tina4-nodejs 3.13.149 → 3.13.151

package/packages/core/src/mcp.ts

@@ -23,6 +23,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 // Built-in dev tools auto-register when TINA4_DEBUG=true and running on localhost.
 
 import * as fs from "node:fs";
+import { rtrimSlashes } from "./slashTrim.js";
 import * as path from "node:path";
 import * as os from "node:os";
 import { spawnSync } from "node:child_process";
@@ -356,7 +357,7 @@ export class McpServer {
   private _sseChannels: Map<string, { buffer: string[]; wake: (() => void) | null }> = new Map();
 
   constructor(mcpPath: string, name = "Tina4 MCP", version = "1.0.0") {
-    this.path = mcpPath.replace(/\/+$/, "");
+    this.path = rtrimSlashes(mcpPath);
     this.name = name;
     this.version = version;
     McpServer._instances.push(this);
@@ -865,26 +866,60 @@ function safePath(projectRoot: string, relPath: string): string {
   if (resolved !== projectRoot && !resolved.startsWith(rootPrefix)) {
     throw new Error(`Path escapes project directory: ${relPath}`);
   }
-  // Belt-and-braces against symlink escapes: if the path exists, canonicalise
-  // it and re-check containment. A symlink inside the tree pointing outside
-  // would otherwise slip past the textual check. New paths (parent not yet
-  // created) have no realpath and rely on the resolve() containment above.
-  let real: string | null = null;
+  // Belt-and-braces against symlink escapes: canonicalise the path and
+  // re-check containment. A symlink inside the tree pointing outside would
+  // otherwise slip past the textual check.
+  let realRoot: string;
   try {
-    real = fs.realpathSync(resolved);
+    realRoot = fs.realpathSync(projectRoot);
   } catch {
-    real = null; // not created yet — textual guard above holds
+    return resolved; // a root that no longer exists holds nothing to link through
   }
-  if (real !== null) {
-    const realRoot = fs.realpathSync(projectRoot);
-    const realPrefix = realRoot.endsWith(path.sep) ? realRoot : realRoot + path.sep;
-    if (real !== realRoot && !real.startsWith(realPrefix)) {
-      throw new Error(`Path escapes project directory: ${relPath}`);
-    }
+  const real = realPathOf(resolved);
+  const realPrefix = realRoot.endsWith(path.sep) ? realRoot : realRoot + path.sep;
+  if (real === null || (real !== realRoot && !real.startsWith(realPrefix))) {
+    throw new Error(`Path escapes project directory: ${relPath}`);
   }
   return resolved;
 }
 
+/**
+ * Where a path will land once every symlink in it is followed, including the
+ * parts that do not exist yet: a NEW file is created through its deepest
+ * existing parent, and a dangling symlink through the place it names. Null when
+ * that cannot be worked out (a link loop, an unreadable link).
+ */
+function realPathOf(p: string, hops = 0): string | null {
+  let probe = p;
+  while (!fs.existsSync(probe) && !isSymlink(probe) && path.dirname(probe) !== probe) {
+    probe = path.dirname(probe);
+  }
+  try {
+    // .native: the JS realpathSync collapses "link/.." as text first.
+    return fs.realpathSync.native(probe);
+  } catch {
+    // A dangling symlink. Its target is joined as text, not normalised, so a
+    // ".." after a linked component is resolved the way the OS will follow it.
+    if (hops >= 40) return null;
+    let target: string;
+    try {
+      target = fs.readlinkSync(probe);
+    } catch {
+      return null;
+    }
+    const base = path.isAbsolute(target) ? target : path.dirname(probe) + path.sep + target;
+    return realPathOf(base + p.slice(probe.length), hops + 1);
+  }
+}
+
+function isSymlink(p: string): boolean {
+  try {
+    return fs.lstatSync(p).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Redact sensitive environment variable values.
  */
@@ -1958,8 +1993,10 @@ export function registerDevTools(server: McpServer): void {
         // 2. Coder-path normalization.
         rel = normalizeCoderPath(projectRoot, rel);
         // 3. Safe path resolution (sandbox check).
-        const resolved = path.resolve(projectRoot, rel);
-        if (!resolved.startsWith(projectRoot)) {
+        let resolved: string;
+        try {
+          resolved = safePath(projectRoot, rel);
+        } catch {
           return { error: `Path escapes project directory: ${rel}` };
         }
         // 4. Existence check.

