不要让你的git碰DSH

42x · 2026 年8 月 25 日 07:21

今天早上42在 Windows 上从用户主目录(C:\Users\ [user])启动 opencode,启动时一个 git ls-files --others --exclude-standard 子进程烧 50 多秒 CPU 都走不完

于是42开始排查，发现了一些端倪

然后这究竟是怎么出现的呢？

packages/boot/app-boot/src/profile.ts

master


      
          if (stat !== undefined) {
            if (!stat.isSymbolicLink()) {
              throw new Error(`dsh: ${link} exists and is not a symlink; remove it so dsh can manage the installation fallback`)
            }
            if (readlinkSync(link) === target) return
            // unlink deletes the reparse point itself on Windows too; rmSync treats a
            // junction as a directory and throws EISDIR unless recursive.
            unlinkSync(link)
          }
          try {
            symlinkSync(target, link, 'junction')
          } catch (error) {
            // Concurrent launches heal the same fallback; losing the race to a
            // process writing the identical link is success, anything else is not.
            // The window between the lstat miss above and this write cannot be
            // staged deterministically from the public API.
            /* v8 ignore next 4 */
            if ((error as NodeJS.ErrnoException).code !== 'EEXIST'
              || !lstatSync(link).isSymbolicLink() || readlinkSync(link) !== target) {
              throw error
            }

github.com/deepseek-ai/deepseek-harness

packages/boot/app-boot/src/profile.ts

master


      
          for (const [packageName, target] of links) {
            const link = join(modulesDir, packageName)
            mkdirSync(dirname(link), { recursive: true })
            ensureSymlink(link, target)
          }

github.com/deepseek-ai/deepseek-harness

apps/cli/src/profile-boot.ts

master


      
          * plugin self-disposing persists the current tree) can bake composed rows
          * into this file — which would duplicate every bundle insert on the next
          * boot. The file exists on disk only because the Loader needs a real include
          * root to anchor `baseUrl` at the profile directory (the config dump anchors
          * on the same file, so both compose over the identical base).
          * @param name - the profile name.
          * @param userLayer - `false` skips parsing `cordis.patch.yml` (the default dump).
          * @returns the loaded profile.
          */
          export function prepareProfile(name: string, userLayer = true): Profile {
           healProfilesModuleFallback(INSTALL_ANCHOR)
           const profile = loadProfile(NAME, name, INSTALL_ANCHOR, undefined, { userLayer })
           writeFileSync(join(profile.dir, PROFILE_ROOT_FILENAME), PROFILE_ROOT_CONFIG)
           return profile
          }
          
          /** One profile's patch layers (application order) and the row index of its pre-flag composition. */
          interface ComposedProfile {
           profile: Profile
           /** Bundle layers concatenated — the part below the user layers on a live reload. */
           bundlePatches: PatchOptions[]

看了dsh源码，以上几行说明每次dsh启动时都会发生的构造指向pnpm install创造的存在junction的环的junction

（在包中，存在这样一对：

store/cordis/node_modules/@deepseek-ai/cordis-plugin-include →(junction) store/cordis-plugin-include
store/cordis-plugin-include/node_modules/@deepseek-ai/cordis   →(junction) store/cordis

)

而在window中，junction作为symlink在win的替代品，对git来说并非像快捷方式而是一个真实目录，所以git会在这一堆junction来回串

当然，ds方面并非没有意识到它的存在

github.com/deepseek-ai/deepseek-harness

.agents/notes/implemented/bug-fix/2026-08-12-unlink-stale-profile-fallback-links.md

master

# Agent Note: Unlink stale profile fallback links instead of rmSync

Status: implemented

English | [中文](2026-08-12-unlink-stale-profile-fallback-links.zh.md)

## Problem

`healProfilesModuleFallback` re-points `$DSH_HOME/profiles/node_modules` entries when an installation moves, and Windows hosts keep those entries as junctions. `ensureSymlink` deleted a stale entry with `rmSync(link)`, but Node treats a junction as a directory for removal: without `recursive`, `rmSync` throws `ERR_FS_EISDIR`, so every launch from a moved installation or a second worktree crashed before booting. The `replaces a wrong symlink` unit test reproduces that crash on Windows at the exact removal call.

