senren-ui 0.1.6 → 0.3.0

data/lib/senren/rails/component_copier.rb

@@ -1,8 +1,11 @@
 # frozen_string_literal: true
 
 require 'fileutils'
+require 'pathname'
 require 'yaml'
 require 'time'
+require 'senren/rails/base_component_patch'
+require 'senren/rails/safe_write'
 
 module Senren
   module Rails
@@ -15,40 +18,7 @@ module Senren
         '../../generators/senren/install/templates', __dir__
       ).freeze
       BASE_COMPONENT_TEMPLATE = File.join(INSTALL_GENERATOR_TEMPLATES, 'base_component.rb.tt').freeze
-      BASE_URL_HELPER_PATCH = <<~RUBY
-
-        # Added by senren:add for compatibility with URL-aware component templates.
-        require 'uri'
-
-        module Senren
-          class BaseComponent
-            SAFE_URL_PROTOCOLS = %w[http https mailto tel].freeze unless const_defined?(:SAFE_URL_PROTOCOLS)
-            SAFE_MEDIA_URL_PROTOCOLS = %w[http https].freeze unless const_defined?(:SAFE_MEDIA_URL_PROTOCOLS)
-
-            private
-
-            def safe_url(value, fallback: '#', protocols: SAFE_URL_PROTOCOLS)
-              url = value.to_s.strip
-              return fallback if url.empty?
-              return url if url.start_with?('#')
-              return url if url.start_with?('/') && !url.start_with?('//')
-
-              uri = URI.parse(url)
-              return url if uri.scheme && Array(protocols).map(&:to_s).include?(uri.scheme.downcase)
-              return fallback if uri.host
-              return url unless uri.scheme
-
-              fallback
-            rescue URI::InvalidURIError
-              fallback
-            end
-
-            def safe_media_url(value, fallback: nil)
-              safe_url(value, fallback: fallback, protocols: SAFE_MEDIA_URL_PROTOCOLS)
-            end
-          end
-        end
-      RUBY
+      BASE_URL_HELPER_PATCH = BaseComponentPatch::URL_HELPERS
 
       attr_reader :registry, :paths, :stdout
 
@@ -62,30 +32,64 @@ module Senren
       # Returns the ordered list of component names actually installed.
       def install(component_names, client_override: nil, force: false)
         wanted = registry.dependencies(*component_names)
+        validate_client_override!(component_names, client_override)
         paths.ensure_dirs!
         ensure_base_component_url_helpers!
 
+        requested = Array(component_names).map(&:to_s)
         wanted.each do |name|
           comp = registry.fetch(name)
-          install_component(comp, client_override: client_override, force: force)
+          install_component(comp, client_override: override_for(name, requested, client_override), force: force)
         end
 
-        update_installed_ledger(wanted, client_override: client_override)
+        update_installed_ledger(wanted, requested: requested, client_override: client_override)
         wanted
       end
 
       private
 
+      # --client / --no-client describes what the user asked for, not what its
+      # dependencies are. Applying it to the whole closure meant
+      # `senren:add context_menu --no-client` also suppressed the controller for
+      # dropdown_menu, whose markup emits data-controller unconditionally — so
+      # the installed menu silently never opened, and the ledger then recorded
+      # client: false for a component this command was never asked about.
+      #
+      # validate_client_override! already exempts dependencies in the other
+      # direction, for the same reason.
+      def override_for(name, requested, client_override)
+        requested.include?(name) ? client_override : nil
+      end
+
       def ensure_base_component_url_helpers!
-        if paths.base_component_path.exist?
+        dest = paths.base_component_path
+
+        # Checked before #exist?, which follows the link, so a destination
+        # resolving outside the app root is refused before it is read.
+        return if refuse_symlink?(dest, 'base_component.rb')
+
+        if dest.exist?
           return if base_component_has_url_helpers?
 
