maven-proxy 1.2.0 → 1.3.0

package/README.md

@@ -256,6 +256,17 @@ curl.exe -k -sS -D - -o NUL -x http://127.0.0.1:8080 https://registry.npmjs.org/
 ### 8.4 Upstream Proxy Settings
 
 Environment variables:
+- CACHE_CLEANUP_ENABLED: enable automatic cache cleanup.
+- CACHE_CLEANUP_DAILY_AT: daily cleanup check time in local timezone (HH:mm), for example 03:00.
+- CACHE_CLEANUP_CHECK_MIN_INTERVAL: minimum interval between pressure checks (supports s/m/h/d), for example 10m.
+- CACHE_TOUCH_ON_HIT: update file mtime when cache hit returns successfully.
+- CACHE_TOUCH_MIN_INTERVAL: minimum interval between two touches for the same file (supports s/m/h/d), default 1d.
+- CACHE_RETENTION_START: initial retention window for cleanup rounds (supports s/m/h/d), default 10d.
+- CACHE_RETENTION_MIN: minimum retention window for cleanup rounds (supports s/m/h/d), default 1d.
+- CACHE_DISK_FREE_TRIGGER: trigger cleanup when disk free bytes are below this value (supports K/M/G/T), for example 20G.
+- CACHE_DISK_FREE_TARGET: stop cleanup when disk free bytes recover to this value (supports K/M/G/T), for example 25G.
+- CACHE_MAX_SIZE: optional cache-size trigger threshold (supports K/M/G/T).
+- CACHE_TARGET_SIZE: optional cache-size target to stop cleanup (supports K/M/G/T).
 - UPSTREAM_PROXY_URL: generic upstream proxy URL.
 - UPSTREAM_HTTP_PROXY_URL: upstream proxy for HTTP.
 - UPSTREAM_HTTPS_PROXY_URL: upstream proxy for HTTPS.
@@ -266,12 +277,18 @@ Environment variables:
 - MAVEN_REPO_DOMAINS: maven domains for ecosystem routing (wildcards supported).
 - HTTPS_MITM_DOMAINS: MITM domain list (includes registry.npmjs.org by default, wildcards supported).
 - DOWNLOAD_LOG_DIR: log directory.
-- LOG_RETENTION_DAYS: number of days to retain logs.
-- LOG_TO_STDOUT: whether to also print logs to stdout/stderr.
+- LOG_RETENTION: log retention duration (supports s/m/h/d), for example 7d.
+- LOG_TO_STDOUT: whether to also print runtime logs to stdout/stderr; startup logs are always printed.
+- LOG_CONNECT_EVENTS: whether to print verbose CONNECT/MITM handshake logs. Default false.
 - OUTBOUND_KEEP_ALIVE: enable outbound keep-alive connection pooling.
-- OUTBOUND_KEEP_ALIVE_SECONDS: keep-alive interval in seconds.
+- OUTBOUND_KEEP_ALIVE_INTERVAL: keep-alive interval (supports s/m/h/d), for example 1s.
 - OUTBOUND_MAX_SOCKETS: max outbound sockets per origin.
 - OUTBOUND_MAX_FREE_SOCKETS: max idle outbound sockets per origin.
+- MAVEN_AFFINITY_ENABLED: enable Maven affinity index.
+- MAVEN_AFFINITY_INDEX_DIR: Maven affinity index directory. Default data/index.
+- MAVEN_NEGATIVE_CACHE_TTL: negative cache TTL (supports s/m/h/d), for example 24h.
+- MAVEN_AFFINITY_FLUSH_INTERVAL: flush interval for affinity event log (supports s/m/h/d), for example 5s.
+- MAVEN_AFFINITY_EVENT_MAX_MB: max size threshold for affinity event log compaction in MB.
 - MAVEN_PROXY_CONFIG_MODE: development or user.
 - MAVEN_PROXY_CONFIG_FILE: explicit config file path.
 - EXISTING_TRUST_STORE_PATH: optional existing truststore path. If present, truststore init prefers it as source.
@@ -291,23 +308,40 @@ Priority:
 - `PROXY_PORT`: Proxy server port. Default `8080`.
 - `REPO_PORT`: Local repository server port. Default `8081`.
 - `CACHE_DIR`: Base cache directory. Default `data/cache`.
+- `CACHE_CLEANUP_ENABLED`: Enable automatic cache cleanup. Default `true`.
+- `CACHE_CLEANUP_DAILY_AT`: Daily cleanup check time in local timezone (`HH:mm`). Default `03:00`.
+- `CACHE_CLEANUP_CHECK_MIN_INTERVAL`: Minimum interval between pressure checks (supports `s/m/h/d`). Default `10m`.
+- `CACHE_TOUCH_ON_HIT`: Update file mtime when cache hit returns successfully. Default `true`.
+- `CACHE_TOUCH_MIN_INTERVAL`: Minimum interval between two touches for the same file (supports `s/m/h/d`). Default `1d`.
+- `CACHE_RETENTION_START`: Initial retention window for cleanup rounds (supports `s/m/h/d`). Default `10d`.
+- `CACHE_RETENTION_MIN`: Minimum retention window for cleanup rounds (supports `s/m/h/d`). Default `1d`.
+- `CACHE_DISK_FREE_TRIGGER`: Trigger cleanup when disk free bytes are below this value (supports `K/M/G/T`). Default `20G`.
+- `CACHE_DISK_FREE_TARGET`: Stop cleanup when disk free bytes recover to this value (supports `K/M/G/T`). Default `25G`.
+- `CACHE_MAX_SIZE`: Optional cache-size trigger threshold (supports `K/M/G/T`). Default empty (disabled).
+- `CACHE_TARGET_SIZE`: Optional cache-size target to stop cleanup (supports `K/M/G/T`). Default empty (disabled).
 - `REPO_FALLBACK_REPOS`: Comma-separated fallback repository URLs for cache misses.
 - `ENABLE_HTTPS_PROXY`: Enable HTTPS proxy handling (`true/false`).
 - `HTTPS_MITM_DOMAINS`: Comma-separated domains to apply MITM certificate issuance (wildcards supported).
-- `HTTPS_PASSTHROUGH_FOR_UNMATCHED`: Whether unmatched HTTPS domains are tunneled directly.
+- `HTTPS_PASSTHROUGH_FOR_UNMATCHED`: Whether unmatched HTTPS domains are tunneled directly. Default `false`.
 - `NPM_REGISTRY_DOMAINS`: Domains treated as npm ecosystem for cache routing (wildcards supported).
 - `MAVEN_REPO_DOMAINS`: Domains treated as Maven ecosystem for cache routing (wildcards supported).
 - `MULTI_THREAD_DOMAINS`: Domains allowed to use multi-thread download (wildcards supported).
 - `MULTI_THREAD_COUNT`: Number of download threads for ranged downloads.
 - `MULTI_THREAD_MIN_SIZE_MB`: Minimum size threshold to trigger multi-thread download (MB).
-- `DOWNLOAD_TIMEOUT_SECONDS`: Upstream request timeout in seconds.
+- `DOWNLOAD_TIMEOUT`: Upstream request timeout (supports `s/m/h/d`). Default `60s`.
 - `DOWNLOAD_LOG_DIR`: Directory for unified app/error logs.
-- `LOG_RETENTION_DAYS`: Number of days to keep log files.
-- `LOG_TO_STDOUT`: Whether to also print logs to stdout/stderr. Default `true`.
+- `LOG_RETENTION`: Log retention duration (supports `s/m/h/d`). Default `7d`.
+- `LOG_TO_STDOUT`: Whether to also print runtime logs to stdout/stderr. Startup logs are always printed. Default `true`.
+- `LOG_CONNECT_EVENTS`: Whether to print verbose CONNECT/MITM handshake logs. Default `false`.
 - `OUTBOUND_KEEP_ALIVE`: Enable outbound keep-alive connection pooling. Default `true`.
-- `OUTBOUND_KEEP_ALIVE_SECONDS`: Keep-alive interval in seconds. Default `1`.
+- `OUTBOUND_KEEP_ALIVE_INTERVAL`: Keep-alive interval (supports `s/m/h/d`). Default `1s`.
 - `OUTBOUND_MAX_SOCKETS`: Max outbound sockets per origin. Default `64`.
 - `OUTBOUND_MAX_FREE_SOCKETS`: Max idle outbound sockets per origin. Default `16`.
+- `MAVEN_AFFINITY_ENABLED`: Enable Maven affinity cache index. Default `true`.
+- `MAVEN_AFFINITY_INDEX_DIR`: Maven affinity index directory. Default `data/index`.
+- `MAVEN_NEGATIVE_CACHE_TTL`: Negative cache TTL (supports `s/m/h/d`). Default `24h`.
+- `MAVEN_AFFINITY_FLUSH_INTERVAL`: Flush interval for affinity event log (supports `s/m/h/d`). Default `5s`.
+- `MAVEN_AFFINITY_EVENT_MAX_MB`: Max size threshold for affinity event log compaction in MB. Default `8`.
 - `UPSTREAM_PROXY_URL`: Generic upstream proxy URL (fallback for HTTP/HTTPS).
 - `UPSTREAM_HTTP_PROXY_URL`: Upstream proxy URL for HTTP requests.
 - `UPSTREAM_HTTPS_PROXY_URL`: Upstream proxy URL for HTTPS requests.
@@ -404,12 +438,17 @@ Common commands:
 - maven-proxy --config /path/to/config
 - maven-proxy start --mode development
 - maven-proxy start --mode user
+- maven-proxy stop
 - maven-proxy init-config --force
 - maven-proxy truststore print
 - maven-proxy truststore init
 - maven-proxy truststore merge --source /path/source.jks --target /path/target.jks
 - maven-proxy doctor
 
