@invarn/cibuild 2.5.8 → 2.6.0

package/dist/src/yaml/steps/cache-push-daemon.test.js

@@ -0,0 +1,132 @@
+/**
+ * `cache-push` with an explicit `cache_key`, over the daemon.
+ *
+ * Every curated Invarn template uses the explicit-key form — `cache_key:
+ * pods-{{checksum "Podfile.lock"}}-$CIBUILD_GIT_BRANCH` and its Gradle/KMM
+ * siblings — for both halves of the pair. The pull side assigns the shell
+ * variable the daemon URL interpolates; the push side did not, and there is
+ * no `set -u`, so `$CACHE_KEY` expanded to nothing and the upload went to
+ * `<daemon>/cache/.tar.zst`. The daemon requires at least one character
+ * before `.tar.zst` and answers 400, which is exactly what the first real
+ * `invarn setup` proof logged on 2026-08-30:
+ *
+ *     curl: (22) The requested URL returned error: 400
+ *     Warning: failed to upload cache to the daemon
+ *     [step_6] ✓ Success (109ms)
+ *
+ * Nothing was ever stored, so the pull could never hit, and every iOS build
+ * paid a cold `pod install`.
+ *
+ * These tests RUN the generated script. A containment check on the script
+ * text cannot see this defect: the text contains the literal `$CACHE_KEY`
+ * either way, which is why the existing assertion passed throughout. `curl`
+ * and `zstd` are stubbed onto PATH so the pipeline completes on any host and
+ * the URL actually requested can be read back.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { execFileSync } from 'child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, existsSync, chmodSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { CachePushStepExecutor } from './cache.js';
+import { testConfigNoPeer } from './test-config.js';
+const CACHE_KEY = 'pods-abc123def456-main';
+/**
+ * Generates the explicit-key push step, runs it, and reports what `curl` was
+ * actually asked to do.
+ *
+ * @param curlExit  exit status the stub returns, and `curlBody` is what it
+ *                  prints — so a rejection can be exercised without a daemon.
+ */
+async function runPush({ curlExit = 0, curlBody = '' } = {}) {
+    const dir = mkdtempSync(join(tmpdir(), 'cibuild-push-'));
+    try {
+        // Something real to cache, so the step does not take its empty branch.
+        const payload = join(dir, 'Pods');
+        mkdirSync(payload, { recursive: true });
+        writeFileSync(join(payload, 'thing.txt'), 'contents\n', 'utf-8');
+        const bin = join(dir, 'bin');
+        mkdirSync(bin, { recursive: true });
+        const urlLog = join(dir, 'curl-urls.txt');
+        // Records the URL, drains stdin so the upstream pipe does not break.
+        writeFileSync(join(bin, 'curl'), [
+            '#!/bin/bash',
+            'for arg in "$@"; do',
+            '  case "$arg" in',
+            `    http*) printf '%s\\n' "$arg" >> "${urlLog}" ;;`,
+            '  esac',
+            'done',
+            'cat > /dev/null',
+            curlBody ? `printf '%s' ${JSON.stringify(curlBody)}` : ':',
+            `exit ${curlExit}`,
+        ].join('\n'), 'utf-8');
+        chmodSync(join(bin, 'curl'), 0o755);
+        // zstd is not on every host, and without it the pipeline fails before
+        // curl is ever reached — which would make these tests pass vacuously.