package/packages/core/src/messenger.ts

@@ -371,6 +371,26 @@ function sendCommand(
 /**
  * Build an RFC 2822 MIME message.
  */
+// The text/html multipart-alternative body, identical in the with- and
+// without-attachments paths of buildMimeMessage.
+function pushAlternativeBody(lines: string[], altBoundary: string, text: string, body: string): void {
+  lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
+  lines.push("");
+  lines.push(`--${altBoundary}`);
+  lines.push("Content-Type: text/plain; charset=UTF-8");
+  lines.push("Content-Transfer-Encoding: 7bit");
+  lines.push("");
+  lines.push(text);
+  lines.push("");
+  lines.push(`--${altBoundary}`);
+  lines.push("Content-Type: text/html; charset=UTF-8");
+  lines.push("Content-Transfer-Encoding: 7bit");
+  lines.push("");
+  lines.push(body);
+  lines.push("");
+  lines.push(`--${altBoundary}--`);
+}
+
 function buildMimeMessage(options: {
   from: string;
   fromName?: string;
@@ -423,21 +443,7 @@ function buildMimeMessage(options: {
 
     // Body part (with optional text alternative)
     if (hasTextAlt) {
-      lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
-      lines.push("");
-      lines.push(`--${altBoundary}`);
-      lines.push("Content-Type: text/plain; charset=UTF-8");
-      lines.push("Content-Transfer-Encoding: 7bit");
-      lines.push("");
-      lines.push(options.text!);
-      lines.push("");
-      lines.push(`--${altBoundary}`);
-      lines.push("Content-Type: text/html; charset=UTF-8");
-      lines.push("Content-Transfer-Encoding: 7bit");
-      lines.push("");
-      lines.push(options.body);
-      lines.push("");
-      lines.push(`--${altBoundary}--`);
+      pushAlternativeBody(lines, altBoundary, options.text!, options.body);
     } else {
       const contentType = options.html ? "text/html" : "text/plain";
       lines.push(`Content-Type: ${contentType}; charset=UTF-8`);
@@ -469,21 +475,7 @@ function buildMimeMessage(options: {
     lines.push(`--${boundary}--`);
   } else if (hasTextAlt) {
     // Text alternative without attachments
-    lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
-    lines.push("");
-    lines.push(`--${altBoundary}`);
-    lines.push("Content-Type: text/plain; charset=UTF-8");
-    lines.push("Content-Transfer-Encoding: 7bit");
-    lines.push("");
-    lines.push(options.text!);
-    lines.push("");
-    lines.push(`--${altBoundary}`);
-    lines.push("Content-Type: text/html; charset=UTF-8");
-    lines.push("Content-Transfer-Encoding: 7bit");
-    lines.push("");
-    lines.push(options.body);
-    lines.push("");
-    lines.push(`--${altBoundary}--`);
+    pushAlternativeBody(lines, altBoundary, options.text!, options.body);
   } else {
     // Simple message
     const contentType = options.html ? "text/html" : "text/plain";

package/packages/core/src/metrics.ts

@@ -69,7 +69,11 @@ export function enginePath(): string | null {
 function runEngine(target: string): Record<string, any> {
   const binary = enginePath();
   if (!binary) throw new MetricsEngineError(`tina4 not found on PATH - ${INSTALL_HINT}`);
-  const processResult = spawnSync(binary, ["metrics", "--path", target, "--json"], {
+  // --no-history: a dashboard READ must never write .tina4-metrics.json.
+  // Without it every scan records history, the file watcher sees the write and
+  // reloads the page, which re-scans - a self-inflicted ~2-second reload loop
+  // that makes the dashboard unusable.
+  const processResult = spawnSync(binary, ["metrics", "--path", target, "--json", "--no-history"], {
     encoding: "utf8",
     timeout: 60_000,
     maxBuffer: 64 * 1024 * 1024,

