@otto-code/server 0.7.2 → 0.7.3

package/dist/server/server/dotnet-process-registry.js

@@ -0,0 +1,160 @@
+import { spawn as nodeSpawn } from "node:child_process";
+import { killProcessTree, MSBUILD_ENV } from "./process-tree.js";
+export class DotnetProcessLimitError extends Error {
+    constructor(limit, running) {
+        super(`Otto already has ${running} .NET processes running and the limit is ${limit}. ` +
+            `Close a workspace or raise the limit to start another.`);
+        this.name = "DotnetProcessLimitError";
+        this.limit = limit;
+        this.running = running;
+    }
+}
+export const DEFAULT_MAX_DOTNET_PROCESSES = 4;
+export class DotnetProcessRegistry {
+    constructor(options) {
+        this.entries = new Set();
+        this.logger = options.logger.child({ subsystem: "dotnet-processes" });
+        this.spawn = options.spawn ?? nodeSpawn;
+        this.killTree = options.killTree ?? killProcessTree;
+        this.now = options.now ?? Date.now;
+        this.maxProcesses = normalizeLimit(options.maxProcesses);
+    }
+    get limit() {
+        return this.maxProcesses;
+    }
+    get size() {
+        return this.entries.size;
+    }
+    /**
+     * Lowering the limit does not kill anything already running: a process holding a warm
+     * project model is expensive to rebuild, and the caller that would be killed has done
+     * nothing wrong. The new limit binds the next spawn, and the count drains naturally as
+     * pools reap their idle members.
+     */
+    setLimit(maxProcesses) {
+        this.maxProcesses = normalizeLimit(maxProcesses);
+    }
+    /** A copy per row, so a caller inspecting the registry cannot mutate what it tracks. */
+    running() {
+        const rows = [];
+        for (const entry of this.entries) {
+            rows.push({
+                pid: entry.record.pid,
+                kind: entry.record.kind,
+                label: entry.record.label,
+                startedAt: entry.record.startedAt,
+            });
+        }
+        return rows;
+    }
+    hasCapacity() {
+        return this.entries.size < this.maxProcesses;
+    }
+    /**
+     * Spawn a .NET process under the cap. Throws {@link DotnetProcessLimitError} rather than
+     * queueing: a caller waiting on a slot would hold a request open behind work that may
+     * take minutes to finish, and "not right now" is an answer both callers can render.
+     *
+     * `MSBUILD_ENV` is applied here rather than at each call site so no future caller can
+     * forget it and reintroduce resident MSBuild worker nodes.
+     */
+    spawnTracked(input) {
+        if (!this.hasCapacity()) {
+            this.logger.warn({
+                kind: input.kind,
+                label: input.label,
+                running: this.entries.size,
+                limit: this.maxProcesses,
+            }, "refused to start a .NET process: at the configured limit");
+            throw new DotnetProcessLimitError(this.maxProcesses, this.entries.size);
+        }
+        const child = this.spawn(input.command, [...input.args], {
+            ...input.options,
+            env: { ...(input.options.env ?? process.env), ...MSBUILD_ENV },
+        });
+        const entry = {
+            child,
+            record: {
+                pid: child.pid,
+                kind: input.kind,
+                label: input.label,
+                startedAt: this.now(),
+            },
+            released: false,
+        };
+        this.entries.add(entry);
+        // A process that dies on its own must free its slot, or a few crashes would exhaust the
+        // cap and the feature would go permanently unavailable with nothing running.
+        const forget = () => {
+            entry.released = true;
+            this.entries.delete(entry);
+        };
+        child.once("exit", forget);
+        child.once("error", forget);
+        this.logger.debug({ kind: input.kind, label: input.label, pid: child.pid, running: this.entries.size }, "started a .NET process");
+        return {
+            child,
+            release: () => {
+                if (entry.released) {
+                    return;
+                }
+                entry.released = true;
+                this.entries.delete(entry);
+                this.killTree(child);
+            },
+        };
+    }
+    /**
+     * Kill everything still tracked. The shutdown sweep, and the backstop for an owner that
+     * dropped its handle without releasing.
+     */
+    killAll() {
+        const entries = [...this.entries];
+        this.entries.clear();
+        for (const entry of entries) {
+            if (entry.released) {
+                continue;
+            }
+            entry.released = true;
+            this.killTree(entry.child);
+        }
+        if (entries.length > 0) {
+            this.logger.debug({ count: entries.length }, "killed all tracked .NET processes");
+        }
+    }
+}
+/**
+ * The process table is a machine-global resource, and the cap is only a cap if both
+ * subsystems that start .NET processes count against the same one. A module-level instance
+ * is the honest model for that: threading a handle through the LSP pool, the solution
+ * provider and their two connection layers would let a future call site quietly opt out by
+ * not being given one.
+ *
+ * Tests construct `DotnetProcessRegistry` directly instead of touching this.
+ */
+let shared = null;
+export function sharedDotnetProcessRegistry(logger) {
+    shared ?? (shared = new DotnetProcessRegistry({ logger }));
+    return shared;
+}
+/** Applies the host's configured ceiling. Safe to call before anything has spawned. */
+export function configureSharedDotnetProcessRegistry(input) {
+    sharedDotnetProcessRegistry(input.logger).setLimit(input.maxProcesses);
+}
+/** Shutdown sweep: nothing Otto started outlives Otto. */
+export function killAllSharedDotnetProcesses() {
+    shared?.killAll();
+}
+export function resetSharedDotnetProcessRegistryForTests() {
+    shared?.killAll();
+    shared = null;
+}
+function normalizeLimit(value) {
+    if (value === undefined || !Number.isFinite(value)) {
+        return DEFAULT_MAX_DOTNET_PROCESSES;
+    }
+    // At least one, or the feature could never run at all and every failure would look like
+    // a limit breach rather than a misconfiguration.
+    return Math.max(1, Math.trunc(value));
+}
+//# sourceMappingURL=dotnet-process-registry.js.map

