Synced from monorepo
Synced from monorepo Changes: - Shell: accept target response id on rewind execute - Shell: stamp response id on chat user message chunks - Worktree: optional rebuild and stale git registration cleanup in auto-GC - Worktree: kind-aware auto-GC TTLs and config knobs - Worktree: macOS process CWD scan and Unix PID liveness for GC guards - Worktree: automatic throttled GC on startup (Linux age-based; non-Linux dead-only) - Pager: add `[ui].combine_queued_prompts` to batch queued follow-ups - Shell: stop overwriting user skills - Tools: read markdown in `skills/` directories untruncated - `/usage` shows per-session token and dollar usage in the TUI - Security: prompt on environment-dumping `ps` variants - Security: always-safe `kubectl` no longer runs arbitrary kubeconfig credential plugins without permission - Tools: make scheduler deletion durable - Shell: add relocation storage primitives - Shell: give side model calls their own conversation ids - Fix five workflow-runtime bugs (budget, pause, cancel, reconnect) - Security: peel `env -S` / `--split-string` operands in the Bash permission gate (managed deny/ask) - Pager: expose doctor in the TUI - Security: block unauthorized RCE via abused safe commands - Pager idle watcher cue: "1 subagent still running" instead of "watching · 1 subagent" - Security: block `rg --pre` arbitrary code execution in auto-mode - Voice: diagnose silent-mic failures (macOS permission) and add doctor/terminal-setup Voice section - App builder deployer: `allow_forking` and `show_built_with_grok` - Pager: stop stacking duplicate "Worked for" markers on parked turns - Shell: support `max` as a distinct reasoning effort tier - Tools: serialize background `/loop` fires on the whole work unit - Shell: add working-directory relocation state primitives - Proto: `ClientToolResult` and `ChatConfig` client-side tools - Shell: model providers - Chat: select App Builder product on the Build path - Shell: attach author identity to feedback when the deployment opts in - Doctor: fix for SSH wrap setup - Workflow authoring skills: create-workflow and import-claude-workflow docs - Add read-only grok doctor - Sandbox: apply Landlock without a controlling TTY - Pager: recover image paste over grok wrap on headless remotes - Pager: make actions screen-mode aware - Shell: resume sessions when the working directory moves - Pager: centralize terminal diagnostics - Workspace: gate inline shell file access - Pager: centralize terminal probes - Pager: edit minimal prompts in an external editor - Pager: standardize backgrounding on Ctrl+B - Shell: recap rides the parent turn's prompt cache - Tools: add scheduler lifecycle version clock Source-Revision: 0f4d7c91b8b2b408333f6de1e8a76cb8eaa71899
This commit is contained in:
parent
a881e6703f
commit
3af4d5d398
556 changed files with 56609 additions and 21892 deletions
|
|
@ -316,6 +316,25 @@ pub fn native_tool_name() -> &'static str {
|
|||
}
|
||||
}
|
||||
|
||||
/// Result of an explicit Wayland data-control capability probe.
|
||||
#[derive(Clone, Debug, Eq, PartialEq)]
|
||||
pub enum WaylandDataControlProbe {
|
||||
/// The compositor definitively reported the protocol present or absent.
|
||||
Available(bool),
|
||||
/// The bounded worker did not answer before its deadline.
|
||||
Unavailable,
|
||||
/// The worker or compositor returned an operational error.
|
||||
Error(String),
|
||||
}
|
||||
|
||||
/// Run one explicit, bounded Wayland data-control capability probe.
|
||||
///
|
||||
/// Unlike [`wayland_data_control_supported`], this preserves inconclusive
|
||||
/// outcomes for diagnostics instead of mapping them to `false`.
|
||||
pub fn probe_wayland_data_control() -> WaylandDataControlProbe {
|
||||
platform::probe_wayland_data_control()
|
||||
}
|
||||
|
||||
/// Whether the Wayland compositor supports the data-control clipboard
|
||||
/// protocol (`zwlr_data_control_v1` / `ext_data_control_v1`).
|
||||
///
|
||||
|
|
@ -592,6 +611,10 @@ mod platform {
|
|||
false
|
||||
}
|
||||
|
||||
pub(super) fn probe_wayland_data_control() -> super::WaylandDataControlProbe {
|
||||
super::WaylandDataControlProbe::Available(false)
|
||||
}
|
||||
|
||||
/// Serializes every in-process NSPasteboard touch.
