fix: reduce the panic surface — poison recovery, structured pipe errors by Tryanks · Pull Request #240 · Tryanks/tcode

Tryanks · 2026-08-22T14:02:47Z

Implements #116.

Mutex poisoning: every lock().unwrap() in crates/agent/src/acp.rs (42 sites), crates/term/src/{grid_emulator,pty,pty_info}.rs now goes through a per-module lock_recover helper (unwrap_or_else(|p| p.into_inner())). These locks guard state that is replaced wholesale or torn down on error paths, so continuing with the inner data is safe; a worker panic can no longer cascade into UI/reader-thread aborts. Regression test poisons a grid mutex and verifies recovery.
Child pipes: ACP agent spawn with missing stdin/stdout/stderr sends AgentError::Spawn through the existing ready-channel start-failure path instead of expect-aborting; ACP terminal creation returns JSON-RPC -32603.
unreachable!() audit (all 9 production sites): 8 kept — each destructures a variant constructed by an immediately preceding local match, so they are invariants by construction, not externally reachable. 1 converted — chat/components/subagent.rs is a general renderer with a gallery-facing caller; it now logs + debug_assert + renders empty in release.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

Closes#116

🤖 Generated with Claude Code

…renderer invariant - Per-module lock_recover helpers replace every lock().unwrap() in acp.rs, grid_emulator.rs, pty.rs, pty_info.rs: a panic while holding a lock no longer cascades poison panics into unrelated threads. - ACP spawn with missing stdin/stdout/stderr now reports a structured AgentError::Spawn through the provider-start failure path; ACP terminal creation returns a JSON-RPC error instead of aborting. - subagent.rs renders an empty element (with debug_assert) on invalid input instead of unreachable!(); the remaining unreachable sites are locally-constructed invariants and were audited as such. - Regression test: poisoned grid mutex stays usable. Closes#116 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Tryanks · 2026-08-22T14:02:47Z

Implements #116.

Mutex poisoning: every lock().unwrap() in crates/agent/src/acp.rs (42 sites), crates/term/src/{grid_emulator,pty,pty_info}.rs now goes through a per-module lock_recover helper (unwrap_or_else(|p| p.into_inner())). These locks guard state that is replaced wholesale or torn down on error paths, so continuing with the inner data is safe; a worker panic can no longer cascade into UI/reader-thread aborts. Regression test poisons a grid mutex and verifies recovery.
Child pipes: ACP agent spawn with missing stdin/stdout/stderr sends AgentError::Spawn through the existing ready-channel start-failure path instead of expect-aborting; ACP terminal creation returns JSON-RPC -32603.
unreachable!() audit (all 9 production sites): 8 kept — each destructures a variant constructed by an immediately preceding local match, so they are invariants by construction, not externally reachable. 1 converted — chat/components/subagent.rs is a general renderer with a gallery-facing caller; it now logs + debug_assert + renders empty in release.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

Closes#116

🤖 Generated with Claude Code

…renderer invariant - Per-module lock_recover helpers replace every lock().unwrap() in acp.rs, grid_emulator.rs, pty.rs, pty_info.rs: a panic while holding a lock no longer cascades poison panics into unrelated threads. - ACP spawn with missing stdin/stdout/stderr now reports a structured AgentError::Spawn through the provider-start failure path; ACP terminal creation returns a JSON-RPC error instead of aborting. - subagent.rs renders an empty element (with debug_assert) on invalid input instead of unreachable!(); the remaining unreachable sites are locally-constructed invariants and were audited as such. - Regression test: poisoned grid mutex stays usable. Closes#116 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Tryanks · 2026-08-22T14:02:47Z

Implements #116.

Mutex poisoning: every lock().unwrap() in crates/agent/src/acp.rs (42 sites), crates/term/src/{grid_emulator,pty,pty_info}.rs now goes through a per-module lock_recover helper (unwrap_or_else(|p| p.into_inner())). These locks guard state that is replaced wholesale or torn down on error paths, so continuing with the inner data is safe; a worker panic can no longer cascade into UI/reader-thread aborts. Regression test poisons a grid mutex and verifies recovery.
Child pipes: ACP agent spawn with missing stdin/stdout/stderr sends AgentError::Spawn through the existing ready-channel start-failure path instead of expect-aborting; ACP terminal creation returns JSON-RPC -32603.
unreachable!() audit (all 9 production sites): 8 kept — each destructures a variant constructed by an immediately preceding local match, so they are invariants by construction, not externally reachable. 1 converted — chat/components/subagent.rs is a general renderer with a gallery-facing caller; it now logs + debug_assert + renders empty in release.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

Closes#116

🤖 Generated with Claude Code

…renderer invariant - Per-module lock_recover helpers replace every lock().unwrap() in acp.rs, grid_emulator.rs, pty.rs, pty_info.rs: a panic while holding a lock no longer cascades poison panics into unrelated threads. - ACP spawn with missing stdin/stdout/stderr now reports a structured AgentError::Spawn through the provider-start failure path; ACP terminal creation returns a JSON-RPC error instead of aborting. - subagent.rs renders an empty element (with debug_assert) on invalid input instead of unreachable!(); the remaining unreachable sites are locally-constructed invariants and were audited as such. - Regression test: poisoned grid mutex stays usable. Closes#116 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Tryanks · 2026-08-22T14:02:47Z

Implements #116.

Mutex poisoning: every lock().unwrap() in crates/agent/src/acp.rs (42 sites), crates/term/src/{grid_emulator,pty,pty_info}.rs now goes through a per-module lock_recover helper (unwrap_or_else(|p| p.into_inner())). These locks guard state that is replaced wholesale or torn down on error paths, so continuing with the inner data is safe; a worker panic can no longer cascade into UI/reader-thread aborts. Regression test poisons a grid mutex and verifies recovery.
Child pipes: ACP agent spawn with missing stdin/stdout/stderr sends AgentError::Spawn through the existing ready-channel start-failure path instead of expect-aborting; ACP terminal creation returns JSON-RPC -32603.
unreachable!() audit (all 9 production sites): 8 kept — each destructures a variant constructed by an immediately preceding local match, so they are invariants by construction, not externally reachable. 1 converted — chat/components/subagent.rs is a general renderer with a gallery-facing caller; it now logs + debug_assert + renders empty in release.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

Closes#116

🤖 Generated with Claude Code

…renderer invariant - Per-module lock_recover helpers replace every lock().unwrap() in acp.rs, grid_emulator.rs, pty.rs, pty_info.rs: a panic while holding a lock no longer cascades poison panics into unrelated threads. - ACP spawn with missing stdin/stdout/stderr now reports a structured AgentError::Spawn through the provider-start failure path; ACP terminal creation returns a JSON-RPC error instead of aborting. - subagent.rs renders an empty element (with debug_assert) on invalid input instead of unreachable!(); the remaining unreachable sites are locally-constructed invariants and were audited as such. - Regression test: poisoned grid mutex stays usable. Closes#116 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Tryanks · 2026-08-22T14:02:47Z

Implements #116.

Mutex poisoning: every lock().unwrap() in crates/agent/src/acp.rs (42 sites), crates/term/src/{grid_emulator,pty,pty_info}.rs now goes through a per-module lock_recover helper (unwrap_or_else(|p| p.into_inner())). These locks guard state that is replaced wholesale or torn down on error paths, so continuing with the inner data is safe; a worker panic can no longer cascade into UI/reader-thread aborts. Regression test poisons a grid mutex and verifies recovery.
Child pipes: ACP agent spawn with missing stdin/stdout/stderr sends AgentError::Spawn through the existing ready-channel start-failure path instead of expect-aborting; ACP terminal creation returns JSON-RPC -32603.
unreachable!() audit (all 9 production sites): 8 kept — each destructures a variant constructed by an immediately preceding local match, so they are invariants by construction, not externally reachable. 1 converted — chat/components/subagent.rs is a general renderer with a gallery-facing caller; it now logs + debug_assert + renders empty in release.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

Closes#116

🤖 Generated with Claude Code

…renderer invariant - Per-module lock_recover helpers replace every lock().unwrap() in acp.rs, grid_emulator.rs, pty.rs, pty_info.rs: a panic while holding a lock no longer cascades poison panics into unrelated threads. - ACP spawn with missing stdin/stdout/stderr now reports a structured AgentError::Spawn through the provider-start failure path; ACP terminal creation returns a JSON-RPC error instead of aborting. - subagent.rs renders an empty element (with debug_assert) on invalid input instead of unreachable!(); the remaining unreachable sites are locally-constructed invariants and were audited as such. - Regression test: poisoned grid mutex stays usable. Closes#116 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Tryanks · 2026-08-22T14:02:47Z

Implements #116.

