bug(javascript): public Bun module exhausts bounded heap and terminates CLI/MCP

The public Claude Code 2.1.296 package provides a shareable reproducer for JavaScript semantic-analysis heap exhaustion. This resource-scaling failure is separately reproducible from private bundle regression #1387 and responsiveness #1462. Refs #1065.

Public report: https://x.com/servasyy_ai/status/2108846931183378537 . Official X oEmbed text and video frames were inspected. The video names Claude Code 2.1.296 and reports 2,589 Bun modules / 47.3 MiB extracted contents, but does not show the actual REA version, heap, failing command, or fatal stderr. The reporter's exact crash remains unverified.

Independent artifact:

Official npm @anthropic-ai/claude-code-linux-x64@2.1.296; npm SHA512 integrity verified.
Native file 257068216 bytes, SHA256 24972e3bc859fab2b46ed4c1e51f7d6130f06d3bd550811a114640de3370d0de.
Producer ELF .bun module table: 2,589 records, 49647008 source bytes. Text was decoded according to producer encoding; the target was never executed.
2,347 .js files / 45765393 extracted UTF8 bytes; REA inventories 2,351 relevant files. The extensionless Bun entry cli was preserved and is not claimed analyzed as JavaScript.
Failing member chunk-kasbfbhj.js, 4762637 bytes, SHA256 64516393b8f06dce5b74140781d43b1df4e743de3e283526a533508ca1c58147.

Independent results:

Linux x64, Node 24.18.0/npm 11.16, CPUs 13/15, nice 10, family RSS cap 2304 MiB, host reserve 2 GiB, core dumps disabled.
Initial current-main integration a310f190 = main a6d6e595 + cooperative scans subsequently merged in fix(javascript): yield during receiver and reference classification #1557.
Old-space 768 MiB: full directory CLI exits 134 after 170.67 s; family peak 1107546112 bytes. Last progress names chunk-kasbfbhj.js (1432/2351). Fatal stderr: Reached heap limit Allocation failed - JavaScript heap out of memory. The outer RSS guard did not kill it.
Old-space 768 MiB: isolated same member CLI exits 134 after 33.81 s, family peak 1066381312 bytes. Failure does not require accumulation from earlier files.
Separate production-domain diagnostic: parsing (~3.8 s), receiver classification and static scan complete; fatal allocation occurs within analyzeParsedJavaScriptSemanticsSteps. Its exact collector/allocation remains unestablished. This failure precedes final application-result JSON serialization. A CJS parser observer did not intercept the bundled CLI parser and supplies no phase attribution.
Old-space 1024 MiB: isolated-member CLI completes in 95.29 s, family peak 1299931136 bytes. This is a measured workaround for that member; it does not establish the reporter's default-heap behavior.
Exact merged main 8c47a9ce4b1349b3ccd50da8f8c587a3080759af: full-directory CLI with old-space 1024 MiB still exits 134 after 201.69 s, family peak 1356345344 bytes. Same largest member at 1432/2351; fatal heap allocation before any JSON output. No outer RSS/host-reserve/timeout stop. The isolated 1024 MiB success does not make this a full-tree workaround.
Exact merged main real stdio MCP/SDK: complete 139-tool catalog, warmed binary_session and pre-call ping, same isolated member/768 MiB old-space. Fatal heap OOM terminated the server; analysis rejected with {'kind': 'client_error', 'name': 'SdkError', 'code': 'CONNECTION_CLOSED', 'message': 'Connection closed'}; the next ping rejected with {'kind': 'client_error', 'name': 'Error', 'message': 'Not connected'}. Family peak 1391751168 bytes; target SHA remained unchanged. This is process/connection loss, not a typed resource_constraint from a live server. The harness exit 0 means the expected defect assertions passed, not that analysis succeeded.
Published npm rea-agents@6.3.0 artifact (integrity verified, all 33 dependency versions matched exactly): same isolated member/768 MiB old-space also exits 134 after 37.82 s, family peak 1040461824 bytes, fatal heap allocation. This is an independent packaged-artifact reproduction; the original post may have used different limits.
All 2,589 extracted file digests match after the full 768 MiB run. No target execution, native provider, installed target configuration changes, retained huge raw JSON, or core dump.

