dtu-github-actions 0.6.0 → 0.7.1

package/dist/server/routes/actions/action-tarball.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/routes/actions/action-tarball.test.js

@@ -0,0 +1,333 @@
+import { describe, it, expect, beforeEach, beforeAll, afterAll } from "vitest";
+import { state, getActionTarballsDir } from "../../store.js";
+import { bootstrapAndReturnApp } from "../../index.js";
+import fs from "node:fs";
+import path from "node:path";
+let PORT;
+describe("Action Tarball Cache", () => {
+    let server;
+    beforeAll(async () => {
+        state.reset();
+        const app = await bootstrapAndReturnApp();
+        return new Promise((resolve) => {
+            server = app.listen(0, () => {
+                const address = server.server?.address();
+                PORT = address.port;
+                resolve();
+            });
+        });
+    });
+    beforeEach(() => {
+        state.reset();
+        // Clean up any tarball cache files from prior tests
+        const dir = getActionTarballsDir();
+        if (fs.existsSync(dir)) {
+            for (const file of fs.readdirSync(dir)) {
+                try {
+                    fs.unlinkSync(path.join(dir, file));
+                }
+                catch { }
+            }
+        }
+    });
+    afterAll(async () => {
+        // Clean up tarball cache dir
+        const dir = getActionTarballsDir();
+        if (fs.existsSync(dir)) {
+            for (const file of fs.readdirSync(dir)) {
+                try {
+                    fs.unlinkSync(path.join(dir, file));
+                }
+                catch { }
+            }
+        }
+        await new Promise((resolve) => {
+            if (server?.server) {
+                server.server.close(() => resolve());
+            }
+            else {
+                resolve();
+            }
+        });
+    });
+    // ── Action tarball proxy route ───────────────────────────────────────────────
+    it("should serve a cached tarball from disk (cache hit)", async () => {
+        const baseUrl = `http://localhost:${PORT}`;
+        // Pre-seed a tarball file on disk
+        const dir = getActionTarballsDir();
+        fs.mkdirSync(dir, { recursive: true });
+        const tarballPath = path.join(dir, "actions__checkout@v4.tar.gz");
+        const content = Buffer.from("fake-tarball-content");
+        fs.writeFileSync(tarballPath, content);
+        // Request should serve from disk
+        const res = await fetch(`${baseUrl}/_dtu/action-tarball/actions/checkout/v4`);
+        expect(res.status).toBe(200);
+        expect(res.headers.get("content-type")).toBe("application/x-tar");
+        expect(res.headers.get("content-length")).toBe(String(content.length));
+        const body = Buffer.from(await res.arrayBuffer());
+        expect(body).toEqual(content);
+    });
+    it("should return error for cache miss when GitHub is unreachable", async () => {
+        const baseUrl = `http://localhost:${PORT}`;
+        // No cached file exists, and the proxy will try to fetch from GitHub.
+        // Since the test env can't reach GitHub reliably, we just verify the route
+        // doesn't crash and returns a response (either 200 if GitHub responds, or
+        // 502/error if it can't reach GitHub). The key is no server crash.
+        const res = await fetch(`${baseUrl}/_dtu/action-tarball/nonexistent/repo/v999`);
+        // Should get some response (not a connection error)
+        expect(res.status).toBeGreaterThanOrEqual(200);
+    });
+    it("should not match slash-containing refs as a single route param", async () => {
+        const baseUrl = `http://localhost:${PORT}`;
+        const dir = getActionTarballsDir();
+        fs.mkdirSync(dir, { recursive: true });
+        // This is the cache file that would be used if "refs/heads/main" were accepted
+        // as a single ref value and sanitized to "refs-heads-main".
+        const tarballPath = path.join(dir, "my-org__my-repo@refs-heads-main.tar.gz");
+        fs.writeFileSync(tarballPath, "test-content");
+        const res = await fetch(`${baseUrl}/_dtu/action-tarball/my-org/my-repo/refs/heads/main`);
+        // Polka does not bind :ref across slashes, so this URL does not hit the route
+        // as a single ref value and therefore must not serve the cached tarball above.