## Decision

`ensureSymlink` removes a stale link with `unlinkSync(link)`. `unlink` deletes the reparse point or symlink itself on every platform and never descends into the target, which preserves the function's fail-loud guarantee that a real directory is never deleted. The [profile-plugin-bundles decision](../architecture/2026-08-05-profile-plugin-bundles.md) keeps owning the fallback's two-anchor resolution; this note owns only the removal primitive.

## Alternatives considered

**`rmSync(link, { recursive: true })`.** On Node 24 this deletes the junction without following its target, but `recursive` would silently delete a real directory that replaced the link between the `lstat` guard and the removal, weakening the fail-loud contract that motivates the guard.

**`rmdirSync(link)`.** Removes a junction on Windows as well, but it reads as directory removal for a link, and `unlinkSync` is the repository's existing junction-cleanup idiom.

此文件已被截断。显示原始文件

github.com/deepseek-ai/deepseek-harness

.agents/notes/implemented/bug-fix/2026-08-12-unlink-fixture-junctions-before-delete.md

master

# Agent Note: Unlink fixture junctions before recursive deletion

Status: implemented

English | [中文](2026-08-12-unlink-fixture-junctions-before-delete.zh.md)

## Problem

The install-lefthook and translation-pairing fixtures junction the repository's real `scripts/`, `node_modules`, and tsx package directories into fixture trees so installer probes resolve through them. Windows recursive deletion can treat a junction (a MOUNT_POINT reparse point) as a directory and follow it into its target; Git's `worktree remove` did exactly that and deleted the repository's tracked `scripts/` and tsx package (the incident's instrumentation pinned the deletion to that step). A fixture cleanup that trusts its deleter therefore deletes the repository's own sources instead of the fixture.

## Decision

`scripts/test-fixture-cleanup.ts` owns junction-safe fixture teardown: `unlinkFixtureLinks` walks a tree and unlinks every reparse point before `removeFixtureSafely` removes the now link-free tree (with Windows async-handle retries). Every affected `afterEach` and the pre-`worktree remove` hook call it. The general rule lives in `docs/defensive-patterns.md`: remove link-shaped paths with unlink, reserve recursive `rmSync` for known real directories.

## Alternatives considered

**Trust recursive deletion alone.** Rejected: whether a given deleter follows junctions is tool- and version-dependent, and one path through `git worktree remove` already destroyed tracked files; no cleanup may bet the repository on that behavior.

**Copy instead of junctioning the real directories.** Rejected: the fixtures exist to probe the real installer paths through their real contents, so copies would stop exercising the boundary under test.

此文件已被截断。显示原始文件

github.com/deepseek-ai/deepseek-harness

docs/defensive-patterns.md

master

# Defensive patterns

English | [中文](defensive-patterns.zh.md)

Hard-won bug-class rules: each pattern below is a class of defect that actually shipped or nearly shipped here, stated as the rule that prevents its recurrence. Read this before writing lifecycle, concurrency, subprocess, or teardown code. Test-tier counterparts (real entry path, world-verification, resource ownership) are in [testing.md](testing.md).

## Report orthogonal outcomes independently

A result can be several things at once — a process can time out AND exit 0 because it trapped the signal. Surface each independent fact (`timedOut`, `signal`, `exitCode`) on its own; never nest one flag's report inside another's branch, or a caller reads a cut-short run as a clean success.

## Honor public contracts on BOTH sides

When an implementation receives several representations of one outcome, normalize them before returning through the public API. `LlmAdapter.stream()` implementations may throw or emit `finish {kind:'error'|'aborted'}`, but `LlmRuntime.stream()` exposes model-request failures only as terminal finish chunks; middleware and consumer defects remain thrown. This keeps consumers from guessing whether a caught exception came from the provider, a wrapper, chunk logging, or their own assembly. Document the normalized contract where the type is defined; exercise every source form through the real consumer.

