@nanmicoder/dsh-skills-hub 0.0.1 → 0.0.3

package/lib/config.js

@@ -27,6 +27,7 @@ export const SKILLS_HUB_DEFAULTS = {
     requestRetries: 1,
     allowUninstall: true,
     pageSize: 24,
+    cacheTtlMinutes: 60,
 };
 /**
  * `null` must stay a legal value for `skillsRoot` (it is the "use the DSH
@@ -48,4 +49,5 @@ export const Config = z.object({
     requestRetries: z.natural().default(SKILLS_HUB_DEFAULTS.requestRetries),
     allowUninstall: z.boolean().default(SKILLS_HUB_DEFAULTS.allowUninstall),
     pageSize: z.natural().min(1).max(100).default(SKILLS_HUB_DEFAULTS.pageSize),
+    cacheTtlMinutes: z.natural().min(1).max(1440).default(SKILLS_HUB_DEFAULTS.cacheTtlMinutes),
 });

package/lib/index.js

@@ -15,11 +15,13 @@
  *
  * @module dsh-skills-hub
  */
+import * as path from 'node:path';
 import { Config, SKILLS_HUB_DEFAULTS } from "./config.js";
+import { configureMarketCache } from "./market/cache.js";
 import { configureProviderFetch } from "./market/provider-fetch.js";
 import { setInstalledLookup, resetInstalledLookup } from "./market/market-service.js";
 import { installedLookupFrom, scanInstalledSkills } from "./skills/installed.js";
-import { resolveSkillsRoot, resolveSkillsScanRoots } from "./skills/root.js";
+import { resolveDshHome, resolveSkillsRoot, resolveSkillsScanRoots } from "./skills/root.js";
 import { registerSkillsHubRoutes, setSkillsHubPageSize, } from "./web-routes.js";
 export const name = 'skills-hub';
 /**
@@ -52,6 +54,7 @@ function resolveConfig(config) {
         requestRetries: config?.requestRetries ?? SKILLS_HUB_DEFAULTS.requestRetries,
         allowUninstall: config?.allowUninstall ?? SKILLS_HUB_DEFAULTS.allowUninstall,
         pageSize: config?.pageSize ?? SKILLS_HUB_DEFAULTS.pageSize,
+        cacheTtlMinutes: config?.cacheTtlMinutes ?? SKILLS_HUB_DEFAULTS.cacheTtlMinutes,
     };
 }
 /**
@@ -101,6 +104,11 @@ export function apply(ctx, config) {
         retries: resolved.requestRetries,
     });
     setSkillsHubPageSize(resolved.pageSize);
+    configureMarketCache({
+        directory: path.join(resolveDshHome(), 'cache', 'skills-hub', 'v1'),
+        ttlMs: resolved.cacheTtlMinutes * 60_000,
+        onError: (error) => ctx.logger.warn(`skills-hub: persistent cache unavailable: ${String(error)}`),
+    });
     let disposed = false;
     /** Rebuild the installed index and hand it to the market layer. */
     const refreshInstalledIndex = async () => {
@@ -135,11 +143,12 @@ export function apply(ctx, config) {
         // republishing it).
         resetInstalledLookup();
     }, 'skills-hub: activation state');
-    // First scan: `apply()` is synchronous, so this cannot be awaited here. Until
-    // it settles the market layer keeps its empty default lookup (skills show as
-    // installable, and the installer's own conflict check still refuses to clobber
-    // an existing directory), and /installed reads the disk directly.
-    void rescan();
+    // Apply is synchronous, but the first HTTP read must wait for install
+    // annotations even when a persisted snapshot arrives before the scan does.
+    const initialScan = refreshInstalledIndex().catch((error) => {
+        ctx.logger.warn(`skills-hub: installed-skill index refresh failed: ${String(error)}`);
+    });
+    void initialScan.then(() => refreshSkillCatalog(ctx));
     // The Web server may bind before or after this plugin (the Loader activates
     // rows concurrently), and older compositions name the service `httpServer`.
     // Bind lazily on the first service event that makes a server reachable.