+        expect(res.status).toBe(404);
+        await expect(res.text()).resolves.not.toBe("test-content");
+    });
+    it("should serve different tarballs for different repos", async () => {
+        const baseUrl = `http://localhost:${PORT}`;
+        const dir = getActionTarballsDir();
+        fs.mkdirSync(dir, { recursive: true });
+        const content1 = Buffer.from("tarball-for-checkout");
+        const content2 = Buffer.from("tarball-for-setup-node");
+        fs.writeFileSync(path.join(dir, "actions__checkout@v4.tar.gz"), content1);
+        fs.writeFileSync(path.join(dir, "actions__setup-node@v4.tar.gz"), content2);
+        const res1 = await fetch(`${baseUrl}/_dtu/action-tarball/actions/checkout/v4`);
+        const res2 = await fetch(`${baseUrl}/_dtu/action-tarball/actions/setup-node/v4`);
+        expect(res1.status).toBe(200);
+        expect(res2.status).toBe(200);
+        const body1 = Buffer.from(await res1.arrayBuffer());
+        const body2 = Buffer.from(await res2.arrayBuffer());
+        expect(body1).toEqual(content1);
+        expect(body2).toEqual(content2);
+    });
+    // ── Action download info URL rewriting ───────────────────────────────────────
+    it("should rewrite tarball URLs to local proxy", async () => {
+        const baseUrl = `http://localhost:${PORT}`;
+        const res = await fetch(`${baseUrl}/_apis/distributedtask/hubs/Hub/plans/Plan/actiondownloadinfo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                actions: [
+                    { nameWithOwner: "actions/checkout", ref: "v4" },
+                    { nameWithOwner: "actions/setup-node", ref: "v4" },
+                ],
+            }),
+        });
+        expect(res.status).toBe(200);
+        const data = await res.json();
+        // Both actions should have tarballUrls pointing at the local proxy
+        const checkoutInfo = data.actions["actions/checkout@v4"];
+        expect(checkoutInfo).toBeDefined();
+        expect(checkoutInfo.tarballUrl).toBe(`${baseUrl}/_dtu/action-tarball/actions/checkout/v4`);
+        expect(checkoutInfo.zipballUrl).toBe(`${baseUrl}/_dtu/action-tarball/actions/checkout/v4`);
+        const setupNodeInfo = data.actions["actions/setup-node@v4"];
+        expect(setupNodeInfo).toBeDefined();
+        expect(setupNodeInfo.tarballUrl).toBe(`${baseUrl}/_dtu/action-tarball/actions/setup-node/v4`);
+    });
+    it("should strip sub-paths from action names for tarball URL", async () => {
+        const baseUrl = `http://localhost:${PORT}`;
+        const res = await fetch(`${baseUrl}/_apis/distributedtask/hubs/Hub/plans/Plan/actiondownloadinfo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                actions: [
+                    { nameWithOwner: "actions/cache/save", ref: "v3" },
+                    { nameWithOwner: "actions/cache/restore", ref: "v3" },
+                ],
+            }),
+        });
+        expect(res.status).toBe(200);
+        const data = await res.json();
+        // "actions/cache/save" should be rewritten to use "actions/cache" repo
+        const saveInfo = data.actions["actions/cache/save@v3"];
+        expect(saveInfo.tarballUrl).toBe(`${baseUrl}/_dtu/action-tarball/actions/cache/v3`);
+        // "actions/cache/restore" should also use "actions/cache" repo
+        const restoreInfo = data.actions["actions/cache/restore@v3"];
+        expect(restoreInfo.tarballUrl).toBe(`${baseUrl}/_dtu/action-tarball/actions/cache/v3`);
+    });
+    it("should include resolvedSha as a deterministic hash", async () => {
+        const baseUrl = `http://localhost:${PORT}`;
+        const res = await fetch(`${baseUrl}/_apis/distributedtask/hubs/Hub/plans/Plan/actiondownloadinfo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                actions: [{ nameWithOwner: "actions/checkout", ref: "v4" }],
+            }),
+        });
+        const data = await res.json();
+        const info = data.actions["actions/checkout@v4"];
+        // resolvedSha should be a 40-char hex string (SHA-1)
+        expect(info.resolvedSha).toMatch(/^[0-9a-f]{40}$/);
+        // Same input should produce the same hash (deterministic)
+        const res2 = await fetch(`${baseUrl}/_apis/distributedtask/hubs/Hub/plans/Plan/actiondownloadinfo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                actions: [{ nameWithOwner: "actions/checkout", ref: "v4" }],
+            }),
+        });
+        const data2 = await res2.json();
+        expect(data2.actions["actions/checkout@v4"].resolvedSha).toBe(info.resolvedSha);
+    });
+    it("should handle empty actions array", async () => {
+        const baseUrl = `http://localhost:${PORT}`;
+        const res = await fetch(`${baseUrl}/_apis/distributedtask/hubs/Hub/plans/Plan/actiondownloadinfo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ actions: [] }),
+        });
+        expect(res.status).toBe(200);
+        const data = await res.json();
+        expect(data.actions).toEqual({});
+    });
+});
+// ── writeStepOutputLines group filtering ─────────────────────────────────────
+// The writeStepOutputLines function is internal to registerActionRoutes, so we
+// test it via the timeline record feed endpoint which calls it.
+describe("Step output group filtering", () => {
+    let server;
+    let logDir;
+    const planId = "test-plan-group";
+    const timelineId = "test-timeline-group";
+    const recordId = "test-record-group";
+    beforeAll(async () => {
+        state.reset();
+        const app = await bootstrapAndReturnApp();
+        return new Promise((resolve) => {
+            server = app.listen(0, () => {
+                const address = server.server?.address();
+                PORT = address.port;
+                resolve();
+            });
+        });
+    });
+    beforeEach(() => {
+        state.reset();
+        // Set up log dir for step output writing
+        logDir = fs.mkdtempSync("/tmp/dtu-group-test-");
+        state.planToLogDir.set(planId, logDir);
+        state.recordToStepName.set(recordId, "test-step");
+    });
+    afterAll(async () => {
+        await new Promise((resolve) => {
+            if (server?.server) {
+                server.server.close(() => resolve());
+            }
+            else {
+                resolve();
+            }
+        });
+    });
+    function postFeed(lines) {
+        return fetch(`http://localhost:${PORT}/_apis/distributedtask/hubs/Hub/plans/${planId}/timelines/${timelineId}/records/${recordId}/feed`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ value: lines }),
+        });
+    }
+    function readStepLog() {
+        const logFile = path.join(logDir, "steps", "test-step.log");
+        return fs.existsSync(logFile) ? fs.readFileSync(logFile, "utf-8") : "";
+    }
+    it("should strip ##[group]/##[endgroup] markers and their contents", async () => {
+        await postFeed([
+            "visible line 1",
+            "##[group]Downloading action",
+            "hidden inside group",
+            "also hidden",
+            "##[endgroup]",
+            "visible line 2",
+        ]);
+        const log = readStepLog();
+        expect(log).toContain("visible line 1");
+        expect(log).toContain("visible line 2");
+        expect(log).not.toContain("hidden inside group");
+        expect(log).not.toContain("also hidden");
+        expect(log).not.toContain("##[group]");
+        expect(log).not.toContain("##[endgroup]");
+    });
+    it("should handle nested groups (flat — no true nesting)", async () => {
+        await postFeed([
+            "before",
+            "##[group]outer",
+            "inside outer",
+            "##[endgroup]",
+            "between",
+            "##[group]inner",
+            "inside inner",
+            "##[endgroup]",
+            "after",
+        ]);
+        const log = readStepLog();
+        expect(log).toContain("before");
+        expect(log).toContain("between");
+        expect(log).toContain("after");
+        expect(log).not.toContain("inside outer");
+        expect(log).not.toContain("inside inner");
+    });
+    it("should suppress empty lines inside groups", async () => {
+        await postFeed([
+            "visible",
+            "##[group]Group start",
+            "",
+            "hidden in group",
+            "",
+            "##[endgroup]",
+            "also visible",
+        ]);
+        const log = readStepLog();
+        expect(log).toContain("visible");
+        expect(log).toContain("also visible");
+        expect(log).not.toContain("hidden in group");
+    });
+    it("should still filter ##[command] and runner internal lines", async () => {
+        await postFeed([
+            "real output",
+            "[command]/usr/bin/npm test",
+            "##[debug]some debug info",
+            "[RUNNER 2025-01-01 00:00:00Z INFO  Something internal",
+            "more real output",
+        ]);
+        const log = readStepLog();
+        expect(log).toContain("real output");
+        expect(log).toContain("more real output");
+        expect(log).not.toContain("[command]");
+        expect(log).not.toContain("##[debug]");
+        expect(log).not.toContain("[RUNNER");
+    });
+    it("should strip BOM and timestamp prefixes", async () => {
+        await postFeed([
+            "\uFEFF2025-01-01T00:00:00.000Z actual content",
+            "2025-06-15T12:30:45.123Z another line",
+        ]);
+        const log = readStepLog();
+        expect(log).toContain("actual content");
+        expect(log).toContain("another line");
+        expect(log).not.toContain("2025-01-01T");
+        expect(log).not.toContain("\uFEFF");
+    });
+    it("should parse and persist agent-ci-output lines", async () => {
+        await postFeed([
+            "normal output",
+            "::agent-ci-output::result=success",
+            "::agent-ci-output::version=1.2.3",
+        ]);
+        const log = readStepLog();
+        expect(log).toContain("normal output");
+        expect(log).not.toContain("agent-ci-output");
+        // Check outputs.json was written
+        const outputsPath = path.join(logDir, "outputs.json");
+        expect(fs.existsSync(outputsPath)).toBe(true);
+        const outputs = JSON.parse(fs.readFileSync(outputsPath, "utf-8"));
+        expect(outputs.result).toBe("success");
+        expect(outputs.version).toBe("1.2.3");
+    });
+});

package/dist/server/routes/actions/generators.js

@@ -173,11 +173,15 @@ export function createJobResponse(jobId, payload, baseUrl, planId) {
         "build.repository.name": { Value: repoFullName, IsSecret: false },
         "build.repository.uri": { Value: `https://github.com/${repoFullName}`, IsSecret: false },
     };
-    // Merge all step-level env: vars into the job Variables.
+    // Merge job-level env: into Variables first, then step-level env: (step wins on conflict).
     // The runner exports every Variable as a process env var for all steps, so this is the
-    // reliable mechanism to get DB_HOST=mysql, DB_PORT=3306 etc. into the step subprocess.
-    // (Step-scoped env would require full template compilation; job-level Variables are sufficient
-    //  for DB credentials / CI flags that are consistent across steps.)
+    // reliable mechanism to get AGENT_CI_LOCAL, DB_HOST, DB_PORT etc. into the step subprocess
+    // and into the runner's expression engine (${{ env.AGENT_CI_LOCAL }}).
+    if (payload.env && typeof payload.env === "object") {
+        for (const [key, val] of Object.entries(payload.env)) {
+            Variables[key] = { Value: String(val), IsSecret: false };
+        }
+    }
     for (const step of payload.steps || []) {
         if (step.Env && typeof step.Env === "object") {
             for (const [key, val] of Object.entries(step.Env)) {
@@ -214,14 +218,15 @@ export function createJobResponse(jobId, payload, baseUrl, planId) {
             },
         };
     }
-    // Collect env vars from all steps (job-level env context seen by the runner's expression engine).
-    // Step-level `env:` blocks in the workflow YAML need to be exposed via ContextData.env so the
-    // runner can evaluate them. We merge all step envs — slightly broader than per-step scoping but
-    // correct for typical use (DB_HOST, DB_PORT, CI flags etc.).
-    const mergedStepEnv = {};
+    // Collect env vars from job-level and all steps (seen by the runner's expression engine).
+    // Job-level env is applied first, then step-level env wins on conflict.
+    const mergedEnv = {};
+    if (payload.env && typeof payload.env === "object") {
+        Object.assign(mergedEnv, payload.env);
+    }
     for (const step of payload.steps || []) {
         if (step.Env) {
-            Object.assign(mergedStepEnv, step.Env);
+            Object.assign(mergedEnv, step.Env);
         }
     }
     const ContextData = {
@@ -230,9 +235,9 @@ export function createJobResponse(jobId, payload, baseUrl, planId) {
         needs: { t: 2, d: [] }, // Empty needs context
         strategy: { t: 2, d: [] }, // Empty strategy context
         matrix: { t: 2, d: [] }, // Empty matrix context
-        // env context: merged from all step-level env: blocks so the runner's expression engine
-        // can substitute ${{ env.DB_HOST }} etc. during step execution.
-        ...(Object.keys(mergedStepEnv).length > 0 ? { env: toContextData(mergedStepEnv) } : {}),
+        // env context: merged from job-level + step-level env: blocks so the runner's expression
+        // engine can substitute ${{ env.AGENT_CI_LOCAL }}, ${{ env.DB_HOST }} etc.
+        ...(Object.keys(mergedEnv).length > 0 ? { env: toContextData(mergedEnv) } : {}),
     };
     const generatedJobId = crypto.randomUUID();
     const mockToken = createMockJwt(planId, generatedJobId);
@@ -303,7 +308,7 @@ export function createJobResponse(jobId, payload, baseUrl, planId) {
         // EnvironmentVariables is IList<TemplateToken> in the runner — each element is a MappingToken.
         // The runner evaluates each MappingToken and merges into Global.EnvironmentVariables (last wins),
         // which then populates ExpressionValues["env"] → subprocess env vars.
-        EnvironmentVariables: Object.keys(mergedStepEnv).length > 0 ? [toTemplateTokenMapping(mergedStepEnv)] : [],
+        EnvironmentVariables: Object.keys(mergedEnv).length > 0 ? [toTemplateTokenMapping(mergedEnv)] : [],
     };
     return {
         MessageId: 1,

package/dist/server/routes/actions/generators.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/routes/actions/generators.test.js

@@ -0,0 +1,71 @@
+import { describe, it, expect } from "vitest";
+import { createJobResponse } from "./generators.js";
+describe("createJobResponse", () => {
+    const basePayload = {
+        id: "1",
+        name: "test-job",
+        githubRepo: "owner/repo",
+        steps: [],
+    };
+    it("propagates job-level env into Variables", () => {
+        const payload = {
+            ...basePayload,
+            env: { AGENT_CI_LOCAL: "true", MY_VAR: "hello" },
+        };
+        const response = createJobResponse("1", payload, "http://localhost:3000", "plan-1");
+        const body = JSON.parse(response.Body);
+        const vars = body.Variables;
+        expect(vars.AGENT_CI_LOCAL).toEqual({ Value: "true", IsSecret: false });
+        expect(vars.MY_VAR).toEqual({ Value: "hello", IsSecret: false });
+    });
+    it("propagates job-level env into ContextData.env", () => {
+        const payload = {
+            ...basePayload,
+            env: { AGENT_CI_LOCAL: "true" },
+        };
+        const response = createJobResponse("1", payload, "http://localhost:3000", "plan-1");
+        const body = JSON.parse(response.Body);
+        // ContextData.env should be a ContextData object with type 2 (mapping)
+        expect(body.ContextData.env).toBeDefined();
+        expect(body.ContextData.env.t).toBe(2);
+        const entries = body.ContextData.env.d;
+        const localEntry = entries.find((e) => e.k === "AGENT_CI_LOCAL");
+        expect(localEntry).toBeDefined();
+        expect(localEntry.v).toEqual({ t: 0, s: "true" });
+    });
+    it("propagates job-level env into EnvironmentVariables", () => {
+        const payload = {
+            ...basePayload,
+            env: { AGENT_CI_LOCAL: "true" },
+        };
+        const response = createJobResponse("1", payload, "http://localhost:3000", "plan-1");
+        const body = JSON.parse(response.Body);
+        expect(body.EnvironmentVariables).toHaveLength(1);
+        const mapping = body.EnvironmentVariables[0];
+        expect(mapping.type).toBe(2);
+        const entry = mapping.map.find((e) => e.Key === "AGENT_CI_LOCAL");
+        expect(entry).toBeDefined();
+        expect(entry.Value).toBe("true");
+    });
+    it("step-level env overrides job-level env on conflict", () => {
+        const payload = {
+            ...basePayload,
+            env: { SHARED: "from-job" },
+            steps: [{ name: "step1", run: "echo hi", Env: { SHARED: "from-step" } }],
+        };
+        const response = createJobResponse("1", payload, "http://localhost:3000", "plan-1");
+        const body = JSON.parse(response.Body);
+        // Variables should have the step-level value (last-write wins)
+        expect(body.Variables.SHARED).toEqual({ Value: "from-step", IsSecret: false });
+        // ContextData.env should also have the step-level value
+        const entries = body.ContextData.env.d;
+        const entry = entries.find((e) => e.k === "SHARED");
+        expect(entry.v).toEqual({ t: 0, s: "from-step" });
+    });
+    it("omits env from ContextData when no env is provided", () => {
+        const response = createJobResponse("1", basePayload, "http://localhost:3000", "plan-1");
+        const body = JSON.parse(response.Body);
+        expect(body.ContextData.env).toBeUndefined();
+        expect(body.EnvironmentVariables).toEqual([]);
+    });
+});

package/dist/server/routes/actions/index.js

@@ -1,11 +1,111 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
+import https from "node:https";
+import http from "node:http";
 import path from "node:path";
-import { state } from "../../store.js";
+import { state, getActionTarballsDir } from "../../store.js";
 import { getBaseUrl } from "../dtu.js";
 import { createJobResponse } from "./generators.js";
+// ─── Action tarball cache ──────────────────────────────────────────────────────
+// Downloads action tarballs from GitHub on first use and serves them from disk
+// on subsequent runs, eliminating ~30s GitHub CDN download delays.
+/** Tracks in-flight downloads so concurrent cache misses for the same tarball
+ *  coalesce into a single GitHub fetch instead of racing on the same tmp file. */
+const inflightDownloads = new Map();
+function actionTarballPath(repoPath, ref) {
+    const key = `${repoPath.replace("/", "__")}@${ref.replace(/[^a-zA-Z0-9._-]/g, "-")}`;
+    return path.join(getActionTarballsDir(), `${key}.tar.gz`);
+}
+/** Follow redirects and invoke callback with the final response. */
+function fetchWithRedirects(url, callback, redirects = 0) {
+    if (redirects > 5) {
+        return;
+    }
+    const mod = url.startsWith("https") ? https : http;
+    mod.get(url, { headers: { "User-Agent": "agent-ci/1.0" } }, (res) => {
+        if ((res.statusCode === 301 || res.statusCode === 302) && res.headers.location) {
+            res.resume();
+            return fetchWithRedirects(res.headers.location, callback, redirects + 1);
+        }
+        callback(res);
+    });
+}
 // Helper to reliably find log Id from URLs like /_apis/distributedtask/hubs/Hub/plans/Plan/logs/123
 export function registerActionRoutes(app) {
+    // ── Action tarball proxy: serves cached tarballs to the runner ──────────────
+    // First run: proxies from GitHub while saving to disk (same speed as direct download).
+    // Subsequent runs: serves from disk cache instantly (~0ms).
+    app.get("/_dtu/action-tarball/:owner/:repo/:ref", (req, res) => {
+        const { owner, repo, ref } = req.params;
+        const repoPath = `${owner}/${repo}`;
+        const dest = actionTarballPath(repoPath, ref);
+        /** Serve a completed cache file from disk. */
+        const serveFromDisk = () => {
+            const stat = fs.statSync(dest);
+            res.writeHead(200, {
+                "Content-Type": "application/x-tar",
+                "Content-Length": String(stat.size),
+            });
+            fs.createReadStream(dest).pipe(res);
+        };
+        // Cache hit: serve from disk
+        if (fs.existsSync(dest)) {
+            serveFromDisk();
+            return;
+        }
+        // Another request is already downloading this tarball — wait for it,
+        // then serve from the completed cache file.
+        const inflight = inflightDownloads.get(dest);
+        if (inflight) {
+            inflight.then(() => serveFromDisk(), () => {
+                res.writeHead(502);
+                res.end();
+            });
+            return;
+        }
+        // Cache miss: proxy from GitHub, write to disk simultaneously.
+        // Register a promise so concurrent requests can coalesce.
+        let resolveDownload;
+        let rejectDownload;
+        const downloadPromise = new Promise((resolve, reject) => {
+            resolveDownload = resolve;
+            rejectDownload = reject;
+        });
+        // Prevent unhandled-rejection when no concurrent waiter is attached.
+        downloadPromise.catch(() => { });
+        inflightDownloads.set(dest, downloadPromise);
+        fs.mkdirSync(path.dirname(dest), { recursive: true });
+        const githubUrl = `https://api.github.com/repos/${repoPath}/tarball/${ref}`;
+        fetchWithRedirects(githubUrl, (upstream) => {
+            if (upstream.statusCode !== 200) {
+                inflightDownloads.delete(dest);
+                rejectDownload(new Error(`upstream ${upstream.statusCode}`));
+                res.writeHead(upstream.statusCode ?? 502);
+                res.end();
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "application/x-tar" });
+            const tmp = dest + ".tmp." + process.pid;
+            const file = fs.createWriteStream(tmp);
+            upstream.pipe(res);
+            upstream.pipe(file);
+            file.on("finish", () => file.close(() => {
+                try {
+                    fs.renameSync(tmp, dest);
+                }
+                catch {
+                    /* best-effort */
+                }
+                inflightDownloads.delete(dest);
+                resolveDownload();
+            }));
+            file.on("error", () => {
+                fs.rmSync(tmp, { force: true });
+                inflightDownloads.delete(dest);
+                rejectDownload(new Error("write failed"));
+            });
+        });
+    });
     // 7. Pipeline Service Discovery Mock
     const serviceDiscoveryHandler = (req, res) => {
         console.log(`[DTU] Handling service discovery: ${req.url}`);
@@ -467,13 +567,20 @@ export function registerActionRoutes(app) {
         res.end(JSON.stringify({ value: {} }));
     });
     // 18. Resolve Action Download Info Mock
-    app.post("/_apis/distributedtask/hubs/:hub/plans/:planId/actiondownloadinfo", (req, res) => {
+    app.post("/_apis/distributedtask/hubs/:hub/plans/:planId/actiondownloadinfo", async (req, res) => {
         const payload = req.body || {};
         const actions = payload.actions || [];
         const result = { actions: {} };
+        const baseUrl = getBaseUrl(req);
         for (const action of actions) {
             const key = `${action.nameWithOwner}@${action.ref}`;
-            const downloadUrl = `https://api.github.com/repos/${action.nameWithOwner}/tarball/${action.ref}`;
+            // Strip sub-path from nameWithOwner (e.g. "actions/cache/save" → "actions/cache")
+            // Sub-path actions share the same repo tarball as the parent action.
+            const repoPath = action.nameWithOwner.split("/").slice(0, 2).join("/");
+            const [owner, repo] = repoPath.split("/");
+            // Point the runner at our local proxy; on cache miss the proxy streams from GitHub
+            // while saving to disk — subsequent runs are served instantly from the local cache.
+            const localUrl = `${baseUrl}/_dtu/action-tarball/${owner}/${repo}/${action.ref}`;
             result.actions[key] = {
                 nameWithOwner: action.nameWithOwner,
                 resolvedNameWithOwner: action.nameWithOwner,
@@ -482,8 +589,8 @@ export function registerActionRoutes(app) {
                     .createHash("sha1")
                     .update(`${action.nameWithOwner}@${action.ref}`)
                     .digest("hex"),
-                tarballUrl: downloadUrl,
-                zipballUrl: downloadUrl.replace("tarball", "zipball"),
+                tarballUrl: localUrl,
+                zipballUrl: localUrl,
                 authentication: null,
             };
         }
@@ -526,12 +633,15 @@ export function registerActionRoutes(app) {
         }
         const RUNNER_INTERNAL_RE = /^\[(?:RUNNER|WORKER) \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}Z (?:INFO|WARN|ERR)\s/;
         let content = "";
+        let inGroup = false;
         // Collect agent-ci-output lines for cross-job output passing
         const outputEntries = [];
         for (const rawLine of lines) {
             const line = rawLine.trimEnd();
             if (!line) {
-                content += "\n";
+                if (!inGroup) {
+                    content += "\n";
+                }
                 continue;
             }
             // Strip BOM + timestamp prefix before filtering
@@ -547,7 +657,16 @@ export function registerActionRoutes(app) {
                 }
                 continue; // Don't include in regular step logs
             }
-            if (!stripped ||
+            if (stripped.startsWith("##[group]")) {
+                inGroup = true;
+                continue;
+            }
+            if (stripped.startsWith("##[endgroup]")) {
+                inGroup = false;
+                continue;
+            }
+            if (inGroup ||
+                !stripped ||
                 stripped.startsWith("##[") ||
                 stripped.startsWith("[command]") ||
                 RUNNER_INTERNAL_RE.test(stripped)) {

package/dist/server/store.d.ts

@@ -1,6 +1,7 @@
 import http from "node:http";
 /** Override the cache directory at runtime (e.g. for ephemeral per-repo DTU instances). */
 export declare function setCacheDir(dir: string): void;
+export declare function getActionTarballsDir(): string;
 export declare const state: {
     jobs: Map<string, any>;
     runnerJobs: Map<string, any>;

package/dist/server/store.js

@@ -3,10 +3,15 @@ import path from "node:path";
 import { config } from "../config.js";
 let CACHE_DIR = config.DTU_CACHE_DIR;
 let CACHES_FILE = path.join(CACHE_DIR, "caches.json");
+let ACTION_TARBALLS_DIR = path.join(CACHE_DIR, "action-tarballs");
 /** Override the cache directory at runtime (e.g. for ephemeral per-repo DTU instances). */
 export function setCacheDir(dir) {
     CACHE_DIR = dir;
     CACHES_FILE = path.join(dir, "caches.json");
+    ACTION_TARBALLS_DIR = path.join(dir, "action-tarballs");
+}
+export function getActionTarballsDir() {
+    return ACTION_TARBALLS_DIR;
 }
 export const state = {
     jobs: new Map(),

package/dist/server.test.js

@@ -439,6 +439,51 @@ describe("Artifact v4 upload/download", () => {
         expect(res.body.lockedUntil).toBeDefined();
         expect(new Date(res.body.lockedUntil).getTime()).toBeGreaterThan(Date.now());
     });
+    it("should let runner B steal runner A's job when seeded WITHOUT runnerName (generic pool bug)", async () => {
+        // REPRODUCTION for issue #103:
+        // When local-job.ts seeds a job without setting runnerName, the job lands
+        // in the generic state.jobs pool. If another runner (from a different
+        // concurrent workflow) polls before runner A, it steals the job — causing
+        // runner A to hang forever waiting for a job that will never arrive.
+        const runnerA = "agent-ci-repro-A";
+        const runnerB = "agent-ci-repro-B";
+        // Register both runners
+        await request("POST", "/_dtu/start-runner", {
+            runnerName: runnerA,
+            logDir: "/tmp/agent-ci-repro-A-logs",
+            timelineDir: "/tmp/agent-ci-repro-A-logs",
+        });
+        await request("POST", "/_dtu/start-runner", {
+            runnerName: runnerB,
+            logDir: "/tmp/agent-ci-repro-B-logs",
+            timelineDir: "/tmp/agent-ci-repro-B-logs",
+        });
+        // Seed a job intended for runner A, but WITHOUT runnerName (the bug).
+        // This goes into the generic state.jobs pool.
+        await request("POST", "/_dtu/seed", {
+            id: 4001,
+            name: "job-intended-for-A",
+            // BUG: no runnerName — job lands in generic pool
+        });
+        // Runner B creates a session and polls — it shouldn't get A's job,
+        // but because the job is in the generic pool, B steals it.
+        const sessionB = await request("POST", "/_apis/distributedtask/pools/1/sessions", {
+            agent: { name: runnerB },
+        });
+        const pollB = await request("GET", `/_apis/distributedtask/pools/1/messages?sessionId=${sessionB.body.sessionId}`);
+        // BUG CONFIRMED: runner B stole the job from the generic pool
+        expect(pollB.status).toBe(200);
+        const bodyB = JSON.parse(pollB.body.Body);
+        expect(bodyB.JobDisplayName).toBe("job-intended-for-A");
+        // Now runner A creates a session and polls — the job is gone
+        await request("POST", "/_apis/distributedtask/pools/1/sessions", {
+            agent: { name: runnerA },
+        });
+        // Runner A's poll will hang (long-poll timeout) because its job was stolen.
+        // We verify by checking state: no jobs remain for A.
+        const aHasJob = state.runnerJobs.has(runnerA) || state.jobs.size > 0;
+        expect(aHasJob).toBe(false); // A's job is gone — it will hang forever
+    }, 10_000);
     it("should handle job request finish (PATCH with result + finishTime)", async () => {
         const finishTime = new Date().toISOString();
         const res = await request("PATCH", "/_apis/distributedtask/jobrequests", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dtu-github-actions",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Digital Twin Universe - GitHub Actions Mock and Simulation",
   "keywords": [
     "ci",