gina 0.7.0 → 0.7.1

package/framework/{v0.7.0 → v0.7.1}/core/server.isaac.js

@@ -6,7 +6,10 @@ const fs                    = require('fs');
 const crypto                = require('crypto');
 const nodePath              = require('path'); // #B179: used for path-traversal boundary enforcement
 const os                    = require('os');   // maintenance status payload: pid + hostname (per-process identity)
-const { execSync, exec }    = require('child_process');
+// #B665 S2 (2026-09-27) — execFileSync / execFile: the brotli and gzip lookups and compressions
+// run from argument vectors, so the cache path reaches them whole.
+// const { execSync, exec }    = require('child_process');
+const { execFileSync, execFile } = require('child_process');
 const {EventEmitter}        = require('events');
 // #B10 fix: engine.io is only needed when options.ioServer is configured (WebSocket support).
 // Require it lazily so bundles without WebSocket support don't crash if engine.io is absent.
@@ -133,6 +136,9 @@ function _instrumentKeyValid(req) {
  * populated it; otherwise drains the request stream (works for HTTP/1.1
  * IncomingMessage and HTTP/2 Http2ServerRequest). A 2s timeout guards against
  * an already-consumed stream that never re-fires `end`. Calls back exactly once.
+ * Accepts Buffer and string chunks: a request whose encoding was set emits strings
+ * (core/server.js calls `request.setEncoding` for every non-multipart request), which
+ * are turned back into bytes so the cap counts bytes and the read cannot throw (#B714).
  *
  * @inner
  * @param {http.IncomingMessage|http2.Http2ServerRequest} req
@@ -157,6 +163,12 @@ function _readInstrumentBody(req, cb) {
     _timer = setTimeout(function() { _finish(new Error('body read timeout')); }, 2000);
     if (_timer && typeof _timer.unref === 'function') { _timer.unref(); }
     req.on('data', function(chunk) {
+        // #B714 — a request whose encoding was set emits strings (core/server.js onInstance
+        // calls request.setEncoding for every non-multipart request): turn a string back into
+        // bytes, so the cap counts bytes and Buffer.concat below accepts every chunk.
+        if ( typeof(chunk) == 'string' ) {
+            chunk = Buffer.from(chunk, req.readableEncoding || 'utf8');
+        }
         _size += chunk.length;
         if (_size > _MAX) {
             _finish(new Error('body too large'));
@@ -166,7 +178,14 @@ function _readInstrumentBody(req, cb) {
         _chunks.push(chunk);
     });
     req.on('end', function() {
-        var _raw = Buffer.concat(_chunks).toString('utf8').trim();
+        // #B714 — a throw here escapes as an uncaughtException and stops the bundle:
+        // answer it through the callback.
+        var _raw;
+        try {
+            _raw = Buffer.concat(_chunks).toString('utf8').trim();
+        } catch (e) {
+            return _finish(e);
+        }
         if (!_raw) return _finish(null, {});
         try { _finish(null, JSON.parse(_raw)); }
         catch (e) { _finish(new Error('invalid JSON body')); }
@@ -211,6 +230,39 @@ var confineToBase = function(filename, base) {
     return null;
 }
 
+/**
+ * #B715 — the `/_gina/*` paths the maintenance gate leaves to core/server.js. core/server.js
+ * answers them in its own /_gina band, above its twin gate, where this listener does not
+ * answer them (or not in that shape), so a window would otherwise close them on this engine
+ * only: storage/stats, storage/gc and storage/verify exist only in core/server.js, and a
+ * health check whose url carries a query string misses the `$`-anchored handler here, which
+ * tests the raw url, while the core/server.js twin sees the url without its query.
+ *
+ * The compare is on the exact query-free root path, so a route the bundle declares elsewhere
+ * under /_gina/ stays behind the gate; a method or a shape core/server.js does not answer
+ * meets its twin gate there. Keep the list in step with the core/server.js /_gina band:
+ * `test/core/maintenance-gate-left-to-server-b715.test.js` fails when a core/server.js
+ * endpoint has neither a handler here above the gate nor an entry below.
+ *
+ * @inner
+ * @private
+ * @memberof module:gina/core/server.isaac
+ * @param {string} url - The raw request url, query included
+ * @returns {boolean} `true` when the gate lets the request through to core/server.js
+ * @example
+ * _isLeftToServerJs('/_gina/storage/gc?dryRun=1');  // → true
+ * _isLeftToServerJs('/_gina/health/check?probe=1'); // → true
+ * _isLeftToServerJs('/_gina/info');                 // → false (answered above the gate)
+ * _isLeftToServerJs('/web/_gina/storage/stats');    // → false (not the root path)
+ */
+function _isLeftToServerJs(url) {
+    var p = ( typeof(url) == 'string' ) ? url.split('?')[0] : '';
+    return p === '/_gina/storage/stats'
+        || p === '/_gina/storage/gc'
+        || p === '/_gina/storage/verify'
+        || p === '/_gina/health/check';
+}
+
 /**
  * Reloads all core and lib modules from disk by replacing their require.cache
  * entries with fresh exports. Excludes gna.js itself. Also refreshes the
@@ -389,14 +441,16 @@ function ServerEngineClass(options) {
         // Checking if brotli is installed
         var brotliBin = null;
         try {
-            brotliBin = execSync( 'which brotli' ).toString().trim();
+            // was: brotliBin = execSync( 'which brotli' ).toString().trim();
+            brotliBin = execFileSync( 'which', ['brotli'] ).toString().trim();
         } catch (binErr) {
             // Means that it is not installed.
         }
         // Checking if gzip is installed
         var gZipBin = null;
         try {
-            gZipBin = execSync( 'which gzip' ).toString().trim();
+            // was: gZipBin = execSync( 'which gzip' ).toString().trim();
+            gZipBin = execFileSync( 'which', ['gzip'] ).toString().trim();
         } catch (binErr) {
             // Means that it is not installed.
         }
@@ -410,7 +464,7 @@ function ServerEngineClass(options) {
         let targetFile  = null
             , fd        = null
             , buffer    = null
-            , cmd       = null
+            // , cmd       = null   (#B665 S2: the compressions take argument vectors)
             , brFileObj = null
             , gzFileObj = null
         ;
@@ -435,10 +489,12 @@ function ServerEngineClass(options) {
                         brFileObj.rmSync();
                     }
                     // Creating a new br version
-                    cmd = brotliBin +' --best '+ _(targetDir +'/'+ targetFile, true);
+                    // #B665 S2 (2026-09-27) — an argument vector: the cache path reaches brotli whole.
+                    // was: cmd = brotliBin +' --best '+ _(targetDir +'/'+ targetFile, true);
                     // replaced: execSync — async exec to avoid blocking event loop during startup (#P32)
                     // console.debug( execSync( cmd ).toString() );
-                    exec(cmd, function(brCmdErr, stdout) {
+                    // was: exec(cmd, function(brCmdErr, stdout) {
+                    execFile(brotliBin, ['--best', _(targetDir +'/'+ targetFile, true)], function(brCmdErr, stdout) {
                         if (brCmdErr) { console.error('[ SERVER ] brotli compression error: ' + (brCmdErr.stack || brCmdErr.message)); return; }
                         if (stdout) console.debug(stdout.toString().trim());
                     });
@@ -459,10 +515,12 @@ function ServerEngineClass(options) {
                         gzFileObj.rmSync();
                     }
                     // Creating a new gz version
-                    cmd = gZipBin +' -9 -k '+ _(targetDir +'/'+ targetFile, true);
+                    // #B665 S2 (2026-09-27) — an argument vector: the cache path reaches gzip whole.
+                    // was: cmd = gZipBin +' -9 -k '+ _(targetDir +'/'+ targetFile, true);
                     // replaced: execSync — async exec to avoid blocking event loop during startup (#P32)
                     // console.debug( execSync( cmd ).toString() );
-                    exec(cmd, function(gzCmdErr, stdout) {
+                    // was: exec(cmd, function(gzCmdErr, stdout) {
+                    execFile(gZipBin, ['-9', '-k', _(targetDir +'/'+ targetFile, true)], function(gzCmdErr, stdout) {
                         if (gzCmdErr) { console.error('[ SERVER ] gzip compression error: ' + (gzCmdErr.stack || gzCmdErr.message)); return; }
                         if (stdout) console.debug(stdout.toString().trim());
                     });
@@ -491,8 +549,9 @@ function ServerEngineClass(options) {
                     if ( brFileObj.existsSync() ) {
                         brFileObj.rmSync();
                     }
-                    cmd = brotliBin +' --best '+ _(targetDir +'/'+ targetFile, true);
-                    exec(cmd, function(brCmdErr, stdout) {
+                    // was: cmd = brotliBin +' --best '+ _(targetDir +'/'+ targetFile, true);
+                    // was: exec(cmd, function(brCmdErr, stdout) {
+                    execFile(brotliBin, ['--best', _(targetDir +'/'+ targetFile, true)], function(brCmdErr, stdout) {
                         if (brCmdErr) { console.error('[ SERVER ] brotli compression error: ' + (brCmdErr.stack || brCmdErr.message)); return; }
                         if (stdout) console.debug(stdout.toString().trim());
                     });
@@ -508,8 +567,9 @@ function ServerEngineClass(options) {
                     if ( gzFileObj.existsSync() ) {
                         gzFileObj.rmSync();
                     }
-                    cmd = gZipBin +' -9 -k '+ _(targetDir +'/'+ targetFile, true);
-                    exec(cmd, function(gzCmdErr, stdout) {
+                    // was: cmd = gZipBin +' -9 -k '+ _(targetDir +'/'+ targetFile, true);
+                    // was: exec(cmd, function(gzCmdErr, stdout) {
+                    execFile(gZipBin, ['-9', '-k', _(targetDir +'/'+ targetFile, true)], function(gzCmdErr, stdout) {
                         if (gzCmdErr) { console.error('[ SERVER ] gzip compression error: ' + (gzCmdErr.stack || gzCmdErr.message)); return; }
                         if (stdout) console.debug(stdout.toString().trim());
                     });
@@ -1167,6 +1227,14 @@ function ServerEngineClass(options) {
             if ( typeof(request.priority) == 'undefined' ) {
                 request.priority = lib.priority.parse(request.headers['priority']);
             }
+            // #B709 — the proxy classification of a /_gina/* request, taken ONCE from
+            // its pristine headers: the h1 Host rewrite further down would make every
+            // direct caller of a server.js-only handler (storage/*) look proxied. The
+            // admin and metrics allowlists read it. First-seer; server.js's onInstance
+            // top fills it when absent (Express). Keep the two tops in sync.
+            if ( request.url.indexOf('/_gina/') > -1 ) {
+                lib.admin.stampProxied(request);
+            }
             // #OBS1 slice 3 — HTTP request lifecycle hook for Prometheus metrics.
             // Gated on lib.metrics.isEnabled() so the listener is only wired when
             // app.json metrics.enabled is true. Records on response 'finish' (fires
@@ -1230,8 +1298,15 @@ function ServerEngineClass(options) {
             // Placed above every /_gina/* handler so current AND future ones
             // inherit the refusal. SAFE methods are untouched — the Inspector's
             // cross-origin GET/SSE channels are a documented design.
+            //
+            // #B708 — placement is not enough: the URL test must also match
+            // wherever a write handler matches. It looks for `/_gina/` anywhere
+            // in the full url, in any case, because the unanchored handlers
+            // (cache/clear, maintenance, instrument) accept a path prefix and the
+            // endpoint path at the end of the query string, and cache/clear and
+            // release/* accept any case — see the core/server.js twin.
             if (
-                /^\/_gina\//.test(request.url)
+                /\/_gina\//i.test(request.url)
                 && !lib.admin.isSafeMethod(request.method)
                 && lib.admin.isCrossOriginWrite(request)
             ) {
@@ -1261,11 +1336,26 @@ function ServerEngineClass(options) {
                 return response.end(xOrgBody);
             }
 
