@invarn/cibuild 2.5.5 → 2.5.8

package/dist/src/commands/build.d.ts

@@ -38,8 +38,19 @@ export interface IosSetupOptions {
     appStoreDeploy: boolean;
     bundleId: string;
 }
-export declare function generateAndroidPipeline(javaVersion?: number, setup?: SetupOptions, variants?: WorkflowVariants, cacheTechnology?: "gradle" | "kmm", metaNamespace?: 'invarn' | 'cibuild.io'): string;
-export declare function generateIosPipeline(projectPath: string, setup: IosSetupOptions, variants: IosWorkflowVariants, metaNamespace?: 'invarn' | 'cibuild.io'): string;
+/**
+ * The `trigger_map` block appended to every generated pipeline.
+ *
+ * Without it the pipeline is inert on the Invarn side: `dispatchRepoEvent`
+ * skips any pipeline whose YAML declares no trigger_map, so a scaffolded repo
+ * receives pushes and builds nothing, with no error to explain it.
+ *
+ * `release` is deliberately absent — it deploys to Google Play / App Store,
+ * and a webhook must never reach it.
+ */
+export declare function triggerMapBlock(defaultBranch?: string): string;
+export declare function generateAndroidPipeline(javaVersion?: number, setup?: SetupOptions, variants?: WorkflowVariants, cacheTechnology?: "gradle" | "kmm", metaNamespace?: 'invarn' | 'cibuild.io', defaultBranch?: string): string;
+export declare function generateIosPipeline(projectPath: string, setup: IosSetupOptions, variants: IosWorkflowVariants, metaNamespace?: 'invarn' | 'cibuild.io', defaultBranch?: string): string;
 export declare function handleBuildCommand(detectMobileProjectRoot: (dir: string) => "android" | "ios" | "kmm" | null, options?: {
     createPipelinesDir?: boolean;
     nonInteractive?: boolean;

package/dist/src/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoJD,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAgL,EACvL,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,GACpD,MAAM,CA2NR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,GACpD,MAAM,CA4LR;AAgVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoJD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAgL,EACvL,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA2NR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}

