gina 0.7.0 → 0.7.1

package/framework/{v0.7.0 → v0.7.1}/lib/cmd/port/list.js

@@ -3,6 +3,9 @@ var fs = require('fs');
 var CmdHelper = require('./../helper');
 var console = lib.logger;
 var Collection = lib.Collection;
+// #B665 — every name below is matched literally: a `.` matched any character, and a `+`
+// or `(` in a registered name broke the listing or threw.
+var escapeRegex = require('./../bundle/inc/name-rewrite').escapeRegex;
 
 /**
  * @module gina/lib/cmd/port/list
@@ -278,7 +281,8 @@ function List(opt, cmd) {
             let protocols   = project.protocols;
             let schemes     = project.schemes;
 
-            re = new RegExp('\@' + projectName + '\/', '');// searching by projectName
+            // was: re = new RegExp('\@' + projectName + '\/', '');// searching by projectName
+            re = new RegExp('@' + escapeRegex(projectName) + '/', '');// searching by projectName
             str += '------------------------------------\n\r';
             if (!project.exists || project.exists && protocols.length == 0) {
                 str += '?! '
@@ -315,7 +319,8 @@ function List(opt, cmd) {
                             continue;
                         }
 
-                        let re2 = new RegExp(_bundle +'\@' + projectName + '\/'+ _env, '');// searching by projectName
+                        // was: let re2 = new RegExp(_bundle +'\@' + projectName + '\/'+ _env, '');// searching by projectName
+                        let re2 = new RegExp(escapeRegex(_bundle +'@' + projectName + '/'+ _env), '');// searching by projectName
                         // if (re.test(self.portsData[protocol][scheme][port]) ) {
                         if (re2.test(self.portsData[protocol][scheme][port])) {
                             found = true;
@@ -391,7 +396,8 @@ function List(opt, cmd) {
                     continue;
                 }
                 str += '  [ ' + scheme + ' ]\n\r';
-                re = new RegExp('\@' + self.projectName + '\/', '');// searching by projectName
+                // was: re = new RegExp('\@' + self.projectName + '\/', '');// searching by projectName
+                re = new RegExp('@' + escapeRegex(self.projectName) + '/', '');// searching by projectName
                 for (let port in self.portsData[protocol][scheme]) {
                     let bundleEnv = self.portsData[protocol][scheme][port].replace(re, ':').split(/\:/);
                     let _bundle = bundleEnv[0];
@@ -400,7 +406,8 @@ function List(opt, cmd) {
                         continue;
                     }
 
-                    let re2 = new RegExp(_bundle +'\@' + self.projectName + '\/'+ _env, '');// searching by projectName
+                    // was: let re2 = new RegExp(_bundle +'\@' + self.projectName + '\/'+ _env, '');// searching by projectName
+                    let re2 = new RegExp(escapeRegex(_bundle +'@' + self.projectName + '/'+ _env), '');// searching by projectName
                     if (re2.test(self.portsData[protocol][scheme][port])) {
 
                         str += '\n\r    - ' + port + '  ' + self.portsData[protocol][scheme][port].replace(re, ' (') + ')';
@@ -460,14 +467,16 @@ function List(opt, cmd) {
                 let bundle = self.name;
                 found = false;
                 // re = new RegExp('^' + bundle + '\@', '');// searching by bundle name
-                re = new RegExp('^' + bundle + '\@' + self.projectName + '\/', '');// searching by projectName
+                // was: re = new RegExp('^' + bundle + '\@' + self.projectName + '\/', '');// searching by projectName
+                re = new RegExp('^' + escapeRegex(bundle + '@' + self.projectName + '/'), '');// searching by projectName
                 for (let port in self.portsData[protocol][scheme]) {
 
                     let bundleEnv = self.portsData[protocol][scheme][port].replace(re, '\:').split(/\:/);
                     let _bundle = bundleEnv[0] || bundle;
                     let _env = bundleEnv[1];
 
