@agfpd/iapeer 0.4.34 → 0.4.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.34",
+  "version": "0.4.35",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/registry/index.ts

@@ -9,10 +9,10 @@
 // is no unlocked path to the registry file anywhere in the package.
 
 import * as lockfile from 'proper-lockfile'
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs'
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs'
 import { homedir } from 'os'
 import { join } from 'path'
-import { randomUUID } from 'crypto'
+import { writeFileAtomicRaw } from '../storage/atomicWrite.ts'
 import {
   IAPEER_DIR,
   MAX_DESCRIPTION_LEN,
@@ -313,7 +313,6 @@ export async function withPeersLock<T>(
  * sanctioned write path for the registry file (#3).
  */
 function writePeersIndexAtomic(paths: PeersPaths, index: PeersIndex): void {
-  const tmp = join(paths.tmpDir, `.${PEERS_PROFILES_FILE}.${process.pid}.${randomUUID()}.tmp`)
   // Persist the RAW intelligence verbatim (legacy-safe round-trip) and DROP the
   // intelligenceRaw shadow field from the on-disk shape — the file carries the
   // legacy vocab the live IAP reads, never the foundation's in-memory normalization.
@@ -333,8 +332,10 @@ function writePeersIndexAtomic(paths: PeersPaths, index: PeersIndex): void {
       ...(peer.interfaces ? { interfaces: peer.interfaces } : {}),
     }))
   const normalized = { version: PEERS_SCHEMA_VERSION, peers: peersForDisk }
-  writeFileSync(tmp, `${JSON.stringify(normalized, null, 2)}\n`, { mode: 0o600 })
-  renameSync(tmp, paths.peersFile)
+  // Route through the SHARED atomic-write core (fsync-before-rename + looped writeSync) — the private
+  // registry writer no longer keeps its own copy that drifted off the durability protocol. tmpDir is
+  // paths.tmpDir (same filesystem as peersFile → the rename stays atomic).
+  writeFileAtomicRaw(paths.peersFile, `${JSON.stringify(normalized, null, 2)}\n`, 0o600, paths.tmpDir)
 }
 
 export async function updatePeersIndex(

package/src/storage/atomicWrite.ts

@@ -0,0 +1,60 @@
+// The guard-FREE atomic-write CORE — the single durability implementation shared by
+// storage.writeFileAtomic (public, basename-guarded) and registry's private
+// peers-profiles writer (which bypasses that guard legitimately: it is the sole writer
+// under withPeersLock). Factored out because the registry kept its OWN copy of the
+// atomic-rename, and that copy DRIFTED — it lost the fsync the storage primitive has,
+// re-opening the power-loss hole on the most critical file of the host (the fleet
+// registry). One implementation → the durability protocol can never drift again.
+
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, renameSync, unlinkSync, writeSync } from 'node:fs'
+import { basename, dirname, join } from 'node:path'
+import { randomUUID } from 'node:crypto'
+
+const DIR_MODE = 0o700
+
+/**
+ * Atomically write `data` to `target`:
+ *   1. write to a unique tmp in `tmpDir` (default: the target's directory — which MUST be the same
+ *      filesystem as `target`, or the rename is not atomic),
+ *   2. fsync the tmp BEFORE the rename — rename is atomic on one fs, but without flushing the bytes
+ *      first a power-loss can publish a zero-length / partial file,
+ *   3. rename the tmp over `target`.
+ *
+ * writeSync is LOOPED over a Buffer: a single writeSync can write FEWER bytes than requested (on
+ * ENOSPC / a signal, write(2) returns a partial count WITHOUT throwing), which would otherwise publish
+ * a truncated file — the exact failure the atomic primitive exists to prevent. The tmp is always
+ * cleaned up on failure so a partial write never leaks.
+ */
+export function writeFileAtomicRaw(
+  target: string,
+  data: string,
+  mode: number,
+  tmpDir: string = dirname(target),
+): void {
+  mkdirSync(dirname(target), { recursive: true, mode: DIR_MODE })
+  if (tmpDir !== dirname(target)) mkdirSync(tmpDir, { recursive: true, mode: DIR_MODE })
+  const tmp = join(tmpDir, `.${basename(target)}.${process.pid}.${randomUUID()}.tmp`)
+  try {
+    const fd = openSync(tmp, 'w', mode)
+    try {
+      const buf = Buffer.from(data, 'utf8')
+      let written = 0
+      while (written < buf.length) {
+        const n = writeSync(fd, buf, written, buf.length - written)
+        if (n <= 0) throw new Error(`writeSync made no progress writing ${target} (${written}/${buf.length} bytes)`)
+        written += n
+      }
+      fsyncSync(fd)
+    } finally {
+      closeSync(fd)
+    }
+    renameSync(tmp, target)
+  } catch (e) {
+    try {
+      if (existsSync(tmp)) unlinkSync(tmp)
+    } catch {
+      /* best-effort cleanup */
+    }
+    throw e
+  }
+}

package/src/storage/index.ts

@@ -10,21 +10,10 @@
 // reaching for the generic atomic-write primitive. The registry keeps its own
 // private writer (see registry/index.ts) used only inside withPeersLock.
 
-import {
-  closeSync,
-  existsSync,
-  fsyncSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  readdirSync,
-  renameSync,
-  unlinkSync,
-  writeSync,
-} from 'fs'
+import { existsSync, mkdirSync, readFileSync, readdirSync } from 'fs'
 import { homedir } from 'os'
 import { basename, dirname, join } from 'path'
-import { randomUUID } from 'crypto'
+import { writeFileAtomicRaw } from './atomicWrite.ts'
 import {
   CACHE_DIR,
   IAPEER_DIR,
@@ -304,28 +293,6 @@ export function writeFileAtomic(path: string, data: string, mode: number = FILE_
       `refusing to write ${PEERS_PROFILES_FILE} via storage.writeFileAtomic — it is the registry's locked write target; use registry.upsertPeer/removePeer/renamePeer`,
     )
   }
-  const dir = dirname(path)
-  mkdirSync(dir, { recursive: true, mode: DIR_MODE })
-  const tmp = join(dir, `.${basename(path)}.${process.pid}.${randomUUID()}.tmp`)
-  try {
-    // fsync the tmp file BEFORE the rename: rename is atomic on a single fs, but
-    // without flushing the bytes first a power-loss can publish a zero-length /
-    // partial shared file (codex config.toml, .mcp.json, router.json, plists).
-    const fd = openSync(tmp, 'w', mode)
-    try {
-      writeSync(fd, data)
-      fsyncSync(fd)
-    } finally {
-      closeSync(fd)
-    }
-    renameSync(tmp, path)
-  } catch (e) {
-    // Never leak the tmp file when the write/rename fails (#audit).
-    try {
-      if (existsSync(tmp)) unlinkSync(tmp)
-    } catch {
-      /* best-effort cleanup */
-    }
-    throw e
-  }
+  // The durability core (fsync-before-rename + looped writeSync) lives in ONE place — see atomicWrite.ts.
+  writeFileAtomicRaw(path, data, mode)
 }