gina 0.7.0 → 0.7.1

package/framework/{v0.7.0 → v0.7.1}/core/server.js

@@ -677,7 +677,9 @@ function _instrumentKeyValid(req) {
  * BOTH engines (the isaac instance IS the raw server; express's `app.listen()`
  * returns it), so one `upgrade` listener here covers both. There is deliberately
  * NO isaac-specific mirror — the isaac engine.io upgrade handler defers to this
- * one via a `/_gina/agent` skip-guard (see server.isaac.js).
+ * one via a `/_gina/agent` skip-guard (see server.isaac.js). Both match
+ * `/_gina/agent` on the url's PATH, never its query string (#B712): an upgrade to
+ * a page url whose query ends in the agent path is not the agent's.
  *
  * Auth parity with the SSE endpoint: dev stays open + keyless; outside dev the
  * upgrade requires a valid key (`x-gina-inspector-key` header or `?key=` query
@@ -724,7 +726,7 @@ function attachInspectorAgentWs(rawServer, ctx) {
     rawServer.on('upgrade', function(req, socket, head) {
         // Only handle the agent WS path; leave every other upgrade (e.g.
         // engine.io in ioServer-attach mode) for its own listener.
-        if (!/\/_gina\/agent(?:\?|$)/.test(req.url || '')) { return; }
+        if (!/\/_gina\/agent(?:\?|$)/.test(req.url ? req.url.split('?')[0] : '')) { return; }
 
         var _agIsDev = (process.env.NODE_ENV_IS_DEV && process.env.NODE_ENV_IS_DEV.toLowerCase() === 'true');
 
@@ -843,6 +845,9 @@ function attachInspectorAgentWs(rawServer, ctx) {
  * populated it; otherwise drains the request stream (works for HTTP/1.1
  * IncomingMessage and HTTP/2 Http2ServerRequest). A 2s timeout guards against
  * an already-consumed stream that never re-fires `end`. Calls back exactly once.
+ * Accepts Buffer and string chunks: a request whose encoding was set emits strings
+ * (core/server.js calls `request.setEncoding` for every non-multipart request), which
+ * are turned back into bytes so the cap counts bytes and the read cannot throw (#B714).
  *
  * @inner
  * @param {http.IncomingMessage|http2.Http2ServerRequest} req
@@ -867,6 +872,12 @@ function _readInstrumentBody(req, cb) {
     _timer = setTimeout(function() { _finish(new Error('body read timeout')); }, 2000);
     if (_timer && typeof _timer.unref === 'function') { _timer.unref(); }
     req.on('data', function(chunk) {
+        // #B714 — a request whose encoding was set emits strings (core/server.js onInstance
+        // calls request.setEncoding for every non-multipart request): turn a string back into
+        // bytes, so the cap counts bytes and Buffer.concat below accepts every chunk.
+        if ( typeof(chunk) == 'string' ) {
+            chunk = Buffer.from(chunk, req.readableEncoding || 'utf8');
+        }
         _size += chunk.length;
         if (_size > _MAX) {
             _finish(new Error('body too large'));
@@ -876,7 +887,14 @@ function _readInstrumentBody(req, cb) {
         _chunks.push(chunk);
     });
     req.on('end', function() {
-        var _raw = Buffer.concat(_chunks).toString('utf8').trim();
+        // #B714 — a throw here escapes as an uncaughtException and stops the bundle:
+        // answer it through the callback.
+        var _raw;
+        try {
+            _raw = Buffer.concat(_chunks).toString('utf8').trim();
+        } catch (e) {
+            return _finish(e);
+        }
         if (!_raw) return _finish(null, {});
         try { _finish(null, JSON.parse(_raw)); }
         catch (e) { _finish(new Error('invalid JSON body')); }
@@ -1355,6 +1373,10 @@ function Server(options) {
 
             serverOpt.port      = self.conf[self.appName][self.env].server.port = portsReverse[ self.appName +'@'+ self.projectName ][self.env][serverOpt.protocol][serverOpt.scheme];
             self.conf[self.appName][self.env].server.debugPort = getContext().debugPort;
+            // #B709 — isaac matches its admin-gated /_gina/* handlers on the control
+            // path (lib.admin.controlPath), which accepts the bundle's OWN webroot
+            // form: hand it the normalised webroot (`/x/`), not the raw settings value.
+            serverOpt.webroot = options.conf[self.appName][self.env].server.webroot;
 
             // engine.io options
             if ( ioServerOpt ) {
@@ -2881,15 +2903,16 @@ function Server(options) {
      * @returns {boolean}
      */
     var hasViews = function(bundle) {
-        var _hasViews   = false
-            , conf      = new Config().getInstance(bundle)
-        ;
+        // memo first: the Config is resolved only to fill the memo, once per bundle
+        // (it was constructed before the check, on every call — phase-2 per-request
+        // trims, slice E)
         if (typeof(local.hasViews[bundle]) != 'undefined') {
-            _hasViews = local.hasViews[bundle];
-        } else {
-            _hasViews = ( typeof(conf.envConf[bundle][self.env].content['templates']) != 'undefined' ) ? true : false;
-            local.hasViews[bundle] = _hasViews;
+            return local.hasViews[bundle];
         }
+        var conf        = new Config().getInstance(bundle)
+            , _hasViews = ( typeof(conf.envConf[bundle][self.env].content['templates']) != 'undefined' ) ? true : false
+        ;
+        local.hasViews[bundle] = _hasViews;
 
         return _hasViews
     }
@@ -4144,7 +4167,7 @@ function Server(options) {
      * name`), while a RegExp path bypasses string parsing on Express 4 AND 5,
      * measured live-dispatching `/`, `/web/` and deep paths on both majors.
      * Isaac KEEPS the string `'*'`: its request listener's dispatch gate is
-     * `path === '*' || path == request.url` (server.isaac.js:2366), so a
+     * `path === '*' || path == request.url` in server.isaac.js, so a
      * RegExp there matches NOTHING and every request hangs without a
      * response — measured, a deterministic container-boot timeout.
      *
@@ -4215,6 +4238,14 @@ function Server(options) {
             if ( typeof(request.priority) == 'undefined' ) {
                 request.priority = lib.priority.parse(request.headers['priority']);
             }
+            // #B709 — the proxy classification of a /_gina/* request, taken ONCE from
+            // its pristine headers. Under isaac the listener top has already taken it
+            // (before its h1 Host rewrite, which runs before this) and this skips; on
+            // Express this claims. The admin and metrics allowlists read it. Keep the
+            // two tops in sync.
+            if ( (request.originalUrl || request.url).indexOf('/_gina/') > -1 ) {
+                lib.admin.stampProxied(request);
+            }
             // #OBS1 slice 3 — HTTP request lifecycle hook for Prometheus metrics.
             // Engine-agnostic mirror of the server.isaac.js hook. Gated on
             // lib.metrics.isEnabled() so the listener is only wired when
@@ -4432,9 +4463,23 @@ function Server(options) {
             // issues ZERO POSTs to /_gina/*, with a firing control (23 hits on
             // /_gina/agent), so no shipped caller is broken by this.
             //
+            // #B708 — the URL test must match WHEREVER a write handler matches, or
+            // that handler escapes the guard. Several handlers test the FULL url
+            // unanchored (cache/clear, maintenance, instrument), so a path prefix
+            // (`/web/_gina/…`, `//_gina/…`) and the endpoint path at the END of the
+            // query string (`/?next=/_gina/maintenance`) both reached them, and
+            // cache/clear, storage/* and release/* match in any case
+            // (`/_GINA/storage/gc`). An anchored, case-sensitive test missed all of
+            // those. So the guard looks for `/_gina/` anywhere in the full url, in
+            // any case — a superset of every write handler on both engines, locked
+            // by test/core/admin-write-guard-b708.test.js. Cost: a cross-origin,
+            // non-safe BROWSER request to an app URL that merely contains `/_gina/`
+            // (in its query, say) is refused too; same-origin and non-browser
+            // clients are unaffected.
+            //
             // Keep in sync with the core/server.isaac.js twin.
             if (
-                /^\/_gina\//.test(request.url)
+                /\/_gina\//i.test(request.url)
                 && !lib.admin.isSafeMethod(request.method)
                 && lib.admin.isCrossOriginWrite(request)
             ) {
@@ -4445,24 +4490,48 @@ function Server(options) {
                 return response.end(JSON.stringify({ error: 'forbidden', message: 'cross-origin write to a /_gina/* control endpoint is refused' }));
             }
 
+            // #B709 — the admin-gated handlers below (metrics, info, cache/*,
+            // maintenance) match this query-free path EXACTLY — the root form, or the
+            // bundle's own webroot form — never the raw url: a nested endpoint path,
+            // the endpoint path in a query string, another letter case or an empty
+            // leading segment reaches none of them. storage/* and release/* stay
+            // anchored on the url, case-sensitive, with no webroot form. Keep in sync
+            // with the core/server.isaac.js twin.
