gina 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -6,6 +6,45 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.7.1 - 2026-10-01
+### Changed
+* A new project or bundle name must now be made of letters, digits, `_`, `.` and `-`, and start with a lowercase letter, a digit, `_` or `.`; `.`, `..` and the names every object inherits, such as `constructor`, are refused. `project:add`, `bundle:add`, the new name given to `project:rename`, `bundle:rename` or `bundle:copy`, and the name `project:restore` registers are checked before anything is written, and `bundle:add` checks every name of its list before it adds the first bundle. Until now only the first character was checked, so names holding spaces, quotes, `$` or `/` were registered, and `project:add @constructor` took the name for a registered project with no path and failed. A project or bundle already registered under a name outside the rule keeps working, including with `project:import`, `bundle:add --import` and `bundle:add --replace`. (#B665)
+* The global `setContext()` and `getConfig()` helpers no longer resolve the merge library on every call: it is bound once when the helpers load. Each call paid a full module resolution, about 3 µs, and the router makes two such calls per routed request.
+* In production the router probes a bundle's `controllers/setup.js` once, when the bundle first serves a request, instead of on every request; in development the per-request probe stays, because the file is re-read there when it changes. The probe cost two thrown file-system errors per request whenever the file was absent.
+* A routed request no longer builds three throwaway configuration objects. Resolving the route, deciding whether the bundle has views and matching the request to a bundle each constructed a new configuration object only to read the one already loaded; they now read the loaded configuration directly once it is initialised, and the views check consults its per-bundle answer before anything else. Before initialisation, the calls run as they did.
+* A routed request of a bundle with views no longer re-encodes the bundle's forms catalog, re-reads the V8 heap limit or stamps the date twice. The encoded `page.environment.forms` export is kept per catalog and reused (the catalog is loaded once per bundle; a large catalog cost about 5 µs per KB on every such request, JSON routes included), the `memory allocated` label is computed once, and `page.environment.date.now` and the locale's `date.now` now carry the same timestamp. Render data that writes into `page.forms`, which holds the shared catalog, no longer changes the forms export of later requests.
+* The controller's `set()`, which fills the render data about 60 times on every routed request of a bundle with views, tests for and splits dotted names with string operations instead of regular expressions. Behaviour is unchanged.
+* Constructing a class built with `inherits()` — every controller, on every routed request — no longer copies anything onto the instance: no own `prototype` property (it was enumerable, so it showed in `Object.keys()` and `JSON.stringify()` of an instance), no stamp of the instance's name onto a shared prototype on every construction, and no copy of the parent prototype's falsy members as own properties. Inherited members resolve through the prototype chain as before, and the browser bundle carries the same constructor.
+* Each bundle's resolved environment configuration now stays in V8's fast property mode. Loading it left the object in dictionary mode, which made the router's per-request copy of it cost about 20 µs; the copy now costs well under 1 µs, and the request's reads of the configuration are faster too. The configuration's contents are unchanged.
+### Fixed
+* `gina project:start`, `project:stop` and `project:restart` now work from an install whose path holds a space: they ran `bundle:start`, `bundle:stop` or `bundle:restart` through a command line that split the path, and failed. A `bundle:start` that reinstalls a project's `node_modules` after an architecture or platform change re-links gina with the running install's own `bin/gina`, so it no longer fails when `gina` is not on your `PATH`, nor uses whichever `gina` comes first there. A flag value holding a space now reaches the `link` steps of `project:` and `bundle:` start, stop and restart as one value instead of two. When a bundle's pid file is missing, `bundle:stop` finds its process by the exact `gina: <bundle>@<project>` title: `api@shop` no longer matches the process of `api@shopping`, which it could stop instead. (#B665)
+* A bundle started through the framework daemon now shows its boot warnings in the output of `gina bundle:start`, and of `gina bundle:restart`, which prints its start step. Every line the bundle logs at `warn`, `warning`, `error`, `err`, `crit` or `alert` while it starts is written there, before the started line. Until now these lines reached only a `gina tail` already attached when the bundle booted, because the log listener keeps no backlog: running `gina bundle:start` and then `gina tail`, or a container whose init script starts the bundle before its tail, never showed them, including the two boot warnings added in 0.7.0 (Swig `autoescape` not set, and unanchored routing `requirements`). A tail attached before the start still receives these lines, so each one then appears twice. An `emerg` line keeps its `aborted` message, and lines logged after the start still reach only the tail. Restart the framework to pick this up: `gina framework:restart`, or restart the container that runs the framework. (#B691)
+* `bin/gina` no longer loses the command when a `--restart-pid` flag is passed: its filter removed the runtime path from the arguments instead of the flag, so `gina start --restart-pid=<pid>` lost its `start` task, and any other command reached the CLI shifted by one argument. The flag belonged to an internal restart handshake that nothing used any more, so its handling is removed: a typed `--restart-pid` is now passed on like any other flag. (#B689)
+* `bundle:stop` reads a bundle's pid file as a positive integer only: a pid file holding `-1` made it send `SIGKILL` to every process the user could signal, and one holding `12abc` to pid 12 (#B693). On a host without `ps`, such as a slim container image, `framework:status` no longer removes the pid file of every running framework: it checks each pid with a signal-0 probe instead of `ps -a`. `gina .` and `framework:open` now open a directory whose path holds a space instead of splitting it in two, and `framework:build` passes each of its arguments to the build script whole. An isaac bundle whose cache path holds a space now gets the brotli and gzip copies of its routing files: the compressions split the path and failed.The npm prefix look-ups that the CLI bootstrap and `framework:init` fall back on when no prefix is configured no longer fail when npm is installed under a path holding a space. (#B665)
+* A `getConfig()` or `getLib()` call that names no bundle no longer walks the call stack when it does not need to: `getConfig()` and `getConfig(confName)` resolve to the running bundle without it, and where the walk is still needed (`getConfig(<falsy>, confName)`, `getLib(lib)`) the stack is captured once instead of once per frame examined. When no frame outside `node_modules` qualifies, the call now takes the no-match path instead of throwing a TypeError. On an npm install, every request to a bundle with templates used to pay up to nine stack captures and a caught exception in the render setup, about a quarter of a request's CPU in a profile of a trivial JSON route; the render setup now reads the bundle's Swig settings from the request's own configuration. (#B695)
+* Port lookups no longer take a bundle or project for another whose name begins with it or extends it. `bundle:remove api @shop` also removed the ports of `myapi@shop` and the port registry entry of `api@shopping`; `port:reset` removed the ports of the same bundle in a project whose name begins with its project's; while allocating ports, `bundle:add`, `bundle:copy` and `env:add` could give environment `dev` the port assigned to `devel`, taking it from `devel`; and `project:add` and `port:reset` could skip an assignment as already made because another value contained it (`api@shop/dev` inside `api@shop/devel` or `myapi@shop/dev`). The first-character refusal of `bundle:add` also names the rejected bundle instead of printing `[ undefined ]`. (#B665)
+* The built-in engine looks the output cache up only while `server.cache.enable` is on. With the cache disabled it looked every GET up anyway, two file-existence checks per request, and could serve a page left on disk by an earlier run that had caching enabled.
+* The path helper no longer records every distinct path it normalizes. Each `_()` call added the path to a list kept for the life of the process, and each `_()` call and each path object's `toString()` searched that list, so a bundle's memory and per-call CPU grew with the number of distinct paths it had ever seen: two per distinct request URL, query string included, through the output cache's file paths. Nothing read the list. `toString()` and `toUnixStyle()` return exactly what they did. `toWin32Style()` now also converts a path whose trailing separator `mkdir()`, `mkdirSync()`, `rm()`, `rmSync()` or `isValidPath()` had stripped, which it used to return with forward slashes (#B703)
+* On the isaac engine (the default), the storage maintenance endpoints of a running bundle now read their query string. Isaac removes the query from the request URL before handing a request to the handlers behind `/_gina/storage/stats`, `/_gina/storage/gc` and `/_gina/storage/verify`, which read `?driver=` and `?dryRun=` from that URL and so never saw them: against a running bundle, `gina storage:gc --dry-run` ran a real garbage collection, removing every unreferenced blob past `sweepGrace` on every `cas` driver (including one whose automatic sweep is off, `sweepInterval: 0`), and `--driver=<name>` was ignored by `storage:stats`, `storage:gc` and `storage:verify`, which reported on or collected every driver. The handlers now read the query from the original request URL. A stopped bundle (the CLI then opens the store itself) and the express engine were not affected, and the endpoints still answer only callers listed in `app.json` `admin.allowFrom`. Affected: 0.6.7 through 0.7.0. Pickup: restart the bundle; nothing to re-bake (#B710)
+* A client listed in `server.maintenance.allowFrom` now gets through a maintenance window on an isaac bundle whose `server.protocol` is http/1.1, the default engine and protocol. The isaac engine's maintenance gate admitted it, then rewrote the request's `Host` without its port before handing it on, and the second maintenance check read that port-less `Host` as the sign of a reverse proxy, closed the address arm and answered 503: the documented IP bypass never let a listed operator reach a page or a static file. The second check now honours the isaac gate's verdict instead of deciding again. A bundle serving HTTP/2 (whatever protocol its clients speak), the Express engine, the `bypassKey` header and cookie, and `server.proxy.requireForwardedHeaders: true` were not affected. A reverse proxy on the bundle's own host that forwards the `Host` with its port and adds no forwarding header cannot be told from a direct client, so a request it relays from a listed address passes too, as it already did on a bundle serving HTTP/2 and on Express. Affected: 0.6.10 through 0.7.0. Pickup: restart the bundle; nothing to re-bake (#B711)
+* During a maintenance window on the isaac engine, `/_gina/storage/stats`, `/_gina/storage/gc` and `/_gina/storage/verify` answer again. They exist only in the engine-agnostic server layer, and the isaac engine's maintenance gate, which lets through every `/_gina/*` endpoint the engine answers itself, stood in front of them: `gina storage:stats`, `storage:gc` and `storage:verify` failed against a running bundle for the whole window, reporting an invalid response. A health check whose URL carries a query string (`/_gina/health/check?probe=1`) got the maintenance 503 on isaac for the same reason. The isaac gate now lets those exact paths through to the server layer, where the storage endpoints stay restricted to `app.json` `admin.allowFrom`. The storage endpoints were not affected on the express engine; a health check with a query string was, in and out of a window, and is fixed by #B717. Affected: 0.6.10 through 0.7.0. Pickup: restart the bundle; nothing to re-bake (#B715)
+* On the express engine, a `POST /_gina/maintenance` or `POST /_gina/instrument` carrying a JSON body no longer stops the bundle. The server layer sets an encoding on every non-multipart request, so the body arrived as text, and the reader of these small control bodies threw while joining it: an uncaught exception that ended the process. The reader now accepts text, counts its 4 KB cap in bytes and reports a failure through its callback. Only a caller the endpoint already admits could send it: an address in `app.json` `admin.allowFrom` for the maintenance toggle, the inspector key for the instrumentation window. The isaac engine was not affected. Affected: 0.6.10 through 0.7.0 for `/_gina/maintenance`, 0.4.0 through 0.7.0 for `/_gina/instrument`. Pickup: restart the bundle; nothing to re-bake (#B714)
+* `/_gina/health/check`, `/_gina/assets/routing.json`, `/_gina/release/status` and `/_gina/release/events` answer a URL that carries a query string. They matched their path only when the URL ended there, so the same path followed by a query string (`/_gina/health/check?probe=1`) missed the endpoint: on the express engine it fell through to routing, a 404 (or the maintenance 503 during a window), and on the isaac engine the routing map and the release-watch endpoints with a query string answered the maintenance 503 during a window. The four endpoints now ignore a query string on both engines, and the isaac engine's routing-map fast path looks its asset up by the file name it matched. The browser fetches the routing map without a query string, so pages were not affected. Pickup: restart the bundle; nothing to re-bake (#B717)
+* `/_gina/health/check` answers `HEAD` on both engines: the `200` and the headers a `GET` gets, plus `content-length`, and no body. It answered `GET` only, so a `HEAD` probe, which some load balancers and monitors send, fell through to routing: a 404, or the maintenance 503 during a window. Pickup: restart the bundle; nothing to re-bake (#B718)
+* A page whose query string ends in a `/_gina/` endpoint path is answered by the page again. The built-in endpoints that #B709 left out of its exact-path matching (the health check, `/_gina/jobs/<id>`, `/_gina/instrument`, and the dev-only `/_gina/inspector`, `/_gina/logs`, `/_gina/agent`, `/_gina/indexes` and `/_gina/reveal`) tested the whole URL, so a URL such as `/web/?next=/_gina/health/check` got the endpoint's answer instead of the page, on both engines, outside a maintenance window and inside one, where the page's 503 was due; a WebSocket upgrade to such a URL was taken by the Inspector agent. These endpoints now match the URL's path only, keeping their prefix tolerance, letter case, methods and gates. The dev-only `/_gina/inspector`, `/_gina/logs`, `/_gina/indexes` and `/_gina/reveal` also answer a URL that carries a query string (`/_gina/logs?x=1`): on the express engine it missed them (a 404, or the maintenance 503 during a window), and on the isaac engine it got the maintenance 503 during a window. Pickup: restart the bundle; nothing to re-bake (#B712)
+* The isaac engine's own event streams answer HTTP/2 clients: `/_gina/logs` and `/_gina/agent` (the Inspector's server-log and agent streams) and `/_gina/release/events` (the live release-watch banner). Each sent a `connection: keep-alive` header, which HTTP/2 forbids: node refused the response headers (`ERR_HTTP2_INVALID_CONNECTION_HEADERS`, logged as a warning) and the client never got an answer, so an `http/2.0` bundle reached directly over HTTP/2 streamed none of them. HTTP/1.1 clients, including a proxy that talks HTTP/1.1 to the bundle, were not affected. The header now goes to HTTP/1.1 clients only. Affected: 0.3.0 through 0.7.0 (`/_gina/release/events`: 0.5.18 through 0.7.0). Pickup: restart the bundle; nothing to re-bake (#B722)
+* The standalone Inspector and `gina inspector:open` accept a target URL that carries a query string or a fragment. The Inspector appends `/_gina/<endpoint>` to its `?target=` value, and the command passes a URL argument through as that value, so a pasted page URL such as `http://localhost:3100/page?x=1` built `http://localhost:3100/page?x=1/_gina/agent`: the endpoint path landed in the query string, where the endpoints no longer look for it (#B712), and outside dev mode the agent key became part of another parameter. The target's query string and fragment are now dropped, then its trailing slashes. Pickup: the bundle reads the Inspector from the framework on every request, so reload the Inspector window, with nothing to restart or re-bake; the command takes effect on its next run (#B719)
+### Security
+* CLI commands that start other gina commands, or look up bundle processes, no longer build shell command lines. `project:start`, `project:stop` and `project:restart`; the `link-node-modules` and `link` steps that run on every `project:` and `bundle:` start, stop and restart; the `framework:link` step of a `bundle:start` that reinstalls a project's `node_modules`; the `node_modules` repair step of `framework:link`; and the process lookups of `bundle:stop` and `minion:kill` all spliced the project or bundle name, and the forwarded `--` flags, into a command line run by `sh`, unquoted or inside single quotes, so shell syntax in a registered name or in a flag value ran as a command, as the user running gina. Who was exposed: automation that builds these names or flags from data it does not control and runs the commands with them, and anything that can send a `bundle:start` to the local framework daemon, which already runs any framework command for whoever reaches its socket (loopback only by default). Typing a command yourself crossed no boundary. These children now start from argument vectors, and `bundle:stop` and `minion:kill` read the `ps -ef` listing themselves. (#B665)
