@vfarcic/dot-ai 1.6.0 → 1.6.2

package/dist/core/git-utils.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Git Utilities
+ *
+ * Shared git operations for the MCP server layer.
+ * Provides authenticated clone, pull, and push using simple-git.
+ *
+ * PRD #362: Git Operations for Recommend Tool
+ *
+ * Environment variables:
+ * - DOT_AI_GIT_TOKEN: PAT authentication token
+ * - GITHUB_APP_ENABLED: Enable GitHub App authentication
+ * - GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY, GITHUB_APP_INSTALLATION_ID: GitHub App config
+ */
+export interface GitAuthConfig {
+    pat?: string;
+    githubApp?: {
+        appId: string;
+        privateKey: string;
+        installationId?: string;
+    };
+}
+export declare function scrubCredentials(message: string): string;
+export declare function getAuthenticatedUrl(repoUrl: string, token: string): string;
+export declare function getAuthToken(authConfig: GitAuthConfig): Promise<string>;
+export declare function getGitAuthConfigFromEnv(): GitAuthConfig;
+export interface CloneOptions {
+    branch?: string;
+    depth?: number;
+}
+export declare function cloneRepo(repoUrl: string, targetDir: string, opts?: CloneOptions): Promise<{
+    localPath: string;
+    branch: string;
+}>;
+export declare function pullRepo(repoPath: string): Promise<{
+    branch: string;
+}>;
+export interface PushOptions {
+    branch?: string;
+    author?: {
+        name: string;
+        email: string;
+    };
+}
+export interface PushResult {
+    commitSha: string | undefined;
+    branch: string;
+    filesAdded: string[];
+}
+export declare function pushRepo(repoPath: string, files: Array<{
+    path: string;
+    content: string;
+}>, commitMessage: string, opts?: PushOptions): Promise<PushResult>;
+//# sourceMappingURL=git-utils.d.ts.map

package/dist/core/git-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-utils.d.ts","sourceRoot":"","sources":["../../src/core/git-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AASD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAK1E;AA2ED,wBAAsB,YAAY,CAAC,UAAU,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAc7E;AAED,wBAAgB,uBAAuB,IAAI,aAAa,CAyBvD;AAeD,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBhD;AAID,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAyB7B;AAID,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAC/C,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,UAAU,CAAC,CAyErB"}

package/dist/core/git-utils.js

@@ -0,0 +1,268 @@
+"use strict";
+/**
+ * Git Utilities
+ *
+ * Shared git operations for the MCP server layer.
+ * Provides authenticated clone, pull, and push using simple-git.
+ *
+ * PRD #362: Git Operations for Recommend Tool
+ *
+ * Environment variables:
+ * - DOT_AI_GIT_TOKEN: PAT authentication token
+ * - GITHUB_APP_ENABLED: Enable GitHub App authentication
+ * - GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY, GITHUB_APP_INSTALLATION_ID: GitHub App config
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scrubCredentials = scrubCredentials;
+exports.getAuthenticatedUrl = getAuthenticatedUrl;
+exports.getAuthToken = getAuthToken;
+exports.getGitAuthConfigFromEnv = getGitAuthConfigFromEnv;
+exports.cloneRepo = cloneRepo;
+exports.pullRepo = pullRepo;
+exports.pushRepo = pushRepo;
+const simple_git_1 = __importDefault(require("simple-git"));
+const jwt = __importStar(require("jsonwebtoken"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const FETCH_TIMEOUT_MS = 30000;
+const GIT_TIMEOUT_MS = 120000; // 2 minutes for git operations
+// ─── Auth helpers ───
+function scrubCredentials(message) {
+    return message
+        .replace(/\/\/x-access-token:[^@]+@/g, '//***@')
+        .replace(/\/\/[^/:][^@]*:[^@]+@/g, '//***@');
+}
+function getAuthenticatedUrl(repoUrl, token) {
+    const url = new URL(repoUrl);
+    url.username = 'x-access-token';
+    url.password = token;
+    return url.toString();
+}
+async function fetchWithTimeout(url, options, timeoutMs = FETCH_TIMEOUT_MS) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(url, { ...options, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function generateGitHubAppJWT(appId, privateKey) {
+    const now = Math.floor(Date.now() / 1000);
+    return jwt.sign({ iat: now - 60, exp: now + 10 * 60, iss: appId }, privateKey, { algorithm: 'RS256' });
+}
+async function getGitHubAppInstallationToken(appId, privateKey, installationId) {
+    const appJWT = generateGitHubAppJWT(appId, privateKey);
+    let installId = installationId;
+    if (!installId) {
+        const resp = await fetchWithTimeout('https://api.github.com/app/installations', {
+            headers: {
+                Authorization: `Bearer ${appJWT}`,
+                Accept: 'application/vnd.github.v3+json',
+            },
+        });
+        if (!resp.ok) {
+            throw new Error(`Failed to list installations: ${resp.statusText}`);
+        }
+        const installations = (await resp.json());
+        if (installations.length === 0) {
+            throw new Error('No GitHub App installations found');
+        }
+        installId = String(installations[0].id);
+    }
+    const tokenResp = await fetchWithTimeout(`https://api.github.com/app/installations/${installId}/access_tokens`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${appJWT}`,
+            Accept: 'application/vnd.github.v3+json',
+        },
+    });
+    if (!tokenResp.ok) {
+        throw new Error(`Failed to get installation token: ${tokenResp.statusText}`);
+    }
+    const data = (await tokenResp.json());
+    return { token: data.token, expiresAt: data.expires_at };
+}
+async function getAuthToken(authConfig) {
+    if (authConfig.pat)
+        return authConfig.pat;
+    if (authConfig.githubApp) {
+        const { appId, privateKey, installationId } = authConfig.githubApp;
+        const tokenData = await getGitHubAppInstallationToken(appId, privateKey, installationId);
+        return tokenData.token;
+    }
+    throw new Error('No authentication method configured. Provide either PAT or GitHub App credentials.');
+}
+function getGitAuthConfigFromEnv() {
+    const pat = process.env.DOT_AI_GIT_TOKEN;
+    const githubAppEnabled = process.env.GITHUB_APP_ENABLED === 'true';
+    if (pat)
+        return { pat };
+    if (githubAppEnabled) {
+        const appId = process.env.GITHUB_APP_ID;
+        const privateKey = process.env.GITHUB_APP_PRIVATE_KEY;
+        const installationId = process.env.GITHUB_APP_INSTALLATION_ID;
+        if (!appId || !privateKey) {
+            throw new Error('GitHub App enabled but GITHUB_APP_ID or GITHUB_APP_PRIVATE_KEY not set');
+        }
+        return {
+            githubApp: {
+                appId,
+                privateKey: privateKey.replace(/\\n/g, '\n'),
+                installationId,
+            },
+        };
+    }
+    return {};
