Pimp My IDE / garage dispatchBack to the garage
October 9, 2026 / command line / cache policy

Cache the contract, not the wish.

A repeated command can skip work. It can also replay an answer after the directory, identity, inputs, or deadline changed.

A cache hit is a claim that the omitted inputs do not matter.
OffScopeHit
Input gap

The key is the policy.

once is a new Go command line tool that keeps successful stdout in a per-user memory daemon. Its key is derived from a tenant value, the working directory unless --no-dir is set, and the command with its arguments. The implementation length-prefixes those fields before applying HMAC-SHA256.[1]

The child command still inherits the caller's environment on a miss. The environment is not part of the documented key. That is not a hidden flaw. It is a boundary the operator must understand. If credentials, profile, architecture, feature flags, network target, or input files can change the answer, the tenant and lifetime must separate those states or the command should not use this cache.

Every cache key is a list of facts you promise are enough.

Short life beats broad confidence.

The tool requires a positive time to live. An optional absolute deadline can cut that life shorter. --refresh bypasses the current entry, and once clear drops all values. Failed commands are not cached. Only stdout is retained. Stdin and stderr continue to pass through.[1]

Those controls make sense for a bounded convenience such as avoiding repeated biometric approval during one terminal session. They do not prove that a value remains valid for eight hours. Set the lifetime from the value's real revocation and rotation rules. Use a fresh tenant when the shell, account, project, or trust context changes.

Build caches expose the larger rule.

Bazel describes each action with declared inputs, output names, a command line, and environment variables. Its remote-cache guidance says reuse across machines is safe when the build is reproducible.[2] Ccache goes deeper for C and C++ compilation. Its manual documents modes that hash compiler, source, and preprocessing information to decide whether an earlier result fits the current compile.[3]

A general shell command has no build graph to declare what it reads. The wrapper can see arguments and a directory. It cannot infer every file, process, account, clock, service, or environment value behind the result. The smaller key is useful because it is simple. It also moves more responsibility to the person writing the command.

Secrets change the storage question.

The inspected revision keeps values unencrypted in daemon memory. It restricts its runtime directory and socket by operating-system permissions, disables core dumps, wipes byte slices on removal as a best effort, and accepts that another process running as the same user can use the cache. Memory is not locked against swapping.[1]

That model is different from a shared continuous-integration cache. GitHub warns against placing access tokens or login credentials in an Actions cache because users who can create pull requests may be able to read base-branch caches.[4] Do not copy one cache policy into another storage and trust boundary.

Inspection found code, not a local run.

We verified the canonical repository and inspected revision 65816d906d127a5a14f78ce1a13e36b676c4f540. We read the README, key derivation, command execution, daemon, expiry, socket permissions, memory wiping, and included tests. This host does not have Go installed, so the repository's test suite was not run here. The project's runtime behavior remains source-observed rather than independently exercised.

Interactive makeover / blind cache alias replaced

Set the ignition lock.

This control combines workload choice, key clauses, a connected decision bus, command sketch, and copyable review record. It drafts policy. It does not inspect your command or verify that the selected facts cover every input.

Choose jobMap inputsBound lifeDraft plan

Cache controls

Choose the job first. A command with side effects stays out of the cache even when every clause is selected.

Workload
Key and expiry clauses
Live teaching model / not runtime telemetry

Cache decision bus

COMMANDSelected
SCOPESelected
INPUTSOpen
EXPIRYSelected
Plan needs input work3 of 4 clauses selected. Hidden inputs still need a rule.
once --ttl 30m --tenant "$SESSION_KEY" -- op read op://Work/token
Sources read / October 9, 2026

Source log

Open the evidence boundary
  1. alex0ptr/once at revision 65816d9, README and implementation, read October 9, 2026. We verified the repository through the GitHub API and git ls-remote, then inspected the exact checkout. We did not run it because Go is absent on this host.
  2. Bazel, "Remote Caching", read October 9, 2026. The documentation describes declared action inputs, output names, command lines, environment variables, action hashes, and the reproducibility condition for reuse.
  3. Ccache manual, read October 9, 2026. The manual describes compiler-result reuse and the information hashed in its direct, preprocessor, and dependency modes.
  4. GitHub Actions, "Dependency caching reference", read October 9, 2026. The page documents cache-key matching and warns against storing credentials in cache paths that pull-request authors can access.
  5. Hacker News discussion, "Once: Cache CLI Commands", item 50018239, read October 9, 2026. The exact discussion URL was resolved through the Hacker News API. Comments compared memory and temporary-file storage. They do not verify the tool's claims.

Scope: the ignition lock edits a browser-local policy draft. It does not parse a shell command, observe files or environment variables, inspect a daemon, hold a secret, or certify a safe cache key.