# Changelog All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html), and is generated by [Changie](https://github.com/miniscruff/changie). ## 0.3.6 - 2026-04-16 ### Changed * syncDocs now regenerates the docs-site package-lock.json after bumping devDependencies.gina — prevents CI / Vercel / Worker deploy failures on every stable release. ### Fixed * Prevented spurious Whisper Error on the first CLI command after a fresh install (#B12). `gina --version` and `gina framework:*` commands no longer emit a red error stack trace before their output on a brand-new install. * Hardening framework:init against missing or mistyped `def_*` keys in ~/.gina/main.json (#B13 — blast-radius follow-up to #B12). `main['def_prefix']`, `def_global_mode`, `def_arch`, `def_platform`, `def_env`, `def_scope`, `def_log_level` reads now short-circuit to undefined instead of throwing TypeError when the key is entirely absent. * Surfacing the real cause when `prepare_version.js` is run against a stale `~/.gina//settings.json` `dir` field. Publish now fails fast with an actionable message instead of wedging at `pushChangesToGitIfNeeded` with a misleading "No branch selected" error. * Preventing CORS preflight failure when a bundle's env.json `access-control-allow-headers` list omits a header the client actually sends. `completeHeaders()` no longer overwrites the echo that `checkPreflightRequest()` sets from the incoming `access-control-request-headers` (#B13). ### Security * Added pre-commit hook (.githooks/pre-commit) that blocks Claude-related paths (CLAUDE.md, .claude*) from entering git history. post_install.js installs core.hooksPath=.githooks for contributor clones only (gated on .git presence in gina repo root). #S5 follow-up to #S3. * Added GitHub Actions workflow (.github/workflows/security.yml) that greps the git index on every push/PR to develop and master for Claude-related paths (CLAUDE.md, .claude*). Fails the build if any are tracked. Backs up the local pre-commit hook (#S5) and publish-boundary gate (#S3). #S6 follow-up to #S3. * Added private-token leak gate (script/check_no_claude_leak.js) wired into the npm prepack hook and the prepare_version.js self.* chain before any git add --all. Fails the publish if the tarball listing contains Claude-related paths OR if pack contents contain private-token patterns (phone, private email, private address, private domain, co-author legal name). #G1 follow-up to #S3/#S4. * Added opt-in pre-commit hook (resources/git-hooks/pre-commit) that blocks commits authored under a private-domain git identity (.local hostnames, internal domains). Contributors install it once via cp resources/git-hooks/pre-commit .git/hooks/pre-commit. Complements the CI-side Claude-path guard (#S5/#S6). #G5. * Redacting secret-looking fields from the dev-mode Inspector feed before any sink (window.__ginaData, localStorage.__ginaData, /_gina/agent SSE, engine.io push, ginaToolbar forms/XHR overlays). New lib/inspector-redact deep-clones the Inspector payload and replaces values whose keys match the default regex (password, pwd, secret, token, apikey, cvv, ssn, authorization, credentials, private_key) with [redacted]. Two complementary carve-outs preserve validation metadata: (1) NON_SECRET_SUFFIX — keys ending in rule/rules/policy/policies/validator/config/configuration/settings/requirements/strength/constraint/options/schema/definition/spec pass through untouched (e.g. passwordRule, passwordPolicy describe form rules, not user input); (2) primitive-only redaction — when a matched secret key holds an object or array, the walker recurses into it instead of replacing it, because such values are always metadata (e.g. rules.account[password] = {isRequired: true, isString: 7} — an HTML form field name under a rules: section). Nested primitive secrets inside preserved objects are still caught on recursion. Client-side shim in statusbar.html mirrors both carve-outs and additionally redacts any DOM input whose type matches configured types (default: password). Configurable via settings.json inspector.redact.