5 commits

Author	SHA1	Message	Date
Bill Easton	c946664a16	Validate actual base64 data size in FileUpload, not client-reported size (#3816) ... The store_files tool checked the client-provided `size` field to enforce max_file_size, but this field is untrusted input. A client could set size=1 while sending a multi-megabyte payload, bypassing the limit. Now computes actual size from the base64 data length instead. 🤖 Generated with Claude Code Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-11 11:23:49 -04:00
Jeremiah Lowin	8ee81b3037	fix: boolean false values dropped in form submissions (#3776) ... * fix: boolean false values dropped in form submissions * revert apps_dev.py boolean coercion	2026-04-07 11:23:34 -04:00
Jeremiah Lowin	2c08edecec	Add FormInput provider, bump prefab-ui to 0.15.0 (#3687)	2026-03-28 21:15:13 -04:00
Jeremiah Lowin	beb35a4ed8	Add Approval and Choice providers (#3686)	2026-03-28 20:58:17 -04:00
Jeremiah Lowin	5338629474	Add FileUpload provider (#3669)	2026-03-28 19:45:43 -04:00