Unbounded subagent file scan drives Python kernel footprint to ~100 GB

[alfredomtx]

Summary

Prime Agent 0.9.4 with runtime 0.1.0 on macOS with Python 3.11 allowed a persistent rlm.repl subagent to run an unbounded recursive file scan.

The scan used Path.rglob(...) over tool and configuration directories, then called read_text(errors="replace") for every regular file. It had no per-file size, directory-depth, total-byte, binary-file, or wall-clock limit.

Observed impact

During the scan, vmmap measured:

• Physical footprint: 51.5G–64.8G in current samples, with a 99.7G peak.
• RSS: about 2GB.
• Later physical footprint: 4.0G without a restart.

RSS and macOS process physical footprint are different metrics. RSS represents resident physical memory. This report does not treat the full physical-footprint value as disk swap.

No crash occurred in this incident. The observation does not prove an idle or general runtime leak. This report describes one measured incident and does not claim deterministic reproduction.

Issue #764 reports a related macOS kernel crash from eager reads of large or binary files. This incident shares that allocation trigger but did not crash.

Minimal pseudocode

from pathlib import Path

for base in (Path("tool-dir"), Path("config-dir")):
    for path in base.rglob("*"):
        if not path.is_file():
            continue
        try:
            text = path.read_text(errors="replace")
        except OSError:
            continue
        if "needle" in text:
            print(path)

Warning: Do not run this code against large directories. It has no file-size or directory-depth limit.

Expected behavior

Provide safer bounded file-discovery and file-read guidance, runtime resource protections, or both, to prevent agent-generated diagnostic scans from exhausting kernel memory.

Which layer should own this safeguard: runtime limits, tool guidance, or both?