aube has a really high peak memory footprint

[hollykbuck]

it takes more than 1.5G memory to mise install npm:opencode-ai and causes high memory pressure on my multiple cloud hosts. i have to forcibly reboot my machine and add more swap to prevent it from oom again.

[jdx]

thanks for the report, nobody has mentioned this yet (at least that I can recall)

[jdx]

I opened #1303 to make the existing diagnostics work through mise's embedded aube path and add memory-specific samples.

Please wait until that PR lands and the change is included in a mise build before collecting anything—the current embedded path does not initialize these diagnostics. Once it is available, please reproduce with:

AUBE_DIAG_FILE=/tmp/aube-memory.jsonl \
AUBE_DIAG_KERNEL=1 \
AUBE_DIAG_FLUSH=1 \
/usr/bin/time -v mise install npm:opencode-ai \
2>/tmp/aube-memory.txt

You can either send me /tmp/aube-memory.jsonl and /tmp/aube-memory.txt along with mise --version, uname -a, and free -h, or have your agent inspect them and summarize:

• where current RSS starts climbing and the peak RSS reached
• the packuments_cached and packument_versions_cached values from decision_mix
• peak pack, tar, and imp concurrency
• the largest max_entry_bytes value from tar_extract_complete
• the last few events before termination if the OOM killer stops the process

The trace may contain package names and local paths, so please inspect/redact it before sharing raw data if needed. AUBE_DIAG_FLUSH=1 makes each event durable so we should still get a useful tail after an OOM kill.

AI-assisted — Tool: Codex; model: OpenAI/GPT-5; version: unavailable.

[hollykbuck]

[jdx]

Thanks, this was enough to reproduce it locally.

The main resolver spike is not random: with the default release-age/trust checks enabled, every exact optional platform package was loading its entire version history before aube wrote all platform variants to the lockfile. For opencode-ai@1.18.18, that meant 12 large packuments, about 215 MB of JSON on the wire, and 136,110 retained version records.

I opened #1315. It keeps the cross-platform lockfile and trust checks intact, but retains only the selected version's complete metadata plus compact publish-time/trust history for these optional dependencies.

I also ran a four-way production-build comparison. These are medians of three cold, isolated opencode-ai@1.18.18 global installs on the same machine, with minimumReleaseAge=1440 and trustPolicy=no-downgrade:

package manager	peak RSS	elapsed
aube main	1,504 MB	4.03s
aube #1315	808 MB	3.80s
pnpm 11.22.0	1,703 MB	4.49s
pnpm 12.0.0-rc.6	1,240 MB	3.51s

The first version of the mitigation cut memory but made a separate exact-version request for every platform package; its median was 4.73s, which was not a tradeoff I wanted to merge. I reworked it to selectively decode the exact version and compact trust history from a single full-packument response. That removes the 12 extra requests and brings the median to 3.80s, versus 4.03s on main, while still cutting peak RSS by 46%.

Cold-network variance makes the small elapsed-time difference inconclusive, but there is no observed wall-time regression now. The patched build uses 53% less memory than pnpm 11 and 35% less than pnpm 12 RC in this reproduction. pnpm 12 is still an RC; no stable pnpm 12 release is published yet.

I also found and removed one deterministic wall-time cost while profiling the remainder: aube eagerly installed its cached node-gyp toolchain before every approved dependency lifecycle, even when that package never called node-gyp. That bootstrap is now on first use. To isolate registry variance, I ran five alternating cold pairs against the repo’s local Verdaccio through its shared 500 Mbit/s, 50ms-latency proxy. The pre-change commit measured 6.59s median (6.57–6.67s); the lazy-bootstrap commit measured 6.07s (6.01–6.31s), so it is 0.52s / 7.9% faster under controlled network conditions. Median peak RSS was 703 MB before and 727 MB after, a small difference within the run-to-run scatter. The phase trace independently shows dependency lifecycle dropping from 831ms to 448ms by removing a 416ms nested node-gyp resolve/install.

All four lockfiles contain all 13 platform variants and only materialize the three Linux/x64-applicable packages.

The remaining aube peak is now clearly later: the two matching Linux packages each contain a 184 MB binary and are extracted concurrently. So this PR fixes the resolver amplification; it does not pretend those two large host binaries are free.

The duplicate/progress-bar mess shown in the recording was fixed on the mise side in 2026.7.14 and later. If you still see it on a current mise release, let me know.

Please wait for #1315 to land and make it into mise, then retry. If memory is still unexpectedly high, you can either send me the raw diagnostic data, or have your agent summarize the results for me. The most useful summary is peak RSS and phase, decision_mix, the largest http_body_read entries, and tar extraction sizes/concurrency.

AI-assisted — Tool: Codex; model: OpenAI/GPT-5; version: unavailable.