gina 0.6.2 → 0.6.3

package/framework/{v0.6.2 → v0.6.3}/core/controller/controller.js

@@ -1492,6 +1492,46 @@ function SuperController(options) {
         // delegate fetches the nunjucks module itself via
         // `lib.nunjucksResolver.get()`, so the `swig` / `SwigFilters` deps
         // passed below are harmless when unused.
+        // #SPA1 — content negotiation, resolved BEFORE the delegate is chosen because
+        // this is the one place all four HTML delegates converge and where `local.req`
+        // (routing + gina headers) and `local.res` are both live. Two independent effects:
+        //
+        //   (a) a NEGOTIABLE route ALWAYS advertises `Vary: X-Gina-Navigate` — a cache
+        //       must be told the response varies whether or not THIS request asked for a
+        //       fragment. Set via res.setHeader so it reaches both engines: every HTTP/2
+        //       send site folds res.getHeaders() into stream.respond(). `completeHeaders`
+        //       is NOT usable for this — it runs at server.js:6452, before the params
+        //       block builds req.routing, so the flag would not exist yet (measured).
+        //
+        //   (b) `X-Gina-Navigate: fragment` reuses the PROVEN layoutless path by setting
+        //       isWithoutLayout, rather than adding a fifth delegate. A custom-error
+        //       render is unaffected by construction: those delegates read `errOptions`,
+        //       not `local.options`.
+        //
+        // Wrapped so an absent/undeclared flag leaves the default path byte-identical,
+        // and so any unexpected value simply falls through to the full page.
+        try {
+            if ( local.req && local.req.routing && local.req.routing.negotiate === true ) {
+                var _navRes = local.res;
+                if ( _navRes && typeof(_navRes.setHeader) == 'function' && !_navRes.headersSent ) {
+                    var _existingVary = ( typeof(_navRes.getHeader) == 'function' ) ? _navRes.getHeader('vary') : null;
+                    if ( !_existingVary ) {
+                        _navRes.setHeader('vary', 'X-Gina-Navigate');
+                    } else if ( !/x-gina-navigate/i.test( String(_existingVary) ) ) {
+                        // Vary is a LIST header — append, never clobber a sibling value
+                        // (the CORS paths set `vary: Origin`).
+                        _navRes.setHeader('vary', String(_existingVary) + ', X-Gina-Navigate');
+                    }
+                }
+                if ( local.req.ginaHeaders && local.req.ginaHeaders.navigate === 'fragment' ) {
+                    local.options.isWithoutLayout = true;
+                }
+            }
+        } catch (negotiationErr) {
+            // Negotiation is an enhancement — it must never break a render.
+            console.warn('[#SPA1] content negotiation skipped: '+ (negotiationErr.message || negotiationErr));
+        }
+
         var _engine = 'swig';
         try {
             var _settings = local.options
@@ -2864,35 +2904,75 @@ function SuperController(options) {
     /**
      * Move files to assets dir
      *
-     * @param {object} res
-     * @param {collection} files
+     * #B223 — each move streams the source into a temp sibling
+     * (`<target>.<pid>.<rand>.tmp`) inside the destination directory, then
+     * publishes it with an atomic `rename(2)`: a reader never observes a
+     * partial file under the final name, and a pre-existing destination is
+     * replaced atomically instead of being deleted up front. Failures settle
+     * the callback ONCE with the real filesystem `Error` — source-side stream
+     * errors included (they previously had no listener, so a source vanishing
+     * mid-move escalated to an uncaughtException that killed the bundle
+     * process) — and a failed move never consumes the source file.
+     *
+     * @inner
+     * @param {number} i - Current index in `files`
+     * @param {object} res - Response reference (unused; kept for signature stability)
+     * @param {array} files - `{ source, target }` pairs — spliced as moves complete
      *
      * @callback cb
-     * @param {object} [err]
+     * @param {Error|boolean} err - `false` once every file moved; the real `Error` on the first failure
      * */
     var movefiles = function (i, res, files, cb) {
         if (!files.length || files.length == 0) {
             cb(false)
         } else {
-            if ( fs.existsSync(files[i].target) ) new _(files[i].target).rmSync();
+            // #B223 — no destination pre-delete: the atomic rename below replaces
+            // it only once the new content is fully written
+            // was: if ( fs.existsSync(files[i].target) ) new _(files[i].target).rmSync();
+            var _tmpTarget  = files[i].target + '.' + process.pid + '.' + Math.random().toString(36).slice(2, 8) + '.tmp';
+            var _settled    = false;
 
             var sourceStream = fs.createReadStream(files[i].source);
-            var destinationStream = fs.createWriteStream(files[i].target);
+            // was: var destinationStream = fs.createWriteStream(files[i].target);
+            var destinationStream = fs.createWriteStream(_tmpTarget);
+
+            var onMoveError = function (err) {
+                if (_settled) return;
+                _settled = true;
+                try { destinationStream.destroy() } catch (_e) {}
+                try { if ( fs.existsSync(_tmpTarget) ) fs.unlinkSync(_tmpTarget) } catch (_e) {}
+                cb(err)
+            };
+
+            // #B223 — the source stream previously had NO error listener: an
+            // unreadable/vanished source raised an unhandled 'error' event
+            sourceStream.on('error', onMoveError);
 
             sourceStream
                 .pipe(destinationStream)
-                .on('error', function () {
-                    var err = 'Error on SuperController::copyFile(...): Not found ' + files[i].source + ' or ' + files[i].target;
-                    cb(err)
-                })
+                .on('error', onMoveError)
                 .on('close', function () {
+                    // 'close' also follows 'error' on an autoDestroyed stream — the
+                    // settled latch keeps a failed move from resuming the loop (the
+                    // pre-fix shape settled the callback a second time, as a success,
+                    // and unlinked the source of a move that had just failed)
+                    if (_settled) return;
 
+                    try {
+                        fs.renameSync(_tmpTarget, files[i].target);
+                    } catch (err) {
+                        return onMoveError(err)
+                    }
                     try {
                         fs.unlinkSync(files[i].source);
-                        files.splice(i, 1);
                     } catch (err) {
-                        cb(err)
+                        // the source vanishing AFTER a successful publish is not a
+                        // move failure (e.g. the upload tmp-cleanup timer took it)
+                        if (err.code != 'ENOENT') {
+                            return onMoveError(err)
+                        }
                     }
+                    files.splice(i, 1);
 
                     movefiles(i, res, files, cb)
                 })
@@ -3240,17 +3320,30 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
      * You only need to provide the destination path
      * Use `cb` callback or `onComplete` event
      *
+     * Files are published atomically (temp sibling + rename — #B223), so a
+     * reader never observes a partially-written file under the final name.
+     *
      * @param {string} target is the upload dir destination
      * @param {array} [files]
      *
      * @callback [cb]
-     *  @param {object} error
+     *  @param {Error|boolean} error - `false` on success; the real move `Error`
+     *    on failure (`No file to upload` only when there was nothing to store)
      *  @param {array} files
      *
      * @event
      *  @param {object} error
      *  @param {array} files
      *
+     * @example
+     * // store the request's uploaded files, surfacing the real failure cause
+     * self.store(uploadDir, req.files, function onStored(err, files) {
+     *     if (err) {
+     *         // err.code carries the filesystem diagnostic (EACCES, ENOSPC, ENOENT, ...)
+     *         return self.throwError(500, err);
+     *     }
+     *     self.renderJSON({ files: files });
+     * });
      * */
     this.store = async function(target, files, cb) {
 
@@ -3322,10 +3415,15 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 
                     movefiles(0, local.res, list, function (err) {
                         if (err) {
+                            // #B223 — surface the REAL move error: every failure used
+                            // to be reported as the fabricated empty-upload message,
+                            // masking the actual filesystem diagnostics (ENOSPC,
+                            // EACCES, a vanished source, ...)
+                            var _moveErr = ( err instanceof Error ) ? err : new Error(String(err));
                             if (cb) {
-                                cb(new Error('No file to upload'))
+                                cb(_moveErr)
                             } else {
-                                self.emit('uploaded', new Error('No file to upload'))
+                                self.emit('uploaded', _moveErr)
                             }
                         } else {
                             if (cb) {
@@ -5859,7 +5957,10 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
     /**
      * Snapshot the current request as a `haltedRequest` and store it in `requestStorage`.
      * Typically called before redirecting to a login page so the original request can be
-     * replayed after authentication via `resumeRequest()`.
+     * replayed after authentication via `resumeRequest()`. The snapshotted `url` is the
+     * byte-exact incoming URL — `req.originalUrl` when the engine preserves it (the isaac
+     * engine strips the query string from `req.url` before controllers run; express's own
+     * `originalUrl` is native), falling back to `req.url` for requests without it.
      *
      * @param {object} data               - Current action data to preserve
      * @param {object} [requestStorage]   - Storage target; defaults to `req.session`
@@ -5887,7 +5988,15 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             , res           = local.res
             , next          = local.next
             , haltedRequest = {
-                url     : req.url,
+                // #B219 — the isaac engine strips the query string from req.url before
+                // controllers run (the query is parsed into req.get); the byte-exact
+                // incoming URL survives on req.originalUrl, stamped as the engine
+                // listener's first statement. Express sets originalUrl natively and does
+                // not strip. Snapshot the preserved URL so the #B215 byte-exact replay
+                // actually carries the query; bare/harness requests without the property
+                // keep the historical req.url source.
+                // was: url     : req.url,
+                url     : req.originalUrl || req.url,
                 routing : req.routing,
                 method  : req.method.toLowerCase(),
                 data    : JSON.clone(data)
@@ -5930,9 +6039,13 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
      * Replay a previously paused request (see `pauseRequest()`). Reads the `haltedRequest`
      * snapshot from `requestStorage` (defaulting to `req.session`), restores the original
      * url / method / data / params onto the live request, then re-dispatches it: a GET is
-     * replayed by redirecting to the resolved url; a non-GET is re-dispatched in-process to
-     * the original controller action (crossing namespaces via `requireController()` when
-     * needed). The snapshot is cleared from storage once consumed. For a GET replay, the
+     * replayed by redirecting to the byte-exact halted URL — query string included —
+     * whenever a live session exists (#B215; with no live session the URL is recomposed
+     * from the route pattern plus the snapshotted params, or the halted data as query
+     * params — the composed URL being the data's only travel channel there); a non-GET is
+     * re-dispatched in-process to the original controller action (crossing namespaces via
+     * `requireController()` when needed). The snapshot is cleared from storage once
+     * consumed. For a GET replay, the
      * halted request's extra data rides the session flash channel (`inheritedData`,
      * consumed one-shot by the next routed GET) whenever a live session exists — a custom
      * `requestStorage` with no live session degrades to a plain replay without the data.
@@ -6003,7 +6116,26 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
         if (data.count() > 0) {
             dataAsParams = JSON.clone(haltedRequest.data);
         }
-        var url             = lib.routing.getRoute(haltedRequest.routing.rule, haltedRequest.params||dataAsParams).url;
+        // #B215 — replay the byte-exact halted URL (query string included) whenever a
+        // live session exists. The recompose below only carries query keys captured
+        // into `req.params` during the original match (keys declared in BOTH the
+        // rule's `requirements` AND `param`): a key bound in `param` only substitutes
+        // its `:key` placeholders at match-commit yet never reaches req.params, and an
+        // undeclared key never does either — so the GET replay arrived query-less,
+        // matched anyway, and rendered literal `:key` template paths as a 500. The
+        // inheritedData flash cannot heal that: router.js merges it into req.get AFTER
+        // matching. `haltedRequest.url` is stamped by every pauseRequest(), so
+        // in-flight pre-#B215 snapshots replay correctly too (#B219: since the isaac
+        // engine strips the query from req.url before controllers run, pauseRequest
+        // snapshots req.originalUrl — pre-#B219 isaac snapshots are path-only and
+        // replay exactly as captured). The session-less flow
+        // keeps the recompose: with no session the flash cannot carry the halted data,
+        // and the composed URL's query params are its only travel channel.
+        // was: var url = lib.routing.getRoute(haltedRequest.routing.rule, haltedRequest.params||dataAsParams).url;
+        var hasLiveSession  = ( typeof(req.session) != 'undefined' && req.session ) ? true : false;
+        var url             = ( hasLiveSession && typeof(haltedRequest.url) != 'undefined' && haltedRequest.url )
+                                ? haltedRequest.url
+                                : lib.routing.getRoute(haltedRequest.routing.rule, haltedRequest.params||dataAsParams).url;
         var requiredController = self; // by default;
         if ( req.routing.namespace != haltedRequest.routing.namespace ) {
             try {
@@ -6098,6 +6230,9 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
      * Render a custom error page defined in `routing.json` via `req.routing.param.error`.
      * Sets `local.options.isRenderingCustomError = true` so the render pipeline
      * bypasses the normal rendering-stack guard.
+     * Stamps `res.statusCode` from the error's `status` — when it is a known
+     * status code — before dispatching, so every render delegate serves the
+     * custom page with the real HTTP status (#B190).
      *
      * @param {object}   req  - Incoming request (reads `req.routing.param`)
      * @param {object}   res  - Server response
@@ -6161,7 +6296,45 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             errOptions = merge(localOptions, local.options);
 
 
+        } else if ( typeof(req.routing.param.file) != 'undefined' && req.routing.param.file ) {
+            // #B191 — the resolved error template must never depend on the
+            // reset flag: the server-side throwError twin (server.js) sets
+            // `param.file` but not `isLocalOptionResetNeeded`, and the flag
+            // used to ride a SHARED routing object overlapping errors could
+            // strip. A falsy read here left errOptions null, so the render
+            // delegates fell back to the FAILING route's own `file` and
+            // built a bare, un-rooted template path — surfacing an upstream
+            // failure as a bogus "check your routing.json" misdirection.
+            // `path: null` mirrors the reset branch: custom paths ignore
+            // the namespace.
+            errOptions = merge({
+                file: req.routing.param.file,
+                path: null
+            }, local.options);
+        }
+        // #B190 — stamp the HTTP status on the response before the render
+        // dispatch. The swig and v1 delegates recompute it downstream from
+        // the page data, but the nunjucks and the async delegates only read
+        // the already-set `res.statusCode || 200` at their write sites — so
+        // without this stamp a configured custom error page is served as
+        // HTTP 200 there (live-measured 2026-08-01: nunjucks 200 vs swig 500
+        // on the same fixture).
+        var _eStatusCodes = local.options.conf
+            && local.options.conf.server
+            && local.options.conf.server.coreConfiguration
+            && local.options.conf.server.coreConfiguration.statusCodes
+            || null;
+        if (
+            data
+            && data.status
+            && res
+            && !res.headersSent
+            && _eStatusCodes
+            && typeof(_eStatusCodes[ data.status ]) != 'undefined'
+        ) {
+            res.statusCode = data.status;
         }
+
         delete local.options.namespace;
         self.render(data, displayInspector, errOptions);
     }
@@ -6746,7 +6919,14 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 
                     if (!local.options.isRenderingCustomError) {
                         var eRule = 'custom-error-page@'+ bundle;
-                        var routeObj = bundleConf.content.routing[eRule];
+                        // #B191 — dispatch on a CLONE: the shared routing
+                        // entry must not carry per-error state. The stamps
+                        // below (and renderCustomError's own param deletes)
+                        // used to mutate `bundleConf.content.routing[eRule]`
+                        // directly, racing overlapping errors on the shared
+                        // object; lib/routing getRoute() already clones for
+                        // the server-side twin's dispatch.
+                        var routeObj = JSON.clone(bundleConf.content.routing[eRule]);
                         routeObj.rule = eRule;
                         //routeObj.url = decodeURI(local.req.url);/// avoid %20
                         routeObj.param.title = ( typeof(eData.title) != 'undefined' ) ? eData.title : 'Error ' + eData.status;