## Async state is not synchronous state

`agent.followup()` has no per-message completion or result; a background job's completion races turn boundaries; `reader.close()` fires for both EOF and disposal. Never treat `agent/status` or `whenIdle()` as the result of one follow-up: several queued follow-ups, steering, and injected work may share one `running` interval, while cancellation or disposal can discard unstarted items. An automation caller that truly owns a run must define its interval explicitly—for example, from its message's durable inbox receipt through the next whole-agent `idle`—and describe any selected output as interval-wide rather than causally attributed to that message. The guard cuts both ways: if the awaited transition can never occur, the wait hangs, so handle the "nothing to wait for" branch explicitly.

## Dispose must reach quiescence, not just request it

此文件已被截断。显示原始文件

这里都有提到这一问题，但是仅仅解决了junction导致删除而没有解决导致环的问题

现在让我们有请最vb的opencode出场！

opencode一出来就对所在目录一轮git快照

github.com/anomalyco/opencode

packages/opencode/src/snapshot/index.ts

dev


      
            }
          })
          
          const add = Effect.fnUntraced(function* () {
            yield* sync()
            const [diff, other] = yield* Effect.all(
              [
                git([...quote, ...args(["diff-files", "--name-only", "-z", "--", "."])], {
                  cwd: state.directory,
                }),
                git([...quote, ...args(["ls-files", "--full-name", "--others", "--exclude-standard", "-z", "--", "."])], {
                  cwd: state.directory,
                }),
              ],
              { concurrency: 2 },
            )
            if (diff.code !== 0 || other.code !== 0) {
              yield* Effect.logWarning("failed to list snapshot files", {
                diffCode: diff.code,
                diffStderr: diff.stderr,
                otherCode: other.code,

github.com/anomalyco/opencode

packages/opencode/src/snapshot/index.ts

dev


      
          
          const state = yield* InstanceState.make<State>(
            Effect.fn("Snapshot.state")(function* (ctx) {
              const state = {
                directory: ctx.directory,
                worktree: ctx.worktree,
                gitdir: path.join(Global.Path.data, "snapshot", ctx.project.id, Hash.fast(ctx.worktree)),
                vcs: ctx.project.vcs,
              }
          
              const args = (cmd: string[]) => ["--git-dir", state.gitdir, "--work-tree", state.worktree, ...cmd]
          
              const encodeNulTerminatedPaths = (files: string[]) => files.join("\0") + "\0"
              const encodeTopLevelLiteralPathspecs = (files: string[]) =>
                encodeNulTerminatedPaths(files.map((file) => `:(top,literal)${file}`))
          
              const git = Effect.fnUntraced(
                function* (cmd: string[], opts?: { cwd?: string; env?: Record<string, string>; stdin?: string }) {
                  const result = yield* appProcess.run(
                    ChildProcess.make("git", cmd, { cwd: opts?.cwd, env: opts?.env, extendEnv: true }),
                    { stdin: opts?.stdin },

github.com/anomalyco/opencode

packages/core/src/git.ts

dev


      
            worktree: AbsolutePath,
            gitDirectory: AbsolutePath,
            commonDirectory: AbsolutePath,
          }) {}
          
          export const ChangeSet = Schema.String.pipe(Schema.brand("Git.ChangeSet"))
          export type ChangeSet = typeof ChangeSet.Type
          
          export const TreeID = Schema.String.pipe(Schema.brand("Git.TreeID"))
          export type TreeID = typeof TreeID.Type
          
          export class OperationError extends Schema.TaggedErrorClass<OperationError>()("Git.OperationError", {
            operation: Schema.Literals([
              "clone",
              "fetch",
              "checkout",
              "reset",
              "create",
              "refresh",
              "write_tree",
              "list_files",

github.com/anomalyco/opencode

packages/core/src/git.ts

dev


      
            ignores?: Repository
            maximumUntrackedFileBytes?: number
          }) {
            const list = (args: string[]) =>
              repositoryOperation("refresh", input.repository, args).pipe(
                Effect.map((result) => result.text.split("\0").filter(Boolean)),
              )
            const [tracked, untracked] = yield* Effect.all(
              [
                list(["diff-files", "--name-only", "-z", "--", input.scope]),
                list(["ls-files", "--others", "--exclude-standard", "-z", "--", input.scope]),
              ],
              { concurrency: 2 },
            )
            const candidates = Array.from(new Set([...tracked, ...untracked]))
            if (!candidates.length) return { skipped: [] }
            const ignored = input.ignores
              ? new Set(
                  (yield* repositoryOperation("refresh", input.ignores, ["check-ignore", "--no-index", "--stdin", "-z"], {
                    stdin: candidates.join("\0") + "\0",
                  }).pipe(Effect.catch(() => Effect.succeed({ text: "", stderr: "" })))).text

github.com/anomalyco/opencode

packages/core/src/git.ts

dev


      
            return yield* new PatchError({
              operation: "capture",
              directory: input.path,
              message: tracked.stderr.trim() || tracked.text.trim() || "Failed to capture tracked changes",
            })
          }
          
          const untracked = yield* execute(
            input.repository.worktree,
            proc,
          )(["ls-files", "--others", "--exclude-standard", "-z", "--", scope]).pipe(
            Effect.mapError(
              (cause) => new PatchError({ operation: "capture", directory: input.path, message: cause.message, cause }),
            ),
          )
          if (untracked.exitCode !== 0) {
            return yield* new PatchError({
              operation: "capture",
              directory: input.path,
              message: untracked.stderr.trim() || untracked.text.trim() || "Failed to list untracked changes",
            })

于是…

cordis ──junction──> cordis-plugin-include ──junction──> cordis ──> …
   ^                                                        │
   └──────────────────── 来回串 <────────────────────────────┘

于是git飞起来了

目前的临时补救方法：别让git碰dsh

即：把~/.dsh/塞进主目录的 .gitignore

说了这么多，其他的agent难道就不会出问题吗？

很显然，这本质上是git对环没有环检测的问题，因此理论上其他存在git的agent(废话)都有可能中招，那么实际呢？

github.com/openai/codex

codex-rs/git-utils/src/info.rs

main


      
          pub fn get_git_repo_root(base_dir: &Path) -> Option<PathBuf> {
              let base = if base_dir.is_dir() {
                  base_dir
              } else {
                  base_dir.parent()?
              };
              find_ancestor_git_entry(base).map(|(repo_root, _)| repo_root)
          }
          
          /// Timeout for git commands to prevent freezing on large repositories
          const GIT_COMMAND_TIMEOUT: TokioDuration = TokioDuration::from_secs(5);
          const DISABLED_HOOKS_PATH: &str = if cfg!(windows) { "NUL" } else { "/dev/null" };
          
          #[derive(Serialize, Deserialize, Clone, Debug, JsonSchema, TS)]
          pub struct GitInfo {
              /// Current commit hash (SHA)
              #[serde(skip_serializing_if = "Option::is_none")]
              pub commit_hash: Option<GitSha>,
              /// Current branch name
              #[serde(skip_serializing_if = "Option::is_none")]
              pub branch: Option<String>,

codex超过5s就会超死，所以不会卡那么久

github.com/earendil-works/pi

packages/agent/src/harness/env/nodejs.ts

main


      
          		try {
          			const entries = await readdir(resolved, { withFileTypes: true });
          			const infos: FileInfo[] = [];
          			for (const entry of entries) {
          				const loopAbort = abortResult<FileInfo[]>(abortSignal, resolved);
          				if (loopAbort) return loopAbort;
          				const entryPath = resolve(resolved, entry.name);
          				try {
          					const info = fileInfoFromStats(entryPath, await lstat(entryPath));
          					if (info.ok) infos.push(info.value);
          				} catch (error) {
          					return err(toFileError(error, entryPath));
          				}
          			}
          			return ok(infos);
          		} catch (error) {
          			return err(toFileError(error, resolved));
          		}
          	}

此文件已被截断。显示原始文件

pi的非递归，只看一层，没有陷入

github.com/can1357/oh-my-pi

packages/coding-agent/src/utils/git.ts

main


      
          // ════════════════════════════════════════════════════════════════════════════
          // API: ls
          // ════════════════════════════════════════════════════════════════════════════
          
          export const ls = {
          	/** List files tracked or untracked by git. */
          	async files(
          		cwd: string,
          		options: { others?: boolean; excludeStandard?: boolean; signal?: AbortSignal } = {},
          	): Promise<string[]> {
          		const args = ["ls-files"];
          		if (options.others) args.push("--others");
          		if (options.excludeStandard) args.push("--exclude-standard");
          		return splitLines(await runText(cwd, args, { readOnly: true, signal: options.signal }));
          	},
          
          	/** List untracked files (excludes ignored). */
          	async untracked(cwd: string, signal?: AbortSignal): Promise<string[]> {
          		return ls.files(cwd, { others: true, excludeStandard: true, signal });
          	},

github.com/can1357/oh-my-pi

packages/coding-agent/src/security/preflight.ts

main


      
          	files(cwd: string, signal?: AbortSignal): Promise<string[]>;
          	untracked(cwd: string, signal?: AbortSignal): Promise<string[]>;
          }
          
          export const DEFAULT_SECURITY_GIT_ADAPTER: SecurityGitAdapter = {
          	root: (cwd, signal) => git.repo.root(cwd, signal),
          	headSha: (cwd, signal) => git.head.sha(cwd, signal),
          	resolveRef: (cwd, refName, signal) => git.ref.resolve(cwd, refName, signal),
          	diffTree: (cwd, base, head, signal) => git.diff.tree(cwd, base, head, { signal }),
          	status: (cwd, signal) => git.status(cwd, { porcelainV1: true, untrackedFiles: "all", signal }),
          	files: (cwd, signal) => git.ls.files(cwd, { signal }),
          	untracked: (cwd, signal) => git.ls.untracked(cwd, signal),
          };
          
          export class StaleSecurityScanPlanError extends Error {
          	constructor(
          		readonly expected: string,
          		readonly actual: string,
          	) {
          		super(`Security scan plan is stale: expected ${expected}, got ${actual}. Run security preflight again.`);
          		this.name = "StaleSecurityScanPlanError";

omp有此类问题，但其实

github.com/can1357/oh-my-pi

Isolated task spawns OOM/SIGTRAP the whole process on multi-GB working trees (isolation.mode auto/apfs)

