Agent Harness Resource Budgets: CPU, Memory & Processes

Once an Agent can execute terminal commands and code, a token budget covers only part of the risk. A model turn can stop on time while tests, compilers, browsers, and background processes continue consuming the host. An October 25, 2026 DeepSeek Harness community proposal organizes the problem around ownership, measurement, budgets, and enforcement, with separate boundaries for the main Agent, Subagents, background jobs, and MCP servers.

The proposal concerns workloads that an Agent launches on the host. High-risk cases include a test allocating memory without bound, recursive process creation, children surviving a timed-out shell, unbounded output, and several Subagents launching the same expensive job concurrently.

What a timeout does not control

A tool-call timeout generally limits how long the caller waits. It does not guarantee that:

• children and grandchildren exit with the parent shell;
• aggregate memory remains below physical RAM;
• CPU time, process count, and open files stay bounded;
• background processes are reclaimed when a Session ends;
• disk writes and logs cannot fill storage;
• one runaway Subagent cannot disrupt unrelated Sessions.

The proposal references incidents from another coding Agent: parallel Subagents left pytest children allocating memory, with one process reaching 144.9 GB; a same-name shell function recursively spawned processes; and timed-out find and grep trees remained active on Windows while security scanning amplified CPU use. Ending a model turn and ending its host workload are separate operations.

Establish resource ownership first

The Harness must answer which execution unit owns a process tree. An operating-system PID alone is insufficient because PIDs are reused and children can be reparented after their launcher exits. A more durable hierarchy is:

Session → Agent → Subagent / background job / MCP server → process tree

Every executable workload receives an execution ID, and later descendants join the same resource container. The usage UI can then attribute CPU time, peak memory, process count, disk writes, and surviving jobs. Enforcement can terminate the complete tree instead of only the top-level shell.

Soft and hard limits have different jobs

Soft limits provide feedback and scheduling. At 70% of a memory budget, the Harness might report remaining capacity, block more high-concurrency tests, or ask the Agent to close existing work. Hard limits protect the host by freezing or terminating the execution unit and recording why.

Subagent budgets must be allocated from the parent. If the parent has 4 GB left, four children cannot each assume an independent 4 GB. Concurrent branches share a total budget while reserving capacity for the Harness, its UI, and the user's other applications.

Enforcement across three platforms

A cross-platform product can expose one budget interface while using native mechanisms underneath:

• Linux: cgroup v2 controls CPU, memory, PIDs, and I/O, and accounts or terminates the container as a unit.
• Windows: Job Objects group related processes, impose memory, CPU, and active-process limits, and can terminate descendants together.
• macOS: process groups, proc_pid_rusage, resource limits, and continuous descendant tracking can be combined; a sandboxed execution service can strengthen the boundary.

Polling a process list alone leaves races: a workload can create many descendants between samples. The operating-system container should enforce hard limits, while the Harness supervisor explains usage and applies policy.

Forced termination still needs a continuation record

Resource protection should return more than “process killed.” A recoverable termination records:

• the Agent, tool call, or background job that crossed a budget;
• peak usage and the configured limit;
• a summary of the terminated process tree;
• produced and potentially incomplete files;
• the last usable checkpoint;
• retry guidance such as lower parallelism, a narrower test target, or a user-approved larger budget.

The model can adjust its next step, and the user can distinguish a code defect, workload-estimation error, and overly small budget. Healthy sibling Sessions should continue rather than losing the complete Desktop process.

Combine host limits with token budgets

Tokens, tool calls, wall time, and host resources belong in one task budget. A Subagent may consume few tokens while starting an expensive local build. Another task may use almost no CPU while repeated verification grows the context. Any single meter understates total cost.

A practical execution loop is:

1. estimate model, tool, time, and host resources before work begins;
2. allocate explicit child budgets and retain a parent reserve;
3. expose remaining budget to the Agent at meaningful thresholds;
4. after a soft limit, reduce concurrency, checkpoint, and request cleanup;
5. at a hard limit, terminate the complete process tree;
6. review provider billing together with host-resource telemetry.

This design complements the Subagent token billing audit and Infinite Agentic Loops analysis. Those cover model calls and loops; this article covers local execution resources.

References

• DSH community proposal for per-Agent resource budgets and enforcement
• Claude Code runaway children exhausting memory
• Claude Code recursive shell function creating a process storm
• Claude Code process trees surviving timeout on Windows
• Linux cgroup v2 documentation
• Windows Job Objects documentation

FAQ

Do resource budgets matter when tools already have timeouts?

Yes. A timeout limits waiting and does not guarantee descendant termination or cap memory, CPU, processes, and disk writes.

Why attribute resources to each Subagent?

Per-Subagent ownership identifies the consumer, lets the supervisor stop only the runaway branch, and correctly divides the parent's shared budget.

Should a hard-limit breach terminate all of DSH?

Usually it should terminate only the responsible execution unit and descendants. The Harness needs its own safety reserve and recovery path so other Sessions remain available.