fix: consolidate CRANK_KEYPAIR into a singleton to reduce secretKey heap allocations - #355
fix: consolidate CRANK_KEYPAIR into a singleton to reduce secretKey heap allocations#355Ayomisco wants to merge 1 commit into
Conversation
…eap allocations loadKeypair(process.env.CRANK_KEYPAIR) was called four times at startup: once in env-guards.ts (validation), once in index.ts (module scope), once in CrankService (field initializer), and once in LiquidationService (field initializer). This created four separate 64-byte Uint8Array allocations containing the ed25519 secret key, all persisting for the process lifetime. Introduce src/lib/keypair-singleton.ts with a getKeeperKeypair() function that parses and caches the keypair on first call, then overwrites and deletes process.env.CRANK_KEYPAIR so the raw secret string is not readable by later code, heap snapshots, or accidental logger.info(process.env) calls. The env-guards.ts validation call is unchanged — it runs before getKeeperKeypair() is first invoked, so it still reads the env var successfully.
|
Warning Review limit reached
More reviews will be available in 57 minutes and 5 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Closes #354
What
Add
src/lib/keypair-singleton.tsand replace all fourloadKeypair(process.env.CRANK_KEYPAIR)call sites withgetKeeperKeypair().Why
loadKeypairwas called at module scope inindex.ts, in the field initializers ofCrankServiceandLiquidationService, and once more inenv-guards.ts. That created four separateUint8Arrayallocations holding the ed25519 secret key, each persisting in the heap for the process lifetime.Deployment platforms log stdout and stderr permanently. Any logger that serializes a service instance with
JSON.stringifyencodessecretKey: Uint8Arrayas a plain JSON object and sends it to the log stream.Changes
src/lib/keypair-singleton.tsprocess.env.CRANK_KEYPAIR, returns the same instance on every subsequent call.src/index.ts: replacedloadKeypair(...)withgetKeeperKeypair(), removedloadKeypairfrom import.src/services/crank.ts: replaced field initializer with a private getter that callsgetKeeperKeypair(), removedloadKeypairfrom import.src/services/liquidation.ts: same getter pattern, removedloadKeypairfrom import.