Synced from monorepo

Synced from monorepo

Changes:
- Workspace server: surface preview-proxy metrics through the hub metric pump
- Shell: reclaim a session’s retained state in one entry
- Shell: reclaim a session’s resident state in one entry
- Pager: withhold key event types from Alacritty builds that double keys
- Tools: cancel a session’s subagents when it closes
- Pager: keep the whole plan in scrollback and separate reasoning from output in minimal mode
- Pager: probe terminal version over DA2 and include it with feedback
- SuperGrok Plus: identity, CLI, and analytics tier surfaces
- Shell: inherit the session process scope into subagents
- Pager: build @-file-search matcher lazily on first use
- Tools: fix description and output contradictions in tool definitions
- Workspace: degrade @-file-search instead of aborting on thread exhaustion
- Tools: reap a session’s LSP servers when it closes
- Tools: fix contradictions and defects in tool descriptions, schemas, and harness pools
- MCP: reap stdio MCP children on session close
- Shell: reuse spawn-time skill discovery for session telemetry
- Tools: stop leaking shell-wrapper positional params into sourced scripts (fixes activate_conda under persistent/static shell)
- Shell: self-heal corrupt session-search SQLite cache
- Workspace: cap workspace-server tokio workers on many-core hosts
- Shell: reap a session’s child processes when it closes
- Crash handler: capture SIGABRT so panic-aborts leave crash reports
- CLI chat proxy: team-scoped Grok Code managed-config admin routes
- MCP: add CLI enable/disable for MCP servers
- Shell: cap tokio worker threads for startup thread demand
- Workspace: harden git_commit and add git_sync_base operation
- Circuit breaker: add feature-gated gRPC retry policy

Source-Revision: 2a818575225183d8ca915f5632a09b8067b5156a

crates/codegen/xai-crash-handler/src/handler.rs

@@ -1,7 +1,12 @@
-//! Cross-platform crash handler for fatal memory faults.
+//! Cross-platform crash handler for fatal memory faults and aborts.
 //!
-//! - **Unix**: SIGBUS/SIGSEGV via `sigaction(2)`.
+//! - **Unix**: SIGBUS/SIGSEGV/SIGABRT via `sigaction(2)`. SIGABRT matters
+//!   because release builds ship with `panic = "abort"`, so every Rust panic
+//!   terminates via `abort(3)` — without a SIGABRT handler those deaths leave
+//!   no crash report.
 //! - **Windows**: `EXCEPTION_ACCESS_VIOLATION` et al. via `SetUnhandledExceptionFilter`.
+//!   `abort()` does not go through the unhandled-exception filter, so SIGABRT
+//!   capture is Unix-only.
 //!
 //! Captures crash PC + frame-pointer chain. All handler operations are
 //! minimal (raw pointer reads, direct file I/O, atomics — no allocation).
@@ -275,11 +280,16 @@ mod imp {
         }
     }
 
-    /// Register a signal handler for SIGBUS and SIGSEGV.
+    /// Register a signal handler for SIGBUS, SIGSEGV, and SIGABRT.
+    ///
+    /// SIGABRT is hooked so `panic = "abort"` deaths (every Rust panic in
+    /// release builds) produce a crash report instead of a bare `Aborted`.
     ///
     /// Flags: `SA_SIGINFO | SA_ONSTACK | SA_RESETHAND`. `SA_RESETHAND`
     /// resets disposition to `SIG_DFL` after delivery, preventing recursive
-    /// faults in the handler from looping.
+    /// faults in the handler from looping. The handlers additionally restore
+    /// `SIG_DFL` and re-raise explicitly, so the process still terminates
+    /// with the original signal's semantics (exit status, core dumps).
     ///
     /// # Safety
     ///
@@ -295,6 +305,7 @@ mod imp {
 
             libc::sigaction(libc::SIGBUS, &sa, std::ptr::null_mut());
             libc::sigaction(libc::SIGSEGV, &sa, std::ptr::null_mut());
+            libc::sigaction(libc::SIGABRT, &sa, std::ptr::null_mut());
         }
     }
 
@@ -424,7 +435,8 @@ mod imp {
         }
     }
 
-    /// Install a minimal SIGSEGV/SIGBUS handler that restores termios on crash.
+    /// Install a minimal SIGSEGV/SIGBUS/SIGABRT handler that restores termios
+    /// on crash.
     ///
     /// Does NOT write terminal escape codes — call
     /// [`enable_terminal_escape_restore`] after TUI modes are enabled.
@@ -486,8 +498,8 @@ mod imp {
         true
     }
 
