Fix #189: process worker fork-safety on macOS Tahoe

[brentrager]

Thanks again for sqlit — it's the cleanest of the SQL TUIs I've tried.

Fixes #189. macOS Tahoe (26.4+) widened the set of system libraries that abort when initialized after fork(), which has been quietly breaking quite a few Python projects (celery, gunicorn, psycopg2 all have open issues from the last few months — links below). For sqlit, the symptom is that the process worker either hangs with Worker connection closed. or segfaults the child when expanding a folder or running a query.

This PR has been split per your request (#207 review) — the psycopg v3 driver swap and its supporting adapter/test changes now live in #222.

Commits

1. Drop the spawn → fork fallback on darwin; redirect worker stderr. When multiprocessing.spawn fails with bad value(s) in fds_to_keep, the current code falls back to fork(). On Tahoe that's no longer safe — CoreFoundation, Security.framework, libsystem_trace's os_log, and libsystem_info's getaddrinfo all now abort if they were loaded by the parent before fork. Letting spawn fail and surfacing it to the caller lets the in-process fallback take over instead. The worker also now redirects its stdout/stderr to $SQLIT_WORKER_LOG (defaults to <tmpdir>/sqlit-worker.log) and enables faulthandler, so future C-level faults aren't invisible behind a closed pipe — that's what let me find the segfault site in the first place.

2. Pre-spawn the worker in cli.py before App.__init__. This is the long-term fix from the issue addendum. multiprocessing.spawn snapshots the parent's open FDs at spawn time, and Textual's App.__init__ registers signal-handler pipes that aren't inheritable — that's the bad value(s) in fds_to_keep ValueError. The previous lazy creation in idle_scheduler.py:_warm was racing this. Spawning before SSMSTUI(...) is constructed is the latest moment at which the FD set is still clean. The pre-spawned client is plumbed in via a new process_worker_client kwarg on SSMSTUI; ProcessWorkerLifecycleMixin already returns the cached client first, so no other changes are needed. If pre-spawn fails for any reason, the lazy path still runs (and on darwin, that path now correctly falls back to in-process execution per commit 1).

3. Unit tests for the new code paths. New tests/unit/test_process_worker_fallback.py and tests/unit/test_cli_prewarm.py cover the darwin re-raise, the worker-log env override, the prewarm gating on runtime.process_worker / runtime.mock, prewarm exception-swallowing, and the SSMSTUI kwarg plumbing.

Result on macOS Tahoe 26.4.1 / Python 3.14

State	Before	After commit 1 only	After both
Worker crash on tree expand / query	Hard segfault, Worker connection closed.	In-process fallback, popup every query	Worker runs, no popup
Query latency (25-row PG table over WAN+TLS)	n/a (crash)	~10s (UI thread blocked)	~0.5s
Query cancellation	Not available	Not available (in-process fallback)	Available

Tests

uv run pytest tests/unit — 837 passed, 1 skipped, including the 9 new tests in this PR.

Related upstream regressions on Tahoe (for context — this isn't sqlit-specific)

• Crash in setproctitle on macOS Tahoe (26.0) #9893 celery/celery#9894 — setproctitle abort on Tahoe via libsystem_trace
• macOS: Workers crash with NSCharacterSet fork-safety error after upgrading to 25.1.0 benoitc/gunicorn#3526 — NSCharacterSet fork-safety abort on Tahoe
• psycopg2-binary 2.9.6 breaks celery worker on Apple silicon psycopg/psycopg2#1593 — libssl bundling pulls Security.framework on macOS; psycopg3 fixes
• multiprocessing's default posix start method of 'fork' is broken: change to `'forkserver' || 'spawn' python/cpython#84559 — CPython 3.14 makes forkserver default on POSIX (partial mitigation)

Tradeoffs to flag

• Commit 1 costs query cancellation on darwin when spawn fails (the in-process fallback can't cancel mid-query). Commit 2 makes that case rare in practice.
• Commit 2 always spawns the worker at startup when process_worker=True (the default) — there's no longer an idle-only path on the first launch. Cost: one extra Python subprocess at TUI startup. Benefit: no race, no popup, worker is hot.

Happy to iterate on either commit if you'd prefer a different approach.

[Maxteabag]

Hey! Thanks so much for sharing the fix.

It seems like a lot of different thing in here are bundled together - of completely different nature. As you suggested yourself, I think it would be a good idea to split this into two PRs.

[brentrager]

Done — split into two PRs as you suggested:

• Fix #189: process worker fork-safety on macOS Tahoe #207 (this PR): macOS Tahoe fork-safety fix. Three commits — disable fork fallback on darwin + worker stderr redirect, pre-spawn the worker in cli.py before App.__init__, and unit tests for both. No driver or dependency changes.
• Switch PostgreSQL / CockroachDB adapter to psycopg v3 #222: the psycopg v3 driver swap and the two CursorBasedAdapter behavior fixes that come with it. Independent of Fix #189: process worker fork-safety on macOS Tahoe #207 and can be reviewed on its own merits.

I force-pushed brentrager:fix/macos-tahoe-fork-segfault to remove the psycopg3 commits from this PR's history. Let me know if you'd like further reshaping on either one.