gina 0.6.33 → 0.7.0

package/framework/{v0.6.33 → v0.7.0}/core/config.js

@@ -16,6 +16,8 @@ var Events          = require('events');
 var EventEmitter    = require('events').EventEmitter;
 var locales         = require('./locales');
 var lib             = require('./../lib');
+// #B360 — the unanchored-`requirements` boot warning (server-side only; reads routing, never rewrites it)
+var requirementsAnchor = require('./config.requirements-anchor');
 var Domain          = lib.Domain;
 var domainLib       = new Domain();
 var merge           = lib.merge;
@@ -2542,6 +2544,19 @@ function Config(opt, contextResetNeeded) {
             }
         }
 
+        // #B360 — a regex requirement is tested as a partial (search) match when a request is
+        // matched, so `/[0-9]+/` accepts `123abc`. One warning per bundle lists the regex
+        // requirements not anchored at both ends. Only the bundle this process runs (or every
+        // bundle of a standalone process) is judged, as for `settings.log.redact` below, so a
+        // bundle is not warned about its siblings. The routing table is read, never rewritten.
+        var _requirementsApply = ( bundle === self.startingApp ) || ( self.Host && typeof(self.Host.isStandalone) == 'function' && self.Host.isStandalone() === true );
+        if ( _requirementsApply ) {
+            var _unanchored = requirementsAnchor.findUnanchoredRequirements(routing);
+            if ( _unanchored.length > 0 ) {
+                console.warn( requirementsAnchor.formatUnanchoredWarning(bundle, _unanchored) );
+            }
+        }
+
         self.setRouting(bundle, env, scope, routing);
         // reverse routing
         for (let rule in routing) {

package/framework/v0.7.0/core/config.requirements-anchor.js

@@ -0,0 +1,218 @@
+'use strict';
+/**
+ * #B360 — which routing `requirements` regexes are anchored at both ends.
+ *
+ * A `requirements` value such as `"/[0-9]+/"` is tested with `RegExp#test` when a request is
+ * matched, which is a partial (search) match: it accepts `123abc`, because the value CONTAINS a
+ * match. Only a pattern anchored at both ends (`^…$`) constrains the whole value. The config
+ * loader uses this module to warn once per bundle, listing the requirements that are not
+ * anchored; it only READS the routing table and never rewrites a requirement (the #P46
+ * route-candidate index caches per routing table object and reads requirement keys).
+ *
+ * "Anchored" is decided per top-level alternative, so `/(^draft$|^[0-9]+$)/` is anchored (each
+ * alternative is) while `/^txt|html$/` is not (`^txt` has no end anchor, `html$` no start
+ * anchor). The `m` flag makes `^` and `$` match at line breaks, so a value carrying a newline
+ * could pass: a pattern with it counts as not anchored. `validator::` requirements are not
+ * regexes and are skipped.
+ *
+ * Server-side only: the browser bundle never loads this file.
+ *
+ * @module core/config.requirements-anchor
+ */
+
+/**
+ * Split a regex body on its top-level `|` — outside groups and character classes, and not
+ * escaped.
+ *
+ * @inner
+ * @private
+ * @param {string} body - The pattern between the slashes
+ * @returns {string[]} The top-level alternatives (one entry when there is no top-level `|`)
+ *
+ * @example
+ *   splitTopLevel('^a|b$');         // ['^a', 'b$']
+ *   splitTopLevel('^(a|b)$');       // ['^(a|b)$']
+ */
+function splitTopLevel(body) {
+    var parts = [], depth = 0, inClass = false, start = 0;
+    for (var i = 0; i < body.length; i++) {
+        var c = body[i];
+        if (c === '\\') { i++; continue; }
+        if (inClass) {
+            if (c === ']') { inClass = false; }
+        } else if (c === '[') {
+            inClass = true;
+        } else if (c === '(') {
+            depth++;
+        } else if (c === ')') {
+            depth--;
+        } else if (c === '|' && depth === 0) {
+            parts.push(body.slice(start, i));
+            start = i + 1;
+        }
+    }
+    parts.push(body.slice(start));
+    return parts;
+}
+
+/**
+ * The inner body of a group that spans the whole alternative — `(…)` or `(?:…)` — or null.
+ *
+ * @inner
+ * @private
+ * @param {string} alt - One alternative
+ * @returns {?string} The group's inner body, without a leading `?:`, or null
+ *
+ * @example
+ *   wholeGroupBody('(^a$|^b$)');    // '^a$|^b$'
+ *   wholeGroupBody('(a)b');         // null
+ */
+function wholeGroupBody(alt) {
+    if (alt.charAt(0) !== '(') { return null; }
+    var depth = 0, inClass = false;
+    for (var i = 0; i < alt.length; i++) {
+        var c = alt[i];
+        if (c === '\\') { i++; continue; }
+        if (inClass) {
+            if (c === ']') { inClass = false; }
+        } else if (c === '[') {
+            inClass = true;
+        } else if (c === '(') {
+            depth++;
+        } else if (c === ')') {
+            depth--;
+            if (depth === 0) {
+                if (i !== alt.length - 1) { return null; }
+                var inner = alt.slice(1, i);
+                return (inner.slice(0, 2) === '?:') ? inner.slice(2) : inner;
+            }
+        }
+    }
+    return null;
+}
+
+/**
+ * Whether a pattern ends with an unescaped `$` (an even count of backslashes before it).
+ *
+ * @inner
+ * @private
+ * @param {string} s - A pattern
+ * @returns {boolean} true when the final `$` is an anchor, not a literal
+ *
+ * @example
+ *   endsWithAnchor('a$');           // true
+ *   endsWithAnchor('a\\$');         // false (a literal dollar)
+ */
+function endsWithAnchor(s) {
+    if (s.charAt(s.length - 1) !== '$') { return false; }
+    var backslashes = 0;
+    for (var j = s.length - 2; j >= 0 && s[j] === '\\'; j--) { backslashes++; }
+    return backslashes % 2 === 0;
+}
+
+/**
+ * Whether a regex body matches only whole values: every top-level alternative starts with
+ * `^` and ends with an unescaped `$`, or is one group spanning it whose body is anchored.
+ *
+ * @inner
+ * @private
+ * @param {string} body - The pattern between the slashes
+ * @returns {boolean} true when the body is anchored at both ends
+ *
+ * @example
