@vfarcic/dot-ai 1.21.1 → 1.23.0

package/dist/interfaces/cors-headers.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Shared CORS allow-header lists (PRD #621 M2, Decision 1).
+ *
+ * The REST (src/interfaces/rest-api.ts) and front HTTP (src/interfaces/mcp.ts)
+ * layers each answer CORS preflight with their own `Access-Control-Allow-Headers`
+ * value, and the two were historically OUT OF SYNC. Centralizing the credential
+ * header name here guarantees the new `X-Dot-AI-Git-Token` header is advertised
+ * by BOTH preflight responses (Decision 1) and that the two lists can never
+ * silently drift apart on this header again.
+ *
+ * The two lists intentionally differ on the OTHER headers (mcp.ts also allows
+ * X-Session-Id / X-Dot-AI-Authorization), which is preserved.
+ */
+/**
+ * Per-request git credential header (PRD #621 M2/M3, Decision 1). The CLI
+ * forwards its `DOT_AI_GIT_TOKEN` here so the server can authenticate an
+ * overridden (`?repo=`) clone against a second auth realm. Always a request
+ * header — never a query param or body field.
+ */
+export declare const GIT_TOKEN_HEADER = "X-Dot-AI-Git-Token";
+/**
+ * Lowercased form for reading the header off Node's `req.headers` (Node
+ * lowercases all incoming header names).
+ */
+export declare const GIT_TOKEN_HEADER_LC: string;
+/**
+ * `Access-Control-Allow-Headers` value for the REST API layer
+ * (rest-api.ts `setCorsHeaders`).
+ */
+export declare const REST_CORS_ALLOW_HEADERS = "Content-Type, Authorization, X-Dot-AI-Git-Token";
+/**
+ * `Access-Control-Allow-Headers` value for the front HTTP layer (mcp.ts).
+ * Retains X-Session-Id and X-Dot-AI-Authorization from the pre-existing list.
+ *
+ * Includes `Mcp-Session-Id` because the MCP session router in mcp.ts routes
+ * requests by `req.headers['mcp-session-id']` (the Streamable HTTP transport's
+ * session header); without it a browser preflight requesting that header would
+ * fail (CodeRabbit Finding 3). `X-Session-Id` is kept for backward compat.
+ */
+export declare const MCP_CORS_ALLOW_HEADERS = "Content-Type, X-Session-Id, Mcp-Session-Id, Authorization, X-Dot-AI-Authorization, X-Dot-AI-Git-Token";
+//# sourceMappingURL=cors-headers.d.ts.map

package/dist/interfaces/cors-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-headers.d.ts","sourceRoot":"","sources":["../../src/interfaces/cors-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAAiC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,uBAAuB,oDAAqD,CAAC;AAE1F;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,0GAA2G,CAAC"}

package/dist/interfaces/cors-headers.js

@@ -0,0 +1,43 @@
+"use strict";
+/**
+ * Shared CORS allow-header lists (PRD #621 M2, Decision 1).
+ *
+ * The REST (src/interfaces/rest-api.ts) and front HTTP (src/interfaces/mcp.ts)
+ * layers each answer CORS preflight with their own `Access-Control-Allow-Headers`
+ * value, and the two were historically OUT OF SYNC. Centralizing the credential
+ * header name here guarantees the new `X-Dot-AI-Git-Token` header is advertised
+ * by BOTH preflight responses (Decision 1) and that the two lists can never
+ * silently drift apart on this header again.
+ *
+ * The two lists intentionally differ on the OTHER headers (mcp.ts also allows
+ * X-Session-Id / X-Dot-AI-Authorization), which is preserved.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_CORS_ALLOW_HEADERS = exports.REST_CORS_ALLOW_HEADERS = exports.GIT_TOKEN_HEADER_LC = exports.GIT_TOKEN_HEADER = void 0;
+/**
+ * Per-request git credential header (PRD #621 M2/M3, Decision 1). The CLI
+ * forwards its `DOT_AI_GIT_TOKEN` here so the server can authenticate an
+ * overridden (`?repo=`) clone against a second auth realm. Always a request
+ * header — never a query param or body field.
+ */
+exports.GIT_TOKEN_HEADER = 'X-Dot-AI-Git-Token';
+/**
+ * Lowercased form for reading the header off Node's `req.headers` (Node
+ * lowercases all incoming header names).
+ */
+exports.GIT_TOKEN_HEADER_LC = exports.GIT_TOKEN_HEADER.toLowerCase();
+/**
+ * `Access-Control-Allow-Headers` value for the REST API layer
+ * (rest-api.ts `setCorsHeaders`).
+ */
+exports.REST_CORS_ALLOW_HEADERS = `Content-Type, Authorization, ${exports.GIT_TOKEN_HEADER}`;
+/**
+ * `Access-Control-Allow-Headers` value for the front HTTP layer (mcp.ts).
+ * Retains X-Session-Id and X-Dot-AI-Authorization from the pre-existing list.
+ *
+ * Includes `Mcp-Session-Id` because the MCP session router in mcp.ts routes
+ * requests by `req.headers['mcp-session-id']` (the Streamable HTTP transport's
+ * session header); without it a browser preflight requesting that header would
+ * fail (CodeRabbit Finding 3). `X-Session-Id` is kept for backward compat.
+ */
+exports.MCP_CORS_ALLOW_HEADERS = `Content-Type, X-Session-Id, Mcp-Session-Id, Authorization, X-Dot-AI-Authorization, ${exports.GIT_TOKEN_HEADER}`;

