From f2f4657e7534e072b369ccb19e714447f60aa3f7 Mon Sep 17 00:00:00 2001
From: sganggs <sganggs@users.noreply.github.com>
Date: Wed, 7 Oct 2026 18:03:54 +0800
Subject: [PATCH] =?UTF-8?q?feedback6=20R21E:=20.gitignore=20lists=20.npm-c?=
 =?UTF-8?q?ache/=20=E2=80=94=20a=20local=20npm=20cache=20(npm=5Fconfig=5Fc?=
 =?UTF-8?q?ache=3D./.npm-cache,=20npm=20ci=20--cache=20.npm-cache)=20is=20?=
 =?UTF-8?q?never=20committed=20by=20any=20contributor=20(GitHub=20#258);?=
 =?UTF-8?q?=20test/gitignore.test.js=20asks=20git=20itself;=20golden:=20un?=
 =?UTF-8?q?changed?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitignore             |  2 ++
 test/gitignore.test.js | 31 +++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+)
 create mode 100644 test/gitignore.test.js

diff --git a/.gitignore b/.gitignore
index 767b4166..37a6479b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,7 @@
 # --- dependencies & generated client libs -------------------------------------------------------
 node_modules/
+# a local npm cache (npm_config_cache=./.npm-cache, npm ci --cache .npm-cache — GitHub #258)
+.npm-cache/
 # copied from node_modules by tools/vendor.mjs (postinstall); never commit third-party builds
 public/vendor/
 
diff --git a/test/gitignore.test.js b/test/gitignore.test.js
new file mode 100644
index 00000000..b5cbb29c
--- /dev/null
+++ b/test/gitignore.test.js
@@ -0,0 +1,31 @@
+// .gitignore keeps per-machine state out of the repository (and so out of the release packages, which ship tracked
+// files only: tools/package.mjs). GitHub #258: a local npm cache (`npm_config_cache=./.npm-cache`, `npm ci --cache
+// .npm-cache`) must never be committed by any contributor.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const lines = readFileSync(path.join(ROOT, '.gitignore'), 'utf8').split(/\r?\n/).map((l) => l.trim());
+
+/** git's own verdict on a path (null when git or the repository is not available). */
+function ignored(rel) {
+  try {
+    execFileSync('git', ['check-ignore', '-q', '--no-index', rel], { cwd: ROOT, stdio: 'ignore' });
+    return true;
+  } catch (e) {
+    return e && e.status === 1 ? false : null;
+  }
+}
+
+test('GitHub #258: the local npm cache (.npm-cache/) is ignored, like node_modules/ and .cache/', () => {
+  for (const entry of ['.npm-cache/', 'node_modules/', '.cache/']) assert.ok(lines.includes(entry), `.gitignore lists ${entry}`);
+  for (const rel of ['.npm-cache/_cacache/index-v5/00/aa', '.npm-cache/_logs/debug-0.log']) {
+    const v = ignored(rel);
+    if (v !== null) assert.equal(v, true, `${rel} is ignored`);
+  }
+  assert.notEqual(ignored('package.json'), true, 'a tracked file is not');
+});