[LOW] Memory leak risk in session management

[Tsukieomie]

Performance Issue: Potential Memory Leak in Sessions

Severity: LOW
Location: src/main/lib/trpc/routers/claude.ts:140, 173

Description

Session maps grow unbounded without size limits or LRU eviction.

Code

const activeSessions = new Map<string, AbortController>()
const pendingToolApprovals = new Map<string, ...>()

Current Protection

• Cleanup in unsubscribe ✓
• But no max-size limit ✗
• No timeout for stale sessions ✗

Risk

If cleanup fails (error, crash, network issue), entries persist in memory indefinitely.

Recommendation

1. Add Size Limits

const MAX_SESSIONS = 100
const MAX_PENDING_APPROVALS = 50

if (activeSessions.size >= MAX_SESSIONS) {
  // Evict oldest session
  const oldestKey = activeSessions.keys().next().value
  activeSessions.delete(oldestKey)
}

2. Add Timeout for Stale Sessions

const SESSION_TIMEOUT = 1000 * 60 * 30  // 30 minutes

setInterval(() => {
  const now = Date.now()
  for (const [id, session] of activeSessions) {
    if (now - session.lastActivity > SESSION_TIMEOUT) {
      session.controller.abort()
      activeSessions.delete(id)
    }
  }
}, 1000 * 60 * 5)  // Check every 5 minutes

3. Use LRU Cache

import { LRUCache } from 'lru-cache'

const activeSessions = new LRUCache<string, AbortController>({
  max: 100,
  ttl: 1000 * 60 * 30,  // 30 min TTL
  dispose: (controller) => controller.abort()
})

4. Add Memory Monitoring

// Log memory usage periodically
setInterval(() => {
  console.log('[Memory] Active sessions:', activeSessions.size)
  console.log('[Memory] Pending approvals:', pendingToolApprovals.size)
  console.log('[Memory] Heap:', process.memoryUsage().heapUsed)
}, 1000 * 60)  // Every minute

Impact

Low but important for long-running app - could cause memory bloat over time.

Labels: performance, memory