package/dist/interfaces/header-redaction.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Redaction of credential-bearing request headers before they are logged.
+ *
+ * The front HTTP layer (mcp.ts) logs incoming requests at debug level. Logging
+ * `req.headers` verbatim would leak credentials — `Authorization`,
+ * `X-Dot-AI-Authorization`, and (PRD #621) the per-request `X-Dot-AI-Git-Token`
+ * — bypassing the loader-level scrubbing. PRD #621 requires the forwarded token
+ * NEVER appear in logs, so these header values are replaced with a fixed
+ * placeholder before logging.
+ *
+ * Kept in its own module so the redaction is unit-testable without importing
+ * the heavy mcp.ts server module.
+ */
+/** Fixed placeholder substituted for a redacted header value. */
+export declare const REDACTED_PLACEHOLDER = "***REDACTED***";
+/**
+ * Lowercased names of headers whose values are credential-bearing and must be
+ * redacted before logging. Node lowercases all incoming header names, so the
+ * comparison is done in lowercase.
+ */
+export declare const SENSITIVE_HEADER_NAMES: ReadonlySet<string>;
+/**
+ * Return a shallow copy of `headers` with the value of every credential-bearing
+ * header replaced by REDACTED_PLACEHOLDER. Non-sensitive headers are preserved
+ * verbatim. The input object is never mutated.
+ */
+export declare function redactSensitiveHeaders(headers: Record<string, unknown> | undefined): Record<string, unknown>;
+//# sourceMappingURL=header-redaction.d.ts.map

package/dist/interfaces/header-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-redaction.d.ts","sourceRoot":"","sources":["../../src/interfaces/header-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,iEAAiE;AACjE,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAMrD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB"}

package/dist/interfaces/header-redaction.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * Redaction of credential-bearing request headers before they are logged.
+ *
+ * The front HTTP layer (mcp.ts) logs incoming requests at debug level. Logging
+ * `req.headers` verbatim would leak credentials — `Authorization`,
+ * `X-Dot-AI-Authorization`, and (PRD #621) the per-request `X-Dot-AI-Git-Token`
+ * — bypassing the loader-level scrubbing. PRD #621 requires the forwarded token
+ * NEVER appear in logs, so these header values are replaced with a fixed
+ * placeholder before logging.
+ *
+ * Kept in its own module so the redaction is unit-testable without importing
+ * the heavy mcp.ts server module.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_HEADER_NAMES = exports.REDACTED_PLACEHOLDER = void 0;
+exports.redactSensitiveHeaders = redactSensitiveHeaders;
+const cors_headers_1 = require("./cors-headers");
+/** Fixed placeholder substituted for a redacted header value. */
+exports.REDACTED_PLACEHOLDER = '***REDACTED***';
+/**
+ * Lowercased names of headers whose values are credential-bearing and must be
+ * redacted before logging. Node lowercases all incoming header names, so the
+ * comparison is done in lowercase.
+ */
+exports.SENSITIVE_HEADER_NAMES = new Set([
+    'authorization',
+    'x-dot-ai-authorization',
+    cors_headers_1.GIT_TOKEN_HEADER_LC,
+    'cookie',
+    'proxy-authorization',
+]);
+/**
+ * Return a shallow copy of `headers` with the value of every credential-bearing
+ * header replaced by REDACTED_PLACEHOLDER. Non-sensitive headers are preserved
+ * verbatim. The input object is never mutated.
+ */
+function redactSensitiveHeaders(headers) {
+    if (!headers)
+        return {};
+    const redacted = {};
+    for (const [name, value] of Object.entries(headers)) {
+        redacted[name] = exports.SENSITIVE_HEADER_NAMES.has(name.toLowerCase())
+            ? exports.REDACTED_PLACEHOLDER
+            : value;
+    }
+    return redacted;
+}