+            // #B709 — the admin-gated handlers below (metrics, info, cache/*,
+            // maintenance) match this query-free path EXACTLY — the root form, or the
+            // bundle's own webroot form — never the raw url: a nested endpoint path,
+            // the endpoint path in a query string, another letter case or an empty
+            // leading segment reaches none of them. storage/* and release/* stay
+            // anchored on the url. See the core/server.js twin.
+            var _ginaCtlPath = lib.admin.controlPath(request.url, options.webroot);
+
             // healthcheck
             // TODO - add a top level API : server.api.js (check, get ...)
             // TODO - on 90% RAM usage, redirect to `come back later then restart bundle`
             // TODO - check url against wroot : getContext() ?
-            if ( request.method.toUpperCase() === 'GET' && /\_gina\/health\/check$/i.test(request.url) ) {
+            // #B717 — a query string no longer misses the handler (`(?:\?|$)`, the idiom of the
+            // instrument and agent handlers). #B718 — HEAD is answered too (a load balancer may
+            // probe with HEAD): the same status and headers, no body. Kept in sync with the
+            // core/server.js twin.
+            // #B712 — `^[^?]*`: the endpoint path must end the url's PATH, not its query string
+            // (`/web/?next=/_gina/health/check` is the page's). Kept in sync with core/server.js.
+            var _healthMethod = request.method.toUpperCase();
+            if ( ( _healthMethod === 'GET' || _healthMethod === 'HEAD' ) && /^[^?]*\_gina\/health\/check(?:\?|$)/i.test(request.url) ) {
 
