fix agent deploy caps

approved

heicode/controller/agent_control_plane.go

@@ -776,6 +776,16 @@ func validateOrchestrationPlan(c *gin.Context, plan agentOrchestrationPlan) bool
 		agentError(c, "POLICY_REJECTED", "at least one agent is required")
 		return false
 	}
+	// Upper bound on agents per orchestration plan (defense-in-depth on this
+	// admin-only control-plane path): a single call must not request an unbounded
+	// number of agents (resource-exhaustion / cost blow-up). Mirrors the team-tier
+	// ceiling (8); env-overridable, <=0 disables. The per-user deploy-COUNT cap lives
+	// on the user self-service path (HeicodeDeployAgent); this is the per-plan SIZE
+	// guard. (#8)
+	if maxPerPlan := common.GetEnvOrDefault("HEICODE_MAX_AGENTS_PER_PLAN", 8); maxPerPlan > 0 && len(plan.Agents) > maxPerPlan {
+		agentError(c, "POLICY_REJECTED", "orchestration plan exceeds the maximum of "+strconv.Itoa(maxPerPlan)+" agents")
+		return false
+	}
 	if strings.TrimSpace(plan.UserContext.UserID) == "" {
 		agentError(c, "POLICY_REJECTED", "user_context.user_id is required")
 		return false