Every invocation SHA-256s the entire bundled runtime tree (23,739 files) — --version takes ~12 minutes

[francescovidaich964]

Description

Every command — including --version and --help — hashes all 23,739 files of the bundled runtime tree before doing anything.

Environment

• OS: Windows 11 Pro (build 26200), x64 (also affects macOS/Linux)
• Feynman: current main (dfdcb7c)

Steps to reproduce

1. Install Feynman.
2. Run feynman --version and wait.

Actual behavior

--version takes 12 min 16 s; doctor 13 min 18 s. With AV exclusions: 16.7 s.

Root cause

collectRuntimeTreeEntries (scripts/lib/runtime-workspace-integrity.mjs:276, hashing at :303) SHA-256s the whole tree. It is reached unconditionally because bin/feynman.js imports the patcher before dispatch. Call path: ensurePackageWorkspace() (patch-embedded-pi.mjs:596) → workspaceMatchesRuntime() (:398) → runtimeWorkspaceMatches() (runtime-workspace-restore.mjs:204).

This is a cross-platform defect — macOS and Linux users pay it too. AV is roughly a 44× multiplier on the hashing, not the cause. (Not a workaround recommendation; an AV exclusion is not a fix and is a security downgrade.)

Already ruled out

• Completion marker .runtime-workspace.complete.json exists and is valid.
• Workspace mtime unchanged since install — nothing is re-extracted.
• patch-embedded-pi.mjs reads the app-level settings.json (6 packages), not the user's (7 after installing memory) — a user-installed package does not invalidate the match.
• No opt-out env var.

Expected behavior

Starting the CLI should not hash the entire runtime tree on every invocation.

Proposed directions (asking for maintainer direction)

1. Skip workspace verification for --version / --help.
2. Cache the result keyed on a cheap signature (mtime/size). This trades a strict guarantee for a heuristic one — flagging that trade explicitly.
3. Verify lazily, on package load.
4. Parallelize hashing. Helps, but does not fix the O(whole tree) design.

Impact

The CLI is effectively unusable on a normal Windows machine; severe startup latency on all platforms.

Per CONTRIBUTING.md, larger changes should start with a discussion — which tradeoff would you prefer?

[francescovidaich964]

To close the loop on direction: we're open to whatever tradeoff the maintainers prefer, but our recommendation is option 2 as implemented in a working fork — verify the portable path/type/mode/size shape on every launch (cheap, no byte reads) and only run the full byte hash when the shape differs, with an opt-in FEYNMAN_STRICT_RUNTIME_VERIFY=1 that restores the full byte check for stronger guarantees.

Rationale: the shape index already covers every add/remove/rename/mode/size/symlink change, so it catches the realistic tampering cases while making startup near-instant on all platforms. The strict env var keeps the same-size-payload-swap guarantee available for higher-assurance environments, so nothing is lost — it just becomes opt-in rather than unconditional. Happy to discuss the alternatives on this thread before any code is written upstream.