+Start/stop behavior:
+- `maven-proxy start` runs in background and returns immediately.
+- `maven-proxy stop` stops the background process using PID file `~/maven-proxy/maven-proxy.pid`.
+
 Doctor command:
 - Checks config loading, port availability, keytool, JAVA_HOME, cert/truststore paths, and writable log/cache directories.
 - Reports PASS/WARN/FAIL.

package/bin/maven-proxy.js

@@ -3,10 +3,14 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import net from "node:net";
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
 
 const defaultConfigDir = path.resolve(os.homedir(), "maven-proxy");
 const defaultConfigFile = path.join(defaultConfigDir, "config.properties");
+const daemonPidFile = path.join(defaultConfigDir, "maven-proxy.pid");
+const internalRunCommand = "__run-server";
+const cliFilePath = fileURLToPath(import.meta.url);
 
 function normalizeMode(value) {
   const normalized = String(value || "").trim().toLowerCase();
@@ -54,6 +58,7 @@ function printHelp() {
   console.log("Usage:");
   console.log("  maven-proxy");
   console.log("  maven-proxy start [--mode <development|user>] [--config <file>]");
+  console.log("  maven-proxy stop");
   console.log("  maven-proxy init-config [--force] [--config <file>]");
   console.log("  maven-proxy truststore <print|init|merge> [options]");
   console.log("  maven-proxy doctor [--mode <development|user>] [--config <file>]");
@@ -62,6 +67,7 @@ function printHelp() {
   console.log("  npx maven-proxy");
   console.log("  maven-proxy init-config");
   console.log("  maven-proxy start --mode development");
+  console.log("  maven-proxy stop");
   console.log("  maven-proxy --config ~/maven-proxy/config.properties");
   console.log("  maven-proxy truststore print");
   console.log("  maven-proxy truststore merge --source ./a.jks --target ./b.jks");
@@ -141,27 +147,38 @@ function getDefaultConfigTemplate() {
     "PROXY_PORT=8080",
     "REPO_PORT=8081",
     "CACHE_DIR=data/cache",
+    "CACHE_CLEANUP_ENABLED=true",
+    "CACHE_CLEANUP_DAILY_AT=03:00",
+    "CACHE_CLEANUP_CHECK_MIN_INTERVAL=10m",
+    "CACHE_TOUCH_ON_HIT=true",
+    "CACHE_TOUCH_MIN_INTERVAL=1d",
+    "CACHE_RETENTION_START=10d",
+    "CACHE_RETENTION_MIN=1d",
+    "CACHE_DISK_FREE_TRIGGER=20G",
+    "CACHE_DISK_FREE_TARGET=25G",
+    "CACHE_MAX_SIZE=",
+    "CACHE_TARGET_SIZE=",
     "REPO_FALLBACK_REPOS=https://repo1.maven.org/maven2,https://jitpack.io,https://plugins.gradle.org/m2,https://maven.google.com",
     "ENABLE_HTTPS_PROXY=true",
     "HTTPS_MITM_DOMAINS=repo1.maven.org,repo.maven.apache.org,registry.npmjs.org",
-    "HTTPS_PASSTHROUGH_FOR_UNMATCHED=true",
+    "HTTPS_PASSTHROUGH_FOR_UNMATCHED=false",
     "NPM_REGISTRY_DOMAINS=registry.npmjs.org,registry.npmmirror.com,npm.pkg.github.com",
     "MAVEN_REPO_DOMAINS=repo1.maven.org,repo.maven.apache.org,jitpack.io,plugins.gradle.org,maven.google.com",
     "MULTI_THREAD_DOMAINS=repo1.maven.org",
     "MULTI_THREAD_COUNT=8",
     "MULTI_THREAD_MIN_SIZE_MB=1",
-    "DOWNLOAD_TIMEOUT_SECONDS=60",
+    "DOWNLOAD_TIMEOUT=60s",
     "OUTBOUND_KEEP_ALIVE=true",
-    "OUTBOUND_KEEP_ALIVE_SECONDS=1",
+    "OUTBOUND_KEEP_ALIVE_INTERVAL=1s",
     "OUTBOUND_MAX_SOCKETS=64",
     "OUTBOUND_MAX_FREE_SOCKETS=16",
     "MAVEN_AFFINITY_ENABLED=true",
-    "MAVEN_AFFINITY_INDEX_DIR=.index",
-    "MAVEN_NEGATIVE_CACHE_TTL_HOURS=24",
-    "MAVEN_AFFINITY_FLUSH_INTERVAL_SECONDS=5",
+    "MAVEN_AFFINITY_INDEX_DIR=data/index",
+    "MAVEN_NEGATIVE_CACHE_TTL=24h",
+    "MAVEN_AFFINITY_FLUSH_INTERVAL=5s",
     "MAVEN_AFFINITY_EVENT_MAX_MB=8",
     "DOWNLOAD_LOG_DIR=data/logs/downloads",
-    "LOG_RETENTION_DAYS=7",
+    "LOG_RETENTION=7d",
     "LOG_TO_STDOUT=false",
     "UPSTREAM_PROXY_URL=",
     "UPSTREAM_HTTP_PROXY_URL=",
@@ -217,12 +234,145 @@ async function ensureAutoConfigIfNeeded(options, command) {
   await initConfigFile(defaultConfigFile, false);
 }
 
-async function startServer(options) {
+async function runServerInCurrentProcess(options) {
   applyConfigOverrides(options);
 
   await import("../src/index.js");
 }
 
+function parsePid(rawText) {
+  const pid = Number.parseInt(String(rawText || "").trim(), 10);
+  return Number.isFinite(pid) && pid > 0 ? pid : 0;
+}
+
+function readDaemonPid() {
+  if (!fs.existsSync(daemonPidFile)) {
+    return 0;
+  }
+
+  try {
+    const text = fs.readFileSync(daemonPidFile, "utf8");
+    return parsePid(text);
+  } catch {
+    return 0;
+  }
+}
+
+function isProcessRunning(pid) {
+  if (!pid) {
+    return false;
+  }
+
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (error && error.code === "EPERM") {
+      return true;
+    }
+    return false;
+  }
+}
+
+async function removeDaemonPidFile() {
+  await fs.promises.rm(daemonPidFile, { force: true });
+}
+
+function waitMs(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitForProcessExit(pid, timeoutMs = 5000) {
+  const startedAt = Date.now();
+  while (Date.now() - startedAt < timeoutMs) {
+    if (!isProcessRunning(pid)) {
+      return true;
+    }
+    await waitMs(100);
+  }
+
+  return !isProcessRunning(pid);
+}
+
+async function startServer(options) {
+  await fs.promises.mkdir(defaultConfigDir, { recursive: true });
+
+  const existingPid = readDaemonPid();
+  if (existingPid && isProcessRunning(existingPid)) {
+    console.log(`[maven-proxy] already running (pid=${existingPid})`);
+    console.log(`[maven-proxy] pid file: ${daemonPidFile}`);
+    return;
+  }
+
+  if (existingPid && !isProcessRunning(existingPid)) {
+    await removeDaemonPidFile();
+  }
+
+  const childEnv = {
+    ...process.env,
+    MAVEN_PROXY_CONFIG_MODE: resolveEffectiveMode(options),
+  };
+
+  if (options.configPath) {
+    childEnv.MAVEN_PROXY_CONFIG_FILE = resolvePath(options.configPath);
+  } else {
+    delete childEnv.MAVEN_PROXY_CONFIG_FILE;
+  }
+
+  const child = spawn(
+    process.execPath,
+    [cliFilePath, internalRunCommand, "--mode", resolveEffectiveMode(options)],
+    {
+      cwd: process.cwd(),
+      detached: true,
+      stdio: "ignore",
+      env: childEnv,
+    },
+  );
+
+  child.unref();
+  await fs.promises.writeFile(daemonPidFile, `${child.pid}\n`, "utf8");
+
+  await waitMs(300);
+  if (!isProcessRunning(child.pid)) {
+    await removeDaemonPidFile();
+    throw new Error("start failed: process exited immediately, check app/error logs");
+  }
+
+  console.log(`[maven-proxy] started in background (pid=${child.pid})`);
+  console.log(`[maven-proxy] pid file: ${daemonPidFile}`);
+}
+
+async function stopServer(options) {
+  const pid = readDaemonPid();
+  if (!pid) {
+    console.log("[maven-proxy] not running (pid file not found)");
+    return;
+  }
+
+  if (!isProcessRunning(pid)) {
+    await removeDaemonPidFile();
+    console.log(`[maven-proxy] stale pid removed: ${pid}`);
+    return;
+  }
+
+  process.kill(pid, "SIGTERM");
+  const stopped = await waitForProcessExit(pid, 5000);
+  if (!stopped) {
+    process.kill(pid, "SIGKILL");
+    const forceStopped = await waitForProcessExit(pid, 2000);
+    if (!forceStopped) {
+      throw new Error(`stop failed: unable to terminate pid ${pid}`);
+    }
+  }
+
+  await removeDaemonPidFile();
+  console.log(`[maven-proxy] stopped (pid=${pid})`);
+  if (options.configPath) {
+    console.log(`[maven-proxy] stop requested with config: ${resolvePath(options.configPath)}`);
+  }
+}
+
 function applyConfigOverrides(options) {
   process.env.MAVEN_PROXY_CONFIG_MODE = resolveEffectiveMode(options);
 
@@ -577,6 +727,14 @@ async function main() {
     return;
   }
 
+  if (command === "stop") {
+    if (options.commandArgs.length > 0) {
+      throw new Error(`Unknown argument for stop: ${options.commandArgs[0]}`);
+    }
+    await stopServer(options);
+    return;
+  }
+
   if (command === "start") {
     if (options.commandArgs.length > 0) {
       throw new Error(`Unknown argument for start: ${options.commandArgs[0]}`);
@@ -585,6 +743,14 @@ async function main() {
     return;
   }
 
+  if (command === internalRunCommand) {
+    if (options.commandArgs.length > 0) {
+      throw new Error(`Unknown argument for ${internalRunCommand}: ${options.commandArgs[0]}`);
+    }
+    await runServerInCurrentProcess(options);
+    return;
+  }
+
   throw new Error(`Unknown command: ${command}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maven-proxy",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Maven proxy with cache, HTTPS MITM for selected domains, and local repo publishing",
   "main": "src/index.js",
   "bin": {
@@ -17,6 +17,7 @@
     "start:cli": "node bin/maven-proxy.js",
     "cli:help": "node bin/maven-proxy.js --help",
     "cli:start": "node bin/maven-proxy.js start --mode development",
+    "cli:stop": "node bin/maven-proxy.js stop",
     "cli:doctor": "node bin/maven-proxy.js doctor --mode development",
     "cli:truststore:print": "node bin/maven-proxy.js truststore print --mode development",
     "cli:truststore:init": "node bin/maven-proxy.js truststore init --mode development",