Minimal public reproduction (literal offsets apply only to this verified package):

npm pack --ignore-scripts @anthropic-ai/claude-code-linux-x64@2.1.296
python3 - <<'PY'
import tarfile, hashlib, pathlib
with tarfile.open('anthropic-ai-claude-code-linux-x64-2.1.296.tgz') as t:
    binary = t.extractfile('package/claude').read()
assert hashlib.sha256(binary).hexdigest() == '24972e3bc859fab2b46ed4c1e51f7d6130f06d3bd550811a114640de3370d0de'
source = binary[215598946:215598946 + 4762637]
assert hashlib.sha256(source).hexdigest() == '64516393b8f06dce5b74140781d43b1df4e743de3e283526a533508ca1c58147'
target = pathlib.Path('rea-claude-memory-repro')
target.mkdir(exist_ok=True)
(target / 'chunk-kasbfbhj.js').write_bytes(source)
PY
NODE_OPTIONS=--max-old-space-size=768 node scripts/rea.mjs analyze-javascript-application "$PWD/rea-claude-memory-repro" --json > /dev/null

Run the final command from a built REA checkout using Node 24.18.0. Extraction reads packaged bytes only.

Follow-up:

Attribute retained/expanded allocations within the semantic stage with this real producer, rather than assuming a size-only problem or JSON maximum-string limit.
Reduce repeated/expanded representations while preserving semantic facts, Evidence identity, classifications and meaningful unknowns.
If the analysis cannot fit supported resource bounds, preserve actionable resource failure through CLI/MCP rather than terminating the process. MCP recovery and owned cleanup require separate real verification.
Keep selected Node heap, default heap, physical/family RSS and transport framing failures distinct. Do not close 6.3.0: analyze-javascript-application --json aborts on a large bundle that 6.2.0 completes #1387 without its owner's private-bundle verification.

Rechecked current main a97bd5ed297cd9159b3ba1909b94b54ca62b206b against the same official Claude Code 2.1.296 member (chunk-kasbfbhj.js, SHA256 64516393b8f06dce5b74140781d43b1df4e743de3e283526a533508ca1c58147). The defect remains reproducible.

Phase-only instrumentation of compiled diagnostic copies, with the repository runtime left unchanged, narrowed the 768 MiB old-space failure to collectJavaScriptSemanticObjects: the preceding definitions, member mutations, references, binding values, returns and other derived collectors completed. The process terminated with SIGABRT; the outer RSS/timeout guard did not stop it. This diagnostic is narrower than a public CLI/MCP workflow.

A successful 1024 MiB domain run recovered the full IR: 82,461 bindings, 252,716 references, 86,112 call sites and 91,009 object operations. Its complete serialized representation is 256,300,420 bytes, SHA256 c109f190e1fb1719b73705096730bf4876338d191a9a07d88e3f6eaed019df04. The hash was streamed one record at a time, without keeping a giant JSON copy.

An allocation experiment replaced only the high-volume call-site, object-operation and return-site ID construction with single joins. It completed the same domain analysis at 768 MiB with the identical full IR byte count and hash. However, the actual CLI still exhausts its heap: current public startup/static analysis has additional live memory, and CLI phase instrumentation now locates that failure earlier in member-mutation analysis. Therefore this improvement alone is not a fix for this issue.

I am testing lazy allocation of the mutation observer's empty collections next. The existing 346 affected source tests pass. Public CLI/MCP recovery and the full extracted directory remain required before any resolution claim. Resource proposal #1565 is still a proposal, rather than an implemented workaround.