@@ -159,6 +168,7 @@ export function apply(ctx, config) {
             skillsRoot: () => resolveSkillsRoot(resolved.skillsRoot),
             allowUninstall: () => resolved.allowUninstall,
             rescan,
+            ready: () => initialScan,
         };
         // `ctx.effect` runs the factory immediately; `dsh-host-webserver` throws on a
         // duplicate route path, so the flag may only be set once registration has

package/lib/market/cache.js

@@ -1,5 +1,5 @@
 /**
- * Skills Market — in-memory TTL cache with stale-while-error support, plus
+ * Skills Market — memory + persistent TTL cache with stale-while-error support, plus
  * per-source health tracking.
  *
  * Only *upstream* data is cached here (list pages, details, file bodies).
@@ -7,56 +7,128 @@
  * and is deliberately never cached: a skill installed a second ago must show up
  * as installed on the very next list call.
  *
- * Everything lives in module scope, so the module needs no DSH service and no
- * filesystem — a unit test can drive it with plain `node --test`.
+ * The host configures disk storage at activation. Without a directory the
+ * cache stays memory-only, so provider tests never touch a user's Harness home.
  */
-/** Hard cap so a long-lived host process cannot grow the map without bound. */
-const MAX_ENTRIES = 500;
-/** Per-payload TTLs: cheap-to-refetch list pages expire sooner than file bodies. */
+import { DiskMarketCache, MAX_CACHE_ENTRIES, MAX_STALE_AGE_MS } from "./disk-cache.js";
+/** Default snapshot lifetime; activation can override it with cacheTtlMinutes. */
 export const MARKET_TTL = {
-    list: 5 * 60_000,
-    search: 2 * 60_000,
-    detail: 10 * 60_000,
-    files: 10 * 60_000,
-    fileContent: 30 * 60_000,
+    list: 60 * 60_000,
+    search: 60 * 60_000,
+    detail: 60 * 60_000,
+    files: 60 * 60_000,
+    fileContent: 60 * 60_000,
 };
-class MarketCache {
+const stats = {
+    hits: 0,
+    misses: 0,
+    staleServed: 0,
+    upstreamRequests: 0,
+    forcedRefreshes: 0,
+};
+/** Record one cache event. Kept tiny so it can sit on the request path. */
+export function noteMarketStat(entry) {
+    stats[entry] += 1;
+}
+/** Snapshot of the counters; the caller cannot mutate the live object. */
+export function getMarketStats() {
+    return { ...stats };
+}
+export class MarketCache {
+    options;
     entries = new Map();
-    get(key) {
-        const entry = this.entries.get(key);
+    disk;
+    warned = false;
+    ttlMs;
+    constructor(options = {}) {
+        this.options = options;
+        this.ttlMs = options.ttlMs ?? MARKET_TTL.list;
+        if (options.directory)
+            this.disk = new DiskMarketCache(options.directory);
+    }
+    warn(error) {
+        if (this.warned)
+            return;
+        this.warned = true;
+        this.options.onError?.(error);
+    }
+    remember(key, entry) {
+        this.entries.delete(key);
+        this.entries.set(key, entry);
+        if (this.entries.size > MAX_CACHE_ENTRIES) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest !== undefined)
+                this.entries.delete(oldest);
+        }
+    }
+    async read(key) {
+        const existing = this.entries.get(key);
+        if (existing)
+            return existing;
+        try {
+            const restored = await this.disk?.read(key);
+            // A concurrent upstream response may have replaced the snapshot while
+            // the disk read was pending. Never overwrite that newer memory entry.
+            const current = this.entries.get(key);
+            if (current)
+                return current;
+            if (restored)
+                this.remember(key, restored);
+            return restored;
+        }
+        catch (error) {
+            // A corrupt or unwritable cache must never break the market request.
+            this.warn(error);
+            return undefined;
+        }
+    }
+    /**
+     * Read a fresh entry.
+     *
+     * The record carries `storedAt` on purpose: a hit is a *snapshot*, and the
+     * caller must be able to say how old it is. Returning only the payload is how
+     * the panel ended up reporting "fetched just now" for data it had not touched
+     * in ten minutes.
+     */
+    async getRecord(key) {
+        const entry = await this.read(key);
         if (!entry)
             return undefined;
-        if (Date.now() > entry.expiresAt)
+        if (Date.now() >= Math.min(entry.expiresAt, entry.storedAt + this.ttlMs))
             return undefined;
         // LRU touch: re-insert so the oldest key is the least recently used one.
         this.entries.delete(key);
         this.entries.set(key, entry);
-        return entry.value;
+        return { value: entry.value, storedAt: entry.storedAt };
     }
     /** Returns the entry even when expired — used for the stale-while-error fallback. */
-    getStale(key) {
-        const entry = this.entries.get(key);
-        if (!entry)
+    async getStale(key) {
+        const entry = await this.read(key);
+        if (!entry || Date.now() - entry.storedAt > MAX_STALE_AGE_MS)
             return undefined;
         return { value: entry.value, storedAt: entry.storedAt };
     }
-    set(key, value, ttlMs) {
-        if (this.entries.has(key))
-            this.entries.delete(key);
+    async set(key, value, ttlMs = this.ttlMs) {
         const now = Date.now();
-        this.entries.set(key, { value, expiresAt: now + ttlMs, storedAt: now });
-        if (this.entries.size > MAX_ENTRIES) {
-            // Map iteration is insertion-ordered, so the first key is the oldest.
-            const oldest = this.entries.keys().next().value;
-            if (oldest !== undefined)
-                this.entries.delete(oldest);
+        const entry = { value, expiresAt: now + ttlMs, storedAt: now };
+        this.remember(key, entry);
+        try {
+            await this.disk?.write(key, entry);
         }
+        catch (error) {
+            this.warn(error);
+        }
+        return now;
     }
     clear() {
         this.entries.clear();
     }
 }
-export const marketCache = new MarketCache();
+export let marketCache = new MarketCache();
+/** Replace memory state when activating a profile; disk entries are read lazily. */
+export function configureMarketCache(options) {
+    marketCache = new MarketCache(options);
+}
 function freshHealth() {
     return {
         clawhub: { status: 'ok' },
@@ -106,8 +178,10 @@ export function resetSourceHealth() {
         sourceHealth[source] = fresh[source];
     }
 }
-/** Test hook: drop cached payloads and reset source health. */
+/** Test hook: drop memory payloads, reset source health and the counters. */
 export function resetMarketCache() {
     marketCache.clear();
     resetSourceHealth();
+    for (const entry of Object.keys(stats))
+        stats[entry] = 0;
 }

package/lib/market/clawhub-provider.js

@@ -7,7 +7,11 @@
  *  - GET /api/v1/skills/{slug}                        → {skill, latestVersion, owner, metadata, moderation}
  *  - GET /api/v1/skills/{slug}/versions/{v}           → {version:{license, files[], security}}
  *  - GET /api/v1/skills/{slug}/file?path=             → raw file text
+ *
+ * Slugs are not unique: every endpoint accepts `?owner=`, and without it a
+ * shared slug answers 409 AMBIGUOUS_SKILL_SLUG. See `clawhubOwnerFor`.
  */
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { getProviderBase, providerFetch, providerFetchJson, readResponseTextWithLimit, MarketHttpError, } from "./provider-fetch.js";
 import { markSourceHealth } from "./cache.js";
 import { detectMarketLanguage, MARKET_ERROR_CODES, MARKET_LIMITS, MarketUpstreamError, skillId, } from "./types.js";
@@ -344,14 +348,77 @@ function usableFileEntries(files) {
     }
     return out;
 }
-// ClawHub slugs are not unique across owners. Ambiguous slugs return
-// 409 AMBIGUOUS_SKILL_SLUG with candidate owners; disambiguate via ?owner=
-// (first match = primary listing) and remember the resolution.
+// ClawHub slugs are not unique across owners. Every read is therefore made
+// for one owner, chosen in this order:
+//  1. the owner the reader's request names (the card it came from);
+//  2. the owner the curated catalogue pins for that slug;
+//  3. an owner resolved earlier for the slug (remembered below);
+//  4. otherwise, on 409 AMBIGUOUS_SKILL_SLUG, the most-downloaded candidate.
+// The registry lists candidates oldest-first, and for popular slugs that is
+// routinely a later copy by another author — "first match" opened (and
+// installed) somebody else's skill.
 const ownerCache = new Map();
+/**
+ * Owners the curated catalogue already knows. A catalogue entry names the exact
+ * skill it recommends, so its owner must win over any guessing.
+ */
+const ownerHints = new Map();
+/** The owner one detail/file/install operation was asked for. */
+const requestedOwner = new AsyncLocalStorage();
+/** Shape of a ClawHub owner handle (also the route's validation rule). */
+export const CLAWHUB_OWNER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;
+/** Most candidates probed when resolving an ambiguous slug without an owner. */
+const MAX_AMBIGUOUS_PROBES = 8;
+export function setClawhubOwnerHints(hints) {
+    ownerHints.clear();
+    for (const [slug, owner] of hints)
+        ownerHints.set(slug, owner);
+}
+/**
+ * Run one operation pinned to `owner` for `slug`. Without an owner the
+ * operation runs unpinned and falls back to the hint/cache/probe order.
