@vfarcic/dot-ai 1.21.1 → 1.22.0

package/dist/core/git-utils.d.ts

@@ -11,6 +11,19 @@
  * - GITHUB_APP_ENABLED: Enable GitHub App authentication
  * - GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY, GITHUB_APP_INSTALLATION_ID: GitHub App config
  */
+/**
+ * Environment variable name through which a per-request override credential
+ * (PRD #621 M3) is handed to the GIT_ASKPASS helper. The token travels in the
+ * git child process's ENVIRONMENT — never on its argv (ps/proc) and never
+ * embedded in the clone URL written to `.git/config`.
+ */
+export declare const ASKPASS_TOKEN_ENV = "DOT_AI_GIT_ASKPASS_TOKEN";
+/**
+ * Environment variable naming the host the override token is bound to. The
+ * GIT_ASKPASS helper emits the token ONLY when git's credential prompt names
+ * this host, so a cross-host HTTP redirect can never obtain it (Decision 3).
+ */
+export declare const ASKPASS_HOST_ENV = "DOT_AI_GIT_ASKPASS_HOST";
 export interface GitAuthConfig {
     pat?: string;
     githubApp?: {
@@ -31,7 +44,40 @@ export declare function sanitizeRelativePath(relativePath: string): string;
 export interface CloneOptions {
     branch?: string;
     depth?: number;
+    /**
+     * Per-call git credential (PRD #621 M3). When supplied it OVERRIDES the
+     * env/GitHub-App auth (`getGitAuthConfigFromEnv`) for this clone only
+     * (Decision 4) and is scoped to the host in `repoUrl` with cross-host
+     * redirect forwarding disabled (Decision 3 — see buildOverrideCloneAuth).
+     * When omitted, the clone uses env auth exactly as before.
+     */
+    token?: string;
 }
+/**
+ * PRD #621 M3 / Decision 3: build the clone URL + intended host for a
+ * per-request override credential.
+ *
+ * The credential itself is NOT in the returned URL — it is the bare
+ * `x-access-token` username only (the token is passed via a HOST-BOUND
+ * GIT_ASKPASS helper, see cloneRepo / createAskpassScript). So the token never
+ * lands on the git argv or in the cloned `.git/config` remote URL (MEDIUM-2/3).
+ *
+ * No `-c` git config is returned: the earlier `-c credential.helper=` was
+ * REJECTED by simple-git's safety guard (allowUnsafeCredentialHelper), which
+ * aborted the clone entirely; and `-c http.followRedirects=false` is dropped
+ * per review finding R-1 (it blocked legitimate same-host redirects too). The
+ * host-bound askpass makes following redirects provably safe — the token is
+ * emitted ONLY for `host`, and libcurl already strips credentials on a
+ * cross-host redirect by default.
+ *
+ * Returned as plain data so the auth decision is unit-testable without spawning
+ * git. The token is intentionally NOT a parameter — it never influences this
+ * (URL/argv) surface.
+ */
+export declare function buildOverrideCloneAuth(repoUrl: string): {
+    cloneUrl: string;
+    host: string;
+};
 export declare function cloneRepo(repoUrl: string, targetDir: string, opts?: CloneOptions): Promise<{
     localPath: string;
     branch: string;

package/dist/core/git-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-utils.d.ts","sourceRoot":"","sources":["../../src/core/git-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AASD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAK1E;AA2ED,wBAAsB,YAAY,CAAC,UAAU,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAc7E;AAED,wBAAgB,uBAAuB,IAAI,aAAa,CAyBvD;AAeD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CASjE;AAID,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BhD;AAID,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA8B5E;AAID,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAC/C,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,UAAU,CAAC,CA4ErB"}
+{"version":3,"file":"git-utils.d.ts","sourceRoot":"","sources":["../../src/core/git-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,6BAA6B,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,4BAA4B,CAAC;AAI1D,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AASD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAK1E;AA2ED,wBAAsB,YAAY,CAAC,UAAU,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAc7E;AAED,wBAAgB,uBAAuB,IAAI,aAAa,CAyBvD;AAeD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CASjE;AAID,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,CAMA;AAkJD,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAsChD;AAID,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA8B5E;AAID,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAC/C,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,UAAU,CAAC,CA4ErB"}

package/dist/core/git-utils.js

@@ -49,20 +49,37 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ASKPASS_HOST_ENV = exports.ASKPASS_TOKEN_ENV = void 0;
 exports.scrubCredentials = scrubCredentials;
 exports.getAuthenticatedUrl = getAuthenticatedUrl;
 exports.getAuthToken = getAuthToken;
 exports.getGitAuthConfigFromEnv = getGitAuthConfigFromEnv;
 exports.sanitizeRelativePath = sanitizeRelativePath;
+exports.buildOverrideCloneAuth = buildOverrideCloneAuth;
 exports.cloneRepo = cloneRepo;
 exports.pullRepo = pullRepo;
 exports.pushRepo = pushRepo;
 const simple_git_1 = __importDefault(require("simple-git"));
+const node_child_process_1 = require("node:child_process");
 const jwt = __importStar(require("jsonwebtoken"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const os = __importStar(require("os"));
 const FETCH_TIMEOUT_MS = 30000;
 const GIT_TIMEOUT_MS = 120000; // 2 minutes for git operations
+/**
+ * Environment variable name through which a per-request override credential
+ * (PRD #621 M3) is handed to the GIT_ASKPASS helper. The token travels in the
+ * git child process's ENVIRONMENT — never on its argv (ps/proc) and never
+ * embedded in the clone URL written to `.git/config`.
+ */
+exports.ASKPASS_TOKEN_ENV = 'DOT_AI_GIT_ASKPASS_TOKEN';
+/**
+ * Environment variable naming the host the override token is bound to. The
+ * GIT_ASKPASS helper emits the token ONLY when git's credential prompt names
+ * this host, so a cross-host HTTP redirect can never obtain it (Decision 3).
+ */
+exports.ASKPASS_HOST_ENV = 'DOT_AI_GIT_ASKPASS_HOST';
 // ─── Auth helpers ───
 function scrubCredentials(message) {
     return message
@@ -177,10 +194,184 @@ function sanitizeRelativePath(relativePath) {
     }
     return normalized;
 }
+/**
+ * PRD #621 M3 / Decision 3: build the clone URL + intended host for a
+ * per-request override credential.
+ *
+ * The credential itself is NOT in the returned URL — it is the bare
+ * `x-access-token` username only (the token is passed via a HOST-BOUND
+ * GIT_ASKPASS helper, see cloneRepo / createAskpassScript). So the token never
+ * lands on the git argv or in the cloned `.git/config` remote URL (MEDIUM-2/3).
+ *
+ * No `-c` git config is returned: the earlier `-c credential.helper=` was
+ * REJECTED by simple-git's safety guard (allowUnsafeCredentialHelper), which
+ * aborted the clone entirely; and `-c http.followRedirects=false` is dropped
+ * per review finding R-1 (it blocked legitimate same-host redirects too). The
+ * host-bound askpass makes following redirects provably safe — the token is
+ * emitted ONLY for `host`, and libcurl already strips credentials on a
+ * cross-host redirect by default.
+ *
+ * Returned as plain data so the auth decision is unit-testable without spawning
+ * git. The token is intentionally NOT a parameter — it never influences this
+ * (URL/argv) surface.
+ */
+function buildOverrideCloneAuth(repoUrl) {
+    const url = new URL(repoUrl);
+    const host = url.host;
+    url.username = 'x-access-token';
+    url.password = '';
+    return { cloneUrl: url.toString(), host };
+}
+/**
+ * Create a throwaway, HOST-BOUND GIT_ASKPASS helper script. The script holds NO
+ * secret — it echoes the token from the environment (ASKPASS_TOKEN_ENV) ONLY
+ * when git's credential prompt (passed as $1) names the intended host
+ * (ASKPASS_HOST_ENV), delimited by `@`/`//` before and a closing quote after.
+ * For any other host — e.g. after an HTTP redirect, or a look-alike like
+ * `github.com.evil.test` — it emits nothing, so the token can never reach a
+ * different host (Decision 3). The token never touches disk. The script lives
+ * in its own 0700 temp dir; `cleanup` removes it.
+ */
+function createAskpassScript() {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dot-ai-askpass-'));
+    try {
+        fs.chmodSync(dir, 0o700);
+    }
+    catch {
+        /* best-effort hardening */
+    }
+    const scriptPath = path.join(dir, 'askpass.sh');
+    // Host-bound match: require the intended host immediately after `@` or `//`
+    // and immediately before the closing `'` git puts around the URL, so neither
+    // a different redirect host nor a look-alike suffix matches.
+    const script = [
+        '#!/bin/sh',
+        'case "$1" in',
+        `  *"@$${exports.ASKPASS_HOST_ENV}'"*|*"//$${exports.ASKPASS_HOST_ENV}'"*)`,
+        `    printf '%s\\n' "$${exports.ASKPASS_TOKEN_ENV}"`,
+        '    ;;',
+        'esac',
+        '',
+    ].join('\n');
+    fs.writeFileSync(scriptPath, script, { mode: 0o700 });
+    return {
+        scriptPath,
+        cleanup: () => {
+            try {
+                fs.rmSync(dir, { recursive: true, force: true });
+            }
+            catch {
+                /* best-effort cleanup; the script holds no secret */
+            }
+        },
+    };
+}
+/**
+ * PRD #621 M3: clone an OVERRIDE repo using a per-request token, via a
+ * HOST-BOUND GIT_ASKPASS helper.
+ *
+ * This deliberately spawns `git` DIRECTLY rather than going through simple-git:
+ * simple-git's safety scanner rejects the env vars this approach relies on
+ * (GIT_ASKPASS → allowUnsafeAskPass) and even flags inherited vars like EDITOR
+ * / PAGER, which aborts the clone before it starts. A direct spawn lets us pass
+ * the full process.env (PATH/HOME/proxy/TLS) plus the askpass wiring with no
+ * argument/env guard interference, while still keeping:
+ *   - the token OFF the argv (the URL carries only the `x-access-token`
+ *     username) and OUT of .git/config (MEDIUM-2/MEDIUM-3);
+ *   - the token bound to the source host so a cross-host redirect can't obtain
+ *     it (Decision 3 — host-bound askpass + libcurl's default cross-host
+ *     credential stripping). Redirects are NOT disabled (review finding R-1),
+ *     so legitimate same-host redirects still work.
+ */
+async function cloneWithOverrideToken(repoUrl, targetDir, opts) {
+    const { cloneUrl, host } = buildOverrideCloneAuth(repoUrl);
+    const askpass = createAskpassScript();
+    const args = ['clone'];
+    if (opts.branch) {
+        args.push('--branch', opts.branch);
+    }
+    if (opts.depth) {
+        args.push('--depth', String(opts.depth));
+    }
+    // `--` terminates option parsing so the URL/dir can never be read as flags.
+    args.push('--', cloneUrl, targetDir);
+    const env = {
+        ...process.env,
+        GIT_ASKPASS: askpass.scriptPath,
+        // Never fall back to an interactive terminal prompt if askpass yields nothing.
+        GIT_TERMINAL_PROMPT: '0',
+        [exports.ASKPASS_TOKEN_ENV]: opts.token,
+        [exports.ASKPASS_HOST_ENV]: host,
+    };
+    try {
+        await new Promise((resolve, reject) => {
+            const child = (0, node_child_process_1.spawn)('git', args, {
+                env,
+                stdio: ['ignore', 'ignore', 'pipe'],
+            });
+            let stderr = '';
+            // The 'error', 'close', and timeout handlers can each race to settle this
+            // promise (e.g. 'close' still fires after a kill or a spawn 'error'). A
+            // promise only settles once, but the LATER handlers would still run their
+            // logic on an already-settled promise. Guard so the FIRST settle wins and
+            // every subsequent handler is a no-op, and clear the timeout on settle so
+            // no dangling timer fires afterwards.
+            let settled = false;
+            const timerRef = {};
+            const settle = (action) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (timerRef.id)
+                    clearTimeout(timerRef.id);
+                action();
+            };
+            timerRef.id = setTimeout(() => {
+                settle(() => {
+                    child.kill('SIGKILL');
+                    reject(new Error(`git clone timed out after ${GIT_TIMEOUT_MS}ms`));
+                });
+            }, GIT_TIMEOUT_MS);
+            child.stderr?.on('data', chunk => {
+                stderr += chunk.toString();
+            });
+            child.on('error', err => {
+                settle(() => reject(err));
+            });
+            child.on('close', code => {
+                settle(() => {
+                    if (code === 0) {
+                        resolve();
+                    }
+                    else {
+                        // stderr carries only the username-only URL (no token), so it is
+                        // safe to surface; the caller scrubs it again as defense-in-depth.
+                        reject(new Error(`git clone exited with code ${code}: ${stderr.trim()}`));
+                    }
+                });
+            });
+        });
+    }
+    finally {
+        // Remove the askpass helper as soon as the clone finishes (success or
+        // failure). It holds no secret, but leaving temp files around is untidy.
+        askpass.cleanup();
+    }
+    return { localPath: targetDir, branch: opts.branch || 'main' };
+}
 async function cloneRepo(repoUrl, targetDir, opts) {
+    // PRD #621 M3 / Decision 4: a per-request override credential takes precedence
+    // over env auth for THIS clone only and uses the host-bound GIT_ASKPASS path.
+    if (opts?.token) {
+        return cloneWithOverrideToken(repoUrl, targetDir, {
+            ...opts,
+            token: opts.token,
+        });
+    }
+    // Env/GitHub-App auth path (unchanged): credentials come from
+    // getGitAuthConfigFromEnv and are embedded in the URL as before.
     const authConfig = getGitAuthConfigFromEnv();
     let cloneUrl;
-    // Use authenticated URL if credentials are available, otherwise clone unauthenticated (public repos)
     if (authConfig.pat || authConfig.githubApp) {
         const token = await getAuthToken(authConfig);
         cloneUrl = getAuthenticatedUrl(repoUrl, token);

package/dist/core/user-prompts-loader.d.ts

@@ -32,6 +32,15 @@ export interface UserPromptsOverride {
     repoUrl: string;
     branch?: string;
     subPath?: string;
+    /**
+     * Per-request git credential forwarded by the caller (PRD #621 M2/M3, via the
+     * X-Dot-AI-Git-Token header). When present it takes precedence over
+     * DOT_AI_GIT_TOKEN for THIS request only (Decision 4) and triggers per-request
+     * cache isolation so a private authenticated clone is never served to/from the
+     * shared unauthenticated cache slot (Decision 2). Never enters the cache key
+     * or any log/error/source surface.
+     */
+    gitToken?: string;
 }
 /**
  * Cache state for tracking repository freshness.