+* More CLI commands no longer build shell command lines. `framework:status`, `framework:restart`, `framework:build`, the download and extract steps of `framework:add`, `gina .`, `framework:open`, the default-browser probes, browser launch and fallbacks of `inspector:open`, and the npm prefix look-ups of the CLI bootstrap and of `framework:init` put values into a command line run by `sh`: the arguments you passed, file paths, the Inspector URL, a pid file's content. Shell syntax in any of them ran as a command, as the user running gina. The isaac engine's brotli and gzip compressions of its routing files, which run at every boot, did the same with the cache path. Each value came from that user's own command line, settings or files, so no boundary was crossed; these commands now start their children from argument vectors, and Windows keeps the command lines that need cmd.exe (`start`, `where` and `npm.cmd`). `framework:status` also listed every user's processes and named a pid file after the title of any `gina-`-titled one, so another local user's process titled `gina-v/../../x` made it write `x.pid` outside the run directory: it now lists the current user's processes only and accepts only a framework daemon's `gina-v<version>` title. (#B665, #B677)
+* `settings.swig.autoescape: true` is now applied when gina is installed with npm. A bundle's Swig settings were read on every request through a helper that located the calling bundle by walking the call stack and skipping every frame whose path contains `node_modules`. Under an npm install (a global install, a project dependency, the image built by `gina image:build`) every framework file sits there, so the walk found nothing and threw; the render setup caught the error and continued with auto-escaping off while the bundle's configuration said it was on, and nothing was logged. Affected: 0.5.25 to 0.7.0, npm installs only; gina run from a repository checkout was not. After upgrading, auto-escaping becomes active on such installs for every bundle that sets `autoescape: true`: before upgrading, print `gina.csrfInput` with `| safe` and mark every other variable that carries trusted markup with `| safe` (the 0.7.0 migration checklist). (#B695)
+* The CLI now matches project, bundle and environment names literally when it looks them up in the port and project registries. It built regular expressions from the names, so a `.` in a name matched any character, and a name holding `+`, `(` or `[` broke the lookup or made the command throw: `project:remove @my.app` also removed the ports of `my-app`, `env:remove` could remove, and `port:list` list, another project's entries, and `bundle:start` did not recognise the mounted line of a bundle whose name holds `+`, so it waited out its start timeout and stopped the bundle. The install scripts match the install prefix literally too: a prefix holding `c++` made `npm install -g gina` fail. These names come from your own registry and command line, or from what can reach the framework's command socket, which listens on loopback by default. (#B665)
+* `run()` (also `gna.run`) and `Shell::run()` in `lib/shell` no longer write every command's output to the fixed files `out.log` and `err.log` in the temp directory (`opt.tmp` / `GINA_TMPDIR`, the system temp directory by default): each run now gets a private directory of its own under that base — created with mode 0700 and an unpredictable name, removed with its two files when the command exits — and a failure while reading the output back is delivered as the run's error instead of leaving the caller waiting. Two runs sharing a temp directory used to read each other's output as their own (the later one received the earlier one's stdout and stderr, the earlier one got nothing), and a run whose files a sibling had already removed never called back. Where the temp directory is shared between local users (`/tmp` on Linux by default), another user could create those names first, which stopped `gina project:add` / `project:import` and any `run()` call on that host, and on hosts without the kernel's `fs.protected_regular` / `fs.protected_symlinks` protections let that user read the command output or have it appended to a file of their choosing. Affected: every version up to 0.7.0. Pickup: the CLI on its next command, a bundle calling `run()` on its restart; nothing to re-bake (#B702, #B664)
+* The framework CLI's log-listener port file (`mq-listener-v<version>.port`, written by every `gina` command and read by `gina tail`) now lives under the framework home (`<GINA_HOMEDIR>/run/`, `~/.gina/run/` by default, written with mode 0600) instead of the system temp directory. Where that directory is shared between local users (`/tmp` on Linux by default), another user could create the file first: every `gina` command of the other users then failed at start-up, and on hosts without the kernel's `fs.protected_symlinks` protection a symbolic link there had the command overwrite a file of that user's choosing with the port number. Affected: every version up to 0.7.0. Pickup: restart the framework (`gina framework:restart`) and any running `gina tail`; nothing to re-bake (#B704)
+* The cross-origin write guard in front of the built-in `/_gina/*` control endpoints now covers every URL those endpoints answer. Since 0.6.10 it refused a write from a page on another origin only when the URL began with `/_gina/` in lower case, while several endpoints also answer a leading segment (`/web/_gina/maintenance`, `//_gina/maintenance`), the endpoint path at the end of the query string (`/?next=/_gina/maintenance`) or another letter case (`/_GINA/cache/clear`, `/_GINA/storage/gc`). A page on another origin, visited by an operator browsing from an address listed in `app.json` `admin.allowFrom` (loopback by default), could therefore turn maintenance mode on (a 503 for every visitor), flush the render cache, run a storage garbage collection or trigger a release rebuild. The guard now looks for `/_gina/` anywhere in the URL, in any letter case; a cross-origin browser request with an unsafe method to an application URL that merely contains `/_gina/` (in its query string, for instance) is refused too, while same-origin pages and non-browser clients are unaffected. Affected: 0.6.10 through 0.7.0. Pickup: restart the bundle; nothing to re-bake (#B708)
+* The admin `/_gina/*` endpoints (`/_gina/info`, `/_gina/cache/stats`, `/_gina/cache/clear`, `/_gina/storage/*`, `/_gina/release/*`, `/_gina/maintenance`) and `/_gina/metrics` no longer admit a request relayed by a reverse proxy running on the bundle's own host. They authorise a caller by network address alone (`app.json` `admin.allowFrom` and `metrics.allowFrom`, loopback by default), and a proxy on the same host connects from loopback, so every client it forwarded was admitted: anyone who could reach the site could turn maintenance mode on (a 503 for every visitor), flush the render cache, run a storage garbage collection or read the process and cache state, with no browser and no credential. Blocking `/_gina/` at the proxy did not close it either, because several of these endpoints also answered a nested path (`/_gina/health/check/_gina/maintenance`, which a proxy location for the health check forwards), the endpoint path at the end of the query string, another letter case or an empty leading segment. A loopback entry now admits a caller only when it connects directly: a request from 127.0.0.1 or ::1 that carries a forwarding header (`X-Forwarded-*`, `Forwarded`) or a Host without a port is refused with 403, and the first refusal is logged once. An address listed explicitly, such as a proxy on another host, still admits what it relays. The endpoints now match only their exact path, at the root or under the bundle's own webroot, with any query ignored; `/_gina/storage/*` and `/_gina/release/*` match in lower case only. A same-host proxy that forwards the Host header with its port and adds no forwarding header cannot be told from a direct client and is still admitted: call these endpoints on the bundle's own port from the host or the pod, and block `/_gina/` at the edge. A bundle bound directly to port 80 or 443 receives a Host without a port from every direct client; set `server.proxy.requireForwardedHeaders: true` there to keep loopback access. Affected: 0.3.14 through 0.7.0. Pickup: restart the bundle; nothing to re-bake (#B709)
+* One unauthenticated GET for the client routing table spelled in another letter case, such as `/_gina/assets/Routing.json`, no longer ends a bundle on the isaac engine (the default). Its routing-table fast path tested the URL without regard to letter case, then looked the file up by the requested spelling with an exact comparison: any spelling other than `routing.json` found nothing, and reading the empty result threw an uncaught `TypeError` that ended the process, before routing and every route guard, with any path prefix. The looked-up name is now lower-cased, so every spelling the test accepts serves the table. A request the bundle classified as proxied was served the host-stripped table and escaped the crash, but that classification reads request headers that a client reaching the bundle directly sets itself. The express engine serves the table from memory and was not affected. Affected: 0.1.6 through 0.7.0. Pickup: restart the bundle; nothing to re-bake (#B707)
+
 ## 0.7.0 - 2026-09-27
 ### Added
 * A Swig bundle that leaves `settings.swig.autoescape` unset now gets a warning at boot, once, naming 0.8.0: in 0.8.0 the default becomes `true`, which HTML-escapes every `{{ x }}` a template does not mark `| safe`. Set the key explicitly to keep your bundle's behaviour and silence the warning: `true` to escape (then mark a variable that carries HTML on purpose with `| safe`, for example `{{ gina.csrfInput | safe }}`), or `false` to keep output unescaped. A bundle whose own pages render only through Nunjucks is not warned. New bundles created with `gina bundle:add` now set `"swig": { "autoescape": true }` in their `settings.json`. Rendered output does not change in 0.7.0. Pick it up with a bundle restart. (#B359)