+            var _ginaCtlPath = lib.admin.controlPath(request.originalUrl || request.url, self.conf[self.appName][self.env].server.webroot);
+
             // ── /_gina/health/check — liveness probe (always-on, UNGATED) ───────────────
-            // (MS2) Engine-agnostic mirror of the Isaac handler (server.isaac.js ~:1105).
-            // GET only, returns {status:"healthy", timestamp}. Deliberately UNGATED — no
-            // dev gate and no admin/metrics IP allowlist: it exposes no process state, and
-            // liveness probes (kubelet, Docker HEALTHCHECK, LB) originate off-loopback, so
-            // an allowlist would defeat the endpoint's purpose. Uses the express idiom
-            // (setHeader/statusCode/end), NOT the Isaac stream / _setPoweredByHeader. Kept
-            // in sync with the isaac fast-path per the /_gina/* built-in endpoint rule.
+            // (MS2) Engine-agnostic mirror of the Isaac handler (server.isaac.js, the
+            // `_healthMethod` block). GET or HEAD, returns {status:"healthy", timestamp}.
+            // Deliberately UNGATED — no dev gate and no admin/metrics IP allowlist: it
+            // exposes no process state, and liveness probes (kubelet, Docker HEALTHCHECK,
+            // LB) originate off-loopback, so an allowlist would defeat the endpoint's
+            // purpose. Uses the express idiom (setHeader/statusCode/end), NOT the Isaac
+            // stream / _setPoweredByHeader. Kept in sync with the isaac fast-path per the
+            // /_gina/* built-in endpoint rule.
+            // #B717 — a query string no longer misses the handler (`(?:\?|$)`, the idiom of the
+            // instrument and agent handlers): on express request.url still carries it here.
+            // #B718 — HEAD is answered too (a load balancer may probe with HEAD): the same
+            // status and headers plus content-length, no body.
+            // #B712 — `^[^?]*`: the endpoint path must end the url's PATH, so a page whose query
+            // string ends in it (`/web/?next=/_gina/health/check`) is answered by the page. Any
+            // prefix still reaches it (a probe under the webroot). jobs, instrument and the dev
+            // endpoints carry the same anchor; the agent upgrade listener tests the query-free path.
+            var _healthMethod = request.method.toUpperCase();
             if (
-                request.method.toUpperCase() === 'GET'
-                && /\/_gina\/health\/check$/i.test(request.url)
+                ( _healthMethod === 'GET' || _healthMethod === 'HEAD' )
+                && /^[^?]*\/_gina\/health\/check(?:\?|$)/i.test(request.url)
             ) {
+                var _healthBody = JSON.stringify({ status: 'healthy', timestamp: new Date().toISOString() });
                 response.setHeader('content-type',  'application/json; charset=utf8');
                 response.setHeader('cache-control', 'no-cache, no-store, must-revalidate');
                 response.setHeader('pragma',        'no-cache');
                 response.setHeader('expires',       '0');
                 response.statusCode = 200;
-                return response.end(JSON.stringify({ status: 'healthy', timestamp: new Date().toISOString() }));
+                if ( _healthMethod === 'HEAD' ) {
+                    response.setHeader('content-length', Buffer.byteLength(_healthBody));
+                    return response.end();
+                }
+                return response.end(_healthBody);
             }
 
             // ── /_gina/assets/routing.json — client routing map (always-on, public) ─────
@@ -4477,7 +4546,9 @@ function Server(options) {
             // onInstance response, so they are inherited, not re-set.
             if (
                 request.method.toUpperCase() === 'GET'
-                && /\/_gina\/assets\/routing\.json$/i.test(request.url)
+                // #B717 — `(?:\?|$)`: a query string no longer misses the handler (on
+                // express request.url still carries it here)
+                && /\/_gina\/assets\/routing\.json(?:\?|$)/i.test(request.url)
                 && self._clientRoutingAssets
             ) {
                 // #B65-twin — per-request proxied classification (keep in sync with
@@ -4523,7 +4594,7 @@ function Server(options) {
             // loopback). 503 when metrics.enabled is false in app.json.