@N0zoM1z0

Confirming the root cause from a local clone of origin/main @ 6543405: the semantic resource limits in src/domain/javascript/javascriptSemanticResourceLimits.ts:7-11 only bound single primitive values (256 candidates / 1 MiB JSON bytes) — there is no module-payload-level budget, and the JS semantic main path (src/application/javascript/JavaScriptArtifactGraphBuilder.ts:117) applies limits only as post-hoc accounting, so a multi-MiB bundled module expands inside the host CLI/MCP heap and terminates the whole process. The repo already has the right precedent in src/javascript/sourceMaps/SourceMapDecoder.ts (independently bounded owned process).

Working on a fix now: bound oversized module payloads so the semantic stage degrades to unknown + a resource-limit reason instead of killing the process, reusing semanticResourceLimitUnknown, keeping clear of the general timeout design in #1565 (this is payload-scale isolation only) and not touching the private-bundle regression in #1387.

Heads-up on coordination: I saw @N0zoM1z0's allocation experiments — I'm taking the process-boundary/budget lane, not the collector-allocation lane, to avoid stepping on that work.

Disclosure: AI-assisted contribution (Claude), as with other PRs in this repo.

@N0zoM1z0

Follow-up on my claim above: the payload-bound fix is implemented and verified locally on fix/1563-js-payload-bound (base origin/main c1b5ccf0); this run's scope ends at a local commit, no PR from this account.

Correction: an earlier version of this comment reported the subset as "1023 passed / 6 failed"; the actual observed numbers are below (1018 passed / 6 failed on this branch, 1013 passed / 6 failed on clean c1b5ccf0).

Root cause confirmed at c1b5ccf0: src/domain/javascript/javascriptSemanticResourceLimits.ts bounds only single primitive values; nothing budgets the module payload itself, so the JS semantic main path (src/application/javascript/JavaScriptArtifactAnalysis.ts → analyzeParsedJavaScriptSemanticsSteps) expands the multi-MiB member inside the host heap.

Fix: modules above a 2 MiB (SEMANTIC_MODULE_SOURCE_BYTES_LIMIT) source-payload budget skip deep semantics with an explicit failed coverage carrying a new named module-source-bytes limit plus a disclosed limitation — static analysis and every smaller module continue unaffected, so the CLI/MCP process survives and coverage stays partial with the bound named, per the issue's follow-up ("preserve actionable resource failure through CLI/MCP"). This deliberately takes the payload-isolation lane and stays out of the collector-allocation lane @N0zoM1z0 is instrumenting and the general timeout design in #1565.

Measured on macOS arm64, Node 24.14.0, official package bytes (tarball SHA512 matched the npm registry integrity; member SHA256 64516393… verified; target never executed):

main: NODE_OPTIONS=--max-old-space-size=768 isolated member → exit 134, FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory, zero output (matches the issue).
fix, same command → exit 0; result coverage.status=partial with limits=[{name: javascript_semantic_module_source_bytes, value: 2097152, unit: bytes}] and the payload-budget limitation; the member's static parse_status stays complete.
Note: at a 2048 MiB old space main completes this isolated member (exit 0), so the fixed 2 MiB budget trades that full analysis for a disclosed degradation — deterministic bounds over heap-proportional behavior; raising the budget is a policy knob, not a redesign.

Tests: 5 new domain/services tests pass. npx vitest run --project domain --project services src/domain/javascript src/application/javascript observed 1018 passed / 6 failed (1024 tests, 59 files) on this branch and 1013 passed / 6 failed (1019 tests, 57 files) on clean c1b5ccf0 (temporary worktree at that commit); the same 6 tests fail in both runs, so they predate this change. The adapters JS+artifacts slice (npx vitest run --project adapters src/artifacts src/javascript) passes 107/107; typecheck, oxlint, oxfmt, module boundaries and git diff --check clean. Disclosure: AI-assisted (Claude).

Allocation work is now tracked in draft #1601. This is a partial improvement; #1563 is still reproducible and should remain open.

I integrated main 603d04ee and verified the resulting runtime e00c2bf123b6e006c753895fb084cd6f287a8b11 on Linux x64, Node 24.18.0/npm 11.16.0, CPUs 13/15, nice 10, one heavy lane, a 2304 MiB process-family RSS guard, and 2 GiB host reserve:

The actual 4,762,637-byte chunk-kasbfbhj.js produces the same complete 256,300,420-byte semantic IR at 768 MiB old-space: SHA256 c109f190e1fb1719b73705096730bf4876338d191a9a07d88e3f6eaed019df04. Peak family RSS: 1,036,480,512 bytes. This checks semantic preservation through the production domain path, not a full CLI success at that heap size.
A real pinned-SDK MCP server at 1024 MiB old-space completes that member and retains its result after the typed transport-size constraint. Summary, module page, exact node selection, a one-node incoming feature trace, ping, close/stale-reference, and a subsequent small analysis pass. The complete catalog has 170 tools. Peak family RSS: 1,599,377,408 bytes; the source digest is unchanged. The graph still reports its existing ceiling and partial semantic coverage.
The full 2,351-relevant-file extracted directory at 1024 MiB old-space still fails at the same member: exit 134 with fatal heap exhaustion, 190.45 seconds, 1,355,137,024-byte peak family RSS, and zero CLI stdout. The external guard did not stop it. No general throughput claim follows from these single runs.

The PR flattens high-volume ID construction, lazily materializes mutation-observer collections, and reuses the existing AST parent index for lexical scope lookup. It adds no source-size cutoff, result cap, or skipped facts. Its CI remains pending/blocked by current main regressions, including fixture corrections already in #1603; it has not been merged.

For the proposed fixed 2 MiB source cutoff, please keep its coverage tradeoff explicit: it would skip semantics for this 4.76 MB member even though the allocation candidate now completes its full IR at 768 MiB in the production domain lane. Source length alone does not measure retained semantic representation. That proposal is distinct from a supervised process boundary that can preserve static observations, report a real resource failure, and keep the CLI/MCP host alive. I have not independently verified the unpublished cutoff patch or an isolation implementation.

Opened #1610 with the bounded fix: modules above a 2 MiB source-payload budget now degrade to explicit failed coverage (named javascript_semantic_module_source_bytes limit + disclosed limitation) instead of exhausting the heap; the process survives and coverage stays partial. Rebased on current main; red (exit 134) re-verified on main 11e3fae6, green (exit 0, partial coverage, static parse complete) at 768 MiB and 2048 MiB.

🤖 Generated with Claude Code

Latest integration check: #1601 at 03994825c118ced5eef90d62d5757c49d76147bd preserves the independent ancestry-cache follow-up and main's Android cleanup/bundled-runtime relationship repairs. The full-directory OOM remains reproducible, so #1563 stays open.

The real 4,762,637-byte member still completes production domain semantics at 768 MiB old-space with the identical full 256,300,420-byte IR, SHA256 c109f190e1fb1719b73705096730bf4876338d191a9a07d88e3f6eaed019df04. The actual pinned-SDK MCP server at 1024 MiB passes result retention after the transport constraint, summary/page/exact node selection/one-node trace, close/stale-reference and subsequent small analysis/ping. The 170-tool catalog is complete, input bytes are unchanged, and retained Evidence is ev_c11a23f39bc7f3f371eeea1c5754dbc2d3923b124b2ac83562c73112f27c87a9. Graph semantic coverage still reports the existing partial ceiling.

The complete 2,351-relevant-file extracted-directory CLI at the same head and 1024 MiB old-space still reaches fatal heap exhaustion at the same member (1432/2351): exit 134, 166.14 seconds, 1,355,161,600-byte peak process-family RSS, zero CLI stdout. The external guard did not stop it. The narrower successful workflows therefore do not establish a full fix, and these noisy single runs do not establish a general speedup.

Independent current-integration checks: 458 selected semantic tests, including the ancestry-read growth regression, pass; 33 JADX subprocess-boundary and 11 runtime-scope domain/public-CLI cases pass after integrating the relevant main repairs. Build/typecheck/lint pass. Final-head CI is running; the PR has not been merged. Linux x64, Node 24.18.0, CPUs 13/15, nice 10, one heavy lane, 2304 MiB family-RSS guard and 2 GiB host reserve. No new Windows/macOS memory or real JADX/Hopper/Ghidra coverage is claimed.

