Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add twaldin/hone --skill javascriptcore-garbage-collectorgit clone --depth 1 https://github.com/twaldin/honeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/twaldin/hone/javascriptcore-garbage-collector)<a href="https://agentmods.dev/skills/twaldin/hone/javascriptcore-garbage-collector"><img src="https://agentmods.dev/badge/skills/twaldin/hone/javascriptcore-garbage-collector/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/twaldin/hone/javascriptcore-garbage-collector"><img src="https://agentmods.dev/badge/skills/twaldin/hone/javascriptcore-garbage-collector.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.05913 |
| Opus 5 | $0.00040 | $0.02957 |
| Sonnet 5 | $0.00016 | $0.01183 |
| Haiku 4.5 | $0.00008 | $0.00591 |
Grade A, and why
javascriptcore-garbage-collector scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 367 lines — stays where its author put it; the contents beside it link to each section on GitHub.
JavaScriptCore's Garbage Collector (Riptide)
Riptide is non-moving, generational, parallel, mostly-concurrent, conservative-on-the-stack. Understanding those five words prevents most GC bugs in Bun.
The mental model
The heap is a graph. GC does a breadth-first search from roots → marks everything it reaches → everything unmarked is freed (lazily, on next allocation from that block). It does NOT compact or move objects — pointers stay stable for an object's lifetime.
Two collection modes:
- Eden GC: only scans newly-allocated objects + remembered set. Fast, frequent.
- Full GC: scans everything. Slower, rarer.
It runs concurrently. Marking happens on background threads while JS is executing; the mutator only stops at brief safepoints. visitChildren runs off the main thread, racing with your code.
How the VM gathers roots
Roots are not a hardcoded list — they are marking constraints registered with Heap::addMarkingConstraint() and run to fixpoint. The built-in set lives in Heap::addCoreConstraints() (vendor/WebKit/Source/JavaScriptCore/heap/Heap.cpp:2970):
| Tag | Name | What it marks |
|---|---|---|
Cs |
Conservative Scan | Native stack + registers of every JS thread, scanned word-by-word (gatherStackRoots → ConservativeRoots). Also JIT stub routines. World is stopped for this. |
Msr |
Misc Small Roots | vm.smallStrings, m_protectedValues (JSValueProtect/gcProtect), MarkedArgumentBuffer lists, vm.exception() / lastException() / m_terminationException |
Sh |
Strong Handles | m_handleSet.visitStrongHandles() — every JSC::Strong<T>. Also vm().visitAggregate() (atom string tables etc.) |
D |
Debugger | Sampling profiler, type profiler, ShadowChicken |
Ws |
Weak Sets | Iterates every WeakBlock; calls WeakHandleOwner::isReachableFromOpaqueRoots() to decide whether a weak ref should become strong this cycle |
O |
Output | Calls visitOutputConstraints() on already-marked cells in output-constraint subspaces (executables, WeakMaps). This is the "re-run after marking discovers more" hook |
Jw |
JIT Worklist | CodeBlocks queued for compilation |
Cb |
CodeBlocks | Executing/compiling CodeBlocks |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 367 lines · 80 tokens per session scan A 5e703eb6432f
javascriptcore-garbage-collector is a skill published in the GitHub repository twaldin/hone (47 stars, last pushed today), licensed MIT. It adds 80 tokens to every session and 5,913 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other skills, from other repositories
ci-self-heal
A diagnostic guide for analysing failed continuous-integration checks. Continuous integration, or CI, automatically tests and builds code changes; this guide classifies failures and suggests fixes without editing the code.
incident-rca
A diagnostic process for producing a structured root-cause analysis of a serious production incident, such as a P0 or P1 outage. It compares logs, measurements, request traces, code changes, and architecture decisions, and gives ranked explanations and actions.
bug-fix
A structured bug-fixing workflow that takes a problem from reproduction and evidence-based cause finding through approval, implementation, testing, and cleanup.
troubleshoot-terva
Diagnose terva itself. Symptoms include an extension that will not load, a connector or bot that is down, missing tools, or MCP trouble. A bloated context or session/resume confusion also qualifies. Use when terva misbehaves, or when something that should be available is absent. Also use when the user asks why terva…
hermes-s6-container-supervision
Modify or debug s6 services in the Hermes Docker image.
ast-grep
AST-aware structural code search and rewrite via ast-grep.