package/framework/{v0.6.2 → v0.6.3}/core/controller/controller.render-nunjucks.js

@@ -888,6 +888,14 @@ async function writeCache(local, self, bundle, opt, htmlContent, req, res) {
         // #B158 — a gated route is never stored: the key carries no principal and
         // both serve points run before the gate. Full rationale on isRouteGated.
         libRef.authzGate.isRouteGated(req)
+        ||
+        // #SPA1 — a NEGOTIABLE route is never stored: the key carries no SHAPE
+        // dimension, so a stored entry could replay a fragment to a page request.
+        // This WRITE-side refusal is load-bearing, not defence-in-depth — isaac's
+        // cache read runs PRE-ROUTING (server.isaac.js ~:2150, off raw request.url
+        // with no request.routing in scope), so it cannot be guarded on the flag.
+        // Keeping the URL out of the cache entirely is what protects that path.
+        ( req.routing && req.routing.negotiate === true )
     ) {
         return;
     }

package/framework/{v0.6.2 → v0.6.3}/core/controller/controller.render-swig.js

@@ -53,6 +53,17 @@ async function writeCache(bundle, opt, htmlContent, req, res, cacheIsEnabled, th
         // #B158 — a gated route is never stored: the key carries no principal and
         // both serve points run before the gate. Full rationale on isRouteGated.
         lib.authzGate.isRouteGated(req)
+        ||
+        // #SPA1 — a NEGOTIABLE route is never stored, for the identical reason one
+        // sentence up: the key carries no SHAPE dimension, and both serve points run
+        // before the shape is resolved. Storing one would let a fragment be replayed
+        // to a page request (and vice versa) on the same URL.
+        // This WRITE-side refusal is LOAD-BEARING, not merely defence-in-depth:
+        // isaac's cache read runs PRE-ROUTING (server.isaac.js ~:2150 — it keys off
+        // the raw request.url with no request.routing in scope, measured), so that
+        // read CANNOT be guarded on the flag. Never writing the entry is what keeps
+        // the isaac path correct; the express-side read guard is the belt.
+        ( req.routing && req.routing.negotiate === true )
     ) {
         return;
     }
@@ -293,6 +304,10 @@ module.exports = async function render(userData, displayInspector, errOptions, d
         , plugin            = null
         // By default
         , isWithoutLayout   = (localOptions.isWithoutLayout) ? true : false
+        // #SPA1 fragment-parent roster — populated only for a layoutless render
+        // of an extends template (derived in the extends block, composed into
+        // the fragments/ cache parent at the priming + post-asset writes).
+        , fragmentBlockRoster = null
         , stream            = null
     ;
 
@@ -470,7 +485,14 @@ module.exports = async function render(userData, displayInspector, errOptions, d
     }
     pageContentObj = null;
 
-    cacheKey = 'swig:' + localOptions.bundle + subFolder +'/'+ data.page.view.file;
+    // #SPA1 — the compiled-template cache is shape-dimensioned: a layoutless
+    // (fragment) compile of an extends template resolves against a block-roster
+    // parent instead of the real layout, so the two shapes must never share a
+    // slot (first-shape-wins collision otherwise). isWithoutLayout is final
+    // here: the implicit extends-less auto-set runs above, and the later
+    // layout-not-found fallbacks only fire for templates that never reach this
+    // cache (its write requires an extends directive).
+    cacheKey = 'swig:' + localOptions.bundle + subFolder +'/'+ data.page.view.file + ( (isWithoutLayout) ? ':fragment' : '' );
     // Retrieve layoutPath from content
     if (
         hasLayoutInPath
@@ -487,7 +509,32 @@ module.exports = async function render(userData, displayInspector, errOptions, d
                 layoutPath = extendFound[0].match(/(\"|\')(.*)(\"|\')/)[0].replace(/(\"|\')/g, '');
 
                 // adding layout
-                var newLayoutPath = 'swig' + subFolder  +'/'+ layoutPath;
+                // #SPA1 — a layoutless (fragment) render of an extends template
+                // must NOT target the shared full-page cached layout: the
+                // post-asset persist below stores THIS render's assembled
+                // `layout`, which for a fragment is the (empty) nolayout shell —
+                // written over the shared file it blanks the parent every
+                // full-page render compiles from, so child blocks extend a
+                // block-less parent and are discarded. Fragments get their own
+                // `fragments/` namespace, primed from the child's OWN block
+                // roster so its blocks keep placeholders to fill.
+                if ( isWithoutLayout ) {
+                    var _fragBlockRe    = /\{\%-?\s*block\s+([A-Za-z0-9_-]+)/g;
+                    var _fragBlockNames = [];
+                    var _fragMatch      = null;
+                    while ( (_fragMatch = _fragBlockRe.exec(_templateContent)) !== null ) {
+                        if ( _fragBlockNames.indexOf(_fragMatch[1]) < 0 ) {
+                            _fragBlockNames.push(_fragMatch[1]);
+                        }
+                    }
+                    var _fragLines = [];
+                    for (var _fragI = 0, _fragLen = _fragBlockNames.length; _fragI < _fragLen; ++_fragI) {
+                        _fragLines.push('{% block '+ _fragBlockNames[_fragI] +' %}{% endblock %}');
+                    }
+                    fragmentBlockRoster = _fragLines.join('\n');
+                    _fragBlockRe = null; _fragBlockNames = null; _fragMatch = null; _fragLines = null;
+                }
+                var newLayoutPath = 'swig' + subFolder + ( (isWithoutLayout) ? '/fragments/' : '/' ) + layoutPath;
                 newLayoutFilename = _(cachePath +'/'+ localOptions.bundle +'/'+ newLayoutPath, true);
 
                 // In dev/cacheless mode we always refresh the cached layout;
@@ -537,7 +584,16 @@ module.exports = async function render(userData, displayInspector, errOptions, d
 
                     // replaced: openSync/readFileSync/writeSync/closeSync — async read + write (#P29, #P31)
                     // buffer = Buffer.from( fs.readFileSync(localOptions.template.html + '/'+ layoutPath) ); // replaced: CVE-2023-25345
-                    buffer = await fs.promises.readFile(localOptions.template.html + '/'+ layoutPath);
+                    // #SPA1 — the fragments/ parent primes from the child's block
+                    // roster, never from the original layout file (the roster is
+                    // what lets the child's blocks render; the shell tail is
+                    // appended by the post-asset persist further below).
+                    if ( isWithoutLayout && fragmentBlockRoster !== null ) {
+                        buffer = fragmentBlockRoster;
+                    }
+                    else {
+                        buffer = await fs.promises.readFile(localOptions.template.html + '/'+ layoutPath);
+                    }
                     // Atomic write: temp file + rename. rename(2) on POSIX is
                     // atomic on the same filesystem, so concurrent readers at
                     // the post-priming readFile below never see the target
@@ -744,6 +800,21 @@ module.exports = async function render(userData, displayInspector, errOptions, d
         //      ./namespace/page.html (GOOD)
 
