bug: parallel cf-api execute processes spin at ~100% CPU after caller exits

[ethan-huo]

Summary

Running several mcpx cf-api execute invocations concurrently can leave Bun processes alive after the caller has completed. Each orphaned process spins at roughly one full CPU core indefinitely.

Observed incident

Environment:

• mcpx: 0.9.15
• repository revision: b297d683a33235872b79a4929896f5e16974da53
• Bun: 1.3.14
• macOS: 26.5.2 (25F84), arm64
• server: cf-api

Five independent zone queries were launched concurrently. Four bun .../mcpx cf-api execute children remained alive after the orchestration call had returned. More than two hours later each process still consumed 96–97% CPU:

PID    %CPU  ELAPSED   STATE
34999  96.6  02:23:22  Rs
35000  96.4  02:23:22  Rs
35875  96.3  02:20:49  Rs
35877  96.3  02:20:49  Rs

Two surviving processes used structured --input; two used the equivalent explicit form:

mcpx cf-api execute --raw \
  --account_id ACCOUNT_ID \
  --code 'async () => { const r = await cloudflare.request({ method: "GET", path: "/zones", query: { name: "usemarkd.app", "account.id": accountId } }); return { success: r.success, zones: r.result }; }'

The same request executed sequentially completed normally in about one second. This points to a concurrent lifecycle/cleanup race rather than a permanently pending Cloudflare request.

All four spinning processes exited immediately after SIGTERM; SIGKILL was not required.

Expected behavior

Every mcpx ... execute invocation must terminate after producing its result or error, including when multiple CLI processes run concurrently. No timer, transport, stdio handle, worker, or cleanup loop should keep the Bun process alive or busy-spin after completion.

Suggested regression coverage

Add a process-level test that launches several execute commands concurrently against a deterministic test MCP server, waits for all outputs, and asserts:

• every child exits within a bounded deadline;
• exit codes and outputs are preserved;
• no child remains alive after the parent/orchestrator closes its pipes;
• error and cancellation paths also release transports, timers, workers, and signal handlers.

A CPU-spin detector or bounded post-result process-exit assertion would expose this class of leak directly.

[ethan-huo]

Issue #16 is now the process-lifecycle acceptance gate for #17 and the accepted docs/specs/mcp-runtime-upgrade.md.

The original incident remains the symptom contract. Closure additionally requires deterministic local coverage for concurrent success, error, caller cancellation, and broken-pipe paths; every CLI process must exit within a bounded post-result deadline, and the shared idle Runtime must not busy-spin. No real Cloudflare OAuth or remote MCP endpoint will be used.

[ethan-huo]

Resolved by the Runtime structural upgrade with deterministic local process evidence (no Cloudflare or remote MCP):

• Five concurrent ordinary Calls with expired OAuth credentials all exit with reauth-required and cause zero token requests.
• Five concurrent explicit @refresh CLI processes cause exactly one local token request; all exit, then five Calls succeed.
• Five concurrent successful stdio CLI processes exit within a 3s bound with preserved output; every PID is confirmed absent afterward.
• Five concurrent failing stdio CLI processes exit within the same bound with preserved failure messages; every PID is confirmed absent afterward.
• Killing an active CLI closes its Runtime socket, cancels only its Call, drives active count to zero, and a subsequent Call succeeds on the same session.
• Closed stdout/broken-pipe behavior exits within a bounded deadline.

Structural cause removal:

• short-lived CLIs no longer own MCP transports, OAuth callback servers, token refresh locks, daemon queues, or schema workers
• the user-local Runtime owns sessions and one removable FIFO per server key
• each Call owns its disconnect listener and AbortController

Validation:

• full bun run check: 122 pass, 0 fail; typecheck and formatting pass
• stdio and Streamable HTTP cancellation matrices pass
• prototype format check and git diff --check: pass

[ethan-huo]

Final acceptance supersedes the earlier intermediate test count and stdio-only process note:

• pinned runtime: Bun 1.3.14 and @modelcontextprotocol/sdk 1.29.0
• five concurrent local Streamable HTTP CLI processes pass for success, tool error, caller cancellation, and broken stdout; all exit within bounded deadlines and every observed PID is gone
• five concurrent explicit @refresh CLI processes make exactly one request to the local token fixture
• Runtime stop cancels an active refresh before returning
• stdio and Streamable HTTP cancellation matrices cover acknowledge, ignore, response race, and complete-before-cancel while preserving session reuse
• full gate: 120 tests passed; typecheck, format, prototype evidence, and git diff --check passed

No real Cloudflare OAuth, Cloudflare API, PostHog, or other remote MCP was accessed.

[ethan-huo]

Released in v0.10.2 via PR #24 and follow-up release hardening in PRs #25 and #26.

Closure evidence:

• caller-owned queued/active cancellation with reusable stdio and Streamable HTTP sessions
• five concurrent explicit OAuth callers share one active local flow
• CLI exit and Runtime shutdown regressions pass with local fixtures only
• public release asset reports Runtime protocol v3 and version 0.10.2 with empty stderr

No real OAuth provider or remote MCP was accessed during regression verification.