fix(agent,lua,storage,ui): harden agent spawn and session recursion

changelog.d/327.fixed.md

@@ -0,0 +1 @@
+Hardened agent spawn recursion and session lineage handling to prevent runaway subagent loops.

n00n-agent/src/agent/run.rs

@@ -355,6 +355,23 @@ impl<'h> Agent<'h> {
         self.total_cost
     }
 
+    pub async fn run_tool(&self, id: String, name: &str, input: &Value) -> ToolDoneEvent {
+        let ctx = self.tool_context();
+        let done = tool_dispatch::run(
+            &self.registry,
+            self.mcp.as_ref(),
+            id,
+            name,
+            input,
+            &ctx,
+            tool_dispatch::Emit::Notify,
+        )
+        .await;
+        self.event_tx
+            .try_send(AgentEvent::ToolDone(Box::new(done.clone())));
+        done
+    }
+
     /// Runs the agent loop with the given input.
     ///
     /// # Errors
@@ -2069,6 +2086,18 @@ mod tests {
         (agent, event_rx)
     }
 
+    #[test]
+    fn tool_context_preserves_agent_session_identity() {
+        let mut history = History::new(Vec::new());
+        let (mut agent, _event_rx) = make_agent(MockProvider::new(Vec::new()), &mut history);
+        let identity = SessionIdentity::root(SessionRef::generate());
+        agent.identity = Some(identity.clone());
+
+        let ctx = agent.tool_context();
+
+        assert_eq!(ctx.identity, Some(identity));
+    }
+
     fn make_agent_with_config(
         provider: MockProvider,
         history: &mut History,

n00n-config/src/lib.rs

@@ -27,6 +27,9 @@ pub const MIN_MAX_INPUT_LINES: u32 = 1;
 pub const DEFAULT_MCP_TOOL_DESC_MAX_CHARS: usize = 200;
 
 pub const DEFAULT_MAX_CONTINUATION_TURNS: u32 = 3;
+pub const DEFAULT_MAX_DEPTH: usize = 4;
+pub const DEFAULT_MAX_TOTAL_DESCENDANTS: usize = 16;
+pub const DEFAULT_MAX_ACTIVE_DESCENDANTS: usize = 8;
 pub const DEFAULT_COMPACTION_BUFFER: CompactionBuffer = CompactionBuffer::Percent(20);
 
 pub const DEFAULT_CONNECT_TIMEOUT_SECS: u64 = 10;
@@ -42,6 +45,9 @@ pub const DEFAULT_INPUT_HISTORY_SIZE: usize = 100;
 pub const MIN_OUTPUT_BYTES: usize = 1024;
 pub const MIN_OUTPUT_LINES: usize = 10;
 pub const MIN_MAX_CONTINUATION_TURNS: u32 = 1;
+pub const MIN_MAX_DEPTH: usize = 1;
+pub const MIN_MAX_TOTAL_DESCENDANTS: usize = 1;
+pub const MIN_MAX_ACTIVE_DESCENDANTS: usize = 1;
 pub const MIN_COMPACTION_BUFFER: u32 = 1_000;
 const MAX_COMPACTION_PERCENT: u8 = 99;
 const COMPACTION_BUFFER_EXPECTED: &str =
@@ -190,6 +196,16 @@ pub enum ConfigError {
         "invalid config: agent.fusion.sidekick_tier must be weak, medium, or strong, got {tier:?}"
     )]
     InvalidFusionSidekickTier { tier: crate::providers::Tier },
+    #[error(
+        "invalid config: agent lineage limits require max_depth <= max_total_descendants and \
+         max_active_descendants <= max_total_descendants (got max_depth={max_depth}, \
+         max_total_descendants={max_total_descendants}, max_active_descendants={max_active_descendants})"
+    )]
+    InvalidLineageLimits {
+        max_depth: usize,
+        max_total_descendants: usize,
+        max_active_descendants: usize,
+    },
 }
 
 fn check(
@@ -491,6 +507,9 @@ pub struct AgentFileConfig {
     pub max_output_bytes: Option<usize>,
     pub max_output_lines: Option<usize>,
     pub max_continuation_turns: Option<u32>,
+    pub max_depth: Option<usize>,
+    pub max_total_descendants: Option<usize>,
+    pub max_active_descendants: Option<usize>,
     pub compaction_buffer: Option<CompactionBuffer>,
     pub mcp_tool_desc_max_chars: Option<usize>,
     pub dynamic_tools: Option<DynamicToolFileConfig>,
@@ -519,6 +538,9 @@ impl AgentFileConfig {
             max_output_bytes,
             max_output_lines,
             max_continuation_turns,
+            max_depth,
+            max_total_descendants,
+            max_active_descendants,
             compaction_buffer,
             mcp_tool_desc_max_chars
         );
@@ -1094,6 +1116,15 @@ pub struct AgentConfig {
     #[config(default = DEFAULT_MAX_CONTINUATION_TURNS, min = MIN_MAX_CONTINUATION_TURNS, desc = "Max automatic continuation turns")]
     pub max_continuation_turns: u32,
 
+    #[config(default = DEFAULT_MAX_DEPTH, min = MIN_MAX_DEPTH, desc = "Maximum session lineage depth")]
+    pub max_depth: usize,
+
+    #[config(default = DEFAULT_MAX_TOTAL_DESCENDANTS, min = MIN_MAX_TOTAL_DESCENDANTS, desc = "Maximum total descendants per session lineage root")]
+    pub max_total_descendants: usize,
+
+    #[config(default = DEFAULT_MAX_ACTIVE_DESCENDANTS, min = MIN_MAX_ACTIVE_DESCENDANTS, desc = "Maximum active descendants per session lineage root")]
+    pub max_active_descendants: usize,
+
     #[config(default = DEFAULT_COMPACTION_BUFFER, ty = "u32 | string", default_doc = "20%", desc = "Context reserved for compaction: token count or percent of the context window (e.g. \"20%\")")]
     pub compaction_buffer: CompactionBuffer,
 
@@ -1194,6 +1225,13 @@ impl AgentConfig {
             max_continuation_turns: file
                 .max_continuation_turns
                 .unwrap_or_else(|| DEFAULT_MAX_CONTINUATION_TURNS),
+            max_depth: file.max_depth.unwrap_or_else(|| DEFAULT_MAX_DEPTH),
+            max_total_descendants: file
+                .max_total_descendants
+                .unwrap_or_else(|| DEFAULT_MAX_TOTAL_DESCENDANTS),
+            max_active_descendants: file
+                .max_active_descendants
+                .unwrap_or_else(|| DEFAULT_MAX_ACTIVE_DESCENDANTS),
             compaction_buffer: file
                 .compaction_buffer
                 .unwrap_or_else(|| DEFAULT_COMPACTION_BUFFER),
@@ -1207,6 +1245,19 @@ impl AgentConfig {
             fusion,
         }
     }
+
+    fn validate_lineage_limits(&self) -> Result<(), ConfigError> {
+        if self.max_depth > self.max_total_descendants
+            || self.max_active_descendants > self.max_total_descendants
+        {
+            return Err(ConfigError::InvalidLineageLimits {
+                max_depth: self.max_depth,
+                max_total_descendants: self.max_total_descendants,
+                max_active_descendants: self.max_active_descendants,
+            });
+        }
+        Ok(())
+    }
 }
 
 #[derive(Debug, Clone, ConfigSection)]
@@ -1381,6 +1432,7 @@ impl Config {
     pub fn validate(&self) -> Result<(), ConfigError> {
         self.ui.validate_all()?;
         self.agent.validate()?;
+        self.agent.validate_lineage_limits()?;
         self.provider.validate()?;
         self.provider.validate_openai_coding_plan_slots()?;
         if self.agent.fusion.sidekick_tier == crate::providers::Tier::Compaction {

n00n-lua/src/api/agent.rs

@@ -596,6 +596,7 @@ async fn call_tool(
         on_buf,
         on_ann,
     };
+    let _nested_dispatch = crate::api::tool::enter_nested_dispatch();
     let done = dispatch_racing_live(&tctx, &name, &input_json, rx, &cbs).await;
     // Same fallback the UI applies on tool completion, so a batch child's
     // header carries the annotation its standalone run would get.
@@ -661,11 +662,6 @@ async fn session(
     opts: Table,
 ) -> LuaResult<Pair<mlua::AnyUserData>> {
     let agent_ctx = try_pair!(dispatch_ctx(&ctx, "session")).clone();
-    let Some(parent_identity) = agent_ctx.identity.clone() else {
-        return Ok(err_pair("session identity is unavailable"));
-    };
-    let plugin_state_store = try_pair!(ctx.plugin_state_store());
-    drop(ctx);
     let model_spec: Option<String> = opts.get("model_spec")?;
     let system: Option<String> = opts.get("system")?;
     let tools_val: Option<LuaValue> = opts.get("tools")?;
@@ -800,6 +796,12 @@ async fn session(
         None => agent_ctx.opts.thinking,
     };
 
+    let Some(parent_identity) = agent_ctx.identity.clone() else {
+        return Ok(err_pair("session identity is unavailable"));
+    };
+    let plugin_state_store = try_pair!(ctx.plugin_state_store());
+    drop(ctx);
+
     let session_id = n00nId::generate();
     let child_id = session_id.to_string();
     let parent_tool_use_id = child_id.clone();

n00n-lua/src/api/async.rs

@@ -605,7 +605,7 @@ mod tests {
     fn cancelled_task_handle() -> TaskHandle {
         let (trigger, token) = CancelToken::new();
         trigger.cancel();
-        Arc::new(Mutex::new(TaskCell::new(token, None, None)))
+        Arc::new(Mutex::new(TaskCell::new(token, None, None, None)))
     }
 
     #[test_case(0 ; "zero_clamps_to_capacity_one")]