package/src/cache/cache-cleanup-manager.js

@@ -0,0 +1,416 @@
+import fs from "node:fs";
+import path from "node:path";
+
+const SECOND_MS = 1000;
+const MINUTE_MS = 60 * SECOND_MS;
+const HOUR_MS = 60 * MINUTE_MS;
+const DAY_MS = 24 * HOUR_MS;
+
+function toBool(value, fallback) {
+  if (value == null || value === "") {
+    return fallback;
+  }
+
+  return ["1", "true", "yes", "on"].includes(String(value).toLowerCase());
+}
+
+function parseDurationToMs(raw, fallbackMs) {
+  const text = String(raw || "").trim();
+  if (!text) {
+    return fallbackMs;
+  }
+
+  const match = text.match(/^(\d+)([smhd])$/i);
+  if (!match) {
+    return fallbackMs;
+  }
+
+  const value = Number.parseInt(match[1], 10);
+  const unit = match[2].toLowerCase();
+  if (!Number.isFinite(value) || value < 0) {
+    return fallbackMs;
+  }
+
+  if (unit === "s") {
+    return value * SECOND_MS;
+  }
+  if (unit === "m") {
+    return value * MINUTE_MS;
+  }
+  if (unit === "h") {
+    return value * HOUR_MS;
+  }
+
+  return value * DAY_MS;
+}
+
+function parseSizeToBytes(raw, fallbackBytes = 0) {
+  const text = String(raw || "").trim();
+  if (!text) {
+    return fallbackBytes;
+  }
+
+  const match = text.match(/^(\d+)([KMGT]?)$/i);
+  if (!match) {
+    return fallbackBytes;
+  }
+
+  const value = Number.parseInt(match[1], 10);
+  if (!Number.isFinite(value) || value < 0) {
+    return fallbackBytes;
+  }
+
+  const unit = String(match[2] || "").toUpperCase();
+  const unitPow = {
+    "": 0,
+    K: 1,
+    M: 2,
+    G: 3,
+    T: 4,
+  }[unit];
+
+  if (unitPow == null) {
+    return fallbackBytes;
+  }
+
+  return value * (1024 ** unitPow);
+}
+
+function parseDailyAt(text, fallback = { hour: 3, minute: 0 }) {
+  const raw = String(text || "").trim();
+  const match = raw.match(/^(\d{1,2}):(\d{2})$/);
+  if (!match) {
+    return fallback;
+  }
+
+  const hour = Number.parseInt(match[1], 10);
+  const minute = Number.parseInt(match[2], 10);
+
+  if (hour < 0 || hour > 23 || minute < 0 || minute > 59) {
+    return fallback;
+  }
+
+  return { hour, minute };
+}
+
+async function statIfFile(filePath) {
+  try {
+    const stats = await fs.promises.stat(filePath);
+    return stats.isFile() ? stats : null;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+
+async function getDiskFreeBytes(targetDir) {
+  if (typeof fs.promises.statfs !== "function") {
+    return Number.POSITIVE_INFINITY;
+  }
+
+  const info = await fs.promises.statfs(targetDir);
+  return Number(info.bavail || 0) * Number(info.bsize || 0);
+}
+
+async function walkFiles(dirPath, onFile) {
+  const entries = await fs.promises.readdir(dirPath, { withFileTypes: true });
+
+  for (const entry of entries) {
+    const fullPath = path.join(dirPath, entry.name);
+
+    if (entry.isDirectory()) {
+      await walkFiles(fullPath, onFile);
+      continue;
+    }
+
+    if (!entry.isFile()) {
+      continue;
+    }
+
+    await onFile(fullPath);
+  }
+}
+
+async function getDirSizeBytes(dirPath) {
+  let total = 0;
+
+  try {
+    await walkFiles(dirPath, async (filePath) => {
+      const stats = await statIfFile(filePath);
+      if (stats) {
+        total += stats.size;
+      }
+    });
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+
+  return total;
+}
+
+function formatBytes(bytes) {
+  const value = Number(bytes || 0);
+  if (!Number.isFinite(value) || value < 0) {
+    return "0B";
+  }
+
+  if (value >= 1024 ** 4) {
+    return `${(value / (1024 ** 4)).toFixed(2)}TB`;
+  }
+  if (value >= 1024 ** 3) {
+    return `${(value / (1024 ** 3)).toFixed(2)}GB`;
+  }
+  if (value >= 1024 ** 2) {
+    return `${(value / (1024 ** 2)).toFixed(2)}MB`;
+  }
+  if (value >= 1024) {
+    return `${(value / 1024).toFixed(2)}KB`;
+  }
+
+  return `${Math.floor(value)}B`;
+}
+
+export class CacheCleanupManager {
+  constructor(config) {
+    this.config = config;
+    this.enabled = toBool(config.cacheCleanupEnabled, true);
+    this.touchOnHit = toBool(config.cacheTouchOnHit, true);
+    this.touchMinIntervalMs = Math.max(0, parseDurationToMs(config.cacheTouchMinInterval, DAY_MS));
+    this.retentionStartDays = Math.max(1, Math.floor(parseDurationToMs(config.cacheRetentionStart, 10 * DAY_MS) / DAY_MS));
+    this.retentionMinDays = Math.max(1, Math.floor(parseDurationToMs(config.cacheRetentionMin, DAY_MS) / DAY_MS));
+    this.diskFreeTriggerBytes = Math.max(0, parseSizeToBytes(config.cacheDiskFreeTrigger, 20 * 1024 ** 3));
+    this.diskFreeTargetBytes = Math.max(
+      this.diskFreeTriggerBytes,
+      parseSizeToBytes(config.cacheDiskFreeTarget, 25 * 1024 ** 3),
+    );
+    this.cacheMaxSizeBytes = Math.max(0, parseSizeToBytes(config.cacheMaxSize, 0));
+    this.cacheTargetSizeBytes = Math.max(
+      0,
+      parseSizeToBytes(config.cacheTargetSize, this.cacheMaxSizeBytes || 0),
+    );
+    this.checkMinIntervalMs = Math.max(MINUTE_MS, parseDurationToMs(config.cacheCleanupCheckMinInterval, 10 * MINUTE_MS));
+    this.dailyAt = parseDailyAt(config.cacheCleanupDailyAt, { hour: 3, minute: 0 });
+
+    this.lastTouchAt = new Map();
+    this.lastPressureCheckAt = 0;
+    this.cleanupRunning = false;
+    this.dailyTimer = null;
+  }
+
+  async init() {
+    if (!this.enabled) {
+      return;
+    }
+
+    this.#scheduleDailyCheck();
+  }
+
+  async destroy() {
+    if (this.dailyTimer) {
+      clearTimeout(this.dailyTimer);
+      this.dailyTimer = null;
+    }
+  }
+
+  touchFileOnHit(filePath) {
+    if (!this.enabled || !this.touchOnHit || !filePath) {
+      return;
+    }
+
+    const now = Date.now();
+    const last = this.lastTouchAt.get(filePath) || 0;
+    if (now - last < this.touchMinIntervalMs) {
+      return;
+    }
+
+    this.lastTouchAt.set(filePath, now);
+
+    fs.promises.utimes(filePath, new Date(now), new Date(now)).catch((error) => {
+      if (error.code !== "ENOENT") {
+        console.warn(`[cache-cleanup] touch failed path=${filePath} message=${error.message}`);
+      }
+    });
+  }
+
+  async checkAndCleanupIfNeeded(reason = "manual", force = false) {
+    if (!this.enabled) {
+      return { triggered: false, reason: "disabled" };
+    }
+
+    const now = Date.now();
+    if (!force && now - this.lastPressureCheckAt < this.checkMinIntervalMs) {
+      return { triggered: false, reason: "throttled" };
+    }
+    this.lastPressureCheckAt = now;
+
+    const metrics = await this.#collectMetrics();
+    const overLimit = this.#isOverLimit(metrics);
+
+    if (!overLimit) {
+      return {
+        triggered: false,
+        reason: "below-limit",
+        metrics,
+      };
+    }
+
+    return this.#runCleanup(reason, metrics);
+  }
+
+  async #runCleanup(reason, beforeMetrics) {
+    if (this.cleanupRunning) {
+      return { triggered: false, reason: "already-running" };
+    }
+
+    this.cleanupRunning = true;
+
+    try {
+      console.warn(
+        `[cache-cleanup] start reason=${reason} free=${formatBytes(beforeMetrics.diskFreeBytes)} cache=${formatBytes(beforeMetrics.cacheSizeBytes)}`,
+      );
+
+      const rounds = [];
+      const startDay = Math.max(this.retentionStartDays, this.retentionMinDays);
+      const endDay = this.retentionMinDays;
+
+      for (let day = startDay; day >= endDay; day -= 1) {
+        const cutoffMs = Date.now() - (day * DAY_MS);
+        const result = await this.#deleteOlderThan(cutoffMs);
+        const metrics = await this.#collectMetrics();
+
+        rounds.push({
+          day,
+          deletedFiles: result.deletedFiles,
+          releasedBytes: result.releasedBytes,
+          diskFreeBytes: metrics.diskFreeBytes,
+          cacheSizeBytes: metrics.cacheSizeBytes,
+        });
+
+        console.warn(
+          `[cache-cleanup] round day=${day} deleted=${result.deletedFiles} released=${formatBytes(result.releasedBytes)} free=${formatBytes(metrics.diskFreeBytes)} cache=${formatBytes(metrics.cacheSizeBytes)}`,
+        );
+
+        if (this.#meetsTarget(metrics)) {
+          console.warn(`[cache-cleanup] success reason=${reason} stop-day=${day}`);
+          return {
+            triggered: true,
+            success: true,
+            stopDay: day,
+            before: beforeMetrics,
+            after: metrics,
+            rounds,
+          };
+        }
+      }
+
+      const afterMetrics = await this.#collectMetrics();
+      console.error(
+        `[cache-cleanup] warn cannot meet target at min-day=${this.retentionMinDays} free=${formatBytes(afterMetrics.diskFreeBytes)} cache=${formatBytes(afterMetrics.cacheSizeBytes)}`,
+      );
+
+      return {
+        triggered: true,
+        success: false,
+        stopDay: this.retentionMinDays,
+        before: beforeMetrics,
+        after: afterMetrics,
+        rounds,
+      };
+    } finally {
+      this.cleanupRunning = false;
+    }
+  }
+
+  async #deleteOlderThan(cutoffMs) {
+    let deletedFiles = 0;
+    let releasedBytes = 0;
+
+    try {
+      await walkFiles(this.config.cacheDir, async (filePath) => {
+        const stats = await statIfFile(filePath);
+        if (!stats) {
+          return;
+        }
+
+        if (stats.mtimeMs >= cutoffMs) {
+          return;
+        }
+
+        try {
+          await fs.promises.unlink(filePath);
+          deletedFiles += 1;
+          releasedBytes += stats.size;
+          this.lastTouchAt.delete(filePath);
+        } catch (error) {
+          if (error.code !== "ENOENT") {
+            console.warn(`[cache-cleanup] delete failed path=${filePath} message=${error.message}`);
+          }
+        }
+      });
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+
+    return { deletedFiles, releasedBytes };
+  }
+
+  async #collectMetrics() {
+    const [diskFreeBytes, cacheSizeBytes] = await Promise.all([
+      getDiskFreeBytes(this.config.cacheDir),
+      getDirSizeBytes(this.config.cacheDir),
+    ]);
+
+    return { diskFreeBytes, cacheSizeBytes };
+  }
+
+  #isOverLimit(metrics) {
+    const diskLow = this.diskFreeTriggerBytes > 0 && metrics.diskFreeBytes <= this.diskFreeTriggerBytes;
+    const cacheOver = this.cacheMaxSizeBytes > 0 && metrics.cacheSizeBytes >= this.cacheMaxSizeBytes;
+    return diskLow || cacheOver;
+  }
+
+  #meetsTarget(metrics) {
+    const diskOk =
+      this.diskFreeTriggerBytes <= 0 ||
+      metrics.diskFreeBytes >= this.diskFreeTargetBytes;
+
+    const cacheTarget = this.cacheTargetSizeBytes > 0 ? this.cacheTargetSizeBytes : this.cacheMaxSizeBytes;
+    const cacheOk =
+      this.cacheMaxSizeBytes <= 0 ||
+      (cacheTarget > 0 && metrics.cacheSizeBytes <= cacheTarget);
+
+    return diskOk && cacheOk;
+  }
+
+  #scheduleDailyCheck() {
+    const now = new Date();
+    const next = new Date(now);
+    next.setHours(this.dailyAt.hour, this.dailyAt.minute, 0, 0);
+
+    if (next.getTime() <= now.getTime()) {
+      next.setDate(next.getDate() + 1);
+    }
+
+    const delay = Math.max(1000, next.getTime() - now.getTime());
+
+    this.dailyTimer = setTimeout(() => {
+      this.checkAndCleanupIfNeeded("daily-check", true)
+        .catch((error) => {
+          console.error(`[cache-cleanup] daily check failed: ${error.message}`);
+        })
+        .finally(() => {
+          this.#scheduleDailyCheck();
+        });
+    }, delay);
+
+    if (typeof this.dailyTimer.unref === "function") {
+      this.dailyTimer.unref();
+    }
+  }
+}

