[FEAT] Allow unpublishing an exported tool; derive API-key target from the URL - #2206

Merged

muhammad-ali-e merged 16 commits into

mainfrom

feat/prompt-studio-ergonomics

Aug 6, 2026

Commits on Jul 25, 2026

[FEAT] Allow unpublishing an exported tool; derive API-key target from the URL

hari-kuriakose
and
claude
committed
20d92a2
[FIX] Restrict registry tool deletion to the project's owner

hari-kuriakose
and
claude
committed
cae9099
[TEST] Pin the authorization and in-use guards on registry tool deletion

hari-kuriakose
and
claude
committed
facf9c7

Commits on Jul 31, 2026

[FIX] Close the API-key create IDOR; make the registry 409 actionable

hari-kuriakose
and
claude
committed
bfde081
[FIX] Close the API-key IDOR on every route, not just the path one

hari-kuriakose
and
claude
committed
4666d4b
[FIX] A malformed identifier is a 404, not a 500

hari-kuriakose
and
claude
committed
bad1ded
[TEST] Exercise the malformed-id catch instead of grepping for it

hari-kuriakose
and
claude
committed
3b06040
[REFACTOR] Share the test source-extraction helper

hari-kuriakose
and
claude
committed
00165fc
[TEST] Keep extracted-body tracebacks pointing at real lines

hari-kuriakose
and
claude
committed
9e255db

Commits on Aug 3, 2026

[FIX] Pin route/permission wiring; guard get_active_pipeline (F1, F2)

hari-kuriakose
and
claude
committed
d017039
[FIX] Refuse same-field target mismatch; correct test-technique claims (F3-F8)

hari-kuriakose
and
claude
committed
655881b
[TEST] Harden the wiring assertions against unrelated edits

hari-kuriakose
and
claude
committed
1e6b96b

Commits on Aug 4, 2026

[TEST] Pin that registry deletion is organization-scoped (G1, G3)

hari-kuriakose
and
claude
committed
6afb438
[FIX] Unbreak pre-commit.ci: attribute docstring reads as a second module docstring

hari-kuriakose
and
claude
committed
8476b0c

Commits on Aug 6, 2026