package/dist/src/commands/build.js

@@ -6,6 +6,7 @@ import { scanIosProject, formatIosScanResult } from "./ios-scanner.js";
 import { SecretsManager } from "../yaml/secrets-manager.js";
 import { collectFileSecret } from "./file-secret-collector.js";
 import { generateGitHubActionsWorkflow } from "./github-workflow.js";
+import { detectDefaultBranch, FALLBACK_DEFAULT_BRANCH } from "../shared/git.js";
 function variantFromName(name) {
     const buildType = name.charAt(0).toUpperCase() + name.slice(1);
     return { variant: name, buildType, gradleTask: `assemble${buildType}` };
@@ -122,7 +123,32 @@ function detectSetupNeeds(warnings) {
         artifactType: 'apk',
     };
 }
-export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {} }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io') {
+/**
+ * The `trigger_map` block appended to every generated pipeline.
+ *
+ * Without it the pipeline is inert on the Invarn side: `dispatchRepoEvent`
+ * skips any pipeline whose YAML declares no trigger_map, so a scaffolded repo
+ * receives pushes and builds nothing, with no error to explain it.
+ *
+ * `release` is deliberately absent — it deploys to Google Play / App Store,
+ * and a webhook must never reach it.
+ */
+export function triggerMapBlock(defaultBranch = FALLBACK_DEFAULT_BRANCH) {
+    const branch = defaultBranch.trim() || FALLBACK_DEFAULT_BRANCH;
+    // JSON.stringify gives a valid double-quoted YAML scalar for any branch
+    // name git will accept. Quoting is not cosmetic: a branch called `no` or
+    // `y` parses as a boolean unquoted, and one called `1.0` as a number.
+    return `
+# Which GitHub events build which workflow. Without this block the pipeline
+# is never triggered by a push or a pull request.
+trigger_map:
+  - push_branch: ${JSON.stringify(branch)}
+    workflow: primary
+  - pull_request_target_branch: "*"
+    workflow: pull-request
+`;
+}
+export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {} }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
     const keystoreStepFor = (wf) => {
         if (!setup.keystore)
             return "";
@@ -331,9 +357,9 @@ ${googlePlayStep}
                   echo "${releaseArtifactLabel}: \$artifact"
                 done
               fi
-`;
+${triggerMapBlock(defaultBranch)}`;
 }
-export function generateIosPipeline(projectPath, setup, variants, metaNamespace = 'cibuild.io') {
+export function generateIosPipeline(projectPath, setup, variants, metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
     const { primary: pv, pullRequest: prv, release: rv } = variants;
     // Global scheme is the primary scheme (used as default across workflows)
     const globalScheme = pv.scheme;
@@ -508,7 +534,7 @@ ${appStoreDeployStep}
               if [ -n "\$CIBUILD_XCARCHIVE_PATH" ]; then
                 echo "Archive: \$CIBUILD_XCARCHIVE_PATH"
               fi
-`;
+${triggerMapBlock(defaultBranch)}`;
 }
 /**
  * Prints a hint listing env vars / Gradle properties detected during scanning
@@ -771,7 +797,7 @@ async function handleIosBuildCommand(cwd, options = {}) {
         }
     }
     // 7. Generate and write the pipeline
-    const yaml = generateIosPipeline(iosScanResult.projectPath, iosSetupOptions, iosVariants, options.metaNamespace);
+    const yaml = generateIosPipeline(iosScanResult.projectPath, iosSetupOptions, iosVariants, options.metaNamespace, detectDefaultBranch());
     writeFileSync(outputPath, yaml, "utf-8");
     console.log("\n✅ Generated .ci/pipelines/cibuild.yml");
     console.log("   Platform: iOS");
@@ -1042,7 +1068,7 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
     // that exact JDK — a newer JDK can cross-compile. Enforce a minimum of 17
     // since ubuntu-latest runners ship with JDK 17+ and JDK <17 is unavailable.
     const javaVersion = Math.max(scanResult.detectedJavaVersion ?? 17, 17);
-    const yaml = generateAndroidPipeline(javaVersion, setupOptions, variants, cacheTechnology, options.metaNamespace);
+    const yaml = generateAndroidPipeline(javaVersion, setupOptions, variants, cacheTechnology, options.metaNamespace, detectDefaultBranch());
     writeFileSync(outputPath, yaml, "utf-8");
     console.log("\n✅ Generated .ci/pipelines/cibuild.yml");
     console.log(`   Platform: ${platformLabel}`);

