@promptctl/cc-candybar 1.41.1 → 1.41.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@promptctl/cc-candybar",
-  "version": "1.41.1",
+  "version": "1.41.2",
   "description": "Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -85,15 +85,15 @@
     "tsdown": "^0.21.4",
     "tsx": "^4.21.0",
     "typescript": "^5.0.0",
-    "@promptctl/go-template-js": "^0.7.0",
+    "@promptctl/go-template-js": "^0.8.0",
     "@promptctl/rich-js": "^0.7.0",
     "json5": "^2.2.3",
     "mobx": "^6.15.0"
   },
   "optionalDependencies": {
-    "@promptctl/cc-candybar-darwin-arm64": "1.41.1",
-    "@promptctl/cc-candybar-darwin-x64": "1.41.1",
-    "@promptctl/cc-candybar-linux-x64": "1.41.1",
-    "@promptctl/cc-candybar-linux-arm64": "1.41.1"
+    "@promptctl/cc-candybar-darwin-arm64": "1.41.2",
+    "@promptctl/cc-candybar-darwin-x64": "1.41.2",
+    "@promptctl/cc-candybar-linux-x64": "1.41.2",
+    "@promptctl/cc-candybar-linux-arm64": "1.41.2"
   }
 }

package/src/config/dsl-types.ts

@@ -181,9 +181,9 @@ export interface RawDslConfig {
   // per session exactly like theme/style (session key `look`).
   readonly looks?: Readonly<Record<string, ThemeKey>>;
   // [LAW:single-enforcer] Config-level shared helper templates: name → Go-template
-  // body. Each compiles to one `{{ define "name" }}body{{ end }}` block, and the
-  // whole set into a single output-neutral preamble prepended to every template
-  // this config parses — so a formatter (`{{ template "formatCost" .x }}`) is
+  // body. Each compiles to one `{{ define "name" }}body{{ end }}` unit, and the
+  // whole set into one shared define set every template this config parses
+  // inherits — so a formatter (`{{ template "formatCost" .x }}`) is
   // defined ONCE and callable from any segment/predicate, never re-inlined per
   // segment. Absent ≡ no helpers; merges by-name (user overrides a helper).
   readonly helpers?: Readonly<Record<string, string>>;
@@ -240,7 +240,7 @@ export interface DslConfig {
   // [LAW:dataflow-not-control-flow].
   readonly editGlobals: Partial<Globals>;
   // [LAW:single-enforcer] The effective helper set: a name → template-body map
-  // compiled to a defines-preamble at registerDslConfig. Empty when no config
+  // compiled to one shared define set at registerDslConfig. Empty when no config
   // declares helpers — an absent `helpers` key merges to `{}` (same cascade as
   // actions). The single definition site for each formatter/transform a template
   // calls via `{{ template "name" .arg }}`.

package/src/config/loader/helpers.ts

@@ -2,7 +2,7 @@
 // record of name → template-body STRING. Each value is a Go-template source the
 // renderer compiles into a `{{ define }}` block; whether the body PARSES (and
 // whether a `{{ template "name" }}` reference resolves) is a render-time concern
-// (registerDslConfig parses the preamble and throws a per-helper diagnostic).
+// (registerDslConfig parses each helper and throws a per-helper diagnostic).
 // This file changes only if the helper authoring shape changes.
 
 import { findKeyLine } from "./diagnostics.js";

package/src/daemon/limits.ts

@@ -21,17 +21,18 @@ import { dlog, type DaemonLogger } from "./log";
 // The cap sits at HEAP_CAP_OVER_RSS × the backstop, a margin wide enough that
 // the graceful path fires first under any growth the 60 s poll can see (a
 // burst that doubles RSS inside one poll window can still reach the hard cap).
-// Before this the two were unrelated literals (400 MB heap in
-// each spawner, 512 MB RSS here): a cold daemon seeding a large transcript tree
-// for a dozen sessions blew the heap in seconds, aborted silently, and crash-
-// looped on every render tick while the backstop — a 60 s poll — never got a
-// turn. Raising the env override raises BOTH, because both spawners derive the
-// cap through heapCapMb below. The Rust client mirrors RSS_LIMIT_ENV,
-// DEFAULT_RSS_LIMIT_MB, and HEAP_CAP_OVER_RSS as literals
+// Before this the two were unrelated literals (400 MB heap in each spawner,
+// 512 MB RSS here), and the 2026-09-03 outage found the gap: a daemon holding
+// twenty configs' worth of duplicated helper-template ASTs (since fixed in
+// src/dsl/render.ts compileHelpers) blew the heap in seconds, aborted
+// silently, and crash-looped on every render tick while the backstop — a 60 s
+// poll — never got a turn. Raising the env override raises BOTH, because both
+// spawners derive the cap through heapCapMb below. The Rust client mirrors
+// RSS_LIMIT_ENV, DEFAULT_RSS_LIMIT_MB, and HEAP_CAP_OVER_RSS as literals
 // (rust-client/src/launch.rs); scripts/check-protocol.mjs fails the build on
 // drift.
 export const RSS_LIMIT_ENV = "CC_CANDYBAR_RSS_LIMIT_MB";
-export const DEFAULT_RSS_LIMIT_MB = 2048;
+export const DEFAULT_RSS_LIMIT_MB = 512;
 export const HEAP_CAP_OVER_RSS = 2;
 