+        writeFileSync(join(bin, 'zstd'), '#!/bin/bash\ncat\n', 'utf-8');
+        chmodSync(join(bin, 'zstd'), 0o755);
+        const { script } = await new CachePushStepExecutor().execute({ cache_key: CACHE_KEY, cache_paths: ['Pods'] }, {}, testConfigNoPeer);
+        const scriptPath = join(dir, '__cache_push.sh');
+        writeFileSync(scriptPath, script, 'utf-8');
+        let stdout = '';
+        try {
+            stdout = execFileSync('bash', [scriptPath], {
+                cwd: dir,
+                encoding: 'utf-8',
+                stdio: ['ignore', 'pipe', 'pipe'],
+                env: {
+                    ...process.env,
+                    PATH: `${bin}:${process.env.PATH}`,
+                    CIBUILD_CACHE_DAEMON: 'http://daemon.invalid',
+                    CIBUILD_CACHE_TOKEN: 'tok',
+                },
+                timeout: 20000,
+            });
+        }
+        catch (e) {
+            const err = e;
+            stdout = String(err.stdout ?? '') + String(err.stderr ?? '');
+        }
+        const urls = existsSync(urlLog)
+            ? readFileSync(urlLog, 'utf-8').split('\n').filter(Boolean)
+            : [];
+        return { stdout, urls };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+describe('cache-push with an explicit key, over the daemon', () => {
+    test('uploads under the key it was given', async () => {
+        const { urls } = await runPush();
+        expect(urls).toHaveLength(1);
+        expect(urls[0]).toBe(`http://daemon.invalid/cache/${CACHE_KEY}.tar.zst`);
+    });
+    test('never uploads to an empty key', async () => {
+        // The defect, named. `<daemon>/cache/.tar.zst` is what an unassigned
+        // `$CACHE_KEY` produces, and what the daemon answers 400 to.
+        const { urls } = await runPush();
+        for (const url of urls) {
+            expect(url).not.toMatch(/\/cache\/\.tar\.zst$/);
+        }
+    });
+    test('the step survives a rejection rather than failing the build', async () => {
+        // Deliberate: a build that produced good output should not be failed by a
+        // cache upload. Whether the STEP should still report success having
+        // stored nothing is a separate, open question.
+        const { stdout } = await runPush({ curlExit: 22 });
+        expect(stdout).toContain('Warning: failed to upload cache to the daemon');
+    });
+    test('a rejection says why, not just that it happened', async () => {
+        // `curl -f` throws the response body away, so the daemon's own reason —
+        // `invalid_cache_key`, `cache_busy`, an auth failure — never reached the
+        // log. All the reader got was an exit code, which is how a one-line bug
+        // stayed open behind a warning that named nothing.
+        const { stdout } = await runPush({
+            curlExit: 22,
+            curlBody: '{"error":"invalid_cache_key"}',
+        });
+        expect(stdout).toContain('invalid_cache_key');
+    });
+});
+//# sourceMappingURL=cache-push-daemon.test.js.map

package/dist/src/yaml/steps/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AA6HF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA0HzF,iBAAiB;CA0MhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAsLzF,iBAAiB;CA0JhC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAuPF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA6HzF,iBAAiB;CA0MhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAkLzF,iBAAiB;CAgJhC"}

package/dist/src/yaml/steps/cache.js

@@ -86,13 +86,120 @@ function resolvePresetChain(technology) {
     }
     return chain;
 }
+/** The token `%{http_code}` is reported under; see `daemonCurl`. */
+const DAEMON_STATUS_TOKEN = 'ci_http_status';
 /**
  * Emits the `curl` invocation the cache steps talk to the daemon with. The
  * bearer token is per-build and only present on the Invarn runner, so it is
  * expanded conditionally and the same script works without one.
+ *
+ * Every request also reports the HTTP status it got, on **stderr** — the
+ * response body is the tarball and goes to stdout, so a status written there
+ * would corrupt it. `%{stderr}` is curl 7.63+ (2018); an older curl prints the
+ * token literally instead of a number, which the reader below tolerates.
+ *
+ * `-f`, not `--fail-with-body`: on the pull side the error body would be piped
+ * straight into `zstd`. The status is what distinguishes the answers anyway,
+ * and it now arrives without the body.
  */
 function daemonCurl(args) {
-    return `curl -fsS \${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} ${args}`;
+    return `curl -fsS -w '%{stderr}${DAEMON_STATUS_TOKEN}=%{http_code}\\n' \${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} ${args}`;
+}
+/**
+ * Emitted once inside a daemon pull branch, before the first fetch: a file for
+ * curl's stderr, and the reader that turns it into one line — or into nothing
+ * at all when the daemon simply had no such entry.
+ *
+ * `{ curl | zstd | tar; } 2>/dev/null` used to swallow curl's message
+ * entirely, so a 401, a 400, a 503, a 500 and a daemon that was not listening
+ * all printed the same `No cache found for key: …` as an empty cache. That is
+ * the same class as the push-side defect: the instrument reported the normal
+ * case for every abnormal one.
