fix(server): delegate cgroups to agent scopes#23913

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

⚙️ Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: fix/issue-21730
• File: .coderabbit.config.ts
• Commit: 74c4ffc
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Team
• Run ID: a42a1fc4-0ba0-48f2-a518-04c6c0c9f7b2

📥 Commits

Reviewing files that changed from the base of the PR and between 51273020db3245f4ec29514a419d29b5dcb012dc and 74c4ffc4ca044c6bfb63cb203237a6aacb3b238c.

📒 Files selected for processing: 2

• apps/server/src/process/agentScope.test.ts
• apps/server/src/process/agentScope.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Systemd scope options and capability probes now request Delegate=yes alongside the stop timeout. A test checks that agent, Codex, and restart-surviving terminal launches include the delegation property.

Changes: Systemd Scope Delegation

Layer / File(s)	Summary
Add delegation to scope options and verify launches apps/server/src/process/agentScope.ts, apps/server/src/process/agentScope.test.ts	The shared options, capability probes, and agent scope options include Delegate=yes alongside the stop timeout. A test checks agent, Codex, and restart-surviving terminal launches.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: only21mil, t3dotgg

The delegation change has no established merge-blocking issue. Compatibility with older systemd versions remains unverified.

Check name	Status	Explanation
Title check	Passed	The title clearly and concisely describes the main change: enabling cgroup delegation for server agent scopes.
Description check	Passed	The description includes all required sections. It explains the Linux systemd problem, the implementation, issue and scope context, focused test results, runtime verification, limitations, and the mod…
Linked Issues check	Passed	[#21730] Requirement: agent systemd scopes must delegate cgroups so rootless nested containers (kind with Podman or Docker rootless) can manage their cgroups. At head, apps/server/src/process/agentSco…
Out of Scope Changes check	Passed	The change touches two files: apps/server/src/process/agentScope.ts and its test file. The agentScope.ts change adds Delegate=yes to the shared scope options. It keeps the stop timeout and OOM policy …

Full details: Description check

Explanation

The description includes all required sections. It explains the Linux systemd problem, the implementation, issue and scope context, focused test results, runtime verification, limitations, and the models and harnesses used.

Full details: Linked Issues check

Explanation

[#21730] Requirement: agent systemd scopes must delegate cgroups so rootless nested containers (kind with Podman or Docker rootless) can manage their cgroups. At head, apps/server/src/process/agentScope.ts defines SCOPE_OPTIONS = ["--property=TimeoutStopSec=10s", "--property=Delegate=yes"]. These options feed both startup capability probes (with and without --property=OOMPolicy=stop) and the scope launch options in wrap. The Codex app-server launch path uses the same scope wrap, and the test asserts Delegate=yes for the agent, Codex, and restart-surviving terminal launches (apps/server/src/process/agentScope.test.ts, 'delegates every agent scope so rootless containers can manage their cgroups'). Existing TimeoutStopSec and OOMPolicy handling is kept. The issue proposed an explicit controller list (Delegate=cpu cpuset io memory pids); the PR uses Delegate=yes, which meets the stated expected behavior. Limits of evidence: the PR diff for the test file was unavailable, so the test was verified by reading the file at head, not by diff. The full kind cluster creation was not verified; the PR reports a runtime check that reached node preparation, based on an external transcript that I did not read. The delegation requirement itself is met by code and test evidence at head.

Full details: Out of Scope Changes check

Explanation

The change touches two files: apps/server/src/process/agentScope.ts and its test file. The agentScope.ts change adds Delegate=yes to the shared scope options. It keeps the stop timeout and OOM policy behavior. The test file adds a delegation assertion. Both files directly implement the delegation requirement of #21730. The option applies to all scopes that use the shared launch path: agent processes, shared Codex app-server processes, and restart-surviving terminals. Per the test, terminal scopes use the same app-t3code-agents.slice as agent scopes, so delegation for terminals follows from the shared launch path. It is not an unrelated change. No unrelated refactoring or documentation changes were found in the inspected evidence. The test diff could not be read, so the check of the test file rests on the file content at head.

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR