Add per-session code-mode execution limits (#37114)

## What changed

- Add `create_session_with_limits` and session-scoped cell execution limits.
- Clamp execute and wait yield times to the session's `max_yield_time_ms`
  without terminating the running cell.
- Negotiate support with remote code-mode hosts and include non-default limits
  in `session/open`, while keeping unlimited sessions compatible with hosts and
  providers that do not support limits.

## Testing

- Cover yield-time clamping, zero-timeout behavior, and isolation between
  sessions.
- Cover wire serialization, capability negotiation, unsupported hosts, and
  shared process-host execution.

GitOrigin-RevId: 9517321cd605bb87f93eeaa6ba331cc2e346e582

codex-rs/code-mode-runtime/src/service.rs

@@ -4,6 +4,7 @@ use std::time::Duration;
 use codex_code_mode_protocol::CellId;
 use codex_code_mode_protocol::CodeModeNestedToolCall;
 use codex_code_mode_protocol::CodeModeSession;
+use codex_code_mode_protocol::CodeModeSessionCellExecutionLimits;
 use codex_code_mode_protocol::CodeModeSessionDelegate;
 use codex_code_mode_protocol::CodeModeSessionResultFuture;
 use codex_code_mode_protocol::CodeModeToolKind;
@@ -29,17 +30,9 @@ use crate::session_runtime::SessionRuntime;
 const YIELD_GRACE_PERIOD: Duration = Duration::from_secs(1);
 const MIN_YIELD_TIME_FOR_GRACE: Duration = Duration::from_secs(10);
 
-fn yield_timeout(yield_time_ms: u64) -> Duration {
-    let yield_time = Duration::from_millis(yield_time_ms);
-    if yield_time >= MIN_YIELD_TIME_FOR_GRACE {
-        yield_time.saturating_add(YIELD_GRACE_PERIOD)
-    } else {
-        yield_time
-    }
-}
-
 pub struct InProcessCodeModeSession {
     runtime: SessionRuntime<ProtocolDelegate>,
+    cell_execution_limits: CodeModeSessionCellExecutionLimits,
 }
 
 impl InProcessCodeModeSession {
@@ -48,20 +41,36 @@ impl InProcessCodeModeSession {
     }
 
     pub fn with_delegate(delegate: Arc<dyn CodeModeSessionDelegate>) -> Self {
+        Self::with_delegate_and_limits(delegate, CodeModeSessionCellExecutionLimits::default())
+    }
+
+    pub fn with_delegate_and_limits(
+        delegate: Arc<dyn CodeModeSessionDelegate>,
+        cell_execution_limits: CodeModeSessionCellExecutionLimits,
+    ) -> Self {
         Self {
             runtime: SessionRuntime::new(Arc::new(ProtocolDelegate { delegate })),
+            cell_execution_limits: CodeModeSessionCellExecutionLimits {
+                max_heap_size_bytes: None,
+                ..cell_execution_limits
+            },
         }
     }
 
     pub fn with_delegate_and_task_failure_handler(
         delegate: Arc<dyn CodeModeSessionDelegate>,
         task_failure_handler: Arc<dyn Fn(String) + Send + Sync>,
+        cell_execution_limits: CodeModeSessionCellExecutionLimits,
     ) -> Self {
         Self {
             runtime: SessionRuntime::new_with_task_failure_handler(
                 Arc::new(ProtocolDelegate { delegate }),
                 Some(task_failure_handler),
             ),
+            cell_execution_limits: CodeModeSessionCellExecutionLimits {
+                max_heap_size_bytes: None,
+                ..cell_execution_limits
+            },
         }
     }
 
@@ -71,7 +80,7 @@ impl InProcessCodeModeSession {
             .runtime
             .execute(
                 runtime_request(request),
-                runtime::ObserveMode::YieldAfter(yield_timeout(yield_time_ms)),
+                runtime::ObserveMode::YieldAfter(self.resolve_yield_timeout(yield_time_ms)),
             )
             .await
             .map_err(|error| error.to_string())?;
@@ -126,7 +135,7 @@ impl InProcessCodeModeSession {
             .runtime
             .begin_observe(
                 &runtime_cell_id,
-                runtime::ObserveMode::YieldAfter(yield_timeout(yield_time_ms)),
+                runtime::ObserveMode::YieldAfter(self.resolve_yield_timeout(yield_time_ms)),
             )
             .await
         {
@@ -185,6 +194,20 @@ impl InProcessCodeModeSession {
             .await
             .map_err(|error| error.to_string())
     }
+
+    fn resolve_yield_timeout(&self, yield_time_ms: u64) -> Duration {
+        let yield_time = Duration::from_millis(yield_time_ms);
+        let timeout = if yield_time >= MIN_YIELD_TIME_FOR_GRACE {
+            yield_time.saturating_add(YIELD_GRACE_PERIOD)
+        } else {
+            yield_time
+        };
+
+        self.cell_execution_limits
+            .max_yield_time_ms
+            .map(Duration::from_millis)
+            .map_or(timeout, |limit| timeout.min(limit))
+    }
 }
 
 impl Default for InProcessCodeModeSession {