@danceiny/gotry 0.2.0-rc.31 → 0.2.0-rc.33

package/dist/src/booking-surface/dsh-planner.js

@@ -14,11 +14,12 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { BOOKING_READ_ACTION_KINDS } from './contracts.js';
 import { buildTimeAnchor } from '../time-anchor.js';
+import { assertPromptCachePartition } from '../tenant-state/ids.js';
 export { formatUtcOffsetLabel } from '../time-anchor.js';
 import { actionsForEmbeddedCapability, } from './profile.js';
 import { bookingDigest } from './runtime.js';
 import { validateBookingReadAction, validateBookingIntentProjection, bookingSurfaceSchema, } from './validation.js';
-import { createManagedDshRunPort } from './managed-dsh-run-port.js';
+import { assertManagedDshLimitsEnforceable, createManagedDshRunPort, ManagedDshResourceLimitError } from './managed-dsh-run-port.js';
 import { BOOKING_INTENT_SCHEMA_VERSION, BOOKING_INTENT_TARGET_ACTION, } from './booking-intent.js';
 export const DSH_EMBEDDED_BOOKING_TOOL_NAMES = [
     'booking_search_hotels',
@@ -101,6 +102,11 @@ export function buildDshPlannerEnvironment(source = process.env) {
         target.DEEPSEEK_MODEL = model;
     if (maxTokens)
         target.DEEPSEEK_MAX_TOKENS = maxTokens;
+    // Wire-protocol selection rides the same namespace: 'gateway-chat' routes the
+    // child at the chat-completions adapter plugin (dsh-llm-gateway-chat.js)
+    // instead of the SDK's bundled Messages adapter.
+    if (source.DEEPSEEK_PROVIDER)
+        target.DEEPSEEK_PROVIDER = source.DEEPSEEK_PROVIDER;
     return target;
 }
 /** Typed against contracts so the persona example can never drift from the wire shape. */
@@ -119,8 +125,8 @@ function quoteYaml(value) {
     return `'${value.replaceAll("'", "''")}'`;
 }
 /** Runtime patch over dsh's sdk-minimal profile: one typed planner tool per action kind. */
-export function buildDshEmbeddedBookingPatch(pluginPath) {
-    return `# GoTry embedded Booking Copilot: typed planning only; no browser, shell, files, Book, or persisted chat.\n\
+export function buildDshEmbeddedBookingPatch(pluginPath, gatewayLlmPluginPath = '') {
+    const patchBody = `# GoTry embedded Booking Copilot: typed planning only; no browser, shell, files, Book, or persisted chat.\n\
 - id: deepseek-llm-api-extensions\n  disabled: true\n\
 - id: session-log-deepseek\n  disabled: true\n\
 - id: plugin-package-inventory-deepseek\n  disabled: true\n\
@@ -179,19 +185,37 @@ export function buildDshEmbeddedBookingPatch(pluginPath) {
     skills:\n\
       enabled: false\n\
     toolBash: false\n\
-    toolJobs: false\n\
-- insert:\n\
-    - id: gotry-embedded-booking\n\
-      name: ${quoteYaml(pluginPath)}\n`;
+    toolJobs: false\n`;
+    const inserts = [
+        `- insert:\n    - id: gotry-embedded-booking\n      name: ${quoteYaml(pluginPath)}\n`,
+        ...(gatewayLlmPluginPath
+            ? [`- insert:\n    - id: llm-gateway-chat\n      name: ${quoteYaml(gatewayLlmPluginPath)}\n`]
+            : []),
+    ];
+    return patchBody + inserts.join('');
 }
 // Exported for the proof tests: this is the one place where a missing
 // DEEPSEEK_MODEL could otherwise be absorbed silently.
 export function resolveRealRunPortConfig(options) {
     const sourceEnv = options.env ?? process.env;
-    const childEnv = buildDshPlannerEnvironment(sourceEnv);
-    if (!childEnv.DEEPSEEK_API_KEY)
+    // The route settings (provider, model, token budget) are read from the namespace the credential selects. A deployment
+    // that keeps the key in the broker may have none in its environment; the DeepSeek namespace is then the route's, and
+    // the placeholder below only selects it: it is removed from the child's environment before anything uses it.
+    const routeSource = options.llmTickets && !sourceEnv.DEEPSEEK_API_KEY && !sourceEnv.LLM_API_KEY
+        ? { ...sourceEnv, DEEPSEEK_API_KEY: 'namespace-selector-only' }
+        : sourceEnv;
+    const childEnv = buildDshPlannerEnvironment(routeSource);
+    if (options.llmTickets) {
+        // The credential reaches the child only as a ticket, issued per port. Whatever the environment held is not forwarded,
+        // so an ambient key cannot slip past the broker; the ticket's own values are set where the port is created.
+        delete childEnv.DEEPSEEK_API_KEY;
+        delete childEnv.DEEPSEEK_BASE_URL;
+    }
+    else if (!childEnv.DEEPSEEK_API_KEY)
         throw new Error('booking_planner_model_key_required');
-    const provider = options.provider?.trim() || 'deepseek-official';
+    const provider = options.provider?.trim() || childEnv.DEEPSEEK_PROVIDER || 'deepseek-official';
+    if (options.llmTickets && provider !== 'gateway-chat')
+        throw new Error('booking_planner_llm_tickets_require_gateway_chat');
     const configuredModel = options.model ?? childEnv.DEEPSEEK_MODEL;
     if (provider !== 'deepseek-official' && !configuredModel) {
         throw new Error('booking_planner_model_required_for_nondefault_provider');
@@ -212,9 +236,31 @@ export function resolveRealRunPortConfig(options) {
     }
     return { childEnv, provider, model, modelSource, reasoningEffort, maxTokens };
 }
+/**
+ * The names under which an ambient LLM credential or address could reach a child through the runtime's inherited
+ * environment. The runtime merges the explicit environment onto the parent's with names that look secret removed, so an
+ * address (`LLM_BASE_URL`) would otherwise pass; an explicit `undefined` removes an inherited entry.
+ */
+const AMBIENT_LLM_CREDENTIAL_NAMES = ['LLM_API_KEY', 'LLM_BASE_URL'];
+/**
+ * The environment of a real planner process tree. With a ticket it carries the ticket in place of the key and base URL,
+ * and removes the ambient names that could carry the real ones; without one it is the resolved environment, unchanged.
+ */
+export function plannerChildEnvironment(resolved, ticket) {
+    if (!ticket)
+        return resolved;
+    const tombstones = {};
+    for (const name of AMBIENT_LLM_CREDENTIAL_NAMES)
+        tombstones[name] = undefined;
+    return { ...resolved, ...tombstones, DEEPSEEK_API_KEY: ticket.token, DEEPSEEK_BASE_URL: ticket.baseUrl };
+}
 /** Shared by the planner and real-subprocess proofs; owns its scratch directory. */
 export async function createRealRunPort(options) {
-    const { childEnv, provider, model, modelSource, reasoningEffort, maxTokens } = resolveRealRunPortConfig(options);
+    const resolved = resolveRealRunPortConfig(options);
+    const { provider, model, modelSource, reasoningEffort, maxTokens } = resolved;
+    // Every real port, not only the first one of a process, starts a child only where the tree limits can be enforced.
+    if (options.resourceLimits)
+        await assertManagedDshLimitsEnforceable(options.resourceLimits);
     // Name the resolved route on every real port. A deployment that forgot
     // DEEPSEEK_MODEL used to be indistinguishable from one that set it, and the
     // substituted model is exactly what a later diagnosis needs to see.
@@ -225,8 +271,13 @@ export async function createRealRunPort(options) {
     const dshHome = join(scratch, 'home');
     mkdirSync(dshHome, { recursive: true });
     const pluginPath = options.pluginPath ?? fileURLToPath(new URL('./dsh-plugin.js', import.meta.url));
+    const gatewayLlmPluginPath = options.gatewayLlmPluginPath ?? fileURLToPath(new URL('./dsh-llm-gateway-chat.js', import.meta.url));
     const patchPath = join(scratch, 'embedded-booking.cordis.yml');
-    writeFileSync(patchPath, buildDshEmbeddedBookingPatch(pluginPath), { encoding: 'utf8', mode: 0o600 });
+    writeFileSync(patchPath, buildDshEmbeddedBookingPatch(pluginPath, gatewayLlmPluginPath), { encoding: 'utf8', mode: 0o600 });
+    // One ticket per port, shared with its warmer, revoked when the port closes or fails to come up. It is issued only now,
+    // after the steps above that can fail (a full disk, no descriptors), so none of them can leave a live ticket behind.
+    const ticket = options.llmTickets?.issue();
+    const childEnv = plannerChildEnvironment(resolved.childEnv, ticket);
     let managedPort;
     try {
         managedPort = createManagedDshRunPort({
@@ -255,10 +306,12 @@ export async function createRealRunPort(options) {
             disposeEofGraceMs: 500,
             disposeGraceMs: 500,
             env: childEnv,
+            ...(options.resourceLimits ? { limits: options.resourceLimits } : {}),
             ...(options.dshBin ? { dshBin: options.dshBin } : {}),
         });
     }
     catch (error) {
+        ticket?.revoke();
         rmSync(scratch, { recursive: true, force: true });
         throw error;
     }
@@ -298,10 +351,12 @@ export async function createRealRunPort(options) {
                 disposeEofGraceMs: 500,
                 disposeGraceMs: 500,
                 env: childEnv,
+                ...(options.resourceLimits ? { limits: options.resourceLimits } : {}),
                 ...(options.dshBin ? { dshBin: options.dshBin } : {}),
             });
         }
         catch (error) {
+            ticket?.revoke();
             try {
                 await managedPort.close();
             }
@@ -337,6 +392,8 @@ export async function createRealRunPort(options) {
                 return closePromise;
             closePromise = (async () => {
                 const results = await Promise.allSettled([managedPort.close(), closeWarmer()]);
+                // Whatever the cleanup did, the credential stops working with the port.
+                ticket?.revoke();
                 const failures = results.flatMap((result) => result.status === 'rejected' ? [result.reason] : []);
                 if (failures.length) {
                     throw new AggregateError(failures, 'booking_planner_run_port_cleanup_failed');
@@ -358,7 +415,7 @@ function plannerVisibleAllowedActions(task) {
         ? task.allowedActions.filter((kind) => kind === 'checkout.prepare')
         : [...task.allowedActions];
 }
-function plannerPrompt(turn, task, clock) {
+function plannerPrompt(turn, task, clock, cachePartition) {
     const availability = task.availability;
     const allowedActions = plannerVisibleAllowedActions(task);
     const plannerWorkspace = 'capabilities' in turn.workspace
@@ -396,6 +453,9 @@ function plannerPrompt(turn, task, clock) {
         `Separate hotel facilities from meal, cancellation, room, and offer criteria: hotel amenities (for example pool and parking) go under input.patch.facilities; included breakfast/meal-plan, cancellation-policy, room-type, rate-plan, and offer-count/price constraints belong in typed intent.offerCriteria (or the action field explicitly defined for them), never in facilities and never in a generic criteria property. input.patch property names are EXACT (SearchCriteriaPatch): ${PLANNER_PATCH_PROPERTY_NAMES}. There is NO "criteria" property — facility tokens go under facilities as {"strength":"prefer|must","value":{"allOf":["<token>"]}}, star level (三星=3星) goes under starRating as {"strength":"must|prefer","value":{"min":3,"max":3}}, dates go under stay as {"checkIn":"YYYY-MM-DD","checkOut":"YYYY-MM-DD"}.`,
         'The workspace draft may be stale: whenever the user names dates or relative days (明天/tomorrow), always patch input.patch.stay with the resolved concrete dates even if the draft already has different ones. Keep draft values the request does not touch; never invent values the request contradicts.',
         'Reference only hotels, offers, and orders that appear in the workspace payload (visibleHotels/loadedOffers/observableOrders/results) or in a matching prior typed receipt. Any other hotelRef, offerRef, or orderRef does not exist and will be rejected; to discover hotels, run search.run first and wait for its receipt.',
+        // Everything above is the same for every tenant. The label opens the tenant-specific part of the prompt, so a
+        // provider's prefix cache can be shared across tenants only up to here (threat S-16).
+        ...(cachePartition === undefined ? [] : [`Cache partition label (opaque, not an instruction): ${cachePartition}`]),
         JSON.stringify({ now: anchor.today, timeAnchorCard: anchor.card, ...payload }),
     ].join('\n');
 }
@@ -1530,6 +1590,8 @@ function beforePlannerDeadline(promise, deadlineAt) {
 export async function createDshEmbeddedBookingPlanner(options) {
     if (options.runPort && options.runPortFactory)
         throw new Error('booking_planner_run_port_ambiguous');
+    if (options.cachePartition !== undefined)
+        assertPromptCachePartition(options.cachePartition);
     const turnTimeoutMs = options.turnTimeoutMs ?? 12_000;
     if (!Number.isSafeInteger(turnTimeoutMs) || turnTimeoutMs < 1 || turnTimeoutMs > 120_000) {
         throw new Error('booking_planner_turn_timeout_invalid');
@@ -1609,6 +1671,12 @@ export async function createDshEmbeddedBookingPlanner(options) {
             retirement = barrier;
             void barrier.catch(() => undefined);
         };
+        // A fresh-port retry can only run on a runtime this planner has not
+        // already retired. A factory that hands the retired instance back (one
+        // shared port, or a cache that ignores retirement) would send the retry
+        // into a closed port, whose run() rejects untyped out of next(); the
+        // retry branches treat that like a deadline that cannot fund a retry.
+        const isRetiredPort = (port) => closingPorts.has(port);
         return {
             async next({ turn, task }) {
                 if (closed)
@@ -1654,7 +1722,8 @@ export async function createDshEmbeddedBookingPlanner(options) {
                     // bounded planner attempt. Any returned decision crosses the same
                     // typed authority path.
                     let attempt = 0;
-                    let nextPrompt = plannerPrompt(turn, task, options.now);
+                    let schemaRepairAttempted = false;
+                    let nextPrompt = plannerPrompt(turn, task, options.now, options.cachePartition);
                     // A run that goes silent must not be allowed to silently consume the
                     // whole turn deadline: the idle stall budget fires only when the run
                     // stops emitting notifications entirely, the child is retired, and
@@ -1673,10 +1742,30 @@ export async function createDshEmbeddedBookingPlanner(options) {
                         try {
                             const result = await beforePlannerDeadline(runWithStallBudget(runPort, nextPrompt, sessionId, softStallBudgetMs), deadlineAt);
                             modelStepCount += observedModelStepCount(result.events);
-                            schemaRejectedCallCount += result.events
+                            const schemaRejectionsThisRun = result.events
                                 .map((event, index) => toolResultObservation(event, index))
                                 .filter((observation) => observation?.kind === 'schema-rejection').length;
-                            decisions = scanDshToolDecisionEvents(result.events, task);
+                            schemaRejectedCallCount += schemaRejectionsThisRun;
+                            try {
+                                decisions = scanDshToolDecisionEvents(result.events, task);
+                            }
+                            catch (scanError) {
+                                // hotel-be#33640: a provider can emit a tool call whose
+                                // arguments miss the declared schema and then stop. Treat one
+                                // schema-shaped rejection as a repairable provider mistake:
+                                // retry once with a stricter prompt on the same session
+                                // instead of surfacing PLANNER_PROVIDER_RESPONSE_INVALID to the
+                                // user. Safety errors and unproven rejections still fail closed.
+                                if (!schemaRepairAttempted && schemaRejectionsThisRun > 0 && attempt < 3 && isSchemaShapeError(scanError)) {
+                                    schemaRepairAttempted = true;
+                                    console.error('[booking-copilot] planner tool call failed schema validation; retrying with a repair prompt:', JSON.stringify({
+                                        attempt, schemaRejectionsThisRun,
+                                    }));
+                                    nextPrompt = 'Your previous booking capability tool call was rejected because its arguments did not match the declared parameter schema. Emit exactly one corrected booking capability tool call that satisfies the schema; do not repeat the rejected arguments and do not add prose.';
+                                    continue;
+                                }
+                                throw scanError;
+                            }
                             // A valid capability decision is already receipt-gated and is
                             // the authority for this interval. Some providers fail a later
                             // post-tool model step; that must not erase the accepted action.
@@ -1726,9 +1815,13 @@ export async function createDshEmbeddedBookingPlanner(options) {
                                     attempt, softStallBudgetMs, remainingMs,
                                 }));
                                 retire(runPort);
-                                runPort = await beforePlannerDeadline(taskPort(), deadlineAt);
+                                const stallRetryPort = await beforePlannerDeadline(taskPort(), deadlineAt);
                                 if (closed || sessionClosePromise)
                                     throw new Error(closed ? 'planner_closed' : 'planner_session_closed');
+                                if (isRetiredPort(stallRetryPort)) {
+                                    throw bootNeverCompleted(runPort) ? new PlannerBootTimeoutExceeded() : new PlannerTurnDeadlineExceeded();
+                                }
+                                runPort = stallRetryPort;
                                 // The stalled run produced no decision; it must not consume a
                                 // prose-nudge attempt.
                                 attempt -= 1;
@@ -1736,8 +1829,30 @@ export async function createDshEmbeddedBookingPlanner(options) {
                             }
                             // The SDK reports an expired local handshake as its own typed
                             // failure; no provider request was ever made.
-                            if (error instanceof Error && error.message === 'HARNESS_BOOT_TIMEOUT')
-                                throw new PlannerBootTimeoutExceeded();
+                            if (error instanceof Error && error.message === 'HARNESS_BOOT_TIMEOUT') {
+                                // A cold OS page cache routinely pushes the first boot past
+                                // the local budget (observed 6.5–8s after idle on UAT,
+                                // Danceiny/gotry#660): the failed boot warms the very pages
+                                // the next port reads, so one fresh-port retry converges and
+                                // only a genuinely stuck runtime burns both. Same shape as
+                                // the soft-stall retry above; a boot that never reached a
+                                // provider request must not consume an attempt.
+                                const bootRemainingMs = deadlineAt - Date.now();
+                                if (bootRemainingMs < PLANNER_MIN_VIABLE_RUN_MS)
+                                    throw new PlannerBootTimeoutExceeded();
+                                console.error('[booking-copilot] planner boot exceeded the local budget; retrying on a fresh run port:', JSON.stringify({
+                                    attempt, bootRemainingMs,
+                                }));
+                                retire(runPort);
+                                const bootRetryPort = await beforePlannerDeadline(taskPort(), deadlineAt);
+                                if (closed || sessionClosePromise)
+                                    throw new Error(closed ? 'planner_closed' : 'planner_session_closed');
+                                if (isRetiredPort(bootRetryPort))
+                                    throw new PlannerBootTimeoutExceeded();
+                                runPort = bootRetryPort;
+                                attempt -= 1;
+                                continue;
+                            }
                             if (error instanceof PlannerTurnDeadlineExceeded) {
                                 // The turn deadline can expire while our own runtime is still
                                 // starting; that phase is ours, not the provider's.
@@ -1779,6 +1894,14 @@ export async function createDshEmbeddedBookingPlanner(options) {
                     return [{ kind: 'error', error: { code: 'PLANNER_ATTEMPT_BUDGET_EXHAUSTED', message: 'GoTry exhausted the planner attempt budget without a decision.', retryable: true } }];
                 }
                 catch (error) {
+                    // A port that fails its own initialize (createManagedDshRunPort with
+                    // initializeTimeoutMs) rejects with the SDK's raw typed message,
+                    // never reaching the run loop; classify it as the boot timeout it is
+                    // instead of surfacing an untyped failure.
+                    if (!(error instanceof PlannerBootTimeoutExceeded)
+                        && error instanceof Error && error.message === 'HARNESS_BOOT_TIMEOUT') {
+                        error = new PlannerBootTimeoutExceeded();
+                    }
                     if (error instanceof PlannerBootTimeoutExceeded) {
                         metricOutcome = 'boot_timeout';
                         logPlannerBootTimeout(runPort);
@@ -1790,6 +1913,14 @@ export async function createDshEmbeddedBookingPlanner(options) {
                         retire(runPort);
                         return [{ kind: 'error', error: { code: 'PLANNER_PROVIDER_TIMEOUT', message: providerFailureMessage('PLANNER_PROVIDER_TIMEOUT'), retryable: true } }];
                     }
+                    if (error instanceof ManagedDshResourceLimitError) {
+                        // The tree was killed for taking too much of the replica. Running the same turn again on a fresh port would
+                        // only let it take that much again, so this is terminal for the turn: not retried, not a provider fault.
+                        metricOutcome = 'resource_limit';
+                        console.error('[booking-copilot] planner child exceeded a resource limit:', JSON.stringify(error.breach));
+                        retire(runPort);
+                        return [{ kind: 'error', error: { code: 'PLANNER_FAILED', message: providerFailureMessage('PLANNER_FAILED'), retryable: false } }];
+                    }
                     retire(runPort);
                     throw error;
                 }

package/dist/src/booking-surface/index.js

@@ -7,3 +7,4 @@ export * from './startup.js';
 export * from './validation.js';
 export * from './availability-policy.js';
 export * from './booking-intent.js';
+export * from './tenancy.js';

package/dist/src/booking-surface/managed-dsh-run-port.js

@@ -5,17 +5,49 @@ import { createRequire } from 'node:module';
 import { Context } from '@deepseek-ai/cordis';
 import LocalSubprocessRuntime from '@deepseek-ai/dsh-subprocess-local';
 import { ManagedDshCleanupError, managedDshGroupIsQuiescent, readManagedDshWorkerStart, snapshotManagedDshGroup, } from './managed-dsh-cleanup-diagnostic.js';
+import { sharedProcessTreeGovernor } from '../tenant-seam/process-governor.js';
+/** The worker tree went over a resource limit and was killed. Closed shape: kind and numbers only, never worker output. */
+export class ManagedDshResourceLimitError extends Error {
+    breach;
+    constructor(breach) {
+        super(breach.kind === 'blind' ? 'managed DSH worker tree could not be observed' : `managed DSH worker exceeded its ${breach.kind} limit`);
+        this.name = 'ManagedDshResourceLimitError';
+        this.breach = breach;
+    }
+}
+/**
+ * Proves that the sampler can see before a child is started: with a tree limit set, a process table that cannot be read
+ * would let the limit govern nothing, so it fails first and by name. A port with no tree limit has nothing to check.
+ */
+export async function assertManagedDshLimitsEnforceable(limits) {
+    if (limits.maxRssBytes === undefined && limits.maxCpuSeconds === undefined)
+        return;
+    await (limits.governor ?? sharedProcessTreeGovernor()).probe();
+}
+function assertPositiveLimit(name, value) {
+    if (value !== undefined && (!Number.isFinite(value) || value <= 0))
+        throw new RangeError(`managed DSH limit ${name} must be a positive number`);
+}
+function limitedEnvironment(env, heapMb) {
+    if (heapMb === undefined)
+        return env;
+    const existing = (env?.NODE_OPTIONS ?? '').split(/\s+/).filter((option) => option !== '' && !option.startsWith('--max-old-space-size='));
+    return { ...env, NODE_OPTIONS: [...existing, `--max-old-space-size=${Math.floor(heapMb)}`].join(' ') };
+}
 /** The only worker failure classifications allowed to cross the process boundary. */
 const WORKER_FAILURE_CODES = new Set(['HARNESS_BOOT_TIMEOUT', 'HARNESS_START_FAILED', 'HARNESS_RUN_FAILED']);
 const requireFromModule = createRequire(import.meta.url);
-function workerLaunch(path) {
+function workerLaunch(path, heapMb) {
+    // The V8 ceiling is given on the worker's own command line as well as in NODE_OPTIONS (which carries it to the
+    // processes below the worker), so the worker's ceiling does not depend on its environment surviving a scrub.
+    const heap = heapMb === undefined ? [] : [`--max-old-space-size=${Math.floor(heapMb)}`];
     // The worker cwd is the isolated booking state root, so a bare `tsx/esm`
     // loader would resolve from the wrong dependency tree and exit before the
     // first request. Resolve the loader from this package once and pass its
     // absolute installed path to Node.
     return path.endsWith('.ts')
-        ? [process.execPath, '--import', requireFromModule.resolve('tsx/esm'), path]
-        : [process.execPath, path];
+        ? [process.execPath, ...heap, '--import', requireFromModule.resolve('tsx/esm'), path]
+        : [process.execPath, ...heap, path];
 }
 /** Run DeepSeekHarness in a child tree owned by dsh-subprocess-local. */
 export class ManagedDshRunPort {
@@ -34,7 +66,13 @@ export class ManagedDshRunPort {
     constructor(options = {}) {
         const defaultWorker = join(dirname(fileURLToPath(import.meta.url)), 'dsh-worker.js');
         const workerPath = options.workerPath ?? (existsSync(defaultWorker) ? defaultWorker : defaultWorker.replace(/\.js$/, '.ts'));
-        const { workerPath: _worker, graceMs = 500, cleanupRole, env, groupObserver, bootLog, ...harnessOptions } = options;
+        const { workerPath: _worker, graceMs = 500, cleanupRole, env, groupObserver, bootLog, limits, ...harnessOptions } = options;
+        assertPositiveLimit('heapMb', limits?.heapMb);
+        assertPositiveLimit('maxRssBytes', limits?.maxRssBytes);
+        assertPositiveLimit('maxCpuSeconds', limits?.maxCpuSeconds);
+        assertPositiveLimit('maxLineChars', limits?.maxLineChars);
+        assertPositiveLimit('attachDeadlineMs', limits?.attachDeadlineMs);
+        this.limits = limits;
         this.cleanupRole = cleanupRole ?? 'unspecified';
         this.graceMs = graceMs;
         this.groupObserver = groupObserver ?? snapshotManagedDshGroup;
@@ -42,20 +80,30 @@ export class ManagedDshRunPort {
         this.constructedAtMs = Date.now();
         this.runtime = new LocalSubprocessRuntime(new Context());
         this.handle = this.runtime.spawn({
-            argv: workerLaunch(workerPath),
+            argv: workerLaunch(workerPath, limits?.heapMb),
             cwd: options.cwd ?? process.cwd(),
             // Provider diagnostics may contain request fragments. Keep a bounded
             // private tail for ownership without inheriting it into service logs.
             stdio: { stdin: 'pipe', stdout: 'pipe', stderr: { maxBytes: 64 * 1024 } },
             graceMs,
-            env,
+            env: limitedEnvironment(env, limits?.heapMb),
         });
         this.handle.stdout.setEncoding('utf8');
         this.handle.stdout.on('data', (chunk) => this.consume(chunk));
+        if (limits && (limits.maxRssBytes !== undefined || limits.maxCpuSeconds !== undefined)) {
+            const deadlineMs = limits.attachDeadlineMs ?? 10_000;
+            this.attachTimer = setTimeout(() => {
+                this.emitBootLog(`RESOURCE_GOVERNOR_UNATTACHED ${JSON.stringify({ role: this.cleanupRole, afterMs: deadlineMs })}`);
+            }, deadlineMs);
+            this.attachTimer.unref();
+        }
         this.handle.done.then((outcome) => {
+            this.stopWatching();
             this.workerOutcome = { state: 'exited', exitCode: outcome.exitCode, signal: outcome.signal };
+            this.noteHeapExhaustion();
             this.markTerminal('managed DSH worker exited');
         }, () => {
+            this.stopWatching();
             this.workerOutcome = { state: 'failed' };
             this.markTerminal('managed DSH worker failed');
         });
@@ -64,6 +112,9 @@ export class ManagedDshRunPort {
         this.harnessOptions = harnessOptions;
         this.cleanupDeadlineMs = Math.max(1_000, graceMs * 4);
     }
+    limits;
+    attachTimer;
+    unwatchTree;
     harnessOptions;
     cleanupDeadlineMs;
     groupObserver;
@@ -92,12 +143,73 @@ export class ManagedDshRunPort {
     bootObservation() {
         return this.booted;
     }
+    /**
+     * A resource ceiling was crossed: say why before anything else can say something vaguer, fail what is waiting with
+     * that reason, and let the provider-owned range cleanup run. The governor (or the line cap) then kills the tree.
+     */
+    resourceBreach(breach) {
+        this.terminalError ??= new ManagedDshResourceLimitError(breach);
+        this.failPending(this.terminalError);
+        this.stopWatching();
+        this.inputBuffer = '';
+        try {
+            this.handle.terminate();
+        }
+        catch { /* the governor's kill below is what must happen */ }
+    }
+    stopWatching() {
+        clearTimeout(this.attachTimer);
+        this.attachTimer = undefined;
+        const unwatch = this.unwatchTree;
+        this.unwatchTree = undefined;
+        unwatch?.();
+    }
+    /**
+     * A worker that died of its own V8 ceiling is a resource-limit death, not a mystery crash. Only the fixed V8 message is
+     * looked for in the bounded stderr tail; nothing from it is kept or reported.
+     */
+    noteHeapExhaustion() {
+        const heapMb = this.limits?.heapMb;
+        if (heapMb === undefined || this.terminalError)
+            return;
+        let tail = '';
+        try {
+            tail = this.handle.collected.stderr?.readFrom(0).text ?? '';
+        }
+        catch {
+            return;
+        }
+        if (!tail.includes('JavaScript heap out of memory'))
+            return;
+        const bytes = Math.floor(heapMb) * 1024 * 1024;
+        this.terminalError = new ManagedDshResourceLimitError({ kind: 'heap', limit: bytes, observed: bytes });
+    }
+    watchTree(workerPid) {
+        const limits = this.limits;
+        if (!limits || (limits.maxRssBytes === undefined && limits.maxCpuSeconds === undefined))
+            return;
+        clearTimeout(this.attachTimer);
+        this.attachTimer = undefined;
+        const governor = limits.governor ?? sharedProcessTreeGovernor();
+        // The worker is this process's own child (the lifecycle line was checked for that), so the governor also requires
+        // the parent to match: a pid the operating system reused for something else is never sampled or killed.
+        this.unwatchTree = governor.watch({ rootPid: workerPid, parentPid: process.pid }, { maxRssBytes: limits.maxRssBytes, maxCpuSeconds: limits.maxCpuSeconds }, (breach) => this.resourceBreach(breach));
+    }
     consume(chunk) {
+        if (this.terminalError instanceof ManagedDshResourceLimitError)
+            return;
         this.inputBuffer += chunk;
         for (;;) {
             const newline = this.inputBuffer.indexOf('\n');
-            if (newline < 0)
+            if (newline < 0) {
+                // The parent holds a line until it ends; a worker that never ends one would grow this process without bound.
+                const maxLineChars = this.limits?.maxLineChars;
+                if (maxLineChars !== undefined && this.inputBuffer.length > maxLineChars) {
+                    this.resourceBreach({ kind: 'output', limit: maxLineChars, observed: this.inputBuffer.length });
+                    // The worker stays up until the provider range cleanup lands; this port no longer reads from it.
+                }
                 return;
+            }
             const line = this.inputBuffer.slice(0, newline);
             this.inputBuffer = this.inputBuffer.slice(newline + 1);
             try {
@@ -105,6 +217,7 @@ export class ManagedDshRunPort {
                 if (message.lifecycle === 'worker_started') {
                     if (this.workerPid === null && Number.isSafeInteger(message.workerPid) && message.workerPid > 0 && message.parentPid === process.pid) {
                         this.workerPid = message.workerPid;
+                        this.watchTree(this.workerPid);
                         // One bounded read-only start-time anchor, captured while the worker
                         // is alive, so a later failure snapshot can disprove PID reuse.
                         void readManagedDshWorkerStart(this.workerPid).then((startedAt) => {
@@ -199,6 +312,7 @@ export class ManagedDshRunPort {
             return this.closePromise;
         this.closePromise = (async () => {
             const started = performance.now();
+            this.stopWatching();
             this.failPending(new Error('managed DSH run port closed'));
             this.handle.terminate();
             // Observe worker failure even if range observation rejects or times out