+ */
+export function withClawhubOwner(slug, owner, operation) {
+    if (!owner)
+        return operation();
+    return requestedOwner.run({ slug, owner }, operation);
+}
+/** The owner a read of `slug` will use right now, if one is known before asking upstream. */
+export function clawhubOwnerFor(slug) {
+    const requested = requestedOwner.getStore();
+    if (requested?.slug === slug)
+        return requested.owner;
+    return ownerHints.get(slug) ?? ownerCache.get(slug);
+}
+/**
+ * Pick the candidate readers most plausibly mean: the most-downloaded one.
+ * Probes are owner-qualified detail reads; a candidate that fails to answer
+ * simply does not compete.
+ */
+async function resolveAmbiguousOwner(slug, candidates) {
+    const base = getProviderBase('clawhub');
+    const probed = await Promise.all(candidates.slice(0, MAX_AMBIGUOUS_PROBES).map(async (owner) => {
+        const url = new URL(`/api/v1/skills/${encodeURIComponent(slug)}`, base);
+        url.searchParams.set('owner', owner);
+        try {
+            const res = await providerFetch('clawhub', url.toString());
+            if (!res.ok)
+                return { owner, downloads: -1 };
+            const { content } = await readResponseTextWithLimit('clawhub', res, MARKET_LIMITS.maxTotalSize, 'ambiguous-slug probe');
+            const parsed = JSON.parse(content);
+            return { owner, downloads: asNumber(parsed.skill?.stats?.downloads) ?? 0 };
+        }
+        catch {
+            return { owner, downloads: -1 };
+        }
+    }));
+    const best = probed.filter((entry) => entry.downloads >= 0).sort((a, b) => b.downloads - a.downloads)[0];
+    return best?.owner;
+}
 async function clawhubFetch(url, slug) {
-    const cachedOwner = ownerCache.get(slug);
-    if (cachedOwner && !url.searchParams.has('owner')) {
-        url.searchParams.set('owner', cachedOwner);
+    const knownOwner = clawhubOwnerFor(slug);
+    if (knownOwner && !url.searchParams.has('owner')) {
+        url.searchParams.set('owner', knownOwner);
     }
     const res = await providerFetch('clawhub', url.toString());
     if (res.status !== 409)
@@ -371,7 +438,13 @@ async function clawhubFetch(url, slug) {
             throw error;
         body = null;
     }
-    const resolvedOwner = body?.code === 'AMBIGUOUS_SKILL_SLUG' ? asString(body.matches?.[0]?.ownerHandle) : undefined;
+    const candidates = body?.code === 'AMBIGUOUS_SKILL_SLUG'
+        ? (body.matches ?? []).map((match) => asString(match?.ownerHandle)).filter((owner) => owner !== undefined)
+        : [];
+    // A pinned owner that still answers 409 is not a guess we may widen.
+    const resolvedOwner = knownOwner === undefined && candidates.length > 0
+        ? await resolveAmbiguousOwner(slug, candidates)
+        : undefined;
     if (!resolvedOwner) {
         throw new MarketHttpError('clawhub', 409, MARKET_ERROR_CODES.upstreamError, `clawhub responded 409 for ${url.pathname}`);
     }
@@ -392,24 +465,61 @@ async function clawhubFetchJson(url, slug) {
         throw new MarketUpstreamError('clawhub', MARKET_ERROR_CODES.upstreamBadResponse, 'clawhub returned invalid JSON');
     }
 }
+/**
+ * ClawHub's scan of one version: an overall status plus per-scanner verdicts
+ * (VirusTotal, skillspector, an LLM review). The overall status decides the
+ * badge; each scanner becomes its own report so the reader sees which one
+ * objected and why.
+ */
 function mapSecurity(security) {
     const vendorStatus = asString(security?.status);
     if (!vendorStatus)
         return { status: 'unknown', reports: [] };
     const clean = vendorStatus === 'clean';
-    return {
-        status: clean ? 'benign' : 'flagged',
-        reports: [
-            {
-                vendor: 'clawhub-scan',
-                status: vendorStatus,
-                statusText: clean
-                    ? security?.hasWarnings === true ? 'Clean (with warnings)' : 'Clean'
-                    : `Scan status: ${vendorStatus}`,
-                reportUrl: asString(security?.virustotalUrl),
-            },
-        ],
-    };
+    const reports = [
+        {
+            vendor: 'clawhub-scan',
+            status: vendorStatus,
+            statusText: clean
+                ? security?.hasWarnings === true ? 'Clean (with warnings)' : 'Clean'
+                : `Scan status: ${vendorStatus}`,
+            reportUrl: asString(security?.virustotalUrl),
+        },
+    ];
+    const scanners = [
+        ['VirusTotal', security?.scanners?.vt],
+        ['skillspector', security?.scanners?.skillspector],
+        ['LLM review', security?.scanners?.llm],
+    ];
+    for (const [vendor, scanner] of scanners) {
+        const status = asString(scanner?.normalizedStatus) ?? asString(scanner?.status);
+        if (!status)
+            continue;
+        const recommendation = asString(scanner?.recommendation);
+        const summary = asString(scanner?.summary);
+        const reportUrl = vendor === 'VirusTotal' ? asString(security?.virustotalUrl) : undefined;
+        reports.push({
+            vendor,
+            status,
+            statusText: recommendation ? `${status} · ${recommendation}` : status,
+            ...(summary ? { summary } : {}),
+            ...(reportUrl ? { reportUrl } : {}),
+        });
+    }
+    return { status: clean ? 'benign' : 'flagged', reports };
+}
+function changelogOf(version, latest) {
+    const text = meaningfulChangelog(latest?.changelog);
+    return text ? { changelog: { version, text, publishedAt: asNumber(latest?.createdAt) } } : {};
+}
+/** A release note worth showing: registries stamp placeholders on synced versions. */
+export function meaningfulChangelog(text) {
+    const value = asString(text)?.trim();
+    if (!value)
+        return undefined;
+    if (/^synced by .*pipeline$/i.test(value))
+        return undefined;
+    return value;
 }
 function normalizeListItem(item) {
     return {
@@ -418,7 +528,7 @@ function normalizeListItem(item) {
         slug: item.slug,
         name: asString(item.displayName) || item.slug,
         summary: asString(item.summary) ?? '',
-        author: { handle: '' },
+        author: { handle: asString(item.ownerHandle) || '' },
         stats: {
             downloads: asNumber(item.stats?.downloads) ?? 0,
             installs: asNumber(item.stats?.installs),
@@ -505,7 +615,11 @@ export const clawhubProvider = {
         }
         const nativeResults = usable.filter((result) => (result.source === undefined || result.source === 'clawhub')
             && (result.install?.kind === undefined || result.install.kind === 'clawhub'));
-        return { items: nativeResults.slice(0, limit).map(normalizeSearchResult) };
+        // A card id is `clawhub:<slug>`, so a page can hold one owner per slug: the
+        // most relevant (first) result keeps the slot and carries its owner.
+        const seen = new Set();
+        const distinct = nativeResults.filter((result) => !seen.has(result.slug) && Boolean(seen.add(result.slug)));
+        return { items: distinct.slice(0, limit).map(normalizeSearchResult) };
     },
     async detail(slug) {
         const base = getProviderBase('clawhub');
@@ -549,6 +663,7 @@ export const clawhubProvider = {
             frontmatter = parsed.frontmatter;
         }
         const item = normalizeListItem(data.skill);
+        const owner = asString(data.owner?.handle);
         return {
             ...item,
             version,
@@ -559,6 +674,8 @@ export const clawhubProvider = {
             },
             securityStatus: security.status,
             securityReports: security.reports.length ? security.reports : undefined,
+            ...changelogOf(version, data.latestVersion),
+            ...(owner ? { pageUrl: `https://clawhub.ai/${encodeURIComponent(owner)}/${encodeURIComponent(slug)}` } : {}),
             description: body,
             descriptionFrontmatter: frontmatter,
             license,

package/lib/market/disk-cache.js

@@ -0,0 +1,113 @@
+/** Atomic, bounded storage for upstream snapshots; never stores install state. */
+import { createHash, randomUUID } from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+export const MAX_CACHE_ENTRIES = 500;
+export const MAX_STALE_AGE_MS = 7 * 24 * 60 * 60_000;
+const MAX_ENTRY_BYTES = 5 * 1024 * 1024;
+const MAX_DISK_BYTES = 64 * 1024 * 1024;
+const CACHE_FILE = /^[a-f0-9]{64}\.json$/;
+const TEMP_FILE = /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}\.tmp$/;
+const MAX_TEMP_AGE_MS = 60 * 60_000;
+function snapshotHash(key, entry) {
+    return createHash('sha256').update(JSON.stringify([2, key, entry.storedAt, entry.expiresAt, entry.value])).digest('hex');
+}
+export class DiskMarketCache {
+    directory;
+    writes = Promise.resolve();
+    constructor(directory) {
+        this.directory = directory;
+    }
+    filename(key) {
+        return path.join(this.directory, `${createHash('sha256').update(key).digest('hex')}.json`);
+    }
+    async read(key) {
+        let handle;
+        try {
+            handle = await fs.open(this.filename(key), 'r');
+            if ((await handle.stat()).size > MAX_ENTRY_BYTES)
+                return undefined;
+            const record = JSON.parse(await handle.readFile('utf8'));
+            if (!record || record.version !== 2 || record.key !== key || !('value' in record))
+                return undefined;
+            const { storedAt, expiresAt, value } = record;
+            if (typeof storedAt !== 'number' || !Number.isFinite(storedAt) || storedAt < 0
+                || typeof expiresAt !== 'number' || !Number.isFinite(expiresAt) || expiresAt < storedAt
+                || storedAt > Date.now() || Date.now() - storedAt > MAX_STALE_AGE_MS)
+                return undefined;
+            const entry = { storedAt, expiresAt, value };
+            if (record.sha256 !== snapshotHash(key, entry))
+                return undefined;
+            return entry;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+        finally {
+            await handle?.close();
+        }
+    }
+    async write(key, entry) {
+        const body = JSON.stringify({ version: 2, key, ...entry, sha256: snapshotHash(key, entry) });
+        const oversized = Buffer.byteLength(body) > MAX_ENTRY_BYTES;
+        // Serialize publication and pruning within this host. Each response awaits
+        // its write, so quitting after reading a page does not lose a delayed flush.
+        const pending = this.writes.then(async () => {
+            // An unpersistable refresh must not resurrect the previous version after
+            // restart. Serialize invalidation with ordinary writes of the same key.
+            if (oversized) {
+                await fs.rm(this.filename(key), { force: true });
+                return;
+            }
+            await fs.mkdir(this.directory, { recursive: true, mode: 0o700 });
+            const temporary = path.join(this.directory, `${randomUUID()}.tmp`);
+            try {
+                await fs.writeFile(temporary, body, { mode: 0o600, flag: 'wx' });
+                await fs.rename(temporary, this.filename(key));
+                await this.prune();
+            }
+            finally {
+                await fs.rm(temporary, { force: true });
+            }
+        });
+        this.writes = pending.catch(() => { });
+        await pending;
+    }
+    async prune() {
+        const names = (await fs.readdir(this.directory)).filter((name) => CACHE_FILE.test(name) || TEMP_FILE.test(name));
+        const records = await Promise.all(names.map(async (name) => {
+            const filename = path.join(this.directory, name);
+            try {
+                const stat = await fs.stat(filename);
+                if (TEMP_FILE.test(name)) {
+                    // A killed host can leave a partial write. Leave recent files alone:
+                    // another host may still be publishing in this shared home.
+                    if (Date.now() - stat.mtimeMs > MAX_TEMP_AGE_MS)
+                        await fs.rm(filename, { force: true });
+                    return undefined;
+                }
+                return { filename, size: stat.size, modifiedAt: stat.mtimeMs };
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    return undefined;
+                throw error;
+            }
+        }));
+        const newest = records.filter((record) => record !== undefined).sort((a, b) => b.modifiedAt - a.modifiedAt);
+        let count = 0;
+        let bytes = 0;
+        for (const record of newest) {
+            if (Date.now() - record.modifiedAt > MAX_STALE_AGE_MS
+                || record.size > MAX_ENTRY_BYTES || count >= MAX_CACHE_ENTRIES || bytes + record.size > MAX_DISK_BYTES) {
+                await fs.rm(record.filename, { force: true });
+            }
+            else {
+                count += 1;
+                bytes += record.size;
+            }
+        }
+    }
+}