fix(term): serialize macOS PTY creation by Tryanks · Pull Request #148 · Tryanks/tcode

Tryanks · 2026-07-24T08:00:17Z

Summary

serialize tty::new calls behind one process-wide mutex on macOS
keep non-macOS creation lock-free and release the guard immediately after PTY creation
add a deterministic 16-thread regression test that proves the creation critical section cannot overlap

Closes#101.

Root cause

Concurrent macOS openpty(3) calls can intermittently fail with an invalid negative errno (-6). That matches the issue's load-dependent behavior and low PTY usage, and an independent C stress reproduction reported failures only under high concurrency and none after serialization (jppittman/pixelflow#894).

The fix serializes the complete upstream tty::new call because tcode cannot lock only the internal openpty invocation. The mutex protects no Rust data invariant, so a poisoned guard is recovered while preserving mutual exclusion. There is no retry or error suppression.

Validation

pre-fix regression test: failed as expected with 16 simultaneous critical-section entries
post-fix regression test: passed with a maximum of 1
cargo fmt --all --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test --workspace --locked
20 consecutive cargo test -p term --locked runs: 20/20 passed, with no Os error -6 or Unknown error: -6

Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com>

* fix(runtime): load session timelines off the GPUI main thread (#114) Switching to, reopening, or background-loading a session used to read and fold its entire JSONL history synchronously on the GPUI thread, hitching the UI for the full disk read of long sessions. - Install the session immediately (parked sessions keep their in-memory snapshot; cold opens start empty) and swap in the folded timeline from a background read, guarded by a per-session load generation. - Retry the read (bounded) when the JSONL append watermark moved mid-read, so events appended while parked can never be lost to a racy fold. - Answer orchestrate status/result from in-memory timelines when the child is loaded, and batch the remaining disk reads into one background task that replies through the broker channel. - Move the idle-child reaper, child-callback fold, and the remaining synchronous .git/HEAD branch probes off the main thread. Co-Authored-By: Claude <noreply@anthropic.com> * perf(runtime): move SessionStore writes to a single background writer Every store write ran synchronously on the GPUI thread: one JSONL append per agent event during streaming, full sessions-index read/parse/rewrite per persist_meta, transcript copies on fork, and terminal-ui.json rewrites throughout resize drags. - A FIFO async_channel drained by one background writer task now owns all store mutations; index ops keep their read-modify-write merge semantics inside the writer. - Main-thread in-memory state stays authoritative and updates synchronously; the writer is durability-only. - Fork waits for the transcript clone to land before opening the fork. - Write failures travel back over a report channel and surface through the same RuntimeError notices as before. - The app-quit hook enqueues a barrier and waits for every earlier write to complete before exiting. Co-Authored-By: Claude <noreply@anthropic.com> * perf(ui,runtime): offload remaining one-shot blocking I/O from the GPUI thread - Preview port scan (up to ~720ms of sequential connect timeouts per click) - git worktree removal on session delete (seconds) - Image paste/drop: metadata size check before reading, unbounded read + transcode + attachment write in one background task, generation-guarded completion that reserves strip slots across in-flight jobs - Orchestrate dispatch cwd canonicalize/is_dir (network-FS stall) - ACP registry cache read, provider install-source canonicalize - AI-title scratch dir create/remove (ran on the main thread inside a gpui local task) - Plan save-to-workspace/download writes - Add-project typed-path is_dir, third-party profile home creation The Codex auth.json probe stays synchronous by design: it is one small local file, and async-fs pools are unsafe inside gpui local tasks (see crates/runtime/src/blocking.rs). Co-Authored-By: Claude <noreply@anthropic.com> * perf(term): spawn PTYs off the GPUI thread; offload secrets file I/O Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>

Tryanks · 2026-07-24T08:00:17Z

Summary

serialize tty::new calls behind one process-wide mutex on macOS
keep non-macOS creation lock-free and release the guard immediately after PTY creation
add a deterministic 16-thread regression test that proves the creation critical section cannot overlap

Closes#101.

Root cause

Concurrent macOS openpty(3) calls can intermittently fail with an invalid negative errno (-6). That matches the issue's load-dependent behavior and low PTY usage, and an independent C stress reproduction reported failures only under high concurrency and none after serialization (jppittman/pixelflow#894).

The fix serializes the complete upstream tty::new call because tcode cannot lock only the internal openpty invocation. The mutex protects no Rust data invariant, so a poisoned guard is recovered while preserving mutual exclusion. There is no retry or error suppression.

