Repository navigation
Long sessions can exhaust 256-FD limit and break shell tools with ProcessFdQuotaExceeded #122
Description
In long-context/long-running agent sessions, shell tools can start failing with Zig error.ProcessFdQuotaExceeded. This reproduces on the latest upstream release, not only the dev checkout. Observed symptoms from saved subagent logs: every bash invocation, even simple pwd/ls, failed immediately with ProcessFdQuotaExceeded.\n\nInvestigation notes:\n- Zig maps this to the process file descriptor quota being exhausted (EMFILE / too many open files).\n- macOS default soft ulimit is often 256; current harness child shells report ulimit -n = 256.\n- graff spawns many subprocesses with piped stdout/stderr (bash, codedb, webfetch/kuri, zigpatch, git auto-commit, subagents/workflows). Concurrent subagents/workflows and background jobs can multiply FD use quickly.\n- The latest code does not appear to raise the process FD limit at startup.\n- Background jobs are retained in g_jobs until session exit even after completion; their child/process/future resources should be audited for FD/resource retention.\n\nSuggested fixes:\n1. At startup, call std.process.raiseFileDescriptorLimit (or equivalent) to raise the soft nofile limit where possible, and log the resulting limit.\n2. Add backpressure/global concurrency caps around subprocess-spawning tools, especially workflow/subagent fan-out.\n3. Audit all subprocess paths for closing/reaping stdio FDs; completed background jobs should be reapable/collectable before session exit.\n4. Improve the error message for ProcessFdQuotaExceeded with actionable advice (raise ulimit/restart session/kill background jobs).\n\nTemporary user workaround: start graff from a shell with a higher limit, e.g. ulimit -n 4096 && graff ..., or adjust macOS launch limits for GUI-launched apps.
Activity
pranavp311 commentedon Jul 10, 2026
related zig issue linked here ziglang/zig#23273 lel
justrach commentedon Jul 11, 2026
Status audit @ v0.0.200: still open — none of the four suggested fixes landed — but the investigation narrows it usefully.
Confirmed unfixed:
ulimit -n 256, a child bash inside graff still reports 256.error: ProcessFdQuotaExceeded(genericfailure()intools.zig:352-355); the background-job spawn path would give actively wrong advice for this error (exec.zig:137-139suggests running it in the background).agent_tools.zig:118-123).Good news from the audit — the leak theory is disproven:
jobPumpalways ends inchild.kill/child.wait, and Zig 0.16's child cleanup closes all parent-side pipe FDs.The fix is now one line: Zig 0.16.0 std ships
std.process.raiseFileDescriptorLimit()(process.zig:647, with correct Darwin OPEN_MAX clamping — the API discussed in ziglang/zig#23273). Call it early inmain()before subcommand dispatch, optionally log the resulting limit, and special-caseProcessFdQuotaExceededin the tool-failure message with actionable advice.Merge pull request #172 from justrach/fix/122-fd-limit