claude-code - 💡(How to fix) Fix [Bug] Claude Code's bundled find replacement (ARGV0=bfs claude -S dfs ...) crawls Time Machine snapshots on macOS, leaks orphaned processes, and degrades the host [1 comments, 2 participants]

Bug Description Title: Claude Code's bundled find replacement (ARGV0=bfs claude -S dfs ...) crawls Time Machine snapshots on macOS, leaks orphaned processes, and degrades the host

Summary: Claude Code injects a find shell function into every shell snapshot it generates. The function shadows the system find and instead runs the claude binary itself with ARGV0=bfs and bfs-compatible flags (-S dfs -regextype findutils-default). This was apparently added to recent versions — older snapshots in ~/.claude/shell-snapshots/ don't have it, snapshots from late April onward do.

When this replacement is invoked as find / -name "Foo" 2>/dev/null | head -5, three things go wrong on macOS:

1. It crawls into /Volumes/.timemachine/. macOS lazily auto-mounts every Time Machine snapshot when anything stats into that path. A single find / call thus produces dozens of new mount points (49 in my case) and walks them all. The kernel's vnode cache fills with APFS metadata for snapshots the user has no reason to be touching.
2. Depth-first ordering plus head -5 doesn't terminate. With -S dfs, the search descends into the TM snapshot tree before producing 5 matches. head never closes the pipe, no SIGPIPE arrives, and the search runs indefinitely from the user's perspective.
3. The Bash tool's 2-minute timeout kills the wrapper shell but not the bfs grandchild. The grandchild reparents to launchd and continues running. In my case two such orphans ran for 11+ hours each, holding ~5,400 open file descriptors between them across 49 TM snapshot mounts.

Impact: On a Mac Studio M1 Max (32 GB, macOS 26.4.1), the accumulated orphaned claude-as-bfs processes drove kern.num_vnodes to its ceiling (default 263168), triggering kernel lock contention cascades. Load averages hit 250-400 with 80% idle CPU — classic vnode-reclaim stall. Symptoms: ls taking 60+ seconds, every interactive command pauses, eventually requiring a forced power cycle. Recurred over multiple days; misdiagnosed as a Spotlight/Time Machine interaction until I traced lsof back to the claude binary (process name bfs) parented to ~/.claude/shell-snapshots/ wrappers.

Repro (macOS with TM configured):

1. Open a Claude Code session — shell snapshot is created with the find override.
2. Ask it to locate any file: find / -name "Foo.swift" 2>/dev/null | head -5.
3. Watch mount | grep TimeMachine — counts climbs as snapshots auto-mount.
4. Wait 2 minutes — Bash tool times out, but ps axo pid,ppid,etime,args | grep bfs shows the search still running, parented to launchd.
5. Repeat across sessions; orphans accumulate.
6. ~30 minutes after a fresh wake-from-sleep, vnode pressure plus the leaked open files trigger systemwide stalls.

Environment Info

• Platform: darwin
• Terminal: Apple_Terminal
• Version: 2.1.126
• Feedback ID: 14967ba4-dbbb-4dd7-b25e-58232ada4f1c