package/dist/src/commands/build.test.js

@@ -10,7 +10,9 @@
  * `metaNamespace: 'invarn'` and get `meta.invarn:`.
  */
 import { describe, test, expect } from '@jest/globals';
+import { load } from 'js-yaml';
 import { generateIosPipeline, generateAndroidPipeline, } from './build.js';
+const parse = (yaml) => load(yaml);
 const iosSetup = {
     cocoaPods: false,
     codeSigning: false,
@@ -56,4 +58,64 @@ describe('generateAndroidPipeline — meta namespace', () => {
         expect(yaml).not.toContain('meta:\n  cibuild.io:\n');
     });
 });
+/**
+ * A generated pipeline with no `trigger_map` is inert on the Invarn side:
+ * the webhook handler skips any pipeline whose YAML has none, so a repo
+ * scaffolded by `ci build` receives pushes and builds nothing, with no
+ * error anywhere to explain it.
+ *
+ * Both generators emit `primary`, `pull-request` and `release`. Pushes go to
+ * `primary`, pull requests to `pull-request`, and `release` stays manual —
+ * it deploys to Google Play / App Store and must never fire off a push.
+ */
+describe.each([
+    ['generateIosPipeline', (branch) => generateIosPipeline('./MyApp', iosSetup, iosVariants, 'cibuild.io', branch)],
+    ['generateAndroidPipeline', (branch) => generateAndroidPipeline(17, undefined, undefined, 'gradle', 'cibuild.io', branch)],
+])('%s — trigger_map', (_name, generate) => {
+    test('emits a trigger_map', () => {
+        const doc = parse(generate());
+        expect(Array.isArray(doc.trigger_map)).toBe(true);
+        expect(doc.trigger_map.length).toBeGreaterThan(0);
+    });
+    test('every rule names a workflow the pipeline actually declares', () => {
+        const doc = parse(generate());
+        const declared = Object.keys(doc.workflows ?? {});
+        for (const rule of doc.trigger_map) {
+            expect(declared).toContain(rule.workflow);
+        }
+    });
+    test('routes a push to primary and a pull request to pull-request', () => {
+        const doc = parse(generate());
+        const push = doc.trigger_map.find((r) => r.push_branch !== undefined);
+        const pr = doc.trigger_map.find((r) => r.pull_request_target_branch !== undefined);
+        expect(push?.workflow).toBe('primary');
+        expect(pr?.workflow).toBe('pull-request');
+    });
+    test('never fires release off a webhook', () => {
+        const doc = parse(generate());
+        expect(doc.trigger_map.map((r) => r.workflow)).not.toContain('release');
+    });
+    test('defaults the push branch to main', () => {
+        const doc = parse(generate());
+        const push = doc.trigger_map.find((r) => r.push_branch !== undefined);
+        expect(push?.push_branch).toBe('main');
+    });
+    test('keys the push branch to the branch it is given', () => {
+        const doc = parse(generate('develop'));
+        const push = doc.trigger_map.find((r) => r.push_branch !== undefined);
+        expect(push?.push_branch).toBe('develop');
+    });
+    test('survives a branch name containing a slash', () => {
+        const doc = parse(generate('release/1.0'));
+        const push = doc.trigger_map.find((r) => r.push_branch !== undefined);
+        expect(push?.push_branch).toBe('release/1.0');
+    });
+    test('still parses when the branch name would otherwise read as a YAML bool', () => {
+        // `push_branch: no` parses as `false` unquoted. Git allows a branch
+        // called `no`, so the value has to be quoted on the way out.
+        const doc = parse(generate('no'));
+        const push = doc.trigger_map.find((r) => r.push_branch !== undefined);
+        expect(push?.push_branch).toBe('no');
+    });
+});
 //# sourceMappingURL=build.test.js.map

package/dist/src/shared/git.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Git probes used while scaffolding a pipeline.
+ *
+ * Scaffolding runs inside the user's checkout, so the repository itself is
+ * the best available source of truth for values the generated YAML has to
+ * hardcode. Everything here is best-effort: a scaffold must still succeed in
+ * a directory that is not a git repository at all.
+ */
+/** What we key a `trigger_map` to when git can't tell us anything better. */
+export declare const FALLBACK_DEFAULT_BRANCH = "main";
+/**
+ * The branch a generated `trigger_map` should build on push.
+ *
+ * Order matters. The remote's HEAD is what GitHub calls the repository's
+ * default branch, and it is what the webhook will report on a merge — so it
+ * wins over whatever happens to be checked out. Only when there is no remote
+ * (a repo that has not been pushed anywhere yet) do we fall back to the
+ * current branch, and only when that is unavailable too — no repo, or a
+ * detached HEAD — do we guess.
+ *
+ * Guessing wrong is not silent: the pipeline is written to disk where the
+ * user can read and correct the branch before committing it.
+ */
+export declare function detectDefaultBranch(cwd?: string): string;
+//# sourceMappingURL=git.d.ts.map

package/dist/src/shared/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../src/shared/git.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAc9C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,CAevE"}