package/packages/core/src/middleware.ts

@@ -931,6 +931,7 @@ export class RequestLogger {
  *   TINA4_CSP                 — Content-Security-Policy (default: "default-src 'self'")
  *   TINA4_REFERRER_POLICY     — Referrer-Policy (default: "strict-origin-when-cross-origin")
  *   TINA4_PERMISSIONS_POLICY  — Permissions-Policy (default: "camera=(), microphone=(), geolocation=()")
+ *   TINA4_COOP                — Cross-Origin-Opener-Policy (default: "same-origin-allow-popups")
  *
  * Usage:
  *   Router.use(SecurityHeadersMiddleware);
@@ -967,6 +968,7 @@ export class SecurityHeadersMiddleware {
       "Referrer-Policy": process.env.TINA4_REFERRER_POLICY ?? "strict-origin-when-cross-origin",
       "X-XSS-Protection": "0",
       "Permissions-Policy": process.env.TINA4_PERMISSIONS_POLICY ?? "camera=(), microphone=(), geolocation=()",
+      "Cross-Origin-Opener-Policy": process.env.TINA4_COOP ?? "same-origin-allow-popups",
     };
   }
 
@@ -996,7 +998,12 @@ export class SecurityHeadersMiddleware {
     // script-src (ADR-0088), already resolved in canonical, so the framework's
     // own inline <style>/<script> (and user templates using the Frond
     // csp_nonce() global) run under the strict policy without 'unsafe-inline'.
-    for (const name of ["Content-Security-Policy", "Referrer-Policy", "X-XSS-Protection", "Permissions-Policy"]) {
+    // Cross-Origin-Opener-Policy severs the window-reference link to a
+    // cross-origin opener (closing reverse-tab-nabbing + cross-window XS-Leaks
+    // that X-Frame-Options does not). Default same-origin-allow-popups keeps
+    // OAuth/payment popups working; TINA4_COOP=same-origin for full isolation,
+    // unsafe-none to opt out. Secure-context only (https + http://localhost).
+    for (const name of ["Content-Security-Policy", "Referrer-Policy", "X-XSS-Protection", "Permissions-Policy", "Cross-Origin-Opener-Policy"]) {
       res.header(name, canonical[name]);
     }
 

package/packages/core/src/optionalPackage.ts

@@ -11,8 +11,8 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  * APPLICATION installs, never the framework (ADR-0067).
  *
  * tina4-nodejs installs as exactly one package. `pg`, `mongodb`, `redis` and
- * the `@aws-sdk` S3 client are optional peerDependencies, which npm does not
- * install, so for most apps "missing" is the normal state. Every feature that
+ * the SQL drivers are optional peerDependencies, which npm does not install, so
+ * for most apps "missing" is the normal state. Every feature that
  * reaches for one must therefore fail at the point of use with the exact
  * command that fixes it - never a bare MODULE_NOT_FOUND, never a silent no-op.
  */

package/packages/core/src/plan.ts

@@ -18,6 +18,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  */
 
 import * as fs from "node:fs";
+import { trimChar } from "./slashTrim.js";
 import * as path from "node:path";
 
 const PLAN_DIR = "plan";
@@ -90,9 +91,8 @@ function archiveDir(): string {
 }
 
 function slugify(title: string): string {
-  const slug = (title || "").trim().toLowerCase()
-    .replace(/[^A-Za-z0-9_-]+/g, "-")
-    .replace(/^-+|-+$/g, "");
+  const dashed = (title || "").trim().toLowerCase().replace(/[^A-Za-z0-9_-]+/g, "-");
+  const slug = trimChar(dashed, 45); // ReDoS-safe edge-dash strip (45 = '-')
   return slug.slice(0, 80) || `plan-${Math.floor(Date.now() / 1000)}`;
 }
 
@@ -533,7 +533,7 @@ export const Plan = {
     const title = currentPlan.title || target;
     const goal = currentPlan.goal || "";
 
