gina 0.5.20 → 0.5.21

package/framework/{v0.5.20 → v0.5.21}/core/config.js

@@ -413,6 +413,14 @@ function Config(opt, contextResetNeeded) {
         /**
          * Get env config
          *
+         * Non-merged mode (`!self.isStandalone`, bundles on distinct ports):
+         * returns `envConf[bundle][env]` untouched. Merged mode (every bundle
+         * on the same port, one process): additionally normalises the target
+         * bundle's `hostname` to the starting app's (same host:port by
+         * definition). The target bundle's `content.routing` is NEVER
+         * reassigned (#B137) — each bundle keeps its own table, and the
+         * merged view lives in the global `envConf.routing`.
+         *
          * @param {string} bundle
          * @param {string} env
          *
@@ -460,7 +468,17 @@ function Config(opt, contextResetNeeded) {
                     self.envConf[self.startingApp][env].hostname = hostname;
 
                     self.envConf[bundle][env].hostname = self.envConf[self.startingApp][env].hostname;
-                    self.envConf[bundle][env].content.routing = self.envConf[self.startingApp][env].content.routing;
+                    // #B137 — was: self.envConf[bundle][env].content.routing = self.envConf[self.startingApp][env].content.routing;
+                    // The 2015 single-table design aliased the target bundle's routing
+                    // table to the starting app's. Per-bundle `rule@bundle` keying made
+                    // that pure corruption: the starting app's table cannot hold a
+                    // sibling's keys, so the first cross-bundle getUrl permanently
+                    // clobbered the sibling's table — every cross-bundle link rendered
+                    // the literal `404:[<METHOD>]<rule>@<bundle>` marker, and merged-mode
+                    // inbound statics dispatch (loadBundleConfiguration → getRouting)
+                    // could match requests against the wrong bundle's table. The sibling
+                    // keeps its own table; the merged view of all bundles' rules lives
+                    // in the global `envConf.routing` (see setRouting).
 
                     if ( bundle && env ) {
                         return self.envConf[bundle][env]
@@ -1627,6 +1645,10 @@ function Config(opt, contextResetNeeded) {
 
         var c       = 0
             , cLen  = configFiles.length
+            // #B132 — set inside the loop when an iteration resolves a REAL
+            // routing config file (bundle or shared; the env-versioned variant
+            // rides its base file's iteration); enforced right after the loop.
+            , routingConfigSeen = false
         ;
         for (; c < cLen; ++c) {
             let jsonFile = null;
@@ -1756,7 +1778,10 @@ function Config(opt, contextResetNeeded) {
                 }
 
                 if (!exists) {
-                    console.warn('[ ' + app + ' ] [ ' + env + ' ]' + new Error('[ ' + filename + ' ] not found'));
+                    // #B132 rider — `app` was a ReferenceError here (the loop's
+                    // bundle-name variable is `bundle`), so this readdir-race
+                    // warn could never actually fire: it crashed instead.
+                    console.warn('[ ' + bundle + ' ] [ ' + env + ' ]' + new Error('[ ' + filename + ' ] not found'));
                 } else {
                     jsonFile = requireJSON(_(filename, true));
                 }
@@ -1798,8 +1823,30 @@ function Config(opt, contextResetNeeded) {
                 files[name] = merge(files[name], fileContent);
             }
 
+            // #B132 — `exists` here reflects the MAIN config file (bundle dir or
+            // the shared-config fallback); a readdir↔existsSync race lands false
+            // and correctly routes to the post-loop refusal (supervisor retry).
+            if ( name == 'routing' && exists ) {
+                routingConfigSeen = true;
+            }
 
         } // EO for (var c = 0, cLen = configFiles.length; c < cLen; ++c)
+
+        // #B132 — fail fast on a missing/unreadable routing config. Hydration is
+        // readdir-driven: a config/routing.json absent at boot readdir time is
+        // never iterated, so the bundle's table would silently hold only the
+        // framework-synthetic routes and every app route 404s (or a sibling
+        // bundle's cross-bundle route lookup throws) hours later with no
+        // boot-time signal. A declared bundle without a readable routing config
+        // is a broken deployment (deploy still in progress?) — refuse to start,
+        // matching the malformed-JSON path above (callback(err) leads to
+        // process.exit(1)); the supervisor restart then retries until the
+        // release tree settles.
+        if (!routingConfigSeen) {
+            e = '[ ' + bundle + ' ][ ' + env + ' ] config/routing.json not found — a declared bundle without a readable routing config is a broken deployment (deploy still in progress?); refusing to start';
+            console.error(e);
+            return callback(new Error(e));
+        }
         conf[bundle][env] = merge(files, conf[bundle][env]);
 
         // building file list

package/framework/{v0.5.20 → v0.5.21}/core/controller/controller.render-json.js

@@ -211,12 +211,17 @@ module.exports = function renderJSON(jsonObj, deps) {
                 }
             } catch (err){
                 response.statusCode    = 500;
+                // #B131 — the reason phrase must be a short single line: a multi-line
+                // stack is invalid on the HTTP/1.1 status line (Node rejects the write)
+                // and would leak internal paths + frames to the client. The stack goes
+                // to the server log instead.
+                console.error('[ RENDER-JSON ] status resolution failed: ', err.stack||err.message||err);
                 // HTTP/2 (RFC7540 8.1.2.4):
                 // This standard for HTTP/2 explicitly states that status messages are not supported.
                 // In HTTP/2, the status is conveyed solely by the numerical status code (e.g., 200, 404, 500),
                 // and there is no field for a human-readable status message.
                 if ( !/http\/2/.test(local.options.conf.server.protocol) ) {
-                    response.statusMessage = err.stack;
+                    response.statusMessage = err.message || 'Internal Server Error';
                 }
             }
         }

package/framework/{v0.5.20 → v0.5.21}/core/controller/controller.render-swig.js

@@ -209,21 +209,38 @@ module.exports = async function render(userData, displayInspector, errOptions, d
     // When present, every framework-injected inline <script> carries a matching
     // nonce="..." attribute so a bundle can drop 'unsafe-inline' from script-src.
     var _cspNonce   = (req && req._ginaCspNonce) ? req._ginaCspNonce : null;
-    // Stamp the onGinaLoaded bootstrap <script> with the nonce. The loader tag is
-    // a cached, immutable string (config.js builds it once) — .replace() returns a
-    // fresh string and never mutates the shared cache. No-op when no nonce is set.
+    // Stamp the onGinaLoaded bootstrap <script> with a RENDER-TIME nonce template
+    // (#B130). The loader tag flows into the swig-compiled layout, and the compiled
+    // template is CACHED per view on serverInstance._cached — so a literal nonce
+    // here would be frozen at first compile while the Csp middleware mints a fresh
+    // one per request (header != markup on every later request for the view).
+    // Injecting swig tags instead keeps the cached artifact nonce-agnostic: the
+    // conditional re-evaluates on every compiledTemplate(data) execute against
+    // data.page.cspNonce, which BOTH the cache-hit and compile branches assign
+    // pre-execute. The loader tag itself is a cached, immutable string (config.js
+    // builds it once) — .replace() returns a fresh string and never mutates the
+    // shared cache. No-op when no nonce is set (non-CSP deployments bake the
+    // plain tag, byte-identical to before).
     var _nonceLoader = function (loaderTag) {
         if (_cspNonce && typeof loaderTag === 'string') {
             return loaderTag.replace(
                 '<script type="text/javascript">',
-                '<script type="text/javascript" nonce="' + _cspNonce + '">'
+                '<script type="text/javascript"{% if page.cspNonce %} nonce="{{ page.cspNonce }}"{% endif %}>'
             );
         }
         return loaderTag;
     };
-    // #HDR5 — nonce attribute fragment for the dev-only Inspector + metrics-patch
-    // inline <script>s (assembled as JS strings below). '' when no nonce is set.
+    // #HDR5 — nonce attribute fragment for POST-EXECUTE inline-<script> injections
+    // (release banner, cache-patch scripts): those splice into htmlContent after
+    // compiledTemplate(data) ran, so the literal per-request value is correct.
+    // '' when no nonce is set.
     var _cspNonceAttr = _cspNonce ? (' nonce="' + _cspNonce + '"') : '';
+    // #B130 — TEMPLATE form of the same attr for inline <script>s that are baked
+    // into the swig-compiled layout PRE-compile (the dev Inspector __ginaData /
+    // __ginaLogs pair): the compiled template is cached per view, so a literal
+    // value would freeze at first compile. The swig conditional re-evaluates per
+    // execute — the same mechanism the statusbar include already uses.
+    var _cspNonceTplAttr = _cspNonce ? '{% if page.cspNonce %} nonce="{{ page.cspNonce }}"{% endif %}' : '';
     // Using server cache to cache compiledTemplates
     cache.from(self.serverInstance._cached);
     // Output/render cache goes through the strategy dispatcher (same shared store).
@@ -893,6 +910,27 @@ module.exports = async function render(userData, displayInspector, errOptions, d
         assets  = {assets:"${assets}"};
         // replaced: fs.readFileSync — async read (#P29)
         layout = await fs.promises.readFile(layoutPath, 'utf8');
+        // #B130 upgrade path — in cached mode the layout-cache file persists the
+        // INJECTED layout (it is the {% extends %} target swig compiles from) and
+        // is only re-primed when missing, so a file written by a pre-#B130 build
+        // still carries the bootstrap loader (and, dev+cache, the Inspector
+        // scripts) with a frozen LITERAL nonce baked in — and the injection
+        // guards below skip re-injection because onGinaLoaded is already there.
+        // Normalize those literals to the render-time conditional; anchored on
+        // each script's own idiom (the loader's `<!--` wrapper from config.js,
+        // the Inspector scripts' window.__gina* openers), idempotent (the
+        // conditional form no longer matches), and persisted back by the
+        // layout-cache write below, so this heals once per stale file.
+        if ( /<script( type="text\/javascript")? nonce="/.test(layout) ) {
+            layout = layout.replace(
+                /<script type="text\/javascript" nonce="[^"]*">(\s*<!--)/g,
+                '<script type="text/javascript"{% if page.cspNonce %} nonce="{{ page.cspNonce }}"{% endif %}>$1'
+            );
+            layout = layout.replace(
+                /<script nonce="[^"]*">(window\.__gina(Data|Logs))/g,
+                '<script{% if page.cspNonce %} nonce="{{ page.cspNonce }}"{% endif %}>$1'
+            );
+        }
         // Loading from cache
         if (
             String(self.serverInstance._cacheIsEnabled).toLowerCase() === 'true'
@@ -1346,7 +1384,7 @@ module.exports = async function render(userData, displayInspector, errOptions, d
                 replacement      : _redactConf.replacement
             });
 