package/dist/interfaces/mcp.d.ts

@@ -73,7 +73,29 @@ export declare class MCPServer {
     private generateRequestId;
     start(): Promise<void>;
     private startHttpTransport;
+    /**
+     * Buffer and JSON-parse the request body.
+     *
+     * PRD #647 F1: when `maxBytes` is supplied (the untrusted ingest route), the
+     * body is rejected with RequestBodyTooLargeError as soon as the declared
+     * Content-Length OR the accumulated bytes exceed the ceiling — so an
+     * authenticated multi-GB POST can't buffer unbounded and OOM the shared
+     * process. When `maxBytes` is omitted (every other endpoint), behavior is
+     * exactly as before: no cap.
+     */
     private parseRequestBody;
+    /**
+     * PRD #647 F1: true only for the prompts source ingest endpoint, the one
+     * untrusted route the raw-body cap is scoped to. Parses the pathname so a
+     * query string can't bypass (or wrongly trip) the cap.
+     *
+     * PRD #647 C2 (CodeRabbit): the cap check runs BEFORE route dispatch, so a
+     * non-canonical pathname must be normalized here or it slips past the cap and
+     * buffers an uncapped body (DoS). A strict `===` let `POST /api/v1/prompts/
+     * sources/` (trailing slash) — the same ingest surface — skip `maxBytes`.
+     * Collapse trailing slashes (keeping a bare "/" intact) before comparing.
+     */
+    private isPromptsIngestRequest;
     stop(): Promise<void>;
     isReady(): boolean;
 }

package/dist/interfaces/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/interfaces/mcp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AA8EtC,OAAO,EAAgB,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAcvD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAmBD,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAkC;IACrD,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,cAAc,CAAC,CAAiC;IACxD,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,CAA6B;IAC9C,OAAO,CAAC,aAAa,CAAC,CAAqB;IAC3C,OAAO,CAAC,SAAS,CAAC,CAAM;gBAEZ,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe;IA6BjD;;;OAGG;IACH,gBAAgB,IAAI,aAAa,GAAG,SAAS;IAQ7C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBxB;;OAEG;IACH,OAAO,CAAC,eAAe;IA2CvB;;OAEG;IACH,OAAO,CAAC,WAAW;IA8KnB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAmBzB;;;;OAIG;YACW,mBAAmB;IA6CjC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkCzB,OAAO,CAAC,qBAAqB;IAS7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,iBAAiB;IAInB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAed,kBAAkB;YAwRlB,gBAAgB;IAexB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC3B,OAAO,IAAI,OAAO;CAGnB"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/interfaces/mcp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAgFtC,OAAO,EAAgB,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAcvD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAqDD,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAkC;IACrD,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,cAAc,CAAC,CAAiC;IACxD,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,CAA6B;IAC9C,OAAO,CAAC,aAAa,CAAC,CAAqB;IAC3C,OAAO,CAAC,SAAS,CAAC,CAAM;gBAEZ,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe;IA6BjD;;;OAGG;IACH,gBAAgB,IAAI,aAAa,GAAG,SAAS;IAQ7C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBxB;;OAEG;IACH,OAAO,CAAC,eAAe;IA2CvB;;OAEG;IACH,OAAO,CAAC,WAAW;IA8KnB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAmBzB;;;;OAIG;YACW,mBAAmB;IA6CjC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkCzB,OAAO,CAAC,qBAAqB;IAS7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,iBAAiB;IAInB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAed,kBAAkB;IA0ThC;;;;;;;;;OASG;YACW,gBAAgB;IAgD9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAWxB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC3B,OAAO,IAAI,OAAO;CAGnB"}

