gina 0.7.0 → 0.7.1

package/framework/v0.7.1/lib/cmd/project/stop.js

@@ -0,0 +1,98 @@
+// #B665 (2026-09-27) — execFile: bundle:stop runs from an argument vector, without a shell.
+// var exec        = require('child_process').exec;
+var execFile    = require('child_process').execFile;
+
+var CmdHelper   = require('./../helper');
+var console     = lib.logger;
+/**
+ * @module gina/lib/cmd/project/stop
+ */
+/**
+ * Stops all bundles in a project.
+ * Delegates to `gina bundle:stop @<project>` (bulk mode), run as an `execFile`
+ * child of the same runtime and CLI script, without a shell (#B665).
+ *
+ * Usage:
+ *  gina project:stop @<project_name>
+ *
+ * @class Stop
+ * @constructor
+ * @param {object} opt - Parsed command-line options
+ * @param {object} opt.client - Socket client or process.stdout for terminal output
+ * @param {string[]} opt.argv - Full argv array
+ * @param {number} [opt.debugPort] - Node.js inspector port
+ * @param {boolean} [opt.debugBrkEnabled] - True when --inspect-brk is active
+ * @param {object} cmd - The cmd dispatcher object (lib/cmd/index.js)
+ */
+function Stop(opt, cmd) {
+
+    var self = {};
+
+    /**
+     * Validates the configuration, takes the runtime and CLI script paths off
+     * `process.argv` as an argument pair (`self.cliArgv`), then stops the project.
+     *
+     * @inner
+     * @private
+     * @param {object} opt - Parsed command-line options
+     * @param {object} cmd - The cmd dispatcher object
+     * @returns {(boolean|void)} false when the CLI is not configured
+     */
+    var init = function(opt, cmd) {
+        // import CMD helpers
+        new CmdHelper(self, opt.client, { port: opt.debugPort, brkEnabled: opt.debugBrkEnabled });
+
+        // check CMD configuration
+        if (!isCmdConfigured()) return false;
+
+        // #B665 (2026-09-27) — the runtime and CLI script paths stay an argument pair: the
+        // child runs without a shell (the pair was joined into a command line, unquoted,
+        // so an install path containing a space broke project:stop).
+        // self.cmdStr = process.argv.splice(0, 2).join(' ');
+        self.cliArgv = process.argv.splice(0, 2);
+
+        stop(opt, cmd);
+    }
+
+    /**
+     * Runs `bundle:stop @<project>`, then exits with the child's outcome.
+     *
+     * @inner
+     * @private
+     * @param {object} opt - Parsed command-line options
+     * @param {object} cmd - The cmd dispatcher object
+     * @returns {void}
+     */
+    var stop = function(opt, cmd) {
+
+        // #B665 (2026-09-27) — an argument vector, without a shell: the command line spliced
+        // the CLI path and the project name in unquoted.
+        // var _cmd = '$gina bundle:stop @' + self.projectName;
+        // _cmd = _cmd.replace(/\$(gina)/g, self.cmdStr);
+        var argv = [self.cliArgv[1], 'bundle:stop', '@' + self.projectName];
+        // for the debug line only: nothing runs this string
+        var _cmd = [self.cliArgv[0]].concat(argv).join(' ');
+
+        console.info('Stopping all bundles in @' + self.projectName + ' ...');
+        console.debug('Executing: ' + _cmd);
+
+        // Re-export the home: the bootstrap env sweep strips GINA_* from
+        // process.env, so the delegated bundle command would otherwise act
+        // on the default home (see linkGina in project/add.js).
+        // was: exec(_cmd, { maxBuffer: … }, function(err, stdout, stderr) {
+        execFile(self.cliArgv[0], argv, { maxBuffer: 1024 * 500, env: Object.assign({}, process.env, { GINA_HOMEDIR: GINA_HOMEDIR }) }, function(err, stdout, stderr) {
+            if (stdout) {
+                console.log(stdout);
+            }
+            if (err) {
+                console.error(err.toString());
+                return process.exit(1);
+            }
+            process.exit(0);
+        });
+    }
+
+    init(opt, cmd);
+}
+
+module.exports = Stop

package/framework/{v0.7.0 → v0.7.1}/lib/cmd/protocol/set.js

@@ -4,6 +4,7 @@ var rl = readline.createInterface({ input: process.stdin, output: process.stdout
 var CmdHelper = require('./../helper');
 var console = lib.logger;
 var scan = require('../port/inc/scan');
+var escapeRegex = require('./../bundle/inc/name-rewrite').escapeRegex;
 