+ *
+ * **A miss stays quiet and a failure gets loud.** A cold cache is the normal
+ * case and must not start printing errors; the point is only that a broken
+ * daemon stops looking like one.
+ */
+function emitDaemonPullDiagnostics(indent = '') {
+    return [
+        `${indent}__ci_cache_diag="\${TMPDIR:-/tmp}/cibuild-cache-pull.$$.diag"`,
+        `${indent}__ci_cache_daemon_said() {`,
+        `${indent}  local __said=''`,
+        `${indent}  if [ -s "$__ci_cache_diag" ]; then`,
+        `${indent}    __said=$(tr '\\n' ' ' < "$__ci_cache_diag")`,
+        `${indent}  fi`,
+        `${indent}  case "$__said" in`,
+        // 404 is the daemon's answer for `cache_miss` and `no_cache_for_scope` —
+        // an empty cache, which is normal. The second pattern reads curl's own
+        // English for a curl too old to honour `%{stderr}`, so neither reader
+        // failing alone can turn a cold cache noisy.
+        `${indent}    *${DAEMON_STATUS_TOKEN}=404*|*'error: 404'*) __said='' ;;`,
+        `${indent}  esac`,
+        // Always exits 0. A non-zero return would be the assignment's status at
+        // every call site, and under errexit that ends the step on a cache miss.
+        `${indent}  printf '%s' "\${__said:0:300}"`,
+        `${indent}}`,
+    ];
+}
+/**
+ * The `else` arm of a daemon fetch: says why it did not restore, unless the
+ * daemon simply had no such entry. Never fatal — a build that cannot read a
+ * cache still builds, it just builds cold.
+ */
+function emitDaemonPullFailureDiagnosis(indent, what) {
+    return [
+        `${indent}__ci_cache_why=$(__ci_cache_daemon_said)`,
+        `${indent}if [ -n "$__ci_cache_why" ]; then`,
+        `${indent}  echo "Warning: cache-pull could not restore ${what} from the daemon — $__ci_cache_why"`,
+        `${indent}fi`,
+    ];
+}
+/**
+ * The same request, keeping the response body when the daemon refuses.
+ *
+ * `-f` throws the body away, so a rejection reached the log as an exit code
+ * and nothing else. The daemon distinguishes `invalid_cache_key` (400), a
+ * retryable `cache_busy` (503) and an auth failure (401); all three arrived
+ * as the same `curl: (22)` line under the same warning, which is how a
+ * one-line bug stayed open behind it. Push only — on the pull side the body
+ * would be piped into `zstd`.
+ *
+ * `--fail-with-body` is curl 7.76+ (2021); every runner image is well past
+ * it. An older curl rejects the option and the step still degrades to
+ * today's behaviour, with the reason in the message.
+ */
+function daemonCurlKeepingErrorBody(args) {
+    return `curl --fail-with-body -sS \${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} ${args}`;
+}
+/**
+ * The daemon half of `cache-push`, shared by both step forms.
+ *
+ * Shared because it did not used to be. The two forms carried byte-identical
+ * copies of this block, and the explicit-key one reached it without ever
+ * assigning the `CACHE_KEY` it interpolates — the preset form assigned it,
+ * the other only assigned `CACHE_FILE`. There is no `set -u`, so the PUT went
+ * to `<daemon>/cache/.tar.zst`, the daemon answered 400, and the step
+ * reported success. Every curated Invarn template uses the explicit-key form,
+ * so nothing was ever stored by any of them. One definition cannot diverge
+ * from itself.
+ */
+function emitDaemonPushCommands() {
+    return [
+        `    if __ci_push_err=$(tar -cf - "\${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 | ${daemonCurlKeepingErrorBody('-T - "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} 2>&1); then`,
+        '      echo "Cache created successfully"',
+        '    else',
+        // Never fatal: a build that produced good output should not be failed by
+        // a cache upload, and the next build simply misses. Saying *why* costs
+        // nothing and is the difference between a warning and a diagnosis.