package/dist/interfaces/mcp.js

@@ -28,6 +28,8 @@ const impact_analysis_1 = require("../tools/impact-analysis");
 const prompts_1 = require("../tools/prompts");
 const rest_registry_1 = require("./rest-registry");
 const rest_api_1 = require("./rest-api");
+const cors_headers_1 = require("./cors-headers");
+const header_redaction_1 = require("./header-redaction");
 const oauth_1 = require("./oauth");
 const request_context_1 = require("./request-context");
 const rbac_1 = require("../core/rbac");
@@ -42,6 +44,37 @@ const plugin_registry_1 = require("../core/plugin-registry");
 const SESSION_TTL_MS = 60 * 60 * 1000;
 /** How often to check for expired sessions. */
 const SESSION_GC_INTERVAL_MS = 5 * 60 * 1000;
+/**
+ * PRD #647 F1 — hard raw-body byte ceiling for the untrusted prompts source
+ * ingest endpoint (POST /api/v1/prompts/sources).
+ *
+ * parseRequestBody buffers the whole body before JSON.parse + per-file
+ * base64-decode, all of which allocate fully BEFORE the 256 KiB *decoded* cap
+ * in ingestPromptsSource — so without a raw ceiling a multi-GB authenticated
+ * POST OOMs the shared process. 512 KiB is:
+ *   - comfortably ABOVE the largest valid manifest: 256 KiB decoded ≈ ~342 KiB
+ *     base64 + JSON/path/mode overhead (~350 KiB raw), and
+ *   - testably BELOW the ~1 MiB nginx-ingress limit the integration suite
+ *     traverses, so the app returns 413 before the proxy would.
+ * The cap is scoped to the ingest route only (see parseRequestBody's maxBytes
+ * argument); every other endpoint keeps today's uncapped behavior.
+ */
+const INGEST_MAX_RAW_BODY_BYTES = 512 * 1024;
+/** Pathname of the prompts source ingest endpoint the raw-body cap is scoped to. */
+const PROMPTS_INGEST_PATHNAME = '/api/v1/prompts/sources';
+/**
+ * PRD #647 F1 — thrown by parseRequestBody when the raw request body exceeds the
+ * per-route ceiling, so the HTTP handler can map it to a 413 (matching the mock
+ * server's read-json-body.ts) instead of buffering an unbounded body.
+ */
+class RequestBodyTooLargeError extends Error {
+    limit;
+    constructor(limit) {
+        super(`Request body exceeds ${limit} bytes`);
+        this.name = 'RequestBodyTooLargeError';
+        this.limit = limit;
+    }
+}
 class MCPServer {
     dotAI;
     initialized = false;
@@ -423,15 +456,23 @@ class MCPServer {
             // Execute entire request within the span's context for proper propagation
             await api_1.context.with(api_1.trace.setSpan(api_1.context.active(), span), async () => {
                 try {
+                    // PRD #621: the forwarded token must never appear in logs. Redact
+                    // credential-bearing headers (HIGH-1) AND scrub credentials from the
+                    // request URL — a ?repo=https://user:token@host or a
+                    // credential-bearing query param would otherwise leak verbatim
+                    // (CodeRabbit Finding 1). sanitizeRequestUrlForLogging is the shared
+                    // helper already used by the REST layer.
                     this.logger.debug('HTTP request received', {
                         method: req.method,
-                        url: req.url,
-                        headers: req.headers,
+                        url: (0, rest_api_1.sanitizeRequestUrlForLogging)(req.url),
+                        headers: (0, header_redaction_1.redactSensitiveHeaders)(req.headers),
                     });
                     // Handle CORS for browser-based clients
                     res.setHeader('Access-Control-Allow-Origin', '*');
                     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-                    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-Session-Id, Authorization, X-Dot-AI-Authorization');
+                    // PRD #621 M2 / Decision 1: includes X-Dot-AI-Git-Token, kept in
+                    // sync with the REST allowlist via cors-headers.ts.
+                    res.setHeader('Access-Control-Allow-Headers', cors_headers_1.MCP_CORS_ALLOW_HEADERS);
                     if (req.method === 'OPTIONS') {
                         res.writeHead(204);
                         res.end();
@@ -486,12 +527,34 @@ class MCPServer {
                         // Parse request body for POST requests
                         let body = undefined;
                         if (req.method === 'POST') {
-                            body = await this.parseRequestBody(req);
+                            // PRD #647 F1: cap the raw body for the untrusted ingest route
+                            // only (default = today's uncapped behavior elsewhere) and map
+                            // an oversize body to 413 (matches the mock server).
+                            const maxBytes = this.isPromptsIngestRequest(req.url)
+                                ? INGEST_MAX_RAW_BODY_BYTES
+                                : undefined;
+                            try {
+                                body = await this.parseRequestBody(req, maxBytes);
+                            }
+                            catch (error) {
+                                if (error instanceof RequestBodyTooLargeError) {
+                                    this.logger.warn('Request body too large', {
+                                        url: (0, rest_api_1.sanitizeRequestUrlForLogging)(req.url),
+                                        limit: error.limit,
+                                    });
+                                    (0, error_response_1.sendErrorResponse)(res, 413, 'PAYLOAD_TOO_LARGE', error.message);
+                                    endSpan(413);
+                                    return;
+                                }
+                                throw error;
+                            }
                         }
                         // Check if this is a REST API request
                         if (this.restApiRouter.isApiRequest(req.url || '')) {
                             this.logger.debug('Routing to REST API handler', {
-                                url: req.url,
+                                // PRD #647 M5 (F2): scrub credential-bearing ?repo=/?source=
+                                // values before they reach the log (matches the REST handler).
+                                url: (0, rest_api_1.sanitizeRequestUrlForLogging)(req.url),
                             });
                             // Mark span as REST API request
                             span.setAttribute('request.type', 'rest-api');
@@ -593,11 +656,49 @@ class MCPServer {
             }).on('error', reject);
         });
     }
-    async parseRequestBody(req) {
+    /**
+     * Buffer and JSON-parse the request body.
+     *
+     * PRD #647 F1: when `maxBytes` is supplied (the untrusted ingest route), the
+     * body is rejected with RequestBodyTooLargeError as soon as the declared
+     * Content-Length OR the accumulated bytes exceed the ceiling — so an
+     * authenticated multi-GB POST can't buffer unbounded and OOM the shared
+     * process. When `maxBytes` is omitted (every other endpoint), behavior is
+     * exactly as before: no cap.
+     */
+    async parseRequestBody(req, maxBytes) {
         return new Promise((resolve, reject) => {
+            // Reject up front on a declared Content-Length over the cap, so we never
+            // start buffering a body we already know is too large.
+            if (maxBytes !== undefined) {
+                const declaredLen = parseInt(req.headers['content-length'] || '0', 10);
+                if (!Number.isNaN(declaredLen) && declaredLen > maxBytes) {
+                    reject(new RequestBodyTooLargeError(maxBytes));
+                    return;
+                }
+            }
             let body = '';
-            req.on('data', chunk => (body += chunk.toString()));
+            let received = 0;
+            let aborted = false;
+            req.on('data', chunk => {
+                if (aborted)
+                    return;
+                // Defense-in-depth: enforce the cap against actual bytes in case the
+                // Content-Length header is absent or lies.
+                if (maxBytes !== undefined) {
+                    received += chunk.length;
+                    if (received > maxBytes) {
+                        aborted = true;
+                        req.destroy();
+                        reject(new RequestBodyTooLargeError(maxBytes));
+                        return;
+                    }
+                }
+                body += chunk.toString();
+            });
             req.on('end', () => {
+                if (aborted)
+                    return;
                 try {
                     resolve(body ? JSON.parse(body) : undefined);
                 }
@@ -608,6 +709,29 @@ class MCPServer {
             req.on('error', reject);
         });
     }
+    /**
+     * PRD #647 F1: true only for the prompts source ingest endpoint, the one
+     * untrusted route the raw-body cap is scoped to. Parses the pathname so a
+     * query string can't bypass (or wrongly trip) the cap.
+     *
+     * PRD #647 C2 (CodeRabbit): the cap check runs BEFORE route dispatch, so a
+     * non-canonical pathname must be normalized here or it slips past the cap and
+     * buffers an uncapped body (DoS). A strict `===` let `POST /api/v1/prompts/
+     * sources/` (trailing slash) — the same ingest surface — skip `maxBytes`.
+     * Collapse trailing slashes (keeping a bare "/" intact) before comparing.
+     */
+    isPromptsIngestRequest(url) {
+        if (!url)
+            return false;
+        try {
+            const pathname = new URL(url, 'http://internal.invalid').pathname;
+            const normalized = pathname.replace(/\/+$/, '') || '/';
+            return normalized === PROMPTS_INGEST_PATHNAME;
+        }
+        catch {
+            return false;
+        }
+    }
     async stop() {
         // Stop OAuth provider pruning timer
         if (this.oauthProvider) {