|
||||
///
|
||||
/// The metadata-only design held "no concurrent in-process pasteboard
|
||||
|
|
@ -1452,18 +1475,6 @@ mod platform {
|
|||
spec.is_some_and(|spec| spec.reads_wayland_selection)
|
||||
}
|
||||
|
||||
/// Outcome of one data-control probe attempt.
|
||||
#[cfg(target_os = "linux")]
|
||||
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
|
||||
enum ProbeOutcome {
|
||||
/// The compositor answered: protocol present or absent — decidable
|
||||
/// forever.
|
||||
Definitive(bool),
|
||||
/// The compositor did not answer (probe timeout, connection failure,
|
||||
/// worker died) — fail closed for this call, retry on a later one.
|
||||
Indefinite,
|
||||
}
|
||||
|
||||
/// Indefinite probe outcomes tolerated before deciding `false` permanently
|
||||
/// (mirrors the lease's timeout ⇒ permanent-degradation stance), so a
|
||||
/// wedged compositor can't tax every copy with a bounded probe forever.
|
||||
|
|
@ -1496,13 +1507,17 @@ mod platform {
|
|||
/// runs the same connect on the same budget and may succeed moments later,
|
||||
/// leaving every working data-control copy mis-toasted as failed.
|
||||
#[cfg(target_os = "linux")]
|
||||
fn apply_probe_outcome(cache: &mut ProbeCache, outcome: ProbeOutcome) -> bool {
|
||||
fn apply_probe_outcome(
|
||||
cache: &mut ProbeCache,
|
||||
outcome: &super::WaylandDataControlProbe,
|
||||
) -> bool {
|
||||
match outcome {
|
||||
ProbeOutcome::Definitive(supported) => {
|
||||
cache.decided = Some(supported);
|
||||
supported
|
||||
super::WaylandDataControlProbe::Available(supported) => {
|
||||
cache.decided = Some(*supported);
|
||||
*supported
|
||||
}
|
||||
ProbeOutcome::Indefinite => {
|
||||
super::WaylandDataControlProbe::Unavailable
|
||||
| super::WaylandDataControlProbe::Error(_) => {
|
||||
cache.indefinite_seen += 1;
|
||||
if cache.indefinite_seen >= PROBE_INDEFINITE_MAX {
|
||||
cache.decided = Some(false);
|
||||
|
|
@ -1517,7 +1532,7 @@ mod platform {
|
|||
#[cfg(target_os = "linux")]
|
||||
fn cached_probe_answer(
|
||||
cache: &parking_lot::Mutex<ProbeCache>,
|
||||
probe: impl FnOnce() -> ProbeOutcome,
|
||||
probe: impl FnOnce() -> super::WaylandDataControlProbe,
|
||||
) -> bool {
|
||||
let mut cache = cache.lock();
|
||||
if let Some(decided) = cache.decided {
|
||||
|
|
@ -1530,7 +1545,7 @@ mod platform {
|
|||
// cap count past PROBE_INDEFINITE_MAX in one wall-clock burst, or
|
||||
// dropping a concurrent definitive answer.
|
||||
let outcome = probe();
|
||||
apply_probe_outcome(&mut cache, outcome)
|
||||
apply_probe_outcome(&mut cache, &outcome)
|
||||
}
|
||||
|
||||
/// Memoized data-control probe (see the public wrapper for semantics).
|
||||
|
|
@ -1552,46 +1567,83 @@ mod platform {
|
|||
false
|
||||
}
|
||||
|
||||
/// Run the same compositor probe arboard's `Clipboard::new` uses to pick
|
||||
/// its Wayland backend, on a worker thread with a self-imposed deadline
|
||||
/// (the Wayland connection can block on a hung compositor). Callers gate
|
||||
/// on the kill switch and `WAYLAND_DISPLAY` first.
|
||||
#[cfg(target_os = "linux")]
|
||||
fn probe_data_control() -> ProbeOutcome {
|
||||
pub(super) fn probe_wayland_data_control() -> super::WaylandDataControlProbe {
|
||||
if data_control_kill_switch_set() || !env_present("WAYLAND_DISPLAY") {
|
||||
return super::WaylandDataControlProbe::Available(false);
|
||||
}
|
||||
probe_data_control()
|
||||
}
|
||||
|
||||
#[cfg(not(target_os = "linux"))]
|
||||
pub(super) fn probe_wayland_data_control() -> super::WaylandDataControlProbe {
|
||||
super::WaylandDataControlProbe::Available(false)
|
||||
}
|
||||
|
||||
/// Run the same compositor probe arboard's `Clipboard::new` uses to pick
|
||||
/// its Wayland backend, on a bounded worker. Both the legacy cached bool
|
||||
/// adapter and explicit diagnostics consume this typed result.
|
||||
#[cfg(target_os = "linux")]
|
||||
fn probe_data_control() -> super::WaylandDataControlProbe {
|
||||
use std::sync::mpsc::RecvTimeoutError;
|
||||
match spawn_with_deadline(
|
||||
"clipboard-dc-probe",
|
||||
DISPLAY_CONN_WAIT,
|
||||
wl_clipboard_rs::utils::is_primary_selection_supported,
|
||||
) {
|
||||
Ok(result) => data_control_from_probe(result),
|
||||
Err(e) => {
|
||||
tracing::debug!("wayland data-control probe aborted: {e}");
|
||||
ProbeOutcome::Indefinite
|
||||
Ok(result) => data_control_from_result(result),
|
||||
Err(RecvTimeoutError::Timeout) => super::WaylandDataControlProbe::Unavailable,
|
||||
Err(RecvTimeoutError::Disconnected) => {
|
||||
super::WaylandDataControlProbe::Error("probe worker died".to_owned())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Classify one probe answer: any `Ok` means the data-control protocol is
|
||||
/// present (whether the *primary* selection is supported is irrelevant —
|
||||
/// this mirrors arboard's own backend selection); `MissingProtocol` /
|
||||
/// `NoSeats` are the compositor definitively answering "absent". Anything
|
||||
/// else means the compositor didn't answer.
|
||||
#[cfg(target_os = "linux")]
|
||||
fn data_control_from_probe(
|
||||
result: Result<bool, wl_clipboard_rs::utils::PrimarySelectionCheckError>,
|
||||
) -> ProbeOutcome {
|
||||
use wl_clipboard_rs::utils::PrimarySelectionCheckError;
|
||||
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
|
||||
enum DataControlSemanticResult {
|
||||
Present,
|
||||
MissingProtocol,
|
||||
NoSeats,
|
||||
ConnectionUnavailable,
|
||||
}
|
||||
|
||||
#[cfg(target_os = "linux")]
|
||||
fn classify_data_control_semantic(
|
||||
result: DataControlSemanticResult,
|
||||
) -> super::WaylandDataControlProbe {
|
||||
use super::WaylandDataControlProbe;
|
||||
match result {
|
||||
Ok(_) => ProbeOutcome::Definitive(true),
|
||||
Err(PrimarySelectionCheckError::MissingProtocol)
|
||||
| Err(PrimarySelectionCheckError::NoSeats) => ProbeOutcome::Definitive(false),
|
||||
Err(e) => {
|
||||
tracing::debug!("wayland data-control probe inconclusive: {e}");
|
||||
ProbeOutcome::Indefinite
|
||||
DataControlSemanticResult::Present => WaylandDataControlProbe::Available(true),
|
||||
DataControlSemanticResult::MissingProtocol => WaylandDataControlProbe::Available(false),
|
||||
DataControlSemanticResult::NoSeats
|
||||
| DataControlSemanticResult::ConnectionUnavailable => {
|
||||
WaylandDataControlProbe::Unavailable
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Canonical exhaustive mapping from dependency errors to semantic classes.
|
||||
#[cfg(target_os = "linux")]
|
||||
fn data_control_from_result(
|
||||
result: Result<bool, wl_clipboard_rs::utils::PrimarySelectionCheckError>,
|
||||
) -> super::WaylandDataControlProbe {
|
||||
use wl_clipboard_rs::utils::PrimarySelectionCheckError;
|
||||
let semantic = match result {
|
||||
Ok(_) => DataControlSemanticResult::Present,
|
||||
Err(PrimarySelectionCheckError::MissingProtocol) => {
|
||||
DataControlSemanticResult::MissingProtocol
|
||||
}
|
||||
Err(PrimarySelectionCheckError::NoSeats) => DataControlSemanticResult::NoSeats,
|
||||
Err(
|
||||
PrimarySelectionCheckError::SocketOpenError(_)
|
||||
| PrimarySelectionCheckError::WaylandConnection(_)
|
||||
| PrimarySelectionCheckError::WaylandCommunication(_),
|
||||
) => DataControlSemanticResult::ConnectionUnavailable,
|
||||
};
|
||||
classify_data_control_semantic(semantic)
|
||||
}
|
||||
|
||||
#[cfg(target_os = "linux")]
|
||||
fn env_value_present(value: Option<&std::ffi::OsStr>) -> bool {
|
||||
value.is_some_and(|value| !value.is_empty())
|
||||
|
|
@ -2217,6 +2269,7 @@ mod platform {
|
|||
#[cfg(all(test, target_os = "linux"))]
|
||||
mod linux_tests {
|
||||
use super::*;
|
||||
use crate::clipboard::WaylandDataControlProbe;
|
||||
|
||||
#[test]
|
||||
fn primary_read_argv_targets_x11_primary_exactly() {
|
||||
|
|
@ -2526,34 +2579,50 @@ mod platform {
|
|||
assert!(!wayland_readback_required(false, false, false));
|
||||
}
|
||||
|
||||
/// `Ok(_)` means the data-control protocol is present regardless of
|
||||
/// the primary-selection answer; MissingProtocol/NoSeats are the
|
||||
/// compositor definitively answering "absent"; connection-class
|
||||
/// failures are indefinite (fail closed now, retry later).
