Crate agentmux_launcher 

Modules

config 🔒

data_dir 🔒

Compatibility shim around agentmux_common::DataPaths.

diag 🔒

event_log 🔒

hash 🔒

host_pipe 🔒

ipc 🔒

reducer 🔒

saga 🔒

splash 🔒

Native pre-splash for Windows: a borderless layered popup showing the AgentMux brain logo (pulsing) on a solid dark background while CefInitialize runs (200–600 ms cold start).

srv_spawner 🔒

state 🔒

wrr 🔒

Structs

JobHandle 🔒

Owns a Windows Job Object handle. CloseHandle on drop. The job’s JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE flag means closing the last handle terminates every assigned process — which is what we want as a backstop if this launcher dies abruptly.

Enums

ForwardError 🔒

Phase B.6 (post-fix) — forward an open_new_window request to the already-running host and let this launcher exit 0.

Constants

HOST_RESTART_BUDGET 🔒

Phase 1 host supervision (spec docs/specs/SPEC_SERVICE_SUPERVISION_AND_RECOVERY_2026_05_20.md): on an abnormal host exit the launcher relaunches the host, but at most HOST_RESTART_BUDGET times within HOST_RESTART_WINDOW — a crash budget so a deterministic crash cannot spin forever (spec §10-A).

HOST_RESTART_WINDOW 🔒

Functions

create_job_object 🔒

Create a Job Object J0 with KILL_ON_JOB_CLOSE. Caller assigns processes to it via srv_spawner::assign_pid_to_job(pid, job).

dirs_fallback_home 🔒

Home dir without depending on dirs for THIS specific lookup. Kept to avoid a dirs dep cycle from log() — log() is called from data_dir::resolve_paths via failure paths, and we want it to work even if dirs itself is mid-failure.

find_cef_binary 🔒

Find the CEF host binary in the runtime directory. Tries versioned name first (agentmux-X.Y.Z.exe), then the old agentmux-cef-X.Y.Z.exe pattern for backwards compat, then plain agentmux-cef.exe (dev mode).

forward_open_new_window 🔒

launcher_main 🔒

log 🔒

Append a timestamped line to ~/.agentmux/logs/agentmux-launcher.log. Best-effort — silently no-ops if the log dir doesn’t exist yet.

main 🔒

Process entry point. suppress_os_crash_dialogs() runs FIRST — before the Tokio runtime is built. The runtime is built explicitly here (rather than via #[tokio::main], whose generated wrapper would construct it before any of our code runs) so a fault during runtime construction can’t surface the Windows crash modal either. Spec: docs/specs/SPEC_SERVICE_SUPERVISION_AND_RECOVERY_2026_05_20.md.

resume_main_thread 🔒

Resume the (single) main thread of a CREATE_SUSPENDED process.

run_windows 🔒

Windows main flow: resolve paths → create J0 → spawn srv → spawn host with srv endpoints in env → supervised wait → cleanup.

show_fatal_dialog 🔒

Show a modal error dialog before the launcher exits. Used for genuine bind failures (NOT the “already running” path — that silently forwards via forward_open_new_window). Without this, the launcher exit is silent (it has the windows subsystem in release, so eprintln! goes nowhere).

spawn_host_supervised 🔒

Spawn the CEF host suspended, assign it to the launcher’s Job Object, and resume it. Returns the running child, or None if any step failed — the caller decides (fatal on first launch, give-up on a restart). splash_event is passed on every launch — including restarts — so a relaunched host can still dismiss a splash left pending by a host that crashed pre-first-frame. disable_gpu is the retry ladder’s rung-2 degraded mode (spec §7): when set the host is launched with --disable-gpu (software rendering).

suppress_os_crash_dialogs 🔒

Suppress the Windows “Application Error” / WER crash dialog so an unhandled fault terminates the process immediately instead of wedging it behind a modal. No-op off Windows. Spec: docs/specs/SPEC_SERVICE_SUPERVISION_AND_RECOVERY_2026_05_20.md.