-          File.open(paths.base_component_path, 'a') { |file| file.write(BASE_URL_HELPER_PATCH) }
-          stdout.puts "  update #{paths.base_component_path} (url helpers)"
+          # Read-modify-write through SafeWrite rather than File.open(dest, 'a').
+          # The append was the one non-atomic write left in the gem: a process
+          # killed partway through left base_component.rb holding half a method,
+          # and an app that will not boot. This is the migration path onto the
+          # hardened URL helpers, so it runs on apps that already have code
+          # worth not corrupting.
+          SafeWrite.write!(dest, dest.read + BASE_URL_HELPER_PATCH, paths.root, 'base_component.rb')
+          stdout.puts "  update #{dest} (url helpers)"
           return
         end
 
-        copy_file(BASE_COMPONENT_TEMPLATE, paths.base_component_path, force: false, label: 'base_component.rb')
+        copy_file(BASE_COMPONENT_TEMPLATE, dest, force: false, label: 'base_component.rb')
+      end
+
+      # Delegates to SafeWrite so an intermediate symlinked directory is caught,
+      # not just a symlinked leaf. `app/components/senren -> /elsewhere` used to
+      # pass every check here.
+      def refuse_symlink?(dest, label)
+        SafeWrite.resolve(dest, paths.root, label, io: stdout).nil?
       end
 
       def base_component_has_url_helpers?
@@ -106,11 +110,28 @@ module Senren
         end
       end
 
+      # Only the explicitly requested components are checked: pulling in a
+      # dependency that has no controller must not fail the whole install.
+      def validate_client_override!(requested, override)
+        return unless override
+
+        offenders = Array(requested).map { |name| registry.fetch(name) }.reject { |comp| controller_file_for(comp) }
+        return if offenders.empty?
+
+        raise ArgumentError,
+              "--client was requested for #{offenders.map(&:name).join(', ')}, but the registry lists no Stimulus " \
+              'controller for them. Drop --client, or add a controller file to the registry entry.'
+      end
+
+      def controller_file_for(comp)
+        comp.files.find { |relative| controller_source_path?(comp, relative) }
+      end
+
       def effective_client_for(comp, override)
-        return comp.client? if override.nil?
-        return false unless comp.can_have_client
+        desired = override.nil? ? comp.client? : (comp.can_have_client && override)
 
-        override
+        # Never record client behavior in the ledger that was not installed.
+        desired && !controller_file_for(comp).nil?
       end
 
       def source_for(comp, relative)
@@ -142,18 +163,46 @@ module Senren
       def copy_file(src, dest, force:, label:)
         raise MissingTemplate, "Missing component template: #{src} (#{label})" unless File.exist?(src)
 
+        dest = assert_inside_host_root!(dest, label)
+        return if refuse_symlink?(dest, label)
+
         if File.exist?(dest) && !force
           stdout.puts "  skip  #{dest} (already exists)"
           return
         end
-        FileUtils.mkdir_p(File.dirname(dest))
-        FileUtils.cp(src, dest)
+        SafeWrite.mkdir_p!(File.dirname(dest), paths.root, label)
+        SafeWrite.copy!(src, dest, paths.root, label)
         stdout.puts "  copy  #{dest}"
       end
 
-      def update_installed_ledger(names, client_override:)
+      # Defense in depth: destinations are registry-derived, but a copier that
+      # can write anywhere is one bad registry entry away from a traversal.
+      #
+      # This used to compare expand_path, which normalises lexically and does
+      # not resolve symlinks, so a symlinked ancestor escaped it entirely.
+      def assert_inside_host_root!(dest, label)
+        SafeWrite.assert_inside!(dest, paths.root, label)
+      rescue SafeWrite::Escape => e
+        raise ArgumentError, e.message
+      end
+
+      # A ledger holding anything but a mapping used to reach `ledger['installed']
+      # ||= []` and raise `IndexError: string not matched` from String#[]=, which
+      # tells the user nothing about which file is wrong or why.
+      def load_ledger(path)
+        return {} unless path.exist?
+
+        content = YAML.safe_load_file(path) || {}
+        return content if content.is_a?(Hash)
+
+        raise ArgumentError,
+              "#{path} is not a Senren ledger: expected a YAML mapping, got #{content.class}. " \
+              'Fix or delete the file and run the command again.'
+      end
+
+      def update_installed_ledger(names, requested:, client_override:)
         ledger_path = paths.installed_components
-        ledger = ledger_path.exist? ? (YAML.safe_load_file(ledger_path) || {}) : {}
+        ledger = load_ledger(ledger_path)
         installed = ledger['installed'] ||= []
 
         names.each do |name|
@@ -162,7 +211,9 @@ module Senren
             'name' => name,
             'version' => Senren::Rails::VERSION,
             'installed_at' => Time.now.utc.iso8601,
-            'client' => effective_client_for(registry.fetch(name), client_override)
+            'client' => effective_client_for(
+              registry.fetch(name), override_for(name, requested, client_override)
+            )
           }
           if existing
             existing.merge!(attrs.except('installed_at'))
@@ -172,8 +223,8 @@ module Senren
         end
 
         installed.sort_by! { |e| e['name'] }
-        ledger_path.parent.mkpath
-        File.write(ledger_path, YAML.dump(ledger))
+        SafeWrite.mkdir_p!(ledger_path.parent, paths.root, 'ledger')
+        SafeWrite.write!(ledger_path, YAML.dump(ledger), paths.root, 'ledger')
       end
     end
   end

data/lib/senren/rails/component_installer.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'fileutils'
 require 'senren/rails/agent_rules_writer'
 require 'senren/rails/component_copier'
 require 'senren/rails/host_paths'
@@ -33,15 +34,40 @@ module Senren
         normalized_names = self.class.normalize_names(names)
         raise ArgumentError, USAGE if normalized_names.empty?
 
+        # Preflight. Everything below writes to disk, and a failure partway
+        # through leaves components copied, the ledger updated and the guidance
+        # files stale -- which is exactly what the first version of the adapter
+        # collision check did.
+        AgentRulesWriter.new(registry: registry, paths: paths).assert_distinct_adapters!
+
         installed = ComponentCopier.new(registry: registry, paths: paths, stdout: stdout)
                                    .install(normalized_names, client_override: client_override, force: force)
 
+        refresh_registry_mirror
         SkillWriter.new(registry: registry, paths: paths).sync!
         AgentRulesWriter.new(registry: registry, paths: paths).sync!
 
         stdout.puts "Installed: #{installed.join(', ')}"
         installed
       end
+
+      private
+
+      # The mirror was written once at install time and never again, so it drifted
+      # from the gem on every upgrade while the generated agent rules kept
+      # advertising it as the authoritative "component registry mirror". Agents
+      # read stale component metadata and had no way to tell.
+      # The FileUtils.cp here was lifted from the Installer#mirror_registry that
+      # this same review deleted, and it carried that method's defect with it:
+      # containment was applied to the directory, so a symlinked
+      # .senren/registry.yml was followed and a file outside the app root was
+      # overwritten. Moving a bug is not fixing it. SafeWrite.copy! checks the
+      # destination file itself.
+      def refresh_registry_mirror
+        dest = paths.registry_mirror
+        SafeWrite.mkdir_p!(dest.dirname, paths.root, 'registry mirror')
+        SafeWrite.copy!(Senren::Rails.registry_path, dest, paths.root, 'registry mirror')
+      end
     end
   end
 end

data/lib/senren/rails/doctor.rb

@@ -28,14 +28,17 @@ module Senren
       private
 
       def check(label)
-        ok = false
         detail = nil
-        begin
-          ok = !yield.nil?
+        result = begin
+          yield
         rescue StandardError => e
           detail = e.message
+          nil
         end
-        Result.new(label, ok, detail)
+
+        # Checks return either a boolean (File#exist?) or nil/truthy (defined?).
+        # Only a truthy result passes: `false` must fail, not slip through.
+        Result.new(label, result ? true : false, detail)
       end
 
       def gem_loadable?(name)

data/lib/senren/rails/engine.rb

@@ -11,6 +11,29 @@ module Senren
         rake_path = File.expand_path('../../tasks/senren.rake', __dir__)
         app.paths['lib/tasks'] << rake_path if File.exist?(rake_path)
       end
+
+      # The gem's only production-boot behaviour, and it earns the exception:
+      # with app/components on the asset load path, Propshaft publishes
+      # component source.
+      #
+      # after_initialize rather than an `after:` anchor. Hosts append asset
+      # paths from config/initializers/assets.rb, so the check has to see a
+      # fully configured app. after_initialize is the only placement that
+      # guarantees that without reasoning about railtie order.
+      #
+      # This was first written as `after: :append_assets_path`, copied from
+      # sprockets-rails. Propshaft names its equivalent
+      # "propshaft.append_assets_path", and Rails resolves an unknown ordering
+      # anchor to an empty dependency set rather than raising — so the anchor
+      # was inert. It happened not to matter, because an application's own
+      # initializers run ahead of every engine's, but an inert anchor that reads
+      # like a guarantee is worse than no anchor.
+      initializer 'senren.rails.guard_asset_paths' do |app|
+        app.config.after_initialize do
+          require 'senren/rails/asset_path_guard'
+          Senren::Rails::AssetPathGuard.check!(app)
+        end
+      end
     end
   end
 end

data/lib/senren/rails/host_paths.rb

@@ -1,4 +1,5 @@
 require 'pathname'
+require 'senren/rails/safe_write'
 
 module Senren
   module Rails
@@ -32,13 +33,21 @@ module Senren
       def claude_md             = root.join('CLAUDE.md')
       def codex_agents_md       = root.join('AGENTS.md')
 