package/dist/interfaces/openapi-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi-generator.d.ts","sourceRoot":"","sources":["../../src/interfaces/openapi-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAAE,gBAAgB,EAAY,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAmB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAMhD;;GAEG;AACH,KAAK,gBAAgB,GAAG;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,KAAK,eAAe,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE;QACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,EAAE,gBAAgB,CAAA;SAAE,CAAC,CAAC;KACxD,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAChB,MAAM,EACN;QACE,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,EAAE,gBAAgB,CAAA;SAAE,CAAC,CAAC;KACxD,CACF,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE;YACR,IAAI,EAAE,MAAM,CAAC;YACb,GAAG,EAAE,MAAM,CAAC;YACZ,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;QACF,OAAO,CAAC,EAAE;YACR,IAAI,EAAE,MAAM,CAAC;YACb,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;KACH,CAAC;IACF,OAAO,EAAE,KAAK,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACvD,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC3C,SAAS,CAAC,EAAE,MAAM,CAChB,MAAM,EACN;YACE,WAAW,EAAE,MAAM,CAAC;YACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC,CAAC;SACxD,CACF,CAAC;QACF,eAAe,CAAC,EAAE,MAAM,CACtB,MAAM,EACN;YACE,IAAI,EAAE,MAAM,CAAC;YACb,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,CACF,CAAC;KACH,CAAC;IACF,IAAI,CAAC,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAAC,CAAoB;IAC1C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,SAAS,CAAC,CAAc;IAChC,OAAO,CAAC,eAAe,CAAa;IACpC,OAAO,CAAC,eAAe,CAAiB;IACxC,OAAO,CAAC,WAAW,CAA4C;gBAG7D,YAAY,EAAE,gBAAgB,EAC9B,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM,EACnC,aAAa,CAAC,EAAE,iBAAiB;IAiBnC;;OAEG;IACH,YAAY,IAAI,WAAW;IA4D3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAmBpB;;OAEG;IACH,OAAO,CAAC,eAAe;IASvB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA2GzB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+DzB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAwB1B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAI5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA4E/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAUzB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAgB/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;OAEG;IACH,OAAO,CAAC,aAAa;IAoBrB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAyB7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4N3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAW3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAoC5B;;OAEG;IACH,OAAO,CAAC,YAAY;IA4DpB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAoE5B;;OAEG;IACH,eAAe,IAAI,IAAI;IAMvB;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAMrD;;OAEG;IACH,SAAS,IAAI,aAAa;CAG3B"}
+{"version":3,"file":"openapi-generator.d.ts","sourceRoot":"","sources":["../../src/interfaces/openapi-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAAE,gBAAgB,EAAY,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAmB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAMhD;;GAEG;AACH,KAAK,gBAAgB,GAAG;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,KAAK,eAAe,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE;QACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,EAAE,gBAAgB,CAAA;SAAE,CAAC,CAAC;KACxD,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAChB,MAAM,EACN;QACE,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,EAAE,gBAAgB,CAAA;SAAE,CAAC,CAAC;KACxD,CACF,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE;YACR,IAAI,EAAE,MAAM,CAAC;YACb,GAAG,EAAE,MAAM,CAAC;YACZ,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;QACF,OAAO,CAAC,EAAE;YACR,IAAI,EAAE,MAAM,CAAC;YACb,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;KACH,CAAC;IACF,OAAO,EAAE,KAAK,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACvD,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC3C,SAAS,CAAC,EAAE,MAAM,CAChB,MAAM,EACN;YACE,WAAW,EAAE,MAAM,CAAC;YACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC,CAAC;SACxD,CACF,CAAC;QACF,eAAe,CAAC,EAAE,MAAM,CACtB,MAAM,EACN;YACE,IAAI,EAAE,MAAM,CAAC;YACb,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,CACF,CAAC;KACH,CAAC;IACF,IAAI,CAAC,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAAC,CAAoB;IAC1C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,SAAS,CAAC,CAAc;IAChC,OAAO,CAAC,eAAe,CAAa;IACpC,OAAO,CAAC,eAAe,CAAiB;IAOxC,OAAO,CAAC,WAAW,CACH;gBAGd,YAAY,EAAE,gBAAgB,EAC9B,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM,EACnC,aAAa,CAAC,EAAE,iBAAiB;IAiBnC;;OAEG;IACH,YAAY,IAAI,WAAW;IA4D3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAmBpB;;OAEG;IACH,OAAO,CAAC,eAAe;IASvB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA2GzB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+DzB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAwB1B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAI5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA4E/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAUzB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAgB/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;OAEG;IACH,OAAO,CAAC,aAAa;IAoBrB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAwB7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4N3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAW3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAoC5B;;OAEG;IACH,OAAO,CAAC,YAAY;IA4DpB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAoE5B;;OAEG;IACH,eAAe,IAAI,IAAI;IAMvB;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAMrD;;OAEG;IACH,SAAS,IAAI,aAAa;CAG3B"}