package/dist/server/server/lsp/connection.d.ts

@@ -59,6 +59,8 @@ export interface LspServerSpec {
     rootPath: string;
     env?: Readonly<Record<string, string>>;
     initializationOptions?: unknown;
+    /** Mirrors the registry row; `"dotnet"` routes the spawn through the .NET process cap. */
+    runtime?: "dotnet";
 }
 export interface LspExitInfo {
     code: number | null;
@@ -130,6 +132,8 @@ export declare class LspConnection {
     private exitInfo;
     private initializeResult;
     private readonly progressTokens;
+    /** Non-null for `runtime: "dotnet"` rows; owns the registry slot and the tree kill. */
+    private tracked;
     private readonly reportActivity;
     private readonly reportDiagnostics;
     readonly whenExited: Promise<LspExitInfo>;

package/dist/server/server/lsp/connection.js

@@ -2,6 +2,8 @@ import { spawn } from "node:child_process";
 import path from "node:path";
 import { CancellationTokenSource, createMessageConnection, StreamMessageReader, StreamMessageWriter, } from "vscode-jsonrpc/node.js";
 import { z } from "zod";
+import { sharedDotnetProcessRegistry, } from "../dotnet-process-registry.js";
+import { killProcessTree, MSBUILD_ENV } from "../process-tree.js";
 import { toFileUri } from "./uri.js";
 /**
  * One live language server: the spawned process, the JSON-RPC channel to it, and
@@ -134,6 +136,8 @@ export class LspConnection {
         this.exitInfo = null;
         this.initializeResult = null;
         this.progressTokens = new Set();
+        /** Non-null for `runtime: "dotnet"` rows; owns the registry slot and the tree kill. */
+        this.tracked = null;
         this.spec = options.spec;
         this.logger = options.logger.child({ lspServer: options.spec.id });
         this.requestTimeoutMs = options.requestTimeoutMs;
@@ -161,17 +165,40 @@ export class LspConnection {
     static async start(options) {
         const { spec, logger } = options;
         const plan = planLanguageServerSpawn(spec.command, spec.args);
-        const proc = spawn(plan.command, [...plan.args], {
+        const spawnOptions = {
             cwd: spec.rootPath,
-            env: spec.env ? { ...process.env, ...spec.env } : process.env,
+            // MSBUILD_ENV applies to every server, not just the .NET ones: a server that has
+            // never heard of MSBuild ignores the variables, and gating on the registry id
+            // would mean remembering to add each future MSBuild-backed row to a list. See
+            // process-tree.ts for why node reuse is the thing being switched off.
+            env: { ...process.env, ...MSBUILD_ENV, ...spec.env },
             stdio: ["pipe", "pipe", "pipe"],
             windowsHide: true,
             windowsVerbatimArguments: plan.windowsVerbatimArguments,
-        });
+        };
+        // A .NET server counts against the machine-wide .NET cap alongside the solution
+        // sidecar, because they load the same MSBuild machinery on the same machine and a
+        // per-subsystem cap can only bound its own half of the total.
+        let tracked = null;
+        let proc;
+        if (spec.runtime === "dotnet") {
+            tracked = sharedDotnetProcessRegistry(logger).spawnTracked({
+                command: plan.command,
+                args: plan.args,
+                options: spawnOptions,
+                kind: "language-server",
+                label: `${spec.id} @ ${spec.rootPath}`,
+            });
+            proc = tracked.child;
+        }
+        else {
+            proc = spawn(plan.command, [...plan.args], spawnOptions);
+        }
         const spawnFailure = new Promise((_resolve, reject) => {
             proc.once("error", (error) => reject(new LspSpawnError(spec.id, spec.command, error)));
         });
         const connection = new LspConnection(options, proc);
+        connection.tracked = tracked;
         connection.pipeStderr();
         try {
             await Promise.race([connection.initialize(options.initializeTimeoutMs), spawnFailure]);
@@ -262,7 +289,15 @@ export class LspConnection {
             new Promise((resolve) => setTimeout(() => resolve(false), STOP_GRACE_MS)),
         ]);
         if (!exited) {
-            this.proc.kill("SIGKILL");
+            // The tree, not the process: a `.cmd` shim makes `this.proc` the shell rather
+            // than the server, and an MSBuild-backed server can have workers of its own. A
+            // tracked (.NET) server goes back through the registry so its slot is freed too.
+            if (this.tracked) {
+                this.tracked.release();
+            }
+            else {
+                killProcessTree(this.proc);
+            }
             await this.whenExited;
         }
     }

package/dist/server/server/lsp/pool.js

@@ -191,6 +191,7 @@ export class LspServerPool {
                     args: resolved.args,
                     rootPath,
                     initializationOptions: row.initializationOptions,
+                    ...(row.runtime === undefined ? {} : { runtime: row.runtime }),
                 },
                 logger: this.logger,
                 initializeTimeoutMs: this.limits.initializeTimeoutMs,

package/dist/server/server/lsp/registry.d.ts

@@ -29,6 +29,13 @@ export interface LspServerRow {
     defaultEnabled: boolean;
     /** Plain-words index cost, shown next to the toggle so the trade is honest. */
     indexCost: string;
+    /**
+     * Which runtime this server is, when that changes how Otto must manage the process.
+     * `"dotnet"` routes the spawn through the shared .NET process registry, so a C# server
+     * counts against the same machine-wide cap as the solution sidecar and is swept with it.
+     * Omitted means an ordinary process the LSP pool's own cap is sufficient for.
+     */
+    runtime?: "dotnet";
 }
 export interface ResolvedLspServer {
     command: string;
@@ -45,5 +52,11 @@ export declare function languageIdForPath(filePath: string): string;
 export declare function indexRowsByExtension(rows: readonly LspServerRow[]): Map<string, LspServerRow[]>;
 export declare function rowsForExtension(extension: string): readonly LspServerRow[];
 export declare function rowsForPath(filePath: string): readonly LspServerRow[];
-export declare function resolveServerCommand(row: LspServerRow, rootPath: string): Promise<ResolvedLspServer | null>;
+/**
+ * `rootPath` null asks the host-wide question: can this machine supply the server at all?
+ * That is what the settings screen asks, since it is a host screen with no workspace in
+ * hand. The `workspaceBin` rung is skipped rather than faked, because a project's
+ * `node_modules` is the one thing a host-wide answer genuinely cannot know.
+ */
+export declare function resolveServerCommand(row: LspServerRow, rootPath: string | null): Promise<ResolvedLspServer | null>;
 //# sourceMappingURL=registry.d.ts.map

package/dist/server/server/lsp/registry.js

@@ -40,6 +40,9 @@ export const LSP_SERVER_ROWS = [
         args: [],
         discovery: ["path"],
         defaultEnabled: true,
+        // A .NET global tool: the process is a `dotnet` host, and it loads projects through
+        // MSBuild, which is where the worker nodes come from. Counted and swept accordingly.
+        runtime: "dotnet",
         indexCost: "Loads the solution on first use; seconds on a small project, longer on a large one.",
     },
     {
@@ -133,11 +136,20 @@ export function rowsForExtension(extension) {
 export function rowsForPath(filePath) {
     return rowsForExtension(path.extname(filePath));
 }
+/**
+ * `rootPath` null asks the host-wide question: can this machine supply the server at all?
+ * That is what the settings screen asks, since it is a host screen with no workspace in
+ * hand. The `workspaceBin` rung is skipped rather than faked, because a project's
+ * `node_modules` is the one thing a host-wide answer genuinely cannot know.
+ */
 export async function resolveServerCommand(row, rootPath) {
     for (const rung of row.discovery) {
-        const command = await resolveRung(rung, row.bin, rootPath);
+        if (rung === "workspaceBin" && rootPath === null) {
+            continue;
+        }
+        const command = await resolveRung(rung, row.bin, rootPath ?? "");
         if (command !== null) {
-            return { command, args: substituteRoot(row.args, rootPath), rung };
+            return { command, args: substituteRoot(row.args, rootPath ?? ""), rung };
         }
     }
     return null;

package/dist/server/server/lsp/service.d.ts

@@ -30,6 +30,14 @@ export interface LspLanguageState {
     running: boolean;
     /** Which discovery rung supplied it, or null when nothing did. */
     rung: string | null;
+    /**
+     * Every rung this row can ever be supplied from. A row whose only rung is `workspaceBin`
+     * comes from the project it runs in, so `installed: false` from a host-wide check means
+     * the project brings it, not that anything is missing.
+     */
+    discovery: string[];
+    /** Absolute path to the resolved executable, or null when nothing resolved. */
+    path: string | null;
     bin: string;
     extensions: string[];
     indexCost: string;
@@ -194,8 +202,16 @@ export declare class LspService {
      * has to mean off immediately, or the switch is decoration.
      */
     applySettings(patch: Partial<LspSettings>): Promise<void>;
-    /** Per-language state for the settings screen, resolved against a real workspace. */
-    languageStates(rootPath: string): Promise<LspLanguageState[]>;
+    /**
+     * Per-language state for the settings screen.
+     *
+     * `rootPath` null is the host-wide answer the screen actually wants: every row this
+     * daemon knows, resolved against the rungs a host has. Settings is a host screen, so it
+     * must be able to state the machine's capabilities without a workspace open. Passing a
+     * root additionally probes that project's `node_modules/.bin`, the one rung that is
+     * genuinely per-project, and narrows "running" to servers rooted there.
+     */
+    languageStates(rootPath: string | null): Promise<LspLanguageState[]>;
     private isRowEnabled;
     /**
      * Record the buffer, then bind it to the servers for its language — spawning them if

package/dist/server/server/lsp/service.js

@@ -229,7 +229,15 @@ export class LspService {
             }
         }
     }
-    /** Per-language state for the settings screen, resolved against a real workspace. */
+    /**
+     * Per-language state for the settings screen.
+     *
+     * `rootPath` null is the host-wide answer the screen actually wants: every row this
+     * daemon knows, resolved against the rungs a host has. Settings is a host screen, so it
+     * must be able to state the machine's capabilities without a workspace open. Passing a
+     * root additionally probes that project's `node_modules/.bin`, the one rung that is
+     * genuinely per-project, and narrows "running" to servers rooted there.
+     */
     async languageStates(rootPath) {
         return Promise.all(this.pool.rows().map(async (row) => {
             const resolved = await resolveServerCommand(row, rootPath);
@@ -237,8 +245,12 @@ export class LspService {
                 id: row.id,
                 enabled: this.isRowEnabled(row),
                 installed: resolved !== null,
-                running: this.pool.peek(rootPath, row.id) !== null,
+                running: rootPath === null
+                    ? this.pool.running().some((entry) => entry.serverId === row.id)
+                    : this.pool.peek(rootPath, row.id) !== null,
                 rung: resolved?.rung ?? null,
+                discovery: [...row.discovery],
+                path: resolved?.command ?? null,
                 bin: row.bin,
                 extensions: [...row.extensions],
                 indexCost: row.indexCost,

package/dist/server/server/process-tree.d.ts

@@ -0,0 +1,29 @@
+import { type ChildProcess } from "node:child_process";
+/**
+ * Kill a child process *and everything it spawned*.
+ *
+ * `ChildProcess.kill()` signals one process. That is enough for a self-contained
+ * server, and wrong for anything that shells out: on Windows a `.cmd` shim means the
+ * process we hold is `cmd.exe` and the real server is its child, and an MSBuild-backed
+ * language server leaves worker nodes of its own. Killing only the named process left
+ * those behind with no parent to reap them, which is how a machine ends up with dozens
+ * of resident `dotnet` processes after a few workspace visits.
+ *
+ * Windows has no process groups to signal, so `taskkill /T` is the only way to reach
+ * the tree. POSIX keeps the direct signal: our children are not started detached, so
+ * they have no group of their own to address, and the subsystems that could orphan
+ * grandchildren (see MSBUILD_ENV) are configured not to.
+ */
+export declare function killProcessTree(child: ChildProcess, signal?: NodeJS.Signals): void;
+/**
+ * Environment every MSBuild-backed child gets.
+ *
+ * `MSBUILDDISABLENODEREUSE` is the important one. By default MSBuild keeps its worker
+ * nodes alive for 15 minutes after a build so the next build can reuse them, and each
+ * node is a separate `dotnet` process. A language server that loads a solution on
+ * every workspace visit therefore leaves a growing pile of them behind, outliving the
+ * server we reaped and answering to nobody. We trade a slightly slower cold project
+ * load for nodes that exit with the work that started them.
+ */
+export declare const MSBUILD_ENV: Readonly<Record<string, string>>;
+//# sourceMappingURL=process-tree.d.ts.map

package/dist/server/server/process-tree.js

@@ -0,0 +1,59 @@
+import { spawn } from "node:child_process";
+/**
+ * Kill a child process *and everything it spawned*.
+ *
+ * `ChildProcess.kill()` signals one process. That is enough for a self-contained
+ * server, and wrong for anything that shells out: on Windows a `.cmd` shim means the
+ * process we hold is `cmd.exe` and the real server is its child, and an MSBuild-backed
+ * language server leaves worker nodes of its own. Killing only the named process left
+ * those behind with no parent to reap them, which is how a machine ends up with dozens
+ * of resident `dotnet` processes after a few workspace visits.
+ *
+ * Windows has no process groups to signal, so `taskkill /T` is the only way to reach
+ * the tree. POSIX keeps the direct signal: our children are not started detached, so
+ * they have no group of their own to address, and the subsystems that could orphan
+ * grandchildren (see MSBUILD_ENV) are configured not to.
+ */
+export function killProcessTree(child, signal = "SIGKILL") {
+    const pid = child.pid;
+    if (process.platform !== "win32" || pid === undefined) {
+        child.kill(signal);
+        return;
+    }
+    try {
+        // Detached with ignored stdio: this is fire-and-forget cleanup, and a taskkill
+        // that outlives the caller is better than one that blocks shutdown. `/F` because
+        // a language server that missed its shutdown handshake will not leave politely.
+        const killer = spawn("taskkill", ["/pid", String(pid), "/T", "/F"], {
+            stdio: "ignore",
+            windowsHide: true,
+            detached: true,
+        });
+        killer.unref();
+        // A failed taskkill (process already gone, or no permission) must not become an
+        // unhandled 'error' event on a process nobody is listening to.
+        killer.on("error", () => { });
+    }
+    catch {
+        // Fall through to the direct kill below.
+    }
+    // Always signal directly too: taskkill is asynchronous, and if it cannot run at all
+    // this is still the behaviour we had before.
+    child.kill(signal);
+}
+/**
+ * Environment every MSBuild-backed child gets.
+ *
+ * `MSBUILDDISABLENODEREUSE` is the important one. By default MSBuild keeps its worker
+ * nodes alive for 15 minutes after a build so the next build can reuse them, and each
+ * node is a separate `dotnet` process. A language server that loads a solution on
+ * every workspace visit therefore leaves a growing pile of them behind, outliving the
+ * server we reaped and answering to nobody. We trade a slightly slower cold project
+ * load for nodes that exit with the work that started them.
+ */
+export const MSBUILD_ENV = {
+    MSBUILDDISABLENODEREUSE: "1",
+    DOTNET_CLI_TELEMETRY_OPTOUT: "1",
+    DOTNET_NOLOGO: "1",
+};
+//# sourceMappingURL=process-tree.js.map

package/dist/server/server/session/files/workspace-files-session.js

@@ -816,17 +816,23 @@ export class WorkspaceFilesSession {
         }
     }
     async handleLspServersListRequest(request) {
-        const cwd = request.cwd.trim();
+        // No cwd is the host-wide question the settings screen asks: what can this machine
+        // run, and what is up right now. There is no path to authorize in that case, since the
+        // workspace check guards reading a directory and host-wide discovery reads none.
+        const cwd = request.cwd?.trim() ?? "";
+        const scope = cwd.length > 0 ? cwd : null;
         try {
-            await this.assertCwdWithinKnownWorkspace(cwd);
+            if (scope !== null) {
+                await this.assertCwdWithinKnownWorkspace(scope);
+            }
             const [languages, running] = await Promise.all([
-                this.lspService.languageStates(cwd),
+                this.lspService.languageStates(scope),
                 Promise.resolve(this.lspService.running()),
             ]);
             this.host.emit({
                 type: "lsp.servers.list.response",
                 payload: {
-                    cwd: request.cwd,
+                    cwd,
                     languages,
                     running: running.map((entry) => ({
                         rootPath: entry.rootPath,
@@ -843,7 +849,7 @@ export class WorkspaceFilesSession {
             this.host.emit({
                 type: "lsp.servers.list.response",
                 payload: {
-                    cwd: request.cwd,
+                    cwd,
                     languages: [],
                     running: [],
                     error: getErrorMessage(error),

package/dist/server/server/session.d.ts

@@ -531,6 +531,17 @@ export declare class Session {
      * Handle client heartbeat for activity tracking
      */
     private handleClientHeartbeat;
+    /**
+     * Tell the workspace-scoped subsystems which workspace the client is actually in, so their
+     * periodic work follows the user instead of the whole catalogue.
+     *
+     * Derived from the focused agent's cwd rather than sent explicitly, which keeps this off
+     * the wire entirely. Deliberately **sticky**: focus goes null whenever the user moves to a
+     * tab that is not a chat (files, terminal, browser), and treating that as "no active
+     * workspace" would stop observing the very workspace they are sitting in. Only focusing an
+     * agent in a *different* workspace moves it.
+     */
+    private syncActiveWorkspaceFromActivity;
     private clearFocusedTerminalAttention;
     /**
      * Handle push token registration

package/dist/server/server/session.js

@@ -4280,6 +4280,29 @@ export class Session {
         if (msg.appVisible && focusedTerminalId) {
             void this.clearFocusedTerminalAttention(focusedTerminalId);
         }
+        this.syncActiveWorkspaceFromActivity();
+    }
+    /**
+     * Tell the workspace-scoped subsystems which workspace the client is actually in, so their
+     * periodic work follows the user instead of the whole catalogue.
+     *
+     * Derived from the focused agent's cwd rather than sent explicitly, which keeps this off
+     * the wire entirely. Deliberately **sticky**: focus goes null whenever the user moves to a
+     * tab that is not a chat (files, terminal, browser), and treating that as "no active
+     * workspace" would stop observing the very workspace they are sitting in. Only focusing an
+     * agent in a *different* workspace moves it.
+     */
+    syncActiveWorkspaceFromActivity() {
+        const focusedAgentId = this.clientActivity?.focusedAgentId;
+        if (!focusedAgentId) {
+            return;
+        }
+        const cwd = this.agentManager.getAgent(focusedAgentId)?.cwd;
+        if (!cwd) {
+            return;
+        }
+        this.workspaceGitService.setActiveWorkspace(cwd);
+        this.lspService.setActiveWorkspace(cwd);
     }
     async clearFocusedTerminalAttention(terminalId) {
         const terminalManager = this.terminalManager;