         if ( !fs.existsSync(path) ) {
+            if (isRenderingCustomError) {
+                // #B191 — never dump a routing rule while rendering a CUSTOM
+                // ERROR page: the rule in scope is the failing route's (or
+                // the injected error route's), correct by construction, and
+                // the generic diagnostic below misdirected operators toward
+                // editing valid configuration. Name the template that failed
+                // and hand off to throwError — its re-entry guard serves the
+                // built-in error page without looping through this branch.
+                msg = 'could not open the custom error template "'+ path +'"'
+                    + ' — falling back to the built-in error page.';
+                err = new ApiError(msg, 500);
+                console.error(err.stack);
+                self.throwError(err);
+                return;
+            }
             msg = 'could not open "'+ path +'"' +
                         '\n1) The requested file does not exists in your templates/html (check your template directory). Can you find: '+path +
                         '\n2) Check the following rule in your `'+localOptions.conf.bundlePath+'/config/routing.json` and look around `param` to make sure that nothing is wrong with your file declaration: '+
@@ -1732,10 +1803,20 @@ module.exports = async function render(userData, displayInspector, errOptions, d
                 // a temp file and renaming onto target is atomic on POSIX, so
                 // readers always see either the prior content or the new
                 // content.
+                // #SPA1 — a fragment render persists the child's block roster
+                // ahead of the assembled shell: the roster keeps placeholders
+                // for the child's blocks, and the shell tail (xhr-inputs /
+                // scripts) still rides the fragment response after them. The
+                // write lands in the fragments/ namespace, so the full-page
+                // cached layout is never touched by a fragment render.
+                var _persistedLayout = ( isWithoutLayout && fragmentBlockRoster !== null )
+                    ? fragmentBlockRoster + '\n' + layout
+                    : layout;
                 var _layoutTmpAssets = newLayoutFilename + '.tmp.' + process.pid + '.' + Date.now() + '.' + Math.random().toString(36).slice(2);
-                await fs.promises.writeFile(_layoutTmpAssets, layout);
+                await fs.promises.writeFile(_layoutTmpAssets, _persistedLayout);
                 await fs.promises.rename(_layoutTmpAssets, newLayoutFilename);
                 _layoutTmpAssets = null;
+                _persistedLayout = null;
             }
 
             // Last compilation before rendering

package/framework/{v0.6.2 → v0.6.3}/core/gna.js

@@ -1494,7 +1494,14 @@ isBundleMounted(projects, bundlesPath, getContext('bundle'), function onBundleMo
                                         // noise for an inert bundle).
                                         var _rcEnabled = String(_rcServerCache.enable).toLowerCase() === 'true';
                                         var _rcRouting = (typeof gna.getConfig === 'function') ? gna.getConfig('routing') : null;
-                                        var _rcCheck = lib.RenderCache.validateConfig(_rcServerCache, _rcRouting || {}, gna.core.startingApp);
+                                        // #B238 — feed the disclosure-warn context from the RESOLVED conf
+                                        // tree (the same `server.hidePoweredBy` source the engine-agnostic
+                                        // X-Powered-By gate reads), guarded like `_rcServerCache` above.
+                                        var _rcHidePoweredBy = false;
+                                        try {
+                                            _rcHidePoweredBy = ( config.getInstance()[gna.core.startingApp][env].server.hidePoweredBy === true );
+                                        } catch (rcHpbErr) { _rcHidePoweredBy = false; }
+                                        var _rcCheck = lib.RenderCache.validateConfig(_rcServerCache, _rcRouting || {}, gna.core.startingApp, { hidePoweredBy: _rcHidePoweredBy, cacheEnabled: _rcEnabled });
                                         for (var _rcW = 0; _rcW < _rcCheck.warnings.length; _rcW++) {
                                             console.warn('[render-cache] ' + _rcCheck.warnings[_rcW]);
                                         }
@@ -2456,6 +2463,21 @@ gna.getProtected = getProtected;
  */
 gna.filterArgs = filterArgs;
 
+/**
+ * Import `GINA_*` / `VENDOR_*` / `USER_*` keys from `process.env` into the
+ * framework environment (`process.gina`). Move semantics by default — the
+ * `filterArgs()` sweep deletes each imported key from `process.env`. Pass
+ * `keep=true` for the early visibility pass (`bin/cli` runs it before its
+ * home/settings/host resolution) that leaves `process.env` intact for the
+ * later sweep. Idempotent in both modes.
+ *
+ * @param {boolean} [keep] - Import without deleting from `process.env`
+ * @returns {void}
+ * @example
+ *   importEnvVars(true); // process.gina.GINA_ENV === 'dev'; process.env.GINA_ENV intact
+ */
+gna.importEnvVars = importEnvVars;
+
 /**
  * Resolve the log directory — `GINA_LOGDIR` / `LOGDIR` / prefix `var/log`
  * with fallback to `~/.gina/log`. Creates it if missing.

package/framework/{v0.6.2 → v0.6.3}/core/plugins/lib/csrf/src/main.js

@@ -436,10 +436,13 @@ var SESSIONLESS_MESSAGE =
  *   1. `opts.secret` — factory override (test harness only).
  *   2. `settings.json > csrf.secret` — resolver-compatible config slot.
  *      `${secret:KEY}` placeholders are filled by `lib/secrets` at
- *      config-load time from `process.env[KEY]`, so this slot lets
- *      consumers name the env var anything they like.
- *   3. `process.env.GINA_CSRF_SECRET` — back-compat direct env read.
- *      Always honoured when set, regardless of (2).
+ *      config-load time (framework environment first, then the raw
+ *      process environment), so this slot lets consumers name the env
+ *      var anything they like.
+ *   3. `GINA_CSRF_SECRET` — back-compat env read, through the framework
+ *      env reader first, then the raw process environment (#B156 class:
+ *      the CLI sweep empties process.env of GINA_* keys). Always
+ *      honoured when set, regardless of (2).
  *
  * @example
  *   // settings.json — recommended shape:
@@ -483,7 +486,8 @@ function Csrf(opts) {
                  ? opts.secret
                  : (typeof defaults.secret === 'string' && defaults.secret)
                    ? defaults.secret
-                   : process.env.GINA_CSRF_SECRET;
+                   : ( (typeof getEnvVar === 'function' && getEnvVar('GINA_CSRF_SECRET'))
+                       || process.env.GINA_CSRF_SECRET );
     if (typeof secret !== 'string' || !secret) {
         throw new Error(
             '[gina csrf] GINA_CSRF_SECRET env var is required'

package/framework/{v0.6.2 → v0.6.3}/core/plugins/lib/security-headers/hide-powered-by/README.md

@@ -119,3 +119,23 @@ the Isaac engine when absent on most installs).
 The plugin is safe to register more than once — `removeHeader` is
 idempotent (no-op when the header is already absent), so a second
 call has no effect.
+
+## What this does NOT cover (#B238)
+
+`server.hidePoweredBy` suppresses the `X-Powered-By` header — nothing
+else. Two other response surfaces can still name the framework:
+
+- **`Cache-Status` identifier** — when the render/output cache is
+  enabled, every GET carries `Cache-Status: gina-cache; …` (RFC 9211).
+  The identifier never changes implicitly (it is a documented-stable
+  wire value); instead, a boot warn fires when `server.hidePoweredBy`
+  is true, the cache is enabled, and no `server.cache.name` is set.
+  Set any RFC 8941 token there (e.g. `"cache"`) to close the
+  disclosure, or explicitly `"gina-cache"` to keep the wire and
+  silence the warn.
+- **`Vary: X-Gina-Navigate`** — routes with `negotiate: true` emit it
+  so shared caches key fragment vs full-page responses correctly.
+  This is caching-correctness metadata, not a banner: suppressing or
+  renaming it would corrupt intermediary caches / break the client
+  contract, so it is not configurable. Routes without `negotiate`
+  never emit it.