Struct ExecutionLimits 

pub struct ExecutionLimits {

    pub max_commands: usize,
    pub max_loop_iterations: usize,
    pub max_total_loop_iterations: usize,
    pub max_function_depth: usize,
    pub timeout: Duration,
    pub parser_timeout: Duration,
    pub max_input_bytes: usize,
    pub max_ast_depth: usize,
    pub max_parser_operations: usize,
    pub max_stdout_bytes: usize,
    pub max_stderr_bytes: usize,
    pub max_subst_depth: usize,
    pub max_file_descriptors: usize,
    pub capture_final_env: bool,
}

Resource limits for script execution

Fields

max_commands: usize

Maximum number of commands that can be executed (fuel model) Default: 10,000

max_loop_iterations: usize

Maximum iterations for a single loop Default: 10,000

max_total_loop_iterations: usize

Maximum total loop iterations across all loops (nested and sequential). Prevents nested loop multiplication attack (TM-DOS-018). Default: 1,000,000

max_function_depth: usize

Maximum function call depth (recursion limit) Default: 100

timeout: Duration

Execution timeout Default: 30 seconds

parser_timeout: Duration

Parser timeout (separate from execution timeout) Default: 5 seconds This limits how long the parser can spend parsing a script before giving up. Protects against parser hang attacks (V3 in threat model).

max_input_bytes: usize

Maximum input script size in bytes Default: 10MB (10,000,000 bytes) Protects against memory exhaustion from large scripts (V1 in threat model).

max_ast_depth: usize

Maximum AST nesting depth during parsing Default: 100 Protects against stack overflow from deeply nested scripts (V4 in threat model).

max_parser_operations: usize

Maximum parser operations (fuel model for parsing) Default: 100,000 Protects against parser DoS attacks that could otherwise cause CPU exhaustion.

max_stdout_bytes: usize

Maximum stdout capture size in bytes Default: 1MB (1,048,576 bytes) Prevents unbounded output accumulation from runaway commands.

max_stderr_bytes: usize

Maximum stderr capture size in bytes Default: 1MB (1,048,576 bytes) Prevents unbounded error output accumulation.

max_subst_depth: usize

Maximum command substitution nesting depth. Default: 32

max_file_descriptors: usize

Maximum persistent custom file descriptors opened via exec N>file, exec N<file, or fd duplication. Standard fds 0/1/2 do not count. Default: 1024

capture_final_env: bool

Whether to capture the final environment state in ExecResult. Default: false (opt-in to avoid cloning cost when not needed)

Implementations

impl ExecutionLimits

pub fn new() -> Self

Create new limits with defaults

pub fn cli() -> Self

Relaxed limits for CLI / interactive use.

Command/loop counters are effectively unlimited — the user chose to run the script, so counting-based limits are unhelpful. Timeout is removed (user has Ctrl-C). Stdout/stderr caps are raised to 10 MB.

Limits that guard against crashes are kept: function depth, AST depth, parser fuel, parser timeout, input size.

pub fn max_commands(self, count: usize) -> Self

Set maximum command count. Passing 0 is treated as “use default” (no-op) to prevent misconfiguration.

pub fn max_loop_iterations(self, count: usize) -> Self

Set maximum loop iterations (per-loop). Passing 0 is treated as “use default” (no-op) to prevent misconfiguration.

pub fn max_total_loop_iterations(self, count: usize) -> Self

Set maximum total loop iterations (across all nested/sequential loops). Prevents TM-DOS-018 nested loop multiplication. Passing 0 is treated as “use default” (no-op) to prevent misconfiguration.

pub fn max_function_depth(self, depth: usize) -> Self

Set maximum function depth. Passing 0 is treated as “use default” (no-op) to prevent misconfiguration.

pub fn timeout(self, timeout: Duration) -> Self

Set execution timeout

pub fn parser_timeout(self, timeout: Duration) -> Self

Set parser timeout

pub fn max_input_bytes(self, bytes: usize) -> Self

Set maximum input script size in bytes. Passing 0 is treated as “use default” (no-op) to prevent misconfiguration.

pub fn max_ast_depth(self, depth: usize) -> Self

Set maximum AST nesting depth. Passing 0 is treated as “use default” (no-op) to prevent misconfiguration.

pub fn max_parser_operations(self, ops: usize) -> Self

Set maximum parser operations. Passing 0 is treated as “use default” (no-op) to prevent misconfiguration.

pub fn max_stdout_bytes(self, bytes: usize) -> Self

Set maximum stdout capture size in bytes. Passing 0 is treated as “use default” (no-op) to prevent misconfiguration.

pub fn max_stderr_bytes(self, bytes: usize) -> Self

Set maximum stderr capture size in bytes. Passing 0 is treated as “use default” (no-op) to prevent misconfiguration.

pub fn max_subst_depth(self, depth: usize) -> Self

Set maximum command substitution nesting depth. Passing 0 is treated as “use default” (no-op) to prevent misconfiguration.

pub fn max_file_descriptors(self, count: usize) -> Self

Set maximum persistent custom file descriptors. Passing 0 is treated as “use default” (no-op) to prevent misconfiguration.

pub fn capture_final_env(self, capture: bool) -> Self

Enable capturing final environment state in ExecResult

Trait Implementations

impl Clone for ExecutionLimits

fn clone(&self) -> ExecutionLimits

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ExecutionLimits

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ExecutionLimits

fn default() -> Self

Returns the “default value” for a type.