Re-scoped from the reverted #10179 to the bound-at-ingress doctrine (see
src/shared/memory-safety/README.md): ceilings go where untrusted or
unpredictably-large input first enters a heap, not in the interior.
Kept: daemon/relay/SSH/mobile/IPC transport frames, PTY output flow control,
on-disk agent transcripts, document parsing, filesystem enumeration, provider
pagination, media decode, and long-lived accumulators keyed by user-growable
ids -- the class behind the reported renderer OOM (#9872).
Dropped: interior ceilings whose size is already implied by a bounded input,
second ceilings behind existing ones, and derived/presentational state.
Every file is reconciled against current main: check-no-merge-base-revert
reports 0 reverted and 0 missing across 169 overlapping files, so no shipped
work is lost. Typecheck is at main's own 2-error baseline.
Co-authored-by: Orca <help@stably.ai>
The native-smoke job ran bare `pnpm vitest run <files>` with no --config.
There is no root-level vitest/vite config, so vitest fell back to its
built-in defaults: a 5000ms testTimeout and no Windows worker cap. The
real csc.exe launcher-compile tests (build-windows-cli-launcher and
ssh-remote-cli-launcher) cold-start in 1.4-7.4s on hosted Windows and
tipped over the 5s default, failing the PR check.
Pass --config config/vitest.config.ts like every other vitest invocation
in the repo (pnpm test, pr.yml) so the job gets the shared 30s timeout and
Windows maxWorkers:4 cap (less CPU contention -> lower compile variance).
Positional file args still filter to just the listed files.
* fix(cli): harden Windows launcher transports
* Fix csc.exe compile failures on space-bearing Windows install paths
- Legacy csc.exe mangles absolute paths containing spaces, so the
compile step now cd's into the bin directory and passes bare
file names for /out and the source file instead of full paths
NeilandOrca
Brennan Benson
Jinjing
Jinwoo Hong