fix: resolve 10 memory leak sources across multiple subsystems

Fixes subagent session deallocation, delta string cap, tool output on compact,
SSE buffer guard, MCP OAuth transport TTL, pending permissions cleanup,
TUI event listener cleanup, LSP diagnostics cap, and AbortSignal listener.

Original work from PR anomalyco#14650 by @kryptobaseddev
Co-authored-by: Keaton Hoskins <[email protected]>

Author: kryptobaseddev

packages/app/src/context/global-sync/event-reducer.ts

@@ -252,7 +252,12 @@ export function applyDirectoryEvent(input: {
           const part = draft[result.index]
           const field = props.field as keyof typeof part
           const existing = part[field] as string | undefined
-          ;(part[field] as string) = (existing ?? "") + props.delta
+          const MAX_PART_STRING_LENGTH = 1_048_576 // 1 MB per part field
+          const combined = (existing ?? "") + props.delta
+          ;(part[field] as string) =
+            combined.length > MAX_PART_STRING_LENGTH
+              ? combined.slice(combined.length - MAX_PART_STRING_LENGTH)
+              : combined
         }),
       )
       break

packages/opencode/src/cli/cmd/tui/app.tsx

@@ -3,7 +3,7 @@ import { Clipboard } from "@tui/util/clipboard"
 import { Selection } from "@tui/util/selection"
 import { MouseButton, TextAttributes } from "@opentui/core"
 import { RouteProvider, useRoute } from "@tui/context/route"
-import { Switch, Match, createEffect, untrack, ErrorBoundary, createSignal, onMount, batch, Show, on } from "solid-js"
+import { Switch, Match, createEffect, untrack, ErrorBoundary, createSignal, onMount, onCleanup, batch, Show, on } from "solid-js"
 import { win32DisableProcessedInput, win32FlushInputBuffer, win32InstallCtrlCGuard } from "./win32"
 import { Installation } from "@/installation"
 import { Flag } from "@/flag/flag"
@@ -673,11 +673,11 @@ function App() {
     }
   })
 
-  sdk.event.on(TuiEvent.CommandExecute.type, (evt) => {
+  const unsub1 = sdk.event.on(TuiEvent.CommandExecute.type, (evt) => {
     command.trigger(evt.properties.command)
   })
 
-  sdk.event.on(TuiEvent.ToastShow.type, (evt) => {
+  const unsub2 = sdk.event.on(TuiEvent.ToastShow.type, (evt) => {
     toast.show({
       title: evt.properties.title,
       message: evt.properties.message,
@@ -686,14 +686,14 @@ function App() {
     })
   })
 
-  sdk.event.on(TuiEvent.SessionSelect.type, (evt) => {
+  const unsub3 = sdk.event.on(TuiEvent.SessionSelect.type, (evt) => {
     route.navigate({
       type: "session",
       sessionID: evt.properties.sessionID,
     })
   })
 
-  sdk.event.on(SessionApi.Event.Deleted.type, (evt) => {
+  const unsub4 = sdk.event.on(SessionApi.Event.Deleted.type, (evt) => {
     if (route.data.type === "session" && route.data.sessionID === evt.properties.info.id) {
       route.navigate({ type: "home" })
       toast.show({
@@ -703,7 +703,7 @@ function App() {
     }
   })
 
-  sdk.event.on(SessionApi.Event.Error.type, (evt) => {
+  const unsub5 = sdk.event.on(SessionApi.Event.Error.type, (evt) => {
     const error = evt.properties.error
     if (error && typeof error === "object" && error.name === "MessageAbortedError") return
     const message = (() => {
@@ -725,7 +725,7 @@ function App() {
     })
   })
 
-  sdk.event.on(Installation.Event.UpdateAvailable.type, (evt) => {
+  const unsub6 = sdk.event.on(Installation.Event.UpdateAvailable.type, (evt) => {
     toast.show({
       variant: "info",
       title: "Update Available",
@@ -734,6 +734,15 @@ function App() {
     })
   })
 
+  onCleanup(() => {
+    unsub1()
+    unsub2()
+    unsub3()
+    unsub4()
+    unsub5()
+    unsub6()
+  })
+
   return (
     <box
       width={dimensions().width}

packages/opencode/src/cli/cmd/tui/component/prompt/index.tsx

@@ -96,7 +96,7 @@ export function Prompt(props: PromptProps) {
   const pasteStyleId = syntax().getStyleId("extmark.paste")!
   let promptPartTypeId = 0
 