已打开 10:16PM - 18 Aug 26 UTC

已关闭 08:25PM - 20 Aug 26 UTC

mmajoris

bug prio:p2 tool agent triaged

## Summary With `task.isolation.mode: auto` (or `apfs`), spawning an **isolated…** task subagent in a repo whose working tree carries multiple GB across many files kills the whole OMP process with a bun panic (`SIGTRAP` / `EXC_BREAKPOINT`) — or, less often, surfaces `Out of memory` as a task error. The isolation snapshot appears to buffer working-tree content in memory instead of streaming/CoW-cloning, so large trees exhaust it; when the allocation failure lands in a native path the process traps, taking the TUI and all in-process subagents with it. On our 7.9GB repo this crashed 100% of isolated spawns — any session there becomes a crash loop. ## Environment - macOS (Darwin 25.4.0, APFS, Apple Silicon) - bun 1.3.14 - @oh-my-pi/pi-coding-agent 17.3.5 and 17.3.7 (identical crashes on both) - Reproduces in a bare config dir (`PI_CONFIG_DIR` staging, no extensions/rules loaded) ## Repro ```sh mkdir bigtree && cd bigtree && git init echo hi > README.md && git add README.md && git commit -m init # ~8GB across ~30k untracked files (the many-files axis matters): python3 - <<'PY' import os buf = os.urandom(262144) for d in range(300): os.makedirs(f"data/d{d}", exist_ok=True) for f in range(100): with open(f"data/d{d}/f{f}.bin", "wb") as fh: fh.write(os.urandom(16)); fh.write(buf) PY omp # task.isolation.mode: auto # prompt: "Spawn one task subagent with isolated: true to run pwd; wait for its result." ``` Observed outcomes across runs of this shape: - **Process crash**: interactive TUI drops to shell with `zsh: trace trap omp`; headless `-p` exits 133 (128+SIGTRAP). This is the common case on our real 7.9GB / 34k-file repo — 15+ crashes, all with identical faulting frames. - **Graceful-ish variant** (same mechanism, luckier allocation site): seat survives, task fails with `Task execution failed: Isolated subagent execution requires a git repository. Out of memory` (note the misleading first clause — the cwd IS a git repo; the git detection itself appears to be failing under memory pressure). Control points, same environment: 2.7GB across 4 files → OK. 31k empty files (0 bytes) → OK. ~8GB across 31k files → OOM/crash. So it scales with total content volume held across many files, consistent with whole-tree buffering. ## Crash signature `EXC_BREAKPOINT (SIGTRAP)`, "Trace/BPT trap: 5"; faulting thread top frames at identical bun image offsets `4506192 / 4468052 / 4488216` in every report (stripped binary, no symbols). `.ips` files available on request. No panic text reaches the terminal (TUI teardown swallows stderr) and nothing lands on stderr in `-p` runs. Possibly related: the isolated worker's cwd comes back **HOME-double-prefixed** — `pwd` inside the worktree reports `/Users/<user>/Users/<user>/<agent-dir>/wt/<id>/m` — so worktree path construction also misbehaves on this path shape. Also: crashed runs leave partial deep copies in `wt/` (we found two 13GB remnants from the 7.9GB repo) — the backend appears to fall back to physical copying rather than an APFS clone even with `mode: apfs` forced. ## Expected Stream or CoW-clone the snapshot (never hold the tree in memory); on any failure, refuse the spawn or run it non-isolated with a clear error — never panic the host process. A knob to exclude ignored/untracked bulk (node_modules, logs) from snapshots would also shrink the exposure dramatically. ## Workaround `task.isolation.mode: none`.

也是有针对防护，但只是防护了内容过大的问题，function问题没修

github.com/MoonshotAI/kimi-code

apps/kimi-code/src/feedback/codebase/scanner.ts

main


      
            }
          }
          
          async function scanWithGit(
            root: string,
            limits: ScanCodebaseLimits,
            signal?: AbortSignal,
          ): Promise<CollectedFiles> {
            const { stdout } = await execFileAsync(
              'git',
              ['-C', root, 'ls-files', '-co', '--exclude-standard', '-z'],
              { encoding: 'buffer', maxBuffer: 1024 * 1024 * 64, signal },
            );
          
            throwIfAborted(signal);
            const relativePaths = splitNull(stdout);
            const files: FeedbackCodebaseFile[] = [];
            let exceedsLimit: FeedbackCodebaseLimitExceeded | undefined;
            let totalSize = 0;
          
            for (const relativePath of relativePaths) {

kimi-code在进行反馈上报的时候会爆

github.com/XiaomiMiMo/MiMo-Code

packages/opencode/src/snapshot/index.ts

main


      
            yield* fs.writeFileString(target, text ? `${text}\n` : "").pipe(Effect.orDie)
          })
          
          const add = Effect.fnUntraced(function* () {
            yield* sync()
            const [diff, other] = yield* Effect.all(
              [
                git([...quote, ...args(["diff-files", "--name-only", "-z", "--", "."])], {
                  cwd: state.directory,
                }),
                git([...quote, ...args(["ls-files", "--others", "--exclude-standard", "-z", "--", "."])], {
                  cwd: state.directory,
                }),
              ],
              { concurrency: 2 },
            )
            if (diff.code !== 0 || other.code !== 0) {
              log.warn("failed to list snapshot files", {
                diffCode: diff.code,
                diffStderr: diff.stderr,
                otherCode: other.code,

mimo-code在fork之后没有发现此类问题，也炸了

所以opencode，omp,kimi-code和mimmocode都会出现这一问题，但仅有opencode(+mimocode)会在启动时出现问题

eeeee · 2026 年8 月 27 日 02:29

真会有人一行行去看代码啊