+ *   isAnchoredBody('^[0-9]+$');           // true
+ *   isAnchoredBody('(^draft$|^[0-9]+$)'); // true
+ *   isAnchoredBody('^[0-9]+');            // false
+ */
+function isAnchoredBody(body) {
+    var alts = splitTopLevel(body);
+    if (alts.length > 1) {
+        return alts.every(isAnchoredBody);
+    }
+    var alt = alts[0];
+    if (alt.charAt(0) === '^' && alt.length > 1 && endsWithAnchor(alt)) {
+        return true;
+    }
+    var inner = wholeGroupBody(alt);
+    return (inner !== null && inner !== '') ? isAnchoredBody(inner) : false;
+}
+
+/**
+ * Whether a routing `requirements` value is a regex that is NOT anchored at both ends.
+ * A `validator::` value, a non-string or a value not written as `/body/flags` is not a
+ * regex requirement and returns false (the config loader refuses any value that is neither
+ * `/…` nor `validator::` at boot).
+ *
+ * @param {*} value - A requirements value as written in routing.json
+ * @returns {boolean} true when the value is a regex a partial match can satisfy
+ *
+ * @example
+ *   isUnanchoredRequirement('/[0-9]+/');                  // true
+ *   isUnanchoredRequirement('/^[0-9]+$/');                // false
+ *   isUnanchoredRequirement('/^[0-9]+$/m');               // true (the m flag)
+ *   isUnanchoredRequirement('validator::{ isEmail: true }'); // false
+ */
+function isUnanchoredRequirement(value) {
+    if (typeof(value) !== 'string' || value.charAt(0) !== '/') { return false; }
+    var last = value.lastIndexOf('/');
+    if (last < 1) { return true; }                       // `/` alone: an empty pattern matches anything
+    var body  = value.slice(1, last);
+    var flags = value.slice(last + 1);
+    if (flags.indexOf('m') > -1) { return true; }
+    return !isAnchoredBody(body);
+}
+
+/**
+ * List a routing table's regex requirements that are not anchored at both ends, in table
+ * order. Reads only; the table and its requirement objects are left untouched.
+ *
+ * @param {object} routing - A bundle's routing table (rule name → rule)
+ * @returns {Array<{rule: string, key: string, value: string}>} The unanchored requirements
+ *
+ * @example
+ *   findUnanchoredRequirements({ item: { url: '/item/:id', requirements: { id: '/[0-9]+/' } } });
+ *   // [ { rule: 'item', key: 'id', value: '/[0-9]+/' } ]
+ */
+function findUnanchoredRequirements(routing) {
+    var found = [];
+    if (!routing || typeof(routing) !== 'object') { return found; }
+    var rules = Object.keys(routing);
+    for (var r = 0; r < rules.length; r++) {
+        var rule = routing[rules[r]];
+        if (!rule || typeof(rule) !== 'object' || !rule.requirements || typeof(rule.requirements) !== 'object') { continue; }
+        var keys = Object.keys(rule.requirements);
+        for (var k = 0; k < keys.length; k++) {
+            var value = rule.requirements[keys[k]];
+            if (isUnanchoredRequirement(value)) {
+                found.push({ rule: rules[r], key: keys[k], value: value });
+            }
+        }
+    }
+    return found;
+}
+
+/**
+ * The single warning line for a bundle's unanchored requirements.
+ *
+ * @param {string} bundle - The bundle name
+ * @param {Array<{rule: string, key: string, value: string}>} list - From findUnanchoredRequirements
+ * @returns {string} The warning text
+ *
+ * @example
+ *   formatUnanchoredWarning('api', [ { rule: 'item', key: 'id', value: '/[0-9]+/' } ]);
+ *   // '[CONFIG][loadBundleConfig] [ api ] 1 routing requirement is not anchored ...: item { id: /[0-9]+/ } ...'
+ */
+function formatUnanchoredWarning(bundle, list) {
+    var n = list.length;
+    var items = list.map(function (u) { return u.rule + ' { ' + u.key + ': ' + u.value + ' }'; }).join(', ');
+    return '[CONFIG][loadBundleConfig] [ ' + bundle + ' ] ' + n + ' routing requirement' + (n === 1 ? ' is' : 's are')
+        + ' not anchored at both ends (^…$), so ' + (n === 1 ? 'it is' : 'each is') + ' tested as a partial match and a value'
+        + ' that only contains a match passes: ' + items + '. Anchor ' + (n === 1 ? 'it' : 'them') + ' (e.g. /^[0-9]+$/),'
+        + ' or write an intended partial match in full (e.g. /^pk_.*$/). See https://gina.io/docs/guides/routing#regex-requirements';
+}
+
+module.exports = {
+    isUnanchoredRequirement    : isUnanchoredRequirement,
+    findUnanchoredRequirements : findUnanchoredRequirements,
+    formatUnanchoredWarning    : formatUnanchoredWarning
+};

package/framework/{v0.6.33 → v0.7.0}/core/controller/controller.js

@@ -3284,7 +3284,12 @@ function SuperController(options) {
                     ignoreWebRoot = false
                 } else {
                     res = local.res;
-                    var stack = __stack.splice(1).toString().split(',').join('\n');
+                    // #B670 — `__stack` returns raw V8 CallSite objects, whose toString() has no
+                    // `    at ` prefix: joined as-is, the list escaped throwError's non-local cut
+                    // and shipped every absolute path to the client. Written as V8 frames, the
+                    // cut recognises it and the ref line keeps it whole.
+                    // was: var stack = __stack.splice(1).toString().split(',').join('\n');
+                    var stack = __stack.splice(1).map(function (c) { return '    at '+ c; }).join('\n');
                     self.throwError(res, 500, new Error('RedirectError: @param `ignoreWebRoot` must be a boolean\n' + stack));
                     return;
                 }
@@ -5087,6 +5092,12 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
      *   pre-transport failure (missing host, unreadable certificate, open
      *   circuit, nested-render refusal) — and on success `cb(false, data)`.
      *
+     * The success `data` is the upstream body as the client parsed it — a
+     * JSON-shaped body becomes an object, anything else stays a string — and
+     * is the same over HTTP/1.1 and HTTP/2: a body without `status` arrives
+     * without one. Before #P47 F6 the HTTP/2 client added `status: 200` to such
+     * a body and logged a warn on every call.
+     *
      * A query issued while the controller is rendering from another required
      * controller (`renderingStack` deeper than one frame — the required
      * controller shares the caller's options object) is refused without
@@ -6349,7 +6360,9 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
      * before sending on a cached session whose last PONG is older than HTTP2_PREFLIGHT_STALE_MS.
      * Retries up to HTTP2_MAX_RETRIES times on transient failures (timeout, stream error,
      * premature close, 502, pre-flight failure) with HTTP2_RETRY_DELAY_MS backoff on 2nd+ retry.
-     * ECONNREFUSED is never retried.
+     * ECONNREFUSED is never retried. A JSON-shaped response body is parsed and delivered as
+     * it came, exactly like the HTTP/1.1 handler does: no `status` is added to a body that has
+     * none (#P47 F6).
      *
      * @inner
      * @param {object}   browser     - HTTP/2 client module (node:http2)
@@ -7211,11 +7224,19 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             if (typeof data === 'string' && /^(\{|%7B|\[{)|\[\]/.test(data)) {
                 try {
                     data = JSON.parse(data);
-                    if (typeof data.status === 'undefined') {
-                        const currentRule = local.options.rule || local.req.routing.rule;
-                        console.warn(`[${currentRule}] Response status code is undefined: switching to 200`);
-                        data.status = 200;
-                    }
+                    // #P47 F6 — the parsed body is delivered as it came, like the HTTP/1.1
+                    // client does. A body without `status` used to be logged ("Response status
+                    // code is undefined: switching to 200") and stamped `data.status = 200` on
+                    // every call: the same upstream answer then reached an HTTP/2 caller with
+                    // one key more than an HTTP/1.1 caller, `self.forward()` relayed that key
+                    // into the end client's body, and on a JSON string body (`"[]"`) the stamp
+                    // threw in strict mode and turned the success into a 500. The branch below
+                    // already reads an absent `status` as success, so nothing depended on it.
+                    // replaced: if (typeof data.status === 'undefined') {
+                    // replaced:     const currentRule = local.options.rule || local.req.routing.rule;
+                    // replaced:     console.warn(`[${currentRule}] Response status code is undefined: switching to 200`);
+                    // replaced:     data.status = 200;
+                    // replaced: }
                 } catch (err) {
                     data = { status: 500, error: err };
                     console.error('[HTTP2] JSON Parse Error:', err);
@@ -8849,6 +8870,13 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
      * dispatched via `renderCustomError` are consumer-owned — what the
      * template renders from `req.params.errorObject` is the consumer's call.
      *
+     * #B670 — a stack passed AS the message (`throwError(res, 500, err.stack)`,
+     * `throwError(500, err.stack)`, or an errorObj whose `title` / `message` /
+     * `error` holds one) is treated like the `stack` field: outside local scope
+     * the JSON body, the fallback HTML page and the data a custom error page
+     * receives keep only its message line, and the full text goes to the
+     * #ERRREF log line below. A caller's `msg` object is cut on a copy.
+     *
      * #ERRREF — every JSON error body additionally carries a top-level
      * `ref`: a short incident ref minted per error (or honoured from a
      * relay-safe producer-set `ref` on the error object / msg), present in
@@ -9295,6 +9323,15 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                 var _errDetail = errorObject.stack || errorObject.message
                     || ( ( errorObject.error && typeof(errorObject.error) === 'object' ) ? JSON.stringify(errorObject.error) : errorObject.error )
                     || '';
+                // #B670 — the egress gate below cuts a stack-bearing title/message/error
+                // to its first line outside local scope, so that text must be in this
+                // line in full. It already is, unless a hand-built object's own `stack`
+                // was logged in its place.
+                for (var _dk = 0, _detailKeys = ['title', 'message', 'error']; _dk < _detailKeys.length; ++_dk) {
+                    if ( typeof(errorObject[_detailKeys[_dk]]) == 'string' && /\n\s+at\s/.test(errorObject[_detailKeys[_dk]]) && String(_errDetail).indexOf(errorObject[_detailKeys[_dk]]) < 0 ) {
+                        _errDetail += '\n'+ errorObject[_detailKeys[_dk]];
+                    }
+                }
                 if ( msg && typeof(msg) == 'object' && msg.cause ) {
                     _errDetail += '\ncaused by: '+ ( msg.cause.stack || msg.cause.message || msg.cause );
                 }
@@ -9308,6 +9345,20 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                 if (!_isLocalScope && errorObject && errorObject.stack) {
                     delete errorObject.stack;
                 }
+                // #B670 — a stack passed AS the message (`throwError(res, 500, err.stack)`,
+                // the 2-arg form, or an errorObj whose `message` / `error` holds one)
+                // carries the frames the gate above strips from the `stack` field.
+                // Outside local scope the wire keeps its message line only — the same
+                // rule as #B131 on the server-side twin; the pairing line above logged
+                // the full text. Written inline: test/core/error-ref.test.js runs this
+                // window as extracted bytes, where a module-level helper is out of reach.
+                if (!_isLocalScope && errorObject) {
+                    for (var _wk = 0, _wireKeys = ['title', 'message', 'error']; _wk < _wireKeys.length; ++_wk) {
+                        if ( typeof(errorObject[_wireKeys[_wk]]) == 'string' && /\n\s+at\s/.test(errorObject[_wireKeys[_wk]]) ) {
+                            errorObject[_wireKeys[_wk]] = errorObject[_wireKeys[_wk]].split('\n')[0];
+                        }
+                    }
+                }
 
                 var errOutput = null, output = errorObject.toString();
                 if ( output == '[object Object]' ) {
@@ -9366,7 +9417,50 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                     var _logMsg = errorObject.stack || errorObject.message
                         || (typeof(errorObject.error) === 'object' ? JSON.stringify(errorObject.error) : errorObject.error)
                         || JSON.stringify(errorObject);
+                    // #B670 — when the caller passed a stack AS the message, `stack` above is
+                    // the throwError callsite: add the error's own text, which is logged
+                    // nowhere else and is cut from the page below outside local scope.
+                    for (var _lk = 0, _logKeys = ['title', 'message', 'error']; _lk < _logKeys.length; ++_lk) {
+                        if ( typeof(errorObject[_logKeys[_lk]]) == 'string' && /\n\s+at\s/.test(errorObject[_logKeys[_lk]]) && String(_logMsg).indexOf(errorObject[_logKeys[_lk]]) < 0 ) {
+                            _logMsg += '\n'+ errorObject[_logKeys[_lk]];
+                        }
+                    }
                     console.error('[ ref '+ _errRef +' ][ req '+ ( ( req && req._ginaReqId ) || '-' ) +' ] '+ req.method +' [ '+ errorObject.status +' ] '+ req.url + '\n'+ _logMsg);
+                } else if ( msg && typeof(msg) == 'object' ) {
+                    // #B670 — the (res, code, errorObj) shape reaches this branch with no
+                    // errorObject, so no line paired the ref the page renders. Log the
+                    // caller's own text against it, like the line above.
+                    var _msgLog = '';
+                    for (var _mk = 0, _msgKeys = ['stack', 'message', 'error', 'title']; _mk < _msgKeys.length; ++_mk) {
+                        if ( typeof(msg[_msgKeys[_mk]]) == 'string' && msg[_msgKeys[_mk]] && _msgLog.indexOf(msg[_msgKeys[_mk]]) < 0 ) {
+                            _msgLog += ( _msgLog ? '\n' : '' ) + msg[_msgKeys[_mk]];
+                        }
+                    }
+                    console.error('[ ref '+ _errRef +' ][ req '+ ( ( req && req._ginaReqId ) || '-' ) +' ] '+ req.method +' [ '+ code +' ] '+ req.url + ( _msgLog ? '\n'+ _msgLog : '' ));
+                }
+
+                // #B670 — outside local scope the page (the inline fallback page, or a
+                // custom error page through `page.data` and `req.params.errorObject`)
+                // keeps only the message line of a stack-bearing title/message/error,
+                // like the JSON wire; the ref lines above logged the full text.
+                // `errorObject` is cut in place, as the JSON branch's stack gate already
+                // edits it; the caller's `msg` is replaced by a copy, never written.
+                if ( !_isLocalScope ) {
+                    var _msgCopy = null;
+                    for (var _pk = 0, _pageKeys = ['title', 'message', 'error']; _pk < _pageKeys.length; ++_pk) {
+                        if ( errorObject && typeof(errorObject) == 'object' && typeof(errorObject[_pageKeys[_pk]]) == 'string' && /\n\s+at\s/.test(errorObject[_pageKeys[_pk]]) ) {
+                            errorObject[_pageKeys[_pk]] = errorObject[_pageKeys[_pk]].split('\n')[0];
+                        }
+                        if ( msg && typeof(msg) == 'object' && typeof(msg[_pageKeys[_pk]]) == 'string' && /\n\s+at\s/.test(msg[_pageKeys[_pk]]) ) {
+                            if ( !_msgCopy ) {
+                                _msgCopy = { title: msg.title, error: msg.error, message: msg.message, stack: msg.stack };
+                            }
+                            _msgCopy[_pageKeys[_pk]] = msg[_pageKeys[_pk]].split('\n')[0];
+                        }
+                    }
+                    if ( _msgCopy ) {
+                        msg = _msgCopy;
+                    }
                 }
 
                  // intercept none HTML mime types

package/framework/{v0.6.33 → v0.7.0}/core/controller/controller.render-swig-async.js

@@ -133,7 +133,7 @@ function getSwigEngine(swigMod, templateRoot, loader, autoescape, SwigFilters, t
         });
         // #B25 / #TPL1 Tier-2 — register the gina filters ONCE on the shared
         // engine (context-free; per-request context flows via _renderALS).
-        registerGinaFilters(engine, SwigFilters, throwError);
+        registerGinaFilters(engine, SwigFilters, throwError, (autoescape === true));
         process.gina._swigEngines[key] = {
             engine:   engine,
             compiled: new Map()
@@ -227,15 +227,19 @@ function computeIsProxyHost(req, localOptions) {
  * shared filter table can't bleed one request's context into another's
  * interleaved async render (#B25). The build-time conf is therefore empty —
  * everything flows through the ALS store stamped by the render `.run()` wrap.
+ * The one exception is the engine's autoescape mode (#B359 prep): nl2br escapes
+ * its input and is flagged `.safe` only when the engine escapes, and the empty
+ * options cannot say so, so it is passed explicitly.
  *
  * @inner
  * @param {*}        engine      - The per-bundle swig engine instance
  * @param {function} SwigFilters - The SwigFilters factory (from `deps`)
  * @param {function} throwError  - `self.throwError`, carried for the singleton-fallback path
+ * @param {boolean}  [autoescape=false] - The engine's own autoescape mode
  * @returns {void}
  */
-function registerGinaFilters(engine, SwigFilters, throwError) {
-    var filters = SwigFilters({ options: {}, isProxyHost: false, throwError: throwError });
+function registerGinaFilters(engine, SwigFilters, throwError, autoescape) {
+    var filters = SwigFilters({ options: {}, isProxyHost: false, throwError: throwError, autoescape: (autoescape === true) });
 
     for (var name in filters) {
         if (typeof filters[name] === 'function' && name !== 'getConfig') {

package/framework/{v0.6.33 → v0.7.0}/core/controller/controller.render-swig.js

@@ -21,6 +21,46 @@ var releaseBanner = require('./release-banner');
 // Precompiled regex — avoids per-request RegExp allocation (#P3)
 var blacklistRe       = /[<>]/g;
 
+/**
+ * #B690 — the asset placeholders this delegate injects into the layout. Their values
+ * (`data.page.view.stylesheets` / `.scripts`) are the `<link>` / `<script>` tags gina
+ * builds from templates.json, so they are injected with `| safe`: under
+ * `settings.swig.autoescape: true` a bare placeholder rendered every injected tag as
+ * visible text and the page lost its CSS and JS. With autoescape off (the default until
+ * 0.8.0) `safe` passes its input through, so the output is unchanged. The render-nunjucks
+ * delegate documents the same `| safe` form for a layout that places them itself.
+ *
+ * @constant
+ * @type {string}
+ * @private
+ */
+var STYLESHEETS_PLACEHOLDER = '{{ page.view.stylesheets | safe }}';
+/**
+ * #B690 — see STYLESHEETS_PLACEHOLDER.
+ *
+ * @constant
+ * @type {string}
+ * @private
+ */
+var SCRIPTS_PLACEHOLDER     = '{{ page.view.scripts | safe }}';
+/**
+ * #B690 — a layout that already holds the stylesheets placeholder, bare or with `| safe`
+ * (its own, or one injected by an earlier pass), is not injected a second time.
+ *
+ * @constant
+ * @type {RegExp}
+ * @private
+ */
+var STYLESHEETS_PLACED_RE   = /\{\{\s+(page\.view\.stylesheets)(\s*\|\s*safe)?\s+\}\}/;
+/**
+ * #B690 — the scripts twin of STYLESHEETS_PLACED_RE (single spaces, as before).
+ *
+ * @constant
+ * @type {RegExp}
+ * @private
+ */
+var SCRIPTS_PLACED_RE       = /\{\{ page\.view\.scripts(\s*\|\s*safe)? \}\}/;
+
 /**
  * Lazily construct the process-wide render-context AsyncLocalStorage, parked on
  * `process.gina` so it survives dev-mode `require.cache` eviction of this
@@ -1460,8 +1500,8 @@ module.exports = async function render(userData, displayInspector, errOptions, d
         }
 
         // adding stylesheets
-        if (!isWithoutLayout && data.page.view.stylesheets && !/\{\{\s+(page\.view\.stylesheets)\s+\}\}/.test(layout) ) {
-            layout = layout.replace(/\<\/head\>/i, '\n\t{{ page.view.stylesheets }}\n</head>')
+        if (!isWithoutLayout && data.page.view.stylesheets && !STYLESHEETS_PLACED_RE.test(layout) ) {
+            layout = layout.replace(/\<\/head\>/i, '\n\t'+ STYLESHEETS_PLACEHOLDER +'\n</head>')
         }
 
         if (hasViews() && isWithoutLayout) {
@@ -1623,18 +1663,18 @@ module.exports = async function render(userData, displayInspector, errOptions, d
             layout.replace('{{ page.view.scripts }}', '');
             // placed in the HEAD excepted when rendering a partial or when `isDeferModeEnabled` == true
             if (isLoadingPartial) {
-                if ( !/\{\{ page\.view\.scripts \}\}/.test(layout) ) {
-                    layout += '\t{{ page.view.scripts }}';
+                if ( !SCRIPTS_PLACED_RE.test(layout) ) {
+                    layout += '\t'+ SCRIPTS_PLACEHOLDER;
                 }
             } else {
                 // placed in the HEAD
                 if ( isDeferModeEnabled  ) {
-                    layout = layout.replace(/\<\/head\>/i, '\t{{ page.view.scripts }}\n\t</head>');
+                    layout = layout.replace(/\<\/head\>/i, '\t'+ SCRIPTS_PLACEHOLDER +'\n\t</head>');
                 }
                 // placed in the BODY
                 else {
-                    if ( !/\{\{ page\.view\.scripts \}\}/.test(layout) ) {
-                        layout = layout.replace(/\<\/body\>/i, '\t{{ page.view.scripts }}\n</body>');
+                    if ( !SCRIPTS_PLACED_RE.test(layout) ) {
+                        layout = layout.replace(/\<\/body\>/i, '\t'+ SCRIPTS_PLACEHOLDER +'\n</body>');
                     }
                     if (hasExternalsPlugins) {
                         for (let i =0, len = localOptions.template.externalPlugins.length; i<len; i++) {
@@ -1679,8 +1719,8 @@ module.exports = async function render(userData, displayInspector, errOptions, d
             // adding javascripts
             layout.replace('{{ page.view.scripts }}', '');
             if (isLoadingPartial) {
-                if ( !/\{\{ page\.view\.scripts \}\}/.test(layout) ) {
-                    layout += '\t{{ page.view.scripts }}\n';
+                if ( !SCRIPTS_PLACED_RE.test(layout) ) {
+                    layout += '\t'+ SCRIPTS_PLACEHOLDER +'\n';
                 }
                 if (
                     !localOptions.template.javascriptsExcluded
@@ -1696,14 +1736,14 @@ module.exports = async function render(userData, displayInspector, errOptions, d
                 // placed in the HEAD
                 if (
                     isDeferModeEnabled && /\<\/head\>/i.test(layout)
-                    && !/\{\{ page\.view\.scripts \}\}/.test(layout)
+                    && !SCRIPTS_PLACED_RE.test(layout)
                 ) { // placed in the HEAD
-                    layout = layout.replace(/\<\/head\>/i, '\t{{ page.view.scripts }}\n\t</head>');
+                    layout = layout.replace(/\<\/head\>/i, '\t'+ SCRIPTS_PLACEHOLDER +'\n\t</head>');
                 }
                 // placed in the BODY
                 else {
-                    if ( !/\{\{ page\.view\.scripts \}\}/.test(layout) ) {
-                        layout = layout.replace(/\<\/body\>/i, '\t{{ page.view.scripts }}\n</body>');
+                    if ( !SCRIPTS_PLACED_RE.test(layout) ) {
+                        layout = layout.replace(/\<\/body\>/i, '\t'+ SCRIPTS_PLACEHOLDER +'\n</body>');
                     }
                     if (hasExternalsPlugins) {
                         for (let i =0, len = localOptions.template.externalPlugins.length; i<len; i++) {

package/framework/{v0.6.33 → v0.7.0}/core/gna.js

@@ -3154,12 +3154,25 @@ gna.getRunDir = getRunDir;
 gna.getTmpDir = getTmpDir;
 
 /**
- * Read the saved startup argv for a given bundle@project — used by
- * `gina bundle:restart` to re-issue the exact same start command.
+ * Resolve the argv dir — `<GINA_HOMEDIR>/run`, created `0700` when absent —
+ * where each bundle's start argv is saved for the `gina tail --follow` crash
+ * restart. Never the shared tmp dir: that restart executes the file's first token.
+ *
+ * @returns {string} Argv-dir path
+ * @example
+ *   var dir = getArgvDir();
+ */
+gna.getArgvDir = getArgvDir;
+
+/**
+ * Read the saved startup argv for a given bundle@project from the argv dir
+ * (`getArgvDir()`) — used by `gina tail --follow` to restart a crashed bundle
+ * with the exact same start command. On POSIX the file must be a regular file
+ * owned by the current user that group/other cannot write, or it is refused.
  *
  * @param {string} bundle  - Bundle name
  * @param {string} project - Project name
- * @returns {string|null} Space-separated argv, or `null` when no file exists
+ * @returns {string|null} Space-separated argv, or `null` when no usable file exists
  * @example
  *   var argv = getBundleStartingArgv('myApp', 'demo');
  */