-    const aiUrl = process.env.TINA4_AI_URL || "http://localhost:11437/api/chat";
+    const aiUrl = process.env.TINA4_AI_URL || "http://localhost:11435/api/chat";
     const aiModel = process.env.TINA4_AI_MODEL || "qwen2.5-coder:14b";
     const prompts = fleshPrompt(title, goal, existing, prompt);
     const fetched = await fetchFleshReply(aiUrl, aiModel, prompts);

package/packages/core/src/push.ts

@@ -70,7 +70,7 @@ function encodeBase64Url(value: Uint8Array): string {
   return Buffer.from(value).toString("base64")
     .replace(/\+/g, "-")
     .replace(/\//g, "_")
-    .replace(/=+$/g, "");
+    .replace(/={1,2}$/, "");
 }
 
 function decodeBase64Url(value: string, name: string): Buffer {

package/packages/core/src/request.ts

@@ -7,7 +7,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 */
 
 import type { IncomingMessage, IncomingHttpHeaders } from "node:http";
-import { mkdirSync, realpathSync, writeFileSync } from "node:fs";
+import { closeSync, constants, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import type { Tina4Request, UploadedFile } from "./types.js";
 import { resolveClientIp, isTrustedProxy } from "./trustedProxy.js";
@@ -84,7 +84,12 @@ export function createRequest(req: IncomingMessage): Tina4Request {
   try {
     const url = new URL(req.url ?? "/", `${proto}://${host}`);
     for (const [key, value] of url.searchParams) {
-      query[key] = value;
+      if (isUnsafeFieldName(key)) continue;
+      // Reflect.set, not query[key]=value: the key is already filtered
+      // (isUnsafeFieldName drops __proto__/constructor/prototype), and the
+      // reflective write keeps that guarantee legible to static analysis
+      // (js/remote-property-injection).
+      Reflect.set(query, key, value);
     }
     path = url.pathname;
     queryString = url.search.replace(/^\?/, "");
@@ -96,7 +101,8 @@ export function createRequest(req: IncomingMessage): Tina4Request {
     queryString = questionIdx >= 0 ? rawTarget.slice(questionIdx + 1) : "";
     try {
       for (const [key, value] of new URLSearchParams(queryString)) {
-        query[key] = value;
+        if (isUnsafeFieldName(key)) continue;
+        Reflect.set(query, key, value);  // filtered key; reflective write (see above)
       }
     } catch { /* unparseable query — leave query empty, still route the path */ }
     fullUrl = `${proto}://${host}${rawTarget}`;
@@ -121,7 +127,9 @@ export function createRequest(req: IncomingMessage): Tina4Request {
   if (cookieHeader) {
     for (const pair of cookieHeader.split(";")) {
       const [k, ...v] = pair.trim().split("=");
-      if (k) cookies[k.trim()] = v.join("=").trim();
+      const name = k ? k.trim() : "";
+      // Reflective write of an already-filtered cookie name (js/remote-property-injection).
+      if (name && !isUnsafeFieldName(name)) Reflect.set(cookies, name, v.join("=").trim());
     }
   }
   w.cookies = cookies;
@@ -273,13 +281,7 @@ async function parseBody(req: Tina4Request): Promise<void> {
       req.body = str;
     }
   } else if (contentType.includes("application/x-www-form-urlencoded")) {
-    const str = raw.toString("utf-8");
-    const params = new URLSearchParams(str);
-    const obj: Record<string, string> = {};
-    for (const [key, value] of params) {
-      obj[key] = value;
-    }
-    req.body = obj;
+    req.body = nestFormFields([...new URLSearchParams(raw.toString("utf-8"))]);
   } else {
     req.body = raw.toString("utf-8");
   }
@@ -300,8 +302,8 @@ function extractBoundary(contentType: string): string | null {
 export function parseMultipart(
   body: Buffer,
   boundary: string,
-): { fields: Record<string, string>; files: Record<string, UploadedFile | UploadedFile[]> } {
-  const fields: Record<string, string> = {};
+): { fields: Record<string, FormValue>; files: Record<string, UploadedFile | UploadedFile[]> } {
+  const pairs: Array<[string, string]> = [];
   const files: Record<string, UploadedFile | UploadedFile[]> = {};
 
   const delimiter = Buffer.from(`--${boundary}`);
@@ -313,7 +315,7 @@ export function parseMultipart(
 