+}
+// ─── Git options helper ───
+function gitOptions(baseDir) {
+    return {
+        baseDir: baseDir || process.cwd(),
+        binary: 'git',
+        maxConcurrentProcesses: 6,
+        timeout: { block: GIT_TIMEOUT_MS },
+    };
+}
+async function cloneRepo(repoUrl, targetDir, opts) {
+    const authConfig = getGitAuthConfigFromEnv();
+    const token = await getAuthToken(authConfig);
+    const authUrl = getAuthenticatedUrl(repoUrl, token);
+    const git = (0, simple_git_1.default)(gitOptions());
+    const cloneOptions = [];
+    if (opts?.branch) {
+        cloneOptions.push('--branch', opts.branch);
+    }
+    if (opts?.depth) {
+        cloneOptions.push('--depth', String(opts.depth));
+    }
+    await git.clone(authUrl, targetDir, cloneOptions);
+    const repoGit = (0, simple_git_1.default)(targetDir);
+    const status = await repoGit.status();
+    const branch = status.current || opts?.branch || 'main';
+    return { localPath: targetDir, branch };
+}
+// ─── Pull ───
+async function pullRepo(repoPath) {
+    const authConfig = getGitAuthConfigFromEnv();
+    const token = await getAuthToken(authConfig);
+    const git = (0, simple_git_1.default)(gitOptions(repoPath));
+    const remotes = await git.getRemotes(true);
+    const origin = remotes.find(r => r.name === 'origin');
+    const originalOriginUrl = origin?.refs.fetch;
+    if (originalOriginUrl) {
+        const authUrl = getAuthenticatedUrl(originalOriginUrl, token);
+        await git.remote(['set-url', 'origin', authUrl]);
+    }
+    try {
+        await git.pull('origin', undefined, ['--ff-only']);
+        const status = await git.status();
+        return { branch: status.current || 'main' };
+    }
+    finally {
+        // Restore original origin URL to prevent auth tokens persisting in .git/config
+        if (originalOriginUrl) {
+            await git.remote(['set-url', 'origin', originalOriginUrl]);
+        }
+    }
+}
+async function pushRepo(repoPath, files, commitMessage, opts) {
+    const git = (0, simple_git_1.default)(gitOptions(repoPath));
+    if (opts?.branch) {
+        const branches = await git.branchLocal();
+        if (!branches.all.includes(opts.branch)) {
+            await git.checkoutLocalBranch(opts.branch);
+        }
+        else {
+            await git.checkout(opts.branch);
+        }
+    }
+    for (const file of files) {
+        const repoRoot = path.resolve(repoPath);
+        const fullPath = path.resolve(repoPath, file.path);
+        if (!fullPath.startsWith(repoRoot + path.sep) && fullPath !== repoRoot) {
+            throw new Error(`Path traversal detected: "${file.path}" attempts to write outside repository directory`);
+        }
+        const dir = path.dirname(fullPath);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        fs.writeFileSync(fullPath, file.content);
+    }
+    await git.add(files.map(f => f.path));
+    const gitUserName = opts?.author?.name || process.env.GIT_AUTHOR_NAME || 'dot-ai-bot';
+    const gitUserEmail = opts?.author?.email ||
+        process.env.GIT_AUTHOR_EMAIL ||
+        'dot-ai@users.noreply.github.com';
+    await git.addConfig('user.name', gitUserName);
+    await git.addConfig('user.email', gitUserEmail);
+    const commitResult = await git.commit(commitMessage);
+    if (!commitResult.commit) {
+        return {
+            commitSha: undefined,
+            branch: (await git.status()).current || 'main',
+            filesAdded: [],
+        };
+    }
+    const authConfig = getGitAuthConfigFromEnv();
+    const token = await getAuthToken(authConfig);
+    const remotes = await git.getRemotes(true);
+    const origin = remotes.find(r => r.name === 'origin');
+    let originalOriginUrl;
+    if (origin) {
+        originalOriginUrl = origin.refs.fetch;
+        const authUrl = getAuthenticatedUrl(originalOriginUrl, token);
+        await git.remote(['set-url', 'origin', authUrl]);
+    }
+    try {
+        const currentBranch = (await git.status()).current || 'main';
+        await git.push('origin', currentBranch, ['--set-upstream']);
+        return {
+            commitSha: commitResult.commit,
+            branch: currentBranch,
+            filesAdded: files.map(f => f.path),
+        };
+    }
+    finally {
+        if (origin && originalOriginUrl) {
+            await git.remote(['set-url', 'origin', originalOriginUrl]);
+        }
+    }
+}

