Synced from monorepo

Synced from monorepo

Changes:
- Release a shell session's resources in one drop
- Make the tools blocking-wait cap client-configurable and self-describing
- Recognize API "exceeds budget" errors as context overflow
- Retry /btw on model overload
- Carry running background tasks and subagents across compaction
- Require round-trip time for SDK liveness checks
- Background-subagent completion reminders with a selectable delivery surface
- Make a PTY shell reap itself until it reaches the registry
- Recover the OS error code from a TLS-phase connection reset
- Consume the attached-client signal and report why idle is withheld
- Treat `.grok/sandbox.toml` edits as protected so auto mode prompts before writing
- Surface history/search in the Ctrl+. cheatsheet and keep it working in history view
- Delete sessions from the dashboard and welcome list
- Release a session's activity record when the session ends
- Stop charging auth-retry budget for fail-closed 401s; reset it across suspends
- Scope skills watches on project vendor roots
- Make [stop] cancel in-flight compaction
- Make the leader soak measure the leader, not its harness

Source-Revision: 8d69c91f02bcacf01e98d5aebbf2f92547c45738

crates/codegen/xai-grok-tools/build.rs

@@ -10,15 +10,185 @@ use std::path::PathBuf;
 const RG_VER: &str = "15.0.0";
 const BFS_VER: &str = "4.1";
 const UGREP_VER: &str = "7.7.0";
+const FD_VER: &str = "10.4.2";
+// fd stopped publishing x86_64-apple-darwin assets after 10.3.0.
+const FD_VER_MACOS_X64: &str = "10.3.0";
+
+/// Pinned SHA-256 of each `(version, triple)` fd release tarball we embed.
+const FD_TARBALL_SHA256: &[(&str, &str, &str)] = &[
+    (
+        "10.4.2",
+        "x86_64-unknown-linux-musl",
+        "e3257d48e29a6be965187dbd24ce9af564e0fe67b3e73c9bdcd180f4ec11bdde",
+    ),
+    (
+        "10.4.2",
+        "aarch64-unknown-linux-musl",
+        "f32d3657473fba74e2600babc8db0b93420d51169223b7e8143b2ed55d8fd9e8",
+    ),
+    (
+        "10.4.2",
+        "aarch64-apple-darwin",
+        "623dc0afc81b92e4d4606b380d7bc91916ba7b97814263e554d50923a39e480a",
+    ),
+    (
+        "10.3.0",
+        "x86_64-apple-darwin",
+        "50d30f13fe3d5914b14c4fff5abcbd4d0cdab4b855970a6956f4f006c17117a3",
+    ),
+];
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     bundle_rg()?;
+    // fd is an optional vendored file-search binary backing a feature-gated
+    // toolset; skip the download/embed entirely when that feature is off
+    // (shipped TUI binaries).
+    if env::var_os("CARGO_FEATURE_PI").is_some() {
+        bundle_fd()?;
+    }
     // bfs/ugrep back the bash-harness find/grep shadows (embedded_search_tools).
     bundle_search_tool("bfs", "BFS", BFS_VER)?;
     bundle_search_tool("ugrep", "UGREP", UGREP_VER)?;
     Ok(())
 }
 
