safe-bash: child command dispatch (env/timeout/xargs) allocates ~726 KB per call — 300 × `env true` = fatal OOM at 128 MB isolate

[kamilio]

Where: packages/safe-bash/src/shell/runtime.ts — the child-dispatch path used by env <cmd>, timeout <cmd>, and xargs (invokeChild at :1218, shebangTarget/shebangStage at :3028+, Runtime construction at :1255). Each child dispatch allocates ~726 KB transient (measured, --expose-gc diff: 300 × env true → peak +242 MB, +4 KB/iter retained after GC). Plain builtins cost ~7 KB/iter; function calls ~30 KB/iter — the invoke path is 25–100× heavier.

PoC (Node 22, --max-old-space-size=128 Workers-isolate proxy):

for i in $(seq 1 300); do env true; done

→ fatal V8 OOM at 128 MB heap (uncatchable). Calibration: 150 iters → +43 MB, exit 0; 200 iters → +91 MB; 300 iters → OOM. Same via for i in $(seq 1 300); do timeout 5 true; done and via seq 1 5000 | xargs -n 1 true (+1.4 GB at default heap, OOMs even --max-old-space-size=4096 at ~5 000 dispatches). All budgets green: 300 commands is 3% of maxCommands, zero output, zero expansion bytes. GC cannot keep up because the allocation rate (~726 KB/iter, allocations held live across the child await) outruns the scavenger on a constrained heap.

Impact: (d) — a ~45-byte script kills a Workers isolate (destroying co-resident tenants' in-flight work) in < 1 s of wall clock. env/timeout/xargs are default-registered commands, and xargs is the canonical fan-out tool, so any tenant script that processes a few hundred items via xargs -n 1 or a shell loop around timeout is a reliable isolate killer. On Node it multiplies RSS ~300× vs. the work performed.

Fix: profile the per-dispatch allocation (prime suspects: AbortSignal.any + cancellation owner/boundary graph, InvocationScope chains, Runtime field initialization, per-child env object cloning at :3067 { ...context.env, ...options.env, PWD } — with a large env this alone is O(env) per dispatch). Then: reuse a pooled child-Runtime template, avoid re-cloning env when unchanged (share the parent record), and/or charge each dispatch a flat cost against a budget (e.g. maxCommands priced in KB) so the loop hits a catchable ShellLimitError before the heap does.

[kamilio]

Also affects the two other dispatch-driven constructs (same invokeChild/Runtime path):

• seq 1 500 | while read x; do x=$(true); done — command substitution per iteration OOMs 128 MB at ~500 iters
• seq 1 5000 | xargs -n 1 true — +1.4 GB at default heap; OOMs even --max-old-space-size=4096 around 5 000 dispatches
• pipeline form seq 1 N | while read x; do :; done — ~22 KB/iter transient; OOMs 128 MB at ~5 000 iters (before maxCommands fires at ~6 400)

So the fix should be at the shared dispatch/Runtime-allocation layer, not per-command.

[kamilio]

The Workers limit profile (cloudflareWorkerLimits) does NOT protect against this. Under the shipped CF profile (maxCommands: 1000, maxLoopIterations: 1000, maxWallClockMs: 10_000), for i in $(seq 1 300); do env true; done still OOMs the 128 MB isolate (300 < 1000 loop cap; each iteration's ~726 KB dispatch allocation outruns the scavenger). 150 iters → 73 MB, 300 → fatal. So selecting worker-limits.ts (v2 recommendation #5) is not a mitigation for this class — the per-dispatch allocation itself must shrink or be priced.

[kamilio]

Validated retained child scopes and invoked snapshot bookkeeping; five regression cases failed before the fix. Completed scopes and snapshot ownership now retire after joined work while preserving shared failures, parent bindings, cancellation and output. Lifecycle/discovery controls and full maintained build, workspace units, lint/package checks and Safe Bash types pass. The initial 20 ms timing assertion failure is preserved; unchanged focused and full retries pass without weakening tests. Incoming commits are preserved; the final merge adds only documentation to the qualified runtime. Delivered to main in e4b4c18; closing immediately after remote verification. Publication is monitored separately. No native heap/OOM claim; the separate heredoc snapshot case remains #633.