Skip to content

perf: implement all 11 Pass 8 performance findings from PR #3 - #4

Merged
EraPartner merged 7 commits into
mainfrom
claude/pr-3-findings-1f9ene
Jul 13, 2026
Merged

perf: implement all 11 Pass 8 performance findings from PR #3#4
EraPartner merged 7 commits into
mainfrom
claude/pr-3-findings-1f9ene

Conversation

@EraPartner

@EraPartner EraPartner commented Jul 12, 2026

Copy link
Copy Markdown
Owner

Summary

Implements all 11 performance findings (2 × P2, 9 × P3) documented in PR #3's Pass 8 review. This branch contains PR #3's three docs commits (merged in unchanged) plus the implementations, so merging it also lands PR #3 — which can then be closed.

Pass 8a — shell tooling

  • [P2] sync.sh — vendored reference copies are generated once into a scratch REF_DIR before the target loop instead of 18–36 gen_vendored/shasum runs (check: cmp against the reference; sync: atomic same-dir temp + mv install, then cmp write-verify). Cuts ~1–2s of per-commit pre-commit latency on macOS.
  • [P3] audit.sh — the secret scan is one git grep --cached -I -nE over the whole index (same staged-blob semantics, file:line-only reporting) instead of ~5–6 processes + a temp file per tracked file. Bonus fix: a bare id_rsa/id_ed25519 at the repo root now trips the filename check (*/id_rsa required a leading dir).
  • [P3] launcher-common.sh — plugins/statusline staged via tar --exclude .git instead of copying multi-MB .git dirs and deleting them (vendored copy re-synced).

Pass 8b — sandbox runtime

  • [P3] Dockerfile — image-wide setuid strip moved before the frequently-edited COPY block (saves ~10–40s per routine rebuild); a scoped strip over the COPY'd paths stays as the last layer for the same defense-in-depth coverage.
  • [P3] bin/dev — proxy-wait folded into the lifecycle container exec (one fewer CLI/XPC round-trip per launch; barrier semantics kept); 0.2s polls here and in post-create.sh.

Pass 8c — CI

  • [P2] egress-test — image built via SHA-pinned docker/setup-buildx-action + docker/build-push-action with the GHA layer cache, then SKIP_BUILD=1 into the smoke test. Cache-hit builds drop from ~4–8 min to seconds.
  • [P3] CodeQL — triggers scoped to .github/workflows/** + .github/codeql/**.
  • [P3] schedule — the six deterministic jobs skip on the weekly cron; the gate tolerates those by-design skips on schedule runs only.
  • [P3] Trivy — single scan (format: sarif, exit-code: "1"); gating + Security-tab upload both preserved.
  • [P3] gate collapse — quality-gate + ci-complete merged into one "CI Complete" job (same required-check name, full needs list, skipped-counts-as-failure kept).
  • [P3] squid job — apt packages cached via SHA-pinned awalsh128/cache-apt-pkgs-action@v1.6.3.

All three new action pins were resolved to real tag commits via git ls-remote (lightweight tags, so the listed SHAs are commit SHAs).

Testing

  • ./audit.sh clean on the repo, and a scratch-repo fixture verified all detection paths: staged-secret-with-clean-worktree (index bypass), root-level id_rsa, private-key .pem flagged, public .pem not flagged.
  • EGRESS_SELF_ONLY=1 ./sync.sh + --check: re-sync is byte-identical; check passes at every commit.
  • Staged-tree fixture for the launcher: nested .git dirs excluded at any depth, all other items staged intact, plugin-path JSON rewrite unaffected.
  • bash -n + shellcheck -s bash -e SC1090,SC1091 -S warning clean on every touched script; both workflows parse as YAML.
  • The full docker egress smoke test could not run in this sandbox (registry egress blocked by the environment's network policy), but buildx parsed/planned all 26 Dockerfile stages before the network failure; the CI egress-test job on this PR exercises the real build + boot.

🤖 Generated with Claude Code

https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum

Generated by Claude Code

claude added 6 commits July 13, 2026 16:24
@claude @EraPartner
perf(sync): generate each vendored reference copy once, not per target
07f3959 
The reference copy is target-independent (canonical content + version +
canonical SHA-256), yet gen_vendored ran once per file per target in
--check mode and twice per file per target in sync mode — 18-36
gen_vendored/shasum spawns where 3 suffice, paid on every commit via the
pre-commit hook (~1-2s on macOS, where sha256_of falls back to Perl
shasum). Generate the references up front into a scratch REF_DIR; check
mode cmp's against them, sync mode installs them via a same-dir temp +
mv (atomicity kept) and cmp's the landed file for the write-verify.

Pass 8a P2 from TODO.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum
@claude @EraPartner
perf(audit): scan the whole index with one git grep pass
b2a12d0 
Replace the per-file mktemp/git-show/grep/rm cycle (~5-6 fork/execs +
a temp-file write/read per tracked file, every commit) with a single
`git grep --cached -I -nE` over the index — same staged-blob semantics
as `git show :<file>`, -I skips binaries, file:line-only reporting
kept. Filename checks now loop over the git ls-files list alone, and
blob extraction happens only for *.pem files.

Also fixed while here: a bare id_rsa/id_ed25519 committed at the repo
ROOT now trips the filename check — the old */id_rsa pattern required a
leading directory component, so root-level keys were missed.

Pass 8a P3 from TODO.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum
@claude @EraPartner
perf(launcher): exclude .git from plugin/statusline staging at copy time
35c5302 
sandbox_stage_claude_config copied plugins/ and statusline/ wholesale
with cp -a — including their multi-MB .git dirs — then deleted those
dirs with find -exec rm -rf, paying full copy I/O for data immediately
discarded on the interactive sandbox-start path. Stage the two
git-clone trees via tar --exclude .git (bsdtar + GNU tar compatible,
bash-3.2 safe) so .git is never copied; plain items keep cp -a.
Vendored copy re-synced.

Pass 8a P3 from TODO.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum
@claude @EraPartner
perf(sandbox): cheap rebuilds + one fewer exec per launch
35a9bb1 
Dockerfile: move the image-wide setuid/setgid strip to just before the
frequently-edited COPY block, so a routine sync.sh allowlist/script
edit no longer re-runs a full-filesystem traversal (~10-40s in the
builder VM) on every rebuild. A scoped strip over the COPY'd paths
(/usr/local/{sbin,bin}, /usr/local/share/dev-sandbox, /etc/squid) is
the new last layer, preserving the defense-in-depth coverage of the
COPY'd files at near-zero cost.

bin/dev: fold the proxy-wait into the top of the lifecycle exec — on
warm reuse the first probe succeeds, so the standalone exec paid a
container-CLI + XPC round-trip (~100-300ms) per launch for nothing.
The wait keeps its barrier role for the start-stopped race. Poll at
0.2s (here and in post-create.sh) instead of 1s, trimming ~0.5s avg
off cold starts.

Pass 8b P3s from TODO.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum
@claude @EraPartner
perf(ci): cache the egress-test image build; cut redundant jobs and s…
d3e2046 
…cans

- egress-test: build via SHA-pinned setup-buildx + build-push-action
  with the GHA layer cache (cache-from/to type=gha, load: true), then
  run the smoke test with SKIP_BUILD=1. The Dockerfile's deliberate
  layer ordering finally pays off in CI: cache-hit builds drop from
  ~4-8 min (the pipeline's long pole) to seconds.
- codeql.yml: triggers scoped to .github/workflows/** and
  .github/codeql/** — the only paths the actions-language analysis
  reads. Safe: CI Complete, not CodeQL, is the required check.
- Weekly schedule now runs only the rule-DB-dependent scans (Trivy +
  gitleaks); the six deterministic jobs get
  if: github.event_name != 'schedule', and the gate tolerates their
  by-design skips on schedule runs only.
- Trivy: one scan (format sarif + exit-code 1) instead of two
  identical back-to-back scans; Trivy writes the SARIF before applying
  the exit code, so gating + Security-tab upload are both preserved.
- quality-gate/ci-complete collapsed into a single "CI Complete" job
  (same required-check name, full needs list, skipped-counts-as-failure
  kept) — removes a serial runner allocation from every run's critical
  path.
- squid job: apt packages installed via SHA-pinned
  awalsh128/cache-apt-pkgs-action; cache-hit runs skip the ~25-50s
  apt-get update entirely.

Pass 8c P2 + P3s from TODO.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum
@claude @EraPartner
docs: mark all 11 Pass 8 performance findings implemented; changelog …
99bc7ae 
…entry

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016mBmyeTGwKzumCZ3VApLum
@EraPartner
EraPartner force-pushed the claude/pr-3-findings-1f9ene branch from b158acc to 99bc7ae Compare July 13, 2026 07:28
EraPartner
perf(ci): drop squid apt-cache action — it startup-fails CI
cd65f58 
awalsh128/cache-apt-pkgs-action@v1.6.3 triggers a GitHub Actions
startup_failure: the whole CI run fails to start, no jobs execute, and
GitHub surfaces no parse error. Isolated by bisecting the workflow on
throwaway branches (only this step fails; still fails with the version
input quoted and with all nested action SHAs verified to resolve).

Revert the squid job to plain apt-get update + install; keep the other
10 Pass-8 findings. Update CHANGELOG/TODO to reflect 10 of 11 landed.
@EraPartner
EraPartner marked this pull request as ready for review July 13, 2026 09:43
@EraPartner
EraPartner merged commit ecf980b into main Jul 13, 2026
12 checks passed
@EraPartner
EraPartner deleted the claude/pr-3-findings-1f9ene branch July 13, 2026 09:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@EraPartner @claude