Pre-spawn process worker in cli.py to avoid the fds_to_keep race

The first two commits made the macOS Tahoe segfault non-fatal by
disabling the fork fallback, but every spawn after Textual booted
still failed with `bad value(s) in fds_to_keep` — leaving the user
with a "Process worker unavailable; falling back" popup and the
slower in-process executor on every query.

Root cause: `multiprocessing.spawn` snapshots the parent's open file
descriptors at spawn time. Once Textual's `App.__init__` has
registered its signal-handler pipes and event-loop FDs, several of
those are not inheritable, and spawn aborts before the child even
runs. The previous lazy creation in the idle scheduler always hit
this race.

Fix: spawn the worker in `cli.py` *before* `SSMSTUI(...)` is
constructed. That's the latest moment at which the parent's FD set
is still clean. The new `_prewarm_process_worker(runtime)` helper
returns a live `ProcessWorkerClient`, or `None` if the worker is
disabled / mocked / spawn raised — in which case we fall through to
the lazy path inside the UI (with the in-process fallback on
darwin).

The pre-spawned client is passed into `SSMSTUI` via a new
`process_worker_client` kwarg and stashed as
`self._process_worker_client`. `ProcessWorkerLifecycleMixin` already
returns the cached client first, so no other changes are needed.

Verified on macOS Tahoe 26.4.1 / Python 3.14 / PostgreSQL over TLS:
the popup no longer appears and queries run in the worker process.

Author: brentrager

sqlit/cli.py

@@ -177,6 +177,32 @@ def _sane_tty() -> None:
         pass
 
 
+def _prewarm_process_worker(runtime: RuntimeConfig) -> Any | None:
+    """Spawn the process worker before the Textual App is constructed.
+
+    `multiprocessing.spawn` collects the parent's open file descriptors at
+    spawn time. Textual's `App.__init__` registers signal-handler pipes
+    and other non-inheritable FDs, which cause spawn to abort with
+    `ValueError: bad value(s) in fds_to_keep` (see issue #189). Spawning
+    here — before the App is constructed — is the latest point at which
+    the FD set is still clean.
+
+    Returns the live client, or None if spawn fails or the worker is
+    disabled. On failure we fall through to the lazy path inside the UI;
+    on macOS that path raises and the in-process executor takes over.
+    """
+    if not runtime.process_worker:
+        return None
+    if runtime.mock.enabled:
+        return None
+    try:
+        from sqlit.domains.process_worker.app.process_worker_client import ProcessWorkerClient
+
+        return ProcessWorkerClient()
+    except Exception:
+        return None
+
+
 def _run_app(app: Any) -> int:
     exit_code: int | None = None
     handled_signals = [signal.SIGINT, signal.SIGTERM]
@@ -843,10 +869,14 @@ def main() -> int:
             print(f"Error: {exc}")
             return 1
 
+        # Spawn the worker before the Textual App is constructed; see
+        # _prewarm_process_worker for why this matters on macOS.
+        process_worker_client = _prewarm_process_worker(runtime)
         app = SSMSTUI(
             services=services,
             startup_connection=startup_config,
             exclusive_connection=exclusive_connection,
+            process_worker_client=process_worker_client,
         )
         exit_code = _run_app(app)
         if exit_code != 0:
@@ -907,7 +937,12 @@ def main() -> int:
             print(f"Error: {alert_error}")
             return 1
 
-        app = SSMSTUI(services=services, startup_connection=temp_config)
+        process_worker_client = _prewarm_process_worker(runtime)
+        app = SSMSTUI(
+            services=services,
+            startup_connection=temp_config,
+            process_worker_client=process_worker_client,
+        )
         return _run_app(app)
 
     if args.command in {"connections", "connection"}:

sqlit/domains/shell/app/main.py

@@ -100,9 +100,16 @@ def __init__(
         runtime: RuntimeConfig | None = None,
         startup_connection: ConnectionConfig | None = None,
         exclusive_connection: bool = False,
+        process_worker_client: Any | None = None,
     ):
         super().__init__()
         self.services = services or build_app_services(runtime or RuntimeConfig.from_env())
+        # A pre-spawned worker handed in from cli.py, before Textual's
+        # FD set was contaminated. ProcessWorkerLifecycleMixin already
+        # checks self._process_worker_client first, so seeding it here
+        # short-circuits the lazy spawn path.
+        if process_worker_client is not None:
+            self._process_worker_client = process_worker_client
         from sqlit.core.connection_manager import ConnectionManager
 
         self._connection_manager = ConnectionManager(self.services)