-            var __gdScript = '<script' + _cspNonceAttr + '>window.__ginaData = '
+            var __gdScript = '<script' + _cspNonceTplAttr + '>window.__ginaData = '
                 + JSON.stringify(__gdPayload)
                     .replace(/<\/script>/gi, '<\\/script>')
                     .replace(/<!--/g, '<\\!--')
@@ -1362,7 +1400,7 @@ module.exports = async function render(userData, displayInspector, errOptions, d
             }
             process.emit('inspector#data', __gdPayload);
 
-            var __logsScript = '<script' + _cspNonceAttr + '>'
+            var __logsScript = '<script' + _cspNonceTplAttr + '>'
                 + 'window.__ginaLogs = window.__ginaLogs || [];'
                 + '(function(w){'
                 + 'var _c=w.console,_l=w.__ginaLogs,_b="' + (__gdUser.environment && __gdUser.environment.bundle || '') + '";'

package/framework/{v0.5.20 → v0.5.21}/core/plugins/lib/validator/src/main.js

@@ -3863,6 +3863,24 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                             handleErrorsDisplay($gForm, gResult.error, gResult.data, _touchedField);
                                         }
                                     }
+                                    // #B136 — the fresh global pass is VALID but the store still
+                                    // holds errors from an earlier pass (e.g. a cross-field
+                                    // comparison fixed by ANOTHER control's change: a checkbox
+                                    // handler raising the compared field). Every stored error is
+                                    // stale — clear each previously-errored field's display, not
+                                    // just the touched field's, so the re-enabled submit trigger
+                                    // never sits beside a stale blocking-error message.
+                                    // handleErrorsDisplay's empty-errors path also prunes the
+                                    // per-field bookkeeping; new errors are never rendered here
+                                    // (untouched-field display still waits for interaction or
+                                    // submit).
+                                    else if ( isFormValid && instance.$forms[formId].errors && instance.$forms[formId].errors.count() > 0 ) {
+                                        var staleErrors = instance.$forms[formId].errors;
+                                        instance.$forms[formId].errors = {};
+                                        for (var staleField in staleErrors) {
+                                            handleErrorsDisplay($gForm, {}, null, staleField);
+                                        }
+                                    }
                                     // Fixed on 2025-03-16
                                     // Eg.: input select change impacting another element: solve `no more errors`
                                     else if ( instance.$forms[formId].errors && !instance.$forms[formId].errors.count() ) {
@@ -4075,7 +4093,19 @@ function ValidatorPlugin(rules, data, formId, culture) {
      * handleAutoComplete
      * This is a temporary fix to handle safari autocomplete/autosuggest
      * Will be removed when Safari honores autocomplete="off"
+     *
+     * Intercepts keydown on the field (preventDefault + a programmatic value
+     * rebuild behind a transient readonly) so the browser never sees typing
+     * and offers no autofill/autosuggest. Modifier chords (metaKey/ctrlKey)
+     * are deliberately NOT intercepted (#B134): they return before
+     * preventDefault so the native select-all/copy/paste/cut/undo defaults
+     * run — the rebuild cannot reproduce them.
+     *
+     * Gated to REAL Safari at the registerForLiveChecking call site (#B135):
+     * Chromium UAs carry the Safari token but were never this workaround's
+     * target — they get native behavior.
      * @param {object} $el HTMLElement
+     * @param {number} [liveCheckTimer] - live-check debounce handle, cleared per intercepted keystroke
      */
     var handleAutoComplete = function($el, liveCheckTimer) {
 
@@ -4096,6 +4126,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
             // add once
             if ( typeof(gina.events[evtName]) == 'undefined' ) {
                 addListener(gina, event.currentTarget, evtName, function(e) {
+                    // #B134 — modifier chords are NOT intercepted: return before
+                    // preventDefault so the native select-all/copy/paste/cut/undo
+                    // defaults run. The rebuild below cannot reproduce them — the
+                    // printable branch typed the chord letter into the field
+                    // (Cmd+A appended "a") and execCommand("paste") is inert in
+                    // unprivileged web content. The field is not readonly here
+                    // (focusin removed it), so the native edit lands and the
+                    // live-check picks it up on the keyup that follows.
+                    if ( e.metaKey || e.ctrlKey ) {
+                        return;
+                    }
                     e.preventDefault();
                     clearTimeout(liveCheckTimer);
 
@@ -4179,53 +4220,61 @@ function ValidatorPlugin(rules, data, formId, culture) {
                             }
                             break;
                         // Shortcuts
-                        case 17: // CTRL
-                        case 91: // CMD
-                            console.debug("CMD, CTRL hit");
-                            e.preventDefault();
-                            break;
-                        case 67: // to handle CMD+C (copy)
-                            if (
-                                keyboardMapping[67] && keyboardMapping[91] // mac osx
-                                ||
-                                keyboardMapping[67] && keyboardMapping[17] // windows
-                            ) {
-                                $_el.setSelectionRange(posStart, posEnd);
-                                document.execCommand("copy");
-                                break;
-                            }
-                        case 86: // to handle CMD+V (paste)
-                            if (
-                                keyboardMapping[86] && keyboardMapping[91] // mac osx
-                                ||
-                                keyboardMapping[86] && keyboardMapping[17] // windows
-                            ) {
-                                if (posStart != posEnd) {
-                                    $_el.value = $_el.value.replace(str.substring(posStart, posEnd), '');
-                                }
-                                setCaretToPos($_el, posStart);
-                                document.execCommand("paste");
-                                break;
-                            }
-                        case 88: // to handle CMD+X (cut)
-                            if (
-                                keyboardMapping[88] && keyboardMapping[91] // mac osx
-                                ||
-                                keyboardMapping[88] && keyboardMapping[17] // windows
-                            ) {
-                                $_el.setSelectionRange(posStart, posEnd);
-                                document.execCommand("cut");
-                                break;
-                            }
-                        case 90: // to handle CMD+Z (undo)
-                            if (
-                                keyboardMapping[90] && keyboardMapping[91] // mac osx
-                                ||
-                                keyboardMapping[90] && keyboardMapping[17] // windows
-                            ) {
-                                $_el.value = $_el.defaultValue;
-                                break;
-                            }
+                        // #B134 — the modifier-chord cases below are unreachable
+                        // since the e.metaKey/e.ctrlKey bail at the top of this
+                        // handler: chords now run natively, and the native
+                        // copy/cut/paste/select-all/undo defaults are correct
+                        // where these re-implementations were not (the paste
+                        // re-implementation was inert in unprivileged web
+                        // content, and undo-to-defaultValue wiped user input).
+                        // Kept commented for the record.
+                        // case 17: // CTRL
+                        // case 91: // CMD
+                        //     console.debug("CMD, CTRL hit");
+                        //     e.preventDefault();
+                        //     break;
+                        // case 67: // to handle CMD+C (copy)
+                        //     if (
+                        //         keyboardMapping[67] && keyboardMapping[91] // mac osx
+                        //         ||
+                        //         keyboardMapping[67] && keyboardMapping[17] // windows
+                        //     ) {
+                        //         $_el.setSelectionRange(posStart, posEnd);
+                        //         document.execCommand("copy");
+                        //         break;
+                        //     }
+                        // case 86: // to handle CMD+V (paste)
+                        //     if (
+                        //         keyboardMapping[86] && keyboardMapping[91] // mac osx
+                        //         ||
