不要让你的git(oc)碰你的DSH

42 2026-08-25 15:42 1

从[preview]不要让你的git碰大烧货（DSH）继续讨论：

今天早上42在 Windows 上从用户主目录(C:\Users\ [user])启动 opencode,启动时一个 git ls-files --others --exclude-standard 子进程烧 50 多秒 CPU 都走不完

于是42开始排查，发现了一些端倪

然后这究竟是怎么出现的呢？

github.com/deepseek-ai/deepseek-harness

packages/boot/app-boot/src/profile.ts

master



      

          if (stat !== undefined) {


            if (!stat.isSymbolicLink()) {


              throw new Error(`dsh: ${link} exists and is not a symlink; remove it so dsh can manage the installation fallback`)


            }


            if (readlinkSync(link) === target) return


            // unlink deletes the reparse point itself on Windows too; rmSync treats a


            // junction as a directory and throws EISDIR unless recursive.


            unlinkSync(link)


          }


          try {


            symlinkSync(target, link, 'junction')


          } catch (error) {


            // Concurrent launches heal the same fallback; losing the race to a


            // process writing the identical link is success, anything else is not.


            // The window between the lstat miss above and this write cannot be


            // staged deterministically from the public API.


            /* v8 ignore next 4 */


            if ((error as NodeJS.ErrnoException).code !== 'EEXIST'


              || !lstatSync(link).isSymbolicLink() || readlinkSync(link) !== target) {


              throw error


            }

github.com/deepseek-ai/deepseek-harness

packages/boot/app-boot/src/profile.ts

master



      

          for (const [packageName, target] of links) {


            const link = join(modulesDir, packageName)


            mkdirSync(dirname(link), { recursive: true })


            ensureSymlink(link, target)


          }

github.com/deepseek-ai/deepseek-harness

apps/cli/src/profile-boot.ts

master



      

          * plugin self-disposing persists the current tree) can bake composed rows


          * into this file — which would duplicate every bundle insert on the next


          * boot. The file exists on disk only because the Loader needs a real include


          * root to anchor `baseUrl` at the profile directory (the config dump anchors


          * on the same file, so both compose over the identical base).


          * @param name - the profile name.


          * @param userLayer - `false` skips parsing `cordis.patch.yml` (the default dump).


          * @returns the loaded profile.


          */


          export function prepareProfile(name: string, userLayer = true): Profile {


           healProfilesModuleFallback(INSTALL_ANCHOR)


           const profile = loadProfile(NAME, name, INSTALL_ANCHOR, undefined, { userLayer })


           writeFileSync(join(profile.dir, PROFILE_ROOT_FILENAME), PROFILE_ROOT_CONFIG)


           return profile


          }


          


          /** One profile's patch layers (application order) and the row index of its pre-flag composition. */


          interface ComposedProfile {


           profile: Profile


           /** Bundle layers concatenated — the part below the user layers on a live reload. */


           bundlePatches: PatchOptions[]

看了dsh源码，以上几行说明每次dsh启动时都会发生的构造指向pnpm install创造的存在junction的环的junction

（在包中，存在这样一对：

store/cordis/node_modules/@deepseek-ai/cordis-plugin-include →(junction) store/cordis-plugin-include

store/cordis-plugin-include/node_modules/@deepseek-ai/cordis   →(junction) store/cordis

)

而在window中，junction作为symlink在win的替代品，对git来说并非像快捷方式而是一个真实目录，所以git会在这一堆junction来回串

当然，ds方面并非没有意识到它的存在

github.com/deepseek-ai/deepseek-harness

.agents/notes/implemented/bug-fix/2026-08-12-unlink-stale-profile-fallback-links.md

master

# Agent Note: Unlink stale profile fallback links instead of rmSync



Status: implemented



English | [中文](2026-08-12-unlink-stale-profile-fallback-links.zh.md)



## Problem



`healProfilesModuleFallback` re-points `$DSH_HOME/profiles/node_modules` entries when an installation moves, and Windows hosts keep those entries as junctions. `ensureSymlink` deleted a stale entry with `rmSync(link)`, but Node treats a junction as a directory for removal: without `recursive`, `rmSync` throws `ERR_FS_EISDIR`, so every launch from a moved installation or a second worktree crashed before booting. The `replaces a wrong symlink` unit test reproduces that crash on Windows at the exact removal call.



