- Validate manifest.id segments in POST endpoint before building dest_file path
- Add hostile manifest.id test (../../tmp/evil → 400)
- Add sqlite-backed round-trip tests for settings.py upsert logic
- Add HTTP tests for GET/PUT /api/v1/extensions/settings endpoints
- Wrap handleDelete in useCallback; already in columns useMemo deps
- Fix MySQL comment drift in _upsert_settings_row (read-then-update, not merge)
- Add intentional no-admin-gate comment to get_settings endpoint
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- ExtensionsList.tsx: unique Tooltip ids per row; onKeyDown Enter/Space for
star and delete role=button spans; data-test attrs; remove stale loading dep
- ExtensionsList.test.tsx: 10 unit tests (import validation, delete confirm,
star toggle, keyboard a11y, file upload)
- api.py: path-traversal validation, upload size limit, LOCAL_EXTENSIONS 409
- test_api.py: 19 Python unit tests for POST and DELETE endpoints
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