+                        //         keyboardMapping[86] && keyboardMapping[17] // windows
+                        //     ) {
+                        //         if (posStart != posEnd) {
+                        //             $_el.value = $_el.value.replace(str.substring(posStart, posEnd), '');
+                        //         }
+                        //         setCaretToPos($_el, posStart);
+                        //         document.execCommand("paste");
+                        //         break;
+                        //     }
+                        // case 88: // to handle CMD+X (cut)
+                        //     if (
+                        //         keyboardMapping[88] && keyboardMapping[91] // mac osx
+                        //         ||
+                        //         keyboardMapping[88] && keyboardMapping[17] // windows
+                        //     ) {
+                        //         $_el.setSelectionRange(posStart, posEnd);
+                        //         document.execCommand("cut");
+                        //         break;
+                        //     }
+                        // case 90: // to handle CMD+Z (undo)
+                        //     if (
+                        //         keyboardMapping[90] && keyboardMapping[91] // mac osx
+                        //         ||
+                        //         keyboardMapping[90] && keyboardMapping[17] // windows
+                        //     ) {
+                        //         $_el.value = $_el.defaultValue;
+                        //         break;
+                        //     }
                         default:
                             // Replace selection
                             if (e.key.length > 1) {
@@ -4294,9 +4343,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 addLiveForInput($form, $el, liveCheckTimer, isCustomEl);
                 if ( !isCustomEl ) {
                     // Bypass Safari autocomplete (native inputs only)
+                    // #B135 — REAL Safari only: every Chromium UA (Chrome/Edge/
+                    // Brave/Opera...) also carries the "Safari/537.36" token, so
+                    // the bare /safari/i test matched them all and ran this
+                    // WebKit workaround where it was never intended (see the
+                    // handleAutoComplete header). WebKit-on-iOS third-party
+                    // browsers (CriOS/FxiOS/EdgiOS — no "Chrome"/"Chromium"
+                    // token) stay matched on purpose: they run Safari's engine.
                     var isAutoCompleteField = $el.getAttribute('autocomplete');
                     if (
                         /safari/i.test(navigator.userAgent)
+                        && !/chrom(e|ium)/i.test(navigator.userAgent)
                         && isAutoCompleteField
                         && /^(off|false)/i.test(isAutoCompleteField)
                     ) {
@@ -5608,6 +5665,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                 handleErrorsDisplay($gForm, gResult.error, gResult.data, _touchedField);
                             }
                         }
+                        // #B136 — same stale-clear as processEvent's global pass (keep the
+                        // two copies in sync): the fresh pass is valid but the store still
+                        // holds earlier errors — clear each previously-errored field's
+                        // display, not just the touched field's.
+                        else if ( isFormValid && instance.$forms[formId].errors && instance.$forms[formId].errors.count() > 0 ) {
+                            var staleErrors = instance.$forms[formId].errors;
+                            instance.$forms[formId].errors = {};
+                            for (var staleField in staleErrors) {
+                                handleErrorsDisplay($gForm, {}, null, staleField);
+                            }
+                        }
 
                         updateSubmitTriggerState( $gForm, isFormValid);
                         once = false;

package/framework/{v0.5.20 → v0.5.21}/core/server.isaac.js

@@ -2163,9 +2163,20 @@ function ServerEngineClass(options) {
                         // only; the shared handle() read (server.js) labels detail=redis.
                         cacheStatus += '; detail=' + ( (typeof(cachedContentObj.fromMemory) != 'undefined') ? 'memory' : 'fs' );
 
