fix(context-poisoning): honour configured maxEntriesPerSession

[PratikDhanave (PratikDhanave)]

Related Issue

None — Problem & Solution, Impact, and Alternatives completed below.

Problem & Solution

Problem: ContextPoisoningConfig.maxEntriesPerSession (default 200) was accepted and stored but never honoured — addEntry evicted against the hard-coded static MAX_ENTRIES_PER_KEY (1000), so a custom per-session cap was silently ignored (the sibling maxContextSizeBytes is honoured, so the config is meant to be live). The first revision used Math.max(1, maxEntriesPerSession), which is NaN for a non-finite config, so entries.length >= NaN was never true and eviction was disabled entirely — a NaN cap retained every entry, breaking the absolute ceiling the change promised.

Solution: Resolve the cap the way this repo's src/sandbox.ts resolves timeoutSeconds (resolveTimeoutMs): a finite value > 0 is used, otherwise the default (200); then cap at MAX_ENTRIES_PER_KEY. So 0 / negative / NaN fall back to the default rather than 1 / NaN, and eviction plus the absolute ceiling always hold.

Impact on Your Work

Surfaced during a review/hardening pass over the toolkit's TypeScript governance components. A silently-ignored per-session cap is a latent governance/memory-bound correctness gap (a caller setting a small cap still got 1000, and a non-finite cap disabled eviction).

Timeline

None.

Alternatives Considered

Clamping non-positive values to 1 (rejected — diverges from main's effective 1000 cap and surprises callers) versus falling back to the documented default (chosen: matches sandbox.ts parity and the maintainer's review guidance).

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Maintenance (dependency updates, CI/CD, refactoring)
• Security fix

Package(s) Affected

TypeScript SDK @microsoft/agent-governance-sdk (agent-governance-typescript) — src/context-poisoning.ts (ContextPoisoningDetector). None of the checkboxes below name the TypeScript SDK directly, so noting it here in text.

Testing

Unit Testing

Extended agent-governance-typescript/tests/context-poisoning.test.ts:

• Positive cap: maxEntriesPerSession: 3 retains 3 of 5 entries for one session.
• Non-finite / non-positive: NaN, 0, and -5 each fall back to the default (200) and keep eviction active. This case fails on the pre-fix code (205 retained) and passes after.

Manual Testing

N/A — behaviour is covered by the unit tests above (tsc --noEmit clean, jest tests/context-poisoning.test.ts 28/28).

Checklist

• I have linked a related issue above, or completed "Problem & Solution", "Impact on Your Work", and "Alternatives Considered"
• My code follows the project style guidelines (ruff check) — TS: tsc --noEmit clean
• I have added tests that prove my fix/feature works
• All new and existing tests pass (pytest) — TS: jest 28/28
• I have updated documentation as needed (N/A — no doc change)
• I have signed the Microsoft CLA

Attribution & Prior Art

• This contribution does not contain code copied or derived from other projects without attribution
• Any external projects that inspired this design are credited in code comments or documentation
• If this PR implements functionality similar to an existing open-source project, I have listed it below

Prior art / related projects (if any): resolution pattern mirrors this repo's own src/sandbox.ts resolveTimeoutMs, credited in the code comment.

AI Assistance

Disclosure: This change was developed by Claude Code (an AI agent) operating under the direction of PratikDhanave (@PratikDhanave) — the AI located the bug, wrote the fix and tests, and ran verification (tsc + jest). The commit records Claude Code as co-author. Submitted via PratikDhanave (@PratikDhanave)'s account.

• I can explain every meaningful change in this PR: what it does, why, and what tradeoffs were considered
• I have run tests and verification appropriate for this change
• No part of this PR was autonomously submitted by an AI agent without my review
• I have not used AI to generate review comments on others' PRs

The two unchecked boxes above are the contributor's personal attestations of human review. They are left for PratikDhanave (@PratikDhanave) to confirm after reviewing the diff, rather than being self-attested by the AI that authored the change.

IP, Patents, and Licensing

• This contribution does not implement patent-pending or patent-encumbered techniques
• This contribution does not require an NDA or licensing agreement to understand or use
• Any AI tools used have terms compatible with the MIT License

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AGT Contributor Check.

[MohammadHaroonAbuomar]

• Please replace the description with the repository PR template and complete it (Type of Change, Packages Affected, Checklist, Attribution, AI Assistance including the autonomous-submission attestation, IP). The commit records Claude Code as co-author, so the AI Assistance attestations are the ones that matter here, as on #4226.

[PratikDhanave (PratikDhanave)]

Thanks MohammadHaroonAbuomar — fixed the non-finite case.

You're right: Math.max(1, NaN) is NaN, so entries.length >= NaN was never true and eviction was disabled for a non-finite maxEntriesPerSession (a NaN config retained every entry, so the absolute ceiling didn't hold). I resolved it the way sandbox.ts's resolveTimeoutMs does:

const resolved =
  Number.isFinite(configured) && configured > 0 ? configured : DEFAULT_CONFIG.maxEntriesPerSession;
const perSessionCap = Math.min(resolved, ContextPoisoningDetector.MAX_ENTRIES_PER_KEY);

So NaN, 0, and negative now fall back to the default (200) rather than NaN/1, and are still capped at MAX_ENTRIES_PER_KEY. Added a test covering NaN, 0, and negative (it fails on the old code — 205 retained — and passes now). Full suite: tsc clean, jest 28/28.

I'll also complete the PR description against the repo template (including the AI-assistance attestations) — PratikDhanave (@PratikDhanave) will confirm those attestations on his side.

[MohammadHaroonAbuomar]

• The code change is now complete and verified, thank you. What remains is the description: please replace it with the repository PR template and complete it (Type of Change, Packages Affected, Checklist, Attribution, AI Assistance, IP). The AI Assistance attestations need to come from you as the author, in particular "No part of this PR was autonomously submitted by an AI agent without my review" and "I can explain every meaningful change": the commits carry a Claude co-author trailer and the latest comment refers to you in the third person, so I need the human confirmation before approving. The same applies to #4226, #4233 and #4234.