@cleocode/cleo 2026.6.9 → 2026.6.11

package/bin/cleo.js

@@ -7,6 +7,14 @@
  * resolution (before any JS code executes), so it must be suppressed at the
  * Node runtime level, not in application code.
  *
+ * T11829 (fleet OOM fail-safe): the wrapper also caps the V8 old-space heap
+ * (`--max-old-space-size`) so a single runaway `cleo` invocation throws a
+ * recoverable, single-process JavaScript heap OOM instead of growing unbounded
+ * and contributing to a host-wide SIGKILL. The cap is overridable via
+ * `CLEO_MAX_OLD_SPACE_MB` for the rare command (large export/import) that needs
+ * more headroom. This is a process-level guard ABOVE the per-connection SQLite
+ * memory bounding in dual-scope-db.ts — defense in depth.
+ *
  * See: https://github.com/kryptobaseddev/cleo/issues/XXX (T1138)
  */
 
@@ -19,11 +27,25 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const cliPath = resolve(__dirname, '../dist/cli/index.js');
 const args = process.argv.slice(2);
 
+// T11829: cap V8 old-space so a runaway throws a recoverable single-process OOM
+// rather than a host SIGKILL. Default 1536 MB; override via CLEO_MAX_OLD_SPACE_MB.
+const maxOldSpaceMb = Number.parseInt(process.env.CLEO_MAX_OLD_SPACE_MB ?? '', 10);
+const heapCapMb = Number.isFinite(maxOldSpaceMb) && maxOldSpaceMb > 0 ? maxOldSpaceMb : 1536;
+
 try {
-  execFileSync('node', ['--disable-warning=ExperimentalWarning', cliPath, ...args], {
-    stdio: 'inherit',
-    cwd: process.cwd(),
-  });
+  execFileSync(
+    'node',
+    [
+      `--max-old-space-size=${heapCapMb}`,
+      '--disable-warning=ExperimentalWarning',
+      cliPath,
+      ...args,
+    ],
+    {
+      stdio: 'inherit',
+      cwd: process.cwd(),
+    },
+  );
 } catch (error) {
   process.exit(error.status || 1);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/cleo",
-  "version": "2026.6.9",
+  "version": "2026.6.11",
   "description": "CLEO CLI — the assembled product consuming @cleocode/core",
   "type": "module",
   "main": "./dist/cli/index.js",
@@ -30,17 +30,17 @@
     "tree-sitter-rust": "0.23.1",
     "tree-sitter-typescript": "^0.23.2",
     "yaml": "^2.8.3",
-    "@cleocode/animations": "2026.6.9",
-    "@cleocode/cant": "2026.6.9",
-    "@cleocode/contracts": "2026.6.9",
-    "@cleocode/caamp": "2026.6.9",
-    "@cleocode/core": "2026.6.9",
-    "@cleocode/lafs": "2026.6.9",
-    "@cleocode/paths": "2026.6.9",
-    "@cleocode/nexus": "2026.6.9",
-    "@cleocode/playbooks": "2026.6.9",
-    "@cleocode/runtime": "2026.6.9",
-    "@cleocode/worktree": "2026.6.9"
+    "@cleocode/animations": "2026.6.11",
+    "@cleocode/caamp": "2026.6.11",
+    "@cleocode/cant": "2026.6.11",
+    "@cleocode/contracts": "2026.6.11",
+    "@cleocode/core": "2026.6.11",
+    "@cleocode/nexus": "2026.6.11",
+    "@cleocode/paths": "2026.6.11",
+    "@cleocode/lafs": "2026.6.11",
+    "@cleocode/playbooks": "2026.6.11",
+    "@cleocode/runtime": "2026.6.11",
+    "@cleocode/worktree": "2026.6.11"
   },
   "engines": {
     "node": ">=24.16.0"

package/scripts/install-daemon-service.mjs

@@ -368,16 +368,29 @@ function buildSystemdUnit(cleoExec, scope) {
       ? `CLEO Sentient Daemon (epic ${scope.scopeEpicId} scoped)`
       : 'CLEO Sentient Daemon (autonomous task hygiene + dream cycles)';
 
+  // T11829 (fleet OOM fail-safe): bound the daemon's blast radius.
+  //   - StartLimitIntervalSec/StartLimitBurst: cap a crash-loop. The prior unit
+  //     respawned every RestartSec=5 with NO ceiling, so — combined with the
+  //     never-converging migration journal — it stacked opens until the host
+  //     OOM-killed. systemd now stops restarting after 5 failures in 60 s.
+  //   - NODE_OPTIONS=--max-old-space-size: a runaway daemon tick throws a
+  //     recoverable single-process JS heap OOM instead of growing unbounded.
+  //   - MemoryMax: best-effort soft cgroup ceiling (enforced only when the user
+  //     manager has memory-cgroup delegation; harmless otherwise).
   return `[Unit]
 Description=${description}
 Documentation=https://github.com/kryptobaseddev/cleocode
 After=network.target
+StartLimitIntervalSec=60
+StartLimitBurst=5
 
 [Service]
 Type=simple
 ExecStart=${cleoExec} daemon start --foreground
 Restart=on-failure
 RestartSec=5
+MemoryMax=2G
+Environment=NODE_OPTIONS=--max-old-space-size=1536
 StandardOutput=append:${logFile}
 StandardError=append:${logFile}
 Environment=CLEO_SENTIENT_DAEMON=1${scopeEnv}