package/dist/core/user-prompts-loader.d.ts

@@ -40,11 +40,6 @@ export declare function getUserPromptsConfig(): UserPromptsConfig | null;
  * Tries project-relative tmp first, falls back to system temp
  */
 export declare function getCacheDirectory(): string;
-/**
- * Insert authentication token into git URL
- * Works with any HTTPS git URL (GitHub, GitLab, Gitea, Bitbucket, etc.)
- */
-export declare function insertTokenInUrl(url: string, token: string): string;
 /**
  * Sanitize URL for logging (remove credentials)
  */

package/dist/core/user-prompts-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-prompts-loader.d.ts","sourceRoot":"","sources":["../../src/core/user-prompts-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,MAAM,EAA8B,MAAM,kBAAkB,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,UAAU,UAAU;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,GAAG,IAAI,CAsB/D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAqB1C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CASnE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUzD;AAwOD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,MAAM,EAAE,CAAC,CA4FnB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,UAAU,GAAG,IAAI,CAE5D"}
+{"version":3,"file":"user-prompts-loader.d.ts","sourceRoot":"","sources":["../../src/core/user-prompts-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,MAAM,EAA8B,MAAM,kBAAkB,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,UAAU,UAAU;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,GAAG,IAAI,CAsB/D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAqB1C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUzD;AAgOD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,MAAM,EAAE,CAAC,CA4FnB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,UAAU,GAAG,IAAI,CAE5D"}

package/dist/core/user-prompts-loader.js

@@ -48,7 +48,6 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUserPromptsConfig = getUserPromptsConfig;
 exports.getCacheDirectory = getCacheDirectory;
-exports.insertTokenInUrl = insertTokenInUrl;
 exports.sanitizeUrlForLogging = sanitizeUrlForLogging;
 exports.loadUserPrompts = loadUserPrompts;
 exports.clearUserPromptsCache = clearUserPromptsCache;
@@ -56,7 +55,7 @@ exports.getUserPromptsCacheState = getUserPromptsCacheState;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
-const platform_utils_1 = require("./platform-utils");
+const git_utils_1 = require("./git-utils");
 const prompts_1 = require("../tools/prompts");
 // In-memory cache state (persists across requests within same process)
 let cacheState = null;
@@ -104,21 +103,6 @@ function getCacheDirectory() {
         return path.join(os.tmpdir(), 'dot-ai-user-prompts');
     }
 }
-/**
- * Insert authentication token into git URL
- * Works with any HTTPS git URL (GitHub, GitLab, Gitea, Bitbucket, etc.)
- */
-function insertTokenInUrl(url, token) {
-    try {
-        const parsed = new URL(url);
-        parsed.username = token;
-        return parsed.toString();
-    }
-    catch {
-        // If URL parsing fails, return original
-        return url;
-    }
-}
 /**
  * Sanitize URL for logging (remove credentials)
  */