package/dist/core/user-prompts-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-prompts-loader.d.ts","sourceRoot":"","sources":["../../src/core/user-prompts-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAO1C,OAAO,EAAE,MAAM,EAA8B,MAAM,kBAAkB,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,UAAU,UAAU;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,GAAG,IAAI,CAsB/D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAS3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,mBAAmB,GAC5B,iBAAiB,CAkDnB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAqB1C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUzD;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAoBlD;AA2PD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,OAAe,EAC7B,QAAQ,CAAC,EAAE,mBAAmB,GAC7B,OAAO,CAAC,MAAM,EAAE,CAAC,CA0HnB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,UAAU,GAAG,IAAI,CAE5D"}
+{"version":3,"file":"user-prompts-loader.d.ts","sourceRoot":"","sources":["../../src/core/user-prompts-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAO1C,OAAO,EAAE,MAAM,EAA8B,MAAM,kBAAkB,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,UAAU,UAAU;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,GAAG,IAAI,CAsB/D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAS3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,mBAAmB,GAC5B,iBAAiB,CAqDnB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAqB1C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUzD;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAoBlD;AA6VD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,OAAe,EAC7B,QAAQ,CAAC,EAAE,mBAAmB,GAC7B,OAAO,CAAC,MAAM,EAAE,CAAC,CA0JnB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,UAAU,GAAG,IAAI,CAE5D"}

package/dist/core/user-prompts-loader.js

@@ -58,6 +58,7 @@ exports.getUserPromptsCacheState = getUserPromptsCacheState;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+const crypto = __importStar(require("crypto"));
 const git_utils_1 = require("./git-utils");
 const prompts_1 = require("../tools/prompts");
 // In-memory cache state (persists across requests within same process)
@@ -160,7 +161,10 @@ function getUserPromptsConfigFromOverride(override) {
         repoUrl: override.repoUrl,
         branch,
         subPath: normalizedSubPath,
-        gitToken: process.env.DOT_AI_GIT_TOKEN,
+        // PRD #621 M2 / Decision 4: a request-supplied token (override.gitToken)
+        // takes precedence over the server env credential for this request only;
+        // the env credential remains the fallback when no header is present.
+        gitToken: override.gitToken ?? process.env.DOT_AI_GIT_TOKEN,
         cacheTtlSeconds,
     };
 }
@@ -254,9 +258,36 @@ function isValidGitBranch(branch) {
     return /^[a-zA-Z0-9_.\-/]+$/.test(branch);
 }
 /**
- * Clone the user prompts repository
+ * Create a unique, throwaway ROOT directory for a token-bearing override
+ * request (PRD #621 M3 / Decision 2). It lives alongside the shared cache
+ * directory but is NOT the shared slot, so an authenticated private clone is
+ * never written to (or served from) the unauthenticated cache. The caller
+ * removes it after reading.
+ *
+ * Hardening (LOW-4): created atomically via fs.mkdtempSync with a CSPRNG
+ * (crypto.randomUUID) name component and mode 0700, so the authenticated clone
+ * cannot land in a predictable, world-readable location.
+ */
+function createIsolatedCloneRoot() {
+    const parent = path.dirname(getCacheDirectory());
+    const root = fs.mkdtempSync(path.join(parent, `user-prompts-override-${crypto.randomUUID()}-`));
+    try {
+        fs.chmodSync(root, 0o700);
+    }
+    catch {
+        /* best-effort hardening (mkdtempSync already creates with 0700) */
+    }
+    return root;
+}
+/**
+ * Clone the user prompts repository.
+ *
+ * `overrideToken` (PRD #621 M3) is a per-request credential that, when present,
+ * overrides env auth for this clone only and is scoped to the source host with
+ * no cross-host redirect forwarding (handled in cloneRepo). When omitted, the
+ * clone authenticates via env exactly as before.
  */
-async function cloneRepository(config, localPath, logger) {
+async function cloneRepository(config, localPath, logger, overrideToken) {
     // Validate branch name as defense-in-depth
     if (!isValidGitBranch(config.branch)) {
         throw new Error(`Invalid branch name: ${config.branch}`);
@@ -280,6 +311,9 @@ async function cloneRepository(config, localPath, logger) {
         await (0, git_utils_1.cloneRepo)(config.repoUrl, localPath, {
             branch: config.branch,
             depth: 1,
+            // Per-request override credential (PRD #621 M3). undefined → cloneRepo
+            // falls back to env auth, i.e. today's behavior unchanged.
+            token: overrideToken,
         });
         logger.info('Successfully cloned user prompts repository', {
             url: sanitizedUrl,
@@ -287,14 +321,24 @@ async function cloneRepository(config, localPath, logger) {
         });
     }
     catch (error) {
+        const scrub = (raw) => (0, git_utils_1.scrubCredentials)(config.gitToken ? raw.replaceAll(config.gitToken, '***') : raw);
         const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-        const sanitizedError = (0, git_utils_1.scrubCredentials)(config.gitToken
-            ? errorMessage.replaceAll(config.gitToken, '***')
-            : errorMessage);
+        const sanitizedError = scrub(errorMessage);
         logger.error('Failed to clone user prompts repository', new Error(sanitizedError), {
             url: sanitizedUrl,
             branch: config.branch,
         });
+        // LOW-5: scrub the caught error IN PLACE (message + stack) before attaching
+        // it as `cause`, so a serialized `.cause` cannot leak the token. (With the
+        // GIT_ASKPASS rework the override token is no longer on the git argv/URL, so
+        // it cannot appear here in the first place — this is defense-in-depth, esp.
+        // for the env-credential path which still embeds its token in the URL.)
+        if (error instanceof Error) {
+            error.message = scrub(error.message);
+            if (error.stack) {
+                error.stack = scrub(error.stack);
+            }
+        }
         throw new Error(`Failed to clone user prompts repository: ${sanitizedError}`, { cause: error });
     }
 }
@@ -326,10 +370,56 @@ async function pullRepository(config, localPath, logger) {
     }
 }
 /**
- * Ensure the repository is cloned and up-to-date
- * Returns the path to the prompts directory within the repository
+ * Ensure the repository is cloned and up-to-date.
+ *
+ * Returns the path to the prompts directory within the repository, plus an
+ * optional `isolatedRoot` the caller must remove after reading (set only for
+ * the token-bearing isolation path below).
+ *
+ * PRD #621 M3 / Decision 2 (cache isolation): when `overrideToken` is present
+ * (a request forwarded an X-Dot-AI-Git-Token), the clone is performed into a
+ * unique throwaway directory and the shared `cacheState` is neither read nor
+ * written. This guarantees an authenticated private clone is never served from
+ * — nor written into — the shared unauthenticated cache slot for the same
+ * (repoUrl, branch, subPath) coordinate, and that the token never enters the
+ * cache key. Token-less requests use the shared cache exactly as before.
  */
-async function ensureRepository(config, logger, forceRefresh = false) {
+async function ensureRepository(config, logger, forceRefresh = false, overrideToken) {
+    if (overrideToken) {
+        const isolatedRoot = createIsolatedCloneRoot();
+        // Clone into a subdirectory of the 0700 root so the root's restrictive
+        // permissions cover the authenticated clone (git creates `cloneDir` itself).
+        const cloneDir = path.join(isolatedRoot, 'repo');
+        logger.debug('Token-bearing override: cloning in isolation', {
+            url: sanitizeUrlForLogging(config.repoUrl),
+            branch: config.branch,
+        });
+        try {
+            await cloneRepository(config, cloneDir, logger, overrideToken);
+        }
+        catch (error) {
+            // Remove any partial clone before propagating so a failed authenticated
+            // request leaves no isolated directory behind. With GIT_ASKPASS the token
+            // is never written to disk, so a cleanup failure cannot leave a PAT
+            // behind — but warn (don't swallow) for observability.
+            try {
+                fs.rmSync(isolatedRoot, { recursive: true, force: true });
+            }
+            catch (cleanupError) {
+                logger.warn('Failed to remove isolated clone directory after clone failure', {
+                    path: isolatedRoot,
+                    error: cleanupError instanceof Error
+                        ? cleanupError.message
+                        : String(cleanupError),
+                });
+            }
+            throw error;
+        }
+        const promptsDir = config.subPath
+            ? path.join(cloneDir, config.subPath)
+            : cloneDir;
+        return { promptsDir, isolatedRoot };
+    }
     const localPath = getCacheDirectory();
     const now = Date.now();
     const ttlMs = config.cacheTtlSeconds * 1000;
@@ -375,7 +465,11 @@ async function ensureRepository(config, logger, forceRefresh = false) {
         });
     }
     // Return path to prompts directory (with optional subPath)
-    return config.subPath ? path.join(localPath, config.subPath) : localPath;
+    return {
+        promptsDir: config.subPath
+            ? path.join(localPath, config.subPath)
+            : localPath,
+    };
 }
 const SKILL_FILE_MAX_BYTES = 5 * 1024 * 1024; // 5 MB per file (before base64 encoding)
 const SKILL_FILENAME = 'SKILL.md';
@@ -458,8 +552,16 @@ async function loadUserPrompts(logger, forceRefresh = false, override) {
         logger.debug('User prompts not configured (DOT_AI_USER_PROMPTS_REPO not set)');
         return [];
     }
+    // PRD #621 M3 / Decision 2: a request-forwarded credential (override.gitToken)
+    // triggers per-request cache isolation. Track the throwaway clone directory so
+    // it is removed after the read (success-path cleanup; the failure path is
+    // cleaned up inside ensureRepository).
+    const overrideToken = override?.gitToken;
+    let isolatedRoot;
     try {
-        const promptsDir = await ensureRepository(config, logger, forceRefresh);
+        const ensured = await ensureRepository(config, logger, forceRefresh, overrideToken);
+        const promptsDir = ensured.promptsDir;
+        isolatedRoot = ensured.isolatedRoot;
         if (!fs.existsSync(promptsDir)) {
             logger.warn('User prompts directory not found in repository', {
                 path: promptsDir,
@@ -539,6 +641,25 @@ async function loadUserPrompts(logger, forceRefresh = false, override) {
         logger.error('Failed to load user prompts, falling back to built-in only', new Error(safeMessage));
         return [];
     }
+    finally {
+        // PRD #621 M3 / Decision 2: remove the per-request isolated clone (if any)
+        // so token-bearing override clones leave no on-disk residue. With
+        // GIT_ASKPASS the token is never written to disk, so a failed cleanup
+        // cannot leave a PAT behind — but warn (don't swallow) for observability.
+        if (isolatedRoot) {
+            try {
+                fs.rmSync(isolatedRoot, { recursive: true, force: true });
+            }
+            catch (cleanupError) {
+                logger.warn('Failed to remove isolated clone directory', {
+                    path: isolatedRoot,
+                    error: cleanupError instanceof Error
+                        ? cleanupError.message
+                        : String(cleanupError),
+                });
+            }
+        }
+    }
 }
 /**
  * Clear the cache state (useful for testing)

package/dist/interfaces/cors-headers.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Shared CORS allow-header lists (PRD #621 M2, Decision 1).
+ *
+ * The REST (src/interfaces/rest-api.ts) and front HTTP (src/interfaces/mcp.ts)
+ * layers each answer CORS preflight with their own `Access-Control-Allow-Headers`
+ * value, and the two were historically OUT OF SYNC. Centralizing the credential
+ * header name here guarantees the new `X-Dot-AI-Git-Token` header is advertised
+ * by BOTH preflight responses (Decision 1) and that the two lists can never
+ * silently drift apart on this header again.
+ *
+ * The two lists intentionally differ on the OTHER headers (mcp.ts also allows
+ * X-Session-Id / X-Dot-AI-Authorization), which is preserved.
+ */
+/**
+ * Per-request git credential header (PRD #621 M2/M3, Decision 1). The CLI
+ * forwards its `DOT_AI_GIT_TOKEN` here so the server can authenticate an
+ * overridden (`?repo=`) clone against a second auth realm. Always a request
+ * header — never a query param or body field.
+ */
+export declare const GIT_TOKEN_HEADER = "X-Dot-AI-Git-Token";
+/**
+ * Lowercased form for reading the header off Node's `req.headers` (Node
+ * lowercases all incoming header names).
+ */
+export declare const GIT_TOKEN_HEADER_LC: string;
+/**
+ * `Access-Control-Allow-Headers` value for the REST API layer
+ * (rest-api.ts `setCorsHeaders`).
+ */
+export declare const REST_CORS_ALLOW_HEADERS = "Content-Type, Authorization, X-Dot-AI-Git-Token";
+/**
+ * `Access-Control-Allow-Headers` value for the front HTTP layer (mcp.ts).
+ * Retains X-Session-Id and X-Dot-AI-Authorization from the pre-existing list.
+ *
+ * Includes `Mcp-Session-Id` because the MCP session router in mcp.ts routes
+ * requests by `req.headers['mcp-session-id']` (the Streamable HTTP transport's
+ * session header); without it a browser preflight requesting that header would
+ * fail (CodeRabbit Finding 3). `X-Session-Id` is kept for backward compat.
+ */
+export declare const MCP_CORS_ALLOW_HEADERS = "Content-Type, X-Session-Id, Mcp-Session-Id, Authorization, X-Dot-AI-Authorization, X-Dot-AI-Git-Token";
+//# sourceMappingURL=cors-headers.d.ts.map

package/dist/interfaces/cors-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-headers.d.ts","sourceRoot":"","sources":["../../src/interfaces/cors-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAAiC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,uBAAuB,oDAAqD,CAAC;AAE1F;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,0GAA2G,CAAC"}

package/dist/interfaces/cors-headers.js

@@ -0,0 +1,43 @@
+"use strict";
+/**
+ * Shared CORS allow-header lists (PRD #621 M2, Decision 1).
+ *
+ * The REST (src/interfaces/rest-api.ts) and front HTTP (src/interfaces/mcp.ts)
+ * layers each answer CORS preflight with their own `Access-Control-Allow-Headers`
+ * value, and the two were historically OUT OF SYNC. Centralizing the credential
+ * header name here guarantees the new `X-Dot-AI-Git-Token` header is advertised
+ * by BOTH preflight responses (Decision 1) and that the two lists can never
+ * silently drift apart on this header again.
+ *
+ * The two lists intentionally differ on the OTHER headers (mcp.ts also allows
+ * X-Session-Id / X-Dot-AI-Authorization), which is preserved.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_CORS_ALLOW_HEADERS = exports.REST_CORS_ALLOW_HEADERS = exports.GIT_TOKEN_HEADER_LC = exports.GIT_TOKEN_HEADER = void 0;
+/**
+ * Per-request git credential header (PRD #621 M2/M3, Decision 1). The CLI
+ * forwards its `DOT_AI_GIT_TOKEN` here so the server can authenticate an
+ * overridden (`?repo=`) clone against a second auth realm. Always a request
+ * header — never a query param or body field.
+ */
+exports.GIT_TOKEN_HEADER = 'X-Dot-AI-Git-Token';
+/**
+ * Lowercased form for reading the header off Node's `req.headers` (Node
+ * lowercases all incoming header names).
+ */
+exports.GIT_TOKEN_HEADER_LC = exports.GIT_TOKEN_HEADER.toLowerCase();
+/**
+ * `Access-Control-Allow-Headers` value for the REST API layer
+ * (rest-api.ts `setCorsHeaders`).
+ */
+exports.REST_CORS_ALLOW_HEADERS = `Content-Type, Authorization, ${exports.GIT_TOKEN_HEADER}`;
+/**
+ * `Access-Control-Allow-Headers` value for the front HTTP layer (mcp.ts).
+ * Retains X-Session-Id and X-Dot-AI-Authorization from the pre-existing list.
+ *
+ * Includes `Mcp-Session-Id` because the MCP session router in mcp.ts routes
+ * requests by `req.headers['mcp-session-id']` (the Streamable HTTP transport's
+ * session header); without it a browser preflight requesting that header would
+ * fail (CodeRabbit Finding 3). `X-Session-Id` is kept for backward compat.
+ */
+exports.MCP_CORS_ALLOW_HEADERS = `Content-Type, X-Session-Id, Mcp-Session-Id, Authorization, X-Dot-AI-Authorization, ${exports.GIT_TOKEN_HEADER}`;

package/dist/interfaces/header-redaction.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Redaction of credential-bearing request headers before they are logged.
+ *
+ * The front HTTP layer (mcp.ts) logs incoming requests at debug level. Logging
+ * `req.headers` verbatim would leak credentials — `Authorization`,
+ * `X-Dot-AI-Authorization`, and (PRD #621) the per-request `X-Dot-AI-Git-Token`
+ * — bypassing the loader-level scrubbing. PRD #621 requires the forwarded token
+ * NEVER appear in logs, so these header values are replaced with a fixed
+ * placeholder before logging.
+ *
+ * Kept in its own module so the redaction is unit-testable without importing
+ * the heavy mcp.ts server module.
+ */
+/** Fixed placeholder substituted for a redacted header value. */
+export declare const REDACTED_PLACEHOLDER = "***REDACTED***";
+/**
+ * Lowercased names of headers whose values are credential-bearing and must be
+ * redacted before logging. Node lowercases all incoming header names, so the
+ * comparison is done in lowercase.
+ */
+export declare const SENSITIVE_HEADER_NAMES: ReadonlySet<string>;
+/**
+ * Return a shallow copy of `headers` with the value of every credential-bearing
+ * header replaced by REDACTED_PLACEHOLDER. Non-sensitive headers are preserved
+ * verbatim. The input object is never mutated.
+ */
+export declare function redactSensitiveHeaders(headers: Record<string, unknown> | undefined): Record<string, unknown>;
+//# sourceMappingURL=header-redaction.d.ts.map

package/dist/interfaces/header-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-redaction.d.ts","sourceRoot":"","sources":["../../src/interfaces/header-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,iEAAiE;AACjE,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAMrD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB"}

package/dist/interfaces/header-redaction.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * Redaction of credential-bearing request headers before they are logged.
+ *
+ * The front HTTP layer (mcp.ts) logs incoming requests at debug level. Logging
+ * `req.headers` verbatim would leak credentials — `Authorization`,
+ * `X-Dot-AI-Authorization`, and (PRD #621) the per-request `X-Dot-AI-Git-Token`
+ * — bypassing the loader-level scrubbing. PRD #621 requires the forwarded token
+ * NEVER appear in logs, so these header values are replaced with a fixed
+ * placeholder before logging.
+ *
+ * Kept in its own module so the redaction is unit-testable without importing
+ * the heavy mcp.ts server module.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_HEADER_NAMES = exports.REDACTED_PLACEHOLDER = void 0;
+exports.redactSensitiveHeaders = redactSensitiveHeaders;
+const cors_headers_1 = require("./cors-headers");
+/** Fixed placeholder substituted for a redacted header value. */
+exports.REDACTED_PLACEHOLDER = '***REDACTED***';
+/**
+ * Lowercased names of headers whose values are credential-bearing and must be
+ * redacted before logging. Node lowercases all incoming header names, so the
+ * comparison is done in lowercase.
+ */
+exports.SENSITIVE_HEADER_NAMES = new Set([
+    'authorization',
+    'x-dot-ai-authorization',
+    cors_headers_1.GIT_TOKEN_HEADER_LC,
+    'cookie',
+    'proxy-authorization',
+]);
+/**
+ * Return a shallow copy of `headers` with the value of every credential-bearing
+ * header replaced by REDACTED_PLACEHOLDER. Non-sensitive headers are preserved
+ * verbatim. The input object is never mutated.
+ */
+function redactSensitiveHeaders(headers) {
+    if (!headers)
+        return {};
+    const redacted = {};
+    for (const [name, value] of Object.entries(headers)) {
+        redacted[name] = exports.SENSITIVE_HEADER_NAMES.has(name.toLowerCase())
+            ? exports.REDACTED_PLACEHOLDER
+            : value;
+    }
+    return redacted;
+}

package/dist/interfaces/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/interfaces/mcp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AA8EtC,OAAO,EAAgB,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAcvD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAmBD,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAkC;IACrD,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,cAAc,CAAC,CAAiC;IACxD,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,CAA6B;IAC9C,OAAO,CAAC,aAAa,CAAC,CAAqB;IAC3C,OAAO,CAAC,SAAS,CAAC,CAAM;gBAEZ,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe;IA6BjD;;;OAGG;IACH,gBAAgB,IAAI,aAAa,GAAG,SAAS;IAQ7C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBxB;;OAEG;IACH,OAAO,CAAC,eAAe;IA2CvB;;OAEG;IACH,OAAO,CAAC,WAAW;IA8KnB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAmBzB;;;;OAIG;YACW,mBAAmB;IA6CjC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkCzB,OAAO,CAAC,qBAAqB;IAS7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,iBAAiB;IAInB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAed,kBAAkB;YAwRlB,gBAAgB;IAexB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC3B,OAAO,IAAI,OAAO;CAGnB"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/interfaces/mcp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAgFtC,OAAO,EAAgB,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAcvD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAmBD,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAkC;IACrD,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,cAAc,CAAC,CAAiC;IACxD,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,CAA6B;IAC9C,OAAO,CAAC,aAAa,CAAC,CAAqB;IAC3C,OAAO,CAAC,SAAS,CAAC,CAAM;gBAEZ,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe;IA6BjD;;;OAGG;IACH,gBAAgB,IAAI,aAAa,GAAG,SAAS;IAQ7C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBxB;;OAEG;IACH,OAAO,CAAC,eAAe;IA2CvB;;OAEG;IACH,OAAO,CAAC,WAAW;IA8KnB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAmBzB;;;;OAIG;YACW,mBAAmB;IA6CjC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkCzB,OAAO,CAAC,qBAAqB;IAS7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,iBAAiB;IAInB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAed,kBAAkB;YAgSlB,gBAAgB;IAexB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC3B,OAAO,IAAI,OAAO;CAGnB"}

package/dist/interfaces/mcp.js

@@ -28,6 +28,8 @@ const impact_analysis_1 = require("../tools/impact-analysis");
 const prompts_1 = require("../tools/prompts");
 const rest_registry_1 = require("./rest-registry");
 const rest_api_1 = require("./rest-api");
+const cors_headers_1 = require("./cors-headers");
+const header_redaction_1 = require("./header-redaction");
 const oauth_1 = require("./oauth");
 const request_context_1 = require("./request-context");
 const rbac_1 = require("../core/rbac");
@@ -423,15 +425,23 @@ class MCPServer {
             // Execute entire request within the span's context for proper propagation
             await api_1.context.with(api_1.trace.setSpan(api_1.context.active(), span), async () => {
                 try {
+                    // PRD #621: the forwarded token must never appear in logs. Redact
+                    // credential-bearing headers (HIGH-1) AND scrub credentials from the
+                    // request URL — a ?repo=https://user:token@host or a
+                    // credential-bearing query param would otherwise leak verbatim
+                    // (CodeRabbit Finding 1). sanitizeRequestUrlForLogging is the shared
+                    // helper already used by the REST layer.
                     this.logger.debug('HTTP request received', {
                         method: req.method,
-                        url: req.url,
-                        headers: req.headers,
+                        url: (0, rest_api_1.sanitizeRequestUrlForLogging)(req.url),
+                        headers: (0, header_redaction_1.redactSensitiveHeaders)(req.headers),
                     });
                     // Handle CORS for browser-based clients
                     res.setHeader('Access-Control-Allow-Origin', '*');
                     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-                    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-Session-Id, Authorization, X-Dot-AI-Authorization');
+                    // PRD #621 M2 / Decision 1: includes X-Dot-AI-Git-Token, kept in
+                    // sync with the REST allowlist via cors-headers.ts.
+                    res.setHeader('Access-Control-Allow-Headers', cors_headers_1.MCP_CORS_ALLOW_HEADERS);
                     if (req.method === 'OPTIONS') {
                         res.writeHead(204);
                         res.end();

package/dist/interfaces/rest-api.d.ts

@@ -9,6 +9,7 @@ import { RestToolRegistry, ToolInfo } from './rest-registry';
 import { RestRouteRegistry } from './rest-route-registry';
 import { Logger } from '../core/error-handling';
 import { DotAI } from '../core/index';
+import { UserPromptsOverride } from '../core/user-prompts-loader';
 import { PluginManager } from '../core/plugin-manager';
 /**
  * Constant placeholder used when the request URL fails to parse and the
@@ -31,6 +32,47 @@ export declare const UNPARSEABLE_QUERY_PLACEHOLDER = "?<redacted-unparseable>";
  * '?' are pass-through (no risk).
  */
 export declare function sanitizeRequestUrlForLogging(url: string | undefined): string | undefined;
+/**
+ * Extract and validate the per-request prompts override.
+ *
+ * Threads three optional, additive inputs from the request into a
+ * UserPromptsOverride (PRD #581 introduced `repo`; PRD #621 M1 adds `path`
+ * and `branch`):
+ *   - repoParam   → override.repoUrl   (GET ?repo=  / POST body `repo`)
+ *   - pathParam   → override.subPath   (GET ?path=  / POST body `path`)
+ *   - branchParam → override.branch    (GET ?branch= / POST body `branch`)
+ *   - gitToken    → override.gitToken  (X-Dot-AI-Git-Token request header; M2)
+ *
+ * Returns:
+ *   - { ok: true, override }  when no `repo` is supplied (override undefined;
+ *     any path/branch/token are ignored, since they only qualify an override —
+ *     this keeps the no-`repo` / env-var-configured path unchanged).
+ *   - { ok: true, override }  when a syntactically valid override is supplied.
+ *   - { ok: false, message }  when the override fails validation (HTTP 400).
+ *
+ * The validation message is run through scrubCredentials so embedded tokens
+ * never reach the wire response.
+ *
+ * Backward compatibility (PRD #621, non-negotiable): when path/branch are
+ * absent or empty, the override carries `repoUrl` only — byte-identical to
+ * the PRD #581 behavior (same clone target: repo root, `main`). subPath and
+ * branch are populated ONLY for a non-empty value, so downstream defaults are
+ * untouched. The credential header is INERT unless a `?repo=` override is
+ * present: without a repo this returns `override: undefined` before the token
+ * is ever read, so the env-var path is unaffected by a forwarded header.
+ *
+ * Validation is delegated to getUserPromptsConfigFromOverride (scheme,
+ * sanitizeRelativePath for subPath, isValidGitBranch for branch) and happens
+ * BEFORE any clone or shared-cache mutation, so a rejected override can never
+ * corrupt the env-var-configured cache.
+ */
+export declare function extractPromptsOverride(repoParam: unknown, pathParam?: unknown, branchParam?: unknown, gitToken?: string): {
+    ok: true;
+    override?: UserPromptsOverride;
+} | {
+    ok: false;
+    message: string;
+};
 /**
  * HTTP status codes for REST responses
  */
@@ -233,18 +275,6 @@ export declare class RestApiRouter {
      * Returns container logs for a pod
      */
     private handleGetLogs;
-    /**
-     * Extract and validate the per-request `repo` override (PRD #581).
-     *
-     * Returns:
-     *   - { ok: true, override }    when no repo param is supplied, override is undefined.
-     *   - { ok: true, override }    when a syntactically valid override URL is supplied.
-     *   - { ok: false, message }    when the override fails validation (HTTP 400).
-     *
-     * The validation message is run through scrubCredentials so embedded tokens
-     * never reach the wire response.
-     */
-    private extractPromptsOverride;
     /**
      * Handle prompts list requests
      */

package/dist/interfaces/rest-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api.d.ts","sourceRoot":"","sources":["../../src/interfaces/rest-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAgDtC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAevD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,GAAG,SAAS,CAoBpB;AAED;;GAEG;AACH,oBAAY,UAAU;IACpB,EAAE,MAAM;IACR,WAAW,MAAM;IACjB,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,MAAM,GACN,OAAO,GACP,MAAM,GACN,WAAW,CAAC;AAEhB;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EACH,MAAM,GACN;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAClC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;KAAE,GACvC,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,GACF,wBAAwB,GACxB,4BAA4B,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,aAAa,CAAC,CAAgB;gBAGpC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,EAC7B,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAkCrC;;;;OAIG;IACG,aAAa,CACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC;IAsGhB;;;OAGG;YACW,aAAa;IA0G3B;;OAEG;YACW,mBAAmB;IAuEjC;;OAEG;YACW,mBAAmB;IAuJjC;;OAEG;YACW,iBAAiB;IAqC/B;;OAEG;YACW,yBAAyB;IA2EvC;;;;OAIG;YACW,sBAAsB;IAyDpC;;;OAGG;YACW,qBAAqB;IAmKnC;;;;OAIG;YACW,mBAAmB;IAoLjC;;;OAGG;YACW,mBAAmB;IAmDjC;;;OAGG;YACW,iBAAiB;IAuL/B;;;OAGG;YACW,eAAe;IA0J7B;;;OAGG;YACW,aAAa;IAuK3B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;OAEG;YACW,wBAAwB;IAiEtC;;OAEG;YACW,uBAAuB;IAmFrC;;OAEG;YACW,yBAAyB;IAyEvC;;;;OAIG;YACW,eAAe;IAwW7B;;;;OAIG;YACW,kBAAkB;IAkHhC;;;OAGG;YACW,oBAAoB;IA+ClC;;;;OAIG;YACW,sBAAsB;IAuEpC;;;;OAIG;YACW,2BAA2B;IAyQzC;;;;OAIG;YACW,kBAAkB;IA6PhC;;OAEG;YACW,+BAA+B;IA8D7C;;OAEG;YACW,gBAAgB;IAwG9B;;OAEG;YACW,eAAe;IAkD7B;;OAEG;YACW,gBAAgB;IA6E9B;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;YACW,gBAAgB;IAS9B;;OAEG;YACW,iBAAiB;IAyB/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC;;OAEG;IACH,SAAS,IAAI,aAAa;IAI1B;;;OAGG;IACH,gBAAgB,IAAI,iBAAiB;CAGtC"}
+{"version":3,"file":"rest-api.d.ts","sourceRoot":"","sources":["../../src/interfaces/rest-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAQtC,OAAO,EAIL,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AAuCrC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAevD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,GAAG,SAAS,CAoBpB;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,OAAO,EAClB,SAAS,CAAC,EAAE,OAAO,EACnB,WAAW,CAAC,EAAE,OAAO,EACrB,QAAQ,CAAC,EAAE,MAAM,GAEf;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;CACjB,CA0DJ;AAED;;GAEG;AACH,oBAAY,UAAU;IACpB,EAAE,MAAM;IACR,WAAW,MAAM;IACjB,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,MAAM,GACN,OAAO,GACP,MAAM,GACN,WAAW,CAAC;AAEhB;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EACH,MAAM,GACN;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAClC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;KAAE,GACvC,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,GACF,wBAAwB,GACxB,4BAA4B,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,aAAa,CAAC,CAAgB;gBAGpC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,EAC7B,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAkCrC;;;;OAIG;IACG,aAAa,CACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC;IAsGhB;;;OAGG;YACW,aAAa;IA0G3B;;OAEG;YACW,mBAAmB;IAuEjC;;OAEG;YACW,mBAAmB;IAuJjC;;OAEG;YACW,iBAAiB;IAqC/B;;OAEG;YACW,yBAAyB;IA2EvC;;;;OAIG;YACW,sBAAsB;IAyDpC;;;OAGG;YACW,qBAAqB;IAmKnC;;;;OAIG;YACW,mBAAmB;IAoLjC;;;OAGG;YACW,mBAAmB;IAmDjC;;;OAGG;YACW,iBAAiB;IAuL/B;;;OAGG;YACW,eAAe;IA0J7B;;;OAGG;YACW,aAAa;IAuK3B;;OAEG;YACW,wBAAwB;IAwEtC;;OAEG;YACW,uBAAuB;IA0FrC;;OAEG;YACW,yBAAyB;IAoFvC;;;;OAIG;YACW,eAAe;IAwW7B;;;;OAIG;YACW,kBAAkB;IAkHhC;;;OAGG;YACW,oBAAoB;IAiDlC;;;;OAIG;YACW,sBAAsB;IAuEpC;;;;OAIG;YACW,2BAA2B;IAyQzC;;;;OAIG;YACW,kBAAkB;IA6PhC;;OAEG;YACW,+BAA+B;IA8D7C;;OAEG;YACW,gBAAgB;IAwG9B;;OAEG;YACW,eAAe;IAkD7B;;OAEG;YACW,gBAAgB;IA6E9B;;OAEG;IACH,OAAO,CAAC,cAAc;IAStB;;OAEG;YACW,gBAAgB;IAS9B;;OAEG;YACW,iBAAiB;IAyB/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC;;OAEG;IACH,SAAS,IAAI,aAAa;IAI1B;;;OAGG;IACH,gBAAgB,IAAI,iBAAiB;CAGtC"}

