fred-runtime 3.4.4__tar.gz → 3.4.5__tar.gz

{fred_runtime-3.4.4 → fred_runtime-3.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fred-runtime
-Version: 3.4.4
+Version: 3.4.5
 Summary: Runtime adapters and infrastructure wiring for Fred v2 agents.
 Author-email: Thales <noreply@thalesgroup.com>
 License: Apache-2.0
@@ -12,8 +12,8 @@ Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Operating System :: OS Independent
 Requires-Python: <3.13,>=3.12
 Description-Content-Type: text/markdown
-Requires-Dist: fred-core>=3.8.0
-Requires-Dist: fred-sdk>=3.3.3
+Requires-Dist: fred-core>=3.8.2
+Requires-Dist: fred-sdk>=3.4.3
 Requires-Dist: alembic>=1.18.4
 Requires-Dist: deepagents>=0.6.12
 Requires-Dist: httpx>=0.28.1

{fred_runtime-3.4.4 → fred_runtime-3.4.5}/fred_runtime/app/agent_app.py

@@ -65,7 +65,6 @@ from fred_core.logs.audit_log import emit_audit_log
 from fred_core.logs.log_setup import log_setup
 from fred_core.logs.log_store_factory import build_log_store
 from fred_core.security.models import AuthorizationError
-from fred_core.security.oidc import get_keycloak_client_id, get_keycloak_url
 from fred_core.security.rebac.rebac_engine import (
     ORGANIZATION_ID,
     OrganizationPermission,
@@ -152,7 +151,9 @@ from ..integrations.v2_runtime.adapters import (
     AgentConfigAssetsAdapter,
     CompositeToolInvoker,
     DocumentContentAdapter,
+    DocumentExtractionAdapter,
     DocumentFolderAdapter,
+    DocumentMarkdownAdapter,
     DocumentSearchAdapter,
     DocumentSummarizeAdapter,
     DocumentTreeAdapter,
@@ -160,6 +161,7 @@ from ..integrations.v2_runtime.adapters import (
     FredMcpToolProvider,
     FredWorkspaceFs,
     KPIWriterMetricsAdapter,
+    _refresh_runtime_context_access_token,
     build_default_tracer,
 )
 from ..runtime_context import (
@@ -168,7 +170,8 @@ from ..runtime_context import (
     set_runtime_context,
 )
 from ..runtime_context import RuntimeContext as FredRuntimeContext
-from ..runtime_support import refresh_user_access_token_from_keycloak
+from ..runtime_support import aclose_token_refresh_client
+from .chat_input_limit import validate_runtime_request
 from .config import AgentPodConfig
 from .container import build_pod_container
 from .context import AuditEventRecord, KpiTurnRecord, PodApplicationContext
@@ -349,6 +352,7 @@ def _execute_response_adapter() -> TypeAdapter[Any]:
     cache = _execute_response_adapter_cache
     if cache is None or cache[0] is not union_token:
         cache = (union_token, TypeAdapter(RuntimeEvent | _RuntimeErrorPayload))
+        # codeql[py/unused-global-variable]
         _execute_response_adapter_cache = cache
     return cache[1]
 
@@ -455,58 +459,26 @@ class _MediaClientAgentAdapter:
         self.runtime_context = binding.runtime_context
         self.agent_settings: AgentSettingsLike = settings
 
-    def refresh_user_access_token(self) -> str:
+    async def refresh_user_access_token(self) -> str:
         """
         Refresh the user access token for media downloads.
 
         Why this exists:
         - media fetch retries need the same Keycloak refresh path as other
-          runtime adapters
+          runtime adapters. It delegates rather than reimplementing: this used
+          to be a ~40-line copy of `_refresh_runtime_context_access_token`
+          which had already drifted — the copy never wrote
+          `access_token_expires_at`, so any consumer gating on expiry saw stale
+          data after a media-path refresh.
 
