fix(web): close unary Zoekt gRPC clients

[brendan-kellam]

Summary

• Close the per-request Zoekt gRPC client in a finally block after every unary search.
• Cover success, RPC failure, and response-transformation failure paths with regression tests.

Finding

zoektSearch created a new grpc-js WebserverService client for every unary request but never closed it. grpc-js registers each InternalChannel in its process-global channelz registry and only unregisters it when Client.close() runs, so dropping JavaScript references does not make those channels collectible.

With the repository pinned grpc-js 1.14.4, a forced-GC reproduction created and dropped 20,000 clients. Channelz still reported all 20,000 channels afterward; retained V8 heap grew by 36,170,288 bytes (about 1.81 KiB per call) and RSS grew by 318 MiB. This path is used by unary search, code navigation, and search-backed tools. Live counters show it is not the dominant source of the current browse-crawler incident, but it is a concrete traffic-proportional leak.

Remediation

The unary call and response transformation now run inside try/finally, and the client is closed in finally. This guarantees channelz cleanup after a successful response, an RPC error, a synchronous call failure, or a later database/response transformation error.

Test plan

• yarn workspace @sourcebot/web test --run src/features/search/zoektSearcher.test.ts (3 tests passed)
• yarn workspace @sourcebot/web exec eslint src/features/search/zoektSearcher.ts src/features/search/zoektSearcher.test.ts
• Full web tsc was also attempted; it remains blocked by existing unrelated missing public-asset declarations and pre-existing test fixture type errors.

---

Note

Medium Risk
Touches the unary Zoekt search path used by search, code nav, and tools. The change is small and covered by tests, but incorrect client teardown could leak or fail searches.

Overview
Stops unary Zoekt searches from leaking a grpc-js channel on every request. zoektSearch now awaits the RPC and response transform in try/finally and always calls client.close().

Streaming search already closed clients; this only fixes the unary path. Tests cover success, RPC failure, and post-response transform failure. Changelog notes the leak fix.

^{Reviewed by Cursor Bugbot for commit b7868ec. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes

  • Improved search reliability by ensuring connections close after every search request.
  • Prevented connections from being retained when searches or response processing fail.
  • Preserved proper error reporting for failed searches and response transformations.

• Documentation

  • Added an Unreleased changelog entry describing the connection cleanup improvement.

• Tests

  • Added coverage for successful searches and multiple failure scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7ab25aba-ea5b-4c16-b264-4d18cdedd3d1

📥 Commits

Reviewing files that changed from the base of the PR and between 387472a and b7868ec.

📒 Files selected for processing (1)

• CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (1)

• CHANGELOG.md

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

Walkthrough

zoektSearch now awaits the gRPC request and response transformation, then closes the client in a finally block. Tests cover successful searches, request failures, and transformation failures. The changelog records the fix.

Changes

Zoekt search cleanup

Layer / File(s)	Summary
Search control flow and cleanup packages/web/src/features/search/zoektSearcher.ts, packages/web/src/features/search/zoektSearcher.test.ts, CHANGELOG.md	zoektSearch awaits the gRPC request and response transformation, closes the client on success and failure, and propagates errors. Tests cover all three paths. The changelog records the fix.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to b7868

This localized change closes unary search clients across success and failure paths with regression coverage; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: closing unary Zoekt gRPC clients.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch brendan/fix-grpc-client-leak

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}