Session memory leak: completed sessions never released from V8 heap

[lyouo]

Problem

The dsh web process accumulates memory for every session created via session/create RPC, and never releases it after the session completes. On workloads that create many sequential sessions (automated challenge runners creating 50-100+ sessions), the V8 heap exhausts and the process crashes silently.

Evidence

Memory never released:

dsh startup:                        RSS = 834 MB
After 3 minimal sessions:          RSS = 938 MB  (+104 MB)
After 60 seconds (GC opportunity):  RSS = 938 MB  (ZERO released)

Each session permanently adds ~35 MB. Real sessions with tool calls and MCP connections consume 200-500+ MB each.

Crash under load:

• V8 default heap: ~4.2 GB (Node.js 24, 64-bit)
• 104 sequential challenges x 35-200 MB = 3.6-20+ GB accumulated
• Result: abort() -> __fastfail -> process dies with no WER dump, no crash event

No cleanup API:

POST /api/session/dispose  -> 404
POST /api/session/close    -> 404
POST /api/session/destroy  -> 404
POST /api/session/delete   -> 404

The plugin-level agents.create() returns { agent, dispose } but external orchestrators using web RPC have no way to trigger disposal.

Proposed Solution

1. Add session/dispose RPC endpoint — allow external callers to release completed sessions
2. Automatic idle eviction — sessions with no activity for N minutes are auto-disposed (configurable TTL)
3. Expose agents.create().dispose() via RPC — bridge the existing JS API to web layer

Environment

• dsh: 0.2.2-rc.1, Node.js v24.15.0, Windows 11, 64 GB RAM
• Workaround: --max-old-space-size=8192 (delays but does not fix)

This makes dsh unsuitable for long-running multi-session workloads without periodic process restarts.