feat: implement hybrid cache architecture

config.schema.json

@@ -357,6 +357,26 @@
           }
         }
       }
+    },
+    "cache": {
+      "description": "Configuration for bare repository cache (hybrid cache system)",
+      "type": "object",
+      "properties": {
+        "maxSizeGB": {
+          "type": "number",
+          "description": "Maximum cache size in gigabytes (default 2GB)"
+        },
+        "maxRepositories": {
+          "type": "number",
+          "description": "Maximum number of repositories in cache (default 50)"
+        },
+        "cacheDir": {
+          "type": "string",
+          "description": "Directory path for bare repository cache (default ./.remote/cache)"
+        }
+      },
+      "required": ["maxSizeGB", "maxRepositories", "cacheDir"],
+      "additionalProperties": false
     }
   },
   "definitions": {

package.json

@@ -61,7 +61,6 @@
     "express-rate-limit": "^8.1.0",
     "express-session": "^1.18.2",
     "history": "5.3.0",
-    "isomorphic-git": "^1.34.0",
     "jsonwebtoken": "^9.0.2",
     "jwk-to-pem": "^2.0.7",
     "load-plugin": "^6.0.3",

proxy.config.json

@@ -178,5 +178,10 @@
         "loginRequired": true
       }
     ]
+  },
+  "cache": {
+    "maxSizeGB": 2,
+    "maxRepositories": 50,
+    "cacheDir": "./.remote/cache"
   }
 }

src/config/generated/config.ts

@@ -36,6 +36,10 @@ export interface GitProxyConfig {
    * List of repositories that are authorised to be pushed to through the proxy.
    */
   authorisedList?: AuthorisedRepo[];
+  /**
+   * Configuration for bare repository cache (hybrid cache system)
+   */
+  cache?: Cache;
   /**
    * Block commits based on rules defined over author/committer e-mail addresses, commit
    * message content and diff content
@@ -286,6 +290,24 @@ export interface AuthorisedRepo {
   [property: string]: any;
 }
 
+/**
+ * Configuration for bare repository cache (hybrid cache system)
+ */
+export interface Cache {
+  /**
+   * Directory path for bare repository cache (default ./.remote/cache)
+   */
+  cacheDir: string;
+  /**
+   * Maximum number of repositories in cache (default 50)
+   */
+  maxRepositories: number;
+  /**
+   * Maximum cache size in gigabytes (default 2GB)
+   */
+  maxSizeGB: number;
+}
+
 /**
  * Block commits based on rules defined over author/committer e-mail addresses, commit
  * message content and diff content
@@ -690,6 +712,7 @@ const typeMap: any = {
         typ: u(undefined, a(r('AuthenticationElement'))),
       },
       { json: 'authorisedList', js: 'authorisedList', typ: u(undefined, a(r('AuthorisedRepo'))) },
+      { json: 'cache', js: 'cache', typ: u(undefined, r('Cache')) },
       { json: 'commitConfig', js: 'commitConfig', typ: u(undefined, r('CommitConfig')) },
       { json: 'configurationSources', js: 'configurationSources', typ: u(undefined, 'any') },
       { json: 'contactEmail', js: 'contactEmail', typ: u(undefined, '') },
@@ -793,6 +816,14 @@ const typeMap: any = {
     ],
     'any',
   ),
+  Cache: o(
+    [
+      { json: 'cacheDir', js: 'cacheDir', typ: '' },
+      { json: 'maxRepositories', js: 'maxRepositories', typ: 3.14 },
+      { json: 'maxSizeGB', js: 'maxSizeGB', typ: 3.14 },
+    ],
+    false,
+  ),
   CommitConfig: o(
     [
       { json: 'author', js: 'author', typ: u(undefined, r('Author')) },

src/config/index.ts

@@ -103,6 +103,9 @@ function mergeConfigurations(
     commitConfig: { ...defaultConfig.commitConfig, ...userSettings.commitConfig },
     attestationConfig: { ...defaultConfig.attestationConfig, ...userSettings.attestationConfig },
     rateLimit: userSettings.rateLimit || defaultConfig.rateLimit,
+    cache: userSettings.cache
+      ? { ...defaultConfig.cache, ...userSettings.cache }
+      : defaultConfig.cache,
     tls: tlsConfig,
     tempPassword: { ...defaultConfig.tempPassword, ...userSettings.tempPassword },
     // Preserve legacy SSL fields
@@ -196,6 +199,7 @@ export const logConfiguration = () => {
   console.log(`data sink = ${JSON.stringify(getDatabase())}`);
   console.log(`authentication = ${JSON.stringify(getAuthMethods())}`);
   console.log(`rateLimit = ${JSON.stringify(getRateLimit())}`);
+  console.log(`cache = ${JSON.stringify(getCacheConfig())}`);
 };
 
 export const getAPIs = () => {
@@ -285,6 +289,17 @@ export const getRateLimit = () => {
   return config.rateLimit;
 };
 
+export const getCacheConfig = () => {
+  const config = loadFullConfiguration();
+  return (
+    config.cache || {
+      maxSizeGB: 2,
+      maxRepositories: 50,
+      cacheDir: './.remote/cache',
+    }
+  );
+};
+
 // Function to handle configuration updates
 const handleConfigUpdate = async (newConfig: Configuration) => {
   console.log('Configuration updated from external source');

src/proxy/processors/push-action/cache-manager.ts

@@ -0,0 +1,181 @@
+import fs from 'fs';
+import path from 'path';
+import { getCacheConfig } from '../../../config';
+
+export interface CacheStats {
+  totalRepositories: number;
+  totalSizeMB: number;
+  repositories: Array<{
+    name: string;
+    sizeMB: number;
+    lastAccessed: Date;
+  }>;
+}
+
+export class CacheManager {
+  private cacheDir: string;
+  private maxSizeGB: number;
+  private maxRepositories: number;
+
+  constructor(
+    cacheDir: string = './.remote/cache',
+    maxSizeGB: number = 2,
+    maxRepositories: number = 50,
+  ) {
+    this.cacheDir = cacheDir;
+    this.maxSizeGB = maxSizeGB;
+    this.maxRepositories = maxRepositories;
+  }
+
+  /**
+   * Update access time for repository (for LRU purposes)
+   */
+  touchRepository(repoName: string): void {
+    const repoPath = path.join(this.cacheDir, repoName);
+    if (fs.existsSync(repoPath)) {
+      const now = new Date();
+      fs.utimesSync(repoPath, now, now);
+    }
+  }
+
+  /**
+   * Get cache statistics
+   */
+  getCacheStats(): CacheStats {
+    if (!fs.existsSync(this.cacheDir)) {
+      return {
+        totalRepositories: 0,
+        totalSizeMB: 0,
+        repositories: [],
+      };
+    }
+
+    const repositories: Array<{ name: string; sizeMB: number; lastAccessed: Date }> = [];
+    let totalSizeMB = 0;
+
+    const entries = fs.readdirSync(this.cacheDir, { withFileTypes: true });
+
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        const repoPath = path.join(this.cacheDir, entry.name);
+        const sizeMB = this.getDirectorySize(repoPath);
+        const stats = fs.statSync(repoPath);
+
+        repositories.push({
+          name: entry.name,
+          sizeMB,
+          lastAccessed: stats.atime,
+        });
+
+        totalSizeMB += sizeMB;
+      }
+    }
+
+    // Sort by last accessed (newest first)
+    repositories.sort((a, b) => b.lastAccessed.getTime() - a.lastAccessed.getTime());
+
+    return {
+      totalRepositories: repositories.length,
+      totalSizeMB,
+      repositories,
+    };
+  }
+
+  /**
+   * Enforce cache limits using LRU eviction
+   */
+  enforceLimits(): { removedRepos: string[]; freedMB: number } {
+    const stats = this.getCacheStats();
+    const removedRepos: string[] = [];
+    let freedMB = 0;
+
+    // Sort repositories by last accessed (oldest first for removal)
+    const reposToEvaluate = [...stats.repositories].sort(
+      (a, b) => a.lastAccessed.getTime() - b.lastAccessed.getTime(),
+    );
+
+    // Check size limit
+    let currentSizeMB = stats.totalSizeMB;
+    const maxSizeMB = this.maxSizeGB * 1024;
+
+    for (const repo of reposToEvaluate) {
+      const shouldRemove =
+        currentSizeMB > maxSizeMB || // Over size limit
+        stats.totalRepositories - removedRepos.length > this.maxRepositories; // Over count limit
+
+      if (shouldRemove) {
+        this.removeRepository(repo.name);
+        removedRepos.push(repo.name);
+        freedMB += repo.sizeMB;
+        currentSizeMB -= repo.sizeMB;
+      } else {
+        break; // We've cleaned enough
+      }
+    }
+
+    return { removedRepos, freedMB };
+  }
+
+  /**
+   * Remove specific repository from cache
+   */
+  private removeRepository(repoName: string): void {
+    const repoPath = path.join(this.cacheDir, repoName);
+    if (fs.existsSync(repoPath)) {
+      fs.rmSync(repoPath, { recursive: true, force: true });
+    }
+  }
+
+  /**
+   * Calculate directory size in MB
+   */
+  private getDirectorySize(dirPath: string): number {
+    let totalBytes = 0;
+
+    const calculateSize = (currentPath: string) => {
+      const items = fs.readdirSync(currentPath, { withFileTypes: true });
+
+      for (const item of items) {
+        const itemPath = path.join(currentPath, item.name);
+
+        if (item.isDirectory()) {
+          calculateSize(itemPath);
+        } else {
+          try {
+            const stats = fs.statSync(itemPath);
+            totalBytes += stats.size;
+          } catch (error) {
+            // Skip files that can't be read
+          }
+        }
+      }
+    };
+
+    try {
+      calculateSize(dirPath);
+    } catch (error) {
+      return 0;
+    }
+
+    return Math.round(totalBytes / (1024 * 1024)); // Convert to MB
+  }
+
+  /**
+   * Get cache configuration
+   */
+  getConfig() {
+    return {
+      maxSizeGB: this.maxSizeGB,
+      maxRepositories: this.maxRepositories,
+      cacheDir: this.cacheDir,
+    };
+  }
+}
+
+// Global instance initialized with config
+const config = getCacheConfig();
+export const cacheManager = new CacheManager(
+  config.cacheDir,
+  config.maxSizeGB,
+  config.maxRepositories,
+);

src/proxy/processors/push-action/clearBareClone.ts

@@ -1,16 +1,41 @@
 import { Action, Step } from '../../actions';
 import fs from 'node:fs';
 
+const WORK_DIR = './.remote/work';
+
 const exec = async (req: any, action: Action): Promise<Action> => {
   const step = new Step('clearBareClone');
 
-  // Recursively remove the contents of ./.remote and ignore exceptions
-  fs.rm('./.remote', { recursive: true, force: true }, (err) => {
-    if (err) {
-      throw err;
+  // In test environment, clean up EVERYTHING to prevent memory leaks
+  if (process.env.NODE_ENV === 'test') {
+    // TEST: Full cleanup (bare cache + all working copies)
+    try {
+      if (fs.existsSync('./.remote')) {
+        fs.rmSync('./.remote', { recursive: true, force: true });
+        step.log('Test environment: Full .remote directory cleaned');
+      } else {
+        step.log('Test environment: .remote directory already clean');
+      }
+    } catch (err) {
+      step.log(`Warning: Could not clean .remote directory: ${err}`);
+    }
+  } else {
+    // PRODUCTION: Delete ONLY this push's working copy
+    const workCopy = `${WORK_DIR}/${action.id}`;
+
+    if (fs.existsSync(workCopy)) {
+      try {
+        fs.rmSync(workCopy, { recursive: true, force: true });
+        step.log(`Cleaned working copy for push ${action.id}`);
+      } catch (err) {
+        step.log(`Warning: Could not clean working copy ${workCopy}: ${err}`);
+      }
+    } else {
+      step.log(`Working copy ${workCopy} not found (may have been already cleaned)`);
     }
-    console.log(`.remote is deleted!`);
-  });
+
+    step.log('Bare cache preserved for reuse');
+  }
 
   action.addStep(step);
   return action;