+/// Download + embed fd as an optional vendored file-search binary, mirroring
+/// the ripgrep bundling
+/// (release-only or `GROK_TOOLS_BUNDLE_FD_PATH` override), plus pinned
+/// per-asset SHA-256 verification of the downloaded tarball.
+fn bundle_fd() -> Result<(), Box<dyn std::error::Error>> {
+    println!("cargo:rerun-if-env-changed=GROK_TOOLS_BUNDLE_FD_PATH");
+    println!("cargo:rustc-check-cfg=cfg(bundle_fd)");
+
+    let gen_dir = PathBuf::from(env::var("OUT_DIR")?).join("bundle-fd");
+    fs::create_dir_all(&gen_dir)?;
+
+    // The consuming vendor extraction is unix-only — never bundle on
+    // Windows targets, mirroring the bfs/ugrep skip.
+    let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
+    if target_os == "windows" {
+        return Ok(());
+    }
+
+    let path_override = env::var("GROK_TOOLS_BUNDLE_FD_PATH").ok();
+    let is_release = env::var("PROFILE").as_deref() == Ok("release");
+    if path_override.is_none() && !is_release {
+        return Ok(());
+    }
+
+    // Per-target version: macOS x86_64 pins the last release with that asset.
+    let target_arch = env::var("CARGO_CFG_TARGET_ARCH").unwrap_or_default();
+    let (ver, asset_triple) = match (target_os.as_str(), target_arch.as_str()) {
+        ("macos", "aarch64") => (FD_VER, "aarch64-apple-darwin"),
+        ("macos", "x86_64") => (FD_VER_MACOS_X64, "x86_64-apple-darwin"),
+        ("linux", "x86_64") => (FD_VER, "x86_64-unknown-linux-musl"),
+        ("linux", "aarch64") => (FD_VER, "aarch64-unknown-linux-musl"),
+        _ => {
+            if path_override.is_none() {
+                return Err(format!(
+                    "Unsupported target for fd bundling: {target_os}-{target_arch}. Set GROK_TOOLS_BUNDLE_FD_PATH to a local fd binary for offline or unsupported builds.",
+                )
+                .into());
+            }
+            (FD_VER, "override")
+        }
+    };
+
+    println!("cargo:rustc-cfg=bundle_fd");
+    println!("cargo:rustc-env=GROK_TOOLS_FD_VER={ver}");
+
+    if let Some(path) = path_override {
+        let dest = gen_dir.join(format!("fd-{ver}-override.bin"));
+        println!("cargo:rustc-env=GROK_TOOLS_FD_TARGET=override");
+        let _ = fs::remove_file(&dest);
+        fs::copy(PathBuf::from(path.clone()), &dest).map_err(|e| {
+            format!(
+                "Failed copying GROK_TOOLS_BUNDLE_FD_PATH: {e} from path {path} to dest {}",
+                dest.display()
+            )
+        })?;
+        return Ok(());
+    }
+
+    println!("cargo:rustc-env=GROK_TOOLS_FD_TARGET={asset_triple}");
+    let dest = gen_dir.join(format!("fd-{ver}-{asset_triple}.bin"));
+    let _ = fs::remove_file(&dest);
+
+    let url = format!(
+        "https://github.com/sharkdp/fd/releases/download/v{ver}/fd-v{ver}-{asset_triple}.tar.gz"
+    );
+
+    let bytes: Vec<u8> = {
+        let resp = reqwest::blocking::get(&url).map_err(|e| {
+            format!(
+                "Failed to download fd: {e}\nSet GROK_TOOLS_BUNDLE_FD_PATH to a local fd for offline builds."
+            )
+        })?;
+        if !resp.status().is_success() {
+            return Err(format!(
+                "HTTP {} downloading fd. Set GROK_TOOLS_BUNDLE_FD_PATH for offline builds.",
+                resp.status()
+            )
+            .into());
+        }
+        resp.bytes()?.to_vec()
+    };
+
+    // Verify the tarball against the pinned per-asset hash before unpacking.
+    let expected_sha = FD_TARBALL_SHA256
+        .iter()
+        .find(|(v, t, _)| *v == ver && *t == asset_triple)
+        .map(|(_, _, sha)| *sha)
+        .ok_or_else(|| format!("No pinned SHA-256 for fd {ver} {asset_triple}"))?;
+    let actual_sha = {
+        use sha2::Digest as _;
+        let mut hasher = sha2::Sha256::new();
+        hasher.update(&bytes);
+        hex_encode(&hasher.finalize())
+    };
+    if actual_sha != expected_sha {
+        return Err(format!(
+            "SHA-256 mismatch for {url}:\n  expected {expected_sha}\n  actual   {actual_sha}"
+        )
+        .into());
+    }
+
+    let gz = flate2::read::GzDecoder::new(&bytes[..]);
+    let mut ar = tar::Archive::new(gz);
+    let mut found = false;
+    for entry in ar.entries()? {
+        let mut e = entry?;
+        let p = e.path()?;
+        if p.file_name().is_some_and(|n| n == "fd") {
+            let data: Vec<u8> = {
+                let mut v = Vec::new();
+                io::copy(&mut e, &mut v)?;
+                v
+            };
+            fs::write(&dest, &data)?;
+            found = true;
+            break;
+        }
+    }
+
+    if !found {
+        return Err(format!(
+            "Could not find 'fd' in fd archive {url}. Set GROK_TOOLS_BUNDLE_FD_PATH for offline builds."
+        )
+        .into());
+    }
+
+    Ok(())
+}
+
+fn hex_encode(bytes: &[u8]) -> String {
+    let mut out = String::with_capacity(bytes.len() * 2);
+    for byte in bytes {
+        out.push_str(&format!("{byte:02x}"));
+    }
+    out
+}
+
 /// Bundle a prebuilt **static** search-tool binary (`bfs`/`ugrep`) when
 /// `GROK_TOOLS_BUNDLE_<NAME>_PATH` points at one (supplied by the release
 /// pipeline). Emits