+        "      __ci_push_msg=$(printf '%s' \"$__ci_push_err\" | tr '\\n' ' ')",
+        '      __ci_push_msg=${__ci_push_msg:0:300}',
+        '      if [ -n "$__ci_push_msg" ]; then',
+        '        echo "Warning: failed to upload cache to the daemon — $__ci_push_msg"',
+        '      else',
+        '        echo "Warning: failed to upload cache to the daemon"',
+        '      fi',
+        '    fi',
+    ];
 }
 /**
  * Restores a cache through the daemon rather than a shared directory.
@@ -109,12 +216,18 @@ function daemonCurl(args) {
 function emitDaemonPullCommands() {
     return [
         'echo "Cache daemon: $CIBUILD_CACHE_DAEMON"',
-        // Exact key. stderr silenced — a miss is the normal case and curl/zstd
-        // both editorialise about it; pipefail still carries the exit status.
-        `if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`,
+        ...emitDaemonPullDiagnostics(),
+        // Exact key. zstd's and tar's stderr is silenced — a miss is the normal
+        // case and they both editorialise about it; pipefail still carries the
+        // exit status. curl's own stderr is kept, in the file the diagnostics
+        // above read: it is the only thing that knows *why*.
+        `if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst" 2>"$__ci_cache_diag"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`,
         '  echo "Cache found (daemon), extracting..."',
         '  echo "CACHE_SOURCE=daemon CACHE_KEY=$CACHE_KEY"',
         'else',
+        // Said before the fallback is attempted, so the reason names the request
+        // it belongs to rather than whichever request happened to fail last.
+        ...emitDaemonPullFailureDiagnosis('  ', '$CACHE_KEY'),
         // Scope fallback: the newest tarball for this <keyPrefix>-<projectId>.
         // Gradle/Xcode re-hash their inputs on top of the warm directory, hitting
         // the unchanged work and rebuilding only what actually moved.
@@ -130,10 +243,11 @@ function emitDaemonPullCommands() {
         // than seed from ancient state. Exact-key hits are unaffected.
         '    if [ "$__ci_fb_age_days" -le 30 ]; then',
         '      echo "Cache fallback (daemon): using prior tarball $__ci_fb_key (${__ci_fb_age_days}d old)"',
-        `      if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$__ci_fb_key.tar.zst"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`,
+        `      if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$__ci_fb_key.tar.zst" 2>"$__ci_cache_diag"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`,
         '        echo "CACHE_SOURCE=fallback_daemon CACHE_KEY=$CACHE_KEY FALLBACK_KEY=$__ci_fb_key"',
         '      else',
         '        echo "Cache fallback $__ci_fb_key could not be fetched — going cold"',
+        ...emitDaemonPullFailureDiagnosis('        ', '$__ci_fb_key'),
         '        echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"',
         '      fi',
         '    else',
@@ -145,6 +259,7 @@ function emitDaemonPullCommands() {
         '    echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"',
         '  fi',
         'fi',
+        'rm -f "$__ci_cache_diag"',
     ];
 }
 /**
@@ -217,13 +332,16 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // Transport split — see the preset path. An explicit-key step has no scope
         // to fall back to, so the daemon side is the exact key or nothing.
         commands.push('if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
-        commands.push(`  if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`);
+        commands.push(...emitDaemonPullDiagnostics('  '));
+        commands.push(`  if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst" 2>"$__ci_cache_diag"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`);
         commands.push('    echo "Cache found (daemon), extracting..."');
         commands.push('    echo "CACHE_SOURCE=daemon"');
         commands.push('  else');
+        commands.push(...emitDaemonPullFailureDiagnosis('    ', '$CACHE_KEY'));
         commands.push(`    echo "No cache found for key: ${this.escapeBash(cacheKey)}"`);
         commands.push('    echo "CACHE_SOURCE=cold"');
         commands.push('  fi');
+        commands.push('  rm -f "$__ci_cache_diag"');
         commands.push('else');
         commands.push('if [ -f "$CACHE_FILE" ]; then');
         commands.push('  echo "Cache found (local), extracting..."');
@@ -491,7 +609,11 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
-        commands.push(`CACHE_FILE="$CACHE_DIR/${this.escapeBash(cacheKey)}.tar.zst"`);
+        // CACHE_KEY first, CACHE_FILE derived from it — exactly as the pull side
+        // does. This step used to set only CACHE_FILE while the daemon URL below
+        // interpolated `$CACHE_KEY`; see emitDaemonPushCommands.
+        commands.push(`CACHE_KEY="${this.escapeBash(cacheKey)}"`);
+        commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
         if (isDebugMode) {
             commands.push('echo "Debug mode enabled"');
             commands.push('echo "Cache file: $CACHE_FILE"');
@@ -561,11 +683,7 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         }
         // Transport split — see the preset path.
         commands.push('  if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
-        commands.push(`    if tar -cf - "\${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 | ${daemonCurl('-T - "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} > /dev/null; then`);
-        commands.push('      echo "Cache created successfully"');
-        commands.push('    else');
-        commands.push('      echo "Warning: failed to upload cache to the daemon"');
-        commands.push('    fi');
+        commands.push(...emitDaemonPushCommands());
         commands.push('  else');
         // Atomic write into a per-process-unique temp (CBR-12). The "runs serialized
         // per runner" assumption behind a fixed "$CACHE_FILE.tmp" is false with two VM
@@ -692,13 +810,7 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         // so there is no temp file to collide or orphan, and the daemon does the
         // atomic temp+rename on the host side where the cache actually lives.
         commands.push('  if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
-        commands.push(`    if tar -cf - "\${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 | ${daemonCurl('-T - "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} > /dev/null; then`);
-        commands.push('      echo "Cache created successfully"');
-        commands.push('    else');
-        // Never fatal: a build that produced good output should not be failed by a
-        // cache upload, and the next build simply misses.
-        commands.push('      echo "Warning: failed to upload cache to the daemon"');
-        commands.push('    fi');
+        commands.push(...emitDaemonPushCommands());
         commands.push('  else');
         // Per-process-unique temp (CBR-12). The old fixed "$CACHE_FILE.tmp" assumed
         // a single serialized writer — false with two VM slots, and it collides with

package/dist/src/yaml/steps/envstore-loader.test.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The envstore loader carried by every generated step.
+ *
+ * These tests drive the *reader* — the preamble `createBashScript` prepends —
+ * directly, with hostile envstore content written by hand. Going through a
+ * producer such as git-clone would only prove the one value that producer
+ * happens to write; the defect lives in the reader, so the reader is what gets
+ * the hostile input.
+ *
+ * Each case actually runs bash. Assertions are made on files the script body
+ * writes with `printf '%s'`, not on stdout, so a value's own newlines and
+ * quoting cannot be confused with the test's framing.
+ */
+export {};
+//# sourceMappingURL=envstore-loader.test.d.ts.map

package/dist/src/yaml/steps/envstore-loader.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envstore-loader.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/envstore-loader.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/src/yaml/steps/envstore-loader.test.js

@@ -0,0 +1,143 @@
+/**
+ * The envstore loader carried by every generated step.
+ *
+ * These tests drive the *reader* — the preamble `createBashScript` prepends —
+ * directly, with hostile envstore content written by hand. Going through a
+ * producer such as git-clone would only prove the one value that producer
+ * happens to write; the defect lives in the reader, so the reader is what gets
+ * the hostile input.
+ *
+ * Each case actually runs bash. Assertions are made on files the script body
+ * writes with `printf '%s'`, not on stdout, so a value's own newlines and
+ * quoting cannot be confused with the test's framing.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { spawnSync } from 'child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, existsSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { BaseStepExecutor } from './base.js';
+/** Exposes the protected preamble builder so the reader can be tested on its own. */
+class PreambleProbe extends BaseStepExecutor {
+    async execute(_inputs, _env, _config) {
+        throw new Error('not used');
+    }
+    build(scriptContent) {
+        return this.createBashScript(scriptContent, 'envstore-loader-probe');
+    }
+}
+describe('envstore loader', () => {
+    let workDir;
+    beforeEach(() => {
+        workDir = mkdtempSync(join(tmpdir(), 'envstore-loader-'));
+    });
+    afterEach(() => {
+        rmSync(workDir, { recursive: true, force: true });
+    });
+    /**
+     * Writes an envstore, runs the generated preamble over it, and captures the
+     * named variables as the step body sees them.