package/dist/src/shared/git.js

@@ -0,0 +1,53 @@
+/**
+ * Git probes used while scaffolding a pipeline.
+ *
+ * Scaffolding runs inside the user's checkout, so the repository itself is
+ * the best available source of truth for values the generated YAML has to
+ * hardcode. Everything here is best-effort: a scaffold must still succeed in
+ * a directory that is not a git repository at all.
+ */
+import { execFileSync } from 'node:child_process';
+/** What we key a `trigger_map` to when git can't tell us anything better. */
+export const FALLBACK_DEFAULT_BRANCH = 'main';
+function git(cwd, args) {
+    try {
+        return execFileSync('git', args, {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The branch a generated `trigger_map` should build on push.
+ *
+ * Order matters. The remote's HEAD is what GitHub calls the repository's
+ * default branch, and it is what the webhook will report on a merge — so it
+ * wins over whatever happens to be checked out. Only when there is no remote
+ * (a repo that has not been pushed anywhere yet) do we fall back to the
+ * current branch, and only when that is unavailable too — no repo, or a
+ * detached HEAD — do we guess.
+ *
+ * Guessing wrong is not silent: the pipeline is written to disk where the
+ * user can read and correct the branch before committing it.
+ */
+export function detectDefaultBranch(cwd = process.cwd()) {
+    // `origin/main` → `main`. Absent unless the remote HEAD ref is set locally,
+    // which `git clone` does and `git init` does not.
+    const remoteHead = git(cwd, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']);
+    if (remoteHead) {
+        const branch = remoteHead.replace(/^origin\//, '').trim();
+        if (branch)
+            return branch;
+    }
+    // `--abbrev-ref HEAD` answers the literal string "HEAD" on a detached
+    // checkout, which is not a branch name and must not become one.
+    const current = git(cwd, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    if (current && current !== 'HEAD')
+        return current;
+    return FALLBACK_DEFAULT_BRANCH;
+}
+//# sourceMappingURL=git.js.map

package/dist/src/shared/git.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Unit tests for the default-branch probe.
+ *
+ * The probe shells out to git, so these drive it against real throwaway
+ * repositories in a temp dir rather than mocking child_process — the whole
+ * point of the helper is that it agrees with what git actually reports.
+ */
+export {};
+//# sourceMappingURL=git.test.d.ts.map

package/dist/src/shared/git.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.test.d.ts","sourceRoot":"","sources":["../../../src/shared/git.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/src/shared/git.test.js

@@ -0,0 +1,66 @@
+/**
+ * Unit tests for the default-branch probe.
+ *
+ * The probe shells out to git, so these drive it against real throwaway
+ * repositories in a temp dir rather than mocking child_process — the whole
+ * point of the helper is that it agrees with what git actually reports.
+ */
+import { describe, test, expect, beforeAll, afterAll } from '@jest/globals';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { detectDefaultBranch } from './git.js';
+function git(cwd, ...args) {
+    execFileSync('git', args, { cwd, stdio: 'ignore' });
+}
+/** A repo with one commit on `branch`, and no remote. */
+function makeRepo(root, name, branch) {
+    const dir = join(root, name);
+    execFileSync('mkdir', ['-p', dir]);
+    git(dir, 'init', '--quiet', `--initial-branch=${branch}`);
+    git(dir, 'config', 'user.email', 'test@example.com');
+    git(dir, 'config', 'user.name', 'Test');
+    writeFileSync(join(dir, 'README.md'), '# test\n');
+    git(dir, 'add', 'README.md');
+    git(dir, 'commit', '--quiet', '-m', 'init');
+    return dir;
+}
+describe('detectDefaultBranch', () => {
+    let root;
+    beforeAll(() => {
+        root = mkdtempSync(join(tmpdir(), 'cibuild-git-'));
+    });
+    afterAll(() => {
+        rmSync(root, { recursive: true, force: true });
+    });
+    test('reads the current branch when there is no remote', () => {
+        expect(detectDefaultBranch(makeRepo(root, 'plain', 'main'))).toBe('main');
+    });
+    test('reads a non-main current branch', () => {
+        expect(detectDefaultBranch(makeRepo(root, 'legacy', 'master'))).toBe('master');
+    });
+    test('prefers the remote HEAD over the checked-out branch', () => {
+        // A clone sitting on a topic branch must still key its trigger to the
+        // branch the remote considers default — otherwise the generated pipeline
+        // would only ever build whatever branch happened to be checked out at
+        // scaffold time.
+        const origin = makeRepo(root, 'origin-repo', 'develop');
+        const clone = join(root, 'cloned');
+        execFileSync('git', ['clone', '--quiet', origin, clone], { stdio: 'ignore' });
+        git(clone, 'checkout', '--quiet', '-b', 'feature/whatever');
+        expect(detectDefaultBranch(clone)).toBe('develop');
+    });
+    test('falls back to main outside a git repository', () => {
+        const notARepo = join(root, 'bare-dir');
+        execFileSync('mkdir', ['-p', notARepo]);
+        expect(detectDefaultBranch(notARepo)).toBe('main');
+    });
+    test('falls back to main on a detached HEAD with no remote', () => {
+        const dir = makeRepo(root, 'detached', 'main');
+        const sha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: dir, encoding: 'utf8' }).trim();
+        git(dir, 'checkout', '--quiet', sha);
+        expect(detectDefaultBranch(dir)).toBe('main');
+    });
+});
+//# sourceMappingURL=git.test.js.map