   // Find first delimiter
   const firstIdx = bufferIndexOf(body, delimiter, offset);
-  if (firstIdx === -1) return { fields, files };
+  if (firstIdx === -1) return { fields: {}, files };
   offset = firstIdx + delimiter.length;
 
   // Skip CRLF after delimiter
@@ -350,16 +352,21 @@ export function parseMultipart(
         content: Buffer.from(content),
         size: content.length,
       };
-      // Dict keyed by field name — multiple files under same name become array
-      if (files[disposition.name]) {
+      // Dict keyed by field name — multiple files under same name become array.
+      // A file field named __proto__/constructor/prototype is never legitimate
+      // and is dropped (js/remote-property-injection).
+      if (isUnsafeFieldName(disposition.name)) {
+        // skip
+      } else if (files[disposition.name]) {
         const existing = files[disposition.name];
-        files[disposition.name] = Array.isArray(existing) ? [...existing, file] : [existing, file];
+        // Reflective write of an already-filtered file-field name (js/remote-property-injection).
+        Reflect.set(files, disposition.name, Array.isArray(existing) ? [...existing, file] : [existing, file]);
       } else {
-        files[disposition.name] = file;
+        Reflect.set(files, disposition.name, file);
       }
     } else if (disposition.name) {
-      // Regular field
-      fields[disposition.name] = content.toString("utf-8");
+      // Regular field, nested once every part is read
+      pairs.push([disposition.name, content.toString("utf-8")]);
     }
 
     // Move past the delimiter
@@ -377,7 +384,7 @@ export function parseMultipart(
     }
   }
 
-  return { fields, files };
+  return { fields: nestFormFields(pairs), files };
 }
 
 /**
@@ -406,13 +413,34 @@ export function saveUpload(file: UploadedFile, targetDir: string, filename?: str
   mkdirSync(targetDir, { recursive: true });
   const dest = join(targetDir, base);
   // Defence in depth: the resolved parent of the destination must be exactly
-  // the resolved target dir (guards a pre-existing symlink at target/base).
+  // the resolved target dir.
   const realDir = realpathSync(targetDir);
   const realParent = realpathSync(dirname(dest));
   if (realParent !== realDir) {
     throw new Error(`refusing to write outside ${targetDir}: ${JSON.stringify(raw)}`);
   }
-  writeFileSync(dest, file.content);
+  // Never write THROUGH a link already at target/base: a symlink (even a
+  // dangling one) leads out of targetDir, and a hard link shares its bytes
+  // with a file elsewhere. Such an entry is removed so the upload gets a file
+  // of its own; a plain file is rewritten in place and keeps its mode.
+  if (lstatSync(dest, { throwIfNoEntry: false })?.isSymbolicLink()) unlinkSync(dest);
+  const flags = constants.O_WRONLY | constants.O_CREAT | (constants.O_NOFOLLOW ?? 0);
+  // 0o600: a newly created upload is owner-only, never group/other readable or
+  // writable (CWE-732). The mode applies only when O_CREAT makes the file; a
+  // plain file rewritten in place keeps its own mode, per the note above.
+  let fd = openSync(dest, flags, 0o600);
+  try {
+    if (fstatSync(fd).nlink > 1) {
+      closeSync(fd);
+      fd = -1;
+      unlinkSync(dest);
+      fd = openSync(dest, flags | constants.O_EXCL, 0o600);
+    }
+    ftruncateSync(fd, 0);
+    writeFileSync(fd, file.content);
+  } finally {
+    if (fd >= 0) closeSync(fd);
+  }
   return dest;
 }
 