+     */
+    function run(envs, capture, extraBody = '') {
+        const storePath = join(workDir, 'envstore.json');
+        const outDir = join(workDir, 'captured');
+        mkdirSync(outDir, { recursive: true });
+        writeFileSync(storePath, JSON.stringify({ envs: envs.map(e => ({ ...e, sensitive: false })) }), 'utf-8');
+        const body = [
+            ...capture.map(name => `printf '%s' "\${${name}-}" > "$CAPTURE_DIR/${name}"`),
+            extraBody,
+        ].join('\n');
+        const scriptPath = join(workDir, 'step.sh');
+        writeFileSync(scriptPath, new PreambleProbe().build(body), 'utf-8');
+        const proc = spawnSync('bash', [scriptPath], {
+            cwd: workDir,
+            encoding: 'utf-8',
+            env: {
+                ...process.env,
+                ENVMAN_ENVSTORE_PATH: storePath,
+                CAPTURE_DIR: outDir,
+            },
+        });
+        return {
+            status: proc.status,
+            stderr: proc.stderr ?? '',
+            captured(name) {
+                const file = join(outDir, name);
+                return existsSync(file) ? readFileSync(file, 'utf-8') : undefined;
+            },
+        };
+    }
+    test('a value containing newlines round-trips byte for byte', () => {
+        const body = 'first line\nsecond line\nthird line';
+        const result = run([{ key: 'GIT_CLONE_COMMIT_MESSAGE_BODY', value: body }], ['GIT_CLONE_COMMIT_MESSAGE_BODY']);
+        expect(result.status).toBe(0);
+        expect(result.captured('GIT_CLONE_COMMIT_MESSAGE_BODY')).toBe(body);
+    });
+    test('security: a value whose lines look like assignments sets nothing', () => {
+        const hostile = 'looks harmless\nPATH=/tmp/attacker-controlled\nNODE_OPTIONS=--require=/tmp/evil.js';
+        const result = run([{ key: 'GIT_CLONE_COMMIT_MESSAGE_BODY', value: hostile }], ['GIT_CLONE_COMMIT_MESSAGE_BODY', 'PATH', 'NODE_OPTIONS']);
+        expect(result.status).toBe(0);
+        // The value arrives intact...
+        expect(result.captured('GIT_CLONE_COMMIT_MESSAGE_BODY')).toBe(hostile);
+        // ...and none of its lines became a variable. Both are compared against
+        // what the parent environment held, which is what "unchanged" means here:
+        // the test runner itself sets NODE_OPTIONS.
+        expect(result.captured('PATH')).toBe(process.env.PATH ?? '');
+        expect(result.captured('NODE_OPTIONS')).toBe(process.env.NODE_OPTIONS ?? '');
+        expect(result.captured('NODE_OPTIONS')).not.toContain('/tmp/evil.js');
+    });
+    test('awkward bytes in a value all survive unchanged', () => {
+        const cases = [
+            { key: 'HAS_EQUALS', value: 'a=b=c' },
+            { key: 'HAS_QUOTES', value: `single ' double " both '"` },
+            { key: 'HAS_BACKTICKS', value: 'a `whoami` b' },
+            { key: 'HAS_SUBSHELL', value: 'a $(whoami) b ${HOME} c' },
+            { key: 'HAS_TRAILING_NEWLINE', value: 'ends with a newline\n' },
+            { key: 'HAS_LONE_CR', value: 'before\rafter' },
+            { key: 'HAS_BACKSLASHES', value: 'C:\\path\\to\\thing and \\n literal' },
+            { key: 'HAS_LEADING_SPACE', value: '   padded   ' },
+        ];
+        const result = run(cases, cases.map(c => c.key));
+        expect(result.status).toBe(0);
+        for (const { key, value } of cases) {
+            expect({ key, value: result.captured(key) }).toEqual({ key, value });
+        }
+    });
+    test('a non-identifier key is skipped without failing the step under set -e', () => {
+        const result = run([
+            { key: 'not a valid identifier', value: 'x' },
+            { key: '2_LEADING_DIGIT', value: 'x' },
+            { key: '', value: 'x' },
+            { key: 'GOOD_KEY', value: 'kept' },
+        ], ['GOOD_KEY'], 'echo reached-the-end');
+        expect(result.status).toBe(0);
+        expect(result.captured('GOOD_KEY')).toBe('kept');
+        expect(result.stderr).not.toContain('not a valid identifier');
+    });
+    test('regression: a multi-line commit message does not end the step', () => {
+        // The shape that killed the first real proof on 2026-08-30: git-clone
+        // publishes the commit body, and every later step died loading it.
