inspector: uncaught throw in setState kills the host when the cordis/tree source state reaches the frame budget

[zhaohualiuyuejun]

What happened

On 2026-10-26 14:10 UTC the DSH desktop host process exited. The last line of crash-*-host.log was:

dsh: fatal uncaught exception: Error: inspector: source state exceeds the source-frame byte limit
    at InspectorSourceBuffer.setState (.../@deepseek-ai/dsh-experimental-inspector/lib/index.js:996:10)
    at HostBridgePublisher.setState (lib/index.js:1109:16)
    at HostInspectorSource.setState (lib/index.js:836:18)
    at lib/index.js:2322:13
    at publish (lib/index.js:2294:3)
    at ChildProcess.<anonymous> (lib/main.js:3844:64)

Environment: @deepseek-ai/dsh-desktop 0.2.1-rc.2, Windows 11, desktop profile with ~25 bundles including community plugins. Agent context usage at the time was about 47%, so this is unrelated to the model context window.

Mechanism

• InspectorSourceBuffer.stateFits() requires jsonByteLength(all retained topic snapshots) + SOURCE_FRAME_OVERHEAD_BYTES (4096) <= maxSourceFrameBytes (default 128 KiB).
• The Host source retains exactly one topic: cordis/tree. publishCordisTree passes { maxNodes: spec.maxCordisNodes, maxBytes: spec.maxSourceFrameBytes - 4096 } to CordisTreeCollector (index.js:2402-2405).
• The collector prunes until jsonByteLength(snapshot) <= maxBytes, i.e. it is allowed to stop exactly at the whole available budget. The record envelope that setState() then adds (topic, sequence, monotonicMs) has no headroom reserved.
• Consequently, once the Cordis tree grows enough to require pruning, the pruned snapshot plus its envelope exceeds maxSourceFrameBytes, stateFits() fails, and setState() throws instead of degrading. The uncaught exception inside the publish microtask terminates the Host process.

Two defects (as I read the code)

1. Budget collision: the tree's prune target equals the entire frame budget (maxSourceFrameBytes - 4096), while the state check also has to fit the record envelope. Please reserve the envelope in the prune target, or measure the budget after wrapping.
2. Error-handling asymmetry: enqueue() silently drops one oversized record (return, index.js:1070), but setState() throws when the sum exceeds the limit (index.js:993-996). The over-budget path should degrade non-fatally (drop or roll back the topic, log a warning), consistent with enqueue().

Workaround in use

The Config schema already accepts maxSourceFrameBytes, so a profile patch raises the budget. Note that a user patch replaces the whole config of the matched entry, so captureFetch must be restated:

- id: experimental-inspector
  name: '@deepseek-ai/dsh-experimental-inspector'
  config:
    captureFetch: true
    maxSourceFrameBytes: 1048576

The Client bootstrap (bootstrap.maxFrameBytes) follows the Host value, so raising it on the Host is enough. This avoids the crash but does not fix the underlying budget collision.

Expected

A Host inspection plugin exceeding a self-imposed frame budget should log and degrade; it should never be able to take down the Host process.

[PerryLink]

The limit is deliberate. Killing the host over it is not.

packages/experimental/inspector/src/shared/bridge/buffer.ts:67 throws exactly that message when the retained topic snapshots plus the 4 KiB frame overhead exceed the budget. The budget is a plugin config field, not a constant: packages/experimental/inspector/src/index.ts:84 declares maxSourceFrameBytes (z.natural().min(1)), defaulting to 128 KiB (controller.ts:18). So there is a supported workaround — raise maxSourceFrameBytes in the inspector plugin config.

The defect you found is downstream. The throw happens on the publish path (HostBridgePublisher.setState → records.setState) with nothing catching it, so a size limit that should drop or truncate a frame takes the whole host down. That is where a fix belongs: reject the frame, keep the process.

One thing worth adding to the report: the budget is computed over all retained topic snapshots, not per topic, so it scales with how many topics the inspector is publishing — which is why ~25 bundles matters.

Source read at f3803c96 (0.2.2-alpha.2); I did not reproduce the 128 KiB boundary.