package/dist/server/server/solution-model/dotnet/probe.d.ts

@@ -47,6 +47,8 @@ export declare class DotnetProbe {
     private handshake;
     /** Settled by the first line the process writes, which must be the handshake. */
     private handshakeWaiter;
+    /** Set by `start` immediately after construction; owns the registry slot and the kill. */
+    private tracked;
     private constructor();
     /**
      * Spawn and wait for the handshake. The handshake is not decoration: it is where the process

package/dist/server/server/solution-model/dotnet/probe.js

@@ -1,5 +1,5 @@
-import { spawn } from "node:child_process";
 import { z } from "zod";
+import { sharedDotnetProcessRegistry, } from "../../dotnet-process-registry.js";
 import { SUPPORTED_PROTOCOL_VERSION } from "./bootstrap.js";
 /**
  * One sidecar process: spawn, handshake, newline-delimited JSON framing, per-request timeouts,
@@ -47,6 +47,8 @@ export class DotnetProbe {
         this.handshake = null;
         /** Settled by the first line the process writes, which must be the handshake. */
         this.handshakeWaiter = null;
+        /** Set by `start` immediately after construction; owns the registry slot and the kill. */
+        this.tracked = null;
         this.child = child;
         this.logger = options.logger;
         this.requestTimeoutMs = options.requestTimeoutMs;
@@ -75,20 +77,35 @@ export class DotnetProbe {
      * is what keeps a stale `dist/` from producing garbled trees rather than a clear failure.
      */
     static async start(options) {
-        const child = spawn(options.runtime.dotnetCommand, [options.runtime.entryPath], {
-            cwd: options.cwd,
-            stdio: ["pipe", "pipe", "pipe"],
-            env: {
-                ...process.env,
-                // MSBuild colours and progress would corrupt the NDJSON stream if anything ever wrote
-                // them to stdout, and neither is readable by a machine anyway.
-                DOTNET_NOLOGO: "1",
-                DOTNET_CLI_TELEMETRY_OPTOUT: "1",
-                NO_COLOR: "1",
+        // Through the registry, never `spawn` directly: it is what enforces the machine-wide
+        // .NET process cap and what guarantees this process is swept on shutdown even if the
+        // pool loses track of it. `MSBUILD_ENV` is applied there, for every caller at once.
+        const tracked = sharedDotnetProcessRegistry(options.logger).spawnTracked({
+            command: options.runtime.dotnetCommand,
+            args: [options.runtime.entryPath],
+            options: {
+                cwd: options.cwd,
+                stdio: ["pipe", "pipe", "pipe"],
+                env: {
+                    ...process.env,
+                    // MSBuild colours and progress would corrupt the NDJSON stream if anything ever
+                    // wrote them to stdout, and neither is readable by a machine anyway.
+                    NO_COLOR: "1",
+                },
             },
+            kind: "solution-sidecar",
+            label: options.cwd,
         });
-        const probe = new DotnetProbe(child, options);
-        await probe.awaitHandshake(options.handshakeTimeoutMs);
+        const probe = new DotnetProbe(tracked.child, options);
+        probe.tracked = tracked;
+        try {
+            await probe.awaitHandshake(options.handshakeTimeoutMs);
+        }
+        catch (error) {
+            // A sidecar that never reports ready still holds a slot and a live process tree.
+            tracked.release();
+            throw error;
+        }
         return probe;
     }
     get sdkVersion() {
@@ -123,7 +140,9 @@ export class DotnetProbe {
         }
         this.exited = true;
         this.child.stdin.end();
-        this.child.kill();
+        // Release, not kill: the registry owns the tree kill and the slot, so going around it
+        // would free the process without freeing the capacity it was holding.
+        this.tracked?.release();
         this.rejectAll(new ProbeUnavailableError("Solution sidecar stopped"));
     }
     awaitHandshake(timeoutMs) {