fix(api-server): validate previous_response_id type and length (salvage of #2961 by @aydnOktay)

[Bartok9]

Summary

Salvages #2961 by @aydnOktay onto current main.

What the original PR fixed

previous_response_id accepted non-strings and unbounded lengths before store lookup.

Why it needed salvage

Still open; endpoint code has grown (multiple handlers). Port validation to current parse paths with tests.

Changes from original

• Apply validation in both body-parse sites that read previous_response_id
• Unit tests for invalid type and overlong ID

Testing

python3 -m pytest tests/gateway/test_api_server.py::TestPreviousResponseIdHardening -q

Full credit to @aydnOktay.

[teknium1]

Thanks for carrying the original hardening forward. The premise is live on current main: both handlers pass a client-provided previous_response_id into ResponseStore.get without validation (gateway/platforms/api_server.py:3285-3286, gateway/platforms/api_server.py:4222-4223), and the PR validates both paths before that lookup.

Problems

• The added tests cover only POST /v1/responses. The test app registers that route at tests/gateway/test_api_server.py:616, but not POST /v1/runs; production registers /v1/runs at gateway/platforms/api_server.py:4805. The new _handle_runs validation therefore has no regression coverage.

Suggested changes

• Add invalid-type and overlength requests for POST /v1/runs, by extending the test app helper or invoking _handle_runs directly, and assert the same 400 contract.

This is an automated hermes-sweeper review.

[teknium1]

These tests exercise only /v1/responses, but this PR also changes _handle_runs. Please add equivalent 400 regression coverage for POST /v1/runs; the current _create_app helper registers /v1/responses but not that production route.

[Bartok9]

Review addressed:

• `_create_app` now registers production route `POST /v1/runs`.
• Added `test_runs_previous_response_id_invalid_type_returns_400` and `test_runs_previous_response_id_too_long_returns_400`.

`pytest tests/gateway/test_api_server.py::TestPreviousResponseIdHardening` → 4 passed.

[Bartok9]

Rebased onto current main (resolved _create_app conflict: kept both /v1/runs and the platforms events route).

Review (jquery/teknium keep_open) was already addressed on this salvage:

• _create_app registers production POST /v1/runs
• TestPreviousResponseIdHardening covers invalid-type + overlong for both /v1/responses and /v1/runs

Local: pytest tests/gateway/test_api_server.py::TestPreviousResponseIdHardening → 4 passed.

Ready for re-review when CI is green. Not merging from author side.

[Bartok9]

Rebuilt onto latest main via patch re-apply (force-push). Please re-run CI.

— Bartok9 public PR hygiene 2026-08-01