@invarn/cibuild 2.5.5 → 2.5.6

package/dist/src/yaml/steps/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAwFF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA0GzF,iBAAiB;CAqMhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAgKzF,iBAAiB;CAmIhC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AA6HF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA0HzF,iBAAiB;CA0MhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAsLzF,iBAAiB;CA0JhC"}

package/dist/src/yaml/steps/cache.js

@@ -87,28 +87,64 @@ function resolvePresetChain(technology) {
     return chain;
 }
 /**
- * Emits the daemon exact-key pull branch (ADR 0001, Phase 3b). On a local
- * miss, GET `<key>.tar.zst` from this runner's cache daemon ($CIBUILD_CACHE_DAEMON,
- * injected by the runner). The daemon fans out to tailnet peers, persists the
- * hit to ~/cache, and streams it back — so we pipe straight to extraction
- * without re-writing it on the guest. The optional per-build bearer token
- * ($CIBUILD_CACHE_TOKEN) is sent only when set. Inert when the env var is
- * empty, so the same script runs with or without a daemon.
+ * Emits the `curl` invocation the cache steps talk to the daemon with. The
+ * bearer token is per-build and only present on the Invarn runner, so it is
+ * expanded conditionally and the same script works without one.
  */
-function emitDaemonPullBranch() {
+function daemonCurl(args) {
+    return `curl -fsS \${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} ${args}`;
+}
+/**
+ * Restores a cache through the daemon rather than a shared directory.
+ *
+ * Two requests, mirroring the directory-based flow it replaces: the exact key
+ * first, then — on a miss — the scope's newest tarball. The daemon resolves
+ * each from its own disk or a tailnet peer, so a hit here covers what used to
+ * be separate "local" and "peer" branches; which one it was is recorded in the
+ * daemon's own host-side log, where the fleet-wide view already lives.
+ *
+ * The 30-day age cap is preserved: the daemon dates the fallback with
+ * `mtimeMs`, standing in for the `stat` the guest can no longer perform.
+ */
+function emitDaemonPullCommands() {
     return [
-        // stderr is silenced on the probe: a cache miss is the normal case and
-        // makes curl emit "(22) ... 404" (and the empty body makes zstd print
-        // "unexpected end of file"). Those are non-actionable — the branch just
-        // falls through to the cold path — so they're pure log noise. Exit
-        // status is preserved (pipefail), so the fall-through still works.
-        'elif [ -n "$CIBUILD_CACHE_DAEMON" ] && { curl -fsS ${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst" | zstd -dc | tar -xf - -C /; } 2>/dev/null; then',
+        'echo "Cache daemon: $CIBUILD_CACHE_DAEMON"',
+        // Exact key. stderr silenced — a miss is the normal case and curl/zstd
+        // both editorialise about it; pipefail still carries the exit status.
+        `if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`,
         '  echo "Cache found (daemon), extracting..."',
-        // LRU bump the tarball the daemon just persisted to ~/cache (same dir as
-        // the --dir mount); tolerate its absence in case the daemon served it
-        // without a local copy.
-        '  touch "$CACHE_FILE" 2>/dev/null || true',
         '  echo "CACHE_SOURCE=daemon CACHE_KEY=$CACHE_KEY"',
+        'else',
+        // Scope fallback: the newest tarball for this <keyPrefix>-<projectId>.
+        // Gradle/Xcode re-hash their inputs on top of the warm directory, hitting
+        // the unchanged work and rebuilding only what actually moved.
+        '  __ci_fb_scope="${CACHE_KEY%-*}"',
+        `  __ci_fb_json=$(${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/scope/$__ci_fb_scope/latest"')} 2>/dev/null || true)`,
+        // Parse without a JSON tool: the guest image is not guaranteed to ship jq.
+        `  __ci_fb_key=$(printf '%s' "$__ci_fb_json" | sed -n 's/.*"key"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p')`,
+        `  __ci_fb_mtime=$(printf '%s' "$__ci_fb_json" | sed -n 's/.*"mtimeMs"[[:space:]]*:[[:space:]]*\\([0-9]*\\).*/\\1/p')`,
+        '  if [ -n "$__ci_fb_key" ] && [ -n "$__ci_fb_mtime" ]; then',
+        '    __ci_fb_age_days=$(( ($(date +%s) - __ci_fb_mtime / 1000) / 86400 ))',
+        // Age cap: a fallback older than 30d likely carries obsolete toolchain
+        // installs or cache entries from a pre-wrapper-bump world. Go cold rather
+        // than seed from ancient state. Exact-key hits are unaffected.