@@ -440,6 +468,138 @@ function parseDisposition(headers: string): { name: string; filename?: string }
 }
 
 function parsePartContentType(headers: string): string | null {
-  const match = headers.match(/Content-Type:\s*(.+?)(?:\r?\n|$)/i);
-  return match?.[1]?.trim() ?? null;
+  // ReDoS-safe: a single negated class captures the rest of the line (it stops
+  // at CR/LF on its own, so no terminator alternation and no leading [ \t]* to
+  // overlap). Trim the surrounding whitespace in code.
+  const match = headers.match(/Content-Type:([^\r\n]*)/i);
+  const value = match?.[1]?.trim();
+  return value ? value : null;
+}
+
+/** A form field's value once its name is nested: `tags[]` a list, `user[name]` an object. */
+export type FormValue = string | FormValue[] | { [key: string]: FormValue };
+
+/** A field name nested this deep or deeper keeps its flat key. Rack's param_depth_limit. */
+const FORM_DEPTH_LIMIT = 32;
+
+/** A form with more fields than this is not nested at all. Rack's params_limit. */
+const FORM_FIELD_LIMIT = 4096;
+
+/** A field name longer than this keeps its flat key. */
+const FORM_NAME_LIMIT = 1024;
+
+/**
+ * The three keys that reach the prototype chain. A query param, cookie or file
+ * field literally named one of these is never legitimate, so the flat maps
+ * (query / cookies / files) drop it. The nested body builder does NOT drop
+ * `constructor`/`prototype` - a form MAY carry `user[constructor][name]` as
+ * data - and stays safe a different way: its containers are prototype-less
+ * (`Object.create(null)` in node() below), so assigning any of these as an own
+ * key cannot pollute a prototype. `__proto__` segments are dropped outright
+ * (the kept filter). Together these make prototype pollution structurally
+ * impossible, not merely filtered (js/prototype-polluting-assignment,
+ * js/remote-property-injection).
+ */
+const isUnsafeFieldName = (key: string): boolean =>
+  key === "__proto__" || key === "constructor" || key === "prototype";
+
+/**
+ * Nest form fields the way PHP and Rack (tina4-ruby) nest a form: `tags[]`
+ * collects an array, `user[name]` builds an object, `a[][x]` an array of
+ * objects, and a repeated plain name keeps its last value. Used for urlencoded
+ * and multipart bodies alike, so a form arrives in one shape however it was
+ * encoded. A field that cannot nest - its name conflicts with an earlier one
+ * (`a=1` then `a[b]=2`), nests too deep or is longer than FORM_NAME_LIMIT -
+ * keeps its flat key; the rest still nest. A later plain name replaces an
+ * earlier nested value of that name, as Rack and parse_str do. A field with a `__proto__` segment anywhere in its name is dropped.
+ */
+function nestFormFields(pairs: Array<[string, string]>): Record<string, FormValue> {
+  const kept = pairs.filter(([name]) => !/(^|[[\]])__proto__([[\]]|$)/.test(name));
+  if (kept.length > FORM_FIELD_LIMIT) return Object.fromEntries(kept);
+  const nested = new WeakSet<object>();
+  // Prototype-less: assigning any user key (including `constructor`/`prototype`)
+  // as an own property on these containers cannot reach or mutate a prototype,
+  // so the nested body is safe by construction (js/prototype-polluting-assignment).
+  const node = (): Record<string, FormValue> => {
+    const created: Record<string, FormValue> = Object.create(null);
+    nested.add(created);
+    return created;
+  };
+  const isNode = (value: unknown): value is Record<string, FormValue> =>
+    typeof value === "object" && value !== null && nested.has(value);
+  const own = (params: Record<string, FormValue>, key: string): FormValue | undefined =>
+    Object.prototype.hasOwnProperty.call(params, key) ? params[key] : undefined;
+  const list = (params: Record<string, FormValue>, key: string): FormValue[] => {
+    let current = own(params, key);
+    if (current === undefined) { current = []; Reflect.set(params, key, current); }
+    if (!Array.isArray(current)) throw new RangeError(`expected an array for '${key}'`);
+    return current;
+  };
+  const object = (params: Record<string, FormValue>, key: string): Record<string, FormValue> => {
+    let current = own(params, key);
+    if (current === undefined) { current = node(); Reflect.set(params, key, current); }
+    if (!isNode(current)) throw new RangeError(`expected an object for '${key}'`);
+    return current;
+  };
+  const hasKey = (params: Record<string, FormValue>, key: string): boolean => {
+    if (key.includes("[]")) return false;
+    let level: FormValue | undefined = params;
+    for (const part of key.split(/[[\]]+/).filter(Boolean)) {
+      if (!isNode(level) || own(level, part) === undefined) return false;
+      level = level[part];
+    }
+    return true;
+  };
+  const splitName = (name: string, depth: number): [string, string] => {
+    if (depth === 0) {
+      const start = name.indexOf("[", 1);
+      return start === -1 ? [name, ""] : [name.slice(0, start), name.slice(start)];
+    }
+    if (name.startsWith("[]")) return ["[]", name.slice(2)];
+    const close = name.indexOf("]", 1);
+    return name.startsWith("[") && close !== -1 ? [name.slice(1, close), name.slice(close + 1)] : [name, ""];
+  };
+  // `a[][x]`: fill the last record unless it already has `x`, else start one.
+  const putListItem = (items: FormValue[], after: string, value: string, depth: number): void => {
+    let childKey = after[2] === "[" && after.endsWith("]") ? after.slice(3, -1) : "";
+    if (childKey === "" || childKey.includes("[") || childKey.includes("]")) childKey = after.slice(2);
+    const last = items[items.length - 1];
+    if (isNode(last) && !hasKey(last, childKey)) put(last, childKey, value, depth + 1);
+    else items.push(put(node(), childKey, value, depth + 1) as FormValue);
+  };
+  // Rack::QueryParser#normalize_params, ported from tina4-ruby's form parser.
+  const put = (params: Record<string, FormValue>, name: string, value: string, depth: number): FormValue | undefined => {
+    const [key, after] = splitName(name, depth);
+    if (key === "") return undefined;
+    if (after === "" && key === "[]" && depth !== 0) return [value];
+    // Reflective writes into prototype-less `node()` containers (js/remote-property-injection).
+    if (after === "") Reflect.set(params, key, value);
+    else if (after === "[") Reflect.set(params, name, value);
+    else if (after === "[]") list(params, key).push(value);
+    else if (after.startsWith("[]")) putListItem(list(params, key), after, value, depth);
+    else put(object(params, key), after, value, depth + 1);
+    return params;
+  };
+  // Counts brackets only up to the limit, so a name of millions of them costs nothing.
+  const tooDeep = (name: string): boolean => {
+    let count = 0;
+    for (let at = name.indexOf("["); at !== -1; at = name.indexOf("[", at + 1)) {
+      if (++count >= FORM_DEPTH_LIMIT) return true;
+    }
+    return false;
+  };
+  const fields = node();
+  for (const [name, value] of kept) {
+    if (name.length > FORM_NAME_LIMIT || tooDeep(name)) {
+      Reflect.set(fields, name, value);  // prototype-less container (js/remote-property-injection)
+      continue;
+    }
+    try {
+      put(fields, name, value, 0);
+    } catch (error) {
+      if (!(error instanceof RangeError)) throw error;
+      Reflect.set(fields, name, value);  // prototype-less container (js/remote-property-injection)
+    }
+  }
+  return fields;
 }