 /**
  * Set a protocol to your project
@@ -308,7 +309,9 @@ function Set(opt, cmd) {
         projectConfig[self.projectName].protocols       = self.protocols;
         projectConfig[self.projectName].schemes         = self.schemes;
 
-        var re      = new RegExp('\@'+ self.projectName +'$', '');
+        // #B665 — the project name is matched literally: a `.` matched any character.
+        // was: var re      = new RegExp('\@'+ self.projectName +'$', '');
+        var re      = new RegExp('@' + escapeRegex(self.projectName) + '$', '');
         var bundles = self.bundles;
         var envs    = self.envs;
 
@@ -519,7 +522,9 @@ function Set(opt, cmd) {
         //var bundles = self.bundles;
         var envs            = self.envs;
         var scopes          = self.scopes;
-        var re              = new RegExp('\@'+ self.projectName +'$', '');
+        // #B665 — the project name is matched literally: a `.` matched any character.
+        // was: var re              = new RegExp('\@'+ self.projectName +'$', '');
+        var re              = new RegExp('@' + escapeRegex(self.projectName) + '$', '');
         var ports           = JSON.clone(local.ports);
         var portsReverse    = JSON.clone(local.portsReverse);
         if ( typeof(ports[protocol]) == 'undefined' ) {

package/framework/{v0.7.0 → v0.7.1}/lib/inherits/src/main.js

@@ -62,19 +62,16 @@ function Inherits(a, b) {
                     return function() {
 
                         if (this) {
-                            this.prototype = cache.prototype;
-
+                            // Nothing is copied onto the instance: the prototype chain
+                            // (z.prototype -> a.prototype -> b.prototype) resolves every inherited
+                            // member. Retired (phase-2 per-request trims, slice A — the router
+                            // composes a controller class on every routed request): an own
+                            // `prototype` property on each instance, a stamp of the instance's
+                            // `name` onto a SHARED prototype on every `new`, and a for...in copying
+                            // the parent prototype's falsy members as own — nothing read the first
+                            // two, and EventEmitter re-sets its three falsy members as own anyway.
                             if (!this.name) this.name = cache.name;
 
-                            this.prototype.name = this.name;
-
-                            //makes it compatible with node.js classes like EventEmitter
-                            for (var prop in b.prototype) {
-                                if (!this[prop]) {
-                                    this[prop] = b.prototype[prop];
-                                }
-                            }
-
                             b.apply(this, arguments);
                             cache.apply(this, arguments);
                         }

package/framework/{v0.7.0 → v0.7.1}/lib/maintenance/src/main.js

@@ -289,13 +289,14 @@ function lintConf(block) {
         // direct client — so listing a SHARED-EGRESS address (a proxy, LB or
         // NAT gateway) grants the bypass to everyone behind it. That is the
         // generic property of any IP allowlist rather than anything specific
-        // here (`app.json > admin.allowFrom` behaves the same way, for more
+        // here (`app.json > admin.allowFrom` has the same residual since #B709
+        // made it refuse a loopback caller carrying a proxy signal, for more
         // sensitive endpoints), but maintenance is the axis most likely to be
         // configured in a hurry during an incident — so say it out loud.
         var _loopback = ( block.allowFrom.indexOf('127.0.0.1') > -1 || block.allowFrom.indexOf('::1') > -1 );
         warnings.push('`server.maintenance.allowFrom` is set — it is honoured ONLY for requests carrying no proxy signal, and it must never list a proxy/load-balancer/NAT address (that would grant the bypass to EVERYONE behind it). Behind a reverse proxy use `bypassKey` instead.'
             + ( _loopback
-                ? ' ⚠️ It lists a LOOPBACK address, which is the single riskiest entry here: a same-host reverse proxy (the common nginx-in-front deployment) makes every visitor arrive from 127.0.0.1/::1. Unlike `admin.allowFrom`, loopback is NOT a safe default for this axis.'
+                ? ' ⚠️ It lists a LOOPBACK address, which is the single riskiest entry here: a same-host reverse proxy (the common nginx-in-front deployment) makes every visitor arrive from 127.0.0.1/::1 — a forwarding header or a port-less Host marks such a request as proxied, but a proxy that forwards Host with its port and adds no forwarding header cannot be told from a direct client. Loopback is NOT a safe default for this axis.'
                 : '' ));
     }
     if ( typeof(block.store) != 'undefined' && ( typeof(block.store) != 'string' || block.store.length === 0 ) ) {

package/framework/{v0.7.0 → v0.7.1}/lib/metrics/src/main.js

@@ -36,6 +36,15 @@
 
 'use strict';
 
+/**
+ * The admin gate's relayed-loopback rule (#B709), shared so the two IP
+ * allowlists refuse the same requests. Relative require: this file is loaded
+ * directly by its tests, without the `lib/…` bare-module path.
+ *
+ * @inner
+ */
+var admin = require('../../admin/src/main');
+
 /**
  * Cached `prom-client` module reference. Populated on first successful
  * {@link start} call.
@@ -214,6 +223,13 @@ function start(opts) {
  * Normalises IPv6-mapped IPv4 form (`::ffff:127.0.0.1`) so an entry of
  * `'127.0.0.1'` matches both `'127.0.0.1'` and `'::ffff:127.0.0.1'`.
  *
+ * #B709 — a listed loopback caller is refused when its request carries a
+ * proxy signal (`lib.admin.isRelayedLoopback`): a reverse proxy on the
+ * bundle's own host connects from loopback, so the default list would admit
+ * every client that proxy forwarded. A listed NON-loopback address (a remote
+ * scraper, or a proxy on another host) keeps admitting relayed requests. The
+ * first such refusal is logged once per process.
+ *
  * Returns `false` before {@link start}, when the allowlist is empty,
  * and when no client IP can be determined.
  *
@@ -245,16 +261,24 @@ function isClientAllowed(req) {
 
     var normalized = ip.replace(/^::ffff:/i, '');
 
+    var listed = false;
     for (var i = 0; i < list.length; i++) {
         var entry = list[i];
-        if (entry === ip)         return true;
-        if (entry === normalized) return true;
-        // Allow listed IPv4 to match the IPv6-mapped form.
-        if (/^\d+\.\d+\.\d+\.\d+$/.test(entry) && '::ffff:' + entry === ip) {
-            return true;
+        if (entry === ip || entry === normalized
+                // Allow listed IPv4 to match the IPv6-mapped form.
+                || ( /^\d+\.\d+\.\d+\.\d+$/.test(entry) && '::ffff:' + entry === ip )) {
+            listed = true;
+            break;
         }
     }
-    return false;
+    if (!listed) {
+        return false;
+    }
+    if (admin.isRelayedLoopback(req)) {
+        admin.warnRelayedOnce(req, 'metrics.allowFrom');
+        return false;
+    }
+    return true;
 }
 
 /**

package/framework/{v0.7.0 → v0.7.1}/lib/shell.js

@@ -4,6 +4,8 @@ var spawn           = require('child_process').spawn;
 var inherits        = require(require.resolve('./inherits'));
 var helpers         = require('./../helpers');
 var console         = require('./logger');
+var os              = require('os');
+var nodePath        = require('path');
 
 /**
  * @module lib/shell
@@ -58,6 +60,10 @@ function Shell () {
      * Run a command line, optionally forcing local execution.
      * Results are delivered via `.onComplete(cb)` on the returned EventEmitter;
      * streamed output via `.onData(cb)`. Both refuse a non-function callback.
+     * The child's stdout and stderr are captured in `out.log` / `err.log` inside a
+     * private per-run directory created under `GINA_TMPDIR` (the system tmp dir
+     * when that global is undefined), read back on exit and removed with it; a
+     * failure while reading them back is delivered as the run's error (#B664).
      *
      * @param {string|Array<string>} cmdline  - Command string or argument array
      * @param {boolean} [runLocal]            - Force local execution (bypass SSH config)
@@ -74,9 +80,30 @@ function Shell () {
      */
     this.run = function(cmdline, runLocal) {
 
+        if ( isWin32() ) {
+            // #B702 — checked before any file is created: the two log descriptors
+            // used to be opened above this throw and leaked on it.
+            throw new Error('Windows platform not supported yet for command line forward');
+        }
+
+        // #B664 / #B702 — every run gets a PRIVATE directory for its two log files,
+        // created under the tmp dir with an unpredictable name and mode 0700 and
+        // removed with them when the command exits. The fixed pair `<GINA_TMPDIR>/out.log`
+        // + `err.log` was shared by every concurrent run (the later one read the
+        // earlier one's output as its own, and a sibling's unlink made the close
+        // handler throw and never complete), and in a shared /tmp another local
+        // user could create those names first (CWE-377). Under a bare bootstrap the
+        // GINA_TMPDIR global is not defined: fall back to the system tmp dir instead
+        // of the relative path `undefined/out.log`.
         var opt         = getOptions()
-            , outFile   = _(GINA_TMPDIR + '/out.log')
-            , errFile   = _(GINA_TMPDIR + '/err.log')
+            , base      = ( typeof(GINA_TMPDIR) != 'undefined' && GINA_TMPDIR ) ? GINA_TMPDIR : os.tmpdir()
+        ;
+        if ( !fs.existsSync(base) ) {
+            fs.mkdirSync(base, { recursive: true });
+        }
+        var runDir      = fs.mkdtempSync(nodePath.join(base, 'gina-run-'))
+            , outFile   = _(runDir + '/out.log')
+            , errFile   = _(runDir + '/err.log')
             , out       = fs.openSync(outFile, 'a')
             , err       = fs.openSync(errFile, 'a')
         ;
@@ -95,10 +122,6 @@ function Shell () {
 
         var cmd = null;
 
-        if ( isWin32() ) {
-            throw new Error('Windows platform not supported yet for command line forward');
-        }
-
         if ( typeof(runLocal) != 'undefined' && runLocal == true ) {
 
             // cmdline must be an array !!
@@ -135,40 +158,50 @@ function Shell () {
 
         cmd.on('close', function (code) {
 
+            // #B664 — read both logs, then ALWAYS release the descriptors and the
+            // private directory, and ALWAYS deliver `run#complete`: a throw in here
+            // used to be caught below and only logged, so the caller waited forever.
+            var error = false, data, readFailure = null;
             try {
-                var error = ( fs.existsSync(errFile) ) ? fs.readFileSync(errFile).toString() : false;
-                //closing
-                fs.closeSync(err);
-                if ( fs.existsSync(errFile) ) fs.unlinkSync(errFile);
+                error = ( fs.existsSync(errFile) ) ? fs.readFileSync(errFile).toString() : false;
+                data  = ( fs.existsSync(outFile) ) ? fs.readFileSync(outFile).toString() : undefined;
+            } catch (readErr) {
+                readFailure = readErr;
+                error = readErr.stack || String(readErr);
+            } finally {
+                try { fs.closeSync(err) } catch (closeErr) { /* already closed */ }
+                try { fs.closeSync(out) } catch (closeErr) { /* already closed */ }
+                try {
+                    fs.rmSync(runDir, { recursive: true, force: true });
+                } catch (rmErr) {
+                    _console.error(rmErr.stack)
+                }
+            }
 
+            try {
                 if (error) {
                     //cmd.emit('stderr', Buffer.from(error))
-                    error = new Error(error).stack;
+                    error = readFailure ? error : new Error(error).stack;
                     cmd.emit('stderr', error)
                 }
-
-
-                var data = ( fs.existsSync(outFile) ) ? fs.readFileSync(outFile).toString() : undefined;
-                //closing
-                fs.closeSync(out);
-                if (fs.existsSync(outFile) ) fs.unlinkSync(outFile);
-
                 if ( data ) {
                     cmd.emit('stdout', Buffer.from(data))
                 }
+            } catch (listenerErr) {
+                // a throwing `onData` listener is logged, and the completion below still runs
+                _console.error(listenerErr.stack)
+            }
 
+            if ( error == '' || typeof(error) == 'undefined' || error == undefined  || error == null) {
+                error = false
+            }
 
-                if ( error == '' || typeof(error) == 'undefined' || error == undefined  || error == null) {
-                    error = false
-                }
-
-                if (code == 0 ) {
+            try {
+                if (code == 0 ) {
                     e.emit('run#complete', error, result)
                 } else {
                     e.emit('run#complete', '[ shell::run ] encountered an error: ' + error, result)
                 }
-
-
             } catch (err) {
                 _console.error(err.stack)
             }

package/framework/{v0.7.0 → v0.7.1}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "dependencies": {
     "@rhinostone/busboy": "^1.6.1",
     "@rhinostone/swig": "^2.7.2",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.7.0/core/gna');
+var _gna = require('./framework/v0.7.1/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.7.0/core/controller');
-var EntitySuper     = require('./framework/v0.7.0/core/model/entity');
+var SuperController = require('./framework/v0.7.1/core/controller');
+var EntitySuper     = require('./framework/v0.7.1/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.7.0/lib/uuid');
+var uuid = require('./framework/v0.7.1/lib/uuid');
 
 module.exports = {