daemon: tighten run-source validation; drop fork gate scripts (#7040 review)

- attachments entries must be objects; pluginId must be an installed plugin
- specs for malformed source fields
- remove bin/gate.sh + scripts/gate-tests.sh (fork-internal gate entrypoints,
  out of scope for this repo)

Author: Val

apps/daemon/src/routes/runs.ts

@@ -1246,10 +1246,15 @@ export function registerRunRoutes(app: Express, ctx: RegisterRunRoutesDeps) {
     const hasPrompt =
       (typeof requestBody.message === 'string' && requestBody.message.trim().length > 0)
       || (typeof requestBody.currentPrompt === 'string' && requestBody.currentPrompt.trim().length > 0);
-    const hasAttachments = Array.isArray(requestBody.attachments) && requestBody.attachments.length > 0;
+    const hasAttachments = Array.isArray(requestBody.attachments)
+      && requestBody.attachments.length > 0
+      && requestBody.attachments.every((entry) => entry !== null && typeof entry === 'object');
     const hasPluginBriefSource =
-      (typeof requestBody.pluginId === 'string' && requestBody.pluginId.length > 0)
-      || (typeof requestBody.appliedPluginSnapshotId === 'string' && requestBody.appliedPluginSnapshotId.length > 0);
+      (typeof requestBody.pluginId === 'string'
+        && requestBody.pluginId.length > 0
+        && Boolean(getInstalledPlugin(db, requestBody.pluginId)))
+      || (typeof requestBody.appliedPluginSnapshotId === 'string'
+        && requestBody.appliedPluginSnapshotId.length > 0);
     if (!hasPrompt && !hasAttachments && !hasPluginBriefSource) {
       return sendApiError(
         res,

apps/daemon/tests/run-create-validation.test.ts

@@ -38,6 +38,23 @@ describe('run creation input validation (#7040)', () => {
     expect(resp.status).toBe(400);
   });
 
+  it('rejects malformed source fields', async () => {
+    const cases = [
+      { message: {} },
+      { message: 42 },
+      { attachments: [null, 42] },
+      { pluginId: 'definitely-not-installed' },
+    ];
+    for (const body of cases) {
+      const resp = await fetch(baseUrl + '/api/runs', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      });
+      expect(resp.status, JSON.stringify(body)).toBe(400);
+    }
+  });
+
   it('still accepts a normal prompt', async () => {
     const resp = await fetch(baseUrl + '/api/runs', {
       method: 'POST',