-    /// Upgrade SIGSEGV/SIGBUS handlers to include terminal escape code
-    /// restoration. Call when TUI modes are enabled.
+    /// Upgrade SIGSEGV/SIGBUS/SIGABRT handlers to include terminal escape
+    /// code restoration. Call when TUI modes are enabled.
     pub fn enable_terminal_escape_restore() {
         unsafe {
             register_crash_signals(if CRASH_FD.load(Ordering::Relaxed) >= 0 {
@@ -498,7 +510,7 @@ mod imp {
         }
     }
 
-    /// Downgrade SIGSEGV/SIGBUS handlers to termios-only restoration.
+    /// Downgrade SIGSEGV/SIGBUS/SIGABRT handlers to termios-only restoration.
     /// Call when TUI modes are disabled.
     pub fn disable_terminal_escape_restore() {
         unsafe {
@@ -856,7 +868,7 @@ pub fn disable_terminal_escape_restore() {}
 mod tests {
     use std::sync::Mutex;
 
-    // SIGSEGV/SIGBUS handlers are process-global. Tests in this binary run on
+    // SIGSEGV/SIGBUS/SIGABRT handlers are process-global. Tests in this binary run on
     // parallel threads, so any two tests that install/read these handlers race.
     // Serialize them through this lock (poison-tolerant: a real assertion
     // failure in one test must not cascade into the other).
@@ -899,6 +911,18 @@ mod tests {
                 0,
                 "SIGBUS handler must use alternate signal stack"
             );
+
+            assert_eq!(libc::sigaction(libc::SIGABRT, std::ptr::null(), &mut sa), 0);
+            assert_ne!(
+                sa.sa_sigaction,
+                libc::SIG_DFL,
+                "SIGABRT handler should not be SIG_DFL after install"
+            );
+            assert_ne!(
+                sa.sa_flags & libc::SA_ONSTACK,
+                0,
+                "SIGABRT handler must use alternate signal stack"
+            );
         }
     }
 

crates/codegen/xai-crash-handler/src/lib.rs

@@ -1,7 +1,11 @@
 //! Cross-platform crash handler with startup crash detection.
 //!
-//! - **Unix**: SIGBUS/SIGSEGV via `sigaction(2)`.
+//! - **Unix**: SIGBUS/SIGSEGV/SIGABRT via `sigaction(2)`. SIGABRT capture
+//!   means `panic = "abort"` builds (every shipped release) leave a crash
+//!   report when a Rust panic aborts the process.
 //! - **Windows**: access violations via `SetUnhandledExceptionFilter`.
+//!   SIGABRT capture is Unix-only — `abort()` on Windows does not route
+//!   through the unhandled-exception filter.
 //!
 //! # Usage
 //!
@@ -66,7 +70,8 @@ pub struct CrashReport {
     pub report_path: PathBuf,
 }
 
-/// Install the crash handler for SIGBUS and SIGSEGV.
+/// Install the crash handler for SIGBUS, SIGSEGV, and SIGABRT (Unix; on
+/// Windows only access violations are captured).
 ///
 /// Must be called early in `main()`, before any async runtime or thread
 /// spawning. Creates `crash_dir` if it does not exist.
@@ -77,7 +82,8 @@ pub fn install(config: CrashHandlerConfig) -> bool {
     handler::install(&config.crash_dir, &config.app_version)
 }
 
-/// Install a minimal SIGSEGV/SIGBUS handler that only restores the terminal.
+/// Install a minimal SIGSEGV/SIGBUS/SIGABRT handler that only restores the
+/// terminal.
 ///
 /// On Unix, saves the current termios state, allocates an alternate signal
 /// stack, and registers a handler that writes terminal restore escape
@@ -96,13 +102,13 @@ pub fn install_terminal_restore_only() {
     handler::install_terminal_restore_only()
 }
 
-/// Upgrade SIGSEGV/SIGBUS handlers to include terminal escape code
+/// Upgrade SIGSEGV/SIGBUS/SIGABRT handlers to include terminal escape code
 /// restoration. Call when TUI modes are enabled.
 pub fn enable_terminal_escape_restore() {
     handler::enable_terminal_escape_restore()
 }
 