-                    let re2 = new RegExp(_bundle +'\@' + self.projectName + '\/'+ _env, '');// searching by <bundle>@<projectName>
+                    // was: let re2 = new RegExp(_bundle +'\@' + self.projectName + '\/'+ _env, '');// searching by <bundle>@<projectName>
+                    let re2 = new RegExp(escapeRegex(_bundle +'@' + self.projectName + '/'+ _env), '');// searching by <bundle>@<projectName>
                     if (re2.test(self.portsData[protocol][scheme][port])) {
                         str +=  '    ' +scheme+ ' ' + port + '  ' + bundle + ' ' + self.portsData[protocol][scheme][port].replace(re, '').replace(/[-_a-z 0-9]+\//i, '(') + ')';
                         found = true;

package/framework/{v0.7.0 → v0.7.1}/lib/cmd/port/reset.js

@@ -5,6 +5,7 @@ const fs            = require('fs');
 var console     = lib.logger;
 var CmdHelper   = require('./../helper');
 var scan        = require('../port/inc/scan');
+var escapeRegex = require('./../bundle/inc/name-rewrite').escapeRegex;
 const { setFips } = require('crypto');
 
 /**
@@ -131,7 +132,11 @@ function Reset(opt, cmd) {
             for (let protocol in ports) {
                 for (let scheme in ports[protocol]) {
                     for (let p in ports[protocol][scheme]) {
-                        let re = new RegExp('^'+ bundle +'@'+ project);
+                        // #B665 — the names are matched literally, and the project must end at
+                        // the `/` that follows it: `^api@shop` matched `api@shopping/dev`, whose
+                        // ports went with this bundle's.
+                        // was: let re = new RegExp('^'+ bundle +'@'+ project);
+                        let re = new RegExp('^' + escapeRegex(bundle +'@'+ project +'/'));
                         if ( re.test( ports[protocol][scheme][p]) ) {
                             delete self.portsData[protocol][scheme][p]
                         }
@@ -321,7 +326,11 @@ function Reset(opt, cmd) {
 
                                         // ports
                                         portValue = local.bundle +'@'+ self.projectName +'/'+ envs[e];
-                                        re = new RegExp(portValue);
+                                        // #B665 — matched as one whole JSON string of the registry text:
+                                        // unescaped and unanchored, `api@shop/dev` was found inside
+                                        // `"myapi@shop/devel"`, so its assignment was skipped as existing.
+                                        // was: re = new RegExp(portValue);
+                                        re = new RegExp(escapeRegex(JSON.stringify(portValue)));
 
 
                                         if ( !re.test(portsListStr) ) {

package/framework/{v0.7.0 → v0.7.1}/lib/cmd/project/add.js

@@ -11,6 +11,8 @@ var console     = lib.logger;
 var scan        = require('../port/inc/scan');
 var scopeName   = require('../scope/inc/name');
 var envName     = require('../env/inc/name');
+var projectNameRule = require('./inc/name');
+var escapeRegex = require('./../bundle/inc/name-rewrite').escapeRegex;
 
 /**
  * @module gina/lib/cmd/project/add
@@ -67,6 +69,31 @@ function Add(opt, cmd) {
         return ( typeof(arg) == 'string' && arg.indexOf(prefix) === 0 ) ? arg.substring(prefix.length) : null;
     }
 
+    /**
+     * Whether `name` is already registered in the framework's `projects.json`, as an own
+     * key: a name every object inherits (`constructor`) is never a registration. `init()`
+     * reads the registry itself because the CLI bootstrap (`isCmdConfigured()`) loads it
+     * only later. A missing or unreadable registry counts as no registration, so the
+     * project-name rule then applies.
+     *
+     * @inner
+     * @private
+     * @param {string} name - Project name, without its `@`
+     * @returns {boolean} True when `projects.json` holds `name` as an own key
+     *
+     * @example
+     *  isRegisteredProject('myproject')   // → true once `gina project:add @myproject` has run
+     *  isRegisteredProject('constructor') // → false: an inherited property is not a registration
+     */
+    var isRegisteredProject = function(name) {
+        try {
+            var registry = requireJSON(_(GINA_HOMEDIR + '/projects.json', true));
+            return !!registry && Object.prototype.hasOwnProperty.call(registry, name);
+        } catch (err) {
+            return false;
+        }
+    }
+
     /**
      * Parses argv flags, ensures the project directory exists, creates package.json,
      * manifest.json, and env.json, optionally adding scope/env via sub-commands.
@@ -82,6 +109,10 @@ function Add(opt, cmd) {
      * value that is not registered yet is registered by a `scope:add` / `env:add` child,
      * spawned from an argument vector — never through a shell string.
      *
+     * The project name itself gets the same treatment on `project:add` (#B665): a name
+     * not registered yet must pass the project-name rule (`inc/name.js`), or it is refused
+     * before anything is written, exit 1. A registered name, and `project:import`, skip it.
+     *
      * @inner
      * @private
      *
@@ -90,6 +121,8 @@ function Add(opt, cmd) {
      *  // → registers `staging` and `qa` if missing, then the project
      *  // gina project:add @myproject --path=/srv/myproject --scope='x;touch y'
      *  // → '"x;touch y" is not a valid scope name: …', exit 1, nothing written
+     *  // gina project:add @My.Project --path=/srv/my-project
+     *  // → '"My.Project" is not a valid project name: …', exit 1, nothing written
      */
     var init = function() {
 
@@ -143,6 +176,18 @@ function Add(opt, cmd) {
                 console.error( envName.describeInvalidEnvName(self.env) );
                 process.exit(1)
             }
+
+            // #B665 — a NEW project name must pass the project-name rule (`inc/name.js`)
+            // before anything is written: the CLI bootstrap below checks only its first
+            // character, and creates the `--path` directory. A name already registered
+            // keeps working, so re-running `project:add` on it goes on as before.
+            if ( /^@/.test(process.argv[3]) ) {
+                let candidate = process.argv[3].substring(1);
+                if ( !isRegisteredProject(candidate) && !projectNameRule.isValidProjectName(candidate) ) {
+                    console.error( projectNameRule.describeInvalidProjectName(candidate) );
+                    process.exit(1)
+                }
+            }
         }
 
         // check CMD configuration
@@ -884,7 +929,11 @@ function Add(opt, cmd) {
 
                                         // ports
                                         portValue = local.bundle +'@'+ self.projectName +'/'+ envs[e];
-                                        re = new RegExp(portValue);
+                                        // #B665 — matched as one whole JSON string of the registry text:
+                                        // unescaped and unanchored, `api@shop/dev` was found inside
+                                        // `"myapi@shop/devel"`, so its assignment was skipped as existing.
+                                        // was: re = new RegExp(portValue);
+                                        re = new RegExp(escapeRegex(JSON.stringify(portValue)));
 
 
                                         if ( !re.test(portsListStr) ) {

package/framework/{v0.7.0 → v0.7.1}/lib/cmd/project/help.txt

@@ -5,10 +5,6 @@
 
 [ Add a new project ]
 
-    You have 2 ways of creating your project
-
-    1st method
-    ----------
     $ gina project:add @<project_name> [ --path=/var/www/<project_name> ] (if no path given, will take the current)
 
     where `/var/www/<project_name>` is the destination path
@@ -21,10 +17,10 @@
     where `~/.<project_name>/v2` is the project homedir path
     If you do not specifiy a `.<project_name>` for the `--homedir` argument , gina will reuse the one you used with `@<project_name>`
 
-    2nd method
-    ----------
-    From current project path : project name will be by default the current project folder name
-    $ gina project:add
+    A project name is made of letters, digits, `_`, `.` and `-`, and starts with a
+    lowercase letter, a digit, `_` or `.`. `.`, `..` and the name of a property every
+    object inherits, such as `constructor`, are refused. A name registered before this
+    rule existed keeps working.
 
 
 [ Import an existing project ]
@@ -83,6 +79,8 @@
 
     $ gina project:rename @<project_name> @<new_project_name>
 
+    The new name follows the naming rule of `project:add`.
+
 
 [ Move project ]
 
@@ -120,3 +118,5 @@
 
     N.B.: node_modules is not in the backup — run `npm install` afterwards.
     Pass --force to overwrite an already-registered name or a non-empty target.
+    A new name follows the naming rule of `project:add`, checked before anything
+    is extracted.

package/framework/v0.7.1/lib/cmd/project/inc/name.js

@@ -0,0 +1,71 @@
+/**
+ * @module gina/lib/cmd/project/inc/name
+ *
+ * The rule a NEW project name must pass (#B665): `gina project:add`, the new name of
+ * `gina project:rename` and the `@<name>` of `gina project:restore` apply it before they
+ * write anything. A project name becomes a key in `projects.json`, the project home
+ * directory `~/.<name>`, part of every `<bundle>@<project>` string in `ports.json` and
+ * `ports.reverse.json`, and part of each bundle's process title. The CLI used to check
+ * only a name's first character, so it registered names holding shell and
+ * regular-expression syntax, `.` and `..` (whose home is `~/..`), and names every object
+ * inherits (`constructor`), which the registry's `typeof(projects[name]) != 'undefined'`
+ * tests take for an existing project.
+ *
+ * The rule is the scope-name rule (`lib/cmd/scope/inc/name.js`, #B626, #B639). A name
+ * registered before it existed keeps working: the commands apply it to a name that is
+ * not registered yet, and `project:import` does not apply it.
+ *
+ * No `fs`, no framework globals — require-by-path unit-testable. It lives in `inc/` so the
+ * command loader never takes it for a `project:<action>` handler.
+ */
+'use strict';
+
+var scopeName = require('../../scope/inc/name');
+
+/**
+ * Whether `name` is a project name the CLI may register: letters, digits, `_`, `.` and
+ * `-`, starting with a lowercase letter, a digit, `_` or `.`; neither `.` nor `..`; and not
+ * a property every object inherits.
+ *
+ * @param {*} name - Candidate project name, without its `@`
+ * @returns {boolean} True when the scope-name rule accepts it
+ *
+ * @example
+ *  isValidProjectName('myproject');     // true
+ *  isValidProjectName('design-system'); // true
+ *  isValidProjectName('Myproject');     // false — starts with an uppercase letter
+ *  isValidProjectName('..');            // false — its home would be ~/..
+ *  isValidProjectName('constructor');   // false — every object inherits it
+ */
+function isValidProjectName(name) {
+    return scopeName.isValidScopeName(name);
+}
+
+/**
+ * The refusal message for a name `isValidProjectName()` rejects. A reserved name is named
+ * as such; any other name gets the character rule. The value is JSON-quoted, so
+ * whitespace and control characters stay visible.
+ *
+ * @param {*} name - The rejected name, without its `@`
+ * @returns {string} The message, naming the value
+ *
+ * @example
+ *  describeInvalidProjectName('constructor');
+ *  // '"constructor" is not a valid project name: it is a property every object inherits, ...'
+ *  describeInvalidProjectName('a b');
+ *  // '"a b" is not a valid project name: use letters, digits, ...'
+ */
+function describeInvalidProjectName(name) {
+    var shown = JSON.stringify(String(name));
+    if ( scopeName.isReservedName(name) ) {
+        return shown + ' is not a valid project name: it is a property every object inherits, so it'
+            + ' cannot be used as a key in the project registry.';
+    }
+    return shown + ' is not a valid project name: use letters, digits, `_`, `.` and `-`, starting with a'
+        + ' lowercase letter, a digit, `_` or `.` (`.` and `..` are refused).';
+}
+
+module.exports = {
+    isValidProjectName         : isValidProjectName,
+    describeInvalidProjectName : describeInvalidProjectName
+};

package/framework/{v0.7.0 → v0.7.1}/lib/cmd/project/remove.js

@@ -1,5 +1,6 @@
 var fs          = require('fs');
 var CmdHelper   = require('./../helper');
+var escapeRegex = require('./../bundle/inc/name-rewrite').escapeRegex;
 var readline    = require('readline');
 var rl          = readline.createInterface(process.stdin, process.stdout);
 
@@ -168,7 +169,10 @@ function Remove(opt, cmd) {
 
                 for (var port in ports[protocol][scheme]) {
 
-                    re = new RegExp("\@"+ self.projectName +"\/");
+                    // #B665 — the project name is matched literally: a `.` matched any
+                    // character, so removing `my.app` also removed the ports of `my-app`.
+                    // was: re = new RegExp("\@"+ self.projectName +"\/");
+                    re = new RegExp('@' + escapeRegex(self.projectName) + '/');
 
                     if ( re.test(ports[protocol][scheme][port]) ) {
                         // reverse ports

package/framework/{v0.7.0 → v0.7.1}/lib/cmd/project/rename.js

@@ -2,6 +2,7 @@ var fs          = require('fs');
 
 var CmdHelper   = require('./../helper');
 var console     = lib.logger;
+var projectNameRule = require('./inc/name');
 
 /**
  * @module gina/lib/cmd/project/rename
@@ -35,6 +36,9 @@ function Rename(opt, cmd) {
     /**
      * Validates that exactly two project tokens are provided, then delegates to rename.
      *
+     * The new name must pass the project-name rule (`inc/name.js`), or the rename is
+     * refused before anything moves, exit 1 (#B665).
+     *
      * @inner
      * @private
      */
@@ -54,6 +58,14 @@ function Rename(opt, cmd) {
         local.source = self.projectName;
         local.target = self.projectArgvList[1];
 
+        // #B665 — the new name must pass the project-name rule (`inc/name.js`): the CLI
+        // bootstrap checks only its first character. It is always a new name, since a
+        // registered one is refused as taken below.
+        if ( !projectNameRule.isValidProjectName(local.target) ) {
+            console.error( projectNameRule.describeInvalidProjectName(local.target) );
+            process.exit(1)
+        }
+
 
         // #B651 — the check was inverted: it renamed only when the new name was
         // ALREADY registered (running the rename onto another project) and refused

package/framework/v0.7.1/lib/cmd/project/restart.js

@@ -0,0 +1,126 @@
+// #B665 (2026-09-27) — execFile: bundle:restart runs from an argument vector, without a shell.
+// var exec        = require('child_process').exec;
+var execFile    = require('child_process').execFile;
+
+var CmdHelper   = require('./../helper');
+var console     = lib.logger;
+/**
+ * @module gina/lib/cmd/project/restart
+ */
+/**
+ * Restarts all bundles in a project.
+ * Delegates to `gina bundle:restart @<project>` (bulk mode), run as an `execFile`
+ * child of the same runtime and CLI script, each flag its own argument, without
+ * a shell (#B665).
+ *
+ * Usage:
+ *  gina project:restart @<project_name>
+ *
+ * @class Restart
+ * @constructor
+ * @param {object} opt - Parsed command-line options
+ * @param {object} opt.client - Socket client or process.stdout for terminal output
+ * @param {string[]} opt.argv - Full argv array
+ * @param {number} [opt.debugPort] - Node.js inspector port
+ * @param {boolean} [opt.debugBrkEnabled] - True when --inspect-brk is active
+ * @param {object} cmd - The cmd dispatcher object (lib/cmd/index.js)
+ */
+function Restart(opt, cmd) {
+
+    var self = {};
+
+    /**
+     * Validates the configuration, takes the runtime and CLI script paths off
+     * `process.argv` as an argument pair (`self.cliArgv`), keeps the `--` flags
+     * it was given as a list (`self.inheritedArgv`), then restarts the project.
+     *
+     * @inner
+     * @private
+     * @param {object} opt - Parsed command-line options
+     * @param {object} cmd - The cmd dispatcher object
+     * @returns {(boolean|void)} false when the CLI is not configured
+     */
+    var init = function(opt, cmd) {
+        // import CMD helpers
+        new CmdHelper(self, opt.client, { port: opt.debugPort, brkEnabled: opt.debugBrkEnabled });
+
+        // check CMD configuration
+        if (!isCmdConfigured()) return false;
+
+        // #B665 (2026-09-27) — the runtime and CLI script paths stay an argument pair: the
+        // child runs without a shell (the pair was joined into a command line, unquoted,
+        // so an install path containing a space broke project:restart).
+        // self.cmdStr = process.argv.splice(0, 2).join(' ');
+        self.cliArgv = process.argv.splice(0, 2);
+
+        // collect --flags to forward
+        self.inheritedArgv = [];
+        for (var i = 0, len = process.argv.length; i < len; i++) {
+            if ( /^\-\-/.test(process.argv[i]) ) {
+                self.inheritedArgv.push(process.argv[i])
+            }
+        }
+        // #B665 (2026-09-27) — kept as a list: each flag reaches bundle:restart as one argument.
+        // self.inheritedArgv = self.inheritedArgv.join(' ');
+
+        restart(opt, cmd);
+    }
+
+    /**
+     * Runs `bundle:restart @<project>` with the inherited flags and the debug
+     * flag, prints its output without the per-bundle "Trying to …" lines, then
+     * exits with the child's outcome.
+     *
+     * @inner
+     * @private
+     * @param {object} opt - Parsed command-line options (debugPort, debugBrkEnabled)
+     * @param {object} cmd - The cmd dispatcher object
+     * @returns {void}
+     */
+    var restart = function(opt, cmd) {
+
+        // #B665 (2026-09-27) — an argument vector, without a shell: the command line spliced
+        // the CLI path, the project name and every inherited `--` flag in unquoted, so a path
+        // containing a space broke the command and shell syntax in a flag ran.
+        // var _cmd = '$gina bundle:restart @' + self.projectName;
+        // if (self.inheritedArgv != '') {
+        //     _cmd += ' ' + self.inheritedArgv;
+        // }
+        // if (opt.debugPort) {
+        //     _cmd += ' --inspect';
+        //     if (opt.debugBrkEnabled) {
+        //         _cmd += '-brk'
+        //     }
+        //     _cmd += '=' + opt.debugPort;
+        // }
+        // _cmd = _cmd.replace(/\$(gina)/g, self.cmdStr);
+        var argv = [self.cliArgv[1], 'bundle:restart', '@' + self.projectName].concat(self.inheritedArgv);
+        if (opt.debugPort) {
+            argv.push('--inspect' + (opt.debugBrkEnabled ? '-brk' : '') + '=' + opt.debugPort);
+        }
+        // for the debug line only: nothing runs this string
+        var _cmd = [self.cliArgv[0]].concat(argv).join(' ');
+
+        console.info('Restarting all bundles in @' + self.projectName + ' ...');
+        console.debug('Executing: ' + _cmd);
+
+        // Re-export the home: the bootstrap env sweep strips GINA_* from
+        // process.env, so the delegated bundle command would otherwise act
+        // on the default home (see linkGina in project/add.js).
+        // was: exec(_cmd, { maxBuffer: … }, function(err, stdout, stderr) {
+        execFile(self.cliArgv[0], argv, { maxBuffer: 1024 * 500, env: Object.assign({}, process.env, { GINA_HOMEDIR: GINA_HOMEDIR }) }, function(err, stdout, stderr) {
+            if (stdout) {
+                console.log(stdout.replace(/\n\rTrying to.*/gm, ''));
+            }
+            if (err) {
+                console.error(err.toString());
+                return process.exit(1);
+            }
+            process.exit(0);
+        });
+    }
+
+    init(opt, cmd);
+}
+
+module.exports = Restart

package/framework/{v0.7.0 → v0.7.1}/lib/cmd/project/restore.js

@@ -4,6 +4,7 @@ var cp   = require('child_process');
 
 var CmdHelper = require('./../helper');
 var console   = lib.logger;
+var projectNameRule = require('./inc/name');
 
 /**
  * @module gina/lib/cmd/project/restore
@@ -66,6 +67,11 @@ function Restore(opt, cmd) {
      * `--to`, validates the archive and the (name / target) conflicts, then runs
      * the restore.
      *
+     * A name not registered yet must pass the project-name rule (`inc/name.js`) before
+     * the archive is touched (#B665): the `project:add` child that registers it would
+     * refuse it only after the tree is extracted. A registered name (restored over under
+     * `--force`) keeps working.
+     *
      * @inner
      * @private
      */
@@ -81,6 +87,19 @@ function Restore(opt, cmd) {
             return;
         }
 
+        // #B665 — a name not registered yet must pass the project-name rule (`inc/name.js`)
+        // BEFORE the archive is extracted: the `project:add` child that registers it would
+        // refuse it only after the tree is written. A registered name, as an own key
+        // (restored over under --force), keeps working.
+        if (
+            !Object.prototype.hasOwnProperty.call(self.projects || {}, local.project)
+            && !projectNameRule.isValidProjectName(local.project)
+        ) {
+            console.error( projectNameRule.describeInvalidProjectName(local.project) );
+            process.exit(1);
+            return;
+        }
+
         // The archive is a path positional — read it off argv (order-independent:
         // the first token that is neither an @<name> nor a --flag). An absolute
         // path fails isValidName(), so it never lands in self.name/self.bundles.

package/framework/v0.7.1/lib/cmd/project/start.js

@@ -0,0 +1,125 @@
+// #B665 (2026-09-27) — execFile: bundle:start runs from an argument vector, without a shell.
+// var exec        = require('child_process').exec;
+var execFile    = require('child_process').execFile;
+
+var CmdHelper   = require('./../helper');
+var console     = lib.logger;
+/**
+ * @module gina/lib/cmd/project/start
+ */
+/**
+ * Starts all bundles in a project.
+ * Delegates to `gina bundle:start @<project>` (bulk mode), run as an `execFile`
+ * child of the same runtime and CLI script, each flag its own argument, without
+ * a shell (#B665).
+ *
+ * Usage:
+ *  gina project:start @<project_name> [ --env=dev, --scope=local, --inspect-brk=5000 ]
+ *
+ * @class Start
+ * @constructor
+ * @param {object} opt - Parsed command-line options
+ * @param {object} opt.client - Socket client or process.stdout for terminal output
+ * @param {string[]} opt.argv - Full argv array
+ * @param {number} [opt.debugPort] - Node.js inspector port
+ * @param {boolean} [opt.debugBrkEnabled] - True when --inspect-brk is active
+ * @param {object} cmd - The cmd dispatcher object (lib/cmd/index.js)
+ */
+function Start(opt, cmd) {
+
+    var self = {};
+
+    /**
+     * Validates the configuration, takes the runtime and CLI script paths off
+     * `process.argv` as an argument pair (`self.cliArgv`), keeps the `--` flags
+     * it was given as a list (`self.inheritedArgv`), then starts the project.
+     *
+     * @inner
+     * @private
+     * @param {object} opt - Parsed command-line options
+     * @param {object} cmd - The cmd dispatcher object
+     * @returns {(boolean|void)} false when the CLI is not configured
+     */
+    var init = function(opt, cmd) {
+        // import CMD helpers
+        new CmdHelper(self, opt.client, { port: opt.debugPort, brkEnabled: opt.debugBrkEnabled });
+
+        // check CMD configuration
+        if (!isCmdConfigured()) return false;
+
+        // #B665 (2026-09-27) — the runtime and CLI script paths stay an argument pair: the
+        // child runs without a shell (the pair was joined into a command line, unquoted,
+        // so an install path containing a space broke project:start).
+        // self.cmdStr = process.argv.splice(0, 2).join(' ');
+        self.cliArgv = process.argv.splice(0, 2);
+
+        // collect --flags to forward
+        self.inheritedArgv = [];
+        for (var i = 0, len = process.argv.length; i < len; i++) {
+            if ( /^\-\-/.test(process.argv[i]) ) {
+                self.inheritedArgv.push(process.argv[i])
+            }
+        }
+        // #B665 (2026-09-27) — kept as a list: each flag reaches bundle:start as one argument.
+        // self.inheritedArgv = self.inheritedArgv.join(' ');
+
+        start(opt, cmd);
+    }
+
+    /**
+     * Runs `bundle:start @<project>` with the inherited flags and the debug flag,
+     * then exits with the child's outcome.
+     *
+     * @inner
+     * @private
+     * @param {object} opt - Parsed command-line options (debugPort, debugBrkEnabled)
+     * @param {object} cmd - The cmd dispatcher object
+     * @returns {void}
+     */
+    var start = function(opt, cmd) {
+
+        // #B665 (2026-09-27) — an argument vector, without a shell: the command line spliced
+        // the CLI path, the project name and every inherited `--` flag in unquoted, so a path
+        // containing a space broke the command and shell syntax in a flag ran.
+        // var _cmd = '$gina bundle:start @' + self.projectName;
+        // if (self.inheritedArgv != '') {
+        //     _cmd += ' ' + self.inheritedArgv;
+        // }
+        // if (opt.debugPort) {
+        //     _cmd += ' --inspect';
+        //     if (opt.debugBrkEnabled) {
+        //         _cmd += '-brk'
+        //     }
+        //     _cmd += '=' + opt.debugPort;
+        // }
+        // _cmd = _cmd.replace(/\$(gina)/g, self.cmdStr);
+        var argv = [self.cliArgv[1], 'bundle:start', '@' + self.projectName].concat(self.inheritedArgv);
+        if (opt.debugPort) {
+            argv.push('--inspect' + (opt.debugBrkEnabled ? '-brk' : '') + '=' + opt.debugPort);
+        }
+        // for the debug line only: nothing runs this string
+        var _cmd = [self.cliArgv[0]].concat(argv).join(' ');
+
+        console.info('Starting all bundles in @' + self.projectName + ' ...');
+        console.debug('Executing: ' + _cmd);
+
+        // Re-export the home: the bootstrap env sweep strips GINA_* from
+        // process.env, so the delegated bundle command would otherwise act
+        // on the default home (see linkGina in project/add.js).
+        // was: exec(_cmd, { maxBuffer: … }, function(err, stdout, stderr) {
+        execFile(self.cliArgv[0], argv, { maxBuffer: 1024 * 500, env: Object.assign({}, process.env, { GINA_HOMEDIR: GINA_HOMEDIR }) }, function(err, stdout, stderr) {
+            if (stdout) {
+                console.log(stdout);
+            }
+            if (err) {
+                console.error(err.toString());
+                return process.exit(1);
+            }
+            process.exit(0);
+        });
+    }
+
+    init(opt, cmd);
+}
+
+module.exports = Start