- Validate elicitation keys match variable name format before regex construction
(prevents ReDoS via user-controlled regex metacharacters — CWE-1333)
- Narrow slugify fallback to only prompts with slug=null, cap at 500 results
- Add TODO to backfill slug column so fallback can be removed
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Track bytes with Buffer.byteLength instead of string code units
- Return 413 Payload Too Large instead of generic 500
- Custom PayloadTooLargeError class for handler discrimination
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- prompts.json: Always include `content` field alongside `contentPreview`
(Raycast extension reads `item.content` — removing it breaks the extension)
- mcp.ts GetPromptRequestSchema: Add slugify(title) fallback for prompts
without a stored slug (getPromptName() advertises slugified titles in
prompts/list, so the resolver must handle them too)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Addresses $6,478/month Vercel bill with 12 targeted fixes based on forensic
bill analysis and 7-expert review. See #1085 for full analysis.
MCP endpoint (src/pages/api/mcp.ts):
- Fix GetPromptRequestSchema P0 full table scan (findMany→findFirst)
- Remove all JSON pretty-printing (13 occurrences, ~30% payload reduction)
- Add Cache-Control headers to GET discovery endpoint
- Set tools.listChanged=false to prevent client polling
- Add 1MB body size limit to parseBody (DoS protection)
- Make elicitation opt-in via fill_variables param (saves 10s CPU/request)
- Fix timer leak in elicitation setTimeout
- Cap search content at 1,000 chars (contentPreview)
- Remove structuredFormat from search results
- Dynamic import for improve_prompt (reduces cold start)
- Optimize search_skills to return fileNames only
prompts.json:
- Add pagination (?page=&limit=) with backward compatibility
- Add ETag support for 304 Not-Modified responses
- Truncate content to 500-char preview by default
Infrastructure:
- Remove Sentry tunnelRoute (was proxying all browser events through edge)
- Add slug + composite database indexes for MCP query patterns
Closes#1085
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fatih Kadir Akın