|
||||
#[test]
|
||||
fn data_control_probe_classification() {
|
||||
fn data_control_semantic_classification_is_exhaustive() {
|
||||
assert_eq!(
|
||||
classify_data_control_semantic(DataControlSemanticResult::Present),
|
||||
WaylandDataControlProbe::Available(true)
|
||||
);
|
||||
assert_eq!(
|
||||
classify_data_control_semantic(DataControlSemanticResult::MissingProtocol),
|
||||
WaylandDataControlProbe::Available(false)
|
||||
);
|
||||
assert_eq!(
|
||||
classify_data_control_semantic(DataControlSemanticResult::NoSeats),
|
||||
WaylandDataControlProbe::Unavailable
|
||||
);
|
||||
assert_eq!(
|
||||
classify_data_control_semantic(DataControlSemanticResult::ConnectionUnavailable),
|
||||
WaylandDataControlProbe::Unavailable
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn dependency_error_mapping_pins_directly_constructible_variants() {
|
||||
use wl_clipboard_rs::utils::PrimarySelectionCheckError;
|
||||
assert_eq!(
|
||||
data_control_from_probe(Ok(true)),
|
||||
ProbeOutcome::Definitive(true)
|
||||
data_control_from_result(Ok(true)),
|
||||
WaylandDataControlProbe::Available(true)
|
||||
);
|
||||
assert_eq!(
|
||||
data_control_from_probe(Ok(false)),
|
||||
ProbeOutcome::Definitive(true)
|
||||
data_control_from_result(Ok(false)),
|
||||
WaylandDataControlProbe::Available(true)
|
||||
);
|
||||
assert_eq!(
|
||||
data_control_from_probe(Err(PrimarySelectionCheckError::MissingProtocol)),
|
||||
ProbeOutcome::Definitive(false)
|
||||
data_control_from_result(Err(PrimarySelectionCheckError::MissingProtocol)),
|
||||
WaylandDataControlProbe::Available(false)
|
||||
);
|
||||
assert_eq!(
|
||||
data_control_from_probe(Err(PrimarySelectionCheckError::NoSeats)),
|
||||
ProbeOutcome::Definitive(false)
|
||||
data_control_from_result(Err(PrimarySelectionCheckError::NoSeats)),
|
||||
WaylandDataControlProbe::Unavailable
|
||||
);
|
||||
assert_eq!(
|
||||
data_control_from_probe(Err(PrimarySelectionCheckError::SocketOpenError(
|
||||
data_control_from_result(Err(PrimarySelectionCheckError::SocketOpenError(
|
||||
std::io::Error::other("boom")
|
||||
))),
|
||||
ProbeOutcome::Indefinite
|
||||
WaylandDataControlProbe::Unavailable
|
||||
);
|
||||
}
|
||||
|
||||
|
|
@ -2564,25 +2633,52 @@ mod platform {
|
|||
fn probe_cache_indefinite_stays_undecided_below_cap() {
|
||||
let mut cache = ProbeCache::new();
|
||||
for seen in 1..PROBE_INDEFINITE_MAX {
|
||||
assert!(!apply_probe_outcome(&mut cache, ProbeOutcome::Indefinite));
|
||||
assert!(!apply_probe_outcome(
|
||||
&mut cache,
|
||||
&WaylandDataControlProbe::Unavailable
|
||||
));
|
||||
assert_eq!(cache.decided, None);
|
||||
assert_eq!(cache.indefinite_seen, seen);
|
||||
}
|
||||
// Cap reached: permanently decided false (mirrors lease degradation).
