fix(agent): validate UI envelopes

features/agent/ui-envelope/map-actions.test.ts

@@ -11,20 +11,26 @@ describe("toTrustedMapAction", () => {
     expect(toTrustedMapAction("run_javascript", { code: "alert(1)" })).toBeNull();
   });
 
-  it("downgrades malformed apply_layer_style params to safe undefined fields", () => {
+  it("rejects malformed or empty apply_layer_style params", () => {
     expect(
       toTrustedMapAction("apply_layer_style", {
         layer_group_id: 123,
         layer_id: [],
         visible: "true"
       })
-    ).toEqual({
-      type: "apply_layer_style",
-      layerGroupId: undefined,
-      layerId: undefined,
-      visible: undefined,
-      fallbackText: undefined
-    });
+    ).toBeNull();
+    expect(toTrustedMapAction("apply_layer_style", {})).toBeNull();
+  });
+
+  it("rejects out-of-range coordinates and zoom", () => {
+    expect(toTrustedMapAction("zoom_to_map", { center: [181, 39.1] })).toBeNull();
+    expect(toTrustedMapAction("zoom_to_map", { center: [117.2, -91] })).toBeNull();
+    expect(toTrustedMapAction("zoom_to_map", { center: [117.2, 39.1], zoom: 25 })).toBeNull();
+  });
+
+  it("rejects empty and oversized locate requests", () => {
+    expect(toTrustedMapAction("locate_features", { ids: [] })).toBeNull();
+    expect(toTrustedMapAction("locate_features", { ids: Array.from({ length: 101 }, (_, index) => `P${index}`) })).toBeNull();
   });
 
   it("accepts valid zoom_to_map coordinates", () => {