                 const healthStatus = JSON.stringify({
                     status: "healthy",
@@ -1281,6 +1371,14 @@ function ServerEngineClass(options) {
 
                 // HTTP/2 (Multiplexing)
                 if (response.stream) {
+                    if ( _healthMethod === 'HEAD' ) {
+                        response.stream.respond({
+                            ':status': 200,
+                            ...healthHeaders,
+                            'content-length': Buffer.byteLength(healthStatus)
+                        });
+                        return response.stream.end();
+                    }
                     // On utilise le stream pour garder la session ouverte
                     response.stream.respond({
                         ':status': 200,
@@ -1290,12 +1388,17 @@ function ServerEngineClass(options) {
                 }
 
                 // Fallback HTTP/1.1
+                if ( _healthMethod === 'HEAD' ) {
+                    healthHeaders['content-length'] = Buffer.byteLength(healthStatus);
+                    response.writeHead(200, healthHeaders);
+                    return response.end();
+                }
                 response.writeHead(200, healthHeaders);
                 return response.end(healthStatus);
             }
 
             // /_gina/metrics — Prometheus exposition format (#OBS1, slice 2)
-            if ( request.method.toUpperCase() === 'GET' && /\/_gina\/metrics$/i.test(request.url) ) {
+            if ( request.method.toUpperCase() === 'GET' && /^\/_gina\/metrics$/.test(_ginaCtlPath) ) {
                 if ( !lib.metrics.isClientAllowed(request) ) {
                     var metricsForbiddenBody    = JSON.stringify({ error: 'forbidden', message: '/_gina/metrics: client IP not in app.json metrics.allowFrom' });
                     var metricsForbiddenHeaders = _setPoweredByHeader({
@@ -1350,7 +1453,7 @@ function ServerEngineClass(options) {
                 });
             }
 
-            if ( request.method.toUpperCase() === 'GET' && /\_gina\/info$/i.test(request.url) ) {
+            if ( request.method.toUpperCase() === 'GET' && /^\/_gina\/info$/.test(_ginaCtlPath) ) {
 
                 // #S7 — IP allowlist gate. Mirrors the metrics endpoint
                 // gate at L605-621. 403 on deny.
@@ -1411,7 +1514,7 @@ function ServerEngineClass(options) {
                 return response.end(infoStatus);
             }
 
-            if ( request.method.toUpperCase() === 'GET' && /\/_gina\/cache\/stats$/i.test(request.url) ) {
+            if ( request.method.toUpperCase() === 'GET' && /^\/_gina\/cache\/stats$/.test(_ginaCtlPath) ) {
 