package/dist/src/yaml/steps/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAwFF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA0GzF,iBAAiB;CAqMhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAgKzF,iBAAiB;CAmIhC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AA6HF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA0HzF,iBAAiB;CA0MhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAsLzF,iBAAiB;CA0JhC"}

package/dist/src/yaml/steps/cache.js

@@ -87,28 +87,64 @@ function resolvePresetChain(technology) {
     return chain;
 }
 /**
- * Emits the daemon exact-key pull branch (ADR 0001, Phase 3b). On a local
- * miss, GET `<key>.tar.zst` from this runner's cache daemon ($CIBUILD_CACHE_DAEMON,
- * injected by the runner). The daemon fans out to tailnet peers, persists the
- * hit to ~/cache, and streams it back — so we pipe straight to extraction
- * without re-writing it on the guest. The optional per-build bearer token
- * ($CIBUILD_CACHE_TOKEN) is sent only when set. Inert when the env var is
- * empty, so the same script runs with or without a daemon.
+ * Emits the `curl` invocation the cache steps talk to the daemon with. The
+ * bearer token is per-build and only present on the Invarn runner, so it is
+ * expanded conditionally and the same script works without one.
  */
-function emitDaemonPullBranch() {
+function daemonCurl(args) {
+    return `curl -fsS \${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} ${args}`;
+}
+/**
+ * Restores a cache through the daemon rather than a shared directory.
+ *
+ * Two requests, mirroring the directory-based flow it replaces: the exact key
+ * first, then — on a miss — the scope's newest tarball. The daemon resolves
+ * each from its own disk or a tailnet peer, so a hit here covers what used to
+ * be separate "local" and "peer" branches; which one it was is recorded in the
+ * daemon's own host-side log, where the fleet-wide view already lives.
+ *
+ * The 30-day age cap is preserved: the daemon dates the fallback with
+ * `mtimeMs`, standing in for the `stat` the guest can no longer perform.
+ */
+function emitDaemonPullCommands() {
     return [
-        // stderr is silenced on the probe: a cache miss is the normal case and
-        // makes curl emit "(22) ... 404" (and the empty body makes zstd print
-        // "unexpected end of file"). Those are non-actionable — the branch just
-        // falls through to the cold path — so they're pure log noise. Exit
-        // status is preserved (pipefail), so the fall-through still works.
-        'elif [ -n "$CIBUILD_CACHE_DAEMON" ] && { curl -fsS ${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst" | zstd -dc | tar -xf - -C /; } 2>/dev/null; then',
+        'echo "Cache daemon: $CIBUILD_CACHE_DAEMON"',
+        // Exact key. stderr silenced — a miss is the normal case and curl/zstd
+        // both editorialise about it; pipefail still carries the exit status.
+        `if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`,
         '  echo "Cache found (daemon), extracting..."',
-        // LRU bump the tarball the daemon just persisted to ~/cache (same dir as
-        // the --dir mount); tolerate its absence in case the daemon served it
-        // without a local copy.
-        '  touch "$CACHE_FILE" 2>/dev/null || true',
         '  echo "CACHE_SOURCE=daemon CACHE_KEY=$CACHE_KEY"',
+        'else',
+        // Scope fallback: the newest tarball for this <keyPrefix>-<projectId>.
+        // Gradle/Xcode re-hash their inputs on top of the warm directory, hitting
+        // the unchanged work and rebuilding only what actually moved.
+        '  __ci_fb_scope="${CACHE_KEY%-*}"',
+        `  __ci_fb_json=$(${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/scope/$__ci_fb_scope/latest"')} 2>/dev/null || true)`,
+        // Parse without a JSON tool: the guest image is not guaranteed to ship jq.
+        `  __ci_fb_key=$(printf '%s' "$__ci_fb_json" | sed -n 's/.*"key"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p')`,
+        `  __ci_fb_mtime=$(printf '%s' "$__ci_fb_json" | sed -n 's/.*"mtimeMs"[[:space:]]*:[[:space:]]*\\([0-9]*\\).*/\\1/p')`,
+        '  if [ -n "$__ci_fb_key" ] && [ -n "$__ci_fb_mtime" ]; then',
+        '    __ci_fb_age_days=$(( ($(date +%s) - __ci_fb_mtime / 1000) / 86400 ))',
+        // Age cap: a fallback older than 30d likely carries obsolete toolchain
+        // installs or cache entries from a pre-wrapper-bump world. Go cold rather
+        // than seed from ancient state. Exact-key hits are unaffected.
+        '    if [ "$__ci_fb_age_days" -le 30 ]; then',
+        '      echo "Cache fallback (daemon): using prior tarball $__ci_fb_key (${__ci_fb_age_days}d old)"',
+        `      if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$__ci_fb_key.tar.zst"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`,
+        '        echo "CACHE_SOURCE=fallback_daemon CACHE_KEY=$CACHE_KEY FALLBACK_KEY=$__ci_fb_key"',
+        '      else',
+        '        echo "Cache fallback $__ci_fb_key could not be fetched — going cold"',
+        '        echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"',
+        '      fi',
+        '    else',
+        '      echo "Cache fallback candidate $__ci_fb_key is ${__ci_fb_age_days}d old, exceeds 30d cap — going cold"',
+        '      echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY FALLBACK_REJECTED=$__ci_fb_key"',
+        '    fi',
+        '  else',
+        '    echo "No cache found for key: $CACHE_KEY"',
+        '    echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"',
+        '  fi',
+        'fi',
     ];
 }
 /**
@@ -154,7 +190,11 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         commands.push('');
         commands.push('# Ensure cache directory exists');
         commands.push(`CACHE_DIR="${this.escapeBash(config.paths.cacheDir)}"`);
-        commands.push('mkdir -p "$CACHE_DIR"');
+        // Only the filesystem transport needs the directory to exist. Over the
+        // daemon the cache lives on the host, and on a runner this path is no
+        // longer mounted into the VM — an unconditional mkdir would abort the
+        // whole step under errexit.
+        commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
@@ -174,6 +214,17 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // Check if cache file exists
         commands.push('');
         commands.push('# Check if cache exists');
+        // Transport split — see the preset path. An explicit-key step has no scope
+        // to fall back to, so the daemon side is the exact key or nothing.
+        commands.push('if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
+        commands.push(`  if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`);
+        commands.push('    echo "Cache found (daemon), extracting..."');
+        commands.push('    echo "CACHE_SOURCE=daemon"');
+        commands.push('  else');
+        commands.push(`    echo "No cache found for key: ${this.escapeBash(cacheKey)}"`);
+        commands.push('    echo "CACHE_SOURCE=cold"');
+        commands.push('  fi');
+        commands.push('else');
         commands.push('if [ -f "$CACHE_FILE" ]; then');
         commands.push('  echo "Cache found (local), extracting..."');
         if (isDebugMode) {
@@ -181,8 +232,6 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         }
         commands.push('  zstd -dc "$CACHE_FILE" | tar -xf - -C /');
         commands.push('  echo "CACHE_SOURCE=local"');
-        // Daemon hit (ADR 0001) — see emitDaemonPullBranch.
-        commands.push(...emitDaemonPullBranch());
         // Peer fallback
         if (peerCacheDir) {
             commands.push('elif [ -f "$PEER_CACHE_FILE" ] 2>/dev/null; then');
@@ -195,6 +244,8 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         commands.push(`  echo "No cache found for key: ${this.escapeBash(cacheKey)}"`);
         commands.push('  echo "CACHE_SOURCE=cold"');
         commands.push('fi');
+        // Closes the daemon/filesystem transport split.
+        commands.push('fi');
         const script = this.createBashScriptFromCommands(commands, stepName);
         return this.createScriptStep(script, stepName);
     }
@@ -213,7 +264,11 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // Compute cache key from lockfile checksum at runtime
         // If technology has a fallback chain, try each lockfile in order
         commands.push(`CACHE_DIR="${this.escapeBash(config.paths.cacheDir)}"`);
-        commands.push('mkdir -p "$CACHE_DIR"');
+        // Only the filesystem transport needs the directory to exist. Over the
+        // daemon the cache lives on the host, and on a runner this path is no
+        // longer mounted into the VM — an unconditional mkdir would abort the
+        // whole step under errexit.
+        commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
         commands.push('');
         // Helper: resolve lockfile path — checks exact path first, then searches
         // recursively (handles SPM Package.resolved inside .xcodeproj/.xcworkspace)
@@ -273,6 +328,12 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         }
         commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
         commands.push('');
+        // Transport split. On a runner the cache lives on the host and is reached
+        // over HTTP; standalone, it is a directory on this machine. The daemon URL
+        // is the switch, so the same generated script serves both.
+        commands.push('if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
+        commands.push(...emitDaemonPullCommands());
+        commands.push('else');
         // Peer cache directory — set from config, empty string disables peer lookup
         const peerCacheDir = config.paths.peerCacheDir || '';
         if (peerCacheDir) {
@@ -292,13 +353,6 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // hit daily would still be reaped on its 31st day from creation.
         commands.push('  touch "$CACHE_FILE"');
         commands.push('  echo "CACHE_SOURCE=local CACHE_KEY=$CACHE_KEY"');
-        // 1b. Daemon hit (ADR 0001) — on a local miss, ask this runner's cache
-        // daemon for the exact key. The daemon resolves it from a tailnet peer
-        // and atomically persists it to ~/cache (the same dir as the --dir mount),
-        // so we stream the response straight to extraction with no redundant
-        // guest-side write. Gated at runtime on the env var the runner injects, so
-        // the generated script is inert when no daemon is configured.
-        commands.push(...emitDaemonPullBranch());
         // 2. Peer hit — tee to warm local cache while extracting in one pass
         if (peerCacheDir) {
             commands.push('elif [ -f "$PEER_CACHE_FILE" ] 2>/dev/null; then');
@@ -362,6 +416,8 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         commands.push('    echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"');
         commands.push('  fi');
         commands.push('fi');
+        // Closes the daemon/filesystem transport split.
+        commands.push('fi');
         if (isDebugMode) {
             commands.push('echo "Restored paths:"');
             const allPaths = [...new Set(chain.flatMap(p => p.paths))];
@@ -427,7 +483,11 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         commands.push('');
         commands.push('# Ensure cache directory exists');
         commands.push(`CACHE_DIR="${this.escapeBash(config.paths.cacheDir)}"`);
-        commands.push('mkdir -p "$CACHE_DIR"');
+        // Only the filesystem transport needs the directory to exist. Over the
+        // daemon the cache lives on the host, and on a runner this path is no
+        // longer mounted into the VM — an unconditional mkdir would abort the
+        // whole step under errexit.
+        commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
@@ -488,7 +548,10 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         // Create cache if we have paths
         commands.push('');
         commands.push('# Skip if cache already exists for this key');
-        commands.push('if [ -f "$CACHE_FILE" ]; then');
+        // Over the daemon there is no local file to test, so the "already up to
+        // date" shortcut can't apply — the daemon's PUT is an idempotent overwrite
+        // under the same key, which gets the same outcome.
+        commands.push('if [ -z "$CIBUILD_CACHE_DAEMON" ] && [ -f "$CACHE_FILE" ]; then');
         commands.push('  echo "Cache already up to date for key: $CACHE_KEY"');
         commands.push('elif [ ${#PATHS_TO_CACHE[@]} -gt 0 ]; then');
         commands.push('  echo "Caching ${#PATHS_TO_CACHE[@]} path(s)..."');
@@ -496,6 +559,14 @@ export class CachePushStepExecutor extends BaseStepExecutor {
             commands.push('  echo "Paths to cache:"');
             commands.push('  printf "  %s\\n" "${PATHS_TO_CACHE[@]}"');
         }
+        // Transport split — see the preset path.
+        commands.push('  if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
+        commands.push(`    if tar -cf - "\${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 | ${daemonCurl('-T - "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} > /dev/null; then`);
+        commands.push('      echo "Cache created successfully"');
+        commands.push('    else');
+        commands.push('      echo "Warning: failed to upload cache to the daemon"');
+        commands.push('    fi');
+        commands.push('  else');
         // Atomic write into a per-process-unique temp (CBR-12). The "runs serialized
         // per runner" assumption behind a fixed "$CACHE_FILE.tmp" is false with two VM
         // slots and collides with the host cache daemon mutating this VirtioFS-shared
@@ -511,6 +582,8 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         commands.push('  else');
         commands.push('    echo "Warning: Failed to create cache file"');
         commands.push('  fi');
+        // Closes the daemon/filesystem transport split.
+        commands.push('  fi');
         commands.push('else');
         commands.push('  echo "No paths to cache"');
         commands.push('fi');
@@ -531,7 +604,11 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         commands.push('');
         // Compute cache key from lockfile checksum at runtime
         commands.push(`CACHE_DIR="${this.escapeBash(config.paths.cacheDir)}"`);
-        commands.push('mkdir -p "$CACHE_DIR"');
+        // Only the filesystem transport needs the directory to exist. Over the
+        // daemon the cache lives on the host, and on a runner this path is no
+        // longer mounted into the VM — an unconditional mkdir would abort the
+        // whole step under errexit.
+        commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
         commands.push('');
         commands.push('__ci_find_lockfile() {');
         commands.push('  if [ -f "$1" ]; then echo "$1"; return; fi');
@@ -610,6 +687,19 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         // build. Atomic .tmp + mv overwrites any prior tarball under this key.
         commands.push('if [ ${#PATHS_TO_CACHE[@]} -gt 0 ]; then');
         commands.push('  echo "Caching ${#PATHS_TO_CACHE[@]} path(s)..."');
+        // Transport split, mirroring cache-pull. Over the daemon the tarball is
+        // streamed straight out as the PUT body — nothing is staged on the guest,
+        // so there is no temp file to collide or orphan, and the daemon does the
+        // atomic temp+rename on the host side where the cache actually lives.
+        commands.push('  if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
+        commands.push(`    if tar -cf - "\${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 | ${daemonCurl('-T - "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} > /dev/null; then`);
+        commands.push('      echo "Cache created successfully"');
+        commands.push('    else');
+        // Never fatal: a build that produced good output should not be failed by a
+        // cache upload, and the next build simply misses.
+        commands.push('      echo "Warning: failed to upload cache to the daemon"');
+        commands.push('    fi');
+        commands.push('  else');
         // Per-process-unique temp (CBR-12). The old fixed "$CACHE_FILE.tmp" assumed
         // a single serialized writer — false with two VM slots, and it collides with
         // the host cache daemon mutating this VirtioFS-shared dir, which (a) made the
@@ -632,6 +722,8 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         commands.push('  else');
         commands.push('    echo "Warning: Failed to create cache file"');
         commands.push('  fi');
+        // Closes the daemon/filesystem transport split.
+        commands.push('  fi');
         commands.push('else');
         commands.push('  echo "No paths to cache"');
         commands.push('fi');