[HamzaKhanBUIC]

Summary

Fixes #66.

Bounds session_id to a maximum length of 255 characters at the API request boundary, aligning it with the database column definition (VARCHAR(255)) and preventing data-length insertion failures and unbounded Redis key creation.

Problem

1. RunCreateRequest.session_id had no max_length constraint, allowing callers to submit arbitrarily long session IDs.
2. The database model defined session_id as VARCHAR(255). Submitting a 256+ character session ID caused database inserts to fail and resulted in unbounded Redis key creation.

Solution

• API Request Boundary Validation: Defined SESSION_ID_MAX_LENGTH: int = 255 and set max_length=SESSION_ID_MAX_LENGTH on RunCreateRequest.session_id in �gentkit/api/schemas.py.
• Database Model Alignment: Referenced SESSION_ID_MAX_LENGTH in �gentkit/db/models.py for Run.session_id: Mapped[str | None] = mapped_column(String(SESSION_ID_MAX_LENGTH)).
• Tests:
  • Added est_session_id_db_and_api_max_length_aligned in ests/unit/test_audit_regressions.py to prevent schema/database drift.
  • Added est_session_id_over_long_rejected_at_api_boundary verifying HTTP 422 VALIDATION_ERROR is returned before any agent execution begins, leaving the store untouched.
  • Added est_session_id_max_boundary_accepted_and_roundtrips verifying a 255-character ID succeeds (HTTP 200) and round-trips through PostgreSQL and Redis.
  • Added over-long session ID validation to ests/integration/test_api_runs.py.

Verification

• uv run pytest tests/unit/test_audit_regressions.py tests/integration/test_api_runs.py -> 41/41 passed
• uv run ruff check . -> All checks passed
• uv run ruff format --check . -> 110 files already formatted
• uv run mypy agentkit -> Success: no issues found in 42 source files
• Structural AST lint & Semgrep security check -> Clean

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.