Skip to content

fix(http): stop Bun JSON Streamable HTTP memory climb + CI plateau gate - #1390

Merged
cursor[bot] merged 11 commits into
mainfrom
cursor/host-memory-leak-gate-a621
Oct 23, 2026
Merged

cursor[bot] merged 11 commits into
mainfrom
cursor/host-memory-leak-gate-a621

Conversation

@danielsmithdevelopment

@danielsmithdevelopment danielsmithdevelopment commented Oct 22, 2026 •

Copy link
Copy Markdown
Owner

Summary

Stops Bun JSON Streamable HTTP memory climb from orphan _streamMapping entries, adds a CI plateau gate, and clears tip OSV drift that blocked merge.

Changes

  • Bound/prune MCP SDK _streamMapping on JSON-response Streamable HTTP so Bun RSS plateaus under long session reuse
  • CI: Bun --smol JSON memory plateau gate (PR 2k + nightly 30k)
  • Tip OSV: next 16.4.2 (www/dashboard/docs), dompurify 3.4.17 (docs), ip-address 10.7.4 (root + overrides); drop unused sprintf-js ignore

Test plan

  • Local osv-scanner: No issues found (exit 0) after bumps
  • CI Supply chain (OSV + Trivy + SBOM) green
  • Memory plateau gate green
  • Full CI green before merge

Follow-up

Resume Bun host density vs peers (~99–102 MB) once this lands; Rust dataplane path is rejected (ADR 0016 / #1396).

Open in Web Open in Cursor 

cursoragent and others added 10 commits October 22, 2026 15:05
MCP SDK JSON-response mode never cleans `_streamMapping` after resolveJson,
so sessionful multiturn retained one entry per POST and Anonymous climbed
(~200→~3444 MB on the week-1 board). Restore orphan prune after each POST,
close stateless transports, default 30m idle eviction + max live sessions,
and clear IFC labels on session end. Export governance from clawql-api so
native-tool wrap resolves.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Tip lean probe and week-1 board no longer match the published plateau.
Label Anon MB figures as measured on the October 15 build until remasured
after the host memory climb fix.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Short sustained known-op run fails if Anonymous climbs past a slope limit
or hard ceiling, so the next streamMapping-style leak fails at merge time.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Root package.json briefly gained viem from a local payments rebuild and
desynced package-lock, failing npm ci on every job. Remove it and format
the version-scoped docs that Prettier flagged.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Bun CI lacks node:sqlite/`sqlite`, so default CLAWQL_SECRET_STORE=sqlite
killed host startup. Point the gate at memory secret + auth-audit stores.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Expose stream map sizes on /healthz when CLAWQL_BENCH_STATS=1 and add a
~300-POST regression that fails if the host orphan prune disappears.
Document the private-field workaround against typescript-sdk#2559.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Exact pin until a published v1.x release includes the JSON-mode
_streamMapping cleanup (typescript-sdk#2559 / #2747). Re-run the bound
regression test on any SDK bump.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Schedule a full 30k Anonymous slope gate (PR stays at 2k). Document that
the Oct 12 prune never reached main, link upstream #2559/#2747, and keep
the Oct 15 lean floor (~130→170–260 MB) as a separate bisect item.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
CI showed prune holding ~450 MB flat after cold start, but slope from the
first sample and a 450 MB hard cap still failed. Baseline after 20% warmup
and raise the default ceiling so the gate catches real climbs, not tip lean.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Bump next to 16.4.2 (www/dashboard/docs), dompurify to 3.4.17 (docs),
and ip-address to 10.7.4 (root + overrides). Drop unused sprintf-js
ignore so osv-scanner tip stays clean for the memory-plateau PR.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
@danielsmithdevelopment
danielsmithdevelopment marked this pull request as ready for review October 23, 2026 06:41
@cursor
cursor Bot merged commit 69e4f65 into main Oct 23, 2026
27 checks passed
@cursor
cursor Bot deleted the cursor/host-memory-leak-gate-a621 branch October 23, 2026 06:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants