Synced from monorepo

Synced from monorepo

Changes:
- Workspace server: surface preview-proxy metrics through the hub metric pump
- Shell: reclaim a session’s retained state in one entry
- Shell: reclaim a session’s resident state in one entry
- Pager: withhold key event types from Alacritty builds that double keys
- Tools: cancel a session’s subagents when it closes
- Pager: keep the whole plan in scrollback and separate reasoning from output in minimal mode
- Pager: probe terminal version over DA2 and include it with feedback
- SuperGrok Plus: identity, CLI, and analytics tier surfaces
- Shell: inherit the session process scope into subagents
- Pager: build @-file-search matcher lazily on first use
- Tools: fix description and output contradictions in tool definitions
- Workspace: degrade @-file-search instead of aborting on thread exhaustion
- Tools: reap a session’s LSP servers when it closes
- Tools: fix contradictions and defects in tool descriptions, schemas, and harness pools
- MCP: reap stdio MCP children on session close
- Shell: reuse spawn-time skill discovery for session telemetry
- Tools: stop leaking shell-wrapper positional params into sourced scripts (fixes activate_conda under persistent/static shell)
- Shell: self-heal corrupt session-search SQLite cache
- Workspace: cap workspace-server tokio workers on many-core hosts
- Shell: reap a session’s child processes when it closes
- Crash handler: capture SIGABRT so panic-aborts leave crash reports
- CLI chat proxy: team-scoped Grok Code managed-config admin routes
- MCP: add CLI enable/disable for MCP servers
- Shell: cap tokio worker threads for startup thread demand
- Workspace: harden git_commit and add git_sync_base operation
- Circuit breaker: add feature-gated gRPC retry policy

Source-Revision: 2a818575225183d8ca915f5632a09b8067b5156a

crates/codegen/xai-tty-utils/src/lib.rs

@@ -42,6 +42,8 @@ use std::io;
 mod process_scope;
 pub use process_scope::{ProcessScope, global_process_scope};
 
+pub mod runtime;
+
 // ---------------------------------------------------------------------------
 // TTY detach — pre_exec building block
 // ---------------------------------------------------------------------------

crates/codegen/xai-tty-utils/src/process_scope.rs

@@ -58,6 +58,19 @@ impl ProcessScope {
         }
     }
 
+    /// True once [`kill_all`](Self::kill_all) has run. Enrollment sites use
+    /// this to re-check after work done between a successful [`register`] and
+    /// publishing the child (e.g. installing a client): a `kill_all` in that
+    /// window has already SIGKILLed the enrolled child, so publishing it would
+    /// advertise a dead server. The check is racy by nature (close can land
+    /// right after it) — it narrows the window; the child itself is reaped by
+    /// `kill_all` in every ordering once registered.
+    ///
+    /// [`register`]: Self::register
+    pub fn is_closed(&self) -> bool {
+        self.inner.closed.load(Ordering::Relaxed)
+    }
+
     /// Configure `cmd` so its spawned child becomes the leader of a new process
     /// group / job. Call this **before** `cmd.spawn()`, then [`enroll`] the
     /// resulting child (or build the group yourself and [`register`] it).
@@ -74,13 +87,18 @@ impl ProcessScope {
     /// last `Arc` (clean reap) makes this registration a silent no-op, which is
     /// what keeps [`kill_all`] PID-reuse-safe.
     ///
+    /// Returns `true` if the group was enrolled. Returns `false` if the scope
+    /// was already closed ([`kill_all`] latched): the group is killed on the
+    /// spot, and the caller should treat the child as dead — fail its start
+    /// rather than proceed against a killed process.
+    ///
     /// For spawn sites (e.g. the MCP child handle, the bash terminal) that
     /// already build their own [`ProcessGroup`] and own its lifecycle; sites that
     /// don't can use [`enroll`] instead.
     ///
     /// [`kill_all`]: Self::kill_all
     /// [`enroll`]: Self::enroll
-    pub fn register(&self, group: &Arc<ProcessGroup>) {
+    pub fn register(&self, group: &Arc<ProcessGroup>) -> bool {
         let mut groups = self.lock();
         if self.inner.closed.load(Ordering::Relaxed) {
             // The scope was already reclaimed (`kill_all` ran) and won't run
@@ -90,16 +108,19 @@ impl ProcessScope {
             // non-blocking, so killing under the lock is fine and serializes
             // with a concurrent `kill_all`.
             let _ = group.kill();
-            return;
+            return false;
         }
         groups.retain(|w| w.strong_count() > 0);
         groups.push(Arc::downgrade(group));
+        true
     }
 
     /// Build a process group for an already-spawned `child` (which must have been
     /// configured via [`prepare`]), register a [`Weak`] into this scope, and
-    /// return the owning `Arc` for the caller to hold. Errors only if the child
-    /// already exited (nothing to attach) — not a leak.
+    /// return the owning `Arc` for the caller to hold. Errors if the child
+    /// already exited (nothing to attach) — not a leak — or if the scope was
+    /// already closed, in which case the child has been killed and the caller
+    /// must not proceed with it.
     ///
     /// [`prepare`]: Self::prepare
     #[must_use = "the returned Arc<ProcessGroup> must be kept alive or the scope cannot reap the child"]
@@ -107,7 +128,11 @@ impl ProcessScope {
         let mut group = ProcessGroup::new()?;
         group.attach(child)?;
         let group = Arc::new(group);
-        self.register(&group);
+        if !self.register(&group) {
+            return Err(io::Error::other(
+                "process scope already closed; child killed",
+            ));
+        }
         Ok(group)
     }
 
@@ -283,7 +308,8 @@ mod tests {
     }
 
     /// Close/spawn race: a child enrolled *after* `kill_all` must be killed on
-    /// the spot, not leaked — `kill_all` won't run again to catch it.
+    /// the spot, not leaked — `kill_all` won't run again to catch it — and the
+    /// caller must be told (enroll errors) so it doesn't proceed with a dead child.
     #[tokio::test]
     async fn register_after_kill_all_reaps_immediately() {
         let scope = ProcessScope::new();
@@ -293,7 +319,10 @@ mod tests {
         scope.prepare(&mut cmd);
         #[allow(clippy::disallowed_methods)] // test: exercises enroll() after close
         let mut child = cmd.spawn().unwrap();
-        let _group = scope.enroll(&child).unwrap(); // register() runs post-close
+        assert!(
+            scope.enroll(&child).is_err(),
+            "post-close enroll must surface the closed scope"
+        );
         assert_eq!(
             scope.live_count(),
             0,

crates/codegen/xai-tty-utils/src/runtime.rs

@@ -0,0 +1,55 @@
+//! Worker-thread policy for multi-thread tokio runtimes.
+//!
+//! Tokio defaults to one worker per core. On many-core shared hosts (100+-core
+//! HPC login nodes) that pins 100+ thread slots per grok process against
+//! per-user ceilings — systemd user-slice `pids.max` (commonly 1000) or
+//! `RLIMIT_NPROC` — and later thread spawns die with EAGAIN. Grok's runtimes
+//! are I/O-bound, so throughput does not scale with workers past a small
+//! count.
+//!
+//! This is the single home for the cap policy; every multi-thread runtime in
+//! the workspace (the `grok` binary, the `workspace_server` daemon) derives
+//! its worker count from here so the policy cannot drift across crates.
+
+use std::num::NonZeroUsize;
+
+/// Maximum runtime worker threads for any grok process.
+pub const MAX_WORKER_THREADS: NonZeroUsize = NonZeroUsize::new(8).unwrap();
+
+/// Pure, testable: `min(cores, MAX_WORKER_THREADS)`.
+pub fn cap_worker_threads(cores: NonZeroUsize) -> NonZeroUsize {
+    cores.min(MAX_WORKER_THREADS)
+}
+
+/// Reads the host: `min(available_parallelism, MAX_WORKER_THREADS)`.
+pub fn capped_worker_threads() -> NonZeroUsize {
+    cap_worker_threads(std::thread::available_parallelism().unwrap_or(NonZeroUsize::MIN))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn nz(n: usize) -> NonZeroUsize {
+        NonZeroUsize::new(n).unwrap()
+    }
+
+    #[test]
+    fn cap_is_identity_at_or_below_max() {
+        assert_eq!(cap_worker_threads(nz(1)), nz(1));
+        assert_eq!(cap_worker_threads(nz(4)), nz(4));
+        assert_eq!(cap_worker_threads(nz(8)), nz(8));
+    }
+
+    #[test]
+    fn cap_clamps_many_core_hosts() {
+        assert_eq!(cap_worker_threads(nz(9)), nz(8));
+        assert_eq!(cap_worker_threads(nz(360)), nz(8));
+    }
+
+    #[test]
+    fn capped_worker_threads_stays_in_bounds() {
+        let n = capped_worker_threads();
+        assert!(n <= MAX_WORKER_THREADS, "got {n}");
+    }
+}