         How to use it:
-        - called by `KfMarkdownMediaClient` when the current token is expired
+        - awaited by `KfMarkdownMediaClient` when the current token is expired
 
         Example:
-        - `token = adapter.refresh_user_access_token()`
+        - `token = await adapter.refresh_user_access_token()`
         """
 
-        refresh_token = self.runtime_context.refresh_token
-        if not refresh_token:
-            raise RuntimeError(
-                "Cannot refresh user access token: refresh_token missing from runtime context."
-            )
-
-        keycloak_url = get_keycloak_url()
-        client_id = get_keycloak_client_id()
-        if not keycloak_url:
-            raise RuntimeError(
-                "User security realm_url is not configured for Keycloak."
-            )
-        if not client_id:
-            raise RuntimeError(
-                "User security client_id is not configured for Keycloak."
-            )
-
-        payload = refresh_user_access_token_from_keycloak(
-            keycloak_url=keycloak_url,
-            client_id=client_id,
-            refresh_token=refresh_token,
-        )
-        new_access_token = payload.get("access_token")
-        raw_refresh = payload.get("refresh_token")
-        new_refresh_token: str = (
-            raw_refresh
-            if isinstance(raw_refresh, str) and raw_refresh
-            else refresh_token
-        )
-        if not isinstance(new_access_token, str) or not new_access_token:
-            raise RuntimeError(
-                "Keycloak refresh response did not include a valid access_token."
-            )
-
-        self.runtime_context.access_token = new_access_token
-        self.runtime_context.refresh_token = new_refresh_token
-        return new_access_token
+        return await _refresh_runtime_context_access_token(self.runtime_context)
 
 
 def _definition_to_agent_tuning(
@@ -752,6 +724,18 @@ def _build_runtime_services(
         binding=binding,
         settings=settings,
     )
+    # Paginated full-markdown read (DOCREAD-01): powers document_verbatim,
+    # same private-binding doctrine.
+    document_markdown = DocumentMarkdownAdapter(
+        binding=binding,
+        settings=settings,
+    )
+    # Server-side exhaustive extraction (DOCREAD-01 Phase 2): powers
+    # document_extract's single-call path.
+    document_extraction = DocumentExtractionAdapter(
+        binding=binding,
+        settings=settings,
+    )
     tool_provider = FredMcpToolProvider(
         binding=binding,
         settings=settings,
@@ -811,6 +795,8 @@ def _build_runtime_services(
         document_folders=DocumentFolderAdapter(binding=binding, settings=settings),
         document_tree=document_tree,
         document_summarize=document_summarize,
+        document_markdown=document_markdown,
+        document_extraction=document_extraction,
     )
 
 
@@ -960,6 +946,9 @@ class _AgentTemplateSummary(BaseModel):
     # for); this field is the one control-plane reads to resolve what a
     # `selected_capability_ids = None` instance activates (#1980).
     default_capability_ids: list[str] = Field(default_factory=list)
+    # Pod-scoped deployment policy mirrored per template so control-plane can
+    # publish it to the managed-chat composer without another runtime endpoint.
+    max_chat_input_chars: int
 
 
 class _McpCatalogEntry(BaseModel):
@@ -1001,6 +990,19 @@ class _ModelCatalogEntry(BaseModel):
     shows no reasoning control at all — aptitude is not a choice, an
     administrator cannot make a model reason. Non-empty means the row carries
     the toggle. Same established join as `profile_ids` above."""
+    display_name: str | None = None
+    """The ops-authored `model_display_name` of this model's first profile that
+    declares one — the label the composer shows instead of splitting the
+    capability id apart. None means no profile named this model and the
+    frontend falls back to that heuristic. First-declared wins, same
+    first-seen rule as `description` above."""
+    reasoning_effort: str | None = None
+    """The ops-authored `settings.reasoning_effort` of this model's first
+    thinking profile — DERIVED from the settings (never declared twice; the
+    settings key is the single source of truth per review 2026-08-12). The
+    composer's reasoning menu displays it as the level a reasoning turn will
+    actually run with ("Élevé" for Mistral small); None when no thinking
+    profile ships the key (the menu then falls back to a generic On label)."""
 
 
 class _ModelCatalogResponse(BaseModel):
@@ -1040,15 +1042,23 @@ def _project_model_catalog_entries(catalog: Any) -> list[_ModelCatalogEntry]:
                 provider=provider,
                 name=name,
                 description=profile.description,
+                display_name=profile.model_display_name,
                 profile_ids=[profile.profile_id],
             )
             seen[key] = existing
         else:
             existing.profile_ids.append(profile.profile_id)
+            # First declaring profile wins; a later one only fills a gap.
+            if existing.display_name is None:
+                existing.display_name = profile.model_display_name
         # REASON-01 §5.3: aptitude is per profile, the toggle is per model —
         # this one condition is the whole projection between them.
         if profile.supports_thinking:
             existing.thinking_profile_ids.append(profile.profile_id)
+            if existing.reasoning_effort is None:
+                existing.reasoning_effort = (profile.model.settings or {}).get(
+                    "reasoning_effort"
+                )
     return list(seen.values())
 
