handshake: close accepted streams — port 444 leaked a goroutine per connection

[TeoSlayer]

Close appeared nowhere in handshake.go. Every stream accepted on port 444 was leaked — on both the timeout and the success path.

The timeout branch is the worse half

ch := make(chan readResult, 1)
go func() {
    buf := make([]byte, maxMsgSize)   // 64 KiB
    n, err := stream.Read(buf)
    ...
}()
select {
case res := <-ch: ...
case <-time.After(handshakeRecvTimeout):   // 10s
    slog.Warn("handshake timeout waiting for message", ...)
}

On timeout, handleConnection returned without closing. The child goroutine stayed parked in stream.Read forever — nothing could ever unblock it, because the only thing that would is a Close, and there wasn't one. Its stack retained the 64 KiB buffer, the stream, and the underlying daemon Connection with its RecvBuf/SendBuf channels.

Port 444 accepts from any peer. A peer that connects and sends nothing leaked ~64 KiB + a goroutine stack + a full Connection every 10 seconds, uncapped, with no recovery.

That is the same shape as the dead idle-timeout that OOM-killed the 431-agent service fleet — reached through a different door.

Why closing fixes the parked goroutine

Close → CloseConnection → CloseRecvBuf, so the blocked <-RecvBuf returns !ok and the reader exits with io.EOF. Closing is the only thing that can reclaim it.

The dead constant was the clue

handshakeCloseDelay was declared at line 80 for precisely this — "delay before closing after send to let data flush" — and had no remaining reference anywhere in the package. It was stranded when the close path was removed at some point.

processMessage writes its reply synchronously, so closing without the pause would truncate an in-flight response. That's why the delay existed, and why simply adding a bare defer Close() would have been wrong.

Each handleConnection already runs in its own goroutine (see the accept loop), so the pause delays nothing but its own teardown.

Tests

go build, go vet clean. TestSendRequestDirectFailsRelaySucceeds fails identically with and without this change — verified against a clean stash, so it's pre-existing and unrelated.

Found during a codebase-wide sweep for safety mechanisms that silently fail to engage.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!