Validation

pre-fix regression test: failed as expected with 16 simultaneous critical-section entries
post-fix regression test: passed with a maximum of 1
cargo fmt --all --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test --workspace --locked
20 consecutive cargo test -p term --locked runs: 20/20 passed, with no Os error -6 or Unknown error: -6

Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com>

* fix(runtime): load session timelines off the GPUI main thread (#114) Switching to, reopening, or background-loading a session used to read and fold its entire JSONL history synchronously on the GPUI thread, hitching the UI for the full disk read of long sessions. - Install the session immediately (parked sessions keep their in-memory snapshot; cold opens start empty) and swap in the folded timeline from a background read, guarded by a per-session load generation. - Retry the read (bounded) when the JSONL append watermark moved mid-read, so events appended while parked can never be lost to a racy fold. - Answer orchestrate status/result from in-memory timelines when the child is loaded, and batch the remaining disk reads into one background task that replies through the broker channel. - Move the idle-child reaper, child-callback fold, and the remaining synchronous .git/HEAD branch probes off the main thread. Co-Authored-By: Claude <noreply@anthropic.com> * perf(runtime): move SessionStore writes to a single background writer Every store write ran synchronously on the GPUI thread: one JSONL append per agent event during streaming, full sessions-index read/parse/rewrite per persist_meta, transcript copies on fork, and terminal-ui.json rewrites throughout resize drags. - A FIFO async_channel drained by one background writer task now owns all store mutations; index ops keep their read-modify-write merge semantics inside the writer. - Main-thread in-memory state stays authoritative and updates synchronously; the writer is durability-only. - Fork waits for the transcript clone to land before opening the fork. - Write failures travel back over a report channel and surface through the same RuntimeError notices as before. - The app-quit hook enqueues a barrier and waits for every earlier write to complete before exiting. Co-Authored-By: Claude <noreply@anthropic.com> * perf(ui,runtime): offload remaining one-shot blocking I/O from the GPUI thread - Preview port scan (up to ~720ms of sequential connect timeouts per click) - git worktree removal on session delete (seconds) - Image paste/drop: metadata size check before reading, unbounded read + transcode + attachment write in one background task, generation-guarded completion that reserves strip slots across in-flight jobs - Orchestrate dispatch cwd canonicalize/is_dir (network-FS stall) - ACP registry cache read, provider install-source canonicalize - AI-title scratch dir create/remove (ran on the main thread inside a gpui local task) - Plan save-to-workspace/download writes - Add-project typed-path is_dir, third-party profile home creation The Codex auth.json probe stays synchronous by design: it is one small local file, and async-fs pools are unsafe inside gpui local tasks (see crates/runtime/src/blocking.rs). Co-Authored-By: Claude <noreply@anthropic.com> * perf(term): spawn PTYs off the GPUI thread; offload secrets file I/O Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>

Tryanks · 2026-07-24T08:00:17Z

Summary

serialize tty::new calls behind one process-wide mutex on macOS
keep non-macOS creation lock-free and release the guard immediately after PTY creation
add a deterministic 16-thread regression test that proves the creation critical section cannot overlap

Closes#101.

Root cause

Concurrent macOS openpty(3) calls can intermittently fail with an invalid negative errno (-6). That matches the issue's load-dependent behavior and low PTY usage, and an independent C stress reproduction reported failures only under high concurrency and none after serialization (jppittman/pixelflow#894).

The fix serializes the complete upstream tty::new call because tcode cannot lock only the internal openpty invocation. The mutex protects no Rust data invariant, so a poisoned guard is recovered while preserving mutual exclusion. There is no retry or error suppression.

Validation

pre-fix regression test: failed as expected with 16 simultaneous critical-section entries
post-fix regression test: passed with a maximum of 1
cargo fmt --all --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test --workspace --locked
20 consecutive cargo test -p term --locked runs: 20/20 passed, with no Os error -6 or Unknown error: -6

Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com>

* fix(runtime): load session timelines off the GPUI main thread (#114) Switching to, reopening, or background-loading a session used to read and fold its entire JSONL history synchronously on the GPUI thread, hitching the UI for the full disk read of long sessions. - Install the session immediately (parked sessions keep their in-memory snapshot; cold opens start empty) and swap in the folded timeline from a background read, guarded by a per-session load generation. - Retry the read (bounded) when the JSONL append watermark moved mid-read, so events appended while parked can never be lost to a racy fold. - Answer orchestrate status/result from in-memory timelines when the child is loaded, and batch the remaining disk reads into one background task that replies through the broker channel. - Move the idle-child reaper, child-callback fold, and the remaining synchronous .git/HEAD branch probes off the main thread. Co-Authored-By: Claude <noreply@anthropic.com> * perf(runtime): move SessionStore writes to a single background writer Every store write ran synchronously on the GPUI thread: one JSONL append per agent event during streaming, full sessions-index read/parse/rewrite per persist_meta, transcript copies on fork, and terminal-ui.json rewrites throughout resize drags. - A FIFO async_channel drained by one background writer task now owns all store mutations; index ops keep their read-modify-write merge semantics inside the writer. - Main-thread in-memory state stays authoritative and updates synchronously; the writer is durability-only. - Fork waits for the transcript clone to land before opening the fork. - Write failures travel back over a report channel and surface through the same RuntimeError notices as before. - The app-quit hook enqueues a barrier and waits for every earlier write to complete before exiting. Co-Authored-By: Claude <noreply@anthropic.com> * perf(ui,runtime): offload remaining one-shot blocking I/O from the GPUI thread - Preview port scan (up to ~720ms of sequential connect timeouts per click) - git worktree removal on session delete (seconds) - Image paste/drop: metadata size check before reading, unbounded read + transcode + attachment write in one background task, generation-guarded completion that reserves strip slots across in-flight jobs - Orchestrate dispatch cwd canonicalize/is_dir (network-FS stall) - ACP registry cache read, provider install-source canonicalize - AI-title scratch dir create/remove (ran on the main thread inside a gpui local task) - Plan save-to-workspace/download writes - Add-project typed-path is_dir, third-party profile home creation The Codex auth.json probe stays synchronous by design: it is one small local file, and async-fs pools are unsafe inside gpui local tasks (see crates/runtime/src/blocking.rs). Co-Authored-By: Claude <noreply@anthropic.com> * perf(term): spawn PTYs off the GPUI thread; offload secrets file I/O Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>

Tryanks · 2026-07-24T08:00:17Z

Summary

serialize tty::new calls behind one process-wide mutex on macOS
keep non-macOS creation lock-free and release the guard immediately after PTY creation
add a deterministic 16-thread regression test that proves the creation critical section cannot overlap

Closes#101.

Root cause

Concurrent macOS openpty(3) calls can intermittently fail with an invalid negative errno (-6). That matches the issue's load-dependent behavior and low PTY usage, and an independent C stress reproduction reported failures only under high concurrency and none after serialization (jppittman/pixelflow#894).

The fix serializes the complete upstream tty::new call because tcode cannot lock only the internal openpty invocation. The mutex protects no Rust data invariant, so a poisoned guard is recovered while preserving mutual exclusion. There is no retry or error suppression.

Validation

pre-fix regression test: failed as expected with 16 simultaneous critical-section entries
post-fix regression test: passed with a maximum of 1
cargo fmt --all --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test --workspace --locked
20 consecutive cargo test -p term --locked runs: 20/20 passed, with no Os error -6 or Unknown error: -6

Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com>

* fix(runtime): load session timelines off the GPUI main thread (#114) Switching to, reopening, or background-loading a session used to read and fold its entire JSONL history synchronously on the GPUI thread, hitching the UI for the full disk read of long sessions. - Install the session immediately (parked sessions keep their in-memory snapshot; cold opens start empty) and swap in the folded timeline from a background read, guarded by a per-session load generation. - Retry the read (bounded) when the JSONL append watermark moved mid-read, so events appended while parked can never be lost to a racy fold. - Answer orchestrate status/result from in-memory timelines when the child is loaded, and batch the remaining disk reads into one background task that replies through the broker channel. - Move the idle-child reaper, child-callback fold, and the remaining synchronous .git/HEAD branch probes off the main thread. Co-Authored-By: Claude <noreply@anthropic.com> * perf(runtime): move SessionStore writes to a single background writer Every store write ran synchronously on the GPUI thread: one JSONL append per agent event during streaming, full sessions-index read/parse/rewrite per persist_meta, transcript copies on fork, and terminal-ui.json rewrites throughout resize drags. - A FIFO async_channel drained by one background writer task now owns all store mutations; index ops keep their read-modify-write merge semantics inside the writer. - Main-thread in-memory state stays authoritative and updates synchronously; the writer is durability-only. - Fork waits for the transcript clone to land before opening the fork. - Write failures travel back over a report channel and surface through the same RuntimeError notices as before. - The app-quit hook enqueues a barrier and waits for every earlier write to complete before exiting. Co-Authored-By: Claude <noreply@anthropic.com> * perf(ui,runtime): offload remaining one-shot blocking I/O from the GPUI thread - Preview port scan (up to ~720ms of sequential connect timeouts per click) - git worktree removal on session delete (seconds) - Image paste/drop: metadata size check before reading, unbounded read + transcode + attachment write in one background task, generation-guarded completion that reserves strip slots across in-flight jobs - Orchestrate dispatch cwd canonicalize/is_dir (network-FS stall) - ACP registry cache read, provider install-source canonicalize - AI-title scratch dir create/remove (ran on the main thread inside a gpui local task) - Plan save-to-workspace/download writes - Add-project typed-path is_dir, third-party profile home creation The Codex auth.json probe stays synchronous by design: it is one small local file, and async-fs pools are unsafe inside gpui local tasks (see crates/runtime/src/blocking.rs). Co-Authored-By: Claude <noreply@anthropic.com> * perf(term): spawn PTYs off the GPUI thread; offload secrets file I/O Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>

Tryanks · 2026-07-24T08:00:17Z

Summary

serialize tty::new calls behind one process-wide mutex on macOS
keep non-macOS creation lock-free and release the guard immediately after PTY creation
add a deterministic 16-thread regression test that proves the creation critical section cannot overlap

Closes#101.

Root cause

Concurrent macOS openpty(3) calls can intermittently fail with an invalid negative errno (-6). That matches the issue's load-dependent behavior and low PTY usage, and an independent C stress reproduction reported failures only under high concurrency and none after serialization (jppittman/pixelflow#894).

The fix serializes the complete upstream tty::new call because tcode cannot lock only the internal openpty invocation. The mutex protects no Rust data invariant, so a poisoned guard is recovered while preserving mutual exclusion. There is no retry or error suppression.

Validation

pre-fix regression test: failed as expected with 16 simultaneous critical-section entries
post-fix regression test: passed with a maximum of 1
cargo fmt --all --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test --workspace --locked
20 consecutive cargo test -p term --locked runs: 20/20 passed, with no Os error -6 or Unknown error: -6

Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com>

* fix(runtime): load session timelines off the GPUI main thread (#114) Switching to, reopening, or background-loading a session used to read and fold its entire JSONL history synchronously on the GPUI thread, hitching the UI for the full disk read of long sessions. - Install the session immediately (parked sessions keep their in-memory snapshot; cold opens start empty) and swap in the folded timeline from a background read, guarded by a per-session load generation. - Retry the read (bounded) when the JSONL append watermark moved mid-read, so events appended while parked can never be lost to a racy fold. - Answer orchestrate status/result from in-memory timelines when the child is loaded, and batch the remaining disk reads into one background task that replies through the broker channel. - Move the idle-child reaper, child-callback fold, and the remaining synchronous .git/HEAD branch probes off the main thread. Co-Authored-By: Claude <noreply@anthropic.com> * perf(runtime): move SessionStore writes to a single background writer Every store write ran synchronously on the GPUI thread: one JSONL append per agent event during streaming, full sessions-index read/parse/rewrite per persist_meta, transcript copies on fork, and terminal-ui.json rewrites throughout resize drags. - A FIFO async_channel drained by one background writer task now owns all store mutations; index ops keep their read-modify-write merge semantics inside the writer. - Main-thread in-memory state stays authoritative and updates synchronously; the writer is durability-only. - Fork waits for the transcript clone to land before opening the fork. - Write failures travel back over a report channel and surface through the same RuntimeError notices as before. - The app-quit hook enqueues a barrier and waits for every earlier write to complete before exiting. Co-Authored-By: Claude <noreply@anthropic.com> * perf(ui,runtime): offload remaining one-shot blocking I/O from the GPUI thread - Preview port scan (up to ~720ms of sequential connect timeouts per click) - git worktree removal on session delete (seconds) - Image paste/drop: metadata size check before reading, unbounded read + transcode + attachment write in one background task, generation-guarded completion that reserves strip slots across in-flight jobs - Orchestrate dispatch cwd canonicalize/is_dir (network-FS stall) - ACP registry cache read, provider install-source canonicalize - AI-title scratch dir create/remove (ran on the main thread inside a gpui local task) - Plan save-to-workspace/download writes - Add-project typed-path is_dir, third-party profile home creation The Codex auth.json probe stays synchronous by design: it is one small local file, and async-fs pools are unsafe inside gpui local tasks (see crates/runtime/src/blocking.rs). Co-Authored-By: Claude <noreply@anthropic.com> * perf(term): spawn PTYs off the GPUI thread; offload secrets file I/O Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>

Tryanks · 2026-07-24T08:00:17Z

Summary

serialize tty::new calls behind one process-wide mutex on macOS
keep non-macOS creation lock-free and release the guard immediately after PTY creation
add a deterministic 16-thread regression test that proves the creation critical section cannot overlap

Closes#101.

