feat(security): define tool execution budgets

[luoye520ww]

Problem

Tool processes currently use unrelated timeout and output limits. There is no shared contract for process count, memory/CPU budgets, or network policy, so future runtime integrations could silently inherit unsafe defaults.

Root cause

Resource limits are defined per provider or tool family rather than at the managed-tool boundary. The existing ToolOutputLimitsConfig only covers output formatting and is not a process execution policy.

Scope

This PR defines the ToolExecutionBudget contract only. It does not change shell, MCP, LSP, extension-host, or subagent execution yet.

Changes

• Add bounded timeout and output byte limits.
• Add optional process count, memory, and CPU time limits.
• Add none, approved, and full network policies with none as the default.
• Export the contract through kun/contracts.
• Add tests for defaults, valid bounded budgets, unknown policies, unknown fields, and out-of-range values.

Safety

• Network access defaults to none.
• All numeric values are positive integers with platform-independent upper bounds.
• The schema is strict and rejects unknown fields.
• No runtime behavior changes in this PR; there is no false claim that process isolation is already active.

Typecheck

npm.cmd --prefix kun run typecheck
npm.cmd run typecheck

Both passed.

Tests

npm.cmd --prefix kun test -- tests/tool-execution-budget.test.ts

Result: 1 file, 3 tests passed.

Actual validation

npm.cmd run lint and npm.cmd run build passed. The targeted tests parse the real contract and verify safe defaults and rejection boundaries.

Review performed

• Functional correctness
• Security defaults and network policy
• Numeric and payload bounds
• Compatibility with existing output-limit configuration
• Cross-platform behavior
• Test quality and PR scope

PR size

Production files: 2
Test files: 1
Production LOC: 15
Total diff: 49 lines

Follow-ups

Runtime enforcement is split into process registry, shell/LSP/extension-host integration, and network approval PRs.

[luoye520ww]

Superseded by consolidated tool/process lifecycle PR #946, which passed Typecheck, Linux, macOS, and Windows packaged checks. Closing this duplicate to keep the review surface focused.