+      # Pathname#mkpath stops at File.directory?, which follows symlinks, so a
+      # checkout shipping app/components/senren as a link to somewhere outside
+      # the project had that link preserved and every later write redirected
+      # through it. SafeWrite refuses instead of silently accepting it.
       def ensure_dirs!
         [senren_dir, components_dir, stimulus_dir,
-         stylesheet_path.dirname, github_dir, cursor_rules_dir].each(&:mkpath)
+         stylesheet_path.dirname, github_dir, cursor_rules_dir].each do |dir|
+          SafeWrite.mkdir_p!(dir, root, 'ensure_dirs!')
+        end
       end
 
       def ensure_agent_dirs!
-        [senren_dir, github_dir, cursor_rules_dir].each(&:mkpath)
+        [senren_dir, github_dir, cursor_rules_dir].each do |dir|
+          SafeWrite.mkdir_p!(dir, root, 'ensure_agent_dirs!')
+        end
       end
     end
   end

data/lib/senren/rails/marker_block.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Senren
+  module Rails
+    # Replaces the content between a START/END marker pair, preserving
+    # everything outside it.
+    #
+    # These markers delimit generated instructions inside files that humans and
+    # AI agents also edit (CLAUDE.md, AGENTS.md, .senren/skill.md). A tampered
+    # or duplicated marker pair is treated as an error rather than something to
+    # work around: silently "repairing" it produces a block that regeneration
+    # can never clean up again, which is indistinguishable from a persistent
+    # prompt injection.
+    module MarkerBlock
+      class MalformedMarkers < StandardError; end
+
+      module_function
+
+      # Returns `existing` with the marker block replaced by `generated`.
+      # Appends a fresh block when no markers are present yet.
+      def inject(existing, generated, start_marker:, end_marker:, label: nil)
+        existing = existing.to_s
+        body = generated.to_s.strip
+
+        assert_body_is_marker_free!(body, start_marker, end_marker, label)
+        assert_well_formed!(existing, start_marker, end_marker, label)
+
+        block = "#{start_marker}\n\n#{body}\n\n#{end_marker}"
+        return append(existing, block) unless existing.include?(start_marker)
+
+        pattern = /#{Regexp.escape(start_marker)}.*?#{Regexp.escape(end_marker)}/m
+        # Block form is required. Given a replacement *string*, String#sub
+        # expands \0, \1 and \& as backreferences: a body containing one would
+        # splice the old block — markers and all — back into the new one,
+        # resurrecting stale content and duplicating the delimiters. The block
+        # form takes the return value literally.
+        existing.sub(pattern) { block }
+      end
+
+      # A generated block that contains its own delimiters produces a file this
+      # module then refuses to parse: the writer corrupts its own output and the
+      # error blames the user for hand-editing. Fail at the source instead.
+      def assert_body_is_marker_free!(body, start_marker, end_marker, label)
+        found = [start_marker, end_marker].select { |marker| body.include?(marker) }
+        return if found.empty?
+
+        where = label ? " for #{label}" : ''
+        raise MalformedMarkers,
+              "Generated content#{where} contains #{found.join(' and ')}. " \
+              'The data this block is rendered from must not contain the markers themselves.'
+      end
+
+      def append(existing, block)
+        head = existing.rstrip
+        head.empty? ? "#{block}\n" : "#{head}\n\n#{block}\n"
+      end
+
+      # A file is well formed when it has either no markers at all, or exactly
+      # one START followed by exactly one END.
+      def assert_well_formed!(existing, start_marker, end_marker, label)
+        starts = existing.scan(start_marker).size
+        ends   = existing.scan(end_marker).size
+
+        return if starts.zero? && ends.zero?
+
+        where = label ? " in #{label}" : ''
+        if starts != 1 || ends != 1
+          raise MalformedMarkers,
+                "Expected exactly one #{start_marker} and one #{end_marker}#{where}, " \
+                "found #{starts} and #{ends}. Fix the markers by hand, then re-run the sync."
+        end
+
+        return if existing.index(start_marker) < existing.index(end_marker)
+
+        raise MalformedMarkers,
+              "#{end_marker} appears before #{start_marker}#{where}. " \
+              'Fix the marker order by hand, then re-run the sync.'
+      end
+    end
+  end
+end

data/lib/senren/rails/registry.rb

@@ -10,15 +10,12 @@ module Senren
       OPTIONAL_KEYS = %w[controller stub].freeze
       ALLOWED_KEYS = (REQUIRED_KEYS + OPTIONAL_KEYS).freeze
       VALID_CATEGORIES = %w[actions forms overlays navigation layout data saas rich].freeze
+      NAME_PATTERN = /\A[a-z][a-z0-9_]*\z/
 
       Component = Struct.new(:name, :category, :client, :can_have_client, :controller, :stub, :files, :depends_on,
                              :pairs_with, :variants, :accessibility, :use_for, :avoid, keyword_init: true) do
         def stub? = stub == true
         def client? = client == true
-
-        def to_h_full
-          to_h.merge(stub: stub?, client: client?)
-        end
       end
 
       attr_reader :components, :groups, :recipes
@@ -107,6 +104,7 @@ module Senren
       end
 
       def validate_component(name, comp, errors)
+        validate_component_name(name, errors)
         validate_component_keys(name, errors)
         validate_component_category(name, comp, errors)
         validate_component_dependencies(name, comp, errors)
@@ -114,6 +112,14 @@ module Senren
         validate_component_file_paths(name, comp, errors)
       end
 
+      # The file-path allowlist is derived from the component name, so an
+      # unconstrained name would validate a traversal path against itself.
+      def validate_component_name(name, errors)
+        return if NAME_PATTERN.match?(name)
+
+        errors << "#{name.inspect}: invalid component name (expected #{NAME_PATTERN.source})"
+      end
+
       def validate_component_keys(name, errors)
         extra_keys = @raw_components.fetch(name).keys - ALLOWED_KEYS
         errors << "#{name}: unknown keys #{extra_keys.sort.join(', ')}" if extra_keys.any?

data/lib/senren/rails/safe_write.rb

@@ -0,0 +1,169 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'pathname'
+require 'securerandom'
+
+module Senren
+  module Rails
+    # Containment for everything this gem writes into a host app.
+    #
+    # The threat model is a repository you clone and run `senren:install` in.
+    # The *content* written is gem-controlled, so this is a file-creation and
+    # overwrite primitive rather than an arbitrary-content write — but a
+    # checkout that ships `app/components/senren` as a symlink pointing outside
+    # the project could previously redirect every copied file, and
+    # `write_adapter_file` reads its destination before rewriting it, so
+    # pre-existing content outside the checkout was modified too.
+    #
+    # Two independent defects made that possible, and both are fixed here:
+    #
+    #   1. Containment used Pathname#expand_path, which normalises `..`
+    #      lexically and does NOT resolve symlinks. An escaping path therefore
+    #      passed the start_with? check. Containment must compare realpath.
+    #   2. Symlinks were refused on the leaf only, never on an intermediate
+    #      directory, and Pathname#mkpath stops at File.directory? — which
+    #      follows a link — so a symlinked parent was preserved rather than
+    #      replaced.
+    module SafeWrite
+      class Escape < StandardError; end
+
+      module_function
+
+      MAX_LINK_DEPTH = 32
+
+      # Where a write to `path` would actually land, with symlinks followed --
+      # including a DANGLING one, by reading its declared target rather than
+      # asking the filesystem to resolve it.
+      #
+      # Following the declared target is what makes the dangling case decidable.
+      # `exist?` is false on a broken link, so a check that resolved only
+      # existing ancestors would clear the parent directory and let the write
+      # land wherever the link points.
+      def real_target(path, depth = 0)
+        current = Pathname.new(path).expand_path
+        return current if depth > MAX_LINK_DEPTH
+
+        if current.symlink?
+          link = Pathname.new(File.readlink(current))
+          link = current.dirname + link unless link.absolute?
+          return real_target(link, depth + 1)
+        end
+        return current.realpath if current.exist?
+
+        resolve_existing_prefix(current)
+      rescue SystemCallError
+        Pathname.new(path).expand_path
+      end
+
+      # For a destination that does not exist yet: resolve the deepest ancestor
+      # that does, then re-append the part that is still missing.
+      #
+      # `symlink?` is part of the loop condition, not just `exist?`. A dangling
+      # link is invisible to `exist?`, so a walk that only tested existence
+      # stepped straight over an intermediate one and rebuilt the tail
+      # lexically -- reporting a path inside the root for a write that would
+      # land wherever the link pointed. Not reachable through today's callers,
+      # because each one runs mkdir_p! on the parent first and that catches it,
+      # but that is an implicit contract between caller and helper, and this
+      # cycle has already broken two of those.
+      def resolve_existing_prefix(path)
+        tail = []
+        current = path
+        until current.exist? || current.symlink? || current.root?
+          tail.unshift(current.basename)
+          current = current.parent
+        end
+        current = real_target(current) if current.symlink?
+        current = current.realpath if current.exist?
+        tail.reduce(current) { |acc, part| acc.join(part) }
+      end
+
+      # True when a write to `path` would land inside `root`.
+      #
+      # The property is containment, NOT the absence of symlinks. An earlier
+      # version refused every link on the path regardless of where it pointed,
+      # which broke `ln -s AGENTS.md CLAUDE.md` -- an ordinary way to keep one
+      # set of agent instructions -- and took `senren:add` down with it.
+      def inside?(path, root)
+        real_root = Pathname.new(root).expand_path
+        real_root = real_root.realpath if real_root.exist?
+        target = real_target(path)
+
+        target == real_root || target.to_s.start_with?("#{real_root}#{File::SEPARATOR}")
+      end
+
+      def assert_inside!(path, root, label)
+        return real_target(path) if inside?(path, root)
+
+        raise Escape,
+              "Refusing to write outside the app root: #{path} resolves to " \
+              "#{real_target(path)} (#{label})"
+      end
+
+      # Creates `dir`, refusing only when it would land outside the root.
+      def mkdir_p!(dir, root, label)
+        target = assert_inside!(dir, root, label)
+        FileUtils.mkdir_p(target)
+        target
+      end
+
+      # Resolves a destination for writing, or returns nil when it must be
+      # skipped. Raises when the destination escapes the app root.
+      def resolve(dest, root, label, io: $stdout)
+        assert_inside!(dest, root, label)
+      rescue Escape => e
+        io.puts "  skip  #{dest} (#{e.message}) [#{label}]"
+        nil
+      end
+
+      # An in-repo symlink is left in place: the write goes to what it points
+      # at, so `ln -s AGENTS.md CLAUDE.md` survives the write instead of being
+      # replaced by a regular file.
+      def assert_writable!(path, root, label)
+        assert_inside!(path, root, label)
+      end
+
+      # Every write this gem performs goes through here or #copy!.
+      #
+      # Hand-rolled File.write / FileUtils.cp is what let component source
+      # escape twice: once through a symlinked directory, and once -- after
+      # that was fixed -- through a symlinked destination *file*, because
+      # containment had been applied to the parent only. Writing via a
+      # temporary and renaming also means a killed process cannot truncate the
+      # file: rename is atomic and does not follow a symlink at the target.
+      def write!(path, content, root, label)
+        target = assert_writable!(path, root, label)
+        atomically(target) { |io| io.write(content) }
+      end
+
+      def copy!(source, path, root, label)
+        target = assert_writable!(path, root, label)
+        atomically(target) { |io| IO.copy_stream(source.to_s, io) }
+      end
+
+      # The temporary was the last way out of the app root, and containment
+      # never looked at it.
+      #
+      # `<dest>.<pid>.tmp` is guessable, and git stores symlinks, so a
+      # repository could ship `.senren/registry.yml.<pid>.tmp` as a link to
+      # something outside the checkout. `File.write` follows a symlink, so the
+      # write landed there with every containment check having passed —
+      # verified before this was changed.
+      #
+      # Two independent fixes, because either alone is thin. A random suffix
+      # removes the guess, and O_CREAT|O_EXCL refuses to open an existing path
+      # at all and does not follow a final symlink, so a lucky guess still
+      # fails. 0o644 rather than 0o600 keeps the permissions a plain write
+      # would have produced.
+      def atomically(target, &)
+        tmp = Pathname.new("#{target}.#{SecureRandom.hex(12)}.tmp")
+        File.open(tmp, File::WRONLY | File::CREAT | File::EXCL, 0o644, &)
+        File.rename(tmp, target)
+        target
+      ensure
+        FileUtils.rm_f(tmp) if tmp&.exist?
+      end
+    end
+  end
+end