fix: dispose RPC authentication channel and trust deadlines

[dvcolomban]

Closing an RPC client leaves its authentication BroadcastChannel open. Successful ensureTrusted() calls also retain their timeout because .then(clear) captures the initial no-op before clear is replaced. Together these keep a Node consumer alive after it disconnects.

Close the authentication channel alongside WebMCP and transport disposal, continuing transport cleanup if another disposer throws. Clear each trust deadline in finally; preserve authentication, expiry and unlimited-wait behavior.

Added regressions for concurrent and already-resolved trust waits, expiry, unlimited waits, channel closure and cleanup failure. Three regressions fail before the fix. Afterward, 24 focused client/authentication tests pass, as do affected lint, package type checking and the package build. A separate Node process connected to a real local RPC server, authenticated, invoked a method and exited naturally after close(), without forced exit.

[coldtea-pr-lens]

◈ PR Lens

🟢 +0 new · 🟠 ~1 changed · 🔴 -0 removed · 1 flow · 4 files · commit a3f9677

Architecture

1 component touched across 5 lanes.

Open the interactive canvas

Data flow

Closing the RPC client

Open the interactive canvas

View

• Architecture lens
• Data flow lens
• Expand every detail

Tip

Run npx skills add coldteadotai/pr-lens, then tell your coding agent: "Diagram the change you just made with PR Lens and attach it to the pull request."

🪧 More tips

• Run npx @coldtea/pr-lens-cli analyze --base origin/main on a branch, then npx @coldtea/pr-lens-cli render .pr-lens/graph.json. Same lenses, your own model key, before the pull request exists.
• Untick Architecture lens or Data flow lens under View to hide a diagram, or tick Expand every detail to open every section. The comment redraws in a few seconds.
• Click the link under each diagram to open it on a canvas you can zoom, pan and step through.
• The diagrams are links. Click one to open it on the canvas, then press W or click play to walk through the change.
• Open a diagram on the canvas, then press W or click play to walk through the change one step at a time.
• The CLI's render reads .github/pr-lens.yml and applies your renames, exclusions and lane pins at draw time.
• Set github.comment.collapsed: true in .github/pr-lens.yml to fold the comment behind one View architecture and data flow row. Drawing still runs on every push.
• Add .github/workflows/pr-lens.yml with coldteadotai/pr-lens/packages/action@v0 and your model provider's key as its api-key to run PR Lens from your own CI. Any /chat/completions endpoint works.
• Push a commit and the comment redraws for the new head. A slow older run never overwrites a newer one.
• Switch GitHub to dark mode and the diagrams follow. The moving dots are this pull request's data in motion.

---

Thanks for using PR Lens! It's built by Coldtea, free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
devframe	Skipped		Sep 13, 2026 11:34am UTC

[Copilot]

🟢 Approval recommended

No unresolved blocking issues were identified.

Pull request overview

Fixes RPC client resource leaks by closing the authentication channel and reliably clearing trust deadlines.

Changes:

• Adds resilient cleanup for authentication, WebMCP, and transport resources.
• Clears trust deadlines in finally.
• Adds regression coverage for cleanup and trust-wait behavior.

File summaries

File	Summary
packages/devframe/src/client/rpc.ts	Adds authentication-channel disposal and resilient cleanup.
packages/devframe/src/client/rpc.test.ts	Tests channel closure and cleanup failures.
packages/devframe/src/client/rpc-live.ts	Ensures trust timers are cleared.
packages/devframe/src/client/rpc-live-trust.test.ts	Tests trust deadline lifecycle behavior.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.