Module startup 

Startup-time process-state bumps. Currently just the RLIMIT_NOFILE raise (#251) - macOS launchd hands GUI-spawned processes a soft cap of 256 open FDs, and multi-session forge steady-state crosses that ceiling (~15-25 FDs per session × claude pipes / watchers / MCP / tokio kqueues). Without the bump, git scans and other openers fail with EMFILE once enough sessions are open.

That per-session estimate was measured when each session also held proxy sockets, so it now runs high; re-measure before treating it as current.

Re-exports

use rlimit::Resource; 🔒

Constants

GUARDED_MARKER 🔒

The value scripts/install.sh exports before its cargo call. Any other value, including the empty string a build script sees when the variable is absent, means the guard did not run.

TARGET_NOFILE 🔒

Target soft RLIMIT_NOFILE value. Well below macOS kern.maxfilesperproc (typically 184320) and Linux containers’ usual hard caps (1024-65536). Capped against the process’s hard limit at call time so a tighter inherited hard cap clamps the effective bump gracefully.

Functions

build_provenance_warning 🔒

What to warn about provenance, or None when the build came through the guarded path.

raise_fd_limit

Raise the soft RLIMIT_NOFILE limit toward TARGET_NOFILE, clamped at the process’s hard cap. No-op when the inherited soft limit is already at or above the target. Logs the action at info on success and at warn when getrlimit / setrlimit fails.

report_build_provenance

Record how this binary was built, so a drifted one says so instead of being silent.