Mutex poisoning: every lock().unwrap() in crates/agent/src/acp.rs (42 sites), crates/term/src/{grid_emulator,pty,pty_info}.rs now goes through a per-module lock_recover helper (unwrap_or_else(|p| p.into_inner())). These locks guard state that is replaced wholesale or torn down on error paths, so continuing with the inner data is safe; a worker panic can no longer cascade into UI/reader-thread aborts. Regression test poisons a grid mutex and verifies recovery.
Child pipes: ACP agent spawn with missing stdin/stdout/stderr sends AgentError::Spawn through the existing ready-channel start-failure path instead of expect-aborting; ACP terminal creation returns JSON-RPC -32603.
unreachable!() audit (all 9 production sites): 8 kept — each destructures a variant constructed by an immediately preceding local match, so they are invariants by construction, not externally reachable. 1 converted — chat/components/subagent.rs is a general renderer with a gallery-facing caller; it now logs + debug_assert + renders empty in release.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

Closes#116

🤖 Generated with Claude Code

…renderer invariant - Per-module lock_recover helpers replace every lock().unwrap() in acp.rs, grid_emulator.rs, pty.rs, pty_info.rs: a panic while holding a lock no longer cascades poison panics into unrelated threads. - ACP spawn with missing stdin/stdout/stderr now reports a structured AgentError::Spawn through the provider-start failure path; ACP terminal creation returns a JSON-RPC error instead of aborting. - subagent.rs renders an empty element (with debug_assert) on invalid input instead of unreachable!(); the remaining unreachable sites are locally-constructed invariants and were audited as such. - Regression test: poisoned grid mutex stays usable. Closes#116 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Tryanks · 2026-08-22T14:02:47Z

Implements #116.

Mutex poisoning: every lock().unwrap() in crates/agent/src/acp.rs (42 sites), crates/term/src/{grid_emulator,pty,pty_info}.rs now goes through a per-module lock_recover helper (unwrap_or_else(|p| p.into_inner())). These locks guard state that is replaced wholesale or torn down on error paths, so continuing with the inner data is safe; a worker panic can no longer cascade into UI/reader-thread aborts. Regression test poisons a grid mutex and verifies recovery.
Child pipes: ACP agent spawn with missing stdin/stdout/stderr sends AgentError::Spawn through the existing ready-channel start-failure path instead of expect-aborting; ACP terminal creation returns JSON-RPC -32603.
unreachable!() audit (all 9 production sites): 8 kept — each destructures a variant constructed by an immediately preceding local match, so they are invariants by construction, not externally reachable. 1 converted — chat/components/subagent.rs is a general renderer with a gallery-facing caller; it now logs + debug_assert + renders empty in release.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

Closes#116

🤖 Generated with Claude Code

…renderer invariant - Per-module lock_recover helpers replace every lock().unwrap() in acp.rs, grid_emulator.rs, pty.rs, pty_info.rs: a panic while holding a lock no longer cascades poison panics into unrelated threads. - ACP spawn with missing stdin/stdout/stderr now reports a structured AgentError::Spawn through the provider-start failure path; ACP terminal creation returns a JSON-RPC error instead of aborting. - subagent.rs renders an empty element (with debug_assert) on invalid input instead of unreachable!(); the remaining unreachable sites are locally-constructed invariants and were audited as such. - Regression test: poisoned grid mutex stays usable. Closes#116 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Tryanks · 2026-08-22T14:02:47Z

Implements #116.

Mutex poisoning: every lock().unwrap() in crates/agent/src/acp.rs (42 sites), crates/term/src/{grid_emulator,pty,pty_info}.rs now goes through a per-module lock_recover helper (unwrap_or_else(|p| p.into_inner())). These locks guard state that is replaced wholesale or torn down on error paths, so continuing with the inner data is safe; a worker panic can no longer cascade into UI/reader-thread aborts. Regression test poisons a grid mutex and verifies recovery.
Child pipes: ACP agent spawn with missing stdin/stdout/stderr sends AgentError::Spawn through the existing ready-channel start-failure path instead of expect-aborting; ACP terminal creation returns JSON-RPC -32603.
unreachable!() audit (all 9 production sites): 8 kept — each destructures a variant constructed by an immediately preceding local match, so they are invariants by construction, not externally reachable. 1 converted — chat/components/subagent.rs is a general renderer with a gallery-facing caller; it now logs + debug_assert + renders empty in release.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

Closes#116

🤖 Generated with Claude Code

…renderer invariant - Per-module lock_recover helpers replace every lock().unwrap() in acp.rs, grid_emulator.rs, pty.rs, pty_info.rs: a panic while holding a lock no longer cascades poison panics into unrelated threads. - ACP spawn with missing stdin/stdout/stderr now reports a structured AgentError::Spawn through the provider-start failure path; ACP terminal creation returns a JSON-RPC error instead of aborting. - subagent.rs renders an empty element (with debug_assert) on invalid input instead of unreachable!(); the remaining unreachable sites are locally-constructed invariants and were audited as such. - Regression test: poisoned grid mutex stays usable. Closes#116 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Tryanks enabled auto-merge (squash) August 22, 2026 14:02

Tryanks merged commit 5edeb87 into mainAug 22, 2026
3 checks passed