GET /api/v1/repos/:owner/:name/prompts carries an ETag and answers a repeat with 304 until a prompt source changes #9221

GET /api/v1/repos/:owner/:name/prompts now carries a weak ETag and answers a repeat with a 304. test/prompts-etag.test.ts passes (3 tests), and tsc and scripts/gate.ts are clean. One existing test fails, and it fails the same way without my change.

What changed (src/http/api/prompts.ts only; api.ts untouched)

• The route tags the exact JSON text it sends with weakEtag, and sets cache-control: private, no-cache and vary: authorization, cookie. The body bytes are unchanged.
• A request whose If-None-Match holds the tag gets a 304 with the same headers and no body. The securityFloor headers are still on it.
• Tagging happens only after the scope check, loadRepo and listPromptSources. A token short of admin, a non-admin and a missing repository answer as before (403, 404, 404, 401 when signed out), with no ETag, even with If-None-Match: *.

Tests (test/prompts-etag.test.ts)

• Headers on the 200, and a bodiless 304 with the floor headers on a repeat.
• Adding a source, editing one (last_said) and removing one each move the tag. A stale tag gets a 200, and removing the source returns the tag to the empty-list value.
• The four access-denied cases carry no ETag, even for *.

Not done

• The checklist asks the etag to move when the default branch moves a prompt file. This route's body is only the DB-backed prompt_source list and reads nothing from the repository. A tag over the body can't see a prompt-file change without changing the body, which the issue forbids, so I did not add one.
• Only an admin of the repository sees this body, so two viewers shown different bodies cannot arise here. I wrote no test for that.
• I couldn't call keep_plan in this session, so there is no plan on the issue.

Failing test: test/prompts.test.ts ("nothing before the hour; once after it; not again the same day") fails at line 604. The issue body is missing the title line, which comes from tell, not this route. Without my change, test/prompts.test.ts still fails the same way (1 failure in 21). I left it alone, but I did push with it red. The forge's check will report it.

Try it: bun test test/prompts-etag.test.ts. Or curl -i -H "authorization: Bearer $TOKEN" …/prompts, then repeat it with -H 'if-none-match: <etag>' to get the 304.

🤖 Generated with Claude Code

Closes #9201

GET /api/v1/repos/:owner/:name/prompts now carries a weak ETag and answers a repeat with a 304. test/prompts-etag.test.ts passes (3 tests), and tsc and scripts/gate.ts are clean. One existing test fails, and it fails the same way without my change.

What changed (src/http/api/prompts.ts only; api.ts untouched)

• The route tags the exact JSON text it sends with weakEtag, and sets cache-control: private, no-cache and vary: authorization, cookie. The body bytes are unchanged.
• A request whose If-None-Match holds the tag gets a 304 with the same headers and no body. The securityFloor headers are still on it.
• Tagging happens only after the scope check, loadRepo and listPromptSources. A token short of admin, a non-admin and a missing repository answer as before (403, 404, 404, 401 when signed out), with no ETag, even with If-None-Match: *.

Tests (test/prompts-etag.test.ts)

• Headers on the 200, and a bodiless 304 with the floor headers on a repeat.
• Adding a source, editing one (last_said) and removing one each move the tag. A stale tag gets a 200, and removing the source returns the tag to the empty-list value.
• The four access-denied cases carry no ETag, even for *.

Not done

• The checklist asks the etag to move when the default branch moves a prompt file. This route's body is only the DB-backed prompt_source list and reads nothing from the repository. A tag over the body can't see a prompt-file change without changing the body, which the issue forbids, so I did not add one.
• Only an admin of the repository sees this body, so two viewers shown different bodies cannot arise here. I wrote no test for that.
• I couldn't call keep_plan in this session, so there is no plan on the issue.

Failing test: test/prompts.test.ts ("nothing before the hour; once after it; not again the same day") fails at line 604. The issue body is missing the title line, which comes from tell, not this route. Without my change, test/prompts.test.ts still fails the same way (1 failure in 21). I left it alone, but I did push with it red. The forge's check will report it.

Try it: bun test test/prompts-etag.test.ts. Or curl -i -H "authorization: Bearer $TOKEN" …/prompts, then repeat it with -H 'if-none-match: <etag>' to get the 304.

🤖 Generated with Claude Code

GET /api/v1/repos/:owner/:name/prompts now carries a weak ETag and answers a repeat that holds it with a bodiless 304. I added a commit carrying the required Try: line (the commit is empty, so no code changed) and pushed it. bun scripts/gate.ts now passes locally, but I haven't seen the forge's check re-run on ca1f530b.

What changed

• In src/http/api/prompts.ts, a 200 carries etag from weakEtag over the exact JSON sent, cache-control: private, no-cache and vary: authorization, cookie. The body bytes are unchanged.
• A request whose If-None-Match holds the tag gets a 304 with the same headers, no body and the securityFloor headers.
• The tag is computed only after the scope check, loadRepo and listPromptSources. A token short of admin, a non-admin and a missing repository answer as before (403, 404, 404, and 401 when signed out), with no ETag, even with If-None-Match: *.
• test/prompts-etag.test.ts (3 tests) covers the headers, the 304, add/edit/remove each moving the tag, and the four denied cases. It passes locally.

Known failure: test/prompts.test.ts ("nothing before the hour; once after it; not again the same day") fails at line 604. The issue body is missing the title line that tell composes. It fails the same way with this route restored to its state on main, so my change did not cause it. I left it alone and did not re-run it after the new commit. If the forge's fast tier reaches that file, the check will fail again on it.

Not done: the issue asks the tag to move when the default branch moves a prompt file. This route's body is only the prompt_source rows and reads nothing from the repository, so a tag over the body cannot see a prompt-file change. Making it see one would mean changing the body, which the issue forbids. For the same reason, two viewers shown different bodies cannot arise here, since only a repository admin gets this body.

Try it: GET /api/v1/repos/<owner>/<name>/prompts with an admin token on the preview. Then repeat it with If-None-Match set to the returned etag; you should get a 304. Locally, run bun test test/prompts-etag.test.ts.

🤖 Generated with Claude Code

Left #9201 open: 2 unticked items remain (The etag moves when a prompt source is added, edited or removed, or the repository's default branch moves a prompt file; two viewers who are shown different bodies never share an etag.; test/prompts-etag.test.ts covers each of the above and fails without the change.).