@@ -147,13 +131,10 @@ function isValidGitBranch(branch) {
  * Clone the user prompts repository
  */
 async function cloneRepository(config, localPath, logger) {
-    // Validate branch name to prevent command injection
+    // Validate branch name as defense-in-depth
     if (!isValidGitBranch(config.branch)) {
         throw new Error(`Invalid branch name: ${config.branch}`);
     }
-    const authUrl = config.gitToken
-        ? insertTokenInUrl(config.repoUrl, config.gitToken)
-        : config.repoUrl;
     const sanitizedUrl = sanitizeUrlForLogging(config.repoUrl);
     logger.info('Cloning user prompts repository', {
         url: sanitizedUrl,
@@ -170,9 +151,10 @@ async function cloneRepository(config, localPath, logger) {
         if (fs.existsSync(localPath)) {
             fs.rmSync(localPath, { recursive: true, force: true });
         }
-        // Clone with shallow depth for faster operation
-        const cloneCommand = `git clone --depth 1 --branch ${config.branch} "${authUrl}" "${localPath}"`;
-        await (0, platform_utils_1.execAsync)(cloneCommand);
+        await (0, git_utils_1.cloneRepo)(config.repoUrl, localPath, {
+            branch: config.branch,
+            depth: 1,
+        });
         logger.info('Successfully cloned user prompts repository', {
             url: sanitizedUrl,
             branch: config.branch,
@@ -180,10 +162,9 @@ async function cloneRepository(config, localPath, logger) {
     }
     catch (error) {
         const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-        // Sanitize error message in case it contains the token
-        const sanitizedError = config.gitToken
+        const sanitizedError = (0, git_utils_1.scrubCredentials)(config.gitToken
             ? errorMessage.replaceAll(config.gitToken, '***')
-            : errorMessage;
+            : errorMessage);
         logger.error('Failed to clone user prompts repository', new Error(sanitizedError), {
             url: sanitizedUrl,
             branch: config.branch,
@@ -201,21 +182,16 @@ async function pullRepository(config, localPath, logger) {
         localPath,
     });
     try {
-        // Set up credentials for pull if token is provided
-        if (config.gitToken) {
-            const authUrl = insertTokenInUrl(config.repoUrl, config.gitToken);
-            await (0, platform_utils_1.execAsync)(`git -C "${localPath}" remote set-url origin "${authUrl}"`);
-        }
-        await (0, platform_utils_1.execAsync)(`git -C "${localPath}" pull --ff-only`);
+        await (0, git_utils_1.pullRepo)(localPath);
         logger.debug('Successfully pulled user prompts repository', {
             url: sanitizedUrl,
         });
     }
     catch (error) {
         const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-        const sanitizedError = config.gitToken
+        const sanitizedError = (0, git_utils_1.scrubCredentials)(config.gitToken
             ? errorMessage.replaceAll(config.gitToken, '***')
-            : errorMessage;
+            : errorMessage);
         logger.warn('Failed to pull user prompts repository, using cached version', {
             url: sanitizedUrl,
             error: sanitizedError,

package/dist/interfaces/rest-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api.d.ts","sourceRoot":"","sources":["../../src/interfaces/rest-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAoCtC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAavD;;GAEG;AACH,oBAAY,UAAU;IACpB,EAAE,MAAM;IACR,WAAW,MAAM;IACjB,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,MAAM,GACN,OAAO,GACP,MAAM,GACN,WAAW,CAAC;AAEhB;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EACH,MAAM,GACN;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAClC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;KAAE,GACvC,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,GACF,wBAAwB,GACxB,4BAA4B,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,aAAa,CAAC,CAAgB;gBAGpC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,EAC7B,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAkCrC;;;;OAIG;IACG,aAAa,CACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC;IAmGhB;;;OAGG;YACW,aAAa;IAsG3B;;OAEG;YACW,mBAAmB;IAgDjC;;OAEG;YACW,mBAAmB;IAuIjC;;OAEG;YACW,iBAAiB;IAqC/B;;OAEG;YACW,yBAAyB;IA2EvC;;;;OAIG;YACW,sBAAsB;IAyDpC;;;OAGG;YACW,qBAAqB;IAmKnC;;;;OAIG;YACW,mBAAmB;IAwKjC;;;OAGG;YACW,mBAAmB;IAmDjC;;;OAGG;YACW,iBAAiB;IAuL/B;;;OAGG;YACW,eAAe;IA0J7B;;;OAGG;YACW,aAAa;IAuK3B;;OAEG;YACW,wBAAwB;IA6CtC;;OAEG;YACW,uBAAuB;IAmErC;;OAEG;YACW,yBAAyB;IAmDvC;;;;OAIG;YACW,eAAe;IAmW7B;;;;OAIG;YACW,sBAAsB;IAuEpC;;;;OAIG;YACW,2BAA2B;IAyQzC;;;;OAIG;YACW,kBAAkB;IA6PhC;;OAEG;YACW,+BAA+B;IA8D7C;;OAEG;YACW,gBAAgB;IA+D9B;;OAEG;YACW,eAAe;IA4B7B;;OAEG;YACW,gBAAgB;IA+C9B;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;YACW,gBAAgB;IAS9B;;OAEG;YACW,iBAAiB;IAyB/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC;;OAEG;IACH,SAAS,IAAI,aAAa;IAI1B;;;OAGG;IACH,gBAAgB,IAAI,iBAAiB;CAGtC"}
+{"version":3,"file":"rest-api.d.ts","sourceRoot":"","sources":["../../src/interfaces/rest-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAoCtC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AASvD;;GAEG;AACH,oBAAY,UAAU;IACpB,EAAE,MAAM;IACR,WAAW,MAAM;IACjB,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,MAAM,GACN,OAAO,GACP,MAAM,GACN,WAAW,CAAC;AAEhB;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EACH,MAAM,GACN;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAClC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;KAAE,GACvC,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,GACF,wBAAwB,GACxB,4BAA4B,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,aAAa,CAAC,CAAgB;gBAGpC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,EAC7B,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAkCrC;;;;OAIG;IACG,aAAa,CACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC;IAmGhB;;;OAGG;YACW,aAAa;IAqG3B;;OAEG;YACW,mBAAmB;IAgDjC;;OAEG;YACW,mBAAmB;IAuIjC;;OAEG;YACW,iBAAiB;IAqC/B;;OAEG;YACW,yBAAyB;IA2EvC;;;;OAIG;YACW,sBAAsB;IAyDpC;;;OAGG;YACW,qBAAqB;IAmKnC;;;;OAIG;YACW,mBAAmB;IAoLjC;;;OAGG;YACW,mBAAmB;IAmDjC;;;OAGG;YACW,iBAAiB;IAuL/B;;;OAGG;YACW,eAAe;IA0J7B;;;OAGG;YACW,aAAa;IAuK3B;;OAEG;YACW,wBAAwB;IA6CtC;;OAEG;YACW,uBAAuB;IAmErC;;OAEG;YACW,yBAAyB;IAqDvC;;;;OAIG;YACW,eAAe;IAmW7B;;;;OAIG;YACW,sBAAsB;IAuEpC;;;;OAIG;YACW,2BAA2B;IAyQzC;;;;OAIG;YACW,kBAAkB;IA6PhC;;OAEG;YACW,+BAA+B;IA8D7C;;OAEG;YACW,gBAAgB;IAmF9B;;OAEG;YACW,eAAe;IA+B7B;;OAEG;YACW,gBAAgB;IAwD9B;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;YACW,gBAAgB;IAS9B;;OAEG;YACW,iBAAiB;IAyB/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC;;OAEG;IACH,SAAS,IAAI,aAAa;IAI1B;;;OAGG;IACH,gBAAgB,IAAI,iBAAiB;CAGtC"}

package/dist/interfaces/rest-api.js

@@ -603,30 +603,41 @@ class RestApiRouter {
             if (includeStatus &&
                 result.resources.length > 0 &&
                 (0, plugin_registry_1.isPluginInitialized)()) {
-                const statusPromises = result.resources.map(async (resource) => {
-                    const resourceType = resource.apiGroup
-                        ? `${resource.kind.toLowerCase()}.${resource.apiGroup}`
-                        : resource.kind.toLowerCase();
-                    const resourceId = `${resourceType}/${resource.name}`;
-                    const pluginResponse = await (0, plugin_registry_1.invokePluginTool)('agentic-tools', 'kubectl_get_resource_json', {
-                        resource: resourceId,
-                        namespace: resource.namespace,
-                        field: 'status',
-                    });
-                    if (pluginResponse.success && pluginResponse.result) {
-                        const pluginResult = pluginResponse.result;
-                        if (pluginResult.success && pluginResult.data) {
-                            try {
-                                return { ...resource, status: JSON.parse(pluginResult.data) };
-                            }
-                            catch {
-                                return resource;
+                // Process status fetches in batches to avoid overwhelming the
+                // agentic-tools pod with concurrent kubectl processes
+                const batchSize = 5;
+                const enrichedResources = [];
+                for (let i = 0; i < result.resources.length; i += batchSize) {
+                    const batch = result.resources.slice(i, i + batchSize);
+                    const batchResults = await Promise.all(batch.map(async (resource) => {
+                        const resourceType = resource.apiGroup
+                            ? `${resource.kind.toLowerCase()}.${resource.apiGroup}`
+                            : resource.kind.toLowerCase();
+                        const resourceId = `${resourceType}/${resource.name}`;
+                        const pluginResponse = await (0, plugin_registry_1.invokePluginTool)('agentic-tools', 'kubectl_get_resource_json', {
+                            resource: resourceId,
+                            namespace: resource.namespace,
+                            field: 'status',
+                        });
+                        if (pluginResponse.success && pluginResponse.result) {
+                            const pluginResult = pluginResponse.result;
+                            if (pluginResult.success && pluginResult.data) {
+                                try {
+                                    return {
+                                        ...resource,
+                                        status: JSON.parse(pluginResult.data),
+                                    };
+                                }
+                                catch {
+                                    return resource;
+                                }
                             }
                         }
-                    }
-                    return resource;
-                });
-                result.resources = await Promise.all(statusPromises);
+                        return resource;
+                    }));
+                    enrichedResources.push(...batchResults);
+                }
+                result.resources = enrichedResources;
             }
             const response = {
                 success: true,
@@ -1064,7 +1075,9 @@ class RestApiRouter {
      */
     async handlePromptsCacheRefresh(req, res, requestId) {
         try {
-            this.logger.info('Processing prompts cache refresh request', { requestId });
+            this.logger.info('Processing prompts cache refresh request', {
+                requestId,
+            });
             const prompts = await (0, prompts_1.loadAllPrompts)(this.logger, undefined, true);
             const hasUserPromptsRepo = !!process.env.DOT_AI_USER_PROMPTS_REPO;
             const source = hasUserPromptsRepo ? 'built-in+repository' : 'built-in';
@@ -1782,7 +1795,10 @@ class RestApiRouter {
      */
     async handleCreateUser(_req, res, requestId, body) {
         try {
-            if (!body || typeof body !== 'object' || !('email' in body) || !('password' in body)) {
+            if (!body ||
+                typeof body !== 'object' ||
+                !('email' in body) ||
+                !('password' in body)) {
                 await this.sendErrorResponse(res, requestId, HttpStatus.BAD_REQUEST, 'INVALID_REQUEST', 'Request body must include email and password');
                 return;
             }

package/dist/tools/organizational-data.d.ts

@@ -21,10 +21,10 @@ export declare const ORGANIZATIONAL_DATA_TOOL_INPUT_SCHEMA: {
     operation: z.ZodEnum<{
         search: "search";
         get: "get";
+        progress: "progress";
         create: "create";
         list: "list";
         delete: "delete";
-        progress: "progress";
         deleteAll: "deleteAll";
         scan: "scan";
         analyze: "analyze";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vfarcic/dot-ai",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "AI-powered development productivity platform that enhances software development workflows through intelligent automation and AI-driven assistance",
   "mcpName": "io.github.vfarcic/dot-ai",
   "main": "dist/index.js",
@@ -90,6 +90,7 @@
     "@types/express": "^5.0.6",
     "@types/glob": "^9.0.0",
     "@types/handlebars": "^4.0.40",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^22.0.0",
     "@types/uuid": "^10.0.0",
     "@typescript-eslint/eslint-plugin": "^8.56.1",
@@ -126,8 +127,10 @@
     "ai": "^5.0.60",
     "bcryptjs": "^3.0.3",
     "handlebars": "^4.7.8",
+    "jsonwebtoken": "^9.0.3",
     "mermaid": "^10.9.5",
     "posthog-node": "^5.23.0",
+    "simple-git": "^3.32.3",
     "yaml": "^2.8.0"
   },
   "optionalDependencies": {