[LUgABeEEE]

Field data from a Web profile (the reports above are desktop), same 0.2.1-rc.2, in case it helps size the impact:

• Environment: DSH 0.2.1-rc.2, web profile, Ubuntu 24.04, Node 22.23.4, 42 bundles (official + community mix).
• The host exited 17 times in the last 5 days, every one of them with this identical stack (dsh: fatal uncaught exception: Error: inspector: source state exceeds the source-frame byte limit).
• systemd journal, two consecutive samples:

Oct 29 18:54:03 SER dsh[3417505]: dsh: fatal uncaught exception: Error: inspector: source state exceeds the source-frame byte limit
Oct 29 18:54:03 SER dsh[3417505]:     at InspectorSourceBuffer.setState (.../dsh-experimental-inspector/lib/index.js:996:10)
Oct 29 18:54:03 SER dsh[3417505]:     at HostBridgePublisher.setState (...:1109:16)
Oct 29 18:54:03 SER dsh[3417505]:     at HostInspectorSource.setState (...:836:18)
Oct 29 18:54:03 SER dsh[3417505]:     at ...:2322:13
Oct 29 18:54:03 SER dsh[3417505]:     at publish (...:2294:3)
Oct 29 18:54:03 SER dsh[3417505]:     at node:internal/process/task_queues:149:7
Oct 29 18:54:04 SER systemd[1]: dsh-web.service: Main process exited, code=exited, status=1/FAILURE
Oct 29 18:54:09 SER systemd[1]: dsh-web.service: Scheduled restart job, restart counter is at 6
...
Oct 29 19:15:48 SER dsh[3596390]: dsh: fatal uncaught exception: Error: inspector: source state exceeds the source-frame byte limit
Oct 29 19:15:54 SER systemd[1]: dsh-web.service: Scheduled restart job, restart counter is at 7

• Impact beyond the exit itself: every crash interrupts all in-flight turns. In the session logs the last event before each exit is turn/end {"kind":"interrupted"} a few seconds earlier, so concurrent conversations lose their work and the host is back 5–6 s later (Restart=always).
• Both crashes landed ~2 s after a burst of session/plugin activity, which matches the "collector prunes to exactly maxBytes, no headroom left for the record envelope" analysis above.

One extra data point for the fix: 0.2.1-rc.4 still contains the identical throw (lib/index.js:996) and the same unguarded queueMicrotask(publish) → listener(collector.snapshot()) path — I pulled and diffed the tarball, so upgrading within the rc line does not fix it.

We are now testing the supported workaround (config.maxSourceFrameBytes raised on this profile) and will report back whether the 128 KiB boundary stops occurring. The proper fix still belongs where you said: reject/drop the frame and keep the process alive.

[PerryLink]

You're right that the patch has to restate the whole config — my suggestion named the field without saying that the entry's config replaces rather than merges, so your snippet is the correct shape.

One thing your web-profile numbers add to the report: the budget is recomputed over every retained topic, so raising it to 1 MiB does not remove the limit, it moves it. With 42 bundles that is worth stating explicitly — otherwise the eventual fix reads as "make the frame bigger" when it has to be "drop the frame and keep the process".

17 host exits in five days from one uncaught throw is also the strongest impact statement in the thread so far; I'd put that number in the first paragraph of the report rather than in a comment.

[ztm-njau]

补充四条前面报告里没有的数据，都与修复范围有关。

1. 干净环境里用发布产物可独立复现

node:24-bookworm 容器，npm i @deepseek-ai/dsh-experimental-inspector@0.2.1-rc.2，用 startInspector() 返回的真实 source 调 setState('cordis/tree', <126,976 字节>)：

Error: inspector: source state exceeds the source-frame byte limit
    at InspectorSourceBuffer.setState  (lib/index.js:996:10)
    at HostBridgePublisher.setState    (lib/index.js:1109:16)
    at HostInspectorSource.setState    (lib/index.js:836:18)
exit=1

与桌面端 crash-*-host.log 的三帧一致。不依赖 macOS，也不依赖源码检出。

2. 缺口是固定可算的，不是随机

同环境二分：126,915 字节接受，126,916 拒绝，缺口 61 字节。把 monotonicMs 换成 16 位，边界落到 126,909，缺口 67 字节。即缺口 = 49 + String(monotonicMs).length + 2（数组括号）。这与 #10259 量到的 ~69 字节吻合，也说明它随调用时刻的位数浮动，不是常量。

3. 跨版本未变，升级不能规避

比对各版本发布产物：DEFAULT_MAX_SOURCE_FRAME_BYTES = 128 * 1024、collector 的 maxSourceFrameBytes - 4096、stateFits() 的写法，在 0.1.7-rc.2 / 0.2.0-rc.2 / 0.2.1-rc.2 / 0.2.1-rc.5 / 0.2.2-alpha.2 五版完全一致。不是某次改动引入的回归，修复必须进版本。

4. 真实 profile 离上限很近

桌面端现场：654 个活 fiber 时再挂 150 个空插件即触发，约 19 KB 余量。不需要极端规模的插件集，正常使用的 profile 就可能贴着这条线。

完整数据和复现步骤在 #11647，那条按重复项关闭，后续讨论留在这里。