[leet-c1]

Why

A release that renames or drops a cache file leaves the old one in ~/.c1i/cache/ forever. The rename in #148 (openapi.yaml → api-openapi.yaml) would strand ~0.9 MB per machine. This replaces a cleanup rule per file with one general rule.

What

• cmd/cache.go holds an allowlist, cacheFiles, of every file the cache dir is meant to contain. Today that is just cacheFileName.
• After a successful OpenAPI cache write, pruneCacheDir deletes every other file in that dir. The write happens at most once per 24h.
• Because the allowlist reads the constant, fix: use the current public OpenAPI source for API discovery #148's rename removes the old file with no extra code, whichever PR merges first.
• The sweep is best-effort and never fails the command. It does not run on a cache read or a failed fetch.
• It skips:
  • subdirectories;
  • a cache dir that is a symlink, whose target may hold files c1i doesn't own;
  • a relative cache path, which is what an unset HOME produces and which would sweep the working directory.
• README and cmd/agents.md now say not to keep your own files in ~/.c1i/cache/.

What c1i writes, and what this touches

Path	Kind	Swept
~/.c1i/cache/*	OpenAPI spec cache	yes, the only dir swept
~/.c1i.yaml	config	no
<UserConfigDir>/c1i/credentials/	credential file fallback	no
<UserConfigDir>/c1i/tokens/	access-token cache, keyed by a hash of the credentials	no
~/.sigstore/root/	Sigstore TUF trust-root cache, written by upgrade through sigstore-go's default path and shared with other Sigstore tools	no
.c1i-upgrade-* beside the binary	upgrade staging file, removed by upgrade itself	no

I chose not to add a cache clear command. Users would have to know to run it, and the automatic sweep already covers leftovers.

Known trade-off: two different c1i versions on one machine that use different cache names delete each other's file. The cost is one refetch per refresh and no offline fallback for the other version.

Verification

• TestCacheWritePrunesLeftoverFiles drives docs openapi end to end with a stubbed transport. TestCachePruneSkipsSymlinkedCacheDir and TestCachePruneSkipsRelativeCacheDir cover the two guards.
• Each test failed before its fix. The symlink test also fails when Lstat is swapped for Stat.
• Live: ran a built binary against the real spec endpoint with a temporary HOME containing a stray file. The stray file was deleted and the fresh spec was kept.
• Passing: go build, go vet, go test -count=1 -shuffle=on, golangci-lint, gosec, go mod tidy diff, gitleaks, and govulncheck (all three GOOS) after merging main with Build with Go 1.27.2 and bump x/net to fix new advisories #149's Go 1.27.2 / x/net bumps.

The CHANGELOG entry will conflict trivially with #148.

🤖 Generated with Claude Code