             if (
                 request.method.toUpperCase() === 'GET'
-                && /\/_gina\/metrics$/.test(request.url)
+                && /^\/_gina\/metrics$/.test(_ginaCtlPath)
             ) {
                 if ( !lib.metrics.isClientAllowed(request) ) {
                     response.setHeader('content-type',  'application/json; charset=utf8');
@@ -4557,7 +4628,7 @@ function Server(options) {
             // _h2Metrics is undefined here), so it degrades to omitted under Express.
             if (
                 request.method.toUpperCase() === 'GET'
-                && /\/_gina\/info$/i.test(request.url)
+                && /^\/_gina\/info$/.test(_ginaCtlPath)
             ) {
                 response.setHeader('content-type',  'application/json; charset=utf8');
                 response.setHeader('cache-control', 'no-cache, no-store, must-revalidate');
@@ -4592,7 +4663,7 @@ function Server(options) {
             // self.instance._cached Map and returns its stats(); 403 JSON on deny.
             if (
                 request.method.toUpperCase() === 'GET'
-                && /\/_gina\/cache\/stats$/i.test(request.url)
+                && /^\/_gina\/cache\/stats$/.test(_ginaCtlPath)
             ) {
                 response.setHeader('content-type',  'application/json; charset=utf8');
                 response.setHeader('cache-control', 'no-cache, no-store, must-revalidate');
@@ -4631,7 +4702,7 @@ function Server(options) {
             // the CLI (gina cache:clear), not in-process.
             if (
                 request.method.toUpperCase() === 'POST'
-                && /\/_gina\/cache\/clear(\?.*)?$/i.test(request.url)
+                && /^\/_gina\/cache\/clear$/.test(_ginaCtlPath)
             ) {
                 response.setHeader('content-type',  'application/json; charset=utf8');
                 response.setHeader('cache-control', 'no-cache, no-store, must-revalidate');
@@ -4668,8 +4739,9 @@ function Server(options) {
             // Returns lib.job.toStatusView (id + state + timestamps) — never the
             // result / error payload (authenticated result retrieval goes through a
             // user route via self.jobStatus). 404 for an unknown / malformed id.
+            // #B712 — `^[^?]*`: the job path must be the url's path, never its query string.
             var _ginaJobsMatch = (request.method.toUpperCase() === 'GET')
-                ? request.url.match(/\/_gina\/jobs\/([A-Za-z0-9_-]+)\/?(\?.*)?$/)
+                ? request.url.match(/^[^?]*\/_gina\/jobs\/([A-Za-z0-9_-]+)\/?(\?.*)?$/)
                 : null;
             if ( _ginaJobsMatch ) {
                 var _ginaJobId = _ginaJobsMatch[1];
@@ -4696,13 +4768,27 @@ function Server(options) {
             // safe by construction — the running process serves REPORTS, and
             // the gc sweep is the one sanctioned mutation.
             //
+            // #B710 — the query (`?driver=`, `?dryRun=`) is read from
+            // `request.originalUrl`, never `request.url`: isaac parses the query
+            // into `request.query` and then strips it from `request.url` before
+            // it hands the request to this chain (the catch-all dispatch in
+            // core/server.isaac.js), so on the default engine these handlers saw
+            // no query at all — `gc?dryRun=1` ran a REAL collection over every
+            // driver, and all three ignored `?driver=`. `originalUrl` is the full
+            // URL on both engines (isaac sets it at its listener top, Express
+            // natively); the URL tests below stay on `request.url`. Not
+            // `request.query`: isaac coerces `true`/`on` and JSON-looking values
+            // while Express parses with qs — one URLSearchParams read keeps one
+            // meaning on both. Locked by
+            // test/integration/container-boot-storage-query-b710.test.js.
+            //
             // GET /_gina/storage/stats?driver=<name>
             //   → { configured, drivers: [ {name, strategy, root, capabilities,
             //     store: {objects, refcounted, zeroRefPending, inline, bytes}|null }
             //     | {name, error} ] } — the driver's own stats() shape, verbatim.