## Decision



`ensureSymlink` removes a stale link with `unlinkSync(link)`. `unlink` deletes the reparse point or symlink itself on every platform and never descends into the target, which preserves the function's fail-loud guarantee that a real directory is never deleted. The [profile-plugin-bundles decision](../architecture/2026-08-05-profile-plugin-bundles.md) keeps owning the fallback's two-anchor resolution; this note owns only the removal primitive.



## Alternatives considered



**`rmSync(link, { recursive: true })`.** On Node 24 this deletes the junction without following its target, but `recursive` would silently delete a real directory that replaced the link between the `lstat` guard and the removal, weakening the fail-loud contract that motivates the guard.



**`rmdirSync(link)`.** Removes a junction on Windows as well, but it reads as directory removal for a link, and `unlinkSync` is the repository's existing junction-cleanup idiom.

此文件已被截断。显示原始文件

github.com/deepseek-ai/deepseek-harness

.agents/notes/implemented/bug-fix/2026-08-12-unlink-fixture-junctions-before-delete.md

master

# Agent Note: Unlink fixture junctions before recursive deletion



Status: implemented



English | [中文](2026-08-12-unlink-fixture-junctions-before-delete.zh.md)



## Problem



The install-lefthook and translation-pairing fixtures junction the repository's real `scripts/`, `node_modules`, and tsx package directories into fixture trees so installer probes resolve through them. Windows recursive deletion can treat a junction (a MOUNT_POINT reparse point) as a directory and follow it into its target; Git's `worktree remove` did exactly that and deleted the repository's tracked `scripts/` and tsx package (the incident's instrumentation pinned the deletion to that step). A fixture cleanup that trusts its deleter therefore deletes the repository's own sources instead of the fixture.



## Decision



`scripts/test-fixture-cleanup.ts` owns junction-safe fixture teardown: `unlinkFixtureLinks` walks a tree and unlinks every reparse point before `removeFixtureSafely` removes the now link-free tree (with Windows async-handle retries). Every affected `afterEach` and the pre-`worktree remove` hook call it. The general rule lives in `docs/defensive-patterns.md`: remove link-shaped paths with unlink, reserve recursive `rmSync` for known real directories.



## Alternatives considered



**Trust recursive deletion alone.** Rejected: whether a given deleter follows junctions is tool- and version-dependent, and one path through `git worktree remove` already destroyed tracked files; no cleanup may bet the repository on that behavior.



**Copy instead of junctioning the real directories.** Rejected: the fixtures exist to probe the real installer paths through their real contents, so copies would stop exercising the boundary under test.

此文件已被截断。显示原始文件

github.com/deepseek-ai/deepseek-harness

docs/defensive-patterns.md

master

# Defensive patterns



English | [中文](defensive-patterns.zh.md)



Hard-won bug-class rules: each pattern below is a class of defect that actually shipped or nearly shipped here, stated as the rule that prevents its recurrence. Read this before writing lifecycle, concurrency, subprocess, or teardown code. Test-tier counterparts (real entry path, world-verification, resource ownership) are in [testing.md](testing.md).



## Report orthogonal outcomes independently



A result can be several things at once — a process can time out AND exit 0 because it trapped the signal. Surface each independent fact (`timedOut`, `signal`, `exitCode`) on its own; never nest one flag's report inside another's branch, or a caller reads a cut-short run as a clean success.



## Honor public contracts on BOTH sides



When an implementation receives several representations of one outcome, normalize them before returning through the public API. `LlmAdapter.stream()` implementations may throw or emit `finish {kind:'error'|'aborted'}`, but `LlmRuntime.stream()` exposes model-request failures only as terminal finish chunks; middleware and consumer defects remain thrown. This keeps consumers from guessing whether a caught exception came from the provider, a wrapper, chunk logging, or their own assembly. Document the normalized contract where the type is defined; exercise every source form through the real consumer.