package/dist/interfaces/openapi-generator.js

@@ -26,7 +26,13 @@ class OpenApiGenerator {
     specCache;
     lastCacheUpdate = 0;
     cacheValidityMs = 60000; // 1 minute
-    schemaCache = new Map();
+    // Keyed on the Zod schema OBJECT identity, not a structural stringify: two
+    // distinct schemas that differ only in their `.describe()` text serialize to
+    // the same string, so a string key would conflate them and leak one schema's
+    // descriptions into the other's endpoint (e.g. the prompts list vs. render
+    // `?source=` query). Identity keying gives each schema object its own entry
+    // while a schema reused across routes still hits the cache.
+    schemaCache = new WeakMap();
     constructor(toolRegistry, logger, config = {}, routeRegistry) {
         this.toolRegistry = toolRegistry;
         this.routeRegistry = routeRegistry;
@@ -472,6 +478,7 @@ class OpenApiGenerator {
             404: 'Not found',
             405: 'Method not allowed',
             409: 'Conflict',
+            413: 'Payload too large',
             422: 'Unprocessable entity',
             500: 'Internal server error',
             502: 'Bad gateway',
@@ -483,16 +490,15 @@ class OpenApiGenerator {
      * Convert Zod schema to JSON Schema with caching
      */
     zodSchemaToJsonSchema(schema) {
-        const cacheKey = JSON.stringify(schema);
-        if (this.schemaCache.has(cacheKey)) {
-            return this.schemaCache.get(cacheKey);
+        if (this.schemaCache.has(schema)) {
+            return this.schemaCache.get(schema);
         }
         try {
             const result = zod_1.z.toJSONSchema(schema);
             // Remove $schema and additionalProperties (not valid in OpenAPI component schemas)
             delete result.$schema;
             delete result.additionalProperties;
-            this.schemaCache.set(cacheKey, result);
+            this.schemaCache.set(schema, result);
             return result;
         }
         catch (error) {

