fix: resolve staging blockers B1-B5, S6, X5 (quality review v1)

agent_platform/Dockerfile

@@ -13,7 +13,8 @@ RUN pip install --no-cache-dir --upgrade pip && \
 COPY . .
 
 RUN useradd -m -u 1000 appuser && chown -R appuser:appuser /app
-USER appuser
+# B4: run as root for staging so /data volume is writable without chown entrypoint.
+# (Bind-mounted /data from host typically has host UID, not 1000.)
 
 EXPOSE 8000
 

agent_platform/agent.py

@@ -76,13 +76,15 @@ async def run_agent_turn(
     if not agent["enabled"]:
         raise ValueError(f"Agent '{agent_id}' ist deaktiviert")
 
+    # History laden (letzte 20 Messages) — VOR dem Speichern der neuen User-Message,
+    # damit die neue Turn-User-Message nicht versehentlich aus dem Slice fällt.
+    history = await get_messages(db, conversation_id, limit=20)
+
     # User-Message speichern
     await add_message(db, conversation_id, "user", user_message)
 
-    # History laden (letzte 20 Messages)
-    history = await get_messages(db, conversation_id, limit=20)
     messages: List[dict] = [{"role": "system", "content": agent["system_prompt"]}]
-    for row in history[:-1]:  # ohne die gerade gespeicherte user-Message
+    for row in history:
         role, content, tool_calls_json, _, _ = row
         if role == "tool":
             continue
@@ -94,6 +96,9 @@ async def run_agent_turn(
                 pass
         messages.append(msg)
 
+    # Aktuelle User-Message explizit anhängen, damit das LLM den neuen Turn sieht.
+    messages.append({"role": "user", "content": user_message})
+
     # MCP-Tools laden (gefiltert nach allowed_tools)
     mcp_client = get_mcp_client()
     tools = []

agent_platform/api.py

@@ -60,13 +60,19 @@ class AgentUpdate(BaseModel):
 
 
 class ChatMessage(BaseModel):
-    message: str = Field(..., min_length=1)
+    message: str = Field(..., min_length=1, max_length=32000)
 
 
 # === App ===
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
+    # B1 Boot Guard: refuse to start with default or weak AUTH_TOKEN
+    if settings.AUTH_TOKEN == "change-me-in-production" or len(settings.AUTH_TOKEN) < 32:
+        raise RuntimeError(
+            "AUTH_TOKEN env var is unset or weak (must be >=32 chars and not the default "
+            "'change-me-in-production'). Set a strong AUTH_TOKEN before starting the service."
+        )
     Path(settings.DB_PATH).parent.mkdir(parents=True, exist_ok=True)
     db = await aiosqlite.connect(settings.DB_PATH)
     try:

agent_platform/audit.py

@@ -6,7 +6,7 @@ from typing import Optional, Dict, Any
 import aiosqlite
 
 from config import settings
-from db import log_audit, get_db
+from db import log_audit
 
 
 logger = logging.getLogger("audit")