Synced from monorepo

Synced from monorepo

Changes:
- Shell: accept target response id on rewind execute
- Shell: stamp response id on chat user message chunks
- Worktree: optional rebuild and stale git registration cleanup in auto-GC
- Worktree: kind-aware auto-GC TTLs and config knobs
- Worktree: macOS process CWD scan and Unix PID liveness for GC guards
- Worktree: automatic throttled GC on startup (Linux age-based; non-Linux dead-only)
- Pager: add `[ui].combine_queued_prompts` to batch queued follow-ups
- Shell: stop overwriting user skills
- Tools: read markdown in `skills/` directories untruncated
- `/usage` shows per-session token and dollar usage in the TUI
- Security: prompt on environment-dumping `ps` variants
- Security: always-safe `kubectl` no longer runs arbitrary kubeconfig credential plugins without permission
- Tools: make scheduler deletion durable
- Shell: add relocation storage primitives
- Shell: give side model calls their own conversation ids
- Fix five workflow-runtime bugs (budget, pause, cancel, reconnect)
- Security: peel `env -S` / `--split-string` operands in the Bash permission gate (managed deny/ask)
- Pager: expose doctor in the TUI
- Security: block unauthorized RCE via abused safe commands
- Pager idle watcher cue: "1 subagent still running" instead of "watching · 1 subagent"
- Security: block `rg --pre` arbitrary code execution in auto-mode
- Voice: diagnose silent-mic failures (macOS permission) and add doctor/terminal-setup Voice section
- App builder deployer: `allow_forking` and `show_built_with_grok`
- Pager: stop stacking duplicate "Worked for" markers on parked turns
- Shell: support `max` as a distinct reasoning effort tier
- Tools: serialize background `/loop` fires on the whole work unit
- Shell: add working-directory relocation state primitives
- Proto: `ClientToolResult` and `ChatConfig` client-side tools
- Shell: model providers
- Chat: select App Builder product on the Build path
- Shell: attach author identity to feedback when the deployment opts in
- Doctor: fix for SSH wrap setup
- Workflow authoring skills: create-workflow and import-claude-workflow docs
- Add read-only grok doctor
- Sandbox: apply Landlock without a controlling TTY
- Pager: recover image paste over grok wrap on headless remotes
- Pager: make actions screen-mode aware
- Shell: resume sessions when the working directory moves
- Pager: centralize terminal diagnostics
- Workspace: gate inline shell file access
- Pager: centralize terminal probes
- Pager: edit minimal prompts in an external editor
- Pager: standardize backgrounding on Ctrl+B
- Shell: recap rides the parent turn's prompt cache
- Tools: add scheduler lifecycle version clock

Source-Revision: 0f4d7c91b8b2b408333f6de1e8a76cb8eaa71899
This commit is contained in:
grokkybara[bot] 2026-07-21 18:10:23 +00:00
commit 3af4d5d398
556 changed files with 56609 additions and 21892 deletions

View file

@ -316,6 +316,25 @@ pub fn native_tool_name() -> &'static str {
}
}
/// Result of an explicit Wayland data-control capability probe.
#[derive(Clone, Debug, Eq, PartialEq)]
pub enum WaylandDataControlProbe {
/// The compositor definitively reported the protocol present or absent.
Available(bool),
/// The bounded worker did not answer before its deadline.
Unavailable,
/// The worker or compositor returned an operational error.
Error(String),
}
/// Run one explicit, bounded Wayland data-control capability probe.
///
/// Unlike [`wayland_data_control_supported`], this preserves inconclusive
/// outcomes for diagnostics instead of mapping them to `false`.
pub fn probe_wayland_data_control() -> WaylandDataControlProbe {
platform::probe_wayland_data_control()
}
/// Whether the Wayland compositor supports the data-control clipboard
/// protocol (`zwlr_data_control_v1` / `ext_data_control_v1`).
///
@ -592,6 +611,10 @@ mod platform {
false
}
pub(super) fn probe_wayland_data_control() -> super::WaylandDataControlProbe {
super::WaylandDataControlProbe::Available(false)
}
/// Serializes every in-process NSPasteboard touch.
///
/// The metadata-only design held "no concurrent in-process pasteboard
@ -1452,18 +1475,6 @@ mod platform {
spec.is_some_and(|spec| spec.reads_wayland_selection)
}
/// Outcome of one data-control probe attempt.
#[cfg(target_os = "linux")]
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
enum ProbeOutcome {
/// The compositor answered: protocol present or absent — decidable
/// forever.
Definitive(bool),
/// The compositor did not answer (probe timeout, connection failure,
/// worker died) — fail closed for this call, retry on a later one.
Indefinite,
}
/// Indefinite probe outcomes tolerated before deciding `false` permanently
/// (mirrors the lease's timeout ⇒ permanent-degradation stance), so a
/// wedged compositor can't tax every copy with a bounded probe forever.
@ -1496,13 +1507,17 @@ mod platform {
/// runs the same connect on the same budget and may succeed moments later,
/// leaving every working data-control copy mis-toasted as failed.
#[cfg(target_os = "linux")]
fn apply_probe_outcome(cache: &mut ProbeCache, outcome: ProbeOutcome) -> bool {
fn apply_probe_outcome(
cache: &mut ProbeCache,
outcome: &super::WaylandDataControlProbe,
) -> bool {
match outcome {
ProbeOutcome::Definitive(supported) => {
cache.decided = Some(supported);
supported
super::WaylandDataControlProbe::Available(supported) => {
cache.decided = Some(*supported);
*supported
}
ProbeOutcome::Indefinite => {
super::WaylandDataControlProbe::Unavailable
| super::WaylandDataControlProbe::Error(_) => {
cache.indefinite_seen += 1;
if cache.indefinite_seen >= PROBE_INDEFINITE_MAX {
cache.decided = Some(false);
@ -1517,7 +1532,7 @@ mod platform {
#[cfg(target_os = "linux")]
fn cached_probe_answer(
cache: &parking_lot::Mutex<ProbeCache>,
probe: impl FnOnce() -> ProbeOutcome,
probe: impl FnOnce() -> super::WaylandDataControlProbe,
) -> bool {
let mut cache = cache.lock();
if let Some(decided) = cache.decided {
@ -1530,7 +1545,7 @@ mod platform {
// cap count past PROBE_INDEFINITE_MAX in one wall-clock burst, or
// dropping a concurrent definitive answer.
let outcome = probe();
apply_probe_outcome(&mut cache, outcome)
apply_probe_outcome(&mut cache, &outcome)
}
/// Memoized data-control probe (see the public wrapper for semantics).
@ -1552,46 +1567,83 @@ mod platform {
false
}
/// Run the same compositor probe arboard's `Clipboard::new` uses to pick
/// its Wayland backend, on a worker thread with a self-imposed deadline
/// (the Wayland connection can block on a hung compositor). Callers gate
/// on the kill switch and `WAYLAND_DISPLAY` first.
#[cfg(target_os = "linux")]
fn probe_data_control() -> ProbeOutcome {
pub(super) fn probe_wayland_data_control() -> super::WaylandDataControlProbe {
if data_control_kill_switch_set() || !env_present("WAYLAND_DISPLAY") {
return super::WaylandDataControlProbe::Available(false);
}
probe_data_control()
}
#[cfg(not(target_os = "linux"))]
pub(super) fn probe_wayland_data_control() -> super::WaylandDataControlProbe {
super::WaylandDataControlProbe::Available(false)
}
/// Run the same compositor probe arboard's `Clipboard::new` uses to pick
/// its Wayland backend, on a bounded worker. Both the legacy cached bool
/// adapter and explicit diagnostics consume this typed result.
#[cfg(target_os = "linux")]
fn probe_data_control() -> super::WaylandDataControlProbe {
use std::sync::mpsc::RecvTimeoutError;
match spawn_with_deadline(
"clipboard-dc-probe",
DISPLAY_CONN_WAIT,
wl_clipboard_rs::utils::is_primary_selection_supported,
) {
Ok(result) => data_control_from_probe(result),
Err(e) => {
tracing::debug!("wayland data-control probe aborted: {e}");
ProbeOutcome::Indefinite
Ok(result) => data_control_from_result(result),
Err(RecvTimeoutError::Timeout) => super::WaylandDataControlProbe::Unavailable,
Err(RecvTimeoutError::Disconnected) => {
super::WaylandDataControlProbe::Error("probe worker died".to_owned())
}
}
}
/// Classify one probe answer: any `Ok` means the data-control protocol is
/// present (whether the *primary* selection is supported is irrelevant —
/// this mirrors arboard's own backend selection); `MissingProtocol` /
/// `NoSeats` are the compositor definitively answering "absent". Anything
/// else means the compositor didn't answer.
#[cfg(target_os = "linux")]
fn data_control_from_probe(
result: Result<bool, wl_clipboard_rs::utils::PrimarySelectionCheckError>,
) -> ProbeOutcome {
use wl_clipboard_rs::utils::PrimarySelectionCheckError;
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
enum DataControlSemanticResult {
Present,
MissingProtocol,
NoSeats,
ConnectionUnavailable,
}
#[cfg(target_os = "linux")]
fn classify_data_control_semantic(
result: DataControlSemanticResult,
) -> super::WaylandDataControlProbe {
use super::WaylandDataControlProbe;
match result {
Ok(_) => ProbeOutcome::Definitive(true),
Err(PrimarySelectionCheckError::MissingProtocol)
| Err(PrimarySelectionCheckError::NoSeats) => ProbeOutcome::Definitive(false),
Err(e) => {
tracing::debug!("wayland data-control probe inconclusive: {e}");
ProbeOutcome::Indefinite
DataControlSemanticResult::Present => WaylandDataControlProbe::Available(true),
DataControlSemanticResult::MissingProtocol => WaylandDataControlProbe::Available(false),
DataControlSemanticResult::NoSeats
| DataControlSemanticResult::ConnectionUnavailable => {
WaylandDataControlProbe::Unavailable
}
}
}
/// Canonical exhaustive mapping from dependency errors to semantic classes.
#[cfg(target_os = "linux")]
fn data_control_from_result(
result: Result<bool, wl_clipboard_rs::utils::PrimarySelectionCheckError>,
) -> super::WaylandDataControlProbe {
use wl_clipboard_rs::utils::PrimarySelectionCheckError;
let semantic = match result {
Ok(_) => DataControlSemanticResult::Present,
Err(PrimarySelectionCheckError::MissingProtocol) => {
DataControlSemanticResult::MissingProtocol
}
Err(PrimarySelectionCheckError::NoSeats) => DataControlSemanticResult::NoSeats,
Err(
PrimarySelectionCheckError::SocketOpenError(_)
| PrimarySelectionCheckError::WaylandConnection(_)
| PrimarySelectionCheckError::WaylandCommunication(_),
) => DataControlSemanticResult::ConnectionUnavailable,
};
classify_data_control_semantic(semantic)
}
#[cfg(target_os = "linux")]
fn env_value_present(value: Option<&std::ffi::OsStr>) -> bool {
value.is_some_and(|value| !value.is_empty())
@ -2217,6 +2269,7 @@ mod platform {
#[cfg(all(test, target_os = "linux"))]
mod linux_tests {
use super::*;
use crate::clipboard::WaylandDataControlProbe;
#[test]
fn primary_read_argv_targets_x11_primary_exactly() {
@ -2526,34 +2579,50 @@ mod platform {
assert!(!wayland_readback_required(false, false, false));
}
/// `Ok(_)` means the data-control protocol is present regardless of
/// the primary-selection answer; MissingProtocol/NoSeats are the
/// compositor definitively answering "absent"; connection-class
/// failures are indefinite (fail closed now, retry later).
#[test]
fn data_control_probe_classification() {
fn data_control_semantic_classification_is_exhaustive() {
assert_eq!(
classify_data_control_semantic(DataControlSemanticResult::Present),
WaylandDataControlProbe::Available(true)
);
assert_eq!(
classify_data_control_semantic(DataControlSemanticResult::MissingProtocol),
WaylandDataControlProbe::Available(false)
);
assert_eq!(
classify_data_control_semantic(DataControlSemanticResult::NoSeats),
WaylandDataControlProbe::Unavailable
);
assert_eq!(
classify_data_control_semantic(DataControlSemanticResult::ConnectionUnavailable),
WaylandDataControlProbe::Unavailable
);
}
#[test]
fn dependency_error_mapping_pins_directly_constructible_variants() {
use wl_clipboard_rs::utils::PrimarySelectionCheckError;
assert_eq!(
data_control_from_probe(Ok(true)),
ProbeOutcome::Definitive(true)