package/dist/interfaces/rest-api.js

@@ -41,6 +41,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RestApiRouter = exports.HttpStatus = exports.UNPARSEABLE_QUERY_PLACEHOLDER = void 0;
 exports.sanitizeRequestUrlForLogging = sanitizeRequestUrlForLogging;
+exports.extractPromptsOverride = extractPromptsOverride;
 const node_url_1 = require("node:url");
 const openapi_generator_1 = require("./openapi-generator");
 const rest_route_registry_1 = require("./rest-route-registry");
@@ -50,6 +51,7 @@ const embedding_migration_handler_1 = require("./embedding-migration-handler");
 const prompts_1 = require("../tools/prompts");
 const user_prompts_loader_1 = require("../core/user-prompts-loader");
 const git_utils_1 = require("../core/git-utils");
+const cors_headers_1 = require("./cors-headers");
 const generic_session_manager_1 = require("../core/generic-session-manager");
 const session_events_1 = require("../core/session-events");
 const shared_prompt_loader_1 = require("../core/shared-prompt-loader");
@@ -108,6 +110,135 @@ function sanitizeRequestUrlForLogging(url) {
         return url.slice(0, qIdx) + exports.UNPARSEABLE_QUERY_PLACEHOLDER;
     }
 }
+/**
+ * Coerce an optional override string param (path/branch) supplied via query
+ * string or JSON body. Mirrors the `repo` guard in extractPromptsOverride:
+ *   - non-string (array, number, object, boolean) → 400 (avoids a 500 from a
+ *     malformed body reaching downstream code).
+ *   - absent (null/undefined) or empty/whitespace-only → `undefined`, i.e.
+ *     treated as not supplied so the downstream default (subPath '' / branch
+ *     'main') is preserved and an empty-string branch never reaches
+ *     isValidGitBranch (which would otherwise reject it).
+ *   - otherwise → the trimmed value.
+ */
+function coerceOverrideStringParam(value, name) {
+    if (value === undefined || value === null) {
+        return { ok: true, value: undefined };
+    }
+    if (typeof value !== 'string') {
+        return {
+            ok: false,
+            message: `${name} must be a string (got ${Array.isArray(value) ? 'array' : typeof value})`,
+        };
+    }
+    const trimmed = value.trim();
+    return { ok: true, value: trimmed.length > 0 ? trimmed : undefined };
+}
+/**
+ * Read the per-request git credential from the X-Dot-AI-Git-Token header
+ * (PRD #621 M2). Node lowercases incoming header names and may present a
+ * repeated header as an array; normalize to a single non-empty string or
+ * undefined. The value is a secret, so it is never logged here.
+ */
+function readGitTokenHeader(req) {
+    const raw = req.headers[cors_headers_1.GIT_TOKEN_HEADER_LC];
+    const value = Array.isArray(raw) ? raw[0] : raw;
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/**
+ * Extract and validate the per-request prompts override.
+ *
+ * Threads three optional, additive inputs from the request into a
+ * UserPromptsOverride (PRD #581 introduced `repo`; PRD #621 M1 adds `path`
+ * and `branch`):
+ *   - repoParam   → override.repoUrl   (GET ?repo=  / POST body `repo`)
+ *   - pathParam   → override.subPath   (GET ?path=  / POST body `path`)
+ *   - branchParam → override.branch    (GET ?branch= / POST body `branch`)
+ *   - gitToken    → override.gitToken  (X-Dot-AI-Git-Token request header; M2)
+ *
+ * Returns:
+ *   - { ok: true, override }  when no `repo` is supplied (override undefined;
+ *     any path/branch/token are ignored, since they only qualify an override —
+ *     this keeps the no-`repo` / env-var-configured path unchanged).
+ *   - { ok: true, override }  when a syntactically valid override is supplied.
+ *   - { ok: false, message }  when the override fails validation (HTTP 400).
+ *
+ * The validation message is run through scrubCredentials so embedded tokens
+ * never reach the wire response.
+ *
+ * Backward compatibility (PRD #621, non-negotiable): when path/branch are
+ * absent or empty, the override carries `repoUrl` only — byte-identical to
+ * the PRD #581 behavior (same clone target: repo root, `main`). subPath and
+ * branch are populated ONLY for a non-empty value, so downstream defaults are
+ * untouched. The credential header is INERT unless a `?repo=` override is
+ * present: without a repo this returns `override: undefined` before the token
+ * is ever read, so the env-var path is unaffected by a forwarded header.
+ *
+ * Validation is delegated to getUserPromptsConfigFromOverride (scheme,
+ * sanitizeRelativePath for subPath, isValidGitBranch for branch) and happens
+ * BEFORE any clone or shared-cache mutation, so a rejected override can never
+ * corrupt the env-var-configured cache.
+ */
+function extractPromptsOverride(repoParam, pathParam, branchParam, gitToken) {
+    // Treat absent (null/undefined) repo as no override. path/branch/token only
+    // qualify an override, so without a repo they are ignored (the credential
+    // header is inert on the env-var path).
+    if (repoParam === undefined || repoParam === null) {
+        return { ok: true, override: undefined };
+    }
+    // The wire contract says `repo` is a string. Anything else (array,
+    // number, object, boolean) is a 400 — otherwise downstream code
+    // would crash to a 500.
+    if (typeof repoParam !== 'string') {
+        return {
+            ok: false,
+            message: `repo must be a string (got ${Array.isArray(repoParam) ? 'array' : typeof repoParam})`,
+        };
+    }
+    const trimmed = repoParam.trim();
+    if (!trimmed) {
+        return { ok: true, override: undefined };
+    }
+    const candidate = { repoUrl: trimmed };
+    // PRD #621 M1: thread ?path= / body `path` into subPath (validated
+    // downstream by sanitizeRelativePath).
+    const pathResult = coerceOverrideStringParam(pathParam, 'path');
+    if (!pathResult.ok) {
+        return pathResult;
+    }
+    if (pathResult.value !== undefined) {
+        candidate.subPath = pathResult.value;
+    }
+    // PRD #621 M1: thread ?branch= / body `branch` into branch (validated
+    // downstream by isValidGitBranch).
+    const branchResult = coerceOverrideStringParam(branchParam, 'branch');
+    if (!branchResult.ok) {
+        return branchResult;
+    }
+    if (branchResult.value !== undefined) {
+        candidate.branch = branchResult.value;
+    }
+    // PRD #621 M2: the X-Dot-AI-Git-Token header (read by the handler and passed
+    // in already-normalized to a non-empty string or undefined) authenticates
+    // THIS override clone. It travels only as a header — never query/body — and
+    // is never echoed (computePromptsSource uses repoUrl only).
+    if (gitToken) {
+        candidate.gitToken = gitToken;
+    }
+    try {
+        // Throws on invalid scheme / subPath / branch.
+        (0, user_prompts_loader_1.getUserPromptsConfigFromOverride)(candidate);
+        return { ok: true, override: candidate };
+    }
+    catch (error) {
+        const raw = error instanceof Error ? error.message : 'Invalid override';
+        return { ok: false, message: (0, git_utils_1.scrubCredentials)(raw) };
+    }
+}
 /**
  * HTTP status codes for REST responses
  */
@@ -1086,53 +1217,17 @@ class RestApiRouter {
             await this.sendErrorResponse(res, requestId, HttpStatus.INTERNAL_SERVER_ERROR, 'LOGS_ERROR', 'Failed to retrieve logs', { error: errorMessage });
         }
     }
-    /**
-     * Extract and validate the per-request `repo` override (PRD #581).
-     *
-     * Returns:
-     *   - { ok: true, override }    when no repo param is supplied, override is undefined.
-     *   - { ok: true, override }    when a syntactically valid override URL is supplied.
-     *   - { ok: false, message }    when the override fails validation (HTTP 400).
-     *
-     * The validation message is run through scrubCredentials so embedded tokens
-     * never reach the wire response.
-     */
-    extractPromptsOverride(repoParam) {
-        // Treat absent (null/undefined) as no override.
-        if (repoParam === undefined || repoParam === null) {
-            return { ok: true, override: undefined };
-        }
-        // The wire contract says `repo` is a string. Anything else (array,
-        // number, object, boolean) is a 400 — otherwise downstream code
-        // would crash to a 500.
-        if (typeof repoParam !== 'string') {
-            return {
-                ok: false,
-                message: `repo must be a string (got ${Array.isArray(repoParam) ? 'array' : typeof repoParam})`,
-            };
-        }
-        const trimmed = repoParam.trim();
-        if (!trimmed) {
-            return { ok: true, override: undefined };
-        }
-        const candidate = { repoUrl: trimmed };
-        try {
-            // Throws on invalid scheme / subPath / branch.
-            (0, user_prompts_loader_1.getUserPromptsConfigFromOverride)(candidate);
-            return { ok: true, override: candidate };
-        }
-        catch (error) {
-            const raw = error instanceof Error ? error.message : 'Invalid override';
-            return { ok: false, message: (0, git_utils_1.scrubCredentials)(raw) };
-        }
-    }
     /**
      * Handle prompts list requests
      */
     async handlePromptsListRequest(req, res, requestId, searchParams) {
         try {
             this.logger.info('Processing prompts list request', { requestId });
-            const overrideResult = this.extractPromptsOverride(searchParams.get('repo'));
+            // PRD #581: ?repo= override. PRD #621 M1: ?path= / ?branch= thread into
+            // candidate.subPath / candidate.branch (absent → unchanged behavior).
+            // PRD #621 M2: X-Dot-AI-Git-Token header authenticates the override clone
+            // (inert when no ?repo= override is present).
+            const overrideResult = extractPromptsOverride(searchParams.get('repo'), searchParams.get('path'), searchParams.get('branch'), readGitTokenHeader(req));
             if (!overrideResult.ok) {
                 await this.sendErrorResponse(res, requestId, HttpStatus.BAD_REQUEST, 'VALIDATION_ERROR', overrideResult.message);
                 return;
@@ -1169,7 +1264,11 @@ class RestApiRouter {
                 requestId,
                 promptName,
             });
-            const overrideResult = this.extractPromptsOverride(searchParams.get('repo'));
+            // PRD #581: ?repo= override. PRD #621 M1: ?path= / ?branch= thread into
+            // candidate.subPath / candidate.branch (absent → unchanged behavior).
+            // PRD #621 M2: X-Dot-AI-Git-Token header authenticates the override clone
+            // (inert when no ?repo= override is present).
+            const overrideResult = extractPromptsOverride(searchParams.get('repo'), searchParams.get('path'), searchParams.get('branch'), readGitTokenHeader(req));
             if (!overrideResult.ok) {
                 await this.sendErrorResponse(res, requestId, HttpStatus.BAD_REQUEST, 'VALIDATION_ERROR', overrideResult.message);
                 return;
@@ -1214,9 +1313,13 @@ class RestApiRouter {
                 requestId,
             });
             // body.repo type is checked inside extractPromptsOverride (it accepts
-            // unknown and rejects non-string values with 400 — see F2).
+            // unknown and rejects non-string values with 400 — see F2). PRD #621 M1:
+            // body `path` / `branch` thread into candidate.subPath / candidate.branch
+            // (absent → unchanged behavior); both are likewise type-checked.
             const bodyObj = body;
-            const overrideResult = this.extractPromptsOverride(bodyObj?.repo);
+            // PRD #621 M2: the credential always travels as the X-Dot-AI-Git-Token
+            // header — never the body — and is inert without a repo override.
+            const overrideResult = extractPromptsOverride(bodyObj?.repo, bodyObj?.path, bodyObj?.branch, readGitTokenHeader(req));
             if (!overrideResult.ok) {
                 await this.sendErrorResponse(res, requestId, HttpStatus.BAD_REQUEST, 'VALIDATION_ERROR', overrideResult.message);
                 return;
@@ -1599,7 +1702,9 @@ class RestApiRouter {
         };
         if (this.config.enableCors) {
             headers['Access-Control-Allow-Origin'] = '*';
-            headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization';
+            // R-2: use the shared allowlist (single source of truth in cors-headers.ts)
+            // so the SSE preflight includes X-Dot-AI-Git-Token like every other route.
+            headers['Access-Control-Allow-Headers'] = cors_headers_1.REST_CORS_ALLOW_HEADERS;
         }
         res.writeHead(HttpStatus.OK, headers);
         this.logger.info('SSE connection established', { requestId });
@@ -2187,7 +2292,9 @@ class RestApiRouter {
     setCorsHeaders(res) {
         res.setHeader('Access-Control-Allow-Origin', '*');
         res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+        // PRD #621 M2 / Decision 1: advertise the X-Dot-AI-Git-Token credential
+        // header (shared with the mcp.ts allowlist via cors-headers.ts).
+        res.setHeader('Access-Control-Allow-Headers', cors_headers_1.REST_CORS_ALLOW_HEADERS);
         res.setHeader('Access-Control-Max-Age', '86400');
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vfarcic/dot-ai",
-  "version": "1.21.1",
+  "version": "1.22.0",
   "description": "AI-powered development productivity platform that enhances software development workflows through intelligent automation and AI-driven assistance",
   "mcpName": "io.github.vfarcic/dot-ai",
   "main": "dist/index.js",