 
@@ -2167,11 +2177,15 @@ async def _write_turn_history(
                 )
 
         elif kind == "awaiting_human":
-            # Store the full HITL gate definition — question and all choices —
-            # so audit logs and UI replay have the complete structured record.
+            # Store the full HITL gate definition — question, all choices, and
+            # the resume identity (interrupt_id/checkpoint_id/pending_calls) —
+            # so audit logs and UI replay have the complete structured record
+            # AND a reload while the gate is still open can reconstruct a
+            # working (not just readable) prompt.
             req = payload.get("request", {})
             question = req.get("question") or req.get("title") or "HITL pause"
             raw_choices = req.get("choices") or []
+            raw_pending_calls = req.get("pending_calls") or []
             messages.append(
                 make_hitl_request(
                     session_id,
@@ -2188,6 +2202,18 @@ async def _write_turn_history(
                     ],
                     stage=req.get("stage"),
                     title=req.get("title"),
+                    free_text=bool(req.get("free_text")),
+                    interrupt_id=req.get("interrupt_id"),
+                    checkpoint_id=req.get("checkpoint_id"),
+                    pending_calls=[
+                        {
+                            "tool_call_id": c.get("tool_call_id", ""),
+                            "tool_name": c.get("tool_name", ""),
+                            "args_preview": c.get("args_preview", ""),
+                        }
+                        for c in raw_pending_calls
+                        if isinstance(c, dict)
+                    ],
                 )
             )
             rank += 1
@@ -2220,6 +2246,8 @@ async def _write_turn_history(
                     input_tokens=tu.get("input_tokens", 0),
                     output_tokens=tu.get("output_tokens", 0),
                     total_tokens=tu.get("total_tokens", 0),
+                    cache_read_tokens=tu.get("cache_read_tokens", 0),
+                    cache_creation_tokens=tu.get("cache_creation_tokens", 0),
                 )
             final_model = payload.get("model_name")
             final_finish_reason = payload.get("finish_reason")
@@ -2276,6 +2304,7 @@ class _TurnOutcome:
     token_usage: dict[str, Any] | None
     input_tokens: int | None
     output_tokens: int | None
+    cache_read_tokens: int | None
     tool_count: int
     is_error: bool
     total_ms: int
@@ -2299,6 +2328,7 @@ def _parse_turn_outcome(
         token_usage=token_usage,
         input_tokens=token_usage.get("input_tokens") if token_usage else None,
         output_tokens=token_usage.get("output_tokens") if token_usage else None,
+        cache_read_tokens=token_usage.get("cache_read_tokens") if token_usage else None,
         tool_count=tool_count,
         is_error=is_error,
         total_ms=total_ms,
@@ -2444,6 +2474,7 @@ def _emit_turn_completed(
                 "tool_count": outcome.tool_count,
                 "input_tokens": outcome.input_tokens,
                 "output_tokens": outcome.output_tokens,
+                "cache_read_tokens": outcome.cache_read_tokens,
             },
             actor=KPIActor(type="human", user_id=user_id),
         )
@@ -3409,6 +3440,7 @@ def _capability_route_base_url(base_url: str, capability_id: str) -> str:
 def _build_agent_router(
     registry: Mapping[str, ReActAgentDefinition | GraphAgentDefinition],
     security_enabled: bool,
+    max_chat_input_chars: int,
     base_url: str = "",
 ) -> APIRouter:
     """
@@ -3433,6 +3465,14 @@ def _build_agent_router(
     # Returns None in local-dev mode so dev pods start without Keycloak.
     _authenticated_user = _make_user_dependency(get_current_user, security_enabled)
 
+    def _enforce_chat_input_limit(request: RuntimeExecuteRequest) -> None:
+        violation = validate_runtime_request(request, max_chat_input_chars)
+        if violation is not None:
+            raise HTTPException(
+                status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+                detail=violation.native_detail(),
+            )
+
     @router.get("")
     async def list_agents() -> list[str]:
         """Return the agent IDs registered in this pod."""
@@ -3567,6 +3607,7 @@ def _build_agent_router(
                 default_capability_ids=[
                     ref.id for ref in definition.default_mcp_servers
                 ],
+                max_chat_input_chars=max_chat_input_chars,
             )
             for definition in registry.values()
             if include_non_public or getattr(definition, "public", True)
@@ -4262,6 +4303,7 @@ def _build_agent_router(
         - This endpoint does not implement pod discovery or routing.
           Those concerns belong to Kubernetes Service, Ingress, and Argo CD.
         """
+        _enforce_chat_input_limit(request)
         auth = http_request.headers.get("Authorization", "")
         access_token = auth.removeprefix("Bearer ").strip() or None
 