package/README.md

@@ -1,6 +1,6 @@
 # Gina
 
-[![npm version](https://img.shields.io/npm/v/gina)](https://www.npmjs.com/package/gina) [![npm downloads](https://img.shields.io/npm/dm/gina)](https://www.npmjs.com/package/gina) [![GitHub stars](https://img.shields.io/github/stars/gina-io/gina)](https://github.com/gina-io/gina/stargazers) [![Tests](https://github.com/gina-io/gina/actions/workflows/test.yml/badge.svg)](https://github.com/gina-io/gina/actions/workflows/test.yml) [![Socket](https://img.shields.io/badge/Socket-view%20analysis-blue)](https://socket.dev/npm/package/gina) [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D%2022-brightgreen)](https://nodejs.org) [![Bun >= 1.2](https://img.shields.io/badge/Bun-%3E%3D%201.2-brightgreen)](https://bun.sh) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![npm version](https://img.shields.io/npm/v/gina)](https://www.npmjs.com/package/gina) [![npm downloads](https://img.shields.io/npm/dm/gina)](https://www.npmjs.com/package/gina) [![GitHub stars](https://img.shields.io/github/stars/gina-io/gina)](https://github.com/gina-io/gina/stargazers) [![Tests](https://github.com/gina-io/gina/actions/workflows/test.yml/badge.svg)](https://github.com/gina-io/gina/actions/workflows/test.yml) [![Socket](https://img.shields.io/badge/Socket-view%20analysis-blue)](https://socket.dev/npm/package/gina) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/gina-io/gina/badge)](https://scorecard.dev/viewer/?uri=github.com/gina-io/gina) [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D%2022-brightgreen)](https://nodejs.org) [![Bun >= 1.2](https://img.shields.io/badge/Bun-%3E%3D%201.2-brightgreen)](https://bun.sh) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
 > **Documentation:** [gina.io/docs](https://gina.io/docs/) · **Issues:** [GitHub](https://github.com/gina-io/gina/issues) · **Changelog:** [CHANGELOG.md](./CHANGELOG.md) · **Security:** [SECURITY.md](./SECURITY.md)
 
@@ -67,68 +67,52 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.7.0
-
-> **Restart your bundles *and* rebuild them.** Two changes are browser-bundled —
-> custom form validators now compile without `eval`, and the warm route cache is
-> one map — so `gina.min.js` changed and `gina bundle:restart` alone leaves the old
-> client running. Rebuild each consuming bundle, then restart.
-
-> **A new minor version — check what carries over to `~/.gina/0.7`.** On an npm
-> install, the install writes `~/.gina/0.7/settings.json` from its template, so
-> `port`, `debug_port`, `mq_port`, `host_v4`, `bind_host`, `hostname`, `rundir`,
-> `logdir`, `tmpdir` and the log level start from their defaults: re-apply them
-> with `gina framework:set`. With Bun, a `gina-container` image or a git checkout,
-> those nine carry over from `~/.gina/0.6/settings.json` and only the log level
-> resets. Culture, timezone, default environment and scope carry over on every
-> path. A `^0.6.x` dependency range does not resolve `0.7.0` — widen it to
-> `^0.7.0`.
-
-> **Read before upgrading — some changes can change an answer.** A plain `GET`
-> no longer runs an action whose route is `DELETE`: the popin and link plugins'
-> same-origin XHR anchors keep working, but any other client must send a real
-> `DELETE`. `project:rename` refuses a registered name, `project:add` and
-> `project:import` read `--path`, `--scope` and `--env` whole, a `405` now
-> carries `Allow`, and a `HEAD` is served by every `GET` route. The scaffolded
-> Couchbase keep-alive key is `pingInterval`, not `ping` — check your
-> `connectors.json`. And plan for `0.8.0`: Swig's `autoescape` default becomes
-> `true`; a bundle that leaves it unset now says so at boot. The
+## What's in 0.7.1
+
+> **Restart your bundles *and* rebuild them — then restart the framework daemon.**
+> One change is browser-bundled (an instance of an `inherits()` class no longer
+> carries its own `prototype`), so `gina.min.js` changed and `gina bundle:restart`
+> alone leaves the old client running: rebuild each consuming bundle, then restart
+> it. The CLI's log-listener port file moved to `~/.gina/run/`, so restart the
+> framework daemon and any running `gina tail` once as well.
+
+> **Read before upgrading — some changes can change an answer.** On an npm install,
+> `settings.swig.autoescape: true` now escapes Swig output as configured — check
+> your templates first. A loopback entry in `admin.allowFrom` or
+> `metrics.allowFrom` no longer admits a request a reverse proxy relays, and the
+> admin endpoints answer their exact path only. A new project or bundle name must
+> follow a naming rule, and the CLI matches names literally. The
 > [migration notes](https://gina.io/docs/migration) list every behaviour change.
 
