@invarn/cibuild 1.9.2 → 1.9.4

package/dist/src/yaml/steps/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AA8DF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAsGzF,iBAAiB;CAsLhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA4JzF,iBAAiB;CA2IhC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAmFF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA0GzF,iBAAiB;CA8LhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA4JzF,iBAAiB;CAoHhC"}

package/dist/src/yaml/steps/cache.js

@@ -86,6 +86,26 @@ function resolvePresetChain(technology) {
     }
     return chain;
 }
+/**
+ * Emits the daemon exact-key pull branch (ADR 0001, Phase 3b). On a local
+ * miss, GET `<key>.tar.zst` from this runner's cache daemon ($CIBUILD_CACHE_DAEMON,
+ * injected by the runner). The daemon fans out to tailnet peers, persists the
+ * hit to ~/cache, and streams it back — so we pipe straight to extraction
+ * without re-writing it on the guest. The optional per-build bearer token
+ * ($CIBUILD_CACHE_TOKEN) is sent only when set. Inert when the env var is
+ * empty, so the same script runs with or without a daemon.
+ */
+function emitDaemonPullBranch() {
+    return [
+        'elif [ -n "$CIBUILD_CACHE_DAEMON" ] && curl -fsS ${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst" | zstd -dc | tar -xf - -C /; then',
+        '  echo "Cache found (daemon), extracting..."',
+        // LRU bump the tarball the daemon just persisted to ~/cache (same dir as
+        // the --dir mount); tolerate its absence in case the daemon served it
+        // without a local copy.
+        '  touch "$CACHE_FILE" 2>/dev/null || true',
+        '  echo "CACHE_SOURCE=daemon CACHE_KEY=$CACHE_KEY"',
+    ];
+}
 /**
  * Cache pull step executor
  * Restores cached files from cache directory
@@ -133,7 +153,8 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
-        commands.push(`CACHE_FILE="$CACHE_DIR/${this.escapeBash(cacheKey)}.tar.zst"`);
+        commands.push(`CACHE_KEY="${this.escapeBash(cacheKey)}"`);
+        commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
         if (isDebugMode) {
             commands.push('echo "Debug mode enabled"');
             commands.push('echo "Cache file: $CACHE_FILE"');
@@ -155,6 +176,8 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         }
         commands.push('  zstd -dc "$CACHE_FILE" | tar -xf - -C /');
         commands.push('  echo "CACHE_SOURCE=local"');
+        // Daemon hit (ADR 0001) — see emitDaemonPullBranch.
+        commands.push(...emitDaemonPullBranch());
         // Peer fallback
         if (peerCacheDir) {
             commands.push('elif [ -f "$PEER_CACHE_FILE" ] 2>/dev/null; then');
@@ -257,6 +280,13 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // hit daily would still be reaped on its 31st day from creation.
         commands.push('  touch "$CACHE_FILE"');
         commands.push('  echo "CACHE_SOURCE=local CACHE_KEY=$CACHE_KEY"');
+        // 1b. Daemon hit (ADR 0001) — on a local miss, ask this runner's cache
+        // daemon for the exact key. The daemon resolves it from a tailnet peer
+        // and atomically persists it to ~/cache (the same dir as the --dir mount),
+        // so we stream the response straight to extraction with no redundant
+        // guest-side write. Gated at runtime on the env var the runner injects, so
+        // the generated script is inert when no daemon is configured.
+        commands.push(...emitDaemonPullBranch());
         // 2. Peer hit — tee to warm local cache while extracting in one pass
         if (peerCacheDir) {
             commands.push('elif [ -f "$PEER_CACHE_FILE" ] 2>/dev/null; then');
@@ -563,34 +593,11 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         if (isDebugMode) {
             commands.push('    echo "Cache size: $(du -h "$CACHE_FILE" | cut -f1)"');
         }
-        // Retention per-scope: (1) keep N newest by mtime — touched on hit in
-        // cache-pull so this is LRU, not strictly creation-order; (2) delete
-        // anything past the age cap regardless of position; (3) enforce a size
-        // budget, oldest-out. Two passes are required: the size pass needs the
-        // post-cleanup set, otherwise its running sum counts tarballs that the
-        // count/age pass is about to delete and over-evicts.
-        commands.push('    __ci_ret_scope="${CACHE_KEY%-*}"');
-        commands.push('    __ci_ret_count_cap=5');
-        commands.push('    __ci_ret_age_cap=$((30 * 86400))');
-        commands.push('    __ci_ret_size_cap_kb="${CIBUILD_CACHE_SCOPE_BUDGET_KB:-10485760}"');
-        commands.push('    __ci_ret_now=$(date +%s)');
-        commands.push('    __ci_ret_idx=0');
-        commands.push('    while IFS= read -r __ci_ret_f; do');
-        commands.push('      __ci_ret_idx=$((__ci_ret_idx + 1))');
-        commands.push('      __ci_ret_age=$(( __ci_ret_now - $(stat -f %m "$__ci_ret_f" 2>/dev/null || echo "$__ci_ret_now") ))');
-        commands.push('      if [ "$__ci_ret_idx" -gt "$__ci_ret_count_cap" ] || [ "$__ci_ret_age" -gt "$__ci_ret_age_cap" ]; then');
-        commands.push('        rm -f "$__ci_ret_f"');
-        commands.push('      fi');
-        commands.push('    done < <(ls -t "$CACHE_DIR"/"$__ci_ret_scope"-*.tar.zst 2>/dev/null)');
-        commands.push('    __ci_ret_running_kb=0');
-        commands.push('    while IFS= read -r __ci_ret_f; do');
-        commands.push('      __ci_ret_size=$(du -k "$__ci_ret_f" 2>/dev/null | cut -f1)');
-        commands.push('      __ci_ret_size=${__ci_ret_size:-0}');
-        commands.push('      __ci_ret_running_kb=$((__ci_ret_running_kb + __ci_ret_size))');
-        commands.push('      if [ "$__ci_ret_running_kb" -gt "$__ci_ret_size_cap_kb" ]; then');
-        commands.push('        rm -f "$__ci_ret_f"');
-        commands.push('      fi');
-        commands.push('    done < <(ls -t "$CACHE_DIR"/"$__ci_ret_scope"-*.tar.zst 2>/dev/null)');
+        // Retention is no longer applied here (ADR 0002 / CBR-6). It moved into the
+        // long-lived peer cache daemon, which owns ~/cache and — unlike the guest —
+        // knows (via the manager) which scopes this runner OWNS and must never evict.
+        // A guest-side prune would have to run blind to ownership and could reap the
+        // fleet's single durable copy, so the daemon owns the whole policy now.
         commands.push('  else');
         commands.push('    echo "Warning: Failed to create cache file"');
         commands.push('  fi');

package/dist/src/yaml/steps/steps.test.js

@@ -268,6 +268,42 @@ describe('Step Implementations', () => {
             expect(result.script).toContain('exceeds 30d cap — going cold');
             expect(result.script).toContain('FALLBACK_REJECTED=');
         });
+        test('routes a preset pull miss through the cache daemon when CIBUILD_CACHE_DAEMON is set', async () => {
+            const executor = new CachePullStepExecutor();
+            const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
+            // Daemon branch is gated at runtime on the injected env var (so the same
+            // generated script is a no-op when the runner doesn't inject a daemon).
+            expect(result.script).toContain('[ -n "$CIBUILD_CACHE_DAEMON" ]');
+            // Exact-key GET against the per-runner daemon.
+            expect(result.script).toContain('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"');
+            // Stream-extract: the daemon already persisted the tarball to ~/cache via
+            // resolveMiss, so we pipe straight to extraction with no redundant write.
+            expect(result.script).toContain('CACHE_SOURCE=daemon CACHE_KEY=$CACHE_KEY');
+        });
+        test('sends the per-build bearer token only when CIBUILD_CACHE_TOKEN is set', async () => {
+            const executor = new CachePullStepExecutor();
+            const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
+            // ${VAR:+...} expands the -H flag only when the token is non-empty, so an
+            // unauthenticated daemon isn't sent a bogus "Bearer " header.
+            expect(result.script).toContain('${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"}');
+        });
+        test('daemon branch is an elif after the local hit (exact-key, daemon, fallback order)', async () => {
+            const executor = new CachePullStepExecutor();
+            const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
+            const localAt = result.script.indexOf('CACHE_SOURCE=local');
+            const daemonAt = result.script.indexOf('CACHE_SOURCE=daemon');
+            const fallbackAt = result.script.indexOf('__ci_fb_scope=');
+            expect(localAt).toBeGreaterThanOrEqual(0);
+            expect(daemonAt).toBeGreaterThan(localAt);
+            expect(fallbackAt).toBeGreaterThan(daemonAt);
+        });
+        test('routes a manual cache_key pull miss through the cache daemon', async () => {
+            const executor = new CachePullStepExecutor();
+            const result = await executor.execute({ cache_key: 'my-key' }, {}, testConfig);
+            expect(result.script).toContain('[ -n "$CIBUILD_CACHE_DAEMON" ]');
+            expect(result.script).toContain('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"');
+            expect(result.script).toContain('CACHE_SOURCE=daemon CACHE_KEY=$CACHE_KEY');
+        });
     });
     describe('CachePushStepExecutor', () => {
         test('should generate cache push script', async () => {
@@ -283,6 +319,15 @@ describe('Step Implementations', () => {
             expect(result.script).toContain('node-modules-v1');
             expect(result.script).toContain('.ci-cache');
         });
+        test('stays a local write — never PUTs to the cache daemon (ADR 0001 v1 scope)', async () => {
+            const executor = new CachePushStepExecutor();
+            const manual = await executor.execute({ cache_key: 'my-key', cache_paths: ['build'] }, {}, testConfig);
+            const preset = await executor.execute({ technology: 'kmm' }, {}, testConfig);
+            for (const result of [manual, preset]) {
+                expect(result.script).not.toContain('CIBUILD_CACHE_DAEMON');
+                expect(result.script).not.toContain('CIBUILD_CACHE_TOKEN');
+            }
+        });
         test('should skip gracefully when cache_key is missing', async () => {
             const executor = new CachePushStepExecutor();
             const inputs = {
@@ -379,17 +424,21 @@ describe('Step Implementations', () => {
             expect(result.script).toContain('> "$CACHE_FILE.tmp"');
             expect(result.script).toContain('mv "$CACHE_FILE.tmp" "$CACHE_FILE"');
         });
-        test('should sweep retention (count + age + size budget) after successful preset push', async () => {
+        test('should NOT emit guest-side retention (the peer cache daemon owns it, CBR-6)', async () => {
+            // ADR 0002 / CBR-6: retention moved into the long-lived peer cache daemon,
+            // which knows (via the manager) which scopes this runner owns and must never
+            // evict. The guest cache-push no longer prunes — it could only reap an owner's
+            // durable copy, having no ownership knowledge of its own.
             const executor = new CachePushStepExecutor();
             const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
-            expect(result.script).toContain('__ci_ret_scope="${CACHE_KEY%-*}"');
-            expect(result.script).toContain('ls -t "$CACHE_DIR"/"$__ci_ret_scope"-*.tar.zst');
-            expect(result.script).toContain('__ci_ret_count_cap=5');
-            expect(result.script).toContain('__ci_ret_age_cap=$((30 * 86400))');
-            expect(result.script).toContain('CIBUILD_CACHE_SCOPE_BUDGET_KB');
-            expect(result.script).toContain('rm -f "$__ci_ret_f"');
-        });
-        test('should not run retention for manual cache_key push (no scope)', async () => {
+            expect(result.script).not.toContain('__ci_ret_scope');
+            expect(result.script).not.toContain('__ci_ret_count_cap');
+            expect(result.script).not.toContain('__ci_ret_age_cap');
+            expect(result.script).not.toContain('CIBUILD_CACHE_SCOPE_BUDGET_KB');
+            // The successful-push path itself is unchanged.
+            expect(result.script).toContain('Cache created successfully');
+        });
+        test('should not emit retention for a manual cache_key push either', async () => {
             const executor = new CachePushStepExecutor();
             const result = await executor.execute({ cache_key: 'my-key', cache_paths: ['build'] }, {}, testConfig);
             expect(result.script).not.toContain('__ci_ret_scope');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "1.9.2",
+  "version": "1.9.4",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",