+        '    if [ "$__ci_fb_age_days" -le 30 ]; then',
+        '      echo "Cache fallback (daemon): using prior tarball $__ci_fb_key (${__ci_fb_age_days}d old)"',
+        `      if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$__ci_fb_key.tar.zst"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`,
+        '        echo "CACHE_SOURCE=fallback_daemon CACHE_KEY=$CACHE_KEY FALLBACK_KEY=$__ci_fb_key"',
+        '      else',
+        '        echo "Cache fallback $__ci_fb_key could not be fetched — going cold"',
+        '        echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"',
+        '      fi',
+        '    else',
+        '      echo "Cache fallback candidate $__ci_fb_key is ${__ci_fb_age_days}d old, exceeds 30d cap — going cold"',
+        '      echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY FALLBACK_REJECTED=$__ci_fb_key"',
+        '    fi',
+        '  else',
+        '    echo "No cache found for key: $CACHE_KEY"',
+        '    echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"',
+        '  fi',
+        'fi',
     ];
 }
 /**
@@ -154,7 +190,11 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         commands.push('');
         commands.push('# Ensure cache directory exists');
         commands.push(`CACHE_DIR="${this.escapeBash(config.paths.cacheDir)}"`);
-        commands.push('mkdir -p "$CACHE_DIR"');
+        // Only the filesystem transport needs the directory to exist. Over the
+        // daemon the cache lives on the host, and on a runner this path is no
+        // longer mounted into the VM — an unconditional mkdir would abort the
+        // whole step under errexit.
+        commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
@@ -174,6 +214,17 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // Check if cache file exists
         commands.push('');
         commands.push('# Check if cache exists');
+        // Transport split — see the preset path. An explicit-key step has no scope
+        // to fall back to, so the daemon side is the exact key or nothing.
+        commands.push('if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
+        commands.push(`  if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`);
+        commands.push('    echo "Cache found (daemon), extracting..."');
+        commands.push('    echo "CACHE_SOURCE=daemon"');
+        commands.push('  else');
+        commands.push(`    echo "No cache found for key: ${this.escapeBash(cacheKey)}"`);
+        commands.push('    echo "CACHE_SOURCE=cold"');
+        commands.push('  fi');
+        commands.push('else');
         commands.push('if [ -f "$CACHE_FILE" ]; then');
         commands.push('  echo "Cache found (local), extracting..."');
         if (isDebugMode) {
@@ -181,8 +232,6 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         }
         commands.push('  zstd -dc "$CACHE_FILE" | tar -xf - -C /');
         commands.push('  echo "CACHE_SOURCE=local"');
-        // Daemon hit (ADR 0001) — see emitDaemonPullBranch.
-        commands.push(...emitDaemonPullBranch());
         // Peer fallback
         if (peerCacheDir) {
             commands.push('elif [ -f "$PEER_CACHE_FILE" ] 2>/dev/null; then');
@@ -195,6 +244,8 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         commands.push(`  echo "No cache found for key: ${this.escapeBash(cacheKey)}"`);
         commands.push('  echo "CACHE_SOURCE=cold"');
         commands.push('fi');
+        // Closes the daemon/filesystem transport split.
+        commands.push('fi');
         const script = this.createBashScriptFromCommands(commands, stepName);
         return this.createScriptStep(script, stepName);
     }
@@ -213,7 +264,11 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // Compute cache key from lockfile checksum at runtime
         // If technology has a fallback chain, try each lockfile in order
         commands.push(`CACHE_DIR="${this.escapeBash(config.paths.cacheDir)}"`);
-        commands.push('mkdir -p "$CACHE_DIR"');
+        // Only the filesystem transport needs the directory to exist. Over the
+        // daemon the cache lives on the host, and on a runner this path is no
+        // longer mounted into the VM — an unconditional mkdir would abort the
+        // whole step under errexit.
+        commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
         commands.push('');
         // Helper: resolve lockfile path — checks exact path first, then searches
         // recursively (handles SPM Package.resolved inside .xcodeproj/.xcworkspace)
@@ -273,6 +328,12 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         }
         commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
         commands.push('');
+        // Transport split. On a runner the cache lives on the host and is reached
+        // over HTTP; standalone, it is a directory on this machine. The daemon URL
+        // is the switch, so the same generated script serves both.
+        commands.push('if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
+        commands.push(...emitDaemonPullCommands());
+        commands.push('else');
         // Peer cache directory — set from config, empty string disables peer lookup
         const peerCacheDir = config.paths.peerCacheDir || '';
         if (peerCacheDir) {
@@ -292,13 +353,6 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // hit daily would still be reaped on its 31st day from creation.
         commands.push('  touch "$CACHE_FILE"');
         commands.push('  echo "CACHE_SOURCE=local CACHE_KEY=$CACHE_KEY"');
-        // 1b. Daemon hit (ADR 0001) — on a local miss, ask this runner's cache
-        // daemon for the exact key. The daemon resolves it from a tailnet peer
-        // and atomically persists it to ~/cache (the same dir as the --dir mount),
-        // so we stream the response straight to extraction with no redundant
-        // guest-side write. Gated at runtime on the env var the runner injects, so
-        // the generated script is inert when no daemon is configured.
-        commands.push(...emitDaemonPullBranch());
         // 2. Peer hit — tee to warm local cache while extracting in one pass
         if (peerCacheDir) {
             commands.push('elif [ -f "$PEER_CACHE_FILE" ] 2>/dev/null; then');
@@ -362,6 +416,8 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         commands.push('    echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"');
         commands.push('  fi');
         commands.push('fi');
+        // Closes the daemon/filesystem transport split.
+        commands.push('fi');
         if (isDebugMode) {
             commands.push('echo "Restored paths:"');
             const allPaths = [...new Set(chain.flatMap(p => p.paths))];
@@ -427,7 +483,11 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         commands.push('');
         commands.push('# Ensure cache directory exists');
         commands.push(`CACHE_DIR="${this.escapeBash(config.paths.cacheDir)}"`);
-        commands.push('mkdir -p "$CACHE_DIR"');
+        // Only the filesystem transport needs the directory to exist. Over the
+        // daemon the cache lives on the host, and on a runner this path is no
+        // longer mounted into the VM — an unconditional mkdir would abort the
+        // whole step under errexit.
+        commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
@@ -488,7 +548,10 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         // Create cache if we have paths
         commands.push('');
         commands.push('# Skip if cache already exists for this key');
-        commands.push('if [ -f "$CACHE_FILE" ]; then');
+        // Over the daemon there is no local file to test, so the "already up to
+        // date" shortcut can't apply — the daemon's PUT is an idempotent overwrite
+        // under the same key, which gets the same outcome.
+        commands.push('if [ -z "$CIBUILD_CACHE_DAEMON" ] && [ -f "$CACHE_FILE" ]; then');
         commands.push('  echo "Cache already up to date for key: $CACHE_KEY"');
         commands.push('elif [ ${#PATHS_TO_CACHE[@]} -gt 0 ]; then');
         commands.push('  echo "Caching ${#PATHS_TO_CACHE[@]} path(s)..."');
@@ -496,6 +559,14 @@ export class CachePushStepExecutor extends BaseStepExecutor {
             commands.push('  echo "Paths to cache:"');
             commands.push('  printf "  %s\\n" "${PATHS_TO_CACHE[@]}"');
         }
+        // Transport split — see the preset path.
+        commands.push('  if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
+        commands.push(`    if tar -cf - "\${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 | ${daemonCurl('-T - "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} > /dev/null; then`);
+        commands.push('      echo "Cache created successfully"');
+        commands.push('    else');
+        commands.push('      echo "Warning: failed to upload cache to the daemon"');
+        commands.push('    fi');
+        commands.push('  else');
         // Atomic write into a per-process-unique temp (CBR-12). The "runs serialized
         // per runner" assumption behind a fixed "$CACHE_FILE.tmp" is false with two VM
         // slots and collides with the host cache daemon mutating this VirtioFS-shared
@@ -511,6 +582,8 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         commands.push('  else');
         commands.push('    echo "Warning: Failed to create cache file"');
         commands.push('  fi');
+        // Closes the daemon/filesystem transport split.
+        commands.push('  fi');
         commands.push('else');
         commands.push('  echo "No paths to cache"');
         commands.push('fi');
@@ -531,7 +604,11 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         commands.push('');
         // Compute cache key from lockfile checksum at runtime
         commands.push(`CACHE_DIR="${this.escapeBash(config.paths.cacheDir)}"`);
-        commands.push('mkdir -p "$CACHE_DIR"');
+        // Only the filesystem transport needs the directory to exist. Over the
+        // daemon the cache lives on the host, and on a runner this path is no
+        // longer mounted into the VM — an unconditional mkdir would abort the
+        // whole step under errexit.
+        commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
         commands.push('');
         commands.push('__ci_find_lockfile() {');
         commands.push('  if [ -f "$1" ]; then echo "$1"; return; fi');
@@ -610,6 +687,19 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         // build. Atomic .tmp + mv overwrites any prior tarball under this key.
         commands.push('if [ ${#PATHS_TO_CACHE[@]} -gt 0 ]; then');
         commands.push('  echo "Caching ${#PATHS_TO_CACHE[@]} path(s)..."');
+        // Transport split, mirroring cache-pull. Over the daemon the tarball is
+        // streamed straight out as the PUT body — nothing is staged on the guest,
+        // so there is no temp file to collide or orphan, and the daemon does the
+        // atomic temp+rename on the host side where the cache actually lives.
+        commands.push('  if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
+        commands.push(`    if tar -cf - "\${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 | ${daemonCurl('-T - "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} > /dev/null; then`);
+        commands.push('      echo "Cache created successfully"');
+        commands.push('    else');
+        // Never fatal: a build that produced good output should not be failed by a
+        // cache upload, and the next build simply misses.
+        commands.push('      echo "Warning: failed to upload cache to the daemon"');
+        commands.push('    fi');
+        commands.push('  else');
         // Per-process-unique temp (CBR-12). The old fixed "$CACHE_FILE.tmp" assumed
         // a single serialized writer — false with two VM slots, and it collides with
         // the host cache daemon mutating this VirtioFS-shared dir, which (a) made the
@@ -632,6 +722,8 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         commands.push('  else');
         commands.push('    echo "Warning: Failed to create cache file"');
         commands.push('  fi');
+        // Closes the daemon/filesystem transport split.
+        commands.push('  fi');
         commands.push('else');
         commands.push('  echo "No paths to cache"');
         commands.push('fi');

package/dist/src/yaml/steps/steps.test.js

@@ -326,10 +326,26 @@ describe('Step Implementations', () => {
             expect(result.script).toContain('ls -t "$CACHE_DIR"/"$__ci_fb_scope"-*.tar.zst');
             expect(result.script).toContain('CACHE_SOURCE=fallback_');
             expect(result.script).toContain('FALLBACK_KEY=');
-            // Fallback must NOT warm $CACHE_FILE (otherwise cache-push would skip)
-            const fallbackSection = result.script.split('__ci_fb_scope=')[1] ?? '';
+            // Fallback must NOT warm $CACHE_FILE (otherwise cache-push would skip).
+            // Both transports declare a scope, so anchor on the last one — the
+            // filesystem branch, which is the only one with a $CACHE_FILE to warm.
+            const sections = result.script.split('__ci_fb_scope=');
+            const fallbackSection = sections[sections.length - 1] ?? '';
             expect(fallbackSection).not.toContain('mv "$CACHE_FILE.tmp" "$CACHE_FILE"');
         });
+        test('asks the daemon for the scope fallback, dated, when there is no shared dir', async () => {
+            const executor = new CachePullStepExecutor();
+            const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
+            // The daemon answers the same two questions the directory listing did:
+            // which key, and how old.
+            expect(result.script).toContain('"$CIBUILD_CACHE_DAEMON/cache/scope/$__ci_fb_scope/latest"');
+            expect(result.script).toContain('CACHE_SOURCE=fallback_daemon');
+            // The 30-day cap has to survive losing `stat`, so it reads the daemon's
+            // mtime instead. Without this the cap silently disappears.
+            expect(result.script).toContain('__ci_fb_mtime');
+            expect(result.script).toContain('-le 30');
+            expect(result.script).toContain('FALLBACK_REJECTED=');
+        });
         test('should try peer dir for fallback when local has no prior tarball', async () => {
             const executor = new CachePullStepExecutor();
             const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
@@ -386,22 +402,36 @@ describe('Step Implementations', () => {
             // unauthenticated daemon isn't sent a bogus "Bearer " header.
             expect(result.script).toContain('${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"}');
         });
-        test('daemon branch is an elif after the local hit (exact-key, daemon, fallback order)', async () => {
+        test('picks its transport up front — daemon when configured, directory otherwise', async () => {
             const executor = new CachePullStepExecutor();
             const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
-            const localAt = result.script.indexOf('CACHE_SOURCE=local');
+            // The daemon is no longer a branch *within* the directory search; it is
+            // the alternative to it, chosen before any lookup happens. A runner has
+            // no cache directory to search once the mount is gone, and standalone
+            // cibuild has no daemon — the same script has to serve both.
+            const splitAt = result.script.indexOf('if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
             const daemonAt = result.script.indexOf('CACHE_SOURCE=daemon');
-            const fallbackAt = result.script.indexOf('__ci_fb_scope=');
-            expect(localAt).toBeGreaterThanOrEqual(0);
-            expect(daemonAt).toBeGreaterThan(localAt);
-            expect(fallbackAt).toBeGreaterThan(daemonAt);
+            const localAt = result.script.indexOf('CACHE_SOURCE=local');
+            expect(splitAt).toBeGreaterThanOrEqual(0);
+            expect(daemonAt).toBeGreaterThan(splitAt);
+            expect(localAt).toBeGreaterThan(daemonAt);
+        });
+        test('does not require the cache directory to exist when using the daemon', async () => {
+            const executor = new CachePullStepExecutor();
+            const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
+            // An unconditional mkdir aborts the step under errexit once the mount is
+            // gone, which is how this fails in production rather than in a test.
+            expect(result.script).toContain('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
+            expect(result.script).not.toContain('\nmkdir -p "$CACHE_DIR"');
         });
         test('routes a manual cache_key pull miss through the cache daemon', async () => {
             const executor = new CachePullStepExecutor();
             const result = await executor.execute({ cache_key: 'my-key' }, {}, testConfig);
             expect(result.script).toContain('[ -n "$CIBUILD_CACHE_DAEMON" ]');
             expect(result.script).toContain('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"');
-            expect(result.script).toContain('CACHE_SOURCE=daemon CACHE_KEY=$CACHE_KEY');
+            // An explicit-key step reports the bare source, matching its sibling
+            // markers; the key is already fixed and echoed by the step header.
+            expect(result.script).toContain('CACHE_SOURCE=daemon');
         });
     });
     describe('CachePushStepExecutor', () => {
@@ -418,15 +448,33 @@ describe('Step Implementations', () => {
             expect(result.script).toContain('node-modules-v1');
             expect(result.script).toContain('.ci-cache');
         });
-        test('stays a local write — never PUTs to the cache daemon (ADR 0001 v1 scope)', async () => {
+        test('uploads to the daemon when one is configured, on both step forms', async () => {
             const executor = new CachePushStepExecutor();
             const manual = await executor.execute({ cache_key: 'my-key', cache_paths: ['build'] }, {}, testConfig);
             const preset = await executor.execute({ technology: 'kmm' }, {}, testConfig);
+            // This is the half that used to be missing: push wrote only to the
+            // shared directory, so removing the mount would have silently dropped
+            // every cache while still reporting success.
             for (const result of [manual, preset]) {
-                expect(result.script).not.toContain('CIBUILD_CACHE_DAEMON');
-                expect(result.script).not.toContain('CIBUILD_CACHE_TOKEN');
+                expect(result.script).toContain('-T - "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"');
+                expect(result.script).toContain('${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"}');
+                // Streamed straight out — nothing is staged on the guest, so there is
+                // no temp file to collide with a concurrent slot or orphan on failure.
+                expect(result.script).toContain('| zstd -3 | curl');
             }
         });
+        test('a failed upload warns instead of failing the build', async () => {
+            const executor = new CachePushStepExecutor();
+            const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
+            expect(result.script).toContain('Warning: failed to upload cache to the daemon');
+        });
+        test('still writes to the cache directory when no daemon is configured', async () => {
+            const executor = new CachePushStepExecutor();
+            const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
+            // Standalone cibuild has no daemon and must keep working unchanged.
+            expect(result.script).toContain('CACHE_TMP="$CACHE_FILE.$$.$RANDOM.tmp"');
+            expect(result.script).toContain('mv "$CACHE_TMP" "$CACHE_FILE"');
+        });
         test('should skip gracefully when cache_key is missing', async () => {
             const executor = new CachePushStepExecutor();
             const inputs = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.5.5",
+  "version": "2.5.6",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",