fix(cli): add upper bound check for modelFacingUserTurnCount

Reject values exceeding Number.MAX_SAFE_INTEGER in both
validateModelFacingUserTurnCount (Session.ts) and the
isHistorySnapshot guard (acpAgent.ts). This prevents
malformed clients from poisoning session state with
absurdly large turn counts.

Author: Jerry2003826

packages/cli/src/acp-integration/acpAgent.ts

@@ -1559,7 +1559,9 @@ class QwenAgent implements Agent {
               .modelFacingUserTurnCount as number,
           ) &&
           ((history as { modelFacingUserTurnCount?: unknown })
-            .modelFacingUserTurnCount as number) >= 0;
+            .modelFacingUserTurnCount as number) >= 0 &&
+          ((history as { modelFacingUserTurnCount?: unknown })
+            .modelFacingUserTurnCount as number) <= Number.MAX_SAFE_INTEGER;
         if (!Array.isArray(history) && !isHistorySnapshot) {
           throw RequestError.invalidParams(
             undefined,

packages/cli/src/acp-integration/session/Session.ts

@@ -152,6 +152,12 @@ function validateModelFacingUserTurnCount(count: unknown): number {
       `modelFacingUserTurnCount must be a non-negative finite integer, got ${count}`,
     );
   }
+  if (count > Number.MAX_SAFE_INTEGER) {
+    throw RequestError.invalidParams(
+      undefined,
+      `modelFacingUserTurnCount exceeds maximum safe integer, got ${count}`,
+    );
+  }
   return count;
 }