@@ -4347,6 +4389,7 @@ def _build_agent_router(
         Intended for evaluation harnesses (DeepEval, Promptfoo) that need
         input, output, retrieval_context, tools_called, and steps in one response.
         """
+        _enforce_chat_input_limit(request)
         auth = http_request.headers.get("Authorization", "")
         access_token = auth.removeprefix("Bearer ").strip() or None
 
@@ -4458,6 +4501,7 @@ def _build_agent_router(
         - This endpoint does not implement pod discovery or routing.
           Those concerns belong to Kubernetes Service, Ingress, and Argo CD.
         """
+        _enforce_chat_input_limit(request)
         auth = http_request.headers.get("Authorization", "")
         access_token = auth.removeprefix("Bearer ").strip() or None
 
@@ -4682,9 +4726,32 @@ def create_agent_app(
             "prometheus" if config.observability.kpi.prometheus.enabled else "logging",
             list(registry.keys()),
         )
-        yield
-        await gc_diagnostics.stop()
-        await container.shutdown()
+        try:
+            yield
+        finally:
+            # Shutdown must RUN and must COMPLETE.
+            # - `finally`: a plain sequence after `yield` is skipped entirely
+            #   when an exception propagates out of the app through the
+            #   generator, which is exactly the case where releasing sockets
+            #   and stopping tasks matters most.
+            # - per-step guard: these three release INDEPENDENT resources, so a
+            #   raising `container.shutdown()` must not strand the Keycloak
+            #   refresh pool behind it. The pod is going away either way;
+            #   losing a connection pool because an unrelated subsystem failed
+            #   is strictly worse than logging both failures.
+            # `except Exception` deliberately lets `CancelledError` through —
+            # a shutdown being cancelled is not a step failing.
+            for label, close in (
+                ("gc diagnostics", gc_diagnostics.stop),
+                ("pod container", container.shutdown),
+                # Release the Keycloak refresh pool deterministically rather
+                # than leaving it to GC, as the control-plane client above is.
+                ("keycloak refresh pool", aclose_token_refresh_client),
+            ):
+                try:
+                    await close()
+                except Exception:
+                    logger.exception("[fred-runtime] shutdown step failed: %s", label)
 
     app = FastAPI(
         title=config.app.name,
@@ -4717,7 +4784,10 @@ def create_agent_app(
     api_router = APIRouter(prefix=base_url)
     api_router.include_router(
         _build_agent_router(
-            registry, security_enabled=security_enabled, base_url=base_url
+            registry,
+            security_enabled=security_enabled,
+            max_chat_input_chars=config.app.max_chat_input_chars,
+            base_url=base_url,
         )
     )
 
@@ -4747,6 +4817,7 @@ def create_agent_app(
         openai_router = create_openai_compat_router(
             registry,
             security_enabled=security_enabled,
+            max_chat_input_chars=config.app.max_chat_input_chars,
         )
         app.include_router(openai_router, prefix="/v1")
         logger.info("[fred-runtime] OpenAI-compat endpoints enabled at /v1")

fred_runtime-3.4.5/fred_runtime/app/chat_input_limit.py

@@ -0,0 +1,109 @@
+# Copyright Thales 2026
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Field-aware chat-input length validation shared by runtime HTTP surfaces."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from dataclasses import dataclass
+from typing import Any
+
+from fred_sdk.contracts.execution import RuntimeExecuteRequest
+
+CHAT_INPUT_TOO_LONG_CODE = "chat_input_too_long"
+_HITL_TEXT_FIELDS = ("choice_id", "answer", "text")
+
+
+@dataclass(frozen=True, slots=True)
+class ChatInputTooLong:
+    """Safe error data for an oversized submitted message.
+
+    The rejected text is deliberately not retained on this object, so logging
+    or serializing the validation result cannot accidentally echo user content.
+    """
+
+    limit_chars: int
+    actual_chars: int
+
+    @property
+    def message(self) -> str:
+        return f"Your message exceeds the {self.limit_chars:,}-character limit."
+
+    def native_detail(self) -> dict[str, str | int]:
+        """Return the Fred-native ``HTTPException.detail`` payload."""
+
+        return {
+            "code": CHAT_INPUT_TOO_LONG_CODE,
+            "message": self.message,
+            "limit_chars": self.limit_chars,
+            "actual_chars": self.actual_chars,
+        }
+
+    def openai_error(self) -> dict[str, str | int]:
+        """Return the OpenAI-compatible ``error`` object."""
+
+        return {
+            "message": self.message,
+            "type": "invalid_request_error",
+            "param": "messages",
+            "code": CHAT_INPUT_TOO_LONG_CODE,
+            "limit_chars": self.limit_chars,
+            "actual_chars": self.actual_chars,
+        }
+
+
+def validate_chat_text(text: str, max_chars: int) -> ChatInputTooLong | None:
+    """Validate one string using Python's Unicode-code-point semantics."""
+
+    actual_chars = len(text)
+    if actual_chars <= max_chars:
+        return None
+    return ChatInputTooLong(limit_chars=max_chars, actual_chars=actual_chars)
+
+
+def runtime_request_chat_char_count(request: RuntimeExecuteRequest) -> int:
+    """Count the user-authored chat text that this runtime request submits.
+
+    Ordinary turns count ``input``. A HITL resume counts a bare string or the
+    combined string values of the canonical ``choice_id``, ``answer``, and
+    ``text`` fields. Values are summed per field without deduplication: callers
+    may use either ``choice_id`` or ``answer`` for a selection, and managed chat
+    currently mirrors the identifier in both. Arbitrary JSON keys are
+    intentionally not traversed.
+    """
+
+    resume_payload: Any = request.resume_payload
+    if resume_payload is None:
+        return len(request.input)
+    if isinstance(resume_payload, str):
+        return len(resume_payload)
+    if isinstance(resume_payload, Mapping):
+        return sum(
+            len(value)
+            for key in _HITL_TEXT_FIELDS
+            if isinstance((value := resume_payload.get(key)), str)
+        )
+    return 0
+
+
+def validate_runtime_request(
+    request: RuntimeExecuteRequest,
+    max_chars: int,
+) -> ChatInputTooLong | None:
+    """Validate the effective ordinary-turn or HITL text in one request."""
+
+    actual_chars = runtime_request_chat_char_count(request)
+    if actual_chars <= max_chars:
+        return None
+    return ChatInputTooLong(limit_chars=max_chars, actual_chars=actual_chars)

{fred_runtime-3.4.4 → fred_runtime-3.4.5}/fred_runtime/app/config.py

@@ -120,6 +120,14 @@ class PodAppConfig(BaseModel):
             "limit."
         ),
     )
+    max_chat_input_chars: int = Field(
+        default=5_000,
+        ge=1,
+        description=(
+            "Maximum number of Unicode code points accepted in one submitted "
+            "chat message, including supported HITL resume text fields."
+        ),
+    )
     gcu_version: str | None = None
     openai_compat: bool = False
     """

{fred_runtime-3.4.4 → fred_runtime-3.4.5}/fred_runtime/app/context.py

@@ -52,6 +52,12 @@ _CONTROL_PLANE_CLIENT_LIMITS = httpx.Limits(
 # attempt hang well past what a readiness-driven operator expects.
 _SQL_BOOT_PING_TIMEOUT_S = 5.0
 
+# Schema ownership: fred-runtime's Alembic tree creates `session_history` and
+# stamps `alembic_version_runtime`; no store creates tables at runtime (#2290).
+# This is the exact command the Helm migration hook and `make db-upgrade` run.
+_MIGRATE_COMMAND = "python -m fred_runtime migrate"
+_RUNTIME_VERSION_TABLE = "alembic_version_runtime"
+
 
 # ---------------------------------------------------------------------------
 # TypedDicts for ring buffer entries
@@ -151,13 +157,15 @@ class PodApplicationContext:
         Durable storage is mandatory for every fred-runtime pod — dev uses a
         local SQLite file (`sqlite_path`), production uses Postgres, but both
         are "durable", never "no storage". Any failure here (bad config,
-        unreachable/misconfigured Postgres) must abort pod startup so the
-        FastAPI lifespan never completes and Kubernetes never routes traffic
-        to this replica — see RUNTIME-EXECUTION-CONTRACT.md §8 (dated entry)
-        for the incident this closes.
+        unreachable/misconfigured Postgres, unmigrated schema) must abort pod
+        startup so the FastAPI lifespan never completes and Kubernetes never
+        routes traffic to this replica — see RUNTIME-EXECUTION-CONTRACT.md §8
+        (dated entries) for the incidents this closes.
         """
+        from fred_core.history.history_models import SessionHistoryRow
         from fred_core.history.postgres_history_store import PostgresHistoryStore
         from fred_core.sql.base_sql import create_async_engine_from_config
+        from fred_core.sql.schema_guard import require_tables
         from fred_core.users.store.postgres_user_store import init_user_store
         from sqlalchemy import text
 
@@ -194,6 +202,23 @@ class PodApplicationContext:
             await engine.dispose()
             raise
 
+        try:
+            # Startup-only (never on a read/write path): the history store no
+            # longer creates its own tables — Alembic owns that DDL (#2290) —
+            # so an install that skipped its migration job must be caught here,
+            # not hours later as an UndefinedTableError mid-turn (#2137).
+            await require_tables(
+                engine,
+                [SessionHistoryRow.__tablename__],
+                component="fred-runtime",
+                migrate_command=_MIGRATE_COMMAND,
+                version_table=_RUNTIME_VERSION_TABLE,
+            )
+        except Exception:
+            # Same leak-on-failure reasoning as the ping path above.
+            await engine.dispose()
+            raise
+
         init_user_store(engine)
         checkpointer = FredSqlCheckpointer(engine, kpi=self.get_kpi_writer())
         history_store = PostgresHistoryStore(engine, kpi=self.get_kpi_writer())

{fred_runtime-3.4.4 → fred_runtime-3.4.5}/fred_runtime/app/openai_compat_router.py

@@ -49,8 +49,8 @@ from collections.abc import AsyncIterator, Mapping
 from typing import Any, Callable
 from uuid import uuid4
 
-from fastapi import APIRouter, Depends, HTTPException, Request, status
-from fastapi.responses import StreamingResponse
+from fastapi import APIRouter, Depends, HTTPException, Request, Response, status
+from fastapi.responses import JSONResponse, StreamingResponse
 from fred_core import AuthorizationError, KeycloakUser, TeamPermission
 from fred_sdk.contracts.models import GraphAgentDefinition, ReActAgentDefinition
 from fred_sdk.contracts.openai_compat import (
@@ -67,6 +67,7 @@ from .agent_app import (
     _iterate_runtime_event_payloads,
     _resolve_agent_instance,
 )
+from .chat_input_limit import validate_chat_text
 from .dependencies import get_pod_container_from_app
 
 logger = logging.getLogger(__name__)
@@ -75,6 +76,7 @@ logger = logging.getLogger(__name__)
 def create_openai_compat_router(
     registry: Mapping[str, ReActAgentDefinition | GraphAgentDefinition],
     security_enabled: bool,
+    max_chat_input_chars: int,
     authenticated_user_dep: Callable[..., Any] | None = None,
 ) -> APIRouter:
     """
@@ -141,7 +143,7 @@ def create_openai_compat_router(
         request: OpenAIChatRequest,
         http_request: Request,
         authenticated_user: KeycloakUser | None = Depends(user_dep),
-    ) -> StreamingResponse:
+    ) -> Response:
         """
         Execute one agent turn over the OpenAI chat completions SSE protocol.
 
@@ -164,6 +166,20 @@ def create_openai_compat_router(
         - `fred.node_error`: graph node error message (finish_reason="stop")
         - `fred.token_usage`: input/output token counts (on the final chunk)
         """
+        user_messages = [m for m in request.messages if m.role == "user"]
+        if not user_messages:
+            raise HTTPException(
+                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+                detail="Request must contain at least one user message.",
+            )
+        message = user_messages[-1].content
+        violation = validate_chat_text(message, max_chat_input_chars)
+        if violation is not None:
+            return JSONResponse(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                content={"error": violation.openai_error()},
+            )
+
         if request.model not in registry:
             raise HTTPException(
                 status_code=status.HTTP_404_NOT_FOUND,
@@ -173,14 +189,6 @@ def create_openai_compat_router(
                 ),
             )
 
-        user_messages = [m for m in request.messages if m.role == "user"]
-        if not user_messages:
-            raise HTTPException(
-                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
-                detail="Request must contain at least one user message.",
-            )
-        message = user_messages[-1].content
-
         session_id = http_request.headers.get("X-Fred-Session-Id") or uuid4().hex
         team_id = http_request.headers.get("X-Fred-Team-Id")
         auth = http_request.headers.get("Authorization", "")