{patterns,types,replacement}. Dev-mode only — the actual HTTP response body is never touched. #R7. ## 0.3.5 - 2026-04-13 ### Security * Bumped @rhinostone/swig to 1.5.0 — extends CVE-2023-25345 path-traversal guards to bracket notation, set bracket assignment, for loop variables, macro names, and import aliases. * Updated vendored client-side swig (core/deps/swig-client/) to the v1.5.0 browser build. Extends CVE-2023-25345 path-traversal guards to bracket-notation access, for-loop variables, macro names, and import aliases — completing the __proto__/constructor/prototype blocklist. Browser-side templating now matches the server-side @rhinostone/swig 1.5.0 protections. ## 0.3.4 - 2026-04-12 ### Fixed * bumpVersion and prepare_version now update gna.js framework paths on version changes — fixes CI test failures where gna.js referenced a stale framework directory * Swig resolution test now skips on CI where framework/v*/node_modules does not exist (framework/package.json is gitignored) * require('gina/gna') explicit exports now resolve correctly — v0.3.3 shipped with stale framework paths in gna.js that caused MODULE_NOT_FOUND errors ## 0.3.3 - 2026-04-11 ### Added * Live database index introspection for Inspector Query tab — SQL connectors (MySQL, PostgreSQL, SQLite) now report actual database indexes without requiring manual indexes.sql files * Implement `framework:get` CLI command — read one or all keys from ~/.gina/settings.json (`gina get --key`, `gina get all`). Completes the `gina set` / `gina get` pair. * Implement `port:set` CLI command — set or update a port number for a bundle/environment/protocol/scheme combination. Supports both positional syntax (`gina port:set http/1.1:3200 frontend @myproject/dev`) and flag syntax (`--protocol=`, `--scheme=`, `--port=`, `--env=`), with interactive prompts for missing values. ### Changed * Improved popin loading and opening performance: parallel resource loading via DOM injection (replaces sequential XHR + eval), eliminated redundant DOM binding on open, reduced DOM scans with querySelectorAll, classList API, cached RegExp, lightweight ID counter, per-load XHR for concurrent popins * Replacing uuid/crypto.randomUUID() with internal lib/uuid — lightweight base-62 ID generator using crypto.getRandomValues with bitmask bias avoidance, zero external dependencies * Replaced vendored swig-1.4.2 with @rhinostone/swig npm dependency in framework/v*/package.json ### Fixed * Fixed malformed regex in events.js XHR error handler, operator precedence bug in binding.js error logging, typo in events.js header loop variable, implemented popinDestroy (was a stub), and fixed registeredPopins duplicate-check array never being populated * explainForIndexes crashes on bulkInsert path where conn._cluster is undefined (conn is a scope object, cluster lives at conn._scope._bucket._cluster). The crash occurs before self.emit(trigger), silently hanging the entity callback and causing a 504 timeout with no error in logs. Fixed by resolving the cluster from either conn shape, with early-return guard and internal try/catch so dev-mode instrumentation never blocks the emit path. * Validator global validation pass no longer displays errors for untouched fields. On every field blur, the validator runs a full-form validation to determine submit button state (isFormValid). Previously, the global pass displayed errors for ALL invalid fields — untouched fields would suddenly show errors when the user interacted with a different field. Now only the field the user actually touched (event.target.name) shows errors. Two call sites fixed in validator/src/main.js (~line 3337 and ~line 4865). * Vendoring streamsearch-1.1.0 to fix busboy MODULE_NOT_FOUND crash in Docker containers after framework directory rename * Forwarding emerg message to CLI output and docker logs when a bundle aborts during startup * Config loader checks MIDDLEWARE file existence before reading — prevents crash in containers or environments where the file is absent * requireJSON now tolerates trailing commas in JSON config files — strips them and warns instead of calling emerg+exit, preventing bundle abort on common authoring mistakes ## 0.3.3-alpha.3 - 2026-04-09 ### Added * TypeScript declaration files (`types/index.d.ts`, `types/globals.d.ts`, `types/gna.d.ts`) — `.d.ts` declarations for the public surface: `SuperController`, `EntitySuper`, global helpers, connector config shapes, `routing.json` schema, all config file interfaces, `GinaRequest`/`GinaResponse` types, `PathObject`, `uuid`, and the `Gna` lifecycle module. Zero TS migration of internals — declarations only. Enables IDE autocomplete and static analysis for consumer projects. `package.json` wired with `"types"` and `"typesVersions"`. * Explicit exports via `require('gina/gna')` — all global helpers (`getContext`, `setContext`, `_`, `requireJSON`, `onCompleteCall`, `getModel`, `uuid`, `ApiError`, etc.), `SuperController`, and `EntitySuper` available as named imports. Uses lazy getters so symbols resolve at access time (after framework boot). Enables IDE go-to-definition and `import { getContext } from 'gina/gna'`-style usage alongside the existing global injection. ## 0.3.3-alpha.2 - 2026-04-08 ### Added * `bundle:openapi` CLI command — generates an OpenAPI 3.1.0 specification from `routing.json` for one or more bundles. Alias: `bundle:oas`. Supports `--output` flag for custom output path. Zero manual spec writing — `url`, `method`, `param.control`, `namespace`, `requirements`, `_comment`, `_sample`, `middleware`, and `cache` fields all map to their OpenAPI equivalents. Makes any Gina app consumable by AI agents, API gateways, and testing tools. * `framework:get` CLI command — read one or all keys from `~/.gina/settings.json` * `port:set` CLI command — set or update a specific port for a bundle/env/protocol/scheme combination ## 0.3.2 - 2026-04-07 ### Added * JSON Schema files for all config files (app, connectors, manifest, routing, settings, watchers, crons) — published at gina.io/schema/* * Entity short-name aliases — use self.getEntity('user') instead of self.getEntity('user/user') ### Changed * Server engines — font MIME types (woff/woff2/otf/ttf) and Inspector endpoint improvements * Inspector UI — tab layout presets (Balanced/Backend/Frontend/Custom with drag-to-reorder), query performance banners, missing-index banners, cross-bundle QI propagation, render-json Inspector data feed, _inspectorActive profiling gate ### Fixed * Model loading without onInitialize hook — entities load correctly when the model has no onInitialize * CLI stability and install path edge cases * getConfig() proxy override — guards against undefined PROXY_HOSTNAME on same-origin POST requests with Origin header * bundle:start crash on unregistered bundle — isDefined guard moved before property access ## 0.3.1 - 2026-04-06 ### Added * SQL index reporting Phase A (#QI1): connectors read indexes.sql at startup and populate query instrumentation index badges in the Inspector ### Changed * HTML rendering now uses direct HTTP/2 stream.respond() + stream.end(), bypassing the HTTP/1.1 compatibility layer (matching JSON rendering behaviour) * Removed ssl-checker, colors, and uuid dependencies — engine.io is now the sole runtime dependency ## 0.3.0 - 2026-04-06 ### Added * HTTP/2 client resilience: retry with backoff (up to 2 retries with 500ms delay), pre-flight PING validation on cached sessions, and session freshness tracking via _lastPongAt. Protects against OrbStack silent TCP drops and stale HTTP/2 sessions. * Inspector UX: drag-to-select log rows, copy badge fade-out, left accent selection styling, logo watermark on content panes, window geometry and env panel height persistence * Inspector View tab performance anomaly alerts: pulsing dot indicator on tab label, badge border override, and tooltip for metrics exceeding thresholds (load time, transfer size, FCP, query duration, query count) * Inspector Query tab: index badges per query card showing which database indexes are used (green for secondary, amber for primary scan, red for no index, grey N/A for unsupported connectors) * Inspector Query tab: per-card result size color-coding using the same weight thresholds as the total badge * Inspector Query tab: search input debounce (200ms), filter persistence in localStorage, and pagination (20 cards default with Show all button) * Couchbase connector: extractIndexes() helper and profile timings query option in dev mode for index reporting in the Inspector * Inspector: manual connect form on the 'No source' overlay — type a bundle URL to connect without editing the address bar * Inspector: tab layout presets (Balanced / Backend / Frontend / Custom) in settings