data_control_from_result(Ok(true)),
WaylandDataControlProbe::Available(true)
);
assert_eq!(
data_control_from_probe(Ok(false)),
ProbeOutcome::Definitive(true)
data_control_from_result(Ok(false)),
WaylandDataControlProbe::Available(true)
);
assert_eq!(
data_control_from_probe(Err(PrimarySelectionCheckError::MissingProtocol)),
ProbeOutcome::Definitive(false)
data_control_from_result(Err(PrimarySelectionCheckError::MissingProtocol)),
WaylandDataControlProbe::Available(false)
);
assert_eq!(
data_control_from_probe(Err(PrimarySelectionCheckError::NoSeats)),
ProbeOutcome::Definitive(false)
data_control_from_result(Err(PrimarySelectionCheckError::NoSeats)),
WaylandDataControlProbe::Unavailable
);
assert_eq!(
data_control_from_probe(Err(PrimarySelectionCheckError::SocketOpenError(
data_control_from_result(Err(PrimarySelectionCheckError::SocketOpenError(
std::io::Error::other("boom")
))),
ProbeOutcome::Indefinite
WaylandDataControlProbe::Unavailable
);
}
@ -2564,25 +2633,52 @@ mod platform {
fn probe_cache_indefinite_stays_undecided_below_cap() {
let mut cache = ProbeCache::new();
for seen in 1..PROBE_INDEFINITE_MAX {
assert!(!apply_probe_outcome(&mut cache, ProbeOutcome::Indefinite));
assert!(!apply_probe_outcome(
&mut cache,
&WaylandDataControlProbe::Unavailable
));
assert_eq!(cache.decided, None);
assert_eq!(cache.indefinite_seen, seen);
}
// Cap reached: permanently decided false (mirrors lease degradation).
assert!(!apply_probe_outcome(&mut cache, ProbeOutcome::Indefinite));
assert!(!apply_probe_outcome(
&mut cache,
&WaylandDataControlProbe::Unavailable
));
assert_eq!(cache.decided, Some(false));
}
/// A definitive answer after transient failures decides truth exactly
/// once; the earlier indefinite attempts leave no residue in the
/// decision.
#[test]
fn repeated_probe_errors_reach_permanent_false() {
let mut cache = ProbeCache::new();
for seen in 1..PROBE_INDEFINITE_MAX {
assert!(!apply_probe_outcome(
&mut cache,
&WaylandDataControlProbe::Error("worker died".to_owned())
));
assert_eq!(cache.decided, None);
assert_eq!(cache.indefinite_seen, seen);
}
assert!(!apply_probe_outcome(
&mut cache,
&WaylandDataControlProbe::Error("worker died".to_owned())
));
assert_eq!(cache.decided, Some(false));
}
#[test]
fn probe_cache_definitive_after_indefinite_decides_truth() {
let mut cache = ProbeCache::new();
assert!(!apply_probe_outcome(&mut cache, ProbeOutcome::Indefinite));
assert!(!apply_probe_outcome(
&mut cache,
&WaylandDataControlProbe::Unavailable
));
assert!(apply_probe_outcome(
&mut cache,
ProbeOutcome::Definitive(true)
&WaylandDataControlProbe::Available(true)
));
assert_eq!(cache.decided, Some(true));
assert_eq!(cache.indefinite_seen, 1);
@ -2593,7 +2689,7 @@ mod platform {
let mut cache = ProbeCache::new();
assert!(!apply_probe_outcome(
&mut cache,
ProbeOutcome::Definitive(false)
&WaylandDataControlProbe::Available(false)
));
assert_eq!(cache.decided, Some(false));
}
@ -2606,11 +2702,11 @@ mod platform {
let calls = std::cell::Cell::new(0u32);
assert!(cached_probe_answer(&cache, || {
calls.set(calls.get() + 1);
ProbeOutcome::Definitive(true)
WaylandDataControlProbe::Available(true)
}));
assert!(cached_probe_answer(&cache, || {
calls.set(calls.get() + 1);
ProbeOutcome::Definitive(false)
WaylandDataControlProbe::Available(false)
}));
assert_eq!(calls.get(), 1);
}
@ -2630,7 +2726,7 @@ mod platform {
calls.fetch_add(1, Ordering::Relaxed);
// Hold the lock long enough that peers must wait.
std::thread::sleep(std::time::Duration::from_millis(50));
ProbeOutcome::Definitive(true)
WaylandDataControlProbe::Available(true)
});
assert!(answer);
});

View file

@ -160,6 +160,9 @@ pub struct UiConfig {
/// only appears once a user toggles a tip.
#[serde(default, skip_serializing_if = "ContextualHints::is_default")]
pub contextual_hints: ContextualHints,
/// Combine consecutive queued follow-ups into one turn. `None` = off.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub combine_queued_prompts: Option<bool>,
/// Display-refresh probe + auto-cadence (`[ui.display_refresh]`). Per-field
/// `None` inherits remote/default; skipped when untouched.
#[serde(default, skip_serializing_if = "DisplayRefreshSettings::is_default")]
@ -273,6 +276,7 @@ impl Default for UiConfig {
screen_mode: None,
double_click_action: None,
contextual_hints: ContextualHints::default(),
combine_queued_prompts: None,
display_refresh: DisplayRefreshSettings::default(),
}
}