package/packages/core/src/router.ts

@@ -7,6 +7,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 */
 
 import type { RouteHandler, RouteDefinition, RouteMeta, Middleware, MiddlewareSpec, Tina4Request, Tina4Response, WebSocketRouteHandler, WebSocketRouteDefinition } from "./types.js";
+import { trimSlashes, rtrimSlashes } from "./slashTrim.js";
 import { isTruthy } from "./dotenv.js";
 import { MiddlewareRunner, isMiddlewareClass } from "./middleware.js";
 
@@ -63,7 +64,7 @@ function coerceParam(raw: string, type: string | undefined): string | number {
  */
 function joinGroupPath(prefix: string, path: string): string {
   const full = `${prefix}/${path.replace(/^\/+/, "")}`;
-  const trimmed = `/${full.replace(/^\/+|\/+$/g, "")}`;
+  const trimmed = `/${trimSlashes(full)}`;
   return trimmed.replace(/\/+/g, "/");
 }
 
@@ -369,7 +370,7 @@ export class Router {
         path.length > 1 &&
         path.endsWith("/")
       ) {
-        const stripped = path.replace(/\/+$/, "");
+        const stripped = rtrimSlashes(path);
         if (stripped.length > 0) {
           const retry = this.matchRoute(routes, stripped);
           if (retry) return retry;