(Tarball) execute JS-X-Ray in separate workers

[fraxken]

Just an idea at this point, since JS-X-Ray cost most of the CPU bound cost at the moment the idea was to allocate one (or a pool?) of worker threads to execute the scan.

A lot of the total delay come from I/O delay and APIs ratelimit but maybe this could help reduce the overall time positively (IDK maybe 20-30% ?).

A least that's something we have to experiment with

[7amed3li]

Hi @fraxken, I'm taking on this task.
After analyzing the current architecture and the CPU-bound nature of js-x-ray within the scanner, I've planned a solution focused on maximizing throughput. My approach will involve implementing a dedicated Worker Pool to leverage multi-core parallelism, combined with Zero-copy data transfer (using TransferList) to eliminate the overhead of cloning large tarball buffers between threads.
The goal is to push the performance gains significantly beyond the initial 20-30% estimate while maintaining strict adherence to the project's contributing guidelines and code standards.
I'll be submitting a PR shortly. Looking forward to the feedback

[7amed3li]

@fraxken,

I’ve been experimenting with this idea over the past days and implemented a guarded Worker Threads execution path for JS-X-Ray in the tarball scanner.

Key findings from the experiments:

• Naïve per-file workers are counterproductive due to orchestration overhead.
• The approach becomes beneficial only for large codebases (≈250+ files).
• The final solution uses:
  • 2 workers (to avoid context-switch overhead)
  • Dynamic load-balanced batching
  • Persistent pool with JIT warmup
  • Full fallback to synchronous execution on any failure

Based on multi-run benchmarks:

• Average speedup: ~10–15% for large packages
• Peak improvement: up to ~29% (outlier)
• Event loop responsiveness: significantly improved
• Memory usage: reduced by ~90%

This is implemented as an internal optimization with no API changes and can be fully disabled via an environment flag.

I’m preparing a PR and would appreciate your feedback when it’s ready.