8 commits

Author	SHA1	Message	Date
Jeremiah Lowin	a8b5da9770	Late-bind app tool names so UIs survive composition (#4682)	2026-07-28 10:54:19 -04:00
Jeremiah Lowin	e4bb6666ab	Add default prefill to FormInput.collect_input (#3937)	2026-04-14 13:23:36 -04:00
Jeremiah Lowin	af957e773f	Replace ___ with hash-based backend tool routing and per-tool prefab resources (#3824) ... Replaces the ___ separator for FastMCPApp backend tool routing with a deterministic hash(app_name, tool_name) prefix, and replaces the shared singleton prefab renderer resource with per-tool resources synthesized on demand. Backend tools are now callable via <hash>_<local_name> instead of <app_name>___<local_name>. The dispatcher walks the provider tree recursively via get_tool_by_hash (same pattern as get_app_tool). Each prefab tool gets its own renderer resource at ui://prefab/tool/<hash>/renderer.html with per-tool CSP — fixing the bug where PrefabAppConfig(csp=...) never actually applied. Closes #3735, closes #3805	2026-04-12 12:52:07 -04:00
Bill Easton	c946664a16	Validate actual base64 data size in FileUpload, not client-reported size (#3816) ... The store_files tool checked the client-provided `size` field to enforce max_file_size, but this field is untrusted input. A client could set size=1 while sending a multi-megabyte payload, bypassing the limit. Now computes actual size from the base64 data length instead. 🤖 Generated with Claude Code Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-11 11:23:49 -04:00
Jeremiah Lowin	8ee81b3037	fix: boolean false values dropped in form submissions (#3776) ... * fix: boolean false values dropped in form submissions * revert apps_dev.py boolean coercion	2026-04-07 11:23:34 -04:00
Jeremiah Lowin	2c08edecec	Add FormInput provider, bump prefab-ui to 0.15.0 (#3687)	2026-03-28 21:15:13 -04:00
Jeremiah Lowin	beb35a4ed8	Add Approval and Choice providers (#3686)	2026-03-28 20:58:17 -04:00
Jeremiah Lowin	5338629474	Add FileUpload provider (#3669)	2026-03-28 19:45:43 -04:00