Root cause

Concurrent macOS openpty(3) calls can intermittently fail with an invalid negative errno (-6). That matches the issue's load-dependent behavior and low PTY usage, and an independent C stress reproduction reported failures only under high concurrency and none after serialization (jppittman/pixelflow#894).

The fix serializes the complete upstream tty::new call because tcode cannot lock only the internal openpty invocation. The mutex protects no Rust data invariant, so a poisoned guard is recovered while preserving mutual exclusion. There is no retry or error suppression.

Validation

pre-fix regression test: failed as expected with 16 simultaneous critical-section entries
post-fix regression test: passed with a maximum of 1
cargo fmt --all --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test --workspace --locked
20 consecutive cargo test -p term --locked runs: 20/20 passed, with no Os error -6 or Unknown error: -6

Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com>

* fix(runtime): load session timelines off the GPUI main thread (#114) Switching to, reopening, or background-loading a session used to read and fold its entire JSONL history synchronously on the GPUI thread, hitching the UI for the full disk read of long sessions. - Install the session immediately (parked sessions keep their in-memory snapshot; cold opens start empty) and swap in the folded timeline from a background read, guarded by a per-session load generation. - Retry the read (bounded) when the JSONL append watermark moved mid-read, so events appended while parked can never be lost to a racy fold. - Answer orchestrate status/result from in-memory timelines when the child is loaded, and batch the remaining disk reads into one background task that replies through the broker channel. - Move the idle-child reaper, child-callback fold, and the remaining synchronous .git/HEAD branch probes off the main thread. Co-Authored-By: Claude <noreply@anthropic.com> * perf(runtime): move SessionStore writes to a single background writer Every store write ran synchronously on the GPUI thread: one JSONL append per agent event during streaming, full sessions-index read/parse/rewrite per persist_meta, transcript copies on fork, and terminal-ui.json rewrites throughout resize drags. - A FIFO async_channel drained by one background writer task now owns all store mutations; index ops keep their read-modify-write merge semantics inside the writer. - Main-thread in-memory state stays authoritative and updates synchronously; the writer is durability-only. - Fork waits for the transcript clone to land before opening the fork. - Write failures travel back over a report channel and surface through the same RuntimeError notices as before. - The app-quit hook enqueues a barrier and waits for every earlier write to complete before exiting. Co-Authored-By: Claude <noreply@anthropic.com> * perf(ui,runtime): offload remaining one-shot blocking I/O from the GPUI thread - Preview port scan (up to ~720ms of sequential connect timeouts per click) - git worktree removal on session delete (seconds) - Image paste/drop: metadata size check before reading, unbounded read + transcode + attachment write in one background task, generation-guarded completion that reserves strip slots across in-flight jobs - Orchestrate dispatch cwd canonicalize/is_dir (network-FS stall) - ACP registry cache read, provider install-source canonicalize - AI-title scratch dir create/remove (ran on the main thread inside a gpui local task) - Plan save-to-workspace/download writes - Add-project typed-path is_dir, third-party profile home creation The Codex auth.json probe stays synchronous by design: it is one small local file, and async-fs pools are unsafe inside gpui local tasks (see crates/runtime/src/blocking.rs). Co-Authored-By: Claude <noreply@anthropic.com> * perf(term): spawn PTYs off the GPUI thread; offload secrets file I/O Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>

Tryanks · 2026-07-24T08:00:17Z

Summary

serialize tty::new calls behind one process-wide mutex on macOS
keep non-macOS creation lock-free and release the guard immediately after PTY creation
add a deterministic 16-thread regression test that proves the creation critical section cannot overlap

Closes#101.

Root cause

Concurrent macOS openpty(3) calls can intermittently fail with an invalid negative errno (-6). That matches the issue's load-dependent behavior and low PTY usage, and an independent C stress reproduction reported failures only under high concurrency and none after serialization (jppittman/pixelflow#894).

The fix serializes the complete upstream tty::new call because tcode cannot lock only the internal openpty invocation. The mutex protects no Rust data invariant, so a poisoned guard is recovered while preserving mutual exclusion. There is no retry or error suppression.