                 // #S7 — IP allowlist gate. Same shape as the /_gina/info gate above.
                 if ( !lib.admin.isClientAllowed(request) ) {
@@ -1466,7 +1569,7 @@ function ServerEngineClass(options) {
             // cache.invalidateOnEvents) and takes precedence over ?bundle.
             // Current-namespace fs bodies are removed via the entries' cleanup fns;
             // old-namespace fs orphans are reclaimed by the CLI (gina cache:clear).
-            if ( request.method.toUpperCase() === 'POST' && /\/_gina\/cache\/clear(\?.*)?$/i.test(request.url) ) {
+            if ( request.method.toUpperCase() === 'POST' && /^\/_gina\/cache\/clear$/.test(_ginaCtlPath) ) {
 
                 if ( !lib.admin.isClientAllowed(request) ) {
                     var cacheClearForbiddenBody    = JSON.stringify({ error: 'forbidden', message: '/_gina/cache/clear: client IP not in app.json admin.allowFrom' });
@@ -1528,7 +1631,8 @@ function ServerEngineClass(options) {
             if (
                 lib.releaseWatch.isActive()
                 && request.method.toUpperCase() === 'GET'
-                && /^\/_gina\/release\/status$/i.test(request.url)
+                // #B717 — `(?:\?|$)`: a query string no longer misses the handler
+                && /^\/_gina\/release\/status(?:\?|$)/.test(request.url)
             ) {
                 if ( !lib.admin.isClientAllowed(request) ) {
                     var _rwStatusForbiddenBody    = JSON.stringify({ error: 'forbidden', message: '/_gina/release/status: client IP not in app.json admin.allowFrom' });
@@ -1562,7 +1666,7 @@ function ServerEngineClass(options) {
             if (
                 lib.releaseWatch.isActive()
                 && request.method.toUpperCase() === 'POST'
-                && /^\/_gina\/release\/rebuild(\?.*)?$/i.test(request.url)
+                && /^\/_gina\/release\/rebuild(\?.*)?$/.test(request.url)
             ) {
                 if ( !lib.admin.isClientAllowed(request) ) {
                     var _rwRebuildForbiddenBody    = JSON.stringify({ error: 'forbidden', message: '/_gina/release/rebuild: client IP not in app.json admin.allowFrom' });
@@ -1609,7 +1713,8 @@ function ServerEngineClass(options) {
             if (
                 lib.releaseWatch.isActive()
                 && request.method.toUpperCase() === 'GET'
-                && /^\/_gina\/release\/events$/i.test(request.url)
+                // #B717 — `(?:\?|$)`: a query string no longer misses the handler
+                && /^\/_gina\/release\/events(?:\?|$)/.test(request.url)
             ) {
                 if ( !lib.admin.isClientAllowed(request) ) {
                     var _rwEventsForbiddenBody    = JSON.stringify({ error: 'forbidden', message: '/_gina/release/events: client IP not in app.json admin.allowFrom' });
@@ -1624,10 +1729,11 @@ function ServerEngineClass(options) {
                     response.writeHead(403, _rwEventsForbiddenHeaders);
                     return response.end(_rwEventsForbiddenBody);
                 }
+                // #B722 — no `connection` in the shared set: HTTP/2 forbids connection-specific
+                // headers, node's respond() threw on it, and the stream never opened over h2
                 var _rwSseHeaders = _setPoweredByHeader({
                     'content-type': 'text/event-stream; charset=utf-8',
                     'cache-control': 'no-cache, no-store',
-                    'connection': 'keep-alive',
                     'x-content-type-options': 'nosniff'
                 });
                 var _rwWrite, _rwOnClose;
@@ -1637,8 +1743,8 @@ function ServerEngineClass(options) {
                     _rwWrite   = function(d) { try { response.stream.write(d); } catch(e){} };
                     _rwOnClose = function(fn) { response.stream.on('close', fn); };
                 } else {
-                    // HTTP/1.1
-                    response.writeHead(200, _rwSseHeaders);
+                    // HTTP/1.1 — `connection` is an HTTP/1 header (#B722)
+                    response.writeHead(200, { ..._rwSseHeaders, 'connection': 'keep-alive' });
                     _rwWrite   = function(d) { try { response.write(d); } catch(e){} };
                     _rwOnClose = function(fn) { request.on('close', fn); };
                 }
@@ -1671,8 +1777,9 @@ function ServerEngineClass(options) {
             // timestamps), never result / error. Engine-agnostic handler lives in
             // server.js; this is the Isaac (HTTP/2) fast-path. 404 on unknown /
             // malformed id.
+            // #B712 — `^[^?]*`: the job path must be the url's path, never its query string.
             var _jobsMatch = (request.method.toUpperCase() === 'GET')
-                ? request.url.match(/\/_gina\/jobs\/([A-Za-z0-9_-]+)\/?(\?.*)?$/)
+                ? request.url.match(/^[^?]*\/_gina\/jobs\/([A-Za-z0-9_-]+)\/?(\?.*)?$/)
                 : null;
             if ( _jobsMatch ) {
                 var _jobsId      = _jobsMatch[1];
@@ -1712,7 +1819,7 @@ function ServerEngineClass(options) {
             // settings.json says is closed.
             if (
                 ( request.method.toUpperCase() === 'GET' || request.method.toUpperCase() === 'POST' )
-                && /\/_gina\/maintenance(?:\?|$)/.test(request.url)
+                && /^\/_gina\/maintenance$/.test(_ginaCtlPath)
             ) {
                 var _mtCtlHeaders = _setPoweredByHeader({
                     'cache-control': 'no-cache, no-store, must-revalidate',
@@ -1850,7 +1957,8 @@ function ServerEngineClass(options) {
             if (
                 process.gina && process.gina._inspectorInstrumentEnabled
                 && (request.method.toUpperCase() === 'GET' || request.method.toUpperCase() === 'POST')
-                && /\/_gina\/instrument(?:\?|$)/.test(request.url)
+                // #B712 — `^[^?]*`: in the url's path, not its query string
+                && /^[^?]*\/_gina\/instrument(?:\?|$)/.test(request.url)
             ) {
                 var _instrHeaders = _setPoweredByHeader({
                     'content-type':  'application/json; charset=utf8',
@@ -1896,14 +2004,17 @@ function ServerEngineClass(options) {
             if (
                 isCacheless
                 && request.method.toUpperCase() === 'GET'
-                && /\/_gina\/inspector(\/.*)?$/.test(request.url)
+                // #B712 — `^[^?]*…(?:\?|$)`: in the url's path, and a query string no longer misses it
+                && /^[^?]*\/_gina\/inspector(\/[^?]*)?(?:\?|$)/.test(request.url)
             ) {
                 // Activate profiling on first Inspector access — one-way flag,
                 // stays true until bundle restart. QI (controller.js:257) gates
                 // on this; it must be true before any request is processed.
                 if (!process.gina._inspectorActive) process.gina._inspectorActive = true;
                 var _inspBase = __dirname + '/asset/plugin/dist/vendor/gina/inspector';
-                var _inspPath = request.url.replace(/^.*\/_gina\/inspector\/?/, '').split('?')[0];
+                // #B712 — read from the url's path, like the matcher above: a query string that
+                // names another Inspector path no longer picks the file
+                var _inspPath = request.url.split('?')[0].replace(/^.*\/_gina\/inspector\/?/, '');
                 if (!_inspPath || _inspPath === '') _inspPath = 'index.html';
 
                 var _inspMime = {
@@ -1953,15 +2064,17 @@ function ServerEngineClass(options) {
             if (
                 isCacheless
                 && request.method.toUpperCase() === 'GET'
-                && /\/_gina\/logs$/.test(request.url)
+                // #B712 — `^[^?]*…(?:\?|$)`: in the url's path, and a query string no longer misses it
+                && /^[^?]*\/_gina\/logs(?:\?|$)/.test(request.url)
             ) {
                 if (!process.gina._inspectorActive) process.gina._inspectorActive = true;
                 var _ansiRe = /\x1B\[\d+m/g;
 
+                // #B722 — no `connection` in the shared set: HTTP/2 forbids connection-specific
+                // headers, node's respond() threw on it, and the stream never opened over h2
                 var _sseHeaders = _setPoweredByHeader({
                     'content-type': 'text/event-stream; charset=utf-8',
                     'cache-control': 'no-cache, no-store',
-                    'connection': 'keep-alive',
                     'x-content-type-options': 'nosniff',
                     'access-control-allow-origin': '*'
                 });
@@ -1974,8 +2087,8 @@ function ServerEngineClass(options) {
                     _write   = function(d) { try { response.stream.write(d); } catch(e){} };
                     _onClose = function(fn) { response.stream.on('close', fn); };
                 } else {
-                    // HTTP/1.1
-                    response.writeHead(200, _sseHeaders);
+                    // HTTP/1.1 — `connection` is an HTTP/1 header (#B722)
+                    response.writeHead(200, { ..._sseHeaders, 'connection': 'keep-alive' });
                     _write   = function(d) { try { response.write(d); } catch(e){} };
                     _onClose = function(fn) { request.on('close', fn); };
                 }
@@ -2021,7 +2134,8 @@ function ServerEngineClass(options) {
             if (
                 (isCacheless || (process.gina && process.gina._inspectorAgentEnabled))
                 && request.method.toUpperCase() === 'GET'
-                && /\/_gina\/agent(?:\?|$)/.test(request.url)
+                // #B712 — `^[^?]*`: in the url's path, not its query string
+                && /^[^?]*\/_gina\/agent(?:\?|$)/.test(request.url)
             ) {
                 // #INS9b — outside dev mode the agent endpoint requires a valid
                 // key (x-gina-inspector-key header or ?key= query param). In dev
@@ -2042,10 +2156,10 @@ function ServerEngineClass(options) {
                 if (!process.gina._inspectorActive) process.gina._inspectorActive = true;
                 var _agAnsiRe = /\x1B\[\d+m/g;
 
+                // #B722 — no `connection` in the shared set (see the /_gina/logs stream above)
                 var _agHeaders = _setPoweredByHeader({
                     'content-type': 'text/event-stream; charset=utf-8',
                     'cache-control': 'no-cache, no-store',
-                    'connection': 'keep-alive',
                     'access-control-allow-origin': '*',
                     'x-content-type-options': 'nosniff'
                 });
@@ -2058,8 +2172,8 @@ function ServerEngineClass(options) {
                     _agWrite   = function(d) { try { response.stream.write(d); } catch(e){} };
                     _agOnClose = function(fn) { response.stream.on('close', fn); };
                 } else {
-                    // HTTP/1.1
-                    response.writeHead(200, _agHeaders);
+                    // HTTP/1.1 — `connection` is an HTTP/1 header (#B722)
+                    response.writeHead(200, { ..._agHeaders, 'connection': 'keep-alive' });
                     _agWrite   = function(d) { try { response.write(d); } catch(e){} };
                     _agOnClose = function(fn) { request.on('close', fn); };
                 }
@@ -2158,7 +2272,8 @@ function ServerEngineClass(options) {
             if (
                 isCacheless
                 && request.method.toUpperCase() === 'GET'
-                && /\/_gina\/indexes$/.test(request.url)
+                // #B712 — `^[^?]*…(?:\?|$)`: in the url's path, and a query string no longer misses it
+                && /^[^?]*\/_gina\/indexes(?:\?|$)/.test(request.url)
             ) {
                 if (!process.gina._inspectorActive) process.gina._inspectorActive = true;
 
@@ -2224,7 +2339,8 @@ function ServerEngineClass(options) {
             if (
                 isCacheless
                 && request.method.toUpperCase() === 'GET'
-                && /\/_gina\/reveal$/.test(request.url)
+                // #B712 — `^[^?]*…(?:\?|$)`: in the url's path, and a query string no longer misses it
+                && /^[^?]*\/_gina\/reveal(?:\?|$)/.test(request.url)
             ) {
                 var _rvHeaders = _setPoweredByHeader({
                     'content-type': 'application/json; charset=utf8',
@@ -2378,11 +2494,19 @@ function ServerEngineClass(options) {
 
