fix(subagent): validate direct depth boundaries

packages/subagent/subagent/README.md

@@ -19,6 +19,7 @@ Unlike the bash seam (one executor per context, second load throws), **multiple
 | Member | Semantics |
 |---|---|
 | `registerProvider(provider)` | Read and validate the name, capability object and four boolean flags, `inheritsParentContext`, and `start` callback exactly once, then register a frozen acceptance snapshot under the accepted name. Malformed fixed fields fail loud before registration; later caller mutation cannot change registry behavior or HMR cleanup, while `start` stays bound to the original provider receiver. Throws `SubagentError('DUPLICATE_PROVIDER')` on a name clash. Effect-scoped (HMR-safe); returns the disposer. |
+| `assertSubagentMaxDepth(value)` | Shared runtime boundary for recursion caps. Accepts absence or a non-negative safe integer; rejects fractions, non-finite numbers, negative values, negative zero, and unsafe integers. The service, direct in-process driver, and model-facing config adapter all use it. |
 | `getProvider(name)` | Look up the frozen registry snapshot (`undefined` if absent). |
 | `list()` | Registered provider names (insertion order). |
 | `start(name, request)` | Resolve the provider (`NO_PROVIDER` if absent), read every caller field once into one acceptance snapshot, validate every requested START-TIME capability and scalar value before any child is created, and materialize prompt/schema/options/filter data through a single-pass lossless-JSON snapshot before delegating to `provider.start`. Acquire the provider run's disposer before reading the rest of its handle, then return a frozen service-owned wrapper whose fields are captured once, whose methods remain bound to the provider handle, and whose `result` is one detached, deeply frozen normalization shared by the caller and telemetry. The wrapper claims its shared disposal promise before invoking raw provider code, so synchronous reentry and ordinary repeats join one provider call; a raw disposer that directly returns that same reentrant wrapper promise is rejected as a cyclic provider contract instead of hanging forever. Malformed handle access/binding starts rollback before the synchronous fault escapes; malformed terminal data rejects only after rollback reaches quiescence. Emit `subagent/start` only after `run.started` fulfills and the paired `subagent/end` after that started run settles; a pre-publication readiness rejection emits neither. |

packages/subagent/subagent/src/index.ts

@@ -58,6 +58,25 @@ export type {
   SubagentStopReasonMap,
 } from './types.ts'
 
+/**
+ * Reject a recursion cap that cannot represent an exact delegation depth.
+ * Undefined means the caller did not request a cap and is accepted. The
+ * service, direct in-process driver, and model-facing config adapter share this
+ * boundary so no entry path can turn a fractional or non-finite value into an
+ * ineffective limit.
+ * @param maxDepth - the optional runtime value to validate.
+ */
+export function assertSubagentMaxDepth(maxDepth: unknown): void {
+  if (maxDepth !== undefined && (
+    typeof maxDepth !== 'number'
+    || !Number.isSafeInteger(maxDepth)
+    || maxDepth < 0
+    || Object.is(maxDepth, -0)
+  )) {
+    throw new TypeError('subagent maxDepth must be a non-negative safe integer')
+  }
+}
+
 declare module 'cordis' {
   interface Context {
     subagents: SubagentService
@@ -309,13 +328,7 @@ export class SubagentService extends Service {
     const input = this.snapshotStartRequest(request)
     const parent = input.parent
     this.assertCapabilities(provider, input)
-    if (input.maxDepth !== undefined && (
-      !Number.isSafeInteger(input.maxDepth)
-      || input.maxDepth < 0
-      || Object.is(input.maxDepth, -0)
-    )) {
-      throw new TypeError('subagent maxDepth must be a non-negative safe integer')
-    }
+    assertSubagentMaxDepth(input.maxDepth)
     if (input.persona !== undefined && typeof input.persona !== 'string') {
       throw new TypeError('subagent persona must be a string')
     }

packages/subagent/subagent/src/types.ts

@@ -69,8 +69,9 @@ export interface SubagentStartRequest {
    */
   outputSchema?: StructuredOutputSchema
   /**
-   * Optional recursion cap (max delegation depth below this child). Requires
-   * {@link SubagentCapabilities.depthLimit}; rejected at start otherwise.
+   * Optional recursion cap (max delegation depth below this child). Must be a
+   * non-negative safe integer. Requires {@link SubagentCapabilities.depthLimit};
+   * rejected at start otherwise.
    */
   maxDepth?: number
   /**

packages/subagent/subagent/tests/service.spec.ts

@@ -431,10 +431,14 @@ describe('SubagentService', () => {
     })
 
     it.each([
+      { label: 'a string', value: '1' as unknown as number },
       { label: 'NaN', value: Number.NaN },
+      { label: 'positive infinity', value: Number.POSITIVE_INFINITY },
+      { label: 'negative infinity', value: Number.NEGATIVE_INFINITY },
       { label: 'a fraction', value: 1.5 },
       { label: 'a negative integer', value: -1 },
       { label: 'negative zero', value: -0 },
+      { label: 'an unsafe integer', value: Number.MAX_SAFE_INTEGER + 1 },
     ])('rejects maxDepth=$label before the provider starts', async ({ value }) => {
       const ctx = new Context()
       await ctx.plugin(SubagentService)