package/dist/interfaces/rest-api.d.ts

@@ -9,6 +9,7 @@ import { RestToolRegistry, ToolInfo } from './rest-registry';
 import { RestRouteRegistry } from './rest-route-registry';
 import { Logger } from '../core/error-handling';
 import { DotAI } from '../core/index';
+import { UserPromptsOverride } from '../core/user-prompts-loader';
 import { PluginManager } from '../core/plugin-manager';
 /**
  * Constant placeholder used when the request URL fails to parse and the
@@ -19,9 +20,11 @@ import { PluginManager } from '../core/plugin-manager';
 export declare const UNPARSEABLE_QUERY_PLACEHOLDER = "?<redacted-unparseable>";
 /**
  * F3: req.url is logged on every request; with PRD #581 the query string may
- * carry `?repo=<user-supplied-url>` whose value can include credentials. This
- * helper rewrites the `repo` value to its credential-scrubbed form so the
- * raw token doesn't reach the log. Everything else is preserved verbatim.
+ * carry `?repo=<user-supplied-url>` whose value can include credentials, and
+ * PRD #647 adds `?source=<identifier>` which is equally credential-bearing (it
+ * may be a `https://user:tok@host` git URL). This helper rewrites BOTH values
+ * to their credential-scrubbed form so the raw token doesn't reach the log.
+ * Everything else is preserved verbatim.
  *
  * CodeRabbit Major B: on parse failure, we no longer return the input
  * verbatim — an unparseable URL is more likely than a parseable one to hide
@@ -31,6 +34,47 @@ export declare const UNPARSEABLE_QUERY_PLACEHOLDER = "?<redacted-unparseable>";
  * '?' are pass-through (no risk).
  */
 export declare function sanitizeRequestUrlForLogging(url: string | undefined): string | undefined;
+/**
+ * Extract and validate the per-request prompts override.
+ *
+ * Threads three optional, additive inputs from the request into a
+ * UserPromptsOverride (PRD #581 introduced `repo`; PRD #621 M1 adds `path`
+ * and `branch`):
+ *   - repoParam   → override.repoUrl   (GET ?repo=  / POST body `repo`)
+ *   - pathParam   → override.subPath   (GET ?path=  / POST body `path`)
+ *   - branchParam → override.branch    (GET ?branch= / POST body `branch`)
+ *   - gitToken    → override.gitToken  (X-Dot-AI-Git-Token request header; M2)
+ *
+ * Returns:
+ *   - { ok: true, override }  when no `repo` is supplied (override undefined;
+ *     any path/branch/token are ignored, since they only qualify an override —
+ *     this keeps the no-`repo` / env-var-configured path unchanged).
+ *   - { ok: true, override }  when a syntactically valid override is supplied.
+ *   - { ok: false, message }  when the override fails validation (HTTP 400).
+ *
+ * The validation message is run through scrubCredentials so embedded tokens
+ * never reach the wire response.
+ *
+ * Backward compatibility (PRD #621, non-negotiable): when path/branch are
+ * absent or empty, the override carries `repoUrl` only — byte-identical to
+ * the PRD #581 behavior (same clone target: repo root, `main`). subPath and
+ * branch are populated ONLY for a non-empty value, so downstream defaults are
+ * untouched. The credential header is INERT unless a `?repo=` override is
+ * present: without a repo this returns `override: undefined` before the token
+ * is ever read, so the env-var path is unaffected by a forwarded header.
+ *
+ * Validation is delegated to getUserPromptsConfigFromOverride (scheme,
+ * sanitizeRelativePath for subPath, isValidGitBranch for branch) and happens
+ * BEFORE any clone or shared-cache mutation, so a rejected override can never
+ * corrupt the env-var-configured cache.
+ */
+export declare function extractPromptsOverride(repoParam: unknown, pathParam?: unknown, branchParam?: unknown, gitToken?: string, sourceParam?: unknown): {
+    ok: true;
+    override?: UserPromptsOverride;
+} | {
+    ok: false;
+    message: string;
+};
 /**
  * HTTP status codes for REST responses
  */
@@ -233,18 +277,6 @@ export declare class RestApiRouter {
      * Returns container logs for a pod
      */
     private handleGetLogs;
-    /**
-     * Extract and validate the per-request `repo` override (PRD #581).
-     *
-     * Returns:
-     *   - { ok: true, override }    when no repo param is supplied, override is undefined.
-     *   - { ok: true, override }    when a syntactically valid override URL is supplied.
-     *   - { ok: false, message }    when the override fails validation (HTTP 400).
-     *
-     * The validation message is run through scrubCredentials so embedded tokens
-     * never reach the wire response.
-     */
-    private extractPromptsOverride;
     /**
      * Handle prompts list requests
      */
@@ -257,6 +289,18 @@ export declare class RestApiRouter {
      * Handle prompts cache refresh requests (PRD #386, extended PRD #581)
      */
     private handlePromptsCacheRefresh;
+    /**
+     * Handle prompts source ingestion (PRD #647 M2).
+     *
+     * Accepts a JSON manifest { source, contentHash, files:[{path, content(base64),
+     * mode}] }, base64-decodes and caches the uploaded skill source keyed by its
+     * `source` identifier in the in-memory ingested cache. A later
+     * POST /api/v1/prompts/:promptName?source=<identifier> renders it through the
+     * existing render path with no git operation. The (scrubbed) source is echoed
+     * back. Bearer-gated by the same checkBearerAuth path as every non-OpenAPI
+     * request.
+     */
+    private handlePromptsSourceIngest;
     /**
      * Handle visualization requests (PRD #317)
      * Returns structured visualization data for a query session