Validation

pre-fix regression test: failed as expected with 16 simultaneous critical-section entries
post-fix regression test: passed with a maximum of 1
cargo fmt --all --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test --workspace --locked
20 consecutive cargo test -p term --locked runs: 20/20 passed, with no Os error -6 or Unknown error: -6

Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com>

* fix(runtime): load session timelines off the GPUI main thread (#114) Switching to, reopening, or background-loading a session used to read and fold its entire JSONL history synchronously on the GPUI thread, hitching the UI for the full disk read of long sessions. - Install the session immediately (parked sessions keep their in-memory snapshot; cold opens start empty) and swap in the folded timeline from a background read, guarded by a per-session load generation. - Retry the read (bounded) when the JSONL append watermark moved mid-read, so events appended while parked can never be lost to a racy fold. - Answer orchestrate status/result from in-memory timelines when the child is loaded, and batch the remaining disk reads into one background task that replies through the broker channel. - Move the idle-child reaper, child-callback fold, and the remaining synchronous .git/HEAD branch probes off the main thread. Co-Authored-By: Claude <noreply@anthropic.com> * perf(runtime): move SessionStore writes to a single background writer Every store write ran synchronously on the GPUI thread: one JSONL append per agent event during streaming, full sessions-index read/parse/rewrite per persist_meta, transcript copies on fork, and terminal-ui.json rewrites throughout resize drags. - A FIFO async_channel drained by one background writer task now owns all store mutations; index ops keep their read-modify-write merge semantics inside the writer. - Main-thread in-memory state stays authoritative and updates synchronously; the writer is durability-only. - Fork waits for the transcript clone to land before opening the fork. - Write failures travel back over a report channel and surface through the same RuntimeError notices as before. - The app-quit hook enqueues a barrier and waits for every earlier write to complete before exiting. Co-Authored-By: Claude <noreply@anthropic.com> * perf(ui,runtime): offload remaining one-shot blocking I/O from the GPUI thread - Preview port scan (up to ~720ms of sequential connect timeouts per click) - git worktree removal on session delete (seconds) - Image paste/drop: metadata size check before reading, unbounded read + transcode + attachment write in one background task, generation-guarded completion that reserves strip slots across in-flight jobs - Orchestrate dispatch cwd canonicalize/is_dir (network-FS stall) - ACP registry cache read, provider install-source canonicalize - AI-title scratch dir create/remove (ran on the main thread inside a gpui local task) - Plan save-to-workspace/download writes - Add-project typed-path is_dir, third-party profile home creation The Codex auth.json probe stays synchronous by design: it is one small local file, and async-fs pools are unsafe inside gpui local tasks (see crates/runtime/src/blocking.rs). Co-Authored-By: Claude <noreply@anthropic.com> * perf(term): spawn PTYs off the GPUI thread; offload secrets file I/O Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>

Tryanks · 2026-07-24T08:00:17Z

Summary

serialize tty::new calls behind one process-wide mutex on macOS
keep non-macOS creation lock-free and release the guard immediately after PTY creation
add a deterministic 16-thread regression test that proves the creation critical section cannot overlap

Closes#101.

Root cause

Concurrent macOS openpty(3) calls can intermittently fail with an invalid negative errno (-6). That matches the issue's load-dependent behavior and low PTY usage, and an independent C stress reproduction reported failures only under high concurrency and none after serialization (jppittman/pixelflow#894).

The fix serializes the complete upstream tty::new call because tcode cannot lock only the internal openpty invocation. The mutex protects no Rust data invariant, so a poisoned guard is recovered while preserving mutual exclusion. There is no retry or error suppression.

Validation

pre-fix regression test: failed as expected with 16 simultaneous critical-section entries
post-fix regression test: passed with a maximum of 1
cargo fmt --all --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test --workspace --locked
20 consecutive cargo test -p term --locked runs: 20/20 passed, with no Os error -6 or Unknown error: -6

Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com>

* fix(runtime): load session timelines off the GPUI main thread (#114) Switching to, reopening, or background-loading a session used to read and fold its entire JSONL history synchronously on the GPUI thread, hitching the UI for the full disk read of long sessions. - Install the session immediately (parked sessions keep their in-memory snapshot; cold opens start empty) and swap in the folded timeline from a background read, guarded by a per-session load generation. - Retry the read (bounded) when the JSONL append watermark moved mid-read, so events appended while parked can never be lost to a racy fold. - Answer orchestrate status/result from in-memory timelines when the child is loaded, and batch the remaining disk reads into one background task that replies through the broker channel. - Move the idle-child reaper, child-callback fold, and the remaining synchronous .git/HEAD branch probes off the main thread. Co-Authored-By: Claude <noreply@anthropic.com> * perf(runtime): move SessionStore writes to a single background writer Every store write ran synchronously on the GPUI thread: one JSONL append per agent event during streaming, full sessions-index read/parse/rewrite per persist_meta, transcript copies on fork, and terminal-ui.json rewrites throughout resize drags. - A FIFO async_channel drained by one background writer task now owns all store mutations; index ops keep their read-modify-write merge semantics inside the writer. - Main-thread in-memory state stays authoritative and updates synchronously; the writer is durability-only. - Fork waits for the transcript clone to land before opening the fork. - Write failures travel back over a report channel and surface through the same RuntimeError notices as before. - The app-quit hook enqueues a barrier and waits for every earlier write to complete before exiting. Co-Authored-By: Claude <noreply@anthropic.com> * perf(ui,runtime): offload remaining one-shot blocking I/O from the GPUI thread - Preview port scan (up to ~720ms of sequential connect timeouts per click) - git worktree removal on session delete (seconds) - Image paste/drop: metadata size check before reading, unbounded read + transcode + attachment write in one background task, generation-guarded completion that reserves strip slots across in-flight jobs - Orchestrate dispatch cwd canonicalize/is_dir (network-FS stall) - ACP registry cache read, provider install-source canonicalize - AI-title scratch dir create/remove (ran on the main thread inside a gpui local task) - Plan save-to-workspace/download writes - Add-project typed-path is_dir, third-party profile home creation The Codex auth.json probe stays synchronous by design: it is one small local file, and async-fs pools are unsafe inside gpui local tasks (see crates/runtime/src/blocking.rs). Co-Authored-By: Claude <noreply@anthropic.com> * perf(term): spawn PTYs off the GPUI thread; offload secrets file I/O Terminal open/restart/new/split (and persisted-terminal reopen) allocated the PTY, spawned the shell, and built the event loop synchronously on the main thread — tens of ms per action. Spawns now run on the background executor behind a pending-spawn registry: completions validate the owning session and workspace before installing, closing the drawer or a terminal cancels in-flight spawns, repeated restarts supersede, and pending spawns count toward the per-session terminal cap. The thread-local cwd override is resolved on the calling thread (Terminal::resolve_spawn_cwd), and the macOS openpty serialization from #148 is untouched. secrets.json also moves off the main thread: profile-secret mutations go through the FIFO store writer (SetProfileSecret/ClearProfileSecrets, read-modify-write inside the writer, values never logged), and the provider-start / title / probe / version-check / model-catalog env builds read secrets inside blocking::unblock. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>

Tryanks enabled auto-merge (squash) July 24, 2026 08:00

fix(term): serialize macOS PTY creation
fcc3ae3

Tryanks force-pushed the fix/serialize-macos-pty-creation branch from 30faa84 to fcc3ae3Compare July 24, 2026 08:02

Tryanks merged commit 47206ae into mainJul 24, 2026
3 checks passed

Tryanks deleted the fix/serialize-macos-pty-creation branch July 24, 2026 08:06

Tryanks mentioned this pull request Jul 24, 2026
perf: move session I/O and PTY spawn off the GPUI main thread #155
Merged

Tryanks mentioned this pull request Aug 10, 2026
term: intermittent PTY creation failure (Os error -6) on macOS under parallel test runs #101
Closed

Tryanks enabled auto-merge (squash) July 24, 2026 08:00

fix(term): serialize macOS PTY creation
fcc3ae3

Tryanks force-pushed the fix/serialize-macos-pty-creation branch from 30faa84 to fcc3ae3Compare July 24, 2026 08:02

Tryanks merged commit 47206ae into mainJul 24, 2026
3 checks passed

Tryanks deleted the fix/serialize-macos-pty-creation branch July 24, 2026 08:06

Tryanks mentioned this pull request Jul 24, 2026
perf: move session I/O and PTY spawn off the GPUI main thread #155
Merged

Tryanks mentioned this pull request Aug 10, 2026
term: intermittent PTY creation failure (Os error -6) on macOS under parallel test runs #101
Closed

Tryanks enabled auto-merge (squash) July 24, 2026 08:00

fix(term): serialize macOS PTY creation
fcc3ae3

Tryanks force-pushed the fix/serialize-macos-pty-creation branch from 30faa84 to fcc3ae3Compare July 24, 2026 08:02

Tryanks merged commit 47206ae into mainJul 24, 2026
3 checks passed

Tryanks deleted the fix/serialize-macos-pty-creation branch July 24, 2026 08:06

Tryanks mentioned this pull request Jul 24, 2026
perf: move session I/O and PTY spawn off the GPUI main thread #155
Merged

Tryanks mentioned this pull request Aug 10, 2026
term: intermittent PTY creation failure (Os error -6) on macOS under parallel test runs #101
Closed

Tryanks enabled auto-merge (squash) July 24, 2026 08:00

fix(term): serialize macOS PTY creation
fcc3ae3

Tryanks force-pushed the fix/serialize-macos-pty-creation branch from 30faa84 to fcc3ae3Compare July 24, 2026 08:02

Tryanks merged commit 47206ae into mainJul 24, 2026
3 checks passed

Tryanks deleted the fix/serialize-macos-pty-creation branch July 24, 2026 08:06

Tryanks mentioned this pull request Jul 24, 2026
perf: move session I/O and PTY spawn off the GPUI main thread #155
Merged

Tryanks mentioned this pull request Aug 10, 2026
term: intermittent PTY creation failure (Os error -6) on macOS under parallel test runs #101
Closed

Tryanks enabled auto-merge (squash) July 24, 2026 08:00

fix(term): serialize macOS PTY creation
fcc3ae3

Tryanks force-pushed the fix/serialize-macos-pty-creation branch from 30faa84 to fcc3ae3Compare July 24, 2026 08:02

Tryanks merged commit 47206ae into mainJul 24, 2026
3 checks passed

Tryanks deleted the fix/serialize-macos-pty-creation branch July 24, 2026 08:06

Tryanks mentioned this pull request Jul 24, 2026
perf: move session I/O and PTY spawn off the GPUI main thread #155
Merged

Tryanks mentioned this pull request Aug 10, 2026
term: intermittent PTY creation failure (Os error -6) on macOS under parallel test runs #101
Closed

Tryanks enabled auto-merge (squash) July 24, 2026 08:00

fix(term): serialize macOS PTY creation
fcc3ae3

Tryanks force-pushed the fix/serialize-macos-pty-creation branch from 30faa84 to fcc3ae3Compare July 24, 2026 08:02

Tryanks merged commit 47206ae into mainJul 24, 2026
3 checks passed

Tryanks deleted the fix/serialize-macos-pty-creation branch July 24, 2026 08:06

Tryanks mentioned this pull request Jul 24, 2026
perf: move session I/O and PTY spawn off the GPUI main thread #155
Merged

Tryanks mentioned this pull request Aug 10, 2026
term: intermittent PTY creation failure (Os error -6) on macOS under parallel test runs #101
Closed

Tryanks enabled auto-merge (squash) July 24, 2026 08:00

fix(term): serialize macOS PTY creation
fcc3ae3

Tryanks force-pushed the fix/serialize-macos-pty-creation branch from 30faa84 to fcc3ae3Compare July 24, 2026 08:02

Tryanks merged commit 47206ae into mainJul 24, 2026
3 checks passed

Tryanks deleted the fix/serialize-macos-pty-creation branch July 24, 2026 08:06

Tryanks mentioned this pull request Jul 24, 2026
perf: move session I/O and PTY spawn off the GPUI main thread #155
Merged

Tryanks mentioned this pull request Aug 10, 2026
term: intermittent PTY creation failure (Os error -6) on macOS under parallel test runs #101
Closed

Tryanks enabled auto-merge (squash) July 24, 2026 08:00

fix(term): serialize macOS PTY creation
fcc3ae3

Tryanks force-pushed the fix/serialize-macos-pty-creation branch from 30faa84 to fcc3ae3Compare July 24, 2026 08:02

Tryanks merged commit 47206ae into mainJul 24, 2026
3 checks passed

Tryanks deleted the fix/serialize-macos-pty-creation branch July 24, 2026 08:06

Tryanks mentioned this pull request Jul 24, 2026
perf: move session I/O and PTY spawn off the GPUI main thread #155
Merged

Tryanks mentioned this pull request Aug 10, 2026
term: intermittent PTY creation failure (Os error -6) on macOS under parallel test runs #101
Closed

Conversation

Tryanks commented Jul 24, 2026

Summary

Root cause

Validation

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Tryanks commented Jul 24, 2026

Summary

Root cause

Validation

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Tryanks commented Jul 24, 2026

Summary

Root cause

Validation

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Tryanks commented Jul 24, 2026

Summary

Root cause

Validation

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Tryanks commented Jul 24, 2026

Summary

Root cause

Validation

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Tryanks commented Jul 24, 2026

Summary

Root cause

Validation