@skydiveai/git-cache 0.1.0 → 0.1.251-beta.0

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { f as startServer } from "./server-B5u5DETT.mjs";
+import { f as startServer } from "./server-DjJs3KcN.mjs";
 //#region src/cli.ts
 /**
 * `git-cache` CLI — the published binary for @skydiveai/git-cache.

package/dist/index.d.mts

@@ -1,3 +1,4 @@
+import http from "node:http";
 import * as _$node_stream0 from "node:stream";
 
 //#region src/server.d.ts
@@ -19,6 +20,8 @@ declare function metricsSnapshot(): {
   evictions: number;
   refresh_failures: number;
   refresh_deferred: number;
+  revalidations: number;
+  revalidate_failures: number;
   publish_deferred: number;
   credential_url_redirects: number;
   lfs_redirects: number;
@@ -148,6 +151,32 @@ declare function shouldBackfillAfterPassthrough({
   cacheable: any;
   sha256: any;
 }): boolean;
+/**
+ * Decide how to serve a warm mirror for one request.
+ *
+ * `revalidateRefs` is set for the `info/refs` half of a fetch — the ref
+ * advertisement, where the client learns the remote's HEAD and branch tips.
+ * That answer must never be stale: serving a pre-merge advertisement is how a
+ * `git fetch` right after an upstream squash-merge silently returns the old
+ * `origin/<branch>` (the object-reuse win of the cache is not worth lying about
+ * where HEAD is). So for `info/refs` a stale mirror BLOCKS on a synchronous
+ * refresh before it answers, exactly as an explicit push invalidation does.
+ * The `git-upload-pack` half keeps stale-while-revalidate: its wants come from
+ * the just-served fresh advertisement, so the client only asks for objects the
+ * fresh refs named, and the caller's `mirrorHasObjects` gate already falls back
+ * to origin for any the mirror is missing (the new objects a merge introduced).
+ *
+ * A blocked refresh that FAILS (network blip, expired token, upstream 5xx)
+ * returns `cacheState: 'STALE_REVALIDATE_FAILED'` rather than throwing, so the
+ * caller can proxy `info/refs` straight to origin — fresh refs from upstream,
+ * never a 502 and never the stale advertisement.
+ */
+/**
+ * Whether a mirror stamped `lastFetchMs` is fresh: past the invalidation fence
+ * AND within the TTL window. `lastFetchMs` is a fetch-START time (see
+ * writeMeta), so a fetch that began before the fence is stale no matter when
+ * it completed — the data it holds predates the invalidation by construction.
+ */
 /**
  * True when every OID is already present in the mirror.
  *

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { a as isProtocolV2Request, c as parseAdvertisement, d as shouldBackfillAfterPassthrough, f as startServer, i as explainRejection, l as parseUpstream, n as classifyUploadRequest, o as metricsSnapshot, r as copyRequestHeaders, s as mirrorHasObjects, t as SidebandPackExtractor, u as recordColdBuildOutcome } from "./server-B5u5DETT.mjs";
+import { a as isProtocolV2Request, c as parseAdvertisement, d as shouldBackfillAfterPassthrough, f as startServer, i as explainRejection, l as parseUpstream, n as classifyUploadRequest, o as metricsSnapshot, r as copyRequestHeaders, s as mirrorHasObjects, t as SidebandPackExtractor, u as recordColdBuildOutcome } from "./server-DjJs3KcN.mjs";
 export { SidebandPackExtractor, classifyUploadRequest, copyRequestHeaders, explainRejection, isProtocolV2Request, metricsSnapshot, mirrorHasObjects, parseAdvertisement, parseUpstream, recordColdBuildOutcome, shouldBackfillAfterPassthrough, startServer };

package/dist/{server-B5u5DETT.mjs → server-DjJs3KcN.mjs}

@@ -5,6 +5,7 @@ import { spawn } from "node:child_process";
 import { mkdir, readFile, readdir, rename, rm, stat, utimes, writeFile } from "node:fs/promises";
 import { hostname } from "node:os";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { createGunzip, gunzip } from "node:zlib";
 import { promisify } from "node:util";
 //#region src/server.ts
@@ -46,6 +47,16 @@ import { promisify } from "node:util";
 * with no npm install.
 */
 const gunzip$1 = promisify(gunzip);
+let runningVersion = null;
+async function readOwnPackageVersion() {
+	try {
+		const here = path.dirname(fileURLToPath(import.meta.url));
+		const manifest = JSON.parse(await readFile(path.join(here, "..", "package.json"), "utf8"));
+		return typeof manifest.version === "string" ? manifest.version : null;
+	} catch (_error) {
+		return null;
+	}
+}
 /**
 * An unset/empty env resolves to trusted-client (the daemon's original
 * contract); anything other than the two known modes is a hard startup
@@ -67,6 +78,7 @@ const config = {
 	maxPackBytes: Number(process.env.GIT_CACHE_MAX_PACK_BYTES || 8 * 1024 * 1024 * 1024),
 	maxImporterQueueBytes: Number(process.env.GIT_CACHE_MAX_IMPORTER_QUEUE_BYTES || 256 * 1024 * 1024),
 	maxCacheBytes: Number(process.env.GIT_CACHE_MAX_CACHE_BYTES || 0),
+	upstreamTimeoutMs: Number(process.env.GIT_CACHE_UPSTREAM_TIMEOUT_MS || 3e4),
 	hostAllowlist: (process.env.GIT_CACHE_HOST_ALLOWLIST || "").split(",").map((h) => h.trim().toLowerCase()).filter(Boolean),
 	logLevel: process.env.GIT_CACHE_LOG_LEVEL || "info",
 	testOriginBase: (process.env.GIT_CACHE_TEST_ORIGIN_BASE || "").replace(/\/+$/, "")
@@ -83,7 +95,9 @@ const GIT_ENV = {
 	GIT_ASKPASS: "/bin/true",
 	SSH_ASKPASS: "/bin/true",
 	GCM_INTERACTIVE: "never",
-	GIT_CONFIG_NOSYSTEM: process.env.GIT_CONFIG_NOSYSTEM || "1"
+	GIT_CONFIG_NOSYSTEM: process.env.GIT_CONFIG_NOSYSTEM || "1",
+	GIT_HTTP_LOW_SPEED_LIMIT: "1024",
+	GIT_HTTP_LOW_SPEED_TIME: "60"
 };
 const activeLevel = LOG_LEVELS[config.logLevel] ?? LOG_LEVELS.info;
 function log(level, event, fields = {}) {
@@ -116,6 +130,8 @@ const metrics = {
 	evictions: 0,
 	refresh_failures: 0,
 	refresh_deferred: 0,
+	revalidations: 0,
+	revalidate_failures: 0,
 	publish_deferred: 0,
 	credential_url_redirects: 0,
 	lfs_redirects: 0,
@@ -296,12 +312,12 @@ function evictAuthCache() {
 }
 function validateUpstream(credHeader, upstreamUrl) {
 	return new Promise((resolve) => {
-		const request = requestUpstream(new URL(`${upstreamUrl}/info/refs?service=git-upload-pack`), {
+		const target = new URL(`${upstreamUrl}/info/refs?service=git-upload-pack`);
+		const headers = { "user-agent": "git/git-cache-authz" };
+		if (credHeader !== null) headers["authorization"] = credHeader;
+		const request = requestUpstream(target, {
 			method: "GET",
-			headers: {
-				authorization: credHeader,
-				"user-agent": "git/git-cache-authz"
-			}
+			headers
 		}, (res) => {
 			res.resume();
 			const status = res.statusCode ?? 502;
@@ -339,7 +355,7 @@ function validateUpstream(credHeader, upstreamUrl) {
 	});
 }
 async function authorizeCheckThrough(credHeader, repo, upstreamUrl) {
-	const key = authMemoKey(credHeader, repo);
+	const key = authMemoKey(credHeader ?? "", repo);
 	const cached = authCache.get(key);
 	if (cached) {
 		const ttl = cached.allowed ? AUTH_ALLOW_TTL_MS : AUTH_DENY_TTL_MS;
@@ -435,14 +451,12 @@ function parseUpstream(rawPathname, rawSearch = "") {
 	const hadDotGit = Boolean(match[3]);
 	const operation = match[4];
 	let host = authority;
-	let port = 443;
 	const colon = authority.lastIndexOf(":");
 	if (colon !== -1) {
 		host = authority.slice(0, colon);
 		const p = authority.slice(colon + 1);
 		if (!/^\d{1,5}$/.test(p)) return null;
-		port = Number(p);
-		if (port !== 443) return null;
+		if (Number(p) !== 443) return null;
 	}
 	host = host.toLowerCase();
 	if (isIpLiteral(host)) return null;
@@ -665,12 +679,35 @@ function withCredential(headers, credHeader) {
 function requestUpstream(target, options, callback) {
 	return (target.protocol === "http:" ? http : https).request(target, options, callback);
 }
+/**
+* Arm the idle-socket ceiling on an upstream request. Fires only when the
+* socket is SILENT for config.upstreamTimeoutMs (any activity resets it), so a
+* healthy transfer — even a slow one — is never interrupted. Must be armed on
+* EVERY upstream request: a hung upstream surfaces as a fast error to the
+* caller instead of a client `git fetch` that never returns.
+*/
+function armUpstreamIdleTimeout(up, onTimeout) {
+	up.setTimeout(config.upstreamTimeoutMs, () => {
+		log("error", "upstream_idle_timeout", { ms: config.upstreamTimeoutMs });
+		onTimeout();
+	});
+}
 function openUpstream(req, upstreamUrl, operation, callback, credHeader) {
-	const up = requestUpstream(new URL(upstreamUrl + (operation === "info/refs" ? "/info/refs?service=git-upload-pack" : "/git-upload-pack")), {
+	const target = new URL(upstreamUrl + (operation === "info/refs" ? "/info/refs?service=git-upload-pack" : "/git-upload-pack"));
+	let settled = false;
+	const settle = (resOrNull, error) => {
+		if (settled) return;
+		settled = true;
+		callback(resOrNull, error);
+	};
+	const up = requestUpstream(target, {
 		method: req.method,
 		headers: withCredential(copyRequestHeaders(req.headers), credHeader)
-	}, (res) => callback(res, null));
-	up.on("error", (error) => callback(null, error));
+	}, (res) => settle(res, null));
+	up.on("error", (error) => settle(null, error));
+	armUpstreamIdleTimeout(up, () => {
+		up.destroy(/* @__PURE__ */ new Error(`upstream idle for ${config.upstreamTimeoutMs}ms`));
+	});
 	if (req.method === "POST") req.pipe(up);
 	else up.end();
 	return up;
@@ -821,10 +858,10 @@ var SidebandPackExtractor = class {
 		if (!this.errored) this.writable.end();
 	}
 };
-async function writeMeta(local, extra = {}) {
+async function writeMeta(local, fetchStartMs, extra = {}) {
 	const tmp = `${metaPath(local)}.tmp.${INSTANCE_ID}`;
 	await writeFile(tmp, JSON.stringify({
-		lastFetchMs: Date.now(),
+		lastFetchMs: fetchStartMs,
 		...extra
 	}), "utf8");
 	await rename(tmp, metaPath(local));
@@ -1019,7 +1056,7 @@ async function backfillMirror(repo, upstreamUrl, credHeader = null) {
 		const published = await withRepoLock(repo, "write", async () => {
 			if (await pathExists(local)) return false;
 			await rename(temp, local);
-			await writeMeta(local, { publishedMs: Date.now() });
+			await writeMeta(local, startedMs, { publishedMs: Date.now() });
 			return true;
 		});
 		if (published !== true) {
@@ -1056,6 +1093,7 @@ async function backfillMirror(repo, upstreamUrl, credHeader = null) {
 }
 function startColdStream(req, res, upstreamUrl, repo, requestBody, credHeader) {
 	const local = localPath(repo);
+	const captureStartedMs = Date.now();
 	const temp = `${config.cacheDir}/quarantine/${repo.replace(/\//g, "__")}.stream-${INSTANCE_ID}-${Date.now()}`;
 	metrics.cold_requests++;
 	coldLeaders.add(repo);
@@ -1230,7 +1268,7 @@ function startColdStream(req, res, upstreamUrl, repo, requestBody, credHeader) {
 					const published = await withRepoLock(repo, "write", async () => {
 						if (await pathExists(local)) return false;
 						await rename(temp, local);
-						await writeMeta(local, { publishedMs: Date.now() });
+						await writeMeta(local, captureStartedMs, { publishedMs: Date.now() });
 						return true;
 					});
 					if (published === true) {
@@ -1257,6 +1295,13 @@ function startColdStream(req, res, upstreamUrl, repo, requestBody, credHeader) {
 			});
 		});
 		up.on("error", (error) => settle.reject(error));
+		armUpstreamIdleTimeout(up, () => {
+			if (!res.headersSent) {
+				res.writeHead(502, { "Content-Type": "text/plain" });
+				res.end("unable to serve repository\n");
+			}
+			up.destroy(/* @__PURE__ */ new Error(`upstream idle for ${config.upstreamTimeoutMs}ms`));
+		});
 		up.end(requestBody);
 	})().catch(settle.reject);
 	done.catch(async (error) => {
@@ -1294,6 +1339,7 @@ async function refreshMirror(repo, local, credHeader = null) {
 		"true"
 	]);
 	await disableAutoMaintenance(local);
+	const fetchStartMs = Date.now();
 	await runGit(upstreamGitArgs([
 		"--git-dir",
 		local,
@@ -1306,22 +1352,54 @@ async function refreshMirror(repo, local, credHeader = null) {
 		...GIT_ENV,
 		...upstreamGitCredentialEnv(credHeader)
 	} });
-	await writeMeta(local);
+	await writeMeta(local, fetchStartMs);
 	metrics.refreshes++;
 	log("info", "refresh", { repo });
 	return local;
 }
-async function ensureWarm(repo, credHeader = null) {
+/**
+* Decide how to serve a warm mirror for one request.
+*
+* `revalidateRefs` is set for the `info/refs` half of a fetch — the ref
+* advertisement, where the client learns the remote's HEAD and branch tips.
+* That answer must never be stale: serving a pre-merge advertisement is how a
+* `git fetch` right after an upstream squash-merge silently returns the old
+* `origin/<branch>` (the object-reuse win of the cache is not worth lying about
+* where HEAD is). So for `info/refs` a stale mirror BLOCKS on a synchronous
+* refresh before it answers, exactly as an explicit push invalidation does.
+* The `git-upload-pack` half keeps stale-while-revalidate: its wants come from
+* the just-served fresh advertisement, so the client only asks for objects the
+* fresh refs named, and the caller's `mirrorHasObjects` gate already falls back
+* to origin for any the mirror is missing (the new objects a merge introduced).
+*
+* A blocked refresh that FAILS (network blip, expired token, upstream 5xx)
+* returns `cacheState: 'STALE_REVALIDATE_FAILED'` rather than throwing, so the
+* caller can proxy `info/refs` straight to origin — fresh refs from upstream,
+* never a 502 and never the stale advertisement.
+*/
+/**
+* Whether a mirror stamped `lastFetchMs` is fresh: past the invalidation fence
+* AND within the TTL window. `lastFetchMs` is a fetch-START time (see
+* writeMeta), so a fetch that began before the fence is stale no matter when
+* it completed — the data it holds predates the invalidation by construction.
+*/
+function isMetaFresh(lastFetchMs, fenceMs, ttlSeconds, nowMs) {
+	if (lastFetchMs <= 0) return false;
+	if (lastFetchMs > nowMs) return false;
+	return lastFetchMs >= fenceMs && (nowMs - lastFetchMs) / 1e3 < ttlSeconds;
+}
+async function ensureWarm(repo, credHeader = null, revalidateRefs = false) {
 	const local = localPath(repo);
 	const lastFetchMs = (await readMeta(local))?.lastFetchMs ?? 0;
-	if (!((Date.now() - lastFetchMs) / 1e3 >= config.ttlSeconds || lastFetchMs < invalidateBeforeMs)) {
+	if (!!isMetaFresh(lastFetchMs, invalidateBeforeMs, config.ttlSeconds, Date.now())) {
 		metrics.warm_hits++;
 		return {
 			local,
 			cacheState: "HIT"
 		};
 	}
-	const mustBlock = lastFetchMs < invalidateBeforeMs;
+	const fencedByPush = lastFetchMs < invalidateBeforeMs;
+	const mustBlock = fencedByPush || revalidateRefs;
 	if (!inflightRefresh.has(repo)) inflightRefresh.set(repo, withRepoLock(repo, "write", () => refreshMirror(repo, local, credHeader)).then((result) => {
 		if (result === null) {
 			metrics.refresh_deferred++;
@@ -1336,7 +1414,18 @@ async function ensureWarm(repo, credHeader = null) {
 	}).finally(() => inflightRefresh.delete(repo)));
 	if (mustBlock) {
 		await inflightRefresh.get(repo);
-		if (((await readMeta(local))?.lastFetchMs ?? 0) < invalidateBeforeMs) throw new Error("mirror refresh failed after push invalidation");
+		if (!isMetaFresh((await readMeta(local))?.lastFetchMs ?? 0, invalidateBeforeMs, config.ttlSeconds, Date.now())) {
+			if (revalidateRefs && !fencedByPush) {
+				metrics.revalidate_failures++;
+				log("warn", "revalidate_failed", { repo });
+				return {
+					local,
+					cacheState: "STALE_REVALIDATE_FAILED"
+				};
+			}
+			throw new Error("mirror refresh failed after invalidation");
+		}
+		if (revalidateRefs) metrics.revalidations++;
 		return {
 			local,
 			cacheState: "REFRESH"
@@ -1432,6 +1521,9 @@ function proxyUploadPackWithBody(res, upstreamUrl, reqHeaders, body, credHeader)
 		if (!res.headersSent) res.writeHead(502);
 		res.end();
 	});
+	armUpstreamIdleTimeout(up, () => {
+		up.destroy(/* @__PURE__ */ new Error(`upstream idle for ${config.upstreamTimeoutMs}ms`));
+	});
 	up.end(body);
 }
 function serveUploadPack(req, res, local, advertise, cacheState, body = null) {
@@ -1610,12 +1702,59 @@ function isLoopbackPeer(req) {
 	const addr = req.socket.remoteAddress;
 	return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
+/**
+* Proxy an `info/refs` advertisement straight to origin and stream it back to
+* the client, retaining a bounded copy of a v0 advertisement for later ref
+* completion. Used for a cold miss AND when a warm mirror's blocking
+* revalidation failed — either way the client gets a FRESH advertisement from
+* upstream, never the mirror's stale refs.
+*/
+async function proxyInfoRefs(req, res, repo, upstreamUrl, host, credHeader) {
+	const cred = credHeader ?? await fetchCredentialHeader(host);
+	await new Promise((resolve, reject) => {
+		openUpstream(req, upstreamUrl, "info/refs", (upRes, error) => {
+			if (error) {
+				reject(error);
+				return;
+			}
+			if (upRes.statusCode === 401 || upRes.statusCode === 403) dropCredential(host);
+			res.writeHead(upRes.statusCode, upRes.headers);
+			const chunks = [];
+			let bytes = 0;
+			const CAP = 32 * 1024 * 1024;
+			upRes.on("data", (chunk) => {
+				res.write(chunk);
+				if (bytes < CAP) {
+					chunks.push(chunk);
+					bytes += chunk.length;
+				}
+			});
+			upRes.on("end", () => {
+				res.end();
+				if (upRes.statusCode === 200 && bytes < CAP && gitProtocolEnv(req.headers).GIT_PROTOCOL === void 0) advertisements.set(repo, parseAdvertisement(Buffer.concat(chunks)));
+				resolve();
+			});
+			upRes.on("error", reject);
+		}, cred);
+	});
+}
+function requestErrorContext(req) {
+	const rawTarget = req.url ?? "";
+	const target = (rawTarget.split("?", 1)[0] ?? "").replace(/^\/[^/?#@]+@/, "/[redacted]@").replace(/^(https?:\/\/)[^/?#@]+@/, "$1[redacted]@");
+	return {
+		method: req.method ?? null,
+		target,
+		targetLength: rawTarget.length,
+		peer: req.socket?.remoteAddress ?? null
+	};
+}
 async function handle(req, res) {
 	const parsed = new URL(req.url, "http://git-cache.local");
 	if (parsed.pathname === "/healthz") {
 		res.writeHead(200, { "Content-Type": "application/json" });
 		return res.end(JSON.stringify({
 			ok: true,
+			version: runningVersion,
 			bind: config.bindHost,
 			cacheDir: config.cacheDir,
 			ttlSeconds: config.ttlSeconds,
@@ -1666,16 +1805,15 @@ async function handle(req, res) {
 		if (config.authMode === "check-through") {
 			const header = req.headers["authorization"];
 			const raw = Array.isArray(header) ? header[0] : header;
-			if (!raw) {
-				metrics.auth_denials++;
-				res.writeHead(401, {
-					"Content-Type": "text/plain",
-					"WWW-Authenticate": "Basic realm=\"git-cache\""
-				});
-				return res.end("authentication required\n");
-			}
-			const verdict = await authorizeCheckThrough(raw, up.repo, up.upstreamUrl);
+			const verdict = await authorizeCheckThrough(raw ?? null, up.repo, up.upstreamUrl);
 			if (!verdict.allowed) {
+				if (!raw && (verdict.status === 401 || verdict.status === 403)) {
+					res.writeHead(401, {
+						"Content-Type": "text/plain",
+						"WWW-Authenticate": "Basic realm=\"git-cache\""
+					});
+					return res.end("authentication required\n");
+				}
 				log("info", "auth_denied", {
 					repo: up.repo,
 					status: verdict.status
@@ -1683,9 +1821,9 @@ async function handle(req, res) {
 				res.writeHead(verdict.status, { "Content-Type": "text/plain" });
 				return res.end("not authorized for this repository\n");
 			}
-			clientCred = raw;
+			clientCred = raw ?? null;
 		}
-		const host = up.repo.split("/")[0];
+		const host = up.repo.split("/")[0] ?? "";
 		let uploadBody = null;
 		let uploadWants = [];
 		if (up.operation === "git-upload-pack") {
@@ -1706,8 +1844,16 @@ async function handle(req, res) {
 			uploadWants = classifyUploadRequest(uploadBody).wants;
 		}
 		if (await pathExists(localPath(up.repo))) {
-			const warm = await ensureWarm(up.repo, clientCred);
+			const warm = await ensureWarm(up.repo, clientCred, up.operation === "info/refs");
 			markServed(warm.local);
+			if (warm.cacheState === "STALE_REVALIDATE_FAILED") {
+				log("info", "serve", {
+					repo: up.repo,
+					op: up.operation,
+					state: warm.cacheState
+				});
+				return await proxyInfoRefs(req, res, up.repo, up.upstreamUrl, host, clientCred);
+			}
 			if (up.operation === "git-upload-pack" && !await mirrorHasObjects(warm.local, uploadWants)) {
 				await refreshMirror(up.repo, warm.local, clientCred).catch((error) => {
 					metrics.refresh_failures++;
@@ -1730,35 +1876,7 @@ async function handle(req, res) {
 			});
 			return serveUploadPack(req, res, warm.local, up.operation === "info/refs", warm.cacheState, uploadBody);
 		}
-		if (up.operation === "info/refs") {
-			const credHeader = clientCred ?? await fetchCredentialHeader(host);
-			return await new Promise((resolve, reject) => {
-				openUpstream(req, up.upstreamUrl, up.operation, (upRes, error) => {
-					if (error) {
-						reject(error);
-						return;
-					}
-					if (upRes.statusCode === 401 || upRes.statusCode === 403) dropCredential(host);
-					res.writeHead(upRes.statusCode, upRes.headers);
-					const chunks = [];
-					let bytes = 0;
-					const CAP = 32 * 1024 * 1024;
-					upRes.on("data", (chunk) => {
-						res.write(chunk);
-						if (bytes < CAP) {
-							chunks.push(chunk);
-							bytes += chunk.length;
-						}
-					});
-					upRes.on("end", () => {
-						res.end();
-						if (upRes.statusCode === 200 && bytes < CAP && gitProtocolEnv(req.headers).GIT_PROTOCOL === void 0) advertisements.set(up.repo, parseAdvertisement(Buffer.concat(chunks)));
-						resolve(void 0);
-					});
-					upRes.on("error", reject);
-				}, credHeader);
-			});
-		}
+		if (up.operation === "info/refs") return await proxyInfoRefs(req, res, up.repo, up.upstreamUrl, host, clientCred);
 		const body = uploadBody ?? Buffer.alloc(0);
 		const credHeader = clientCred ?? await fetchCredentialHeader(host);
 		if (coldLeaders.has(up.repo)) return proxyColdFollowerWithBody(res, up.upstreamUrl, req.headers, body, up.repo, credHeader);
@@ -1786,6 +1904,9 @@ function proxyColdFollowerWithBody(res, upstreamUrl, reqHeaders, body, repo, cre
 		if (!res.headersSent) res.writeHead(502);
 		res.end();
 	});
+	armUpstreamIdleTimeout(up, () => {
+		up.destroy(/* @__PURE__ */ new Error(`upstream idle for ${config.upstreamTimeoutMs}ms`));
+	});
 	up.end(body);
 }
 async function startServer(options = {}) {
@@ -1799,9 +1920,21 @@ async function startServer(options = {}) {
 	if (config.authMode === "check-through" && config.credentialHelper) throw new Error("git-cache: credentialHelper is incompatible with check-through authorization — upstream requests authenticate with each client's own credential.");
 	await mkdir(path.join(config.cacheDir, "mirrors"), { recursive: true });
 	await cleanupQuarantine();
+	runningVersion = await readOwnPackageVersion();
 	const server = http.createServer((req, res) => {
+		const context = requestErrorContext(req);
+		res.on("finish", () => {
+			if (res.statusCode >= 400 && res.statusCode < 500) log("info", "client_error", {
+				...context,
+				status: res.statusCode
+			});
+		});
 		handle(req, res).catch((error) => {
-			log("error", "unhandled", { error: String(error) });
+			log("error", "unhandled", {
+				error: String(error),
+				stack: error instanceof Error ? error.stack : null,
+				...context
+			});
 			if (!res.headersSent) res.writeHead(500);
 			res.end();
 		});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skydiveai/git-cache",
-  "version": "0.1.0",
+  "version": "0.1.251-beta.0",
   "description": "Sandbox-local Git smart-HTTP clone/fetch cache: a loopback daemon that transparently mirrors HTTPS git reads so repeated clone/fetch/ls-remote skip the origin round-trip. Runs inside an agent sandbox; pushes stay direct.",
   "homepage": "https://skydive.com",
   "license": "MIT",
@@ -20,15 +20,6 @@
     }
   },
   "publishConfig": {
-    "bin": {
-      "git-cache-daemon": "./dist/cli.mjs"
-    },
-    "exports": {
-      ".": {
-        "types": "./dist/index.d.mts",
-        "default": "./dist/index.mjs"
-      }
-    },
     "access": "public",
     "registry": "https://registry.npmjs.org"
   },
@@ -39,8 +30,7 @@
     "test:git-cache-e2e": "yarn build && bash test/e2e.sh",
     "bench": "yarn build && bash test/bench.sh",
     "test:unit": "yarn build && vitest run --passWithNoTests && yarn lint:shell && bash test/local-e2e.sh && bash test/perf-check.sh",
-    "test:ci": "yarn build && vitest run --coverage --coverage.reporter=lcovonly --reporter=default --reporter=github-actions --minWorkers=1 --maxWorkers=2 --passWithNoTests && yarn lint:shell && bash test/local-e2e.sh && bash test/perf-check.sh",
-    "publish:system-artifacts": "yarn build && doppler run --preserve-env -- node ../../scripts/anyone/publish-system-artifact.mjs"
+    "test:ci": "yarn build && vitest run --coverage --coverage.reporter=lcovonly --reporter=default --reporter=github-actions --minWorkers=1 --maxWorkers=2 --passWithNoTests && yarn lint:shell && bash test/local-e2e.sh && bash test/perf-check.sh"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",