             if (
                 request.method.toUpperCase() === 'GET'
-                && /^\/_gina\/storage\/stats(\?.*)?$/i.test(request.url)
+                && /^\/_gina\/storage\/stats(\?.*)?$/.test(request.url)
             ) {
                 response.setHeader('content-type',  'application/json; charset=utf8');
                 response.setHeader('cache-control', 'no-cache, no-store, must-revalidate');
@@ -4714,9 +4800,10 @@ function Server(options) {
                 }
                 var _stoStatsNames  = lib.storage.list();
                 var _stoStatsDriver = null;
-                var _stoStatsQi     = request.url.indexOf('?');
+                var _stoStatsUrl    = request.originalUrl || request.url; // #B710
+                var _stoStatsQi     = _stoStatsUrl.indexOf('?');
                 if ( _stoStatsQi > -1 ) {
-                    _stoStatsDriver = new URLSearchParams(request.url.slice(_stoStatsQi + 1)).get('driver') || null;
+                    _stoStatsDriver = new URLSearchParams(_stoStatsUrl.slice(_stoStatsQi + 1)).get('driver') || null;
                 }
                 if ( _stoStatsDriver ) {
                     if ( _stoStatsNames.indexOf(_stoStatsDriver) < 0 ) {
@@ -4750,7 +4837,7 @@ function Server(options) {
             // an error — the design's "no sweep" is a strategy fact.
             if (
                 request.method.toUpperCase() === 'POST'
-                && /^\/_gina\/storage\/gc(\?.*)?$/i.test(request.url)
+                && /^\/_gina\/storage\/gc(\?.*)?$/.test(request.url)
             ) {
                 response.setHeader('content-type',  'application/json; charset=utf8');
                 response.setHeader('cache-control', 'no-cache, no-store, must-revalidate');
@@ -4763,9 +4850,10 @@ function Server(options) {
                 var _stoGcNames  = lib.storage.list();
                 var _stoGcDriver = null;
                 var _stoGcDry    = false;
-                var _stoGcQi     = request.url.indexOf('?');
+                var _stoGcUrl    = request.originalUrl || request.url; // #B710
+                var _stoGcQi     = _stoGcUrl.indexOf('?');
                 if ( _stoGcQi > -1 ) {
-                    var _stoGcQs = new URLSearchParams(request.url.slice(_stoGcQi + 1));
+                    var _stoGcQs = new URLSearchParams(_stoGcUrl.slice(_stoGcQi + 1));
                     _stoGcDriver = _stoGcQs.get('driver') || null;
                     _stoGcDry    = ( _stoGcQs.get('dryRun') === '1' || _stoGcQs.get('dryRun') === 'true' );
                 }
@@ -4826,7 +4914,7 @@ function Server(options) {
             // verify (sharded, v1) is named-and-skipped, never an error.
             if (
                 request.method.toUpperCase() === 'GET'
-                && /^\/_gina\/storage\/verify(\?.*)?$/i.test(request.url)
+                && /^\/_gina\/storage\/verify(\?.*)?$/.test(request.url)
             ) {
                 response.setHeader('content-type',  'application/json; charset=utf8');
                 response.setHeader('cache-control', 'no-cache, no-store, must-revalidate');
@@ -4838,9 +4926,10 @@ function Server(options) {
                 }
                 var _stoVerNames  = lib.storage.list();
                 var _stoVerDriver = null;
-                var _stoVerQi     = request.url.indexOf('?');
+                var _stoVerUrl    = request.originalUrl || request.url; // #B710
+                var _stoVerQi     = _stoVerUrl.indexOf('?');
                 if ( _stoVerQi > -1 ) {
-                    _stoVerDriver = new URLSearchParams(request.url.slice(_stoVerQi + 1)).get('driver') || null;
+                    _stoVerDriver = new URLSearchParams(_stoVerUrl.slice(_stoVerQi + 1)).get('driver') || null;
                 }
                 if ( _stoVerDriver ) {
                     if ( _stoVerNames.indexOf(_stoVerDriver) < 0 ) {
@@ -4880,7 +4969,8 @@ function Server(options) {
             if (
                 lib.releaseWatch.isActive()
                 && request.method.toUpperCase() === 'GET'
-                && /^\/_gina\/release\/status$/i.test(request.url)
+                // #B717 — `(?:\?|$)`: a query string no longer misses the handler
+                && /^\/_gina\/release\/status(?:\?|$)/.test(request.url)
             ) {
                 if ( !lib.admin.isClientAllowed(request) ) {
                     response.statusCode = 403;
@@ -4899,7 +4989,7 @@ function Server(options) {
             if (
                 lib.releaseWatch.isActive()
                 && request.method.toUpperCase() === 'POST'
-                && /^\/_gina\/release\/rebuild(\?.*)?$/i.test(request.url)
+                && /^\/_gina\/release\/rebuild(\?.*)?$/.test(request.url)
             ) {
                 if ( !lib.admin.isClientAllowed(request) ) {
                     response.statusCode = 403;
@@ -4928,7 +5018,8 @@ function Server(options) {
             if (
                 lib.releaseWatch.isActive()
                 && request.method.toUpperCase() === 'GET'
-                && /^\/_gina\/release\/events$/i.test(request.url)
+                // #B717 — `(?:\?|$)`: a query string no longer misses the handler
+                && /^\/_gina\/release\/events(?:\?|$)/.test(request.url)
             ) {
                 if ( !lib.admin.isClientAllowed(request) ) {
                     response.statusCode = 403;
@@ -4970,8 +5061,9 @@ function Server(options) {
             // message]} flips it. Admin IP-allowlist gated like /_gina/info and the
             // cache/storage families — NOT key-gated like /_gina/instrument, because
             // this is an operational switch rather than a data-capture toggle, and it
-            // must stay reachable from the host/pod and from the CLI (which dials the
-            // bundle port directly, so it presents as loopback under any topology).