+                        // #B130 — same re-nonce as server.js serveRenderCacheHit (keep in
+                        // sync): a hit replays the WRITING request's stored headers + body;
+                        // when the stored CSP header carries a nonce, mint fresh + rewrite
+                        // the header copy and the body occurrences so nonces stay
+                        // per-response. The stored entry is never mutated.
+                        var _rn = lib.RenderCache.renonceCspHeaders(
+                            ( typeof(cachedContentObj.responseHeaders) != 'undefined' )
+                                ? cachedContentObj.responseHeaders
+                                : null
+                        );
                         if ( typeof(cachedContentObj.responseHeaders) != 'undefined' ) {
-                            for (let h in cachedContentObj.responseHeaders ) {
-                                response.setHeader(h, cachedContentObj.responseHeaders[h]);
+                            let _rnHeaders = _rn ? _rn.headers : cachedContentObj.responseHeaders;
+                            for (let h in _rnHeaders ) {
+                                response.setHeader(h, _rnHeaders[h]);
                             }
                         }
                         response.setHeader('Cache-Status', cacheStatus);
@@ -2195,15 +2206,39 @@ function ServerEngineClass(options) {
                             typeof(cachedContentObj.fromMemory) != 'undefined'
                         ) {
                             console.info(request.method +' [200]['+ cacheStatus +'] '+ request.url);
-                            return response.end(cachedContentObj.content);
+                            return response.end(
+                                _rn
+                                    ? lib.RenderCache.swapNonces(cachedContentObj.content, _rn.oldNonces, _rn.nonce)
+                                    : cachedContentObj.content
+                            );
                         }
 
                         filename  =  _(cachedContentObj.filename, true);
 
+                        if ( _rn ) {
+                            // #B130 — the re-nonced body needs the whole content in hand;
+                            // buffer the disk read-back instead of streaming. Only fires
+                            // when the stored headers carry a CSP nonce — nonce-less
+                            // entries keep the streaming path below byte-identical.
+                            return fs.readFile(filename, 'utf8', function onCachedFileRenonce(err, fileContent) {
+                                if (err) {
+                                    console.error("[SERVER][CACHE][FILE ERROR] ", err.stack||err.message||err);
+                                    // message-only on the wire — the stack stays in the log above
+                                    return response.end(''+ (err.message || err));
+                                }
+                                console.info(request.method +' [200] '+ request.url);
+                                return response.end( lib.RenderCache.swapNonces(fileContent, _rn.oldNonces, _rn.nonce) );
+                            });
+                        }
+
                         return fs.createReadStream(filename)
                             .on('error', function onError(err) {
                                 console.error("[SERVER][CACHE][FILE ERROR] ", err.stack||err.message||err);
-                                return response.end(''+ (err.stack||err.message||err));
+                                // #B131 — message-only on the wire, aligned with the
+                                // onCachedFileRenonce buffered sibling above; the stack
+                                // stays in the log line above (it previously led the
+                                // wire fallback chain, putting frames on the wire).
+                                return response.end(''+ (err.message || err));
                             })
                             .on('end', function onResponse(){
                                 console.info(request.method +' [200] '+ request.url);

package/framework/{v0.5.20 → v0.5.21}/core/server.js

@@ -5571,9 +5571,19 @@ function Server(options) {
             _remaining = Math.max(0, Math.floor( (hit.createdAt.getTime() + Math.round(hit.ttl * 1000) - Date.now()) / 1000 ));
         }
         var _vis = ( hit.visibility === 'public' ) ? 'public' : 'private';
+        // #B130 — a hit replays the STORED headers + body, both minted by the request
+        // that WROTE the entry. When the stored CSP header carries a nonce, replaying
+        // the pair verbatim would reuse one nonce for every client of this URL until
+        // the TTL (and the Csp middleware never re-mints here — the hit short-circuits
+        // dispatch). Mint fresh + rewrite the header copy AND the body occurrences so
+        // nonces stay per-response. The stored entry is never mutated.
+        // Keep in sync with the isaac pre-routing read (server.isaac.js).
+        var _rn         = lib.RenderCache.renonceCspHeaders(hit.responseHeaders || null);
+        var _hitContent = _rn ? lib.RenderCache.swapNonces(hit.content, _rn.oldNonces, _rn.nonce) : hit.content;
         // The page's own headers first, then the cache metadata.
         if ( hit.responseHeaders ) {
-            for (var h in hit.responseHeaders) { res.setHeader(h, hit.responseHeaders[h]); }
+            var _hitHeaders = _rn ? _rn.headers : hit.responseHeaders;
+            for (var h in _hitHeaders) { res.setHeader(h, _hitHeaders[h]); }
         }
         // #RC5 — ONE header string, set AND logged from the same var (the prior dual
         // construction at setHeader + console.info was a drift hazard).
@@ -5595,12 +5605,12 @@ function Server(options) {
                 var _pending = res.getHeaders ? res.getHeaders() : {};
                 for (var ph in _pending) { _sh[ph] = _pending[ph]; }
                 res.stream.respond(_sh);
-                res.stream.end(hit.content);
+                res.stream.end(_hitContent);
                 res.headersSent = true;
             }
         } else {
             if ( !res.headersSent && !res.writableEnded ) {
-                res.end(hit.content);
+                res.end(_hitContent);
             }
         }
         console.info(req.method + ' [200][' + _cs + '] ' + (req.originalUrl || req.url));
@@ -6192,6 +6202,37 @@ function Server(options) {
         var bundleConf      = self.conf[self.appName][self.env];
         var _h1ContentType  = null;
 