+        const result = run([
+            { key: 'GIT_CLONE_COMMIT_MESSAGE_SUBJECT', value: 'Add Invarn pipeline' },
+            {
+                key: 'GIT_CLONE_COMMIT_MESSAGE_BODY',
+                value: 'cibuild sets CIBUILD_GIT_BRANCH, so pre-execution validation asked for a\nvalue nothing provides.\n\nSecond paragraph.',
+            },
+        ], ['GIT_CLONE_COMMIT_MESSAGE_SUBJECT'], 'echo step-completed');
+        expect(result.status).toBe(0);
+        expect(result.captured('GIT_CLONE_COMMIT_MESSAGE_SUBJECT')).toBe('Add Invarn pipeline');
+        expect(result.stderr).not.toContain('not a valid identifier');
+    });
+    test('an absent envstore leaves the step to run normally', () => {
+        const scriptPath = join(workDir, 'no-store.sh');
+        writeFileSync(scriptPath, new PreambleProbe().build('echo ran'), 'utf-8');
+        const proc = spawnSync('bash', [scriptPath], {
+            cwd: workDir,
+            encoding: 'utf-8',
+            env: { ...process.env, ENVMAN_ENVSTORE_PATH: join(workDir, 'missing.json') },
+        });
+        expect(proc.status).toBe(0);
+        expect(proc.stdout).toContain('ran');
+    });
+});
+//# sourceMappingURL=envstore-loader.test.js.map

package/dist/src/yaml/steps/steps.test.js

@@ -218,17 +218,28 @@ describe('Step Implementations', () => {
                 mkdirSync(swiftpm, { recursive: true });
                 writeFileSync(join(swiftpm, 'Package.resolved'), '{"pins":[],"version":3}');
             }
-            test('a cold daemon miss does not print curl/zstd noise', async () => {
-                // Reproduce the runner setup: a configured cache daemon whose
-                // probe fails for an uncached key. (We point at a closed port so
-                // curl errors instantly with no server handle to leak — the fix
-                // silences curl's stderr regardless of the failure mode, exactly
-                // as it does for the 404 seen in production.) The probe must fall
-                // through to cold quietly: no "curl:" or "unexpected end of file".
-                const { stdout, combined } = await runIosPull(writeSpmFixture, {
+            test('a daemon that is not listening is named once, and leaks no raw noise', async () => {
+                // A closed port: curl errors instantly with no server handle to leak.
+                //
+                // This used to assert that the output contained no `curl:` at all —
+                // curl's stderr was silenced whatever the failure mode was, which is
+                // how a 401, a 500 and a dead daemon all came to print the same
+                // `No cache found` as an empty cache. The contract is now narrower: a
+                // *miss* is silent (the 404 case, covered against a real listener in
+                // cache-pull-daemon.test.ts), a *failure* is named exactly once, and
+                // neither leaks the raw pipeline chatter that made the old blanket
+                // silence attractive in the first place.
+                const { stdout, stderr, combined } = await runIosPull(writeSpmFixture, {
                     CIBUILD_CACHE_DAEMON: 'http://127.0.0.1:1',
                 });
-                expect(combined).not.toContain('curl:');
+                expect(stdout).toContain('Warning: cache-pull could not restore');
+                expect(stdout).toMatch(/Failed to connect|Couldn't connect|Connection refused/);
+                // Once, not once per request the step happens to make.
+                expect(stdout.match(/Warning: cache-pull could not restore/gu)).toHaveLength(1);
+                // Whatever curl said arrives inside that one line, on stdout. Nothing
+                // reaches the build log as loose interleaved stderr, and zstd/tar still
+                // do not editorialise about a stream that never arrived.
+                expect(stderr).not.toContain('curl:');
                 expect(combined).not.toContain('unexpected end of file');
                 // Still resolves the SPM key and reports a cold miss.
                 expect(stdout).toContain('CACHE_SOURCE=cold');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.5.8",
+  "version": "2.6.0",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",