[IvanMurzak]

Fixes two Code-Exec robustness findings from wave-5 testing. A snippet with deep recursion used to end the Godot editor with a stack overflow, and a synchronous endless loop froze the editor forever. This PR does not release anything or bump the version.

Execution guards (C#, spec §3.6)

The Roslyn adapter (GuardWriter) inserts guard checks into the snippet, full-source code and includes. The guard type is compiled into the snippet's own assembly, so the snippet never binds to a copy of Core.

• Recursion: methods, local functions, accessors, operators, constructors, block lambdas and class field/property initializers check the stack every 8 calls. They check against the host's allowance (CodeRunnerOptions.MaxStackBytes, 1 MiB by default, on the snippet's thread) and against EnsureSufficientExecutionStack. The allowance exists because .NET 8 on Linux took minutes to unwind an exception thrown near the end of an 8 MB stack. Close to the limit the result is a Runtime error, System.InsufficientExecutionStackException: Recursion too deep: ..., not a stack overflow that kills the process. This works on the host's main thread.
• Time: every loop iteration counts down a local counter and every goto a shared one; calls count down too. They read the clock after 1, 2, 4 … up to 256 iterations, and on every iteration while iterations are slow. Once timeoutMs is spent the run stops with Timeout (System.TimeoutException: The snippet ran longer than its time budget of N ms (timeoutMs) and was stopped.), with the snippet's line in the error.
• Catch clauses: clauses that could catch a stop (no type, Exception, SystemException, or the stop's own type) get a when (Running()) filter, so a catch-all inside the loop cannot swallow the stop.
• Coordinates: inserted code sits on its own lines behind #line directives plus padding, so diagnostics and stack frames keep the agent's line and column.
• Options: CodeRunnerOptions.DefaultTimeoutMs (120 000) is used when a request leaves timeoutMs at 0. ExecutionGuards (default true) turns the guards off. A negative timeoutMs is InvalidRequest.
• After the run: a finished run lifts its time budget, so callbacks it left behind keep only the stack check. A timed-out run keeps its stop. On Mono a timed-out assembly is never reused.

Python time budget (spec §4)

• When timeoutMs is spent (or set_default_timeout_ms, default 120 s), a watchdog thread raises SnippetTimeout, a BaseException, in the snippet's thread with PyThreadState_SetAsyncExc, and raises it again every 100 ms while the snippet catches it. The result is errorKind Timeout.
• The stop is disarmed without taking any lock in the snippet thread: on Python 3.14 a stop delivered right after acquiring a lock leaves that lock held. A 1,500-run race stress test on 3.11 and 3.14 had no stop leaking into the host and no leftover threads.
• Recursion: the default limit gives a clean RecursionError. One limit is documented: a snippet that raises sys.setrecursionlimit can still overflow the C stack on 3.11 and older through C-level recursion (repr or json.dumps of a deeply nested list).

Also

• Full-source mode now gets the request's usings and auto-import. The host's default usings are still not added, because adding them could make working code ambiguous. A new CE0003 diagnostic says so and names the unresolved names.
• Unity analyzer warnings UAC0005/0007/0020 are suppressed with narrow pragmas. I checked this against Unity 6000.6.3f1's Unity.Analyzers.Common.dll.

Overhead

Measured on .NET 8 (snippet code is compiled in Debug); the baseline is the same loop without guards:

Case	Overhead
Empty for loop	about +0.8 ns per iteration (+77–150%)
foreach over a List with a sum	+15–39%
Recursive fib(32), non-collectible host (Mono-like)	+1.3 ns per call (+60%)
Recursive fib(32), collectible AssemblyLoadContext	+5.7 ns per call (+250%)

Each call pays more on a collectible load context because statics there are slow to reach.

Python watchdog: about 65 µs per run (one timer thread started per run). A 3M-iteration loop showed no measurable per-bytecode cost (+2%, within noise) on 3.11 and 3.14.

Python 3.10 limit: a loop whose body begins with try or with never receives the stop on 3.10 (the interpreter does not check for pending exceptions there). This is documented, and the test skips that case on 3.10. Unreal uses 3.11, where it works.

Tests

• New GuardTests cover recursion in each guarded form, endless loops of each kind including catch-alls and goto, async, full-source and include code, kept coordinates and kept meaning. Without the guards the recursion tests crash the test host with a stack overflow and the loop tests hang (checked locally).
• New golden cases: endless-loop-timeout and deep-recursion for both runtimes, and full-source-auto-import.
• Python TimeBudgetTests.
• Local runs:
  • .NET tests on Roslyn 3.8, 4.8 and 5.9 (net8.0 and net10.0), plus net48.
  • SourceConsumer builds on Roslyn 3.8 and 4.8.
  • pack.sh plus the package consumer on Roslyn 3.8 and 5.9.
  • Python tests on 3.11, 3.12 and 3.14.

Quality stages: simplify: and code review: commits (two report-only reviewers; their findings were fixed in the code review: commit).

🤖 Generated with Claude Code