Summary
run: composition is protected against runaway nesting; the raw tool: flow-execute form is not.
MAX_RUN_DEPTH and the run-stack cycle check live in execRunStep — they cover only run: steps, which expand a fragment into the same runner invocation. A raw tool: flow-execute step dispatches a fresh runner invocation through the registry, so neither guard sees it. A flow whose raw step names itself recurses until the process stack or the abort signal stops it.
Where
packages/tool-server/src/tools/flows/flow-run.ts — execRunStep's depth/cycle checks, versus execLeafStep's case "tool", which dispatches any registered tool with no such check.- The raw form is produced by
flow-add-step whenever the target is not a resolvable sibling of the recording, and always for a remote recording (run: composition is host-resolved).
Note on reachability
This is not purely theoretical: the raw form is the normal outcome for cross-project composition and for every remote recording, so a hand-edited or mis-recorded self-reference is reachable without doing anything exotic.
Suggested direction
Thread the run-stack and depth through the nested invocation the way run: already does, so both composition forms share one guard — rather than adding a second, parallel check that could drift from the first. Worth confirming whether the nested call can see the parent's stack at all today, since it arrives as an ordinary tool dispatch.
Context
Noticed while fixing #606 (a nested run's verdict not reaching the enclosing run). Deliberately not bundled there — that fix is about propagating a verdict, this is about bounding recursion, and mixing them would make both harder to review. Also related to #607 (the raw form pinning its record-time device), which shares the theme of the raw form having weaker guarantees than run:.
Summary
run:composition is protected against runaway nesting; the rawtool: flow-executeform is not.MAX_RUN_DEPTHand the run-stack cycle check live inexecRunStep— they cover onlyrun:steps, which expand a fragment into the same runner invocation. A rawtool: flow-executestep dispatches a fresh runner invocation through the registry, so neither guard sees it. A flow whose raw step names itself recurses until the process stack or the abort signal stops it.Where
packages/tool-server/src/tools/flows/flow-run.ts—execRunStep's depth/cycle checks, versusexecLeafStep'scase "tool", which dispatches any registered tool with no such check.flow-add-stepwhenever the target is not a resolvable sibling of the recording, and always for a remote recording (run:composition is host-resolved).Note on reachability
This is not purely theoretical: the raw form is the normal outcome for cross-project composition and for every remote recording, so a hand-edited or mis-recorded self-reference is reachable without doing anything exotic.
Suggested direction
Thread the run-stack and depth through the nested invocation the way
run:already does, so both composition forms share one guard — rather than adding a second, parallel check that could drift from the first. Worth confirming whether the nested call can see the parent's stack at all today, since it arrives as an ordinary tool dispatch.Context
Noticed while fixing #606 (a nested run's verdict not reaching the enclosing run). Deliberately not bundled there — that fix is about propagating a verdict, this is about bounding recursion, and mixing them would make both harder to review. Also related to #607 (the raw form pinning its record-time device), which shares the theme of the raw form having weaker guarantees than
run:.