panel — reorder tabs for different developer audiences, or drag to create a custom order * Docker Compose starter: `docker compose up` in gina-starter sets up a Gina app container + Couchbase Community 7.6.4 with pre-seeded cluster, bucket, application user, and sample documents — zero local install required ### Changed * Renamed legacy Inspector parameter and marker names across the render pipeline: `displayToolbar` → `displayInspector` (server.js, controller.js, render-swig.js, render-v1.js), `{# Gina Toolbar #}` → `{# Gina Inspector #}` comment markers and guard regexes, "Beemaster" → "Inspector" in server.isaac.js and scan.js comments. `render-v1.js` now includes `statusbar.html` instead of `toolbar.html`, completing the migration of all render paths to the modern Inspector statusbar. ### Fixed * Fixed error page displaying `[object Object]` when upstream returned an error object instead of a string — render-swig now normalises error and message fields to strings before building the error response (#Q2) * Couchbase session store v3/v4: touch() and destroy() passed MutationResult as error to express-session callback, causing defer(next, MutationResult) and a 500 response with the Couchbase CAS token as body on every authenticated read-only request (#CB-BUG-4) * Static file server now sends ETag and Last-Modified headers in production, enabling conditional GET (304 Not Modified) responses for all static types on both HTTP/1.x and HTTP/2 paths * Fixed method-based routing on shared URLs — the router now continues scanning after a URL match with a wrong method instead of immediately throwing 405. GET /notes and POST /notes can coexist as separate routing rules; a 405 is only emitted after the full scan finds no method match. * Fixed crash in fitsWithRequirements when a URL param route has no requirements block — router now accepts any non-empty segment value and correctly binds it to req.params / req[method] instead of throwing TypeError. * Fixed throwError(res, code, stringMsg) silently overriding an explicit 3-digit HTTP status code with res.status || 500 — throwError(res, 404, "Not found") now correctly sends 404 instead of 500. * Removed dead buffer consumption code from entity.js Option B path (_arguments[trigger] was unreachable for both connector-generated and custom entity methods). Added defensive unconditional clear at Option B entry point to prevent stale buffer leakage across calls (#M5). * Inspector Query tab: durationClass variable shadowing in renderQueryContent ## 0.3.0-alpha.1 - 2026-04-02 ### Added * `project:start` / `project:stop` / `project:restart` — start, stop, or restart all bundles in a project with one command. Delegates to `bundle:start/stop/restart @` (bulk mode). Flags forwarded. * Inspector Phase 2 — Inspector dev SPA embedded at `/_gina/inspector/` (engine-agnostic — works with both Isaac and Express). See CHANGELOG.md for the complete breakdown. * Thin in-page status bar — `statusbar.html` (new file in `dist/vendor/gina/html/`) is included instead of `toolbar.html`. A 36-line vanilla JS IIFE creates a Shadow DOM host (`#__gina-statusbar`) fixed at bottom-right: status dot (green = ok, red = `data.error` set), `bundle@env` label, and an "Inspector" link to `/_gina/inspector/`. No RequireJS, no jQuery, no SASS. Shadow DOM isolates styles from the app. `gina.js` toolbar module silently skips init when `#gina-toolbar` is absent (`!$toolbar.length` guard at line 17752). * Gina infrastructure port range 4100–4199 — reserved exclusively for Gina infrastructure; never assigned to bundle HTTP servers by `gina port:scan` (range skipped automatically). Layout: `4100` = socket server (future migration from 8124), `4101` = reserved, `4102` = engine.io internal transport, `4103–4199` = reserved for future Gina infrastructure. `settings.json` `engine.io.port` corrected from `8888` (conflicts with Jupyter Notebook) to `4102`. Port range documented in `framework/v0.3.0-alpha.1/lib/cmd/port/help.txt`. * `window.__ginaData` — replaces the two `
` DOM nodes with a single `` tag injected before `` in dev mode. Data is built in Node.js (`controller.render-swig.js`) with the same field masking as before (`view.assets = {}`, `view.scripts/stylesheets = "ignored-by-toolbar"`); `` and `