package/dist/interfaces/rest-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api.d.ts","sourceRoot":"","sources":["../../src/interfaces/rest-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAgDtC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAevD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,GAAG,SAAS,CAoBpB;AAED;;GAEG;AACH,oBAAY,UAAU;IACpB,EAAE,MAAM;IACR,WAAW,MAAM;IACjB,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,MAAM,GACN,OAAO,GACP,MAAM,GACN,WAAW,CAAC;AAEhB;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EACH,MAAM,GACN;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAClC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;KAAE,GACvC,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,GACF,wBAAwB,GACxB,4BAA4B,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,aAAa,CAAC,CAAgB;gBAGpC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,EAC7B,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAkCrC;;;;OAIG;IACG,aAAa,CACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC;IAsGhB;;;OAGG;YACW,aAAa;IA0G3B;;OAEG;YACW,mBAAmB;IAuEjC;;OAEG;YACW,mBAAmB;IAuJjC;;OAEG;YACW,iBAAiB;IAqC/B;;OAEG;YACW,yBAAyB;IA2EvC;;;;OAIG;YACW,sBAAsB;IAyDpC;;;OAGG;YACW,qBAAqB;IAmKnC;;;;OAIG;YACW,mBAAmB;IAoLjC;;;OAGG;YACW,mBAAmB;IAmDjC;;;OAGG;YACW,iBAAiB;IAuL/B;;;OAGG;YACW,eAAe;IA0J7B;;;OAGG;YACW,aAAa;IAuK3B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;OAEG;YACW,wBAAwB;IAiEtC;;OAEG;YACW,uBAAuB;IAmFrC;;OAEG;YACW,yBAAyB;IAyEvC;;;;OAIG;YACW,eAAe;IAwW7B;;;;OAIG;YACW,kBAAkB;IAkHhC;;;OAGG;YACW,oBAAoB;IA+ClC;;;;OAIG;YACW,sBAAsB;IAuEpC;;;;OAIG;YACW,2BAA2B;IAyQzC;;;;OAIG;YACW,kBAAkB;IA6PhC;;OAEG;YACW,+BAA+B;IA8D7C;;OAEG;YACW,gBAAgB;IAwG9B;;OAEG;YACW,eAAe;IAkD7B;;OAEG;YACW,gBAAgB;IA6E9B;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;YACW,gBAAgB;IAS9B;;OAEG;YACW,iBAAiB;IAyB/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC;;OAEG;IACH,SAAS,IAAI,aAAa;IAI1B;;;OAGG;IACH,gBAAgB,IAAI,iBAAiB;CAGtC"}
+{"version":3,"file":"rest-api.d.ts","sourceRoot":"","sources":["../../src/interfaces/rest-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAQtC,OAAO,EAOL,mBAAmB,EAEpB,MAAM,6BAA6B,CAAC;AAuCrC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAevD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,GAAG,SAAS,CAyCpB;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,OAAO,EAClB,SAAS,CAAC,EAAE,OAAO,EACnB,WAAW,CAAC,EAAE,OAAO,EACrB,QAAQ,CAAC,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,OAAO,GAEnB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;CACjB,CA0EJ;AAED;;GAEG;AACH,oBAAY,UAAU;IACpB,EAAE,MAAM;IACR,WAAW,MAAM;IACjB,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,MAAM,GACN,OAAO,GACP,MAAM,GACN,WAAW,CAAC;AAEhB;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EACH,MAAM,GACN;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAClC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;KAAE,GACvC,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,GACF,wBAAwB,GACxB,4BAA4B,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,aAAa,CAAC,CAAgB;gBAGpC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,EAC7B,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAkCrC;;;;OAIG;IACG,aAAa,CACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC;IAsGhB;;;OAGG;YACW,aAAa;IA4G3B;;OAEG;YACW,mBAAmB;IAuEjC;;OAEG;YACW,mBAAmB;IAuJjC;;OAEG;YACW,iBAAiB;IAqC/B;;OAEG;YACW,yBAAyB;IA2EvC;;;;OAIG;YACW,sBAAsB;IAyDpC;;;OAGG;YACW,qBAAqB;IAmKnC;;;;OAIG;YACW,mBAAmB;IAoLjC;;;OAGG;YACW,mBAAmB;IAmDjC;;;OAGG;YACW,iBAAiB;IAuL/B;;;OAGG;YACW,eAAe;IA0J7B;;;OAGG;YACW,aAAa;IAuK3B;;OAEG;YACW,wBAAwB;IA8GtC;;OAEG;YACW,uBAAuB;IAgHrC;;OAEG;YACW,yBAAyB;IAkGvC;;;;;;;;;;OAUG;YACW,yBAAyB;IAmEvC;;;;OAIG;YACW,eAAe;IAwW7B;;;;OAIG;YACW,kBAAkB;IAkHhC;;;OAGG;YACW,oBAAoB;IAiDlC;;;;OAIG;YACW,sBAAsB;IAuEpC;;;;OAIG;YACW,2BAA2B;IAyQzC;;;;OAIG;YACW,kBAAkB;IA6PhC;;OAEG;YACW,+BAA+B;IA8D7C;;OAEG;YACW,gBAAgB;IAwG9B;;OAEG;YACW,eAAe;IAkD7B;;OAEG;YACW,gBAAgB;IA6E9B;;OAEG;IACH,OAAO,CAAC,cAAc;IAStB;;OAEG;YACW,gBAAgB;IAS9B;;OAEG;YACW,iBAAiB;IAyB/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC;;OAEG;IACH,SAAS,IAAI,aAAa;IAI1B;;;OAGG;IACH,gBAAgB,IAAI,iBAAiB;CAGtC"}