+        // #B131 — scope-gated stack egress. Feeders (router.js action/middleware
+        // catches, server.js internals) pass `err.stack` pre-flattened as `msg`,
+        // so outside local scope every emit below (the JSON XHR/API branches, the
+        // inline HTML fallback, the custom-error page data built from `err`) would
+        // carry absolute framework paths + stack frames to HTTP clients. Outside
+        // local scope: log the full text server-side (before this gate it only
+        // survived via the wire), then send the message line only / strip the
+        // field. Local scope stays byte-identical — the dev toolbar reads the
+        // stack. The gate reads self.isLocalScope() — the same NODE_SCOPE_IS_LOCAL
+        // env read as controller.js's module-level scope cache (both set once at
+        // gna.js bootstrap), so the server-side and controller-side throwError
+        // gates can never disagree. bundleConf.server.scopeIsLocal was rejected:
+        // it derives from projects.json def_scope (config.js), which can lag the
+        // RUNTIME scope of a boot started with an explicit NODE_SCOPE/--scope.
+        var sanitizeWireError = function(m, c) {
+            if ( self.isLocalScope() ) {
+                return m;
+            }
+            if ( typeof(m) == 'string' && /\n\s+at\s/.test(m) ) {
+                console.error('[ BUNDLE ][ '+ self.appName +' ] '+ local.request.method +' [ '+ c +' ] '+ local.request.url +'\n'+ m);
+                return m.split('\n')[0];
+            }
+            if ( m && typeof(m) == 'object' && typeof(m.stack) != 'undefined' ) {
+                console.error('[ BUNDLE ][ '+ self.appName +' ] '+ local.request.method +' [ '+ c +' ] '+ local.request.url +'\n'+ m.stack);
+                m = JSON.clone(m);
+                delete m.stack;
+            }
+            return m;
+        };
+        msg = sanitizeWireError(msg, code);
+
         if ( typeof(msg) != 'object' ) {
             err = {
                 code    : code,
@@ -6211,6 +6252,9 @@ function Server(options) {
                 if ( typeof(code) == 'object' && !msg && typeof(code.status) != 'undefined' && typeof(code.error) != 'undefined' ) {
                     msg     = code.error;
                     code    = code.status;
+                    // #B131 — the 1-arg errorObject shape lands `msg` after the
+                    // top-of-function gate already ran; sanitize the reshaped value too.
+                    msg     = sanitizeWireError(msg, code);
                 }
 
                 // Internet Explorer override

package/framework/{v0.5.20 → v0.5.21}/core/template/conf/env.json

@@ -90,7 +90,13 @@
         // },
         "response": {
           "header": {
-            "accept-language": "en-US,en;q=0.8,fr;q=0.6"
+            // Accept-Language is a REQUEST header — meaningless on responses.
+            // The framework default used to declare it here, so every response
+            // (error responses included) emitted a hardcoded accept-language;
+            // removed (#B133). A project/bundle env.json may still declare any
+            // response header in this block — the override path is intact, and
+            // the controller's request-fallback read of a declared value in
+            // this block is kept.
             // X-Powered-By is intentionally NOT set here.
             // The framework emits `X-Powered-By: Gina/<version>` from its
             // per-request emission in core/server.js (BOTH engines), gated on