pmg/docs/caching.md

Caching

PMG can cache package analysis results across runs to reduce repeat-install latency. Caching is opt-in and disabled by default.

Storage

PMG's on-disk caches share a single SQLite database at <cache-dir>/localdb/pmg.db, where <cache-dir> follows the platform convention:

Platform	Default cache dir
macOS	~/Library/Caches/safedep/pmg
Linux	$XDG_CACHE_HOME/safedep/pmg (or ~/.cache/safedep/pmg)
Windows	%LOCALAPPDATA%\safedep\pmg

Override the location with the PMG_CACHE_DIR environment variable. The cache is local to the machine and safe to delete at any time.

Malysis analysis cache

Persists benign Malysis (malware analysis) verdicts on disk, so a package version that was already screened is not re-analyzed on every install.

Only benign verdicts are cached, and each entry expires after a TTL. Malicious, suspicious, and tenant-excluded verdicts are never cached and are always re-evaluated. Keep the TTL below your dependency_cooldown window so newly published packages remain covered by cooldown if a cached verdict goes stale.

Enable

In config.yml:

analysis_cache:
  malysis:
    enabled: true
    ttl: 24h

Or from the CLI:

pmg config set analysis_cache.malysis.enabled true
pmg config set analysis_cache.malysis.ttl 24h
pmg config edit   # open the config file directly

• enabled (default false) — turn the persistent cache on.
• ttl (default 24h) — how long a cached benign verdict is reused, measured from when it was fetched. A non-positive value disables persistence.

Manage

pmg setup cache status   # show path, enabled state, TTL, and entry count
pmg setup cache clear    # delete all cached verdicts