VS Code extension sandbox leaves empty .git directory, causing Git discovery CPU spin #28631

Activity

1. github-actions

   added

   bugSomething isn't workingSomething isn't working

   extensionIssues related to the VS Code extensionIssues related to the VS Code extension

   sandboxIssues related to permissions or sandboxingIssues related to permissions or sandboxing

   performance

   on Jun 17, 2026
2. hkwi commented on Jun 17, 2026

   

   hkwi

   on Jun 17, 2026

   Author

   More actions

   Related issues I found after filing:

   • Linux sandbox creates synthetic child .git when Codex is launched from a subdirectory of a parent Git repo #26463 looks closely related on the sandbox side: Linux sandbox creates or mounts a synthetic child .git path as tmpfs. The difference here is that I observed an empty host-visible .git directory left behind in a non-Git workspace, followed by VS Code Git repeatedly running git rev-parse --show-toplevel.
   • VS Code extension: high renderer CPU in non-git workspace caused by repeated git stable-metadata worker loop #17394 looks closely related on the IDE-extension CPU side: high CPU in non-Git workspaces from repeated Git metadata handling. The difference here is that strace showed the repeated process spawning path from the extension host: 211 /usr/bin/git executions in 10 seconds.
   • Codex VS Code extension logs Git metadata failures in unborn Git repositories #19326 is related to missing Git metadata / missing HEAD, but for an unborn Git repository rather than a host-visible empty .git directory created around sandbox activity.

   So this may be a cross-product of #26463 and #17394: sandbox leaves or exposes a .git path that makes the IDE Git metadata/discovery loop pathological.
3. nken-eccs commented on Jul 16, 2026

   

   nken-eccs

   on Jul 16, 2026

   Last edited by nken-eccs

   More actions

   I can confirm this issue is still present in openai.chatgpt-26.707.91948-linux-x64.

   In my case, $HOME was not a Git repository, but $HOME/.git existed as a completely empty directory. While Codex was active, the Extension Host repeatedly ran:

   git -c core.hooksPath=/dev/null -c core.fsmonitor= rev-parse --show-toplevel
   

   I observed approximately 750–1,287 executions every 5 seconds.

   • Extension Host CPU: 59–66%, mostly system CPU
   • Minor faults: 30,000–46,000/s
   • Voluntary context switches: 570–814/s
   • codex app-server CPU: only about 2–4%

   Confirmed loop

   GitInitWatcher.start()
     -> checkForGitDirectory("$HOME/.git")
     -> stat(".git") succeeds
     -> watcher is disposed and onGitInit() is called
     -> handleGitInit()
     -> invalidateStableMetadata()
     -> getStableMetadata()
     -> git rev-parse --show-toplevel
     -> exit 128 / null metadata
     -> ensureWatchingForGitInit()
     -> new GitInitWatcher.start()
     -> stat(".git") succeeds again
   

   Because the empty .git directory continues to exist, the newly created watcher immediately follows the same path. There is no delay or backoff between attempts.

   Renaming the empty directory stopped the loop without reloading VS Code or restarting the Extension Host:

   mv "$HOME/.git" "$HOME/.git.empty"

   In the next measurement window:

   • repeated rev-parse executions dropped to 0
   • Extension Host CPU dropped to 0.2–0.4%
   • minor faults dropped to 23–88/s
   • voluntary context switches dropped to 13–17/s

   Suggested fixes

   1. checkForGitDirectory() should not treat a successful stat(".git") as completed Git initialization. It should verify that the path resolves to valid Git metadata before disposing the watcher and calling onGitInit().

   2. When handleGitInit() receives null metadata, it should not call ensureWatchingForGitInit() immediately. The retry should use a bounded exponential backoff, for example:

      1s -> 2s -> 5s -> 10s -> 30s maximum
      

   3. A negative Git-root result should be cached per host and cwd for the backoff period, so repeated metadata invalidation cannot immediately spawn another git process.

   4. If the sandbox creates .git as a host-side mountpoint, it should remove that directory when the sandbox exits if it did not exist before and is still empty.

   5. Add a regression test that creates an empty .git directory in a non-Git cwd and verifies that Git discovery attempts remain bounded.