fix: validate perplexity token budgets

extensions/perplexity/src/perplexity-web-search-provider.runtime.ts

@@ -343,8 +343,10 @@ export async function executePerplexitySearch(
   const rawDateAfter = readStringParam(args, "date_after");
   const rawDateBefore = readStringParam(args, "date_before");
   const domainFilter = readStringArrayParam(args, "domain_filter");
-  const maxTokens = readNumberParam(args, "max_tokens", { integer: true });
-  const maxTokensPerPage = readNumberParam(args, "max_tokens_per_page", { integer: true });
+  const maxTokens = readNumberParam(args, "max_tokens", { positiveInteger: true });
+  const maxTokensPerPage = readNumberParam(args, "max_tokens_per_page", {
+    positiveInteger: true,
+  });
 
   if (!structured) {
     if (country) {

src/agents/tools/common.params.test.ts

@@ -57,6 +57,23 @@ describe("readNumberParam", () => {
     const params = { messageId: "42.9" };
     expect(readNumberParam(params, "messageId", { integer: true })).toBe(42);
   });
+
+  it("accepts only positive safe integers when positiveInteger is true", () => {
+    expect(readNumberParam({ tokenBudget: "42" }, "tokenBudget", { positiveInteger: true })).toBe(
+      42,
+    );
+    expect(
+      readNumberParam({ tokenBudget: "42.9" }, "tokenBudget", { positiveInteger: true }),
+    ).toBeUndefined();
+    expect(
+      readNumberParam({ tokenBudget: 0 }, "tokenBudget", { positiveInteger: true }),
+    ).toBeUndefined();
+    expect(
+      readNumberParam({ tokenBudget: Number.POSITIVE_INFINITY }, "tokenBudget", {
+        positiveInteger: true,
+      }),
+    ).toBeUndefined();
+  });
 });
 
 describe("snake_case aliases", () => {

src/agents/tools/common.ts

@@ -157,9 +157,21 @@ export function readStringOrNumberParam(
 export function readNumberParam(
   params: Record<string, unknown>,
   key: string,
-  options: { required?: boolean; label?: string; integer?: boolean; strict?: boolean } = {},
+  options: {
+    required?: boolean;
+    label?: string;
+    integer?: boolean;
+    strict?: boolean;
+    positiveInteger?: boolean;
+  } = {},
 ): number | undefined {
-  const { required = false, label = key, integer = false, strict = false } = options;
+  const {
+    required = false,
+    label = key,
+    integer = false,
+    strict = false,
+    positiveInteger = false,
+  } = options;
   const raw = readParamRaw(params, key);
   let value: number | undefined;
   if (typeof raw === "number" && Number.isFinite(raw)) {
@@ -179,6 +191,9 @@ export function readNumberParam(
     }
     return undefined;
   }
+  if (positiveInteger) {
+    return Number.isSafeInteger(value) && value > 0 ? value : undefined;
+  }
   return integer ? Math.trunc(value) : value;
 }