Unify prompt repository source handling

This commit is contained in:
2026-08-11 22:18:50 +00:00
parent 25f1ba0b30
commit d45c474c1e
4 changed files with 286 additions and 173 deletions

View File

@@ -12,18 +12,21 @@ validation modes, built-in catalog, and source precedence.
## Prompt Definitions
`internal/promptdef` discovers YAML deterministically, requires one strictly
decoded document per file, and scans normalized ID and version metadata before
validating the selected definition. It retains the point-in-time metadata scan
needed for duplicate detection while opening file-backed message content only
for one exact selected candidate. Content resolution uses an explicit
source-root abstraction. Operating-system
sources enforce containment against canonical roots and targets so symlinks
cannot escape. Injected `fs.FS` sources enforce containment in their clean
relative path namespace. A single-file source uses the selected prompt file's
containing directory as its root. Every content path must be relative and is
opened from its exact parsed text after a separate blank check; contained
parent components and whitespace-bearing names remain valid.
`internal/promptdef` uses one source-neutral flow for prompt selection and
normalization. That flow scans normalized YAML ID and version metadata,
requires one strictly decoded document per file, classifies errors for the
selected definition, detects duplicates, and normalizes the exact match.
Small operating-system and `fs.FS` adapters own discovery, byte reads, display
paths, content opening, and root containment. Each lookup remains a
point-in-time scan: definitions and catalogs are not cached, and file-backed
message content is opened only for the exact selected candidate.
Operating-system sources enforce containment against canonical roots and
targets so symlinks cannot escape. Injected `fs.FS` sources enforce containment
in their clean relative path namespace. A single-file source uses the selected
prompt file's containing directory as its root. Every content path must be
relative and is opened from its exact parsed text after a separate blank check;
contained parent components and whitespace-bearing names remain valid.
Exact prompt inspection performs one point-in-time lookup through that same
repository and validates referenced message content before returning declared