package/src/cache/maven-affinity-index.js

@@ -75,6 +75,8 @@ export class MavenAffinityIndex {
     this.snapshotPath = path.join(this.indexDir, "maven-affinity.snapshot.json");
     this.eventLogPath = path.join(this.indexDir, "maven-affinity.events.log");
 
+    // Positive entries are persistent and have no TTL. They are removed only
+    // when the cache file disappears or a conflict is detected.
     this.positive = new Map();
     this.negative = new Map();
     this.conflicts = new Map();
@@ -269,7 +271,7 @@ export class MavenAffinityIndex {
     return true;
   }
 
-  recordSuccess({ canonicalKey, host, cachePath, fileName }) {
+  recordSuccess({ canonicalKey, host, cachePath, fileName, urlObj = null }) {
     if (!this.enabled || !canonicalKey || !cachePath || !fileName) {
       return;
     }
@@ -309,8 +311,9 @@ export class MavenAffinityIndex {
       },
     });
 
-    if (host) {
-      const negativeKey = buildNegativeKey(host, canonicalKey);
+    const successScope = buildNegativeScope(urlObj);
+    if (successScope) {
+      const negativeKey = buildNegativeKey(successScope, canonicalKey);
       if (this.negative.has(negativeKey)) {
         this.#applyEvent({
           type: "negative_remove",

package/src/config/config.js

@@ -99,6 +99,38 @@ function toInt(value, defaultValue) {
   return Number.isFinite(parsed) ? parsed : defaultValue;
 }
 
+function parseDurationToMs(value, fallbackMs) {
+  const text = String(value || "").trim();
+  if (!text) {
+    return fallbackMs;
+  }
+
+  const match = text.match(/^(\d+)([smhd])$/i);
+  if (!match) {
+    return fallbackMs;
+  }
+
+  const amount = Number.parseInt(match[1], 10);
+  const unit = String(match[2] || "").toLowerCase();
+  if (!Number.isFinite(amount) || amount < 0) {
+    return fallbackMs;
+  }
+
+  if (unit === "s") {
+    return amount * 1000;
+  }
+
+  if (unit === "m") {
+    return amount * 60 * 1000;
+  }
+
+  if (unit === "h") {
+    return amount * 60 * 60 * 1000;
+  }
+
+  return amount * 24 * 60 * 60 * 1000;
+}
+
 function toList(value, defaultValue = []) {
   if (!value) {
     return defaultValue;
@@ -181,10 +213,17 @@ const defaultMavenRepoDomains = [
 const cacheDir = path.resolve(configBaseDir, process.env.CACHE_DIR || "data/cache");
 
 const multiThreadMinSizeBytes = Math.max(0, toInt(process.env.MULTI_THREAD_MIN_SIZE_MB, 1)) * 1024 * 1024;
-const downloadTimeoutMs = Math.max(1, toInt(process.env.DOWNLOAD_TIMEOUT_SECONDS, 60)) * 1000;
-const outboundKeepAliveMsecs = Math.max(1, toInt(process.env.OUTBOUND_KEEP_ALIVE_SECONDS, 1)) * 1000;
-const mavenNegativeCacheTtlMs = Math.max(1, toInt(process.env.MAVEN_NEGATIVE_CACHE_TTL_HOURS, 24)) * 60 * 60 * 1000;
-const mavenAffinityFlushIntervalMs = Math.max(1, toInt(process.env.MAVEN_AFFINITY_FLUSH_INTERVAL_SECONDS, 5)) * 1000;
+const downloadTimeout = process.env.DOWNLOAD_TIMEOUT || "60s";
+const outboundKeepAliveInterval = process.env.OUTBOUND_KEEP_ALIVE_INTERVAL || "1s";
+const mavenNegativeCacheTtl = process.env.MAVEN_NEGATIVE_CACHE_TTL || "24h";
+const mavenAffinityFlushInterval = process.env.MAVEN_AFFINITY_FLUSH_INTERVAL || "5s";
+const logRetention = process.env.LOG_RETENTION || "7d";
+
+const downloadTimeoutMs = Math.max(1, parseDurationToMs(downloadTimeout, 60 * 1000));
+const outboundKeepAliveMsecs = Math.max(1, parseDurationToMs(outboundKeepAliveInterval, 1000));
+const mavenNegativeCacheTtlMs = Math.max(1, parseDurationToMs(mavenNegativeCacheTtl, 24 * 60 * 60 * 1000));
+const mavenAffinityFlushIntervalMs = Math.max(1, parseDurationToMs(mavenAffinityFlushInterval, 5 * 1000));
+const logRetentionDays = Math.max(1, Math.ceil(parseDurationToMs(logRetention, 7 * 24 * 60 * 60 * 1000) / (24 * 60 * 60 * 1000)));
 const mavenAffinityEventMaxBytes = Math.max(1, toInt(process.env.MAVEN_AFFINITY_EVENT_MAX_MB, 8)) * 1024 * 1024;
 
