fix(session): bound broker scheduling and transport

[benvinegar]

Summary

• define one immutable lower-only resource contract with reserve-before-work accounting
• add per-session FIFO command scheduling, daemon/session count and byte ceilings, and bounded producer queues
• bound HTTP controls, bodies, responses, retained authentication/session state, and Hunk review actions
• align Node and Bun text/binary, UTF-8, oversize, pressure, shutdown, and active-handler behavior
• close authentication-clear, late-message, bodyless-request, copy-peak, and response-retention races
• add shared adapter conformance plus real Node runtime coverage

Validation

• 147 focused generic/Hunk boundary tests
• 2,053 full repository tests passed; 10 platform skips
• 135 PTY integration tests passed; 1 platform skip
• 3 real Node runtime adapter tests
• bun run typecheck
• bun run lint
• bun run deps:check
• targeted oxfmt --check
• git diff --check
• independent final release-gate review: no blocker or high-severity finding

Stack

• Replaces automatically closed fix(session): bound broker scheduling and transport #904 after fix(session): validate broker runtime boundaries #903's deleted stack base made it impossible to reopen
• Depends on merged fix(session): validate broker runtime boundaries #903, feat(session): add signed broker authorization #901, and fix(session): bind broker state to peer ownership #898
• Final PR: Hunk automatic credential discovery and authenticated integration

This PR description was generated by Pi using gpt-5.6-sol

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
hunk-web	Ignored		Aug 30, 2026 1:46pm

[greptile-apps]

Greptile Summary

This PR introduces a shared reserve-before-work resource contract and applies bounded scheduling, transport, authentication, and review-serving behavior across the broker stack.

• Adds daemon-wide and per-session count and byte ceilings with FIFO command dispatch.
• Aligns Bun and Node adapters on message validation, bounded responses, backpressure, and shutdown behavior.
• Bounds retained authentication, HTTP request, response, and browser-review action state.
• Adds focused adapter conformance, runtime, lifecycle, pressure, and race regression coverage.

Confidence Score: 5/5

The PR appears safe to merge, with bounded ownership and cleanup consistently applied across the reviewed broker lifecycle and transport paths.

The changed reservation, scheduling, authentication, transport, and shutdown paths have matching release or terminal cleanup behavior, and the investigated pressure and reconnect scenarios did not establish an actionable defect.

Important Files Changed

Filename	Overview
packages/session-broker-core/src/budgets.ts	Introduces idempotent resource reservations, grouped ownership, resizing, and shared retained-size accounting.
packages/session-broker-core/src/brokerState.ts	Adds bounded session retention and per-session FIFO command scheduling with centralized terminal cleanup.
packages/session-broker/src/authentication.ts	Bounds retained authentication records and protects asynchronous authentication work across clear-generation changes.
packages/session-broker/src/daemon.ts	Applies bounded control handling, pressure responses, and coordinated shutdown to runtime-neutral daemon paths.
packages/session-broker-bun/src/serve.ts	Adds Bun-specific admission, inbound/outbound accounting, response bounding, and active-handler shutdown coordination.
packages/session-broker-node/src/serve.ts	Adds corresponding Node transport, response, admission, and lifecycle bounds using WebSocket send completion ownership.
src/session/broker/browserReviewServer.ts	Bounds browser review requests, actions, responses, streams, and retained capability state while preserving generation checks.
src/session/broker/brokerServer.ts	Wires generic broker limits into Hunk-specific session and browser-review routes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Client[HTTP or WebSocket client] --> Adapter[Bun or Node adapter]
  Adapter --> TransportBudget[Transport admission and byte budgets]
  TransportBudget --> Daemon[Runtime-neutral daemon]
  Daemon --> Auth[Authentication and request bounds]
  Daemon --> Broker[Session broker state]
  Broker --> SessionBudget[Session and retained-state budgets]
  Broker --> FIFO[Per-session command FIFO]
  FIFO --> App[Live Hunk session]
  App --> FIFO
  Daemon --> Review[Browser review routes]
  Review --> ResponseBudget[Body, response, action, and stream bounds]
  ResponseBudget --> Client

Loading

_{Reviews (1): Last reviewed commit: "fix(session): bound broker scheduling an..." | Re-trigger Greptile}