-/// Downgrade SIGSEGV/SIGBUS handlers to termios-only restoration.
+/// Downgrade SIGSEGV/SIGBUS/SIGABRT handlers to termios-only restoration.
 /// Call when TUI modes are disabled.
 pub fn disable_terminal_escape_restore() {
     handler::disable_terminal_escape_restore()

crates/codegen/xai-crash-handler/src/symbolicate.rs

@@ -81,6 +81,9 @@ pub fn format_report(blob: &CrashBlob, frames: &[ResolvedFrame]) -> String {
 pub fn signal_name(sig: u8) -> &'static str {
     match sig as i32 {
         4 => "SIGILL (Illegal instruction)",
+        // SIGABRT is 6 on both macOS and Linux.
+        // With panic = "abort", every Rust panic terminates via SIGABRT.
+        6 => "SIGABRT (Abort)",
         // SIGBUS is 10 on macOS, 7 on Linux
         7 | 10 => "SIGBUS (Bus error)",
         11 => "SIGSEGV (Segmentation fault)",
@@ -89,6 +92,11 @@ pub fn signal_name(sig: u8) -> &'static str {
 }
 
 fn si_code_name(sig: u8, code: i32) -> &'static str {
+    // SIGABRT carries no fault-specific si_code (abort(3) raises it directly;
+    // the kernel reports SI_USER/SI_TKILL-style origins instead).
+    if sig == 6 {
+        return "abort() - raised by the process (e.g. Rust panic with panic=abort)";
+    }
     let is_bus = sig == 7 || sig == 10;
     if is_bus {
         match code {
@@ -112,6 +120,7 @@ mod tests {
 
     #[test]
     fn signal_names() {
+        assert_eq!(signal_name(6), "SIGABRT (Abort)");
         assert_eq!(signal_name(10), "SIGBUS (Bus error)");
         assert_eq!(signal_name(7), "SIGBUS (Bus error)");
         assert_eq!(signal_name(11), "SIGSEGV (Segmentation fault)");

crates/codegen/xai-crash-handler/tests/integration.rs

@@ -110,6 +110,12 @@ fn subprocess_entry() {
             unsafe { libc::raise(libc::SIGSEGV) };
         }
 
+        // Scenario 6: install handler, abort. This is the path every Rust
+        // panic takes in release builds (panic = "abort" → SIGABRT).
+        "sigabrt" => {
+            std::process::abort();
+        }
+
         // Scenario 5: tokio runtime + signal coexistence, then clean shutdown.
         "tokio_signals" => {
             let rt = tokio::runtime::Builder::new_multi_thread()
@@ -269,6 +275,53 @@ fn sigsegv_produces_valid_crash_blob() {
     assert_eq!(blob.app_version, "0.0.0-test");
 }
 
+#[test]
+fn sigabrt_produces_valid_crash_blob() {
+    let tmp = tempfile::tempdir().expect("tempdir");
+    let (status, _stdout, _stderr) = run_scenario("sigabrt", tmp.path());
+
+    // The handler must re-raise with default disposition so the process
+    // still dies with SIGABRT semantics. The frame-pointer walker may hit
+    // unmapped memory and cause a secondary SIGSEGV (as in the SIGBUS test).
+    #[cfg(unix)]
+    {
+        use std::os::unix::process::ExitStatusExt;
+        let sig = status.signal();
+        assert!(
+            sig == Some(libc::SIGABRT) || sig == Some(libc::SIGSEGV),
+            "process should be killed by SIGABRT (or a secondary SIGSEGV), got signal={sig:?} status={status:?}"
+        );
+    }
+
+    let crash_file = tmp.path().join("last-crash.bin");
+    assert!(crash_file.exists(), "crash file should exist after abort()");
+    let data = std::fs::read(&crash_file).expect("read crash file");
+    let blob = xai_crash_handler::format::CrashBlob::parse(&data).expect("crash blob should parse");
+    assert_eq!(
+        blob.signal, 6,
+        "signal should be SIGABRT (6), got {}",
+        blob.signal
+    );
+    assert_eq!(blob.app_version, "0.0.0-test");
+    assert!(blob.pid > 0, "PID should be nonzero");
+    assert!(blob.timestamp > 0, "timestamp should be nonzero");
+
+    // check_previous_crash should produce a SIGABRT-labelled report.
+    let report =
+        xai_crash_handler::check_previous_crash(tmp.path()).expect("should produce a crash report");
+    assert!(
+        report.signal_name.contains("SIGABRT"),
+        "report should name SIGABRT, got {}",
+        report.signal_name
+    );
+    assert_eq!(report.app_version, "0.0.0-test");
+    assert!(report.report_path.exists(), "report file should be written");
+    assert!(
+        !crash_file.exists(),
+        "crash file should be deleted after processing"
+    );
+}
+
 #[test]
 fn clean_exit_does_not_produce_crash_report() {
     let tmp = tempfile::tempdir().expect("tempdir");