fix: admin show, network status, and content validation

Surfaced by a manual run of the CLI test plan against the latest
release.

- `admin agent show` now always prints an allowlist row — count + entries
  when populated, "(empty)" otherwise — instead of dropping the line for
  empty allowlists.
- `network status` when not running uses the same key-value format as
  the running case (`running: false`, `network: …`) instead of a
  free-text "is not running" message.
- POST /sessions/:id/messages and parseInitialMessage now reject empty
  string, empty array, and empty TextPart with 400 INVALID_CONTENT,
  matching the tightened ASP Content schema (asp@HEAD).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: nrcrews

src/commands/admin.ts

@@ -362,9 +362,13 @@ function renderLocalAgent(agent: AgentWire | AgentWithTokenWire): void {
   if ("token" in agent && typeof agent.token === "string") {
     out(`  ${"token".padEnd(pad)} ${agent.token}`);
   }
-  if (agent.allowlist.length > 0) {
-    out(`  ${"allowlist".padEnd(pad)} ${[...agent.allowlist].join(", ")}`);
-  }
+  out(
+    `  ${"allowlist".padEnd(pad)} ${
+      agent.allowlist.length === 0
+        ? "(empty)"
+        : `${agent.allowlist.length} — ${[...agent.allowlist].join(", ")}`
+    }`,
+  );
   if (agent.card_body !== null && agent.card_body.length > 0) {
     out("  card");
     for (const line of agent.card_body.split("\n")) {

src/commands/network.ts

@@ -96,7 +96,12 @@ export function registerNetworkCommand(program: Command): void {
         if (opts.json) {
           console.log(renderJson(payload));
         } else {
-          console.log(`Network "${config.network.name}" is not running.`);
+          console.log(
+            renderKeyValues(
+              profileTitle("Local operator status", config),
+              payload,
+            ),
+          );
         }
         return;
       }

src/operator/routes/sessions.ts

@@ -78,10 +78,7 @@ export function registerSessionRoutes(router: Router, ctx: SessionRoutesContext)
   router.add("POST", "/sessions/:id/messages", async (rc) => {
     const agent = requireAgent(rc.req, ctx.repo.agents);
     const body = await parseJsonBody(rc.req);
-    const content = body.content;
-    if (content === undefined || content === null) {
-      throw new BadRequestError("content is required", "INVALID_CONTENT");
-    }
+    const content = requireNonEmptyContent(body.content, "content");
     const idempotencyKey = parseOptionalString(body.idempotency_key, "idempotency_key");
     const metadata = parseOptionalObject(body.metadata, "metadata");
     const result = ctx.service.sendMessage({
@@ -182,16 +179,53 @@ function parseInitialMessage(raw: unknown): { readonly content: unknown; readonl
     );
   }
   const o = raw as Record<string, unknown>;
-  if (o.content === undefined) {
-    throw new BadRequestError(
-      "initial_message.content is required",
-      "INVALID_REQUEST",
-    );
-  }
+  const content = requireNonEmptyContent(o.content, "initial_message.content");
   const metadata = parseOptionalObject(o.metadata, "initial_message.metadata");
   return metadata === undefined
-    ? { content: o.content }
-    : { content: o.content, metadata };
+    ? { content }
+    : { content, metadata };
+}
+
+function requireNonEmptyContent(raw: unknown, field: string): unknown {
+  // Mirrors the ASP schema (common.json#/$defs/Content): empty payloads
+  // are rejected. String form `minLength: 1`, array form `minItems: 1`,
+  // and `TextPart.text` is itself `minLength: 1`.
+  if (raw === undefined || raw === null) {
+    throw new BadRequestError(`${field} is required`, "INVALID_CONTENT");
+  }
+  if (typeof raw === "string") {
+    if (raw.length === 0) {
+      throw new BadRequestError(`${field} must not be empty`, "INVALID_CONTENT");
+    }
+    return raw;
+  }
+  if (Array.isArray(raw)) {
+    if (raw.length === 0) {
+      throw new BadRequestError(
+        `${field} must contain at least one part`,
+        "INVALID_CONTENT",
+      );
+    }
+    for (const part of raw) {
+      if (
+        typeof part === "object" &&
+        part !== null &&
+        (part as { type?: unknown }).type === "text" &&
+        typeof (part as { text?: unknown }).text === "string" &&
+        ((part as { text: string }).text.length === 0)
+      ) {
+        throw new BadRequestError(
+          `${field} text part must not be empty`,
+          "INVALID_CONTENT",
+        );
+      }
+    }
+    return raw;
+  }
+  throw new BadRequestError(
+    `${field} must be a string or an array of parts`,
+    "INVALID_CONTENT",
+  );
 }
 
 function parseAfterSequence(url: URL): number {

tests/operator-sessions.test.ts

@@ -447,6 +447,32 @@ describe("operator sessions — join + send_message", () => {
     assert.equal(r2.message_id, r1.message_id);
     assert.equal(r2.sequence, r1.sequence);
   });
+
+  it("rejects empty content with 400 INVALID_CONTENT", async () => {
+    await adminRegister(h, "@alice.bot");
+
+    const create = await fetch(`${h.baseUrl}/sessions`, {
+      method: "POST",
+      headers: agentHeaders(h, "@alice.bot"),
+      body: JSON.stringify({ invite: [] }),
+    });
+    const { session_id } = (await create.json()) as { session_id: string };
+
+    const cases: { name: string; body: unknown }[] = [
+      { name: "empty string", body: { content: "" } },
+      { name: "empty array", body: { content: [] } },
+    ];
+    for (const { name, body } of cases) {
+      const res = await fetch(`${h.baseUrl}/sessions/${session_id}/messages`, {
+        method: "POST",
+        headers: agentHeaders(h, "@alice.bot"),
+        body: JSON.stringify(body),
+      });
+      assert.equal(res.status, 400, `${name}: expected 400`);
+      const err = (await res.json()) as { error?: { code?: string } };
+      assert.equal(err.error?.code, "INVALID_CONTENT", `${name}: error code`);
+    }
+  });
 });
 
 describe("operator sessions — leave + end + history", () => {