module style 4: add cache for module compilation

[prozacchiwawa]

Note

Medium Risk
Adds a new on-disk cache that can bypass module compilation/optimization and directly rehydrate compiled exports, which affects build correctness if cache keys or fingerprints are wrong. Also changes output file writing behavior (directory creation + error propagation details), impacting artifact generation paths.

Overview
Adds an on-disk cache for module-style compilation outputs. The compiler now fingerprints include inputs, computes a cache key from those fingerprints, and on a cache hit skips codegen/optimization by loading cached .hex exports, reconstructing the module summary/hashes, and re-emitting the expected output and companion *_hash.hex files.

Updates module compilation to populate the cache for each export, introduces IncludeDesc.fingerprint to drive cache invalidation (including a synthetic main fingerprint), and extends tests with new module fixtures plus a regression test that verifies cached artifacts are reused. Includes small refactors/cleanups and dependency lockfile bumps (e.g., cc, zerocopy, serde).

^{Reviewed by Cursor Bugbot for commit 5927198. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• cargo/cc@1.2.55
• cargo/zerocopy-derive@0.8.39

View full report

[prozacchiwawa]

@SocketSecurity ignore cargo/zerocopy-derive@0.8.39

[prozacchiwawa]

@SocketSecurity ignore cargo/cc@1.2.55

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Cache key concatenates fingerprints without length-prefixing causing ambiguity
  • The cache key now prefixes each include fingerprint with its length before hashing, so empty and variable-length fingerprints are encoded unambiguously.

Or push these changes by commenting:

@cursor push 415a928f33

Preview (415a928f33)

diff --git a/src/compiler/diskcache.rs b/src/compiler/diskcache.rs
--- a/src/compiler/diskcache.rs
+++ b/src/compiler/diskcache.rs
@@ -7,7 +7,8 @@
 fn cache_key(cf: &CompileForm) -> String {
     let mut include_fingerprints = Vec::new();
     for include in cf.include_forms.iter() {
-        include_fingerprints.append(&mut include.fingerprint.clone());
+        include_fingerprints.extend_from_slice(&(include.fingerprint.len() as u64).to_be_bytes());
+        include_fingerprints.extend_from_slice(&include.fingerprint);
     }
     hex::encode(sha256tree_from_atom(&include_fingerprints))
 }

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}