fix(dlx): cap binary/package-json path caches and TTL negative hits

`binaryPathCache` (src/dlx/package.ts) and `packageJsonPathCache`
(src/dlx/detect.ts) were plain `Map`s with no size limit — a long-
running process (devserver, editor extension) that resolved many
distinct paths accumulated entries forever. Adds a 200-entry LRU cap
to both (Map insertion-order = recency, re-insert on hit).

`packageJsonPathCache` also cached negative results (null) without any
expiration. A directory that later gained a package.json (sibling
`npm install`, `pnpm add`, workspace scaffolding) would permanently
return undefined. Negative entries now expire after a 10s TTL and
re-probe — still amortizing the walk in tight loops but not forever.

Author: jdalton

src/dlx/detect.ts

@@ -26,7 +26,29 @@ let _path: typeof import('node:path') | undefined
 const NODE_JS_EXTENSIONS = new Set(['.js', '.mjs', '.cjs'] as const)
 
 // Cache for package.json path lookups to avoid repeated directory traversal.
-const packageJsonPathCache = new Map<string, string | null>()
+// Bounded LRU so long-lived processes don't accumulate entries for every
+// distinct startDir they've ever seen. Negative entries (null) are
+// short-lived — we re-probe after TTL expiry so a dir that later gains
+// a package.json isn't permanently stuck at "none found".
+const PACKAGE_JSON_PATH_CACHE_MAX_SIZE = 200
+const PACKAGE_JSON_NEGATIVE_TTL_MS = 10_000
+type PackageJsonPathEntry = {
+  path: string | null
+  at: number
+}
+const packageJsonPathCache = new Map<string, PackageJsonPathEntry>()
+
+function packageJsonPathCacheSet(key: string, value: string | null): void {
+  if (packageJsonPathCache.has(key)) {
+    packageJsonPathCache.delete(key)
+  } else if (packageJsonPathCache.size >= PACKAGE_JSON_PATH_CACHE_MAX_SIZE) {
+    const oldest = packageJsonPathCache.keys().next().value
+    if (oldest !== undefined) {
+      packageJsonPathCache.delete(oldest)
+    }
+  }
+  packageJsonPathCache.set(key, { path: value, at: Date.now() })
+}
 
 // Cache for parsed package.json content keyed by path + mtime so stale
 // content is not served if the file is modified or replaced.
@@ -62,15 +84,22 @@ function findPackageJson(filePath: string): string | undefined {
   // Check cache first.
   const cached = packageJsonPathCache.get(startDir)
   if (cached !== undefined) {
-    // Validate cache - check if cached path still exists.
-    if (cached === null) {
-      return undefined
-    }
-    if (fs.existsSync(cached)) {
-      return cached
+    // Negative entries expire after a short TTL so a directory that later
+    // gains a package.json (npm install in a sibling workspace, etc.) is
+    // re-probed instead of permanently stuck on the cached "not found".
+    if (cached.path === null) {
+      if (Date.now() - cached.at < PACKAGE_JSON_NEGATIVE_TTL_MS) {
+        return undefined
+      }
+      packageJsonPathCache.delete(startDir)
+    } else if (fs.existsSync(cached.path)) {
+      // Bump recency on hit.
+      packageJsonPathCacheSet(startDir, cached.path)
+      return cached.path
+    } else {
+      // Cached path no longer exists, remove stale entry.
+      packageJsonPathCache.delete(startDir)
     }
-    // Cached path no longer exists, remove stale entry.
-    packageJsonPathCache.delete(startDir)
   }
 
   let currentDir = startDir
@@ -80,15 +109,15 @@ function findPackageJson(filePath: string): string | undefined {
     const packageJsonPath = path.join(currentDir, 'package.json')
     if (fs.existsSync(packageJsonPath)) {
       // Cache the result for the starting directory.
-      packageJsonPathCache.set(startDir, packageJsonPath)
+      packageJsonPathCacheSet(startDir, packageJsonPath)
       return packageJsonPath
     }
 
     currentDir = path.dirname(currentDir)
   }
 
   // Cache the negative result.
-  packageJsonPathCache.set(startDir, null)
+  packageJsonPathCacheSet(startDir, null)
   return undefined
 }
 

src/dlx/package.ts

@@ -63,9 +63,27 @@ const FIREWALL_BLOCK_SEVERITIES: ReadonlySet<string> = new Set([
   'high',
 ])
 
-// Cache for binary path resolution to avoid repeated extension checks on Windows.
+// Cache for binary path resolution to avoid repeated extension checks
+// on Windows. Bounded LRU: a long-running process that resolves many
+// distinct binary paths used to accumulate entries forever, and entries
+// for paths that have since been garbage-collected by `cleanDlxCache`
+// were never reclaimed. Map iteration order = insertion order; accessing
+// an entry re-inserts it to bump recency.
+const BINARY_PATH_CACHE_MAX_SIZE = 200
 const binaryPathCache = new Map<string, string>()
 
+function binaryPathCacheSet(key: string, value: string): void {
+  if (binaryPathCache.has(key)) {
+    binaryPathCache.delete(key)
+  } else if (binaryPathCache.size >= BINARY_PATH_CACHE_MAX_SIZE) {
+    const oldest = binaryPathCache.keys().next().value
+    if (oldest !== undefined) {
+      binaryPathCache.delete(oldest)
+    }
+  }
+  binaryPathCache.set(key, value)
+}
+
 interface FirewallAlert {
   severity?: string
   type?: string
@@ -887,6 +905,8 @@ export function resolveBinaryPath(basePath: string): string {
   const cached = binaryPathCache.get(basePath)
   if (cached) {
     if (fs.existsSync(cached)) {
+      // Bump recency on hit.
+      binaryPathCacheSet(basePath, cached)
       return cached
     }
     // Cached path no longer exists, remove stale entry.
@@ -901,7 +921,7 @@ export function resolveBinaryPath(basePath: string): string {
     const testPath = basePath + ext
     if (fs.existsSync(testPath)) {
       // Cache the result.
-      binaryPathCache.set(basePath, testPath)
+      binaryPathCacheSet(basePath, testPath)
       return testPath
     }
   }