            "version": "${VERSION}",
+            "dependencies": {
+              "@rhinostone/swig": "^1.6.0"
+            }
+          }
+          EOF
+          fi
+          (cd "${FW_DIR}" && npm install --ignore-scripts)
+
+      - name: Install Closure Compiler JARs
+        run: bash framework/v*/core/asset/plugin/lib/js/install-closure-compiler.sh
+
+      - name: Rebuild bundle
+        run: |
+          bash framework/v*/core/asset/plugin/build --env=prod \
+            --sass-bin="$PWD/node_modules/.bin/sass" \
+            --csso-bin="$PWD/node_modules/.bin/csso" \
+            --rjs-bin="$PWD/node_modules/.bin/r.js"
+
+      - name: Verify dist is in sync with source
+        run: |
+          # *.gz files are excluded: gzip output is platform-specific (Apple
+          # gzip on the maintainer's Mac vs GNU gzip on Linux runners produce
+          # different deflate bytes for the same input — even Node's zlib
+          # disagrees Mac↔Linux because it links the system zlib). Brotli IS
+          # cross-platform deterministic (single canonical reference impl),
+          # so the .br files remain checked. If a .css/.js/.html source
+          # changes without a rebuild, the .br diff catches it; the .gz
+          # divergence would have been a false positive.
+          if ! git diff --exit-code -- \
+                  'framework/v*/core/asset/plugin/dist/vendor/gina/' \
+                  ':(exclude)framework/v*/core/asset/plugin/dist/vendor/gina/**/*.gz'; then
+            echo ""
+            echo "::error::Bundle is out of sync with source."
+            echo "::error::A source file under one of the AMD-aliased paths in build.json"
+            echo "::error::was modified without a corresponding rebuilt dist staged."
+            echo "::error::"
+            echo "::error::Locally:"
+            echo "::error::  bash framework/v*/core/asset/plugin/build --env=prod"
+            echo "::error::  git add framework/v*/core/asset/plugin/dist/vendor/gina/"
+            echo "::error::"
+            echo "::error::See llms.txt §72 for the rebuild-gate discipline."
+            exit 1
+          fi
+          echo "Bundle is fresh — dist matches source (excluding *.gz, which is platform-divergent)."

package/.github/workflows/security.yml

@@ -7,8 +7,8 @@ on:
     branches: [develop, master]
 
 jobs:
-  claude-leak-check:
-    name: Claude-leak scan
+  local-leak-check:
+    name: Local-tool leak scan
     runs-on: ubuntu-latest
 
     steps:
@@ -16,17 +16,17 @@ jobs:
 
       # #S6 — Backs up the local pre-commit hook (#S5) and the publish-boundary
       # gate in prepare_version.js (#S3). Fails the build if any tracked path
-      # matches (^|/)(CLAUDE\.md|\.claude[a-z]*). Also retroactively catches
+      # matches local-tool configuration paths. Also retroactively catches
       # leaks that landed before the active defenses were wired.
-      - name: Scan tracked files for Claude-related paths
+      - name: Scan tracked files for local-tool paths
         run: |
           matches=$(git ls-files | grep -iE '(^|/)(CLAUDE\.md|\.claude[a-z]*)' || true)
           if [ -n "$matches" ]; then
-            echo "::error::Claude-related paths detected in git index:"
+            echo "::error::local-tool paths detected in git index:"
             echo "$matches" | sed 's/^/  - /'
             echo ""
             echo "These paths must never be tracked. Remove with: git rm --cached <path>"
             echo "If pushed already, scrub history with git filter-repo."
             exit 1
           fi
-          echo "OK: no Claude-related paths in git index."
+          echo "OK: no local-tool paths in git index."

package/.github/workflows/test.yml

@@ -29,6 +29,23 @@ jobs:
           npm install --ignore-scripts
           ln -sf $(pwd) node_modules/gina
 
+      - name: Prepare framework dependencies
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          FW_DIR="framework/v${VERSION}"
+          if [ ! -f "${FW_DIR}/package.json" ]; then
+            cat > "${FW_DIR}/package.json" <<EOF
+          {
+            "name": "gina-framework",
+            "version": "${VERSION}",
+            "dependencies": {
+              "@rhinostone/swig": "^1.6.0"
+            }
+          }
+          EOF
+          fi
+          (cd "${FW_DIR}" && npm install --ignore-scripts)
+
       - name: Run tests
         run: |
           node --test \

package/.github/workflows/vendored-cve.yml

@@ -0,0 +1,36 @@
+name: Vendored CVE Scan
+
+on:
+  push:
+    branches: [develop, master]
+  pull_request:
+    branches: [develop, master]
+  schedule:
+    # Weekly, Sunday 00:00 UTC — catches CVEs disclosed after the last push.
+    - cron: '0 0 * * 0'
+  workflow_dispatch:
+
+# Cancel any in-flight scan for the same ref when a newer one kicks off.
+concurrency:
+  group: vendored-cve-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: OSV scan on vendored deps
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Scan vendored package.jsons via api.osv.dev
+        run: node .github/scripts/scan-vendored-cves.js

package/.playwright-mcp/console-2026-04-22T21-42-03-731Z.log

@@ -0,0 +1,2 @@
+[     112ms] [ERROR] Failed to load resource: the server responded with a status of 404 (Not Found) @ http://127.0.0.1:41724/_gina/assets/routing.json:0
+[     114ms] [ERROR] Failed to load resource: the server responded with a status of 404 (Not Found) @ http://127.0.0.1:41724/favicon.ico:0

package/.playwright-mcp/page-2026-04-22T21-42-03-861Z.yml

@@ -0,0 +1,3 @@
+- generic [active] [ref=e1]:
+  - heading "gina PSL browser smoke" [level=1] [ref=e2]
+  - generic [ref=e3]: waiting…

package/.playwright-mcp/page-2026-04-22T21-44-40-373Z.yml

@@ -0,0 +1,3 @@
+- generic [active] [ref=e1]:
+  - heading "gina PSL browser smoke" [level=1] [ref=e2]
+  - generic [ref=e3]: Domain ready; psl loaded via RequireJS OK | input="example.com" expected="example.com" actual="example.com" OK | input="sub.example.com" expected="example.com" actual="example.com" OK | input="https://www.google.co.uk/blah" expected="google.co.uk" actual="google.co.uk" OK | input="https://my-bucket.s3.af-south-1.amazon.co.za/puppy.png" expected="amazon.co.za" actual="amazon.co.za" OK | input="Mac-mini.local" expected="Mac-mini.local" actual="Mac-mini.local" OK | input="frontend.myproject.beta.Mac-mini.local" expected="Mac-mini.local" actual="Mac-mini.local" OK | input="api.default.svc.cluster.local" expected="cluster.local" actual="cluster.local" OK | input="192.168.1.5" expected="192.168.1.5" actual="192.168.1.5" OK | input="localhost" expected="localhost" actual="localhost" OK | input="" expected="" actual="" OK | input="россия.xn--p1ai" expected="xn--h1alffa9f.xn--p1ai" actual="xn--h1alffa9f.xn--p1ai" ALL PASS

package/AUTHORS

@@ -1,6 +1,6 @@
 # Authors (sorted alphabetically)
 
-John Doe <fabrice.delaneau@gina.io>
+Fabrice DELANEAU <fabrice.delaneau@gina.io>
 Martin Luther ETOUMAN <martin-luther.etouman@gina.io>
 
 # Contributors (sorted alphabetically)