Native pre-splash for Windows: a borderless layered popup showing
the AgentMux brain logo (pulsing) on a solid dark background while
CefInitialize runs (200–600 ms cold start).
“Disable the splash” preference, resolved by the launcher before it spawns
the splash (and before the host/srv exist), per
SPEC_SPLASH_USERINFO_AND_DISABLE_2026_06_21.md §6.
Identity shown in the splash footer: user@host and v<version> (+ a dev
label on non-stable builds). Gathered once in the launcher and handed to each
platform’s splash backend, so the three render identical content.
Software text blitter for the splash footer — shared by the Linux software
buffers (splash_linux) and the Win32 layered-window DIB (splash.rs).
macOS uses native NSTextField instead, so it does not use this module.
Owns a Windows Job Object handle. CloseHandle on drop. The job’s
JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE flag means closing the last handle
terminates every assigned process — which is what we want as a backstop
if this launcher dies abruptly.
Phase 1 host supervision (spec
docs/specs/SPEC_SERVICE_SUPERVISION_AND_RECOVERY_2026_05_20.md): on an
abnormal host exit the launcher relaunches the host, but at most
HOST_RESTART_BUDGET times within HOST_RESTART_WINDOW — a crash budget
so a deterministic crash cannot spin forever (spec §10-A). Shared by
the Windows (run_windows) and Unix (run_unix) supervisors.
Home dir without depending on dirs for THIS specific lookup.
Kept to avoid a dirs dep cycle from log() — log() is called from
data_dir::resolve_paths via failure paths, and we want it to work
even if dirs itself is mid-failure.
Find the CEF host binary in the runtime directory.
Tries versioned name first (agentmux-X.Y.Z.exe), then the old
agentmux-cef-X.Y.Z.exe pattern for backwards compat, then plain
agentmux-cef.exe (dev mode).
Process entry point. suppress_os_crash_dialogs() runs FIRST — before the
Tokio runtime is built. The runtime is built explicitly here (rather than
via #[tokio::main], whose generated wrapper would construct it before any
of our code runs) so a fault during runtime construction can’t surface the
Windows crash modal either. Spec:
docs/specs/SPEC_SERVICE_SUPERVISION_AND_RECOVERY_2026_05_20.md.
Show a modal error dialog before the launcher exits. Used for
genuine bind failures (NOT the “already running” path — that
silently forwards via forward_open_new_window). Without this,
the launcher exit is silent (it has the windows subsystem in
release, so eprintln! goes nowhere).
Spawn the CEF host suspended, assign it to the launcher’s Job Object, and
resume it. Returns the running child, or None if any step failed — the
caller decides (fatal on first launch, give-up on a restart). splash_event
is passed on every launch — including restarts — so a relaunched host can
still dismiss a splash left pending by a host that crashed pre-first-frame.
disable_gpu is the retry ladder’s rung-2 degraded mode (spec §7): when set
the host is launched with --disable-gpu (software rendering).
--splash-selftest: show the splash with no srv/host behind it, hold it for a
few seconds (or AGENTMUX_SPLASH_HOLD_MS), then exit. A demo/dev affordance
for eyeballing the footer + centering without launching the whole app.
Suppress the Windows “Application Error” / WER crash dialog so an unhandled
fault terminates the process immediately instead of wedging it behind a
modal. No-op off Windows. Spec:
docs/specs/SPEC_SERVICE_SUPERVISION_AND_RECOVERY_2026_05_20.md.