Files
yhh 394da0a313 refactor: the kernel's packages live in the layer they belong to
internal/ was 141 packages side by side, so nothing but a reader's memory
said which were foundations and which assembled the rest. Each now sits in a
layer directory, and the directory is the declaration:

  base      L0  foundation with no domain in it
  contract  L1  types and interfaces the layers above agree on
  model, tools, safety, ext, state, platform
            L2  subsystems, peers of one another
  runtime   L3  the turn engine
  session   L4  the controller
  assembly  L5  the composition root
  frontend  L6  cli, serve, acp and the host adapters

Only paths change: package names, code and behaviour do not. Imports,
repolint and coverage baselines, sensitive paths, CI package lists and docs
follow the new paths; release notes keep the paths they were written with,
and sample paths inside tests and fixtures keep theirs.

repolint gains layer-order: a package may import its own layer and those
below it, read from where it lives. The 47 imports that point upward today
are recorded as that rule's opening debt (-allow-widen, a new rule's first
baseline) and can only go down. Most of it is config, which still reaches
into eight subsystems and is the next thing to take apart; the rest is
event, history and a few tools reaching into runtime for types that belong
in contract.
2026-09-23 18:28:21 -07:00

36 lines
1.5 KiB
Go

package plugin
import (
"fmt"
"sync/atomic"
)
// maxCodeGraphInstances caps how many CodeGraph indexer subprocesses may run
// concurrently across the whole process. Each tab/session boots its own plugin
// Host (desktop/tabs.go, boot.go), so opening many tabs on large projects used
// to spawn one full-tree indexer per tab — exhausting file descriptors and
// freezing the machine (#4361, #2992, #3797). A hard cap bounds the blast
// radius: once reached, additional CodeGraph instances refuse to start and the
// agent degrades to grep/glob, which is the documented manual workaround
// (`[codegraph] enabled = false`) applied automatically instead of a crash.
const maxCodeGraphInstances = 4
var liveCodeGraphInstances atomic.Int32
// acquireCodeGraphSlot reserves one of the bounded CodeGraph instance slots.
// It returns a release func (idempotent) and an error when the cap is reached.
// The cap only governs CodeGraph; every other stdio plugin is unaffected.
func acquireCodeGraphSlot() (func(), error) {
n := liveCodeGraphInstances.Add(1)
if n > maxCodeGraphInstances {
liveCodeGraphInstances.Add(-1)
return nil, fmt.Errorf("codegraph: %d instances already running (cap %d); not starting another to avoid file-descriptor exhaustion — close some tabs/sessions or set codegraph off for this one", n-1, maxCodeGraphInstances)
}
var released atomic.Bool
return func() {
if released.CompareAndSwap(false, true) {
liveCodeGraphInstances.Add(-1)
}
}, nil
}