 export const config = {
@@ -205,19 +244,36 @@ export const config = {
   multiThreadDomains: toList(process.env.MULTI_THREAD_DOMAINS, ["repo1.maven.org"]),
   multiThreadCount: Math.max(1, toInt(process.env.MULTI_THREAD_COUNT, 4)),
   multiThreadMinSizeBytes,
+  downloadTimeout,
   downloadTimeoutMs,
   outboundKeepAlive: toBool(process.env.OUTBOUND_KEEP_ALIVE, true),
+  outboundKeepAliveInterval,
   outboundKeepAliveMsecs,
   outboundMaxSockets: Math.max(1, toInt(process.env.OUTBOUND_MAX_SOCKETS, 64)),
   outboundMaxFreeSockets: Math.max(1, toInt(process.env.OUTBOUND_MAX_FREE_SOCKETS, 16)),
   mavenAffinityEnabled: toBool(process.env.MAVEN_AFFINITY_ENABLED, true),
-  mavenAffinityIndexDir: path.resolve(cacheDir, process.env.MAVEN_AFFINITY_INDEX_DIR || ".index"),
+  mavenAffinityIndexDir: path.resolve(configBaseDir, process.env.MAVEN_AFFINITY_INDEX_DIR || "data/index"),
+  mavenNegativeCacheTtl,
   mavenNegativeCacheTtlMs,
+  mavenAffinityFlushInterval,
   mavenAffinityFlushIntervalMs,
   mavenAffinityEventMaxBytes,
+  cacheCleanupEnabled: toBool(process.env.CACHE_CLEANUP_ENABLED, true),
+  cacheCleanupDailyAt: process.env.CACHE_CLEANUP_DAILY_AT || "03:00",
+  cacheCleanupCheckMinInterval: process.env.CACHE_CLEANUP_CHECK_MIN_INTERVAL || "10m",
+  cacheTouchOnHit: toBool(process.env.CACHE_TOUCH_ON_HIT, true),
+  cacheTouchMinInterval: process.env.CACHE_TOUCH_MIN_INTERVAL || "1d",
+  cacheRetentionStart: process.env.CACHE_RETENTION_START || "10d",
+  cacheRetentionMin: process.env.CACHE_RETENTION_MIN || "1d",
+  cacheDiskFreeTrigger: process.env.CACHE_DISK_FREE_TRIGGER || "20G",
+  cacheDiskFreeTarget: process.env.CACHE_DISK_FREE_TARGET || "25G",
+  cacheMaxSize: process.env.CACHE_MAX_SIZE || "",
+  cacheTargetSize: process.env.CACHE_TARGET_SIZE || "",
   downloadLogDir: path.resolve(configBaseDir, process.env.DOWNLOAD_LOG_DIR || "data/logs/downloads"),
-  logRetentionDays: Math.max(1, toInt(process.env.LOG_RETENTION_DAYS, 7)),
+  logRetention,
+  logRetentionDays,
   logToStdout: toBool(process.env.LOG_TO_STDOUT, true),
+  logConnectEvents: toBool(process.env.LOG_CONNECT_EVENTS, false),
   certDir: path.resolve(configBaseDir, process.env.CERT_DIR || "data/certs"),
   rootCertPath: path.resolve(configBaseDir, process.env.ROOT_CERT_PATH || "data/certs/root-ca.crt"),
   rootKeyPath: path.resolve(configBaseDir, process.env.ROOT_KEY_PATH || "data/certs/root-ca.key.pem"),
@@ -230,7 +286,7 @@ export const config = {
   javaHome: javaHomeResolution.javaHome,
   javaHomeSource: javaHomeResolution.source,
   javaHomeConfigured: javaHomeResolution.configuredJavaHome || "",
-  httpsPassthroughForUnmatched: toBool(process.env.HTTPS_PASSTHROUGH_FOR_UNMATCHED, true),
+  httpsPassthroughForUnmatched: toBool(process.env.HTTPS_PASSTHROUGH_FOR_UNMATCHED, false),
   upstreamProxyUrl: normalizeProxyUrl(process.env.UPSTREAM_PROXY_URL || process.env.ALL_PROXY || process.env.all_proxy || ""),
   upstreamHttpProxyUrl: normalizeProxyUrl(process.env.UPSTREAM_HTTP_PROXY_URL || process.env.HTTP_PROXY || process.env.http_proxy || ""),
   upstreamHttpsProxyUrl: normalizeProxyUrl(process.env.UPSTREAM_HTTPS_PROXY_URL || process.env.HTTPS_PROXY || process.env.https_proxy || ""),

package/src/index.js

@@ -8,6 +8,7 @@ import { startRepoServer } from "./repo/repo-server.js";
 import { getTrustStoreCommands } from "./cert/truststore-utils.js";
 import { UpstreamProxyManager } from "./proxy/upstream-proxy.js";
 import { MavenAffinityIndex } from "./cache/maven-affinity-index.js";
+import { CacheCleanupManager } from "./cache/cache-cleanup-manager.js";
 import { installConsoleLogFileMirror, installGlobalErrorLogging } from "./common/console-log-file.js";
 
 installConsoleLogFileMirror({
@@ -17,6 +18,53 @@ installConsoleLogFileMirror({
 });
 installGlobalErrorLogging();
 
+function startupInfo(message) {
+  if (!config.logToStdout) {
+    process.stdout.write(`${message}\n`);
+  }
+  console.log(message);
+}
+
+function startupError(message, error = null) {
+  if (!config.logToStdout) {
+    process.stderr.write(`${message}\n`);
+    if (error) {
+      process.stderr.write(`${error?.stack || error?.message || String(error)}\n`);
+    }
+  }
+  if (error) {
+    console.error(message, error);
+  } else {
+    console.error(message);
+  }
+}
+
+async function waitForServerListening(server, name) {
+  if (server?.listening) {
+    return;
+  }
+
+  await new Promise((resolve, reject) => {
+    const onListening = () => {
+      cleanup();
+      resolve();
+    };
+
+    const onError = (error) => {
+      cleanup();
+      reject(new Error(`${name} listen failed: ${error.message}`));
+    };
+
+    const cleanup = () => {
+      server.off("listening", onListening);
+      server.off("error", onError);
+    };
+
+    server.once("listening", onListening);
+    server.once("error", onError);
+  });
+}
+
 async function main() {
   await fs.promises.mkdir(config.cacheDir, { recursive: true });
   await fs.promises.mkdir(config.mavenCacheDir, { recursive: true });
@@ -38,6 +86,8 @@ async function main() {
   const upstreamProxyManager = new UpstreamProxyManager(config, matchesDomain);
   const mavenAffinityIndex = new MavenAffinityIndex(config);
   await mavenAffinityIndex.init();
+  const cacheCleanupManager = new CacheCleanupManager(config);
+  await cacheCleanupManager.init();
 
   const downloader = new Downloader(config, matchesDomain, upstreamProxyManager);
 
@@ -48,55 +98,75 @@ async function main() {
     matchesDomain,
     upstreamProxyManager,
     mavenAffinityIndex,
+    cacheCleanupManager,
   );
-  const repoServer = startRepoServer(config, downloader);
+  const repoServer = startRepoServer(config, downloader, cacheCleanupManager);
+
+  await Promise.all([
+    waitForServerListening(proxyServer, "proxy server"),
+    waitForServerListening(repoServer, "repo server"),
+  ]);
 
   const trustCommands = getTrustStoreCommands(config);
 
-  console.log("[maven-proxy] started");
-  console.log(`[maven-proxy] config mode: ${config.configMode}`);
-  console.log(`[maven-proxy] config file: ${config.loadedConfigFile || "(none)"}`);
-  console.log(`[maven-proxy] config base: ${config.configBaseDir}`);
+  startupInfo("[maven-proxy] started");
+  startupInfo(`[maven-proxy] config mode: ${config.configMode}`);
+  startupInfo(`[maven-proxy] config file: ${config.loadedConfigFile || "(none)"}`);
+  startupInfo(`[maven-proxy] config base: ${config.configBaseDir}`);
   if (config.configMode === "user") {
-    console.log(`[maven-proxy] default user config: ${config.defaultUserConfigPath}`);
+    startupInfo(`[maven-proxy] default user config: ${config.defaultUserConfigPath}`);
   }
-  console.log(`[maven-proxy] proxy port: ${config.proxyPort}`);
-  console.log(`[maven-proxy] repo  port: ${config.repoPort}`);
-  console.log(`[maven-proxy] cache dir : ${config.cacheDir}`);
-  console.log(`[maven-proxy] cache maven: ${config.mavenCacheDir}`);
-  console.log(`[maven-proxy] cache npm  : ${config.npmCacheDir}`);
-  console.log(`[maven-proxy] cache other: ${config.genericCacheDir}`);
-  console.log(`[maven-proxy] log dir: ${config.downloadLogDir}`);
-  console.log(`[maven-proxy] log retention days: ${config.logRetentionDays}`);
-  console.log(`[maven-proxy] log to stdout: ${config.logToStdout}`);
-  console.log(`[maven-proxy] outbound keep-alive: ${config.outboundKeepAlive}`);
-  console.log(`[maven-proxy] outbound keepAlive(seconds): ${config.outboundKeepAliveMsecs / 1000}`);
-  console.log(`[maven-proxy] outbound maxSockets: ${config.outboundMaxSockets}`);
-  console.log(`[maven-proxy] outbound maxFreeSockets: ${config.outboundMaxFreeSockets}`);
-  console.log(`[maven-proxy] maven affinity enabled: ${config.mavenAffinityEnabled}`);
-  console.log(`[maven-proxy] maven affinity index dir: ${config.mavenAffinityIndexDir}`);
-  console.log(`[maven-proxy] maven negative cache ttl(hours): ${config.mavenNegativeCacheTtlMs / (60 * 60 * 1000)}`);
-  console.log(`[maven-proxy] maven affinity flush interval(seconds): ${config.mavenAffinityFlushIntervalMs / 1000}`);
-  console.log(`[maven-proxy] maven affinity event max(MB): ${config.mavenAffinityEventMaxBytes / (1024 * 1024)}`);
-  console.log(`[maven-proxy] root cert : ${config.rootCertPath}`);
-  console.log(`[maven-proxy] repo fallback repos: ${(config.repoFallbackRepos || []).join(",") || "(none)"}`);
+  startupInfo(`[maven-proxy] proxy port: ${config.proxyPort}`);
+  startupInfo(`[maven-proxy] repo  port: ${config.repoPort}`);
+  startupInfo(`[maven-proxy] cache dir : ${config.cacheDir}`);
+  startupInfo(`[maven-proxy] cache maven: ${config.mavenCacheDir}`);
+  startupInfo(`[maven-proxy] cache npm  : ${config.npmCacheDir}`);
+  startupInfo(`[maven-proxy] cache other: ${config.genericCacheDir}`);
+  startupInfo(`[maven-proxy] log dir: ${config.downloadLogDir}`);
+  startupInfo(`[maven-proxy] log retention: ${config.logRetention} (${config.logRetentionDays}d)`);
+  startupInfo(`[maven-proxy] log to stdout: ${config.logToStdout}`);
+  startupInfo(`[maven-proxy] log connect events: ${config.logConnectEvents}`);
+  startupInfo(`[maven-proxy] outbound keep-alive: ${config.outboundKeepAlive}`);
+  startupInfo(`[maven-proxy] outbound keepAlive interval: ${config.outboundKeepAliveInterval}`);
+  startupInfo(`[maven-proxy] outbound maxSockets: ${config.outboundMaxSockets}`);
+  startupInfo(`[maven-proxy] outbound maxFreeSockets: ${config.outboundMaxFreeSockets}`);
+  startupInfo(`[maven-proxy] maven affinity enabled: ${config.mavenAffinityEnabled}`);
+  startupInfo(`[maven-proxy] maven affinity index dir: ${config.mavenAffinityIndexDir}`);
+  startupInfo(`[maven-proxy] maven negative cache ttl: ${config.mavenNegativeCacheTtl}`);
+  startupInfo(`[maven-proxy] maven affinity flush interval: ${config.mavenAffinityFlushInterval}`);
+  startupInfo(`[maven-proxy] download timeout: ${config.downloadTimeout}`);
+  startupInfo(`[maven-proxy] maven affinity event max(MB): ${config.mavenAffinityEventMaxBytes / (1024 * 1024)}`);
+  startupInfo(`[maven-proxy] cache cleanup enabled: ${config.cacheCleanupEnabled}`);
+  startupInfo(`[maven-proxy] cache cleanup daily at: ${config.cacheCleanupDailyAt}`);
+  startupInfo(`[maven-proxy] cache touch on hit: ${config.cacheTouchOnHit}`);
+  startupInfo(`[maven-proxy] cache touch min interval: ${config.cacheTouchMinInterval}`);
+  startupInfo(`[maven-proxy] cache retention start: ${config.cacheRetentionStart}`);
+  startupInfo(`[maven-proxy] cache retention min: ${config.cacheRetentionMin}`);
+  startupInfo(`[maven-proxy] cache disk free trigger: ${config.cacheDiskFreeTrigger}`);
+  startupInfo(`[maven-proxy] cache disk free target: ${config.cacheDiskFreeTarget}`);
+  startupInfo(`[maven-proxy] cache max size: ${config.cacheMaxSize || "(disabled)"}`);
+  startupInfo(`[maven-proxy] cache target size: ${config.cacheTargetSize || "(disabled)"}`);
+  startupInfo(`[maven-proxy] root cert : ${config.rootCertPath}`);
+  startupInfo(`[maven-proxy] repo fallback repos: ${(config.repoFallbackRepos || []).join(",") || "(none)"}`);
   if (config.upstreamProxyUrl || config.upstreamHttpProxyUrl || config.upstreamHttpsProxyUrl) {
-    console.log(`[maven-proxy] upstream proxy (generic): ${config.upstreamProxyUrl || "(none)"}`);
-    console.log(`[maven-proxy] upstream proxy (http)   : ${config.upstreamHttpProxyUrl || "(none)"}`);
-    console.log(`[maven-proxy] upstream proxy (https)  : ${config.upstreamHttpsProxyUrl || "(none)"}`);
-    console.log(`[maven-proxy] upstream no-proxy       : ${(config.upstreamNoProxyDomains || []).join(",") || "(none)"}`);
-    console.log(`[maven-proxy] upstream ignore-domains : ${(config.upstreamIgnoreDomains || []).join(",") || "(none)"}`);
+    startupInfo(`[maven-proxy] upstream proxy (generic): ${config.upstreamProxyUrl || "(none)"}`);
+    startupInfo(`[maven-proxy] upstream proxy (http)   : ${config.upstreamHttpProxyUrl || "(none)"}`);
+    startupInfo(`[maven-proxy] upstream proxy (https)  : ${config.upstreamHttpsProxyUrl || "(none)"}`);
+    startupInfo(`[maven-proxy] upstream no-proxy       : ${(config.upstreamNoProxyDomains || []).join(",") || "(none)"}`);
+    startupInfo(`[maven-proxy] upstream ignore-domains : ${(config.upstreamIgnoreDomains || []).join(",") || "(none)"}`);
   }
-  console.log("[maven-proxy] trust store command (copy):");
-  console.log(trustCommands.copyCmd);
-  console.log("[maven-proxy] trust store command (import):");
-  console.log(trustCommands.importCmd);
+  startupInfo("[maven-proxy] trust store command (copy):");
+  startupInfo(trustCommands.copyCmd);
+  startupInfo("[maven-proxy] trust store command (import):");
+  startupInfo(trustCommands.importCmd);
+  startupInfo(`[maven-proxy] startup success: proxy=127.0.0.1:${config.proxyPort}, repo=127.0.0.1:${config.repoPort}`);
 
   const shutdown = () => {
     proxyServer.close();
     mitmHttpServer.close();
     repoServer.close();
     upstreamProxyManager.destroy();
+    void cacheCleanupManager.destroy();
     void mavenAffinityIndex.destroy();
   };
 
@@ -105,6 +175,6 @@ async function main() {
 }
 
 main().catch((error) => {
-  console.error("[maven-proxy] fatal error:", error);
+  startupError("[maven-proxy] fatal error:", error);
   process.exit(1);
 });

package/src/proxy/proxy-connect-handler.js

@@ -20,7 +20,9 @@ async function openConnectUpstreamSocket(targetHost, targetPort, timeoutMs, upst
     upstreamProxyManager.hasProxyFor("https:", targetHost);
 
   if (useUpstreamProxy) {
-    console.log(`[proxy] CONNECT via upstream target=${targetHost}:${targetPort}`);
+    if (upstreamProxyManager?.config?.logConnectEvents) {
+      console.log(`[proxy] CONNECT via upstream target=${targetHost}:${targetPort}`);
+    }
     const tunnel = await upstreamProxyManager.createConnectTunnel(targetHost, targetPort, timeoutMs);
     return {
       upstreamSocket: tunnel.socket,
@@ -81,9 +83,13 @@ async function handlePassThroughConnect(clientSocket, head, targetHost, targetPo
 }
 
 async function handleMitmConnect(clientSocket, head, targetHost, certManager, mitmHttpServer) {
-  console.log(`[proxy] MITM prepare ${targetHost}`);
+  if (certManager?.config?.logConnectEvents) {
+    console.log(`[proxy] MITM prepare ${targetHost}`);
+  }
   const leaf = await certManager.getOrCreateLeaf(targetHost);
-  console.log(`[proxy] MITM cert ready ${targetHost}`);
+  if (certManager?.config?.logConnectEvents) {
+    console.log(`[proxy] MITM cert ready ${targetHost}`);
+  }
 
   await new Promise((resolve, reject) => {
     writeTunnelResponse(clientSocket, "HTTP/1.1 200 Connection Established", (error) => {
@@ -94,7 +100,9 @@ async function handleMitmConnect(clientSocket, head, targetHost, certManager, mi
       resolve();
     });
   });
-  console.log(`[proxy] MITM tunnel established ${targetHost}`);
+  if (certManager?.config?.logConnectEvents) {
+    console.log(`[proxy] MITM tunnel established ${targetHost}`);
+  }
 
   const tlsSocket = new tls.TLSSocket(clientSocket, {
     isServer: true,
@@ -138,7 +146,9 @@ export function attachConnectHandler(server, {
       config.enableHttpsProxy &&
       matchesDomain(host, config.httpsMitmDomains);
 
-    console.log(`[proxy] CONNECT ${host}:${port} mitm=${mitmEnabled}`);
+    if (config.logConnectEvents) {
+      console.log(`[proxy] CONNECT ${host}:${port} mitm=${mitmEnabled}`);
+    }
 
     if (!mitmEnabled) {
       if (!config.httpsPassthroughForUnmatched) {

package/src/proxy/proxy-http-handler.js

@@ -80,6 +80,12 @@ function sendErrorText(res, statusCode, message, context = "proxy") {
   sendText(res, statusCode, message);
 }
 
+export function isPositiveAffinityEligible(fileName) {
+  const lower = String(fileName || "").toLowerCase();
+  const base = lower.replace(/\.(sha1|sha256|sha512|md5|asc)$/i, "");
+  return /\.(jar|aar|war)$/i.test(base);
+}
+
 function buildUrl(req, forcedProtocol = null) {
   const raw = req.url || "/";
   if (/^https?:\/\//i.test(raw)) {
@@ -95,13 +101,17 @@ function buildUrl(req, forcedProtocol = null) {
   return new URL(`${protocol}//${host}${raw}`);
 }
 
-async function serveFile(res, req, filePath) {
+async function serveFile(res, req, filePath, cacheCleanupManager = null) {
   const stats = await statIfFile(filePath);
   if (!stats) {
     sendText(res, 404, "Not Found");
     return;
   }
 
+  if (cacheCleanupManager) {
+    cacheCleanupManager.touchFileOnHit(filePath);
+  }
+
   res.setHeader("content-length", String(stats.size));
   if (!res.hasHeader("x-cache")) {
     res.setHeader("x-cache", "HIT");
@@ -165,6 +175,7 @@ export function createHttpRequestHandler({
   upstreamProxyManager = null,
   matchesDomain,
   mavenAffinityIndex = null,
+  cacheCleanupManager = null,
 }) {
   return async function handleHttpRequestPath(req, res, forcedProtocol = null) {
     let urlObj;
@@ -203,16 +214,19 @@ export function createHttpRequestHandler({
 
     const existing = await statIfFile(cachePath);
     if (existing) {
-      await serveFile(res, req, cachePath);
+      console.log(`[proxy] local cache hit host=${urlObj.hostname} path=${urlObj.pathname}`);
+      await serveFile(res, req, cachePath, cacheCleanupManager);
       return;
     }
 
     if (canonical && mavenAffinityIndex) {
-      const preferredPath = await mavenAffinityIndex.resolvePreferredCachePath(canonical.canonicalKey);
-      if (preferredPath) {
-        console.log(`[proxy] affinity hit canonical=${canonical.canonicalKey} host=${urlObj.hostname}`);
-        await serveFile(res, req, preferredPath);
-        return;
+      if (isPositiveAffinityEligible(canonical.fileName)) {
+        const preferredPath = await mavenAffinityIndex.resolvePreferredCachePath(canonical.canonicalKey);
+        if (preferredPath) {
+          console.log(`[proxy] affinity hit canonical=${canonical.canonicalKey} host=${urlObj.hostname}`);
+          await serveFile(res, req, preferredPath, cacheCleanupManager);
+          return;
+        }
       }
 
       if (mavenAffinityIndex.shouldSkipRequest(canonical.canonicalKey, urlObj)) {
@@ -223,20 +237,25 @@ export function createHttpRequestHandler({
     }
 
     try {
+      console.log(`[proxy] local cache miss host=${urlObj.hostname} path=${urlObj.pathname}`);
+      if (cacheCleanupManager) {
+        await cacheCleanupManager.checkAndCleanupIfNeeded("cache-miss");
+      }
       await fs.promises.mkdir(path.dirname(cachePath), { recursive: true });
       await downloader.ensureCached(urlObj, cachePath, req.headers);
 
-      if (canonical && mavenAffinityIndex) {
+      if (canonical && mavenAffinityIndex && isPositiveAffinityEligible(canonical.fileName)) {
         mavenAffinityIndex.recordSuccess({
           canonicalKey: canonical.canonicalKey,
           host: urlObj.hostname,
           cachePath,
           fileName: canonical.fileName,
+          urlObj,
         });
       }
 
       res.setHeader("x-cache", "MISS");
-      await serveFile(res, req, cachePath);
+      await serveFile(res, req, cachePath, cacheCleanupManager);
     } catch (error) {
       if (
         canonical &&

package/src/proxy/proxy-server.js

@@ -19,6 +19,7 @@ export function startProxyServer(
   matchesDomain,
   upstreamProxyManager = null,
   mavenAffinityIndex = null,
+  cacheCleanupManager = null,
 ) {
   const handleHttpRequestPath = createHttpRequestHandler({
     config,
@@ -26,6 +27,7 @@ export function startProxyServer(
     upstreamProxyManager,
     matchesDomain,
     mavenAffinityIndex,
+    cacheCleanupManager,
   });
   const mitmHttpServer = createMitmHttpServer(handleHttpRequestPath);
 

package/src/repo/repo-server.js

@@ -41,7 +41,7 @@ function buildCandidateRelativePaths(relativePath) {
   return [...new Set(candidates.filter(Boolean))];
 }
 
-async function ensureFromRemoteRepos(config, downloader, filePath, relativePath) {
+async function ensureFromRemoteRepos(config, downloader, filePath, relativePath, cacheCleanupManager = null) {
   if (!downloader) {
     return null;
   }
@@ -60,6 +60,9 @@ async function ensureFromRemoteRepos(config, downloader, filePath, relativePath)
       const remoteUrl = buildRemoteUrl(repoBase, candidatePath);
 
       try {
+        if (cacheCleanupManager) {
+          await cacheCleanupManager.checkAndCleanupIfNeeded("repo-cache-miss");
+        }
         console.log(`[repo] cache miss, try remote ${remoteUrl.href}`);
         await downloader.ensureCached(remoteUrl, filePath, {});
         return await statIfExists(filePath);
@@ -79,7 +82,7 @@ async function ensureFromRemoteRepos(config, downloader, filePath, relativePath)
   return null;
 }
 
-export function startRepoServer(config, downloader = null) {
+export function startRepoServer(config, downloader = null, cacheCleanupManager = null) {
   const server = http.createServer(async (req, res) => {
     try {
       const urlObj = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
@@ -88,7 +91,7 @@ export function startRepoServer(config, downloader = null) {
       let stats = await statIfExists(filePath);
 
       if (!stats || !stats.isFile()) {
-        stats = await ensureFromRemoteRepos(config, downloader, filePath, relativePath);
+        stats = await ensureFromRemoteRepos(config, downloader, filePath, relativePath, cacheCleanupManager);
       }
 
       if (!stats || !stats.isFile()) {
@@ -100,6 +103,10 @@ export function startRepoServer(config, downloader = null) {
       res.setHeader("content-length", String(stats.size));
       res.setHeader("cache-control", "public, max-age=3600");
 
+      if (cacheCleanupManager) {
+        cacheCleanupManager.touchFileOnHit(filePath);
+      }
+
       if (req.method === "HEAD") {
         res.writeHead(200);
         res.end();