+            // must stay reachable from the host or the pod (`curl` against the bundle
+            // port — there is no maintenance CLI command). A caller relayed by a proxy
+            // on the bundle's own host is refused (#B709, lib/admin).
             //
             // Deliberately declared ABOVE the maintenance gate itself, so an operator
             // can always reach their own off switch while the window is open.
@@ -4986,7 +5078,7 @@ function Server(options) {
             // Keep in sync with the core/server.isaac.js twin.
             if (
                 ( request.method.toUpperCase() === 'GET' || request.method.toUpperCase() === 'POST' )
-                && /\/_gina\/maintenance(?:\?|$)/.test(request.url)
+                && /^\/_gina\/maintenance$/.test(_ginaCtlPath)
             ) {
                 response.setHeader('content-type',  'application/json; charset=utf8');
                 response.setHeader('cache-control', 'no-cache, no-store, must-revalidate');
@@ -5121,7 +5213,8 @@ function Server(options) {
             if (
                 process.gina && process.gina._inspectorInstrumentEnabled
                 && (request.method.toUpperCase() === 'GET' || request.method.toUpperCase() === 'POST')
-                && /\/_gina\/instrument(?:\?|$)/.test(request.url)
+                // #B712 — `^[^?]*`: in the url's path, not its query string
+                && /^[^?]*\/_gina\/instrument(?:\?|$)/.test(request.url)
             ) {
                 response.setHeader('content-type',  'application/json; charset=utf8');
                 response.setHeader('cache-control', 'no-cache, no-store, must-revalidate');
@@ -5158,14 +5251,17 @@ function Server(options) {
             if (
                 process.env.NODE_ENV_IS_DEV && process.env.NODE_ENV_IS_DEV.toLowerCase() === 'true'
                 && request.method.toUpperCase() === 'GET'
-                && /\/_gina\/inspector(\/.*)?$/.test(request.url)
+                // #B712 — `^[^?]*…(?:\?|$)`: in the url's path, and a query string no longer misses it
+                && /^[^?]*\/_gina\/inspector(\/[^?]*)?(?:\?|$)/.test(request.url)
             ) {
                 // Activate profiling on first Inspector access — one-way flag,
                 // stays true until bundle restart. QI (controller.js:257) gates
                 // on this; it must be true before any request is processed.
