docs(TODO): performance review — Pass 8 findings (8a–8c) - #3
Merged
Conversation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SqFPHPDhQSfYu42wNJqKAV
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SqFPHPDhQSfYu42wNJqKAV
… order Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SqFPHPDhQSfYu42wNJqKAV
EraPartner
marked this pull request as ready for review
July 13, 2026 07:16
EraPartner
added a commit
that referenced
this pull request
Jul 13, 2026
* perf(sync): generate each vendored reference copy once, not per target The reference copy is target-independent (canonical content + version + canonical SHA-256), yet gen_vendored ran once per file per target in --check mode and twice per file per target in sync mode — 18-36 gen_vendored/shasum spawns where 3 suffice, paid on every commit via the pre-commit hook (~1-2s on macOS, where sha256_of falls back to Perl shasum). Generate the references up front into a scratch REF_DIR; check mode cmp's against them, sync mode installs them via a same-dir temp + mv (atomicity kept) and cmp's the landed file for the write-verify. Pass 8a P2 from TODO.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum * perf(audit): scan the whole index with one git grep pass Replace the per-file mktemp/git-show/grep/rm cycle (~5-6 fork/execs + a temp-file write/read per tracked file, every commit) with a single `git grep --cached -I -nE` over the index — same staged-blob semantics as `git show :<file>`, -I skips binaries, file:line-only reporting kept. Filename checks now loop over the git ls-files list alone, and blob extraction happens only for *.pem files. Also fixed while here: a bare id_rsa/id_ed25519 committed at the repo ROOT now trips the filename check — the old */id_rsa pattern required a leading directory component, so root-level keys were missed. Pass 8a P3 from TODO.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum * perf(launcher): exclude .git from plugin/statusline staging at copy time sandbox_stage_claude_config copied plugins/ and statusline/ wholesale with cp -a — including their multi-MB .git dirs — then deleted those dirs with find -exec rm -rf, paying full copy I/O for data immediately discarded on the interactive sandbox-start path. Stage the two git-clone trees via tar --exclude .git (bsdtar + GNU tar compatible, bash-3.2 safe) so .git is never copied; plain items keep cp -a. Vendored copy re-synced. Pass 8a P3 from TODO.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum * perf(sandbox): cheap rebuilds + one fewer exec per launch Dockerfile: move the image-wide setuid/setgid strip to just before the frequently-edited COPY block, so a routine sync.sh allowlist/script edit no longer re-runs a full-filesystem traversal (~10-40s in the builder VM) on every rebuild. A scoped strip over the COPY'd paths (/usr/local/{sbin,bin}, /usr/local/share/dev-sandbox, /etc/squid) is the new last layer, preserving the defense-in-depth coverage of the COPY'd files at near-zero cost. bin/dev: fold the proxy-wait into the top of the lifecycle exec — on warm reuse the first probe succeeds, so the standalone exec paid a container-CLI + XPC round-trip (~100-300ms) per launch for nothing. The wait keeps its barrier role for the start-stopped race. Poll at 0.2s (here and in post-create.sh) instead of 1s, trimming ~0.5s avg off cold starts. Pass 8b P3s from TODO.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum * perf(ci): cache the egress-test image build; cut redundant jobs and scans - egress-test: build via SHA-pinned setup-buildx + build-push-action with the GHA layer cache (cache-from/to type=gha, load: true), then run the smoke test with SKIP_BUILD=1. The Dockerfile's deliberate layer ordering finally pays off in CI: cache-hit builds drop from ~4-8 min (the pipeline's long pole) to seconds. - codeql.yml: triggers scoped to .github/workflows/** and .github/codeql/** — the only paths the actions-language analysis reads. Safe: CI Complete, not CodeQL, is the required check. - Weekly schedule now runs only the rule-DB-dependent scans (Trivy + gitleaks); the six deterministic jobs get if: github.event_name != 'schedule', and the gate tolerates their by-design skips on schedule runs only. - Trivy: one scan (format sarif + exit-code 1) instead of two identical back-to-back scans; Trivy writes the SARIF before applying the exit code, so gating + Security-tab upload are both preserved. - quality-gate/ci-complete collapsed into a single "CI Complete" job (same required-check name, full needs list, skipped-counts-as-failure kept) — removes a serial runner allocation from every run's critical path. - squid job: apt packages installed via SHA-pinned awalsh128/cache-apt-pkgs-action; cache-hit runs skip the ~25-50s apt-get update entirely. Pass 8c P2 + P3s from TODO.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum * docs: mark all 11 Pass 8 performance findings implemented; changelog entry Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum * perf(ci): drop squid apt-cache action — it startup-fails CI awalsh128/cache-apt-pkgs-action@v1.6.3 triggers a GitHub Actions startup_failure: the whole CI run fails to start, no jobs execute, and GitHub surfaces no parse error. Isolated by bisecting the workflow on throwaway branches (only this step fails; still fails with the version input quoted and with all nested action SHAs verified to resolve). Revert the squid job to plain apt-get update + install; keep the other 10 Pass-8 findings. Update CHANGELOG/TODO to reflect 10 of 11 landed. --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: EraPartner <derbies_vested.3q@icloud.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a dedicated Pass 8 — Performance review section to
TODO.md, produced by three sequential review passes over the whole repo. Findings are deduped against the performance items already recorded in Passes 1–3 (audit.sh grep-per-pattern, devcontainer double-scan, Dockerfile COPY ordering, unpinned apt, CodeQL concurrency group) — none of those are resurfaced.No code changes — this PR is documentation of findings only, structured so a later agent can pick up implementation from the tracker and the "suggested working order" list.
Findings overview (2 × P2, 9 × P3)
Pass 8a — core shell tooling
sync.shre-runsgen_vendored(with ashasumspawn) once or twice per file per target instead of once per file — 18–36 runs where 3 suffice; this is per-commit latency via the pre-commit hook (~1–2 s on macOS).audit.shstill spawns ~5–6 processes + a temp file per tracked file; a singlegit grep -I -nE --cachedpass would do the whole scan in one process.launcher-common.shstages plugin/statusline trees by copying their multi-MB.gitdirs and then deleting them, on the interactive start path.Pass 8b — sandbox runtime
find /is the last Dockerfile layer, after the frequently-edited COPY block — every routine allowlist/script edit re-pays a full-filesystem traversal (~10–40 s per rebuild).bin/devruns the proxy-wait as its owncontainer execon every launch (redundant on warm reuse) with a 1 s poll granularity on cold starts.Pass 8c — CI
egress-testjob rebuilds the sandbox image from scratch with no layer caching — ~4–8 min per run, the long pole of the pipeline; buildx + GHA cache + the existingSKIP_BUILD=1support fixes it..github/workflows/**; scope its path triggers.quality-gate→ci-completeis two serial runner allocations doing the same aggregation.squidjob apt-installs from the network every run with no caching.Each pass also records a "checked and found clean" list so future agents don't re-investigate settled ground.
Testing
pre-commithook (audit +sync.sh --check) passed on each commit.🤖 Generated with Claude Code
https://claude.ai/code/session_01SqFPHPDhQSfYu42wNJqKAV
Generated by Claude Code