I independently built and reviewed #1610 at exact head 808ded32c4b18691365ca5fcc54c090621c92c25; the original complete directory still kills both public workflows, so #1563 remains unresolved.

Original Claude Code 2.1.296 extracted directory, 2351 relevant files, Linux x64/Node 24.18.0, 768 MiB old-space: CLI exits 134 at chunk-kasbfbhj.js (1432/2351), fatal heap exhaustion, zero stdout, 170.64 seconds. Peak family RSS 1,165,242,368 bytes; no external guard stop.
Real pinned-SDK stdio MCP on the same directory: 170-tool catalog/initial ping succeed, then fatal heap exhaustion and CONNECTION_CLOSED after 174.60 seconds. Subsequent ping and a small analysis both report Not connected. Server 768 MiB/parent 512 MiB; peak family RSS 1,411,112,960 bytes; no guard stop. Culprit SHA unchanged.
A synthetic 1,600,024-byte file, below the proposed 2 MiB cutoff, also kills the CLI and real MCP server at 768 MiB. Source: function f(){return 1;}\n followed by f(); repeated 400000 times; SHA256 fd861fc0c984035c6c9a41df7bf389f6e82a69404f7bf91323159e0aa56f6efe. This is a distinct synthetic counterexample, not the tweet's target.
A large inert-comment control does return the explicitly skipped/partial coverage and remains usable afterwards. That verifies the skip policy; it does not bound actual parsing, semantic expansion or accumulated representations.

The check is after parsing/classification/static analysis. Full evidence and the blocking review: #1610 (review) . A genuinely bounded supervised boundary/admission treatment is still needed to preserve collected facts and keep the host alive. No claim is made for higher-heap full-tree success, Windows/macOS or private #1387.

#1601 remains a partial allocation improvement, unmerged because final-head CI has maintenance-boundary failures. I reproduced those failures and am correcting the stale browser/uninstall/diagnostic tests separately; firmware recovery is already in #1616. #740 stays deferred.

The complete original directory remains reproducible on the recently refreshed main production sources dce81ca400eda369fe65b3de6e5a9aef4dfdaa50, including the graph/factory and process optimizations.

The runtime was freshly rebuilt in test-only #1617 at c2e2ed9aa2469b7ff8225018fddc8c6e071ebe5a; git diff --name-only MAIN HEAD -- src bridge scripts package.json package-lock.json returned no paths. This records production-source equivalence, not byte-for-byte package/build-metadata equivalence. Neither #1601's allocation changes nor #1610's cutoff are included.

Actual full-directory CLI, 2351 relevant files, Linux x64/Node 24.18.0, 1024 MiB old-space: exit 134, fatal heap exhaustion at chunk-kasbfbhj.js (1432/2351), zero stdout, 207.93 seconds. Peak family RSS 1,339,428,864 bytes; the external RSS/time guard did not stop it. All 2589 extracted files were independently rehashed afterwards: zero mismatches. No general throughput comparison follows from this single run.

The PR1610 review separately establishes full original CLI/MCP server death at 768 MiB and the below-cutoff synthetic counterexample: #1610 (review) . #1563 remains open; a reliable analysis resource boundary has not yet landed.

perf(javascript): reduce retained semantic analysis allocations (#1601)

#1601 is now merged as b28c0337fcb3f34533ffb61a8220e802eb6973e7. All 20 checks passed at its final head a2255f49, including the complete CI run and real JavaScript recovery. The complete-directory memory failure remains reproducible after that merge.

Freshly built main b28c0337, original 2,351-file directory, Linux x64 / Node 24.18.0, two CPUs / reduced priority / 2,304 MiB family RSS guard:

Actual CLI, 1,024 MiB old-space: exit 134, fatal heap exhaustion at chunk-kasbfbhj.js (1432/2351), zero stdout, 165.38 seconds. Sampled peak family RSS: 1,367,728,128 bytes.
Actual pinned-SDK stdio MCP, server 768 MiB / client 512 MiB: all 170 tools and initial ping succeed; analysis loses the connection after 170.08 seconds with fatal heap exhaustion. Subsequent ping and a small analysis both report Not connected. Sampled peak family RSS: 1,427,992,576 bytes.
Neither workflow was stopped by the outer guard. All 2,589 original extracted files were independently rehashed after each workflow: zero mismatches. The target was never executed.

The resource boundary also needs to account for returned representations. A separate file-local diagnostic at a2255f49, using the production parser/semantic/projector with empty application bindings, measured the same member:

Complete IR: 256,300,420 bytes, identical SHA256 c109f190e1fb1719b73705096730bf4876338d191a9a07d88e3f6eaed019df04.
Projected graph: 148,462,167 bytes, despite the 20,000-node ceiling; it retains 156,786 unknowns. Module facts add 9,175,244 bytes. These were streamed into byte counts/digests, without keeping giant JSON files.
An owned 768 MiB diagnostic worker exhausted its heap; its 512 MiB parent could still read and verify the completed 189,811-byte static checkpoint after worker death, confirm worker/root cleanup and analyze a small file afterwards. The compact report retains the checkpoint digest/counts. This is a boundary experiment, not a shipped CLI/MCP fix, persistent result-retention guarantee or proof of safe graph transfer.

#1563 and #1565 remain open. A source-length cutoff does not establish the required parsing, semantic expansion, accumulated-result, transfer and parent-recovery bounds. The blocking #1610 review remains applicable: #1610 (review) .

A further implementation checkpoint now validates file-local projection and record transfer against the real original source. The production codec transferred 151,019,319 bytes in 217,400 records, including the 9,175,244-byte module projection. An independent decoder configured with a 512 MiB V8 old-space limit validated the records, retained the module facts through graph sealing, and reproduced the frozen inline graph commitment with a realm-local immutable proof. Producer and decoder exited normally; both process cleanups were verified, their temporary record files were removed, and the original source digest was unchanged.

The affected CLI/filesystem/composition lanes passed 83 tests. A stronger decoded-facts-to-application-graph regression also passes, alongside typecheck, lint, Knip and architecture guards. This establishes the file-transfer boundary; it does not establish complete-tree memory bounds or a shipped CLI/MCP recovery fix. Persistent process supervision, accumulated-result admission, and application-visible static facts on worker failure are still being connected. #1563 and #1565 remain open.

The owned-worker fix is ready for review in #1651; it is not merged or released yet.

The complete extracted feedback directory now finishes under 768 MiB parent/worker heaps: 2346 JavaScript files parsed, all 2589 input hashes unchanged, no parent heap failure or leftover owned runtime roots. Graph coverage remains partial where deeper projection does not fit. The full analysis is retained when the default MCP response exceeds its existing transport budget; summary/page/item/trace, close/stale and a subsequent small analysis all passed. Sampled process-family peak was 1.70 GiB.

A separate 1.6 MB dense source actually exhausted its 512 MiB worker during semantic extraction. Its completed static observations survived and the MCP parent continued accepting work. Real Notion ASAR also passed with explicit partial coverage and 98 control pings (maximum 13.31 ms). CLI cancellation preserved the first completed source in full JSON partial Evidence. The production package verifier and 154 focused tests passed; native Windows install testing and exact-head CI are still running.

Navigation Menu

Repository navigation

bug(javascript): public Bun module exhausts bounded heap and terminates CLI/MCP #1563

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

bug(javascript): public Bun module exhausts bounded heap and terminates CLI/MCP #1563

Description

Activity

N0zoM1z0 commented on Oct 10, 2026

akushonkamen commented on Oct 10, 2026

akushonkamen commented on Oct 10, 2026

N0zoM1z0 commented on Oct 10, 2026

akushonkamen commented on Oct 10, 2026

N0zoM1z0 commented on Oct 10, 2026

N0zoM1z0 commented on Oct 10, 2026

N0zoM1z0 commented on Oct 10, 2026

N0zoM1z0 commented on Oct 10, 2026

N0zoM1z0 commented on Oct 10, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions