[low] accessJwt/refreshJwt visible in heap dumps via AtpAgent in-memory sessions

[aspiers]

Summary

PdsAgentPool holds authenticated AtpAgent instances in a Map (src/pds/agent.ts:10). Each AtpAgent stores live accessJwt and refreshJwt strings internally (managed by @atproto/api). These are visible in heap dumps or memory inspection tools.

Details

• JWTs are never written to disk by this codebase, which is correct.
• However, they live as plaintext strings in the process heap for the lifetime of the cached agent.
• This is inherent to the @atproto/api library's session design, not a bug introduced here.

Suggested Fix

• Document this as a known trade-off.
• Consider setting a maximum agent cache TTL to bound JWT lifetime in memory.
• Evaluate whether @atproto/api provides any mechanism to limit session exposure.

[aspiers]

This issue was raised by Adam's AI analysis and should be taken with a pinch of salt.