perf(scripts): cache registry responses so --check runs in 0.05s instead of 29s

[os-zhuang]

--check makes one HTTPS request per tracked component — 46 round trips for a run that is almost entirely I/O wait: 28.6s wall against 0.13s of user time. That's enough friction that nobody runs the status command, which rather defeats having one.

Result

	wall	registry
cold (empty cache)	26.86s	0 cached, 46 fetched
warm	0.05s	46 cached, 0 fetched
--no-cache	28.74s	0 cached, 46 fetched

Responses are cached under node_modules/.cache/shadcn-sync/, keyed by source URL, 60-minute TTL. That's the conventional home: already gitignored (verified with git check-ignore), and a clean install discards it — the right lifetime for a cache.

The load-bearing detail: reads only

allowCache gates reading, and only read-only commands pass it.

command	reads cache?	writes cache?
--check, --diff	✅	✅
--update, --update-all	❌ never	✅

A stale --check is a slightly out-of-date status line. A stale --update would put hour-old code on disk under a message saying it's current. Writes still refresh the entry, so an update leaves the cache warm for the next check.

Proved it by poisoning the cache. Overwrote the cached button entry with // POISONED CACHE — this must never reach disk:

• --check → reported button as 51 local line(s) … --update would refuse. It reads the cache, so it saw the poison. ✅
• --update button → ignored the poison entirely, fetched live, wrote the real upstream content. Clean git tree, zero POISONED lines on disk, and the cache entry was write-refreshed (poison gone, fetchedAt 17s old). ✅

Failure modes are quiet by design

• Missing / unreadable / corrupt entry → falls through to the network. Wrote not json at all {{{ into one file: 45 cached, 1 fetched, exit 0, 0 errors.
• Cache directory unwritable → the write is swallowed; a cache is an optimisation and must never fail a run.
• TTL expiry → aged every entry to 61 minutes: 0 cached, 46 fetched. ✅

Always says where the data came from

Registry: 46 cached, 0 fetched (cache TTL 60min — --no-cache to force live)

A run that returns in 50ms is otherwise indistinguishable from one that silently fetched nothing.

Verification

• Cold / warm / --no-cache / expired / corrupt paths all measured above
• --update resizable still refuses (fix(components): resizable is a diverged file, not a synced one — stop the sync from breaking the build, and finish the v4 migration in it #3029 reclassification intact); --update command still refuses (fix(scripts): shadcn-sync refuses to silently delete local edits, and compiles the package after it writes #3035 local-edit guard intact); --diff unaffected
• eslint clean; script-only change — no manifest or component edits

No changeset — tooling only.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectui	Ignored		Jul 30, 2026 3:01pm