[euforic]

Summary

Two changes that make refreshes cheaper without removing any safety check.

1. Codex stats and activity query SQLite in process (241ac6b)

ProfileStatsScanner (queryRows, tableColumns, profileStateRows, querySingleRow) and LocalActivityReader used to launch /usr/bin/sqlite3 for every query, about five processes per Codex profile per refresh. They now go through a new SQLiteReadOnly.query, which uses the SQLite C API:

• SQLiteReadOnly.databaseArgument still validates the path first (parent resolved, symlinked or non-regular database and sidecars rejected), and immutable=1 is still used only when no -wal/-shm exists.
• Connections open with SQLITE_OPEN_READONLY | SQLITE_OPEN_NOFOLLOW. They also set trusted_schema=OFF and query_only=ON, and refuse any statement SQLite doesn't report as read-only.
• sqlite3_progress_handler stops a query at the existing timeout or when Task.isCancelled becomes true.
• Output bytes and rows are counted as values are copied. Stats keep their 8 MiB budget. Activity keeps its configured byte budget and also gets a row limit equal to its LIMIT.
• Rows come back typed and in source order. Values containing a newline or the separator can no longer split rows. The readabilityHandler / readDataToEndOfFile ordering race in queryRows is gone, because there is no pipe any more.
• Fail-closed decoding: text that isn't valid UTF-8, or a missing or mistyped required activity column, fails that source. SQLite errors still report "Database could not be read."

2. Subprocess waits no longer hold cooperative threads (ae88f7b)

• BoundedSubprocess now runs each process from dispatch sources on a private serial queue: root exit, pipe output, the deadline, and the group SIGTERM → 1 s → SIGKILL escalation. A new async overload hands the result back through a continuation with a cancellation handler. Async callers suspend instead of blocking. Sync callers keep the sync overload, which now waits on one semaphore instead of polling every 10 ms.
• A race found during testing: the kqueue exit event can arrive before the child becomes reapable, so a WNOHANG reap in the exit handler can miss it. The handler now does a blocking waitpid on the private queue, which returns promptly once the exit event has fired.
• AppServerRateLimitClient is async end to end. It waits on initialize, response, output-closed and process-exit milestones, which come from the readability handler and a process source. GroupedSubprocess.terminate() suspends between group checks instead of calling Thread.sleep. Timeout, process-group kill, cancellation and output-limit behavior are unchanged.

Verification

• swift test: 416 tests, 0 failures, 20 opt-in skips. PerformanceRegressionTests passes.
• New tests use real files and processes (no mocks or stubs):
  • SQLite timeout and cancellation, using a real endless recursive CTE and a slow view
  • write refusal, symlink refusal, byte and row budgets, non-UTF-8 text
  • reading committed WAL content while a writer holds the sidecars open
  • async run and cancellation killing a TERM-ignoring process group
  • 3× more concurrent async waits than cores finishing in about 1.0 s; the sync path took 3.0 s in the same setup
• ./script/benchmark_resources.sh 9af151b <out>, SQLite scenario (nine samples per revision): sqlite3 launches 5 → 0 per refresh. Wall time 287.6 → 247.9 ms; child CPU 271.7 → 0 ms and parent CPU 4.8 → 244.9 ms, so the work moves into the app. 50,000 sessions and zero query errors in both. The status rows also differ, but only because the runner's baseline branch calls the older status API on purpose; they don't measure this change. Details are in docs/resource-usage-benchmarks.md.
• Merges cleanly with Fix refresh and subprocess bugs; rebuild the interface with native macOS components #36 (checked with git merge-tree); the merged tree keeps its POSIX_SPAWN_CLOEXEC_DEFAULT changes.

Notes for review

• Threat model: provider databases are now parsed inside the AgentDock process, not a child sqlite3 process. The read-only, no-follow, trusted_schema=OFF, timeout and output bounds limit what a hostile database can do, but a SQLite parser bug would now hit the app process.
• A read blocked in the kernel (for example on a hung filesystem) can't be interrupted in process the way a child could be killed. Profile databases are local, under the profile root.
• Not changed here: status refresh ps snapshots still use the sync runner on the launcher actors, behind sync snapshot protocols. LocalChatSession and ClaudeUsageClient still launch sqlite3.

🤖 Generated with Claude Code