 // [LAW:parse-dont-validate] Absent → default; a positive integer → that; present

package/src/dsl/render.ts

@@ -13,7 +13,7 @@
 
 import type { RichText, Palette, ThemeKey } from "@promptctl/rich-js";
 import { ColorSpec, Style, lighten, IDENTITY } from "@promptctl/rich-js";
-import type { Engine, Template } from "@promptctl/go-template-js";
+import { Defines, type Engine, type Template } from "@promptctl/go-template-js";
 import type {
   ValidatedConfig,
   VariableDecl,
@@ -213,38 +213,40 @@ function declareOne(
   }
 }
 
-// ─── Helper preamble ─────────────────────────────────────────────────────────
+// ─── Helpers ─────────────────────────────────────────────────────────────────
 
 // [LAW:single-enforcer] Compile the config's shared helper templates into ONE
-// output-neutral preamble: each name→body becomes a `{{ define "name" }}body{{ end }}`
-// block, concatenated with no interstitial text so the preamble emits nothing.
-// Prepended to every template this config parses, the defines resolve a
-// `{{ template "name" .arg }}` call locally — go-template-js scopes defines to a
-// single parse unit, so the define and the call MUST share one parse.
-// [LAW:no-silent-fallbacks] Each body is parsed in ISOLATION first, so a malformed
-// helper surfaces a per-helper diagnostic rather than a confusing error blamed on
-// the first segment that happens to call it.
-// [LAW:dataflow-not-control-flow] Empty helpers ⇒ "" ⇒ `engine.parse("" + src)`
-// is byte-identical to `engine.parse(src)`: existing configs are unaffected with
-// no special-case branch.
-function compileHelperPreamble(
+// define set: each name→body is parsed as its own `{{ define "name" }}body{{ end }}`
+// unit, chained onto the previous helpers' set, so the result is one `Defines`
+// every template this config parses inherits (`engine.parse(src, helpers)`).
+// [LAW:one-source-of-truth] Inherited by link, never by copy. The previous
+// shape — the defines' SOURCE prepended to every parse — re-parsed the whole
+// helper block into every template: ~100 KB of AST per parse for the 2 KB
+// stdlib block, ~287 parses per config, ~30 MB per config, and a daemon
+// holding twenty configs sat at 600 MB of nothing but duplicated helper ASTs
+// (the 2026-09-02 RSS-breach snapshot and the 2026-09-03 crash-loop).
+// [LAW:no-silent-fallbacks] Each body is parsed in ISOLATION, so a malformed
+// helper surfaces a per-helper diagnostic rather than a confusing error blamed
+// on the first segment that happens to call it; the redefinition check the
+// parser applies against the inherited set is what makes helper names unique.
+function compileHelpers(
   engine: Engine<RichText>,
   helpers: Readonly<Record<string, string>>,
-): string {
-  let preamble = "";
+): Defines {
+  let defines = Defines.EMPTY;
   for (const [name, body] of Object.entries(helpers)) {
-    const define = `{{ define "${name}" }}${body}{{ end }}`;
     try {
-      engine.parse(define);
+      defines = engine
+        .parse(`{{ define "${name}" }}${body}{{ end }}`, defines)
+        .defines();
     } catch (e) {
       throw new Error(
         `Template parse error in helpers.${name}: ${(e as Error).message}`,
         { cause: e },
       );
     }
-    preamble += define;
   }
-  return preamble;
+  return defines;
 }
 
 // ─── registerDslConfig ────────────────────────────────────────────────────────
@@ -379,16 +381,14 @@ export function registerDslConfig(
     },
     opts?.clock,
   );
-  // [LAW:single-enforcer] THE one parse path for this config: prepend the helper
-  // preamble so every template — segment template/when/bg/fg, node `when`, and
-  // action copy/open — resolves `{{ template "name" }}` calls against the same
-  // shared helpers. One closure, not raw engine.parse scattered across sites, so
-  // there is exactly one boundary where helpers come into scope (and one place a
-  // helper could fail to be visible). The preamble is compiled ONCE here, not per
-  // parse, and is "" when no helpers are declared.
-  const helperPreamble = compileHelperPreamble(engine, config.helpers);
-  const parse = (src: string): Template<RichText> =>
-    engine.parse(helperPreamble + src);
+  // [LAW:single-enforcer] THE one parse path for this config: every template —
+  // segment template/when/bg/fg, node `when`, and action copy/open — inherits
+  // the same helper define set, so `{{ template "name" }}` resolves against one
+  // shared AST. One closure, not raw engine.parse scattered across sites, so
+  // there is exactly one boundary where helpers come into scope (and one place
+  // a helper could fail to be visible). The helpers are parsed ONCE here.
+  const helpers = compileHelpers(engine, config.helpers);
+  const parse = (src: string): Template<RichText> => engine.parse(src, helpers);
   // [LAW:one-source-of-truth] Map each SessionState key → the variable that
   // reads it, so an option picker marks its current selection by reading the
   // SAME value the templates read — independent of whether the config named the