-**The hardening and throughput release.** Seven security fixes lead it: a `GET`
-could run a route's `DELETE` action for another site; on Express 5 one body-less
-request could stop a bundle; a stack passed as an error message reached the
-client; `gina tail --follow` could re-run another local user's program; a long
-`X-Forwarded-Prefix` header could tie up an isaac bundle; a malformed frame could
-stop the framework daemon; and the browser bundle no longer carries any
-dynamic-code call. The inter-bundle throughput arc closes with a route candidate
-index and a one-map warm route cache, and `0.7.0` prepares Swig's move to escaped
-output by default in `0.8.0`. Full detail in [CHANGELOG.md](./CHANGELOG.md).
-
-- **Security — a `GET` no longer runs a `DELETE` action for another site (#B662).** So that the popin and link plugins could send their anchors as a `GET`, the router served any `GET` to a `DELETE` route as a `DELETE`, for any client: a cross-site navigation carrying the visitor's session cookie could run it — on the Express engine even with the Csrf plugin adopted, and on either engine without it, since the Session plugin's default `SameSite=Lax` cookie is sent on a top-level navigation. The override is now granted only to a same-origin XHR (`X-Requested-With: XMLHttpRequest`, `Sec-Fetch-Site` of `same-origin` or `none`, no foreign `Origin`); any other `GET` answers 404, or 405 on a route whose methods include `DELETE`.
-- **Security — on Express 5, one body-less request no longer stops the bundle (#B666).** A `DELETE`, or a `POST`, `PUT` or `PATCH` without a body, on any URL and with no authentication, found `request.query` undefined, and the resulting TypeError exited the process. `request.query` is now an accessor that materialises Express's own parse on first read. Express 4 and the default isaac engine were never affected; `0.6.9` to `0.6.33` were.
-- **Security — a stack passed as an error message no longer reaches the client (#B670).** `self.throwError(res, 500, err.stack)`, or an error whose `message`, `error` or `title` holds a stack, put file paths and frames in the JSON body and on the built-in error page in every scope. Outside the local scope such a value now keeps only its first line in the response, and the full text goes to the server log line that carries the incident ref.
-- **Security — `gina tail --follow` no longer re-runs a start command from the shared tmp directory (#B676).** The command a crash restart re-runs is now saved as `~/.gina/run/<bundle>@<project>.argv` (mode 0600) and re-run only from a regular file owned by the current user that group and other cannot write; where `/tmp` is shared, another local user could create the old file first. Restart `gina tail`, then start each bundle once so its file is written in the new place.
-- **Security — a long `X-Forwarded-Prefix` header no longer ties up an isaac bundle (#B679).** The trailing-slash trim backtracked quadratically on a long run of slashes and ran before the 255-character cap, so one request with a 15 KB header cost about 100–170 ms of CPU. The cap now runs first. `0.3.10` to `0.6.33` were affected.
-- **Security — a malformed frame on the log listener no longer stops the framework daemon (#B678).** A frame on port 8125 whose `request` names an inherited object member, such as `__proto__`, threw out of the socket handler and ended the daemon, which also serves the command socket on 8124; the listener now dispatches only short identifiers to its own methods. It binds loopback by default, so only a local process could reach it. Pickup: a framework restart.
-- **Security — the browser bundle carries no dynamic-code call (#M21d).** A custom form validator is compiled by the browser as an inline script carrying the page's CSP nonce instead of through `eval` — the same `this.getValidationContext()` contract, and no `'unsafe-eval'` needed — and the two unreachable calls in the bundled RequireJS and engine.io-client are rewritten at build time. Nothing changes for a validator file that follows the reference.
-- **Added — a boot warning when Swig `autoescape` is not set; `true` becomes the default in `0.8.0` (#B359).** Rendered output does not change in `0.7.0`. Set `settings.swig.autoescape` explicitly to silence it: `false` keeps today's output; with `true`, mark HTML you trust with `| safe` — `{{ gina.csrfInput | safe }}` first, or every form POST fails CSRF. New bundles are scaffolded with `"autoescape": true`.
-- **Added — a boot warning for routing `requirements` regexes that are not anchored (#B360).** A requirement is tested as a partial match, so `"/[0-9]+/"` accepts `123abc`. Anchor each listed pattern (`"/^[0-9]+$/"`); nothing is rewritten for you, and requirements are not applied when a URL is built.
-- **Changed — routing tests only the routes whose URL could match (#P46).** A per-table candidate index skips the rules a request's URL cannot match — a late rule on a 380-rule table went from about 440 µs to about 14 µs — so a skipped rule's `validator::` requirement is no longer evaluated for that request.
-- **Changed — the warm route cache is one map and keeps only the matched rule (#P46).** A lookup and an eviction cost the same at any size, and an entry no longer keeps the first request's parameters and data — a login form's body included — for the life of the process.
-- **Changed — `self.query()` over HTTP/2 no longer adds `status: 200` (#P47).** An upstream JSON body without a `status` arrives as sent, as it always did over HTTP/1.1, with no warning per call; treat an absent `status` as success.
-- **Fixed — the first gina commands after a minor-version upgrade no longer fail (#B680, #B681).** When `bundle:start`, `bundle:restart`, `project:start`, `project:restart` or a `gina-container` boot ran first, every later command exited `1` (`reading 'split'`) until `main.json` was repaired by hand, and the first command after any minor upgrade failed once (`reading 'indexOf'`). Installs that skip npm's install scripts were exposed. CLI only.
-- **Fixed — with `autoescape: true`, Swig pages keep their CSS and JavaScript (#B690).** gina's injected `<link>` and `<script>` tags rendered as visible text; they are now injected with `| safe`, and `nl2br` keeps its line breaks. Output with escaping off is unchanged.
-- **Fixed — a `405` carries `Allow`, and a `HEAD` works on every `GET` route (#B659, #B667).** The `Allow` header lists the methods of the routes whose URL matched; a `HEAD` on a parameterised URL used to answer 404, and on a route declaring several methods 405.
-- **Fixed — a `HEAD` gives the action `req.get` (#B675).** A `GET` action reading `req.get.<param>` answered 500 on `HEAD`; `req.get` is now the same object as `req.head`.
-- **Fixed — on the Express engine, a URL carrying a query string resolves (#B668).** `GET /items?page=2` and a cache-busted static such as `/css/app.css?v=3` answered 404 on Express 4 and 5; the query is now stripped before routing and statics, as on isaac.
-- **Fixed — `env:add <env> @<project>` makes the environment ready to start (#B643).** It registered the environment but gave no bundle ports for it; it now allocates them, writes the `env.json` blocks, prints a confirmation and exits.
-- **Fixed — `project:add` and `project:import` read `--path`, `--scope` and `--env` whole (#B644).** A value holding `=` was cut at its second `=`.
-- **Fixed — `project:rename` renames to a free name and refuses a taken one (#B651).** It refused every free name, and renamed port records of any project whose name began with the old one.
-- **Fixed — six more commands exit after their work (#B653).** Started by the CLI's own path, as CI and scripts run it, `port:reset` with no project, `env:unset`, `env:set` with no key, `port:list --format=json|conf`, `connector:list` without a project and a cancelled `protocol:set` prompt never ended.
-- **Fixed — a path with a space no longer breaks the install, `port:reset` or `bundle:restart` (#B663).** The install scripts, `port:reset` and `bundle:restart` no longer run their commands through a shell, so a home directory or npm prefix with a space works, and `port:reset` no longer needs `gina` on your `PATH`.
-- **Fixed — a failed copy no longer leaves a temporary file behind, and reports a stack on Bun (#B649, #B654).**
-- **Fixed — the scaffolded Couchbase keep-alive interval is `pingInterval` (#D51).** The example named `ping`, a key the connector ignores — check your `connectors.json`.
+**The security release.** Five advisories lead it: behind a reverse proxy on the
+bundle's own host, the admin `/_gina/*` endpoints and `/_gina/metrics` admitted
+every client the proxy relayed; the cross-origin write guard in front of the
+control endpoints missed three URL shapes; one `GET` of the routing table in
+another letter case stopped an isaac bundle; command output logs and the
+log-listener port file left the shared temp directory; and `autoescape: true` is
+applied on npm installs. More CLI commands stop building shell command lines, a
+routed request costs about a third less CPU, and the built-in `/_gina/*` endpoints
+answer a query string, `HEAD` and HTTP/2. Full detail in [CHANGELOG.md](./CHANGELOG.md).
+
+- **Security — the admin `/_gina/*` endpoints refuse a request relayed by a proxy on the bundle's host (#B709).** They admitted a caller by its network address alone, loopback by default, so a proxy on the same host relayed every client past `admin.allowFrom` and `metrics.allowFrom`. A loopback caller whose request carries a forwarding header or a `Host` without a port is now refused with `403`, and each endpoint answers its exact path only.
+- **Security — the cross-origin write guard covers every URL the control endpoints answer (#B708).** A leading path segment, the endpoint path at the end of a query string or another letter case slipped past it, so a page on another origin could turn maintenance mode on from an operator's allowed address.
+- **Security — a `GET` of the routing table in another letter case no longer stops an isaac bundle (#B707).** `/_gina/assets/Routing.json` found no file and the empty result's read ended the process — one unauthenticated request, before routing and every route guard. The lookup now uses the lower-cased name.
+- **Security — command output logs and the log-listener port file leave the shared temp directory (#B702, #B704).** `run()` and `Shell::run()` write each command's output to a private directory removed at close, and the port file lives in `~/.gina/run/` (mode 0600).
+- **Security — `settings.swig.autoescape: true` is applied on npm installs (#B695).** The per-request settings read failed on an npm install, so the option was silently dropped there.
+- **Security — CLI commands no longer build shell command lines, and match names literally (#B665).** Commands that start other gina commands, the framework commands and an isaac bundle's boot pass their values as arguments, and registry lookups no longer read a name as a regular expression.
+- **Changed — new project and bundle names follow a naming rule (#B665).** Letters, digits, `_`, `.` and `-`, starting with a lowercase letter, a digit, `_` or `.`; existing names keep working.
+- **Changed — less work per routed request.** Values that do not change between requests are computed once and configuration lookups reuse the loaded configuration: a routed JSON request went from about 300 µs to about 205 µs of CPU in the profiling harness. An instance of an `inherits()` class no longer carries its own `prototype`.
+- **Fixed — the built-in `/_gina/*` endpoints answer a query string and `HEAD`, and a page whose query string ends in an endpoint path gets the page (#B712, #B717, #B718).**
+- **Fixed — isaac's own event streams answer HTTP/2 clients (#B722).** `/_gina/logs`, `/_gina/agent` and `/_gina/release/events` never answered one.
+- **Fixed — maintenance mode on isaac: a listed direct client gets through on HTTP/1.1, and the storage endpoints answer during a window (#B711, #B715).**
+- **Fixed — `storage:gc --dry-run` and `--driver=` work against a running isaac bundle (#B710).** A dry run ran a real collection.
+- **Fixed — a JSON body sent to the maintenance or instrumentation toggle no longer stops an express bundle (#B714).**
+- **Fixed — a daemon-started bundle's boot warnings appear in the `bundle:start` output (#B691).**
+- **Fixed — project commands from a path with a space, `bundle:stop`'s pid file, lookups of names extending one another, and a `--restart-pid` flag (#B665, #B693, #B689).**
+- **Fixed — the Inspector and `gina inspector:open` accept a target URL with a query string (#B719).**
+- **Fixed — a bundle with templates no longer walks the call stack on every request (#B695).**
+- **Fixed — with the output cache off, isaac no longer serves a page an earlier run cached.**
+- **Fixed — the path helper no longer keeps every path it has seen (#B703).**
 
 ## Documentation
 

package/ROADMAP.md

@@ -87,6 +87,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.33` ✅ | **Security**: nine fixes — one unauthenticated GET could stop a bundle process (a bracket field name with a numeric segment); an encoded `&` or `=` in a urlencoded body could add or override other fields; a parse failure wrote the raw body or query to the log; a top-level `__proto__` field swapped the parsed request object's prototype; on an `http/2.0` bundle an HTTP/1.1 request skipped every route's method check; a query key named like an inherited object member could reach another route; the Couchbase connector binds `SEARCH()` terms and validates field paths and the scope instead of splicing them into statement text, and its plaintext REST query transport is retired; `project:add` no longer runs `--scope` / `--env` through a shell. **Added**: `server.query.http2SessionPool`. **Changed**: the HTTP/2 rapid-reset guard counts client resets (`maxStreamResetsPerSecond`); `scope:add` and `env:add` check the whole name and retire the `<bundle>/<name>` forms. **Fixed**: the inter-bundle throughput arc (the env template parsed once per process; HTTP/2 client sessions no longer reset every stream, leak, storm pre-flight PINGs or lose their warmup sessions; a request refused before processing is retried for any method; the server closes idle sessions; HTTP/1.1 calls reuse their connections; the CA file is read once); the `is` rule compares referenced values as typed, with one `$field` token grammar (gh#77); a throw from `onInitialize` and an asynchronous model-load failure abort the boot; a malformed `${secret:…}` reference refuses the bundle; the Couchbase session store's login rotation, a reconnect's scope and `bulkInsert`'s bucket name; a percent-escape no longer empties a query; the in-memory Collection's string operators; the `rstCount` metric; `project:add`'s scope and environment race and the link-slot commands' crash and hang; two type declarations; the tarball's test artifacts. 42 fragments; restart **and rebuild** — 8 commits touch the browser bundle. |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities ✅ shipped early in `0.6.31` (the `Priority` header half — read, propagated, emitted, job urgency; response ordering stays blocked on Node scheduler hooks) · the `0.6` line closed at `0.6.33`: the Beemaster admin + visual translation editor moved to `0.7.x` |
 | **Q4 2026** | `0.7.0` ✅ | **Performance**: the inter-bundle throughput arc closes — a candidate index narrows the cold route match to the rules whose URL could match, the warm route cache becomes one constant-time map, an HTTP/2 `self.query()` answer without a `status` field no longer gets `status: 200` added nor a warning logged per call, and the arc's exit benchmark is published (its first five slices shipped in `0.6.33`). **Security**: seven fixes — a `GET` could run a route's `DELETE` action for any client, including from another site; on Express 5 one body-less request could stop the bundle; a stack passed as an error message reached the client; `gina tail --follow` re-ran a start command from the shared tmp directory; a long `X-Forwarded-Prefix` header could tie up an isaac bundle; a malformed frame on the loopback log listener stopped the framework daemon; and the browser bundle no longer carries any dynamic-code call, so custom validators compile without `eval`. **Added**: a boot warning for a Swig bundle that leaves `settings.swig.autoescape` unset (the default becomes `true` in `0.8.0`), and one for routing `requirements` regexes that are not anchored. **Fixed**: the first gina commands after a minor-version upgrade; a `405` lists the allowed methods, and a `HEAD` works on every `GET` route and gives the action `req.get`; on Express, a URL carrying a query string resolves; with `autoescape: true`, Swig pages keep their CSS and JavaScript; `env:add <env> @<project>`, `project:rename`, the values of `project:add`'s flags, six CLI commands that did not exit, and a path with a space in the install, `port:reset` and `bundle:restart`; the path helper's failed copies; the scaffolded Couchbase `pingInterval`. **ISO 27001 supplier evidence**: a published OpenSSF Scorecard and the controller-side error-message sanitizer. **New minor version**: settings move to `~/.gina/0.7/` — an npm install resets the networking and directory settings and the log level to their defaults, while Bun, a `gina-container` image or a git checkout carries them over and resets only the log level; culture, timezone, default environment and scope carry over on every path — and a `^0.6.x` dependency range does not resolve `0.7.0`. 25 fragments; restart **and rebuild** — the browser bundle changed. |
+| **Q4 2026** | `0.7.1` ✅ | **Security**: five advisories — behind a reverse proxy on the bundle's own host, the admin `/_gina/*` endpoints and `/_gina/metrics` admitted every client the proxy relayed; the cross-origin write guard in front of the `/_gina/*` control endpoints missed a leading path segment, the endpoint path at the end of a query string and another letter case; one `GET` of the client routing table spelled in another letter case stopped an isaac bundle; command output logs and the log-listener port file left the shared temp directory; and `settings.swig.autoescape: true` is applied on npm installs — plus CLI hardening: commands that start other gina commands, and an isaac bundle's boot, no longer build shell command lines, and the CLI matches names literally in its registry lookups. **Changed**: new project and bundle names follow a naming rule; less work per routed request — about a third less CPU on a JSON route — and an instance of an `inherits()` class no longer carries its own `prototype`. **Fixed**: the built-in `/_gina/*` endpoints answer a URL with a query string and the health check answers `HEAD`; a page whose query string ends in an endpoint path gets the page; isaac's own event streams answer HTTP/2; the maintenance IP allowlist on an isaac bundle serving HTTP/1.1; the storage endpoints during a maintenance window, and `storage:gc --dry-run` and `--driver=` against a running bundle; a JSON body sent to a control toggle on express; a daemon-started bundle's boot warnings in the `bundle:start` output; project commands from a path with a space, `bundle:stop`'s pid file, lookups that took one name for another extending it, and a `--restart-pid` flag; the Inspector's target URL with a query string; a bundle with templates walking the call stack on every request; the output cache read while disabled; and the path helper's per-path registry. 34 fragments; restart **and rebuild** — the browser bundle changed — and restart the framework daemon and any running `gina tail`. |
 | **2027** | `0.7.x` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`; the per-request configuration view — `getConfig()` without the deep clone — shipped in `0.6.30`) · ISO 27001 supplier evidence — an SBOM attached to every release, once releases are cut by the CI release workflow · Beemaster admin + visual translation editor (moved from `0.6.x`) |
 | **2027** | `0.8.0` | **Swig output auto-escaping on by default** — `settings.swig.autoescape` becomes `true` when a bundle leaves it unset (prepared in `0.7.0`: a boot warning, the scaffold, the asset-tag fix). ⚠️ The financial-messaging content first planned here was **delivered early in `0.6.25` (2026-09-03)**: XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys. |
 | **2027** | `0.9.0` | Financial-integration heavyweights — entity-layer datastore transaction seam · message-queue connector family (AMQP / Kafka / IBM MQ) |
@@ -333,7 +334,7 @@ Technical-safeguard primitives that map to the **PCI-DSS**, **SOC2**, **HIPAA**
 | ✅ | **Transport-security posture** — A bundle resolving a cleartext scheme outside the local scope warns once at boot, naming the bundle, scheme, and scope alongside both remediations. `server.requireHttps: true` refuses the boot instead — the throw lands pre-listen, so the cleartext port is never reachable at all. `server.allowInsecure: true` is the "TLS terminates upstream" acknowledgment for the mesh / ingress / reverse-proxy topology, turning the warning into a single info line; declaring both is a boot-refused contradiction. Both are strict booleans resolved exactly like `scheme` itself — the bundle's settings win and `env.json`'s `server` block fills — and a non-boolean value refuses the boot in every scope. Terminating mTLS stays a mesh/ingress concern by design. Maps to the "encrypt everywhere / no implicit network trust" principle of NIST SP 800-207 (Zero Trust). | `0.5.26-alpha.2` | shipped |
 | ✅ | **Deny-by-default authorization mode** — `settings.json > auth.requireAuthByDefault: true` inverts a bundle's posture: a route declaring no authorization key is gated rather than open, and opts back out with `param.public: true`. The mode is keyed per bundle, so one bundle's posture can never un-gate a sibling's in a merged process. The existing `requireAuth` / `roles` / `policy` keys are unaffected — only the un-annotated route changes — and `public` is evaluated inside the un-annotated branch, so a route carrying it alongside an explicit gate key stays gated even in a hand-edited config. The boot refuses the three shapes the mode makes dangerous: `public` beside an explicit gate key, a login route the mode would gate (an infinite self-bounce), and a mode-gated route that also declares `cache` (the render cache is read before authorization and its key carries no identity). The five framework-injected routes ship exempt, so enabling the mode cannot take the site root or the error renderer offline. Complements the shipped Authorization / RBAC control. Maps to NIST SP 800-207 least-privilege / deny-by-default. | `0.5.26-alpha.2` | shipped |
 | ✅ | **Zero-Trust deployment guide** — [Running Gina zero-trust](https://gina.io/docs/guides/zero-trust) walks the NIST SP 800-207 tenets against the controls Gina actually ships: deny-by-default authorization, the transport-posture knobs, terminating mTLS at the mesh or ingress, network default-deny between services, keeping the framework control sockets on loopback, and shipping the built-in audit / metrics / request-correlation telemetry to a SOC. An honest-boundary companion to the compliance control-mapping guide — the framework supplies the enforcement point, identity, and telemetry; the deployment supplies transport identity and segmentation. | `0.5.26-alpha.2` | shipped |
-| 📋 | **ISO 27001 supplier evidence — a published Scorecard and an error-message sanitizer** — two of the artifacts a certified customer's supplier review (ISO/IEC 27001:2022 A.5.19–A.5.22, A.8.8) asks of Gina itself: a published OpenSSF Scorecard (its prerequisites — read-only default token permissions and SHA-pinned actions in every workflow, and CodeQL analysis — are in place since 2026-09-25) and a controller-side error-message sanitizer, so a stack trace passed as an error message never reaches the JSON wire outside the local scope (the server-side twin has sanitized since `0.5.21`). The evidence Gina already offers — private vulnerability reporting with published, CVSS-scored advisories; Dependabot, OSV and Socket scans; staged npm publishing approved with 2FA — is listed on the [compliance control mapping](https://gina.io/docs/guides/compliance) guide. | `0.7.x` | Q4 2026 |
+| ✅ | **ISO 27001 supplier evidence — a published Scorecard and an error-message sanitizer** — two of the artifacts a certified customer's supplier review (ISO/IEC 27001:2022 A.5.19–A.5.22, A.8.8) asks of Gina itself: a published OpenSSF Scorecard ([live on scorecard.dev](https://scorecard.dev/viewer/?uri=github.com/gina-io/gina) since 2026-09-27, re-scored on every push to `master` and weekly; its prerequisites — read-only default token permissions and SHA-pinned actions in every workflow, and CodeQL analysis — are in place since 2026-09-25) and a controller-side error-message sanitizer, so a stack trace passed as an error message never reaches the JSON wire outside the local scope (the server-side twin has sanitized since `0.5.21`). The evidence Gina already offers — private vulnerability reporting with published, CVSS-scored advisories; Dependabot, OSV and Socket scans; staged npm publishing approved with 2FA — is listed on the [compliance control mapping](https://gina.io/docs/guides/compliance) guide. | `0.7.0` | Q4 2026 |
 | ⏸ | **ISO 27001 Annex A — the deferred technological controls** — the ISO view of two rows above, not new work: data masking and PII protection (A.8.11, A.5.34) are the deferred **PII/PHI protection** row; encryption of data at rest (A.8.24) is the deferred **field-level encryption** row. Both stay built-on-request; their interim patterns are unchanged. Everything else Gina can supply under Annex A's technological theme is shipped, and the organizational, people and physical themes are never a framework's. | — | on demand |
 | 📋 | **ISO 27001 supplier evidence — an SBOM per release** — a software bill of materials attached to every GitHub Release, generated by the CI release workflow once releases are cut there; build provenance for npm releases rides the same workflow. GitHub already exports a bill of materials for the repository on demand; what is missing is the per-release artifact. | `0.7.x` | 2027 |
 
@@ -501,7 +502,7 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | ✅ | **HTTP/1.1 hop connection reuse — one keep-alive agent per upstream instead of one per call** | `0.6.33` | 2026-09-25 | **Arc slice 4, shipped.** Every `self.query()` over HTTP/1.1 opened a new TCP connection (500 calls → 500 connections), costing ~190 µs of callee CPU per call on loopback and a full network round-trip (plus TLS) per call between pods. Calls to the same upstream now share one keep-alive pool kept for the life of the bundle: 500 sequential calls use one connection, 50 concurrent callers settle at 10, and the benchmark's median latency fell from 46 to 14 ms. One pool per upstream, never one shared: a single shared pool sent every `bundle@project` call to the wrong host. `maxSockets` (default 100) now caps the connections to one upstream. Pickup: bundle restart. |
 | ✅ | **Server-side `GOAWAY(INTERNAL_ERROR)` on long-lived HTTP/2 sessions — diagnose and fix** | `0.6.33` | 2026-09-25 | **Arc slice 5 — cause found in slice 2, fix re-checked.** After every completed response the calling bundle also sent a stream reset; the target's HTTP/2 library counts those against its reset rate limit and closed the session with `GOAWAY(INTERNAL_ERROR)` after about a thousand calls, without logging anything. The caller stopped sending them in `0.6.33`. Re-checked on the current tree: three runs of 20,000 calls (8 and 50 concurrent callers), each on one long-lived session — no GOAWAY, no failed call, no retry; the same scene with the reset put back closed the session four times in 5,000 calls. |
 | ✅ | **Routing — a candidate index for the cold match, a constant-time route cache; measured against rule count** | `0.7.0` | 2026-09-25 | **Arc slice 6 — landed (2026-09-25, for `0.7.0`).** Instead of wiring the 0.3.0 trie, a server-side index built once per routing table narrows a request the route cache has not seen to the routes whose URL could match; declaration order and every per-route check are unchanged, so the same route answers. Measured on the routing step, 380 routes: a late match 441 → 14 µs, a `404` 509 → 12 µs. The route cache is now one map: with it full, a lookup costs about 1.5 µs instead of 18–74 µs, and an entry keeps only the matched route — no longer the request's parameters and data. The unused trie is removed. |
-| ✅ | **Hop hygiene — per-call warning and `status` injection on the HTTP/2 hop, guide corrections, arc exit benchmark** | `0.7.0` | 2026-09-25 | **Arc slice 7 — landed (2026-09-25, for `0.7.0`).** An HTTP/2 `self.query()` answer without a `status` field no longer gets `status: 200` added or logs a warning, so both transports return the same result. The guides now say which protocol a bundle serves (HTTP/1.1 unless configured), what the HTTP/2 client retries, and when a route answers 405. The arc closed with the bundle-to-bundle benchmark re-run on the shipped tree, side by side with the arc's starting point: with default settings, no failed call at 50 concurrent callers (3,916 before, over three 10-second runs), one connection per HTTP/2 upstream and none left open after idle, and the hop's CPU cost per call down 52% over HTTP/1.1 and 58% over HTTP/2. |
+| ✅ | **Hop hygiene — per-call warning and `status` injection on the HTTP/2 hop, guide corrections, arc exit benchmark** | `0.7.0` | 2026-09-25 | **Arc slice 7 — landed (2026-09-25, for `0.7.0`).** An HTTP/2 `self.query()` answer without a `status` field no longer gets `status: 200` added or logs a warning, so both transports return the same result. The guides now say which protocol a bundle serves (HTTP/1.1 unless configured), what the HTTP/2 client retries, and when a route answers 405. The arc closed with the bundle-to-bundle benchmark re-run on the shipped tree, side by side with the arc's starting point: with default settings, no failed call at 50 concurrent callers (3,916 before, over three 10-second runs), one connection per HTTP/2 upstream and none left open after idle, and the hop's CPU cost per call down 52% over HTTP/1.1 and 58% over HTTP/2. These figures were measured from a repository checkout. Re-run on 2026-09-27 side by side from a checkout and from a copy laid out like an npm install, the benchmark showed no difference between the two beyond the run's noise: its bundles have no templates, so they never ran the per-request call-stack walk that cost bundles with templates on npm installs until 0.7.1. |
 
 ---
 

package/bin/cli

@@ -303,9 +303,12 @@ async function onExec() {
             // plane to `bind_host` (loopback by default) like the command socket.
             var mqListener = await new MQListener({ port: mqPort, hostV4: bindHost });
             // required for tail command
-            var mqPortFile = getTmpDir() + '/mq-listener-v'+ version +'.port';// jshint ignore:line
+            // #B704 — under the framework home's run dir (created 0700, the argv
+            // file's home since #B676), never the shared tmp dir where another
+            // local user could create the file first.
+            var mqPortFile = getArgvDir() + '/mq-listener-v'+ version +'.port';// jshint ignore:line
             console.debug('Writting: '+ mqPortFile);
-            fs.writeFileSync( mqPortFile, ''+mqPort );
+            fs.writeFileSync( mqPortFile, ''+mqPort, { mode: 0o600 } );
             process.on('exit', function() {
                 if ( new _(mqPortFile).existsSync() ) {
                     fs.unlinkSync(mqPortFile);

package/bin/gina

@@ -31,8 +31,6 @@ const {spawn}       = require('child_process');
 const {execSync}    = require('child_process');
 var runtime         = require(__dirname + '/../utils/runtime.js');
 
-var restartPid      = null;
-
 function runAsSubProcess() {
 
     var argv            =  Array.from(process.argv);
@@ -91,11 +89,8 @@ function runAsSubProcess() {
             // Docker considerations: All signals except for SIGKILL and SIGSTOP can be intercepted by the process.
             // Ref.: https://medium.com/@gchudnov/trapping-signals-in-docker-containers-7a57fdda7d86
             console.info('Gina server started with PID `'+ child.pid +'`');
-            // Sending kill command to parent restart process
-            if (restartPid) {
-                // We can't just use process.kill() here ...
-                process.stdout.write('[ quit ]\n');
-            }
+            // #B689 — the `[ quit ]` line written here for a `--restart-pid` start is removed
+            // (see runCMD).
 
             // Docker fix - 2022-08-20
             process.exit(0);
@@ -158,24 +153,14 @@ function runAsSubProcess() {
 */
 function runCMD() {
     var argv = Array.from(process.argv);
-    // BO - filter restartPid
-    var r = 0;
-    for (let i=0, len=process.argv.length; i<len; i++) {
-        let arg = process.argv[i];
-        if ( /\-\-restart\-pid/.test(arg) ) {
-            restartPid = ~~(arg.split(/\=/)[1]);
-            r = i;
-            break;
-        }
-
-    }
-    r = null;
-    if (restartPid) {
-        console.debug('removing `--restart-pid`: '+ restartPid);
-        // removing `--restart-pid`
-        Array.prototype.splice.call(process.argv, r, 1);
-    }
-    // EO - filter restartPid
+    // #B689 (2026-09-27) — the `--restart-pid=<pid>` filter that stood here, and the `[ quit ]`
+    // line it gated in runAsSubProcess(), are removed. They served framework:restart's METHOD #1
+    // (a detached `gina start --restart-pid=<pid>`), which was never called and which #B665 S1
+    // removed; nothing read `[ quit ]`. The filter reset its index to null after its search, so
+    // the splice removed argv[0] (the runtime path) instead of the flag: `start --restart-pid=N`
+    // started the daemon without `start`, and any other command reached bin/cli shifted by one.
+    // A typed `--restart-pid` is now passed on like any other flag. The removed code is in git
+    // history.
 
     if ( /^(start|framework:start)$/.test(argv[2]) ) {
         try {

package/framework/v0.7.1/VERSION

@@ -0,0 +1 @@
+0.7.1

package/framework/{v0.7.0 → v0.7.1}/core/asset/plugin/dist/vendor/gina/inspector/inspector.js

@@ -2370,11 +2370,27 @@
         return (bytes / (1024 * 1024)).toFixed(1) + ' MB';
     }
 
+    /**
+     * #B719 — Reduce a `?target=` value to the origin + path the Inspector
+     * appends `/_gina/…` to: drop a query string or a fragment, then trailing
+     * slashes. A pasted page URL (`http://host/page?x=1`) otherwise built
+     * `http://host/page?x=1/_gina/agent`, which puts the endpoint path in the
+     * query string.
+     *
+     * @inner
+     * @param {?string} raw - The `?target=` value (null when absent)
+     * @returns {string} The normalised target, or '' when nothing is left
+     */
+    function normaliseTarget(raw) {
+        return String(raw || '').replace(/[?#].*$/, '').replace(/\/+$/, '');
+    }
+
     /**
      * Resolve the base URL prefix for a per-bundle `/_gina/*` endpoint.
      *
      * Three-fallback resolver (the same logic `toggleReveal()` uses): (1) a
-     * `?target=` query param (standalone mode), (2) the opener's pathname
+     * `?target=` query param (standalone mode; its own query string and
+     * fragment dropped, see {@link normaliseTarget}), (2) the opener's pathname
      * (statusbar-opened mode — routes to the bundle that rendered the current
      * page), (3) the Inspector's own pathname with `_gina/inspector...` stripped.
      * Critical in proxy-routed multi-bundle setups where bundles share a host and
@@ -2393,7 +2409,7 @@
     function resolveBundleBase() {
         try {
             var params = new URLSearchParams(window.location.search);
-            var target = (params.get('target') || '').replace(/\/+$/, '');
+            var target = normaliseTarget(params.get('target'));
             if (target) {
                 return target;
             }
@@ -4614,11 +4630,9 @@
         if (typeof EventSource === 'undefined') return false;
 
         var params = new URLSearchParams(window.location.search);
-        var target = params.get('target');
+        var target = normaliseTarget(params.get('target')); // #B719
         if (!target) return false;
 
-        // Normalise: strip trailing slash
-        target = target.replace(/\/+$/, '');
         var url = target + '/_gina/agent';
 
         // #INS9b — when the target bundle's agent endpoint is auth-gated
@@ -4735,11 +4749,10 @@
         if (typeof WebSocket === 'undefined') return false;
 
         var params = new URLSearchParams(window.location.search);
-        var target = params.get('target');
+        var target = normaliseTarget(params.get('target')); // #B719
         if (!target) return false;
 
-        // Normalise: strip trailing slash, switch scheme to ws/wss.
-        target = target.replace(/\/+$/, '');
+        // Switch the scheme to ws/wss.
         var wsUrl = target.replace(/^http/i, 'ws') + '/_gina/agent';
 
         var agentKey = params.get('key');

package/framework/{v0.7.0 → v0.7.1}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -30805,19 +30805,16 @@ function Inherits(a, b) {
                     return function() {
 
                         if (this) {
-                            this.prototype = cache.prototype;
-
+                            // Nothing is copied onto the instance: the prototype chain
+                            // (z.prototype -> a.prototype -> b.prototype) resolves every inherited
+                            // member. Retired (phase-2 per-request trims, slice A — the router
+                            // composes a controller class on every routed request): an own
+                            // `prototype` property on each instance, a stamp of the instance's
+                            // `name` onto a SHARED prototype on every `new`, and a for...in copying
+                            // the parent prototype's falsy members as own — nothing read the first
+                            // two, and EventEmitter re-sets its three falsy members as own anyway.
                             if (!this.name) this.name = cache.name;
 
-                            this.prototype.name = this.name;
-
-                            //makes it compatible with node.js classes like EventEmitter
-                            for (var prop in b.prototype) {
-                                if (!this[prop]) {
-                                    this[prop] = b.prototype[prop];
-                                }
-                            }
-
                             b.apply(this, arguments);
                             cache.apply(this, arguments);
                         }