## Async state is not synchronous state



`agent.followup()` has no per-message completion or result; a background job's completion races turn boundaries; `reader.close()` fires for both EOF and disposal. Never treat `agent/status` or `whenIdle()` as the result of one follow-up: several queued follow-ups, steering, and injected work may share one `running` interval, while cancellation or disposal can discard unstarted items. An automation caller that truly owns a run must define its interval explicitly—for example, from its message's durable inbox receipt through the next whole-agent `idle`—and describe any selected output as interval-wide rather than causally attributed to that message. The guard cuts both ways: if the awaited transition can never occur, the wait hangs, so handle the "nothing to wait for" branch explicitly.



## Dispose must reach quiescence, not just request it

此文件已被截断。显示原始文件

这里都有提到这一问题，但是仅仅解决了junction导致删除而没有解决导致环的问题

现在让我们有请最vb的opencode出场！

opencode一出来就对所在目录一轮git快照

github.com/anomalyco/opencode

packages/opencode/src/snapshot/index.ts

dev



      

            }


          })


          


          const add = Effect.fnUntraced(function* () {


            yield* sync()


            const [diff, other] = yield* Effect.all(


              [


                git([...quote, ...args(["diff-files", "--name-only", "-z", "--", "."])], {


                  cwd: state.directory,


                }),


                git([...quote, ...args(["ls-files", "--full-name", "--others", "--exclude-standard", "-z", "--", "."])], {


                  cwd: state.directory,


                }),


              ],


              { concurrency: 2 },


            )


            if (diff.code !== 0 || other.code !== 0) {


              yield* Effect.logWarning("failed to list snapshot files", {


                diffCode: diff.code,


                diffStderr: diff.stderr,


                otherCode: other.code,

github.com/anomalyco/opencode

packages/opencode/src/snapshot/index.ts

dev



      

          


          const state = yield* InstanceState.make<State>(


            Effect.fn("Snapshot.state")(function* (ctx) {


              const state = {


                directory: ctx.directory,


                worktree: ctx.worktree,


                gitdir: path.join(Global.Path.data, "snapshot", ctx.project.id, Hash.fast(ctx.worktree)),


                vcs: ctx.project.vcs,


              }


          


              const args = (cmd: string[]) => ["--git-dir", state.gitdir, "--work-tree", state.worktree, ...cmd]


          


              const encodeNulTerminatedPaths = (files: string[]) => files.join("\0") + "\0"


              const encodeTopLevelLiteralPathspecs = (files: string[]) =>


                encodeNulTerminatedPaths(files.map((file) => `:(top,literal)${file}`))


          


              const git = Effect.fnUntraced(


                function* (cmd: string[], opts?: { cwd?: string; env?: Record<string, string>; stdin?: string }) {


                  const result = yield* appProcess.run(


                    ChildProcess.make("git", cmd, { cwd: opts?.cwd, env: opts?.env, extendEnv: true }),


                    { stdin: opts?.stdin },

github.com/anomalyco/opencode

packages/core/src/git.ts

dev



      

            worktree: AbsolutePath,


            gitDirectory: AbsolutePath,


            commonDirectory: AbsolutePath,


          }) {}


          


          export const ChangeSet = Schema.String.pipe(Schema.brand("Git.ChangeSet"))


          export type ChangeSet = typeof ChangeSet.Type


          


          export const TreeID = Schema.String.pipe(Schema.brand("Git.TreeID"))


          export type TreeID = typeof TreeID.Type


          


          export class OperationError extends Schema.TaggedErrorClass<OperationError>()("Git.OperationError", {


            operation: Schema.Literals([


              "clone",


              "fetch",


              "checkout",


              "reset",


              "create",


              "refresh",


              "write_tree",


              "list_files",

github.com/anomalyco/opencode

packages/core/src/git.ts

dev



      

            ignores?: Repository


            maximumUntrackedFileBytes?: number


          }) {


            const list = (args: string[]) =>


              repositoryOperation("refresh", input.repository, args).pipe(


                Effect.map((result) => result.text.split("\0").filter(Boolean)),


              )


            const [tracked, untracked] = yield* Effect.all(


              [


                list(["diff-files", "--name-only", "-z", "--", input.scope]),


                list(["ls-files", "--others", "--exclude-standard", "-z", "--", input.scope]),


              ],


              { concurrency: 2 },


            )


            const candidates = Array.from(new Set([...tracked, ...untracked]))


            if (!candidates.length) return { skipped: [] }


            const ignored = input.ignores


              ? new Set(


                  (yield* repositoryOperation("refresh", input.ignores, ["check-ignore", "--no-index", "--stdin", "-z"], {


                    stdin: candidates.join("\0") + "\0",


                  }).pipe(Effect.catch(() => Effect.succeed({ text: "", stderr: "" })))).text

github.com/anomalyco/opencode

packages/core/src/git.ts

dev



      

            return yield* new PatchError({


              operation: "capture",


              directory: input.path,


              message: tracked.stderr.trim() || tracked.text.trim() || "Failed to capture tracked changes",


            })


          }


          


          const untracked = yield* execute(


            input.repository.worktree,


            proc,


          )(["ls-files", "--others", "--exclude-standard", "-z", "--", scope]).pipe(


            Effect.mapError(


              (cause) => new PatchError({ operation: "capture", directory: input.path, message: cause.message, cause }),


            ),


          )


          if (untracked.exitCode !== 0) {


            return yield* new PatchError({


              operation: "capture",


              directory: input.path,


              message: untracked.stderr.trim() || untracked.text.trim() || "Failed to list untracked changes",


            })

于是…

cordis ──junction──> cordis-plugin-include ──junction──> cordis ──> …

   ^                                                        │

   └──────────────────── 来回串 <────────────────────────────┘

于是git飞起来了

目前的临时补救方法：别让git碰dsh

即：把~/.dsh/塞进主目录的 .gitignore

说了这么多，其他的agent难道就不会出问题吗？

很显然，这本质上是git对环没有环检测的问题，因此理论上其他存在git的agent(废话)都有可能中招，那么实际呢？

github.com/openai/codex

codex-rs/git-utils/src/info.rs

main



      

          pub fn get_git_repo_root(base_dir: &Path) -> Option<PathBuf> {


              let base = if base_dir.is_dir() {


                  base_dir


              } else {


                  base_dir.parent()?


              };


              find_ancestor_git_entry(base).map(|(repo_root, _)| repo_root)


          }


          


          /// Timeout for git commands to prevent freezing on large repositories


          const GIT_COMMAND_TIMEOUT: TokioDuration = TokioDuration::from_secs(5);


          const DISABLED_HOOKS_PATH: &str = if cfg!(windows) { "NUL" } else { "/dev/null" };


          


          #[derive(Serialize, Deserialize, Clone, Debug, JsonSchema, TS)]


          pub struct GitInfo {


              /// Current commit hash (SHA)


              #[serde(skip_serializing_if = "Option::is_none")]


              pub commit_hash: Option<GitSha>,


              /// Current branch name


              #[serde(skip_serializing_if = "Option::is_none")]


              pub branch: Option<String>,

codex超过5s就会超死，所以不会卡那么久

github.com/earendil-works/pi

packages/agent/src/harness/env/nodejs.ts

main



      

          		try {


          			const entries = await readdir(resolved, { withFileTypes: true });


          			const infos: FileInfo[] = [];


          			for (const entry of entries) {


          				const loopAbort = abortResult<FileInfo[]>(abortSignal, resolved);


          				if (loopAbort) return loopAbort;


          				const entryPath = resolve(resolved, entry.name);


          				try {


          					const info = fileInfoFromStats(entryPath, await lstat(entryPath));


          					if (info.ok) infos.push(info.value);


          				} catch (error) {


          					return err(toFileError(error, entryPath));


          				}


          			}


          			return ok(infos);


          		} catch (error) {


          			return err(toFileError(error, resolved));


          		}


          	}

此文件已被截断。显示原始文件

pi的非递归，只看一层，没有陷入

github.com/can1357/oh-my-pi

packages/coding-agent/src/utils/git.ts

main



      

          // ════════════════════════════════════════════════════════════════════════════


          // API: ls


          // ════════════════════════════════════════════════════════════════════════════


          


          export const ls = {


          	/** List files tracked or untracked by git. */


          	async files(


          		cwd: string,


          		options: { others?: boolean; excludeStandard?: boolean; signal?: AbortSignal } = {},


          	): Promise<string[]> {


          		const args = ["ls-files"];


          		if (options.others) args.push("--others");


          		if (options.excludeStandard) args.push("--exclude-standard");


          		return splitLines(await runText(cwd, args, { readOnly: true, signal: options.signal }));


          	},


          


          	/** List untracked files (excludes ignored). */


          	async untracked(cwd: string, signal?: AbortSignal): Promise<string[]> {


          		return ls.files(cwd, { others: true, excludeStandard: true, signal });


          	},

github.com/can1357/oh-my-pi

packages/coding-agent/src/security/preflight.ts

main



      

          	files(cwd: string, signal?: AbortSignal): Promise<string[]>;


          	untracked(cwd: string, signal?: AbortSignal): Promise<string[]>;


          }


          


          export const DEFAULT_SECURITY_GIT_ADAPTER: SecurityGitAdapter = {


          	root: (cwd, signal) => git.repo.root(cwd, signal),


          	headSha: (cwd, signal) => git.head.sha(cwd, signal),


          	resolveRef: (cwd, refName, signal) => git.ref.resolve(cwd, refName, signal),


          	diffTree: (cwd, base, head, signal) => git.diff.tree(cwd, base, head, { signal }),


          	status: (cwd, signal) => git.status(cwd, { porcelainV1: true, untrackedFiles: "all", signal }),


          	files: (cwd, signal) => git.ls.files(cwd, { signal }),


          	untracked: (cwd, signal) => git.ls.untracked(cwd, signal),


          };


          


          export class StaleSecurityScanPlanError extends Error {


          	constructor(


          		readonly expected: string,


          		readonly actual: string,


          	) {


          		super(`Security scan plan is stale: expected ${expected}, got ${actual}. Run security preflight again.`);


          		this.name = "StaleSecurityScanPlanError";

omp有此类问题，但其实

github.com/can1357/oh-my-pi

Isolated task spawns OOM/SIGTRAP the whole process on multi-GB working trees (isolation.mode auto/apfs)

已打开 10:16PM - 18 Aug 26 UTC

已关闭 08:25PM - 20 Aug 26 UTC

mmajoris

bug

prio:p2

tool

agent

triaged

## Summary

With `task.isolation.mode: auto` (or `apfs`), spawning an **isolated…** task subagent in a repo whose working tree carries multiple GB across many files kills the whole OMP process with a bun panic (`SIGTRAP` / `EXC_BREAKPOINT`) — or, less often, surfaces `Out of memory` as a task error. The isolation snapshot appears to buffer working-tree content in memory instead of streaming/CoW-cloning, so large trees exhaust it; when the allocation failure lands in a native path the process traps, taking the TUI and all in-process subagents with it. On our 7.9GB repo this crashed 100% of isolated spawns — any session there becomes a crash loop.

## Environment

- macOS (Darwin 25.4.0, APFS, Apple Silicon)
- bun 1.3.14
- @oh-my-pi/pi-coding-agent 17.3.5 and 17.3.7 (identical crashes on both)
- Reproduces in a bare config dir (`PI_CONFIG_DIR` staging, no extensions/rules loaded)

## Repro

```sh
mkdir bigtree && cd bigtree && git init
echo hi > README.md && git add README.md && git commit -m init
# ~8GB across ~30k untracked files (the many-files axis matters):
python3 - <<'PY'
import os
buf = os.urandom(262144)
for d in range(300):
os.makedirs(f"data/d{d}", exist_ok=True)
for f in range(100):
with open(f"data/d{d}/f{f}.bin", "wb") as fh:
fh.write(os.urandom(16)); fh.write(buf)
PY
omp # task.isolation.mode: auto
# prompt: "Spawn one task subagent with isolated: true to run pwd; wait for its result."
```

Observed outcomes across runs of this shape:
- **Process crash**: interactive TUI drops to shell with `zsh: trace trap omp`; headless `-p` exits 133 (128+SIGTRAP). This is the common case on our real 7.9GB / 34k-file repo — 15+ crashes, all with identical faulting frames.
- **Graceful-ish variant** (same mechanism, luckier allocation site): seat survives, task fails with `Task execution failed: Isolated subagent execution requires a git repository. Out of memory` (note the misleading first clause — the cwd IS a git repo; the git detection itself appears to be failing under memory pressure).