-  sdk.event.on(TuiEvent.PromptAppend.type, (evt) => {
+  const unsubPromptAppend = sdk.event.on(TuiEvent.PromptAppend.type, (evt) => {
     if (!input || input.isDestroyed) return
     input.insertText(evt.properties.text)
     setTimeout(() => {
@@ -107,6 +107,7 @@ export function Prompt(props: PromptProps) {
       renderer.requestRender()
     }, 0)
   })
+  onCleanup(unsubPromptAppend)
 
   createEffect(() => {
     if (props.disabled) input.cursorColor = theme.backgroundElement

packages/opencode/src/cli/cmd/tui/routes/session/index.tsx

@@ -7,6 +7,7 @@ import {
   For,
   Match,
   on,
+  onCleanup,
   Show,
   Switch,
   useContext,
@@ -208,7 +209,7 @@ export function Session() {
   })
 
   let lastSwitch: string | undefined = undefined
-  sdk.event.on("message.part.updated", (evt) => {
+  const unsubPartUpdated = sdk.event.on("message.part.updated", (evt) => {
     const part = evt.properties.part
     if (part.type !== "tool") return
     if (part.sessionID !== route.sessionID) return
@@ -223,6 +224,7 @@ export function Session() {
       lastSwitch = part.id
     }
   })
+  onCleanup(unsubPartUpdated)
 
   let scroll: ScrollBoxRenderable
   let prompt: PromptRef

packages/opencode/src/lsp/client.ts

@@ -48,6 +48,7 @@ export namespace LSPClient {
       new StreamMessageWriter(input.server.process.stdin as any),
     )
 
+    const MAX_DIAGNOSTICS_FILES = 2_000
     const diagnostics = new Map<string, Diagnostic[]>()
     connection.onNotification("textDocument/publishDiagnostics", (params) => {
       const filePath = Filesystem.normalizePath(fileURLToPath(params.uri))
@@ -56,6 +57,11 @@ export namespace LSPClient {
         count: params.diagnostics.length,
       })
       const exists = diagnostics.has(filePath)
+      if (!exists && diagnostics.size >= MAX_DIAGNOSTICS_FILES) {
+        // Evict the oldest entry to stay within the size limit
+        const oldest = diagnostics.keys().next().value
+        if (oldest !== undefined) diagnostics.delete(oldest)
+      }
       diagnostics.set(filePath, params.diagnostics)
       if (!exists && input.serverID === "typescript") return
       Bus.publish(Event.Diagnostics, { path: filePath, serverID: input.serverID })
@@ -132,6 +138,7 @@ export namespace LSPClient {
       })
     }
 
+    const MAX_OPEN_FILES = 1_000
     const files: {
       [path: string]: number
     } = {}
@@ -191,6 +198,11 @@ export namespace LSPClient {
 
           log.info("textDocument/didOpen", input)
           diagnostics.delete(input.path)
+          // Evict oldest tracked file if we're at the limit
+          if (Object.keys(files).length >= MAX_OPEN_FILES) {
+            const oldest = Object.keys(files)[0]
+            if (oldest) delete files[oldest]
+          }
           await connection.sendNotification("textDocument/didOpen", {
             textDocument: {
               uri: pathToFileURL(input.path).href,

packages/opencode/src/mcp/index.ts

@@ -150,6 +150,27 @@ export namespace MCP {
   // Store transports for OAuth servers to allow finishing auth
   type TransportWithAuth = StreamableHTTPClientTransport | SSEClientTransport
   const pendingOAuthTransports = new Map<string, TransportWithAuth>()
+  const pendingOAuthTimers = new Map<string, ReturnType<typeof setTimeout>>()
+  const OAUTH_TRANSPORT_TTL_MS = 5 * 60 * 1_000 // 5 minutes
+
+  function setPendingOAuthTransport(key: string, transport: TransportWithAuth) {
+    const existing = pendingOAuthTimers.get(key)
+    if (existing) clearTimeout(existing)
+    pendingOAuthTransports.set(key, transport)
+    const timer = setTimeout(() => {
+      pendingOAuthTransports.delete(key)
+      pendingOAuthTimers.delete(key)
+      log.info("evicted stale pending OAuth transport", { key })
+    }, OAUTH_TRANSPORT_TTL_MS)
+    pendingOAuthTimers.set(key, timer)
+  }
+
+  function deletePendingOAuthTransport(key: string) {
+    const timer = pendingOAuthTimers.get(key)
+    if (timer) clearTimeout(timer)
+    pendingOAuthTimers.delete(key)
+    pendingOAuthTransports.delete(key)
+  }
 
   // Prompt cache types
   type PromptInfo = Awaited<ReturnType<MCPClient["listPrompts"]>>["prompts"][number]
@@ -205,6 +226,8 @@ export namespace MCP {
           }),
         ),
       )
+      for (const timer of pendingOAuthTimers.values()) clearTimeout(timer)
+      pendingOAuthTimers.clear()
       pendingOAuthTransports.clear()
     },
   )
@@ -378,7 +401,7 @@ export namespace MCP {
               }).catch((e) => log.debug("failed to show toast", { error: e }))
             } else {
               // Store transport for later finishAuth call
-              pendingOAuthTransports.set(key, transport)
+              setPendingOAuthTransport(key, transport)
               status = { status: "needs_auth" as const }
               // Show toast for needs_auth
               Bus.publish(TuiEvent.ToastShow, {
@@ -772,7 +795,7 @@ export namespace MCP {
     } catch (error) {
       if (error instanceof UnauthorizedError && capturedUrl) {
         // Store transport for finishAuth
-        pendingOAuthTransports.set(mcpName, transport)
+        setPendingOAuthTransport(mcpName, transport)
         return { authorizationUrl: capturedUrl.toString() }
       }
       throw error
@@ -879,7 +902,7 @@ export namespace MCP {
       }
 
       // Re-add the MCP server to establish connection
-      pendingOAuthTransports.delete(mcpName)
+      deletePendingOAuthTransport(mcpName)
       const result = await add(mcpName, mcpConfig)
 
       const statusRecord = result.status as Record<string, Status>
@@ -899,7 +922,7 @@ export namespace MCP {
   export async function removeAuth(mcpName: string): Promise<void> {
     await McpAuth.remove(mcpName)
     McpOAuthCallback.cancelPending(mcpName)
-    pendingOAuthTransports.delete(mcpName)
+    deletePendingOAuthTransport(mcpName)
     await McpAuth.clearOAuthState(mcpName)
     log.info("removed oauth credentials", { mcpName })
   }

packages/opencode/src/permission/next.ts

@@ -283,4 +283,18 @@ export namespace PermissionNext {
     const s = await state()
     return Object.values(s.pending).map((x) => x.info)
   }
+
+  export async function clearSession(sessionID: string) {
+    const s = await state()
+    for (const [id, pending] of Object.entries(s.pending)) {
+      if (pending.info.sessionID !== sessionID) continue
+      delete s.pending[id]
+      pending.reject(new RejectedError())
+      Bus.publish(Event.Replied, {
+        sessionID,
+        requestID: id,
+        reply: "reject",
+      })
+    }
+  }
 }

packages/opencode/src/session/compaction.ts

@@ -91,6 +91,11 @@ export namespace SessionCompaction {
       for (const part of toPrune) {
         if (part.state.status === "completed") {
           part.state.time.compacted = Date.now()
+          // Clear tool output and attachments from both DB and in-memory store.
+          // toModelMessages already substitutes "[Old tool result content cleared]"
+          // for compacted parts, so this aligns stored data with model behavior.
+          part.state.output = "[compacted]"
+          part.state.attachments = undefined
           await Session.updatePart(part)
         }
       }

packages/opencode/src/session/index.ts

@@ -653,6 +653,7 @@ export namespace Session {
         await remove(child.id)
       }
       await unshare(sessionID).catch(() => {})
+      await PermissionNext.clearSession(sessionID).catch(() => {})
       // CASCADE delete handles messages and parts automatically
       Database.use((db) => {
         db.delete(SessionTable).where(eq(SessionTable.id, sessionID)).run()

packages/opencode/src/tool/task.ts

@@ -152,6 +152,12 @@ export const TaskTool = Tool.define("task", async (ctx) => {
         "</task_result>",
       ].join("\n")
 
+      // Clean up subagent session to free in-memory state (messages, parts,
+      // event listeners). The task output has already been captured above.
+      // If the LLM later tries to resume via task_id, Session.get() will
+      // fail gracefully and a fresh session will be created instead.
+      Session.remove(session.id).catch(() => {})
+
       return {
         title: params.description,
         metadata: {