fix(python): bound Deep Agents VFS searches

[chaliy]

Motivation

• The native Python grep/VFS traversal could materialize millions of matches and bypass shell execution deadlines, amplifying host memory and CPU usage (TM-DOS-106).
• Default max_count=None and eager splitlines() made dense attacker-controlled files create huge in-memory object graphs.
• Async dispatch via asyncio.to_thread did not reliably stop the worker, so cancellation/timeouts were ineffective.

Description

• Add per-operation resource budgets with cooperative cancellation and deadlines via _OperationBudget, _BudgetExceeded, and session-work accounting on BashkitBackend in crates/bashkit-python/bashkit/deepagents.py.
• Stream file lines with a _lines() iterator instead of splitlines(), and charge traversal bytes/files while walking in _files() so reads/glob/grep honor traversal/file/byte budgets.
• Enforce bounded grep results by default (_DEFAULT_GREP_MATCHES = 1000) and a matched-result byte ceiling (_MAX_GREP_RESULT_BYTES = 100_000), return GrepResult(truncated=True) when budgets hit limits, and forward a cancellable agrep/aglob worker that sets the cancellation flag on task cancelation.
• Add regression tests (crates/bashkit-python/tests/test_deepagents_backend.py) that exercise dense-file behavior and cooperative cancellation, and update documentation entries in knowledge/runtimes/python-package.md and knowledge/security/threat-model.md to record TM-DOS-106 mitigation.

Testing

• Ran ruff format / ruff check and python -m py_compile on the modified Python module with no lint or syntax failures.
• Built and installed the Python wheel via maturin develop in a venv and ran pytest crates/bashkit-python/tests/test_deepagents_backend.py, which passed (14 passed).
• Ran the extended pytest crates/bashkit-python/tests/ suite in the prepared environment; modified tests passed (14 passed) while full test-collection of the entire Python test tree can require CI-only fixtures (bashkit_random_fs).
• Ran an allocation trace inside the new dense-file test to confirm truncation and that peak traced memory stayed under the adjusted acceptance threshold during the regression (tracemalloc assertion passed in CI-local runs).

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	01224fa	Commit Preview URL	Sep 25 2026, 11:40 AM

[chaliy]

Reviewed, rebased onto latest main, and pushed two fixes. The per-operation budgets, streaming line scan and cooperative cancellation are all good; two things needed changing.

1. The session work budget could only drain (blocking)

_charge subtracted every byte read from _session_work_remaining, and nothing restored it except reset(). But no bytes are retained once an operation returns — GrepResult carries its own 1,000-match / 100 KB caps, and ReadResult is bounded by limit. So the counter measured work that had already been released, and could only count down.

The effect is a long-lived agent session bricking itself after 100 MB of entirely legitimate reads:

read → ReadResult(error="read resource budget exceeded")   # forever, until reset()

That is reachable in ordinary use — a recursive grep charges every file it walks, so a handful of searches over a moderate tree exhausts it. And the diagnostic gives the agent no way to tell a permanent session budget from a per-operation one.

Fix: dropped the cumulative counter. The per-operation deadline, 10,000-file and 10 MB traversal budgets are what actually bound amplification, and they are unaffected. The reasoning is recorded next to the remaining constants so it does not get re-added.

2. Duplicate threat ID (blocking)

The new row was numbered TM-DOS-106, which is already assigned to "Zip creation allocation-before-check". Renumbered to TM-DOS-113 (main tops out at 110; #2466 takes 111 and #2455 takes 112).

One behaviour note, not changed

_lines() splits on \n only, where splitlines() also breaks on \v, \f, \x1c–\x1e, and ₅. So a file containing U+2028 now counts as one line rather than two. That is closer to what GNU grep does and it removes a surprise split on attacker-controlled bytes, so it looks like an improvement — flagging it only because it is a silent compatibility change that is not mentioned in the description.

Validation

• ruff check and ruff format --check clean across all 48 files; py_compile clean
• just check-okf conformant
• no residual references to the removed budget in code or knowledge
• rebased onto main @ 1308956

I could not run pytest crates/bashkit-python/tests/test_deepagents_backend.py here — this environment has neither the built extension nor deepagents installed, and maturin develop is not available. CI's Python legs cover it.

---

Generated by Claude Code