|
||||
assert!(!apply_probe_outcome(&mut cache, ProbeOutcome::Indefinite));
|
||||
assert!(!apply_probe_outcome(
|
||||
&mut cache,
|
||||
&WaylandDataControlProbe::Unavailable
|
||||
));
|
||||
assert_eq!(cache.decided, Some(false));
|
||||
}
|
||||
|
||||
/// A definitive answer after transient failures decides truth exactly
|
||||
/// once; the earlier indefinite attempts leave no residue in the
|
||||
/// decision.
|
||||
#[test]
|
||||
fn repeated_probe_errors_reach_permanent_false() {
|
||||
let mut cache = ProbeCache::new();
|
||||
for seen in 1..PROBE_INDEFINITE_MAX {
|
||||
assert!(!apply_probe_outcome(
|
||||
&mut cache,
|
||||
&WaylandDataControlProbe::Error("worker died".to_owned())
|
||||
));
|
||||
assert_eq!(cache.decided, None);
|
||||
assert_eq!(cache.indefinite_seen, seen);
|
||||
}
|
||||
assert!(!apply_probe_outcome(
|
||||
&mut cache,
|
||||
&WaylandDataControlProbe::Error("worker died".to_owned())
|
||||
));
|
||||
assert_eq!(cache.decided, Some(false));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn probe_cache_definitive_after_indefinite_decides_truth() {
|
||||
let mut cache = ProbeCache::new();
|
||||
assert!(!apply_probe_outcome(&mut cache, ProbeOutcome::Indefinite));
|
||||
assert!(!apply_probe_outcome(
|
||||
&mut cache,
|
||||
&WaylandDataControlProbe::Unavailable
|
||||
));
|
||||
assert!(apply_probe_outcome(
|
||||
&mut cache,
|
||||
ProbeOutcome::Definitive(true)
|
||||
&WaylandDataControlProbe::Available(true)
|
||||
));
|
||||
assert_eq!(cache.decided, Some(true));
|
||||
assert_eq!(cache.indefinite_seen, 1);
|
||||
|
|
@ -2593,7 +2689,7 @@ mod platform {
|
|||
let mut cache = ProbeCache::new();
|
||||
assert!(!apply_probe_outcome(
|
||||
&mut cache,
|
||||
ProbeOutcome::Definitive(false)
|
||||
&WaylandDataControlProbe::Available(false)
|
||||
));
|
||||
assert_eq!(cache.decided, Some(false));
|
||||
}
|
||||
|
|
@ -2606,11 +2702,11 @@ mod platform {
|
|||
let calls = std::cell::Cell::new(0u32);
|
||||
assert!(cached_probe_answer(&cache, || {
|
||||
calls.set(calls.get() + 1);
|
||||
ProbeOutcome::Definitive(true)
|
||||
WaylandDataControlProbe::Available(true)
|
||||
}));
|
||||
assert!(cached_probe_answer(&cache, || {
|
||||
calls.set(calls.get() + 1);
|
||||
ProbeOutcome::Definitive(false)
|
||||
WaylandDataControlProbe::Available(false)
|
||||
}));
|
||||
assert_eq!(calls.get(), 1);
|
||||
}
|
||||
|
|
@ -2630,7 +2726,7 @@ mod platform {
|
|||
calls.fetch_add(1, Ordering::Relaxed);
|
||||
// Hold the lock long enough that peers must wait.
|
||||
std::thread::sleep(std::time::Duration::from_millis(50));
|
||||
ProbeOutcome::Definitive(true)
|
||||
WaylandDataControlProbe::Available(true)
|
||||
});
|
||||
assert!(answer);
|
||||
});
|
||||
|
|
|
|||
|
|
@ -160,6 +160,9 @@ pub struct UiConfig {
|
|||
/// only appears once a user toggles a tip.
|
||||
#[serde(default, skip_serializing_if = "ContextualHints::is_default")]
|
||||
pub contextual_hints: ContextualHints,
|
||||
/// Combine consecutive queued follow-ups into one turn. `None` = off.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub combine_queued_prompts: Option<bool>,
|
||||
/// Display-refresh probe + auto-cadence (`[ui.display_refresh]`). Per-field
|
||||
/// `None` inherits remote/default; skipped when untouched.
|
||||
#[serde(default, skip_serializing_if = "DisplayRefreshSettings::is_default")]
|
||||
|
|
@ -273,6 +276,7 @@ impl Default for UiConfig {
|
|||
screen_mode: None,
|
||||
double_click_action: None,
|
||||
contextual_hints: ContextualHints::default(),
|
||||
combine_queued_prompts: None,
|
||||
display_refresh: DisplayRefreshSettings::default(),
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue