@buoy-gg/external-sync 7.0.9 → 7.0.11

package/lib/commonjs/useExternalSync.js

@@ -9,6 +9,57 @@ var _logger = require("./utils/logger");
 var _types = require("./types");
 const LOG = "[ExternalSync]";
 
+// ==========================================================================
+// Emit-layer byte budgets — the choke-point guard.
+//
+// Every adapter's snapshot and every action result funnels through
+// socket.emit, whose serializer walks the ENTIRE payload synchronously on
+// the JS thread (and JSON.stringify does not honor structural sharing).
+// Per-adapter guards get missed — the redux adapter shipping raw state
+// trees froze and native-OOM-crashed enterprise apps whenever a dashboard
+// was connected. One budget here closes every adapter's hole at once:
+// oversized payloads are dropped (snapshots) or replaced with an error
+// (action results) instead of being serialized.
+//
+// The estimator is O(limit) — early-abort walk, O(1) for giant strings —
+// never O(payload). Copied per-package by design (see events/redux copies).
+// ==========================================================================
+
+/** Max approx bytes for one tool snapshot emit. */
+const MAX_SNAPSHOT_EMIT_BYTES = 2 * 1024 * 1024;
+/** Max approx bytes for one action-result emit (explicit requests get more). */
+const MAX_ACTION_RESULT_BYTES = 8 * 1024 * 1024;
+function approxSizeOver(value, limit) {
+  let bytes = 0;
+  const stack = [value];
+  const seen = new Set();
+  while (stack.length > 0) {
+    if (bytes > limit) return {
+      over: true,
+      approxBytes: bytes
+    };
+    const v = stack.pop();
+    if (v === null || v === undefined) bytes += 4;else if (typeof v === "string") bytes += v.length + 2;else if (typeof v === "number") bytes += 8;else if (typeof v === "boolean") bytes += 5;else if (typeof v === "object") {
+      if (seen.has(v)) continue;
+      seen.add(v);
+      if (Array.isArray(v)) {
+        bytes += 2 + v.length;
+        for (let i = 0; i < v.length; i++) stack.push(v[i]);
+      } else {
+        bytes += 2;
+        for (const k in v) {
+          bytes += k.length + 4;
+          stack.push(v[k]);
+        }
+      }
+    } else bytes += 4;
+  }
+  return {
+    over: bytes > limit,
+    approxBytes: bytes
+  };
+}
+
 /**
  * Device-side sync bridge: syncs any number of dev tools to the desktop
  * dashboard and executes actions invoked remotely.
@@ -67,17 +118,36 @@ function useExternalSync({
         (0, _logger.log)(`${LOG} Failed to emit "${event}": ${error}. Payload must be JSON-serializable.`, enableLogs, "error");
       }
     };
+
+    // One warning per tool per session — the drop repeats every snapshot.
+    const warnedOversized = new Set();
     const sendSnapshot = toolId => {
       const tool = toolsRef.current[toolId];
       if (!tool) return;
       lastEmit[toolId] = Date.now();
+      const payload = tool.getSnapshot();
+
+      // Emit-layer budget: never hand an unbounded payload to the socket
+      // serializer. A dropped snapshot means a stale dashboard panel for
+      // that tool; serializing it would freeze (and can OOM-kill) the app.
+      const {
+        over,
+        approxBytes
+      } = approxSizeOver(payload, MAX_SNAPSHOT_EMIT_BYTES);
+      if (over) {
+        if (!warnedOversized.has(toolId)) {
+          warnedOversized.add(toolId);
+          console.warn(`${LOG} "${toolId}" snapshot ≈${(approxBytes / 1e6).toFixed(1)}MB exceeds the ${MAX_SNAPSHOT_EMIT_BYTES / 1e6}MB sync budget — dropped (dashboard will be stale for this tool). The adapter should ship a wire-form snapshot (summaries + on-demand detail).`);
+        }
+        return;
+      }
       const message = {
         toolId,
         persistentDeviceId: deviceId,
         timestamp: lastEmit[toolId],
         version: tool.version,
         kind: "snapshot",
-        payload: tool.getSnapshot()
+        payload
       };
       safeEmit("devtool-sync", message);
     };
@@ -168,6 +238,20 @@ function useExternalSync({
       } catch (error) {
         result.error = error instanceof Error ? error.message : String(error);
       }
+
+      // Same budget for action results: e.g. redux getState({includeValues:
+      // true}) on a huge tree would otherwise OOM through this exact emit.
+      if (result.ok) {
+        const {
+          over,
+          approxBytes
+        } = approxSizeOver(result.result, MAX_ACTION_RESULT_BYTES);
+        if (over) {
+          result.ok = false;
+          result.result = undefined;
+          result.error = `Result ≈${(approxBytes / 1e6).toFixed(1)}MB exceeds the ${MAX_ACTION_RESULT_BYTES / 1e6}MB sync budget. Narrow the request (e.g. includeValues:false, a limit, or a more specific action).`;
+        }
+      }
       result.timestamp = Date.now();
       safeEmit("devtool-action-result", result);
     };

package/lib/module/useExternalSync.js

@@ -5,6 +5,57 @@ import { log } from "./utils/logger";
 import { SYNC_PROTOCOL_VERSION } from "./types";
 const LOG = "[ExternalSync]";
 
+// ==========================================================================
+// Emit-layer byte budgets — the choke-point guard.
+//
+// Every adapter's snapshot and every action result funnels through
+// socket.emit, whose serializer walks the ENTIRE payload synchronously on
+// the JS thread (and JSON.stringify does not honor structural sharing).
+// Per-adapter guards get missed — the redux adapter shipping raw state
+// trees froze and native-OOM-crashed enterprise apps whenever a dashboard
+// was connected. One budget here closes every adapter's hole at once:
+// oversized payloads are dropped (snapshots) or replaced with an error
+// (action results) instead of being serialized.
+//
+// The estimator is O(limit) — early-abort walk, O(1) for giant strings —
+// never O(payload). Copied per-package by design (see events/redux copies).
+// ==========================================================================
+
+/** Max approx bytes for one tool snapshot emit. */
+const MAX_SNAPSHOT_EMIT_BYTES = 2 * 1024 * 1024;
+/** Max approx bytes for one action-result emit (explicit requests get more). */
+const MAX_ACTION_RESULT_BYTES = 8 * 1024 * 1024;
+function approxSizeOver(value, limit) {
+  let bytes = 0;
+  const stack = [value];
+  const seen = new Set();
+  while (stack.length > 0) {
+    if (bytes > limit) return {
+      over: true,
+      approxBytes: bytes
+    };
+    const v = stack.pop();
+    if (v === null || v === undefined) bytes += 4;else if (typeof v === "string") bytes += v.length + 2;else if (typeof v === "number") bytes += 8;else if (typeof v === "boolean") bytes += 5;else if (typeof v === "object") {
+      if (seen.has(v)) continue;
+      seen.add(v);
+      if (Array.isArray(v)) {
+        bytes += 2 + v.length;
+        for (let i = 0; i < v.length; i++) stack.push(v[i]);
+      } else {
+        bytes += 2;
+        for (const k in v) {
+          bytes += k.length + 4;
+          stack.push(v[k]);
+        }
+      }
+    } else bytes += 4;
+  }
+  return {
+    over: bytes > limit,
+    approxBytes: bytes
+  };
+}
+
 /**
  * Device-side sync bridge: syncs any number of dev tools to the desktop
  * dashboard and executes actions invoked remotely.
@@ -63,17 +114,36 @@ export function useExternalSync({
         log(`${LOG} Failed to emit "${event}": ${error}. Payload must be JSON-serializable.`, enableLogs, "error");
       }
     };
+
+    // One warning per tool per session — the drop repeats every snapshot.
+    const warnedOversized = new Set();
     const sendSnapshot = toolId => {
       const tool = toolsRef.current[toolId];
       if (!tool) return;
       lastEmit[toolId] = Date.now();
+      const payload = tool.getSnapshot();
+
+      // Emit-layer budget: never hand an unbounded payload to the socket
+      // serializer. A dropped snapshot means a stale dashboard panel for
+      // that tool; serializing it would freeze (and can OOM-kill) the app.
+      const {
+        over,
+        approxBytes
+      } = approxSizeOver(payload, MAX_SNAPSHOT_EMIT_BYTES);
+      if (over) {
+        if (!warnedOversized.has(toolId)) {
+          warnedOversized.add(toolId);
+          console.warn(`${LOG} "${toolId}" snapshot ≈${(approxBytes / 1e6).toFixed(1)}MB exceeds the ${MAX_SNAPSHOT_EMIT_BYTES / 1e6}MB sync budget — dropped (dashboard will be stale for this tool). The adapter should ship a wire-form snapshot (summaries + on-demand detail).`);
+        }
+        return;
+      }
       const message = {
         toolId,
         persistentDeviceId: deviceId,
         timestamp: lastEmit[toolId],
         version: tool.version,
         kind: "snapshot",
-        payload: tool.getSnapshot()
+        payload
       };
       safeEmit("devtool-sync", message);
     };
@@ -164,6 +234,20 @@ export function useExternalSync({
       } catch (error) {
         result.error = error instanceof Error ? error.message : String(error);
       }
+
+      // Same budget for action results: e.g. redux getState({includeValues:
+      // true}) on a huge tree would otherwise OOM through this exact emit.
+      if (result.ok) {
+        const {
+          over,
+          approxBytes
+        } = approxSizeOver(result.result, MAX_ACTION_RESULT_BYTES);
+        if (over) {
+          result.ok = false;
+          result.result = undefined;
+          result.error = `Result ≈${(approxBytes / 1e6).toFixed(1)}MB exceeds the ${MAX_ACTION_RESULT_BYTES / 1e6}MB sync budget. Narrow the request (e.g. includeValues:false, a limit, or a more specific action).`;
+        }
+      }
       result.timestamp = Date.now();
       safeEmit("devtool-action-result", result);
     };

package/lib/typescript/useExternalSync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useExternalSync.d.ts","sourceRoot":"","sources":["../../src/useExternalSync.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,oBAAoB,EAC1B,MAAM,SAAS,CAAC;AAIjB;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,MAAM,EACN,QAAQ,EACR,OAAc,EACd,UAAgB,EAChB,UAAkB,GACnB,EAAE,oBAAoB,QAgLtB"}
+{"version":3,"file":"useExternalSync.d.ts","sourceRoot":"","sources":["../../src/useExternalSync.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,oBAAoB,EAC1B,MAAM,SAAS,CAAC;AAyDjB;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,MAAM,EACN,QAAQ,EACR,OAAc,EACd,UAAgB,EAChB,UAAkB,GACnB,EAAE,oBAAoB,QAkNtB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buoy-gg/external-sync",
-  "version": "7.0.9",
+  "version": "7.0.11",
   "description": "Generic device-to-desktop sync for Buoy dev tools",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",