 
             if (
-                request.method.toUpperCase() === 'GET' && /\_gina\/assets\/routing\.json$/i.test(request.url)
+                request.method.toUpperCase() === 'GET' && /\_gina\/assets\/routing\.json(?:\?|$)/i.test(request.url)
             ) {
                 // server.toApi(reques, response)
                 // console.debug('[ SERVER ][200] '+ request.url);
-                localAsset = assetsCollection.findOne({ file: request.url.split(/\//g).slice(-1).toString() });
+                // #B717 — a query string no longer misses the handler (`(?:\?|$)`), and the asset
+                // lookup reads the file name the test matched: the url's last segment of
+                // `routing.json?x` named no asset, and the `localAsset.mime` read below would
+                // have thrown. Not the query-free path's last segment either — the test also
+                // matches `/x?y=/_gina/assets/routing.json`, whose path names `x`.
+                // #B707 — the name is lower-cased: the test is case-insensitive while `findOne`
+                // compares strictly, so `Routing.json` named no asset and the `localAsset.mime`
+                // read below threw — an uncaughtException that ended the process.
+                localAsset = assetsCollection.findOne({ file: /\_gina\/assets\/(routing\.json)(?:\?|$)/i.exec(request.url)[1].toLowerCase() });
                 // #B66 — on a proxied deployment serve the host-stripped routing.json so
                 // the browser never receives any bundle's INTERNAL scheme://host:port (an
                 // information disclosure) and cross-bundle client toUrl resolves
@@ -2494,8 +2618,12 @@ function ServerEngineClass(options) {
             // core/server.js then serves the asset underneath it — MEASURED as a
             // 200 bypass, against a synchronous arm that held at 503. The full
             // mechanism is documented at the core/server.js twin.
+            //
+            // #B715 — the `/_gina/*` paths only core/server.js answers pass through to
+            // it (`_isLeftToServerJs`); the check runs last, so it costs nothing while
+            // no window is open.
             var _mtState = server._maintenance;
-            if ( _mtState && lib.maintenance.isActive(_mtState) ) {
+            if ( _mtState && lib.maintenance.isActive(_mtState) && !_isLeftToServerJs(request.url) ) {
                 var _mtNow     = Date.now();
                 var _mtConf    = lib.maintenance.effectiveConf(_mtState, _mtNow);
                 var _mtVerdict = lib.maintenance.evaluateBypass(
@@ -2546,9 +2674,19 @@ function ServerEngineClass(options) {
                     return response.end();
                 }
                 // cookie / header / allowlisted-and-not-proxied: straight through.
+                // #B711 — mark the verdict for core/server.js. Below, isaac rewrites an http/1.1
+                // `Host` without its port before handing the request over, and server.js's own
+                // gate would decide again on that rewritten `Host`, read a listed direct client as
+                // proxied and answer 503. server.js honours this mark instead of re-deciding.
+                request._ginaMaintenanceAdmitted = true;
             }
 
-            if (!isCacheless || String(server._cacheIsEnabled).toLowerCase() === 'true') {
+            // The output cache is looked up only while `server.cache.enable` is on. Every
+            // writer refuses to store while it is off (render-swig / render-json writeCache),
+            // the engine-agnostic read in server.js gates on the same flag, and the former
+            // production-unconditional lookup cost two existsSync() calls per GET and could
+            // serve an entry left on disk by an earlier run that had the cache enabled.
+            if ( String(server._cacheIsEnabled).toLowerCase() === 'true' ) {
                 if ( request.method.toUpperCase() === 'GET' ) {
                     var cacheStatus = null;
                     if ( String(server._cacheIsEnabled).toLowerCase() === 'true' ) {
@@ -3205,7 +3343,7 @@ function ServerEngineClass(options) {
         server.on('upgrade', function(req, socket, head){
             // #INS8 — defer /_gina/agent upgrades to the WebSocket agent handler
             // attached in server.js; engine.io owns only its own upgrade path.
-            if (/\/_gina\/agent(?:\?|$)/.test(req.url || '')) { return; }
+            if (/\/_gina\/agent(?:\?|$)/.test(req.url ? req.url.split('?')[0] : '')) { return; }
             console.debug('[IO SERVER ] upgrading socket #'+ this.id);
             ioServer.handleUpgrade(req, socket, head);
         });