                 if (!process.gina._inspectorActive) process.gina._inspectorActive = true;
                 var _bmBase = __dirname + '/asset/plugin/dist/vendor/gina/inspector';
-                var _bmPath = request.url.replace(/^.*\/_gina\/inspector\/?/, '').split('?')[0];
+                // #B712 — read from the url's path, like the matcher above: a query string that
+                // names another Inspector path no longer picks the file
+                var _bmPath = request.url.split('?')[0].replace(/^.*\/_gina\/inspector\/?/, '');
                 if (!_bmPath || _bmPath === '') _bmPath = 'index.html';
 
                 var _bmMime = {
@@ -5203,7 +5299,8 @@ function Server(options) {
             if (
                 process.env.NODE_ENV_IS_DEV && process.env.NODE_ENV_IS_DEV.toLowerCase() === 'true'
                 && request.method.toUpperCase() === 'GET'
-                && /\/_gina\/logs$/.test(request.url)
+                // #B712 — `^[^?]*…(?:\?|$)`: in the url's path, and a query string no longer misses it
+                && /^[^?]*\/_gina\/logs(?:\?|$)/.test(request.url)
             ) {
                 if (!process.gina._inspectorActive) process.gina._inspectorActive = true;
                 var _ansiRe = /\x1B\[\d+m/g;
@@ -5258,7 +5355,8 @@ function Server(options) {
                     || (process.gina && process.gina._inspectorAgentEnabled)
                 )
                 && request.method.toUpperCase() === 'GET'
-                && /\/_gina\/agent(?:\?|$)/.test(request.url)
+                // #B712 — `^[^?]*`: in the url's path, not its query string
+                && /^[^?]*\/_gina\/agent(?:\?|$)/.test(request.url)
             ) {
                 // #INS9b — outside dev mode the agent endpoint requires a valid
                 // key (x-gina-inspector-key header or ?key= query param). In dev
@@ -5369,7 +5467,8 @@ function Server(options) {
             if (
                 process.env.NODE_ENV_IS_DEV && process.env.NODE_ENV_IS_DEV.toLowerCase() === 'true'
                 && request.method.toUpperCase() === 'GET'
-                && /\/_gina\/indexes$/.test(request.url)
+                // #B712 — `^[^?]*…(?:\?|$)`: in the url's path, and a query string no longer misses it
+                && /^[^?]*\/_gina\/indexes(?:\?|$)/.test(request.url)
             ) {
                 if (!process.gina._inspectorActive) process.gina._inspectorActive = true;
 
@@ -5423,7 +5522,8 @@ function Server(options) {
             if (
                 process.env.NODE_ENV_IS_DEV && process.env.NODE_ENV_IS_DEV.toLowerCase() === 'true'
                 && request.method.toUpperCase() === 'GET'
-                && /\/_gina\/reveal$/.test(request.url)
+                // #B712 — `^[^?]*…(?:\?|$)`: in the url's path, and a query string no longer misses it
+                && /^[^?]*\/_gina\/reveal(?:\?|$)/.test(request.url)
             ) {
                 response.setHeader('content-type', 'application/json; charset=utf8');
                 response.setHeader('cache-control', 'no-cache, no-store');
@@ -5489,7 +5589,12 @@ function Server(options) {
             //
             // Keep in sync with the core/server.isaac.js twin.
             var _mtState = self.instance && self.instance._maintenance;
-            if ( _mtState && lib.maintenance.isActive(_mtState) ) {
+            // #B711 — a request the isaac engine's own gate already admitted is not decided again:
+            // isaac rewrites an http/1.1 `Host` without its port before handing the request here,
+            // so this gate would read a listed direct client as proxied, close the IP arm and
+            // answer 503. The mark is only ever set by isaac's gate, on a request it let through
+            // (cookie, header or allowlisted-and-not-proxied); Express never sets it.
+            if ( _mtState && request._ginaMaintenanceAdmitted !== true && lib.maintenance.isActive(_mtState) ) {
                 var _mtNow     = Date.now();
                 var _mtConf    = lib.maintenance.effectiveConf(_mtState, _mtNow);
                 var _mtVerdict = lib.maintenance.evaluateBypass(
@@ -7121,10 +7226,23 @@ function Server(options) {
      */
     var loadBundleConfiguration = function(req, res, next, callback) {
 
-        var config = new Config();
-        config.setBundles(self.bundles);
-        // for all loaded bundles
-        var conf = config.getInstance();
+        // Once Config is initialised, `new Config()` built a throwaway only for its
+        // getInstance() to return the singleton's envConf (re-setting Env/Scope/Host to
+        // the values they already hold), and setBundles() wrote onto that throwaway,
+        // which nothing read. Downstream, `config` is only asked isCacheless() and
+        // getRouting(), which answer the same on the singleton. Before that — or in a
+        // worker, where Config.initialized stays unset — the calls run as before, #B542's
+        // refusal included (phase-2 per-request trims, slice E).
+        var config, conf;
+        if ( Config.initialized && Config.instance ) {
+            config  = Config.instance;
+            conf    = Config.instance.envConf;
+        } else {
+            config = new Config();
+            config.setBundles(self.bundles);
+            // for all loaded bundles
+            conf = config.getInstance();
+        }
         //for cacheless mode
         if ( typeof(conf) != 'undefined') {
             self.conf = conf;