Control points, same environment: 2.7GB across 4 files → OK. 31k empty files (0 bytes) → OK. ~8GB across 31k files → OOM/crash. So it scales with total content volume held across many files, consistent with whole-tree buffering.

## Crash signature

`EXC_BREAKPOINT (SIGTRAP)`, "Trace/BPT trap: 5"; faulting thread top frames at identical bun image offsets `4506192 / 4468052 / 4488216` in every report (stripped binary, no symbols). `.ips` files available on request. No panic text reaches the terminal (TUI teardown swallows stderr) and nothing lands on stderr in `-p` runs.

Possibly related: the isolated worker's cwd comes back **HOME-double-prefixed** — `pwd` inside the worktree reports `/Users/<user>/Users/<user>/<agent-dir>/wt/<id>/m` — so worktree path construction also misbehaves on this path shape.

Also: crashed runs leave partial deep copies in `wt/` (we found two 13GB remnants from the 7.9GB repo) — the backend appears to fall back to physical copying rather than an APFS clone even with `mode: apfs` forced.

## Expected

Stream or CoW-clone the snapshot (never hold the tree in memory); on any failure, refuse the spawn or run it non-isolated with a clear error — never panic the host process. A knob to exclude ignored/untracked bulk (node_modules, logs) from snapshots would also shrink the exposure dramatically.

## Workaround

`task.isolation.mode: none`.

也是有针对防护，但只是防护了内容过大的问题，function问题没修

github.com/MoonshotAI/kimi-code

apps/kimi-code/src/feedback/codebase/scanner.ts

main



      

            }


          }


          


          async function scanWithGit(


            root: string,


            limits: ScanCodebaseLimits,


            signal?: AbortSignal,


          ): Promise<CollectedFiles> {


            const { stdout } = await execFileAsync(


              'git',


              ['-C', root, 'ls-files', '-co', '--exclude-standard', '-z'],


              { encoding: 'buffer', maxBuffer: 1024 * 1024 * 64, signal },


            );


          


            throwIfAborted(signal);


            const relativePaths = splitNull(stdout);


            const files: FeedbackCodebaseFile[] = [];


            let exceedsLimit: FeedbackCodebaseLimitExceeded | undefined;


            let totalSize = 0;


          


            for (const relativePath of relativePaths) {

kimi-code在进行反馈上报的时候会爆

github.com/XiaomiMiMo/MiMo-Code

packages/opencode/src/snapshot/index.ts

main



      

            yield* fs.writeFileString(target, text ? `${text}\n` : "").pipe(Effect.orDie)


          })


          


          const add = Effect.fnUntraced(function* () {


            yield* sync()


            const [diff, other] = yield* Effect.all(


              [


                git([...quote, ...args(["diff-files", "--name-only", "-z", "--", "."])], {


                  cwd: state.directory,


                }),


                git([...quote, ...args(["ls-files", "--others", "--exclude-standard", "-z", "--", "."])], {


                  cwd: state.directory,


                }),


              ],


              { concurrency: 2 },


            )


            if (diff.code !== 0 || other.code !== 0) {


              log.warn("failed to list snapshot files", {


                diffCode: diff.code,


                diffStderr: diff.stderr,


                otherCode: other.code,

mimo-code在fork之后没有发现此类问题，也炸了

所以opencode，omp,kimi-code和mimmocode都会出现这一问题，但仅有opencode(+mimocode)会在启动时出现问题

最新回复 (3)

chenastron 08-25 15:46

1楼

是在用户主目录初始化了一个 git 仓库吗？不应该这么做吧
42 楼主 08-25 15:49

2楼

如果正好有一个大**用户直接这样做就会炸，而这本应该被避免
42 楼主 08-26 21:54

3楼

https://linux.do/t/topic/2815902?u=4242

看不下去看这个

* 帖子来源Linux.do

附近帖子