@cjhyy/code-shell-core 0.7.1 → 0.8.1

package/dist/settings/manager.js

@@ -10,6 +10,7 @@ import { parse as parseYaml } from "yaml";
 import { validateSettings } from "./schema.js";
 import { migrateModels } from "../migrate-models.js";
 import { migrateConfig, CONFIG_VERSION_KEY } from "./migrate-config.js";
+import { acquireFileLock } from "../utils/file-mutex.js";
 /**
  * Resolve the user's home directory. Prefers `process.env.HOME` so that
  * runtime env overrides (set after process start, e.g. in tests) actually
@@ -147,6 +148,7 @@ export class SettingsManager {
     cwd;
     scope;
     projectTrusted;
+    userConfigDirOverride;
     sources = [];
     merged = null;
     constructor(cwd = process.cwd(), scope = "project", 
@@ -162,10 +164,24 @@ export class SettingsManager {
      * Defaults to `true` so existing embedders/tests keep their behavior; the
      * host (desktop) passes the real trust decision from its trust-store.
      */
-    projectTrusted = true) {
+    projectTrusted = true, 
+    /**
+     * Override the user-level config directory (the `~/.code-shell` layer:
+     * settings.managed.json / settings.json live directly inside it). When
+     * absent the manager keeps today's behavior — `join(userHome(),
+     * ".code-shell")` resolved per call so `$HOME` overrides still work.
+     * Injection point for identity-scoped server deployments (a per-user
+     * worker passes `<dataRoot>` here instead of relocating `$HOME`).
+     */
+    userConfigDirOverride) {
         this.cwd = cwd;
         this.scope = scope;
         this.projectTrusted = projectTrusted;
+        this.userConfigDirOverride = userConfigDirOverride;
+    }
+    /** User-layer config dir: explicit override wins, else `~/.code-shell`. */
+    userConfigDir() {
+        return this.userConfigDirOverride ?? join(userHome(), ".code-shell");
     }
     /**
      * Load settings from all sources.
@@ -178,14 +194,14 @@ export class SettingsManager {
         const readProject = this.scope !== "isolated";
         if (readUser) {
             // 1. Managed (lowest priority)
-            this.loadJsonFile(join(userHome(), ".code-shell", "settings.managed.json"), "managed", 0);
+            this.loadJsonFile(join(this.userConfigDir(), "settings.managed.json"), "managed", 0);
             // 2. User — only ~/.code-shell/. We used to also read ~/.claude/settings.json
             // for "zero-migration from Claude Code", but Claude Code's schema diverges
             // (e.g. `model` is a string there, an object here). Merging caused boot
             // crashes on machines that had Claude Code installed but never ran us.
             // File-level compat (CLAUDE.md, .claude/skills/) is kept elsewhere — only
             // the settings.json read is dropped.
-            this.loadJsonFile(join(userHome(), ".code-shell", "settings.json"), "user", 1);
+            this.loadJsonFile(join(this.userConfigDir(), "settings.json"), "user", 1);
         }
         if (readProject) {
             // 3. Project
@@ -206,7 +222,7 @@ export class SettingsManager {
         // dirtying the user's (or a repo-tracked project) file for; steps are
         // idempotent, so re-running on unstamped files each load is fine.
         if (readUser) {
-            this.applyConfigMigration(join(userHome(), ".code-shell", "settings.json"), "user");
+            this.applyConfigMigration(join(this.userConfigDir(), "settings.json"), "user");
         }
         if (readProject) {
             this.applyConfigMigration(join(this.cwd, ".code-shell", "settings.json"), "project");
@@ -233,7 +249,7 @@ export class SettingsManager {
         // collapses provenance and the migration needs to write back to a
         // single physical file. Gated on readUser: under non-full scope we must
         // not read — let alone rewrite — the host's ~/.code-shell/settings.json.
-        const userPath = join(userHome(), ".code-shell", "settings.json");
+        const userPath = join(this.userConfigDir(), "settings.json");
         if (readUser && existsSync(userPath)) {
             try {
                 const userRaw = sanitizeSettingsObject(JSON.parse(readFileSync(userPath, "utf-8")));
@@ -334,29 +350,39 @@ export class SettingsManager {
      * The merged cache is invalidated so the next get() picks up the change.
      */
     saveUserSetting(key, value) {
-        const path = join(userHome(), ".code-shell", "settings.json");
-        let current = {};
-        if (existsSync(path)) {
-            try {
-                const raw = readFileSync(path, "utf-8");
-                const parsed = JSON.parse(raw);
-                if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-                    current = sanitizeSettingsObject(parsed);
+        const path = join(this.userConfigDir(), "settings.json");
+        mkdirSync(dirname(path), { recursive: true });
+        // Lock spans read → modify → write; see mutateSettingsFile for why the
+        // atomic rename alone was not enough. This path keeps its own sanitizing
+        // read (readJsonObject does not sanitize) so behaviour is unchanged apart
+        // from the added serialization.
+        const release = acquireFileLock(path);
+        try {
+            let current = {};
+            if (existsSync(path)) {
+                try {
+                    const raw = readFileSync(path, "utf-8");
+                    const parsed = JSON.parse(raw);
+                    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                        current = sanitizeSettingsObject(parsed);
+                    }
+                }
+                catch {
+                    // Corrupt file — overwrite rather than crash.
                 }
             }
-            catch {
-                // Corrupt file — overwrite rather than crash.
-            }
+            setDottedSetting(current, key, value);
+            // Atomic write: stage to .tmp, then rename, so a concurrent read can't
+            // catch a half-written file. mode 0o600 — settings.json can hold plaintext
+            // API keys, so it must be owner-only like credentials.json (store.ts:56),
+            // not world-readable (default umask leaves 0o644 otherwise).
+            const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+            writeFileSync(tmp, JSON.stringify(current, null, 2), { encoding: "utf-8", mode: 0o600 });
+            renameSync(tmp, path);
+        }
+        finally {
+            release();
         }
-        setDottedSetting(current, key, value);
-        mkdirSync(dirname(path), { recursive: true });
-        // Atomic write: stage to .tmp, then rename, so a concurrent read can't
-        // catch a half-written file. mode 0o600 — settings.json can hold plaintext
-        // API keys, so it must be owner-only like credentials.json (store.ts:56),
-        // not world-readable (default umask leaves 0o644 otherwise).
-        const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
-        writeFileSync(tmp, JSON.stringify(current, null, 2), { encoding: "utf-8", mode: 0o600 });
-        renameSync(tmp, path);
         this.invalidate();
     }
     /**
@@ -374,9 +400,9 @@ export class SettingsManager {
         // — skip the write rather than recreate it.
         if (!existsSync(cwd))
             return;
-        const current = this.readJsonObject(path);
-        setDottedSetting(current, key, value);
-        this.atomicWriteJson(path, current);
+        this.mutateSettingsFile(path, (current) => {
+            setDottedSetting(current, key, value);
+        });
         this.invalidate();
     }
     /**
@@ -394,18 +420,21 @@ export class SettingsManager {
         // format and wins over YAML, exactly as save does).
         if (!resolveConfigPath(path))
             return;
-        const current = this.readJsonObject(path);
-        const parts = parseDottedSettingKey(key);
-        let target = current;
-        for (let i = 0; i < parts.length - 1; i++) {
-            const seg = parts[i];
-            if (!target || !isOwnPlainObject(target, seg))
-                return;
-            target = target[seg];
-        }
-        if (target)
-            delete target[parts[parts.length - 1]];
-        this.atomicWriteJson(path, current);
+        this.mutateSettingsFile(path, (current) => {
+            const parts = parseDottedSettingKey(key);
+            let target = current;
+            for (let i = 0; i < parts.length - 1; i++) {
+                const seg = parts[i];
+                // Intermediate segment missing → nothing to delete; skip the write
+                // entirely rather than rewriting the file unchanged.
+                if (!target || !isOwnPlainObject(target, seg))
+                    return false;
+                target = target[seg];
+            }
+            if (target)
+                delete target[parts[parts.length - 1]];
+            return true;
+        });
         this.invalidate();
     }
     /**
@@ -418,7 +447,7 @@ export class SettingsManager {
      */
     getForScope(scope, cwd) {
         const path = scope === "user"
-            ? join(userHome(), ".code-shell", "settings.json")
+            ? join(this.userConfigDir(), "settings.json")
             : this.projectSettingsPath(cwd ?? this.cwd);
         const raw = this.readJsonObject(path);
         // validateSettings applies defaults; for a scope view we want only the
@@ -459,6 +488,38 @@ export class SettingsManager {
         writeFileSync(tmp, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 0o600 });
         renameSync(tmp, path);
     }
+    /**
+     * Read-modify-write a settings file under a cross-process lock.
+     *
+     * Atomic rename alone only prevents a half-written file; it does NOT prevent a
+     * lost update. Every writer here used to read its own snapshot outside any
+     * lock, so two processes changing DIFFERENT keys still clobbered each other:
+     * 48 concurrent writers each setting a distinct key left only 17 keys on disk.
+     *
+     * Real multi-writer paths, not a theoretical concern: the desktop settings
+     * page, the Agent `Config` tool, an automation worker, the TUI and a second
+     * desktop instance all write the same files. The desktop settings service
+     * already locked correctly; this brings Core's own writers onto the same
+     * protocol so they interlock rather than race past one another.
+     *
+     * `mutate` receives the CURRENT on-disk object (re-read inside the lock) and
+     * mutates it in place; returning false skips the write.
+     */
+    mutateSettingsFile(path, mutate) {
+        mkdirSync(dirname(path), { recursive: true });
+        const release = acquireFileLock(path);
+        try {
+            // Re-read INSIDE the lock: a snapshot taken before acquiring it would be
+            // exactly the stale value that drops the other writer's key.
+            const current = this.readJsonObject(path);
+            if (mutate(current) === false)
+                return;
+            this.atomicWriteJson(path, current);
+        }
+        finally {
+            release();
+        }
+    }
     loadJsonFile(path, name, priority) {
         // `path` is the canonical .json path for this layer. When it's absent but
         // a sibling settings.yaml/.yml exists, read the YAML instead (JSON wins

package/dist/settings/migrate-config.js

@@ -67,8 +67,10 @@ function clearMisWrittenSandboxAuto(config) {
     const s = sb;
     const isMisWritten = s.mode === "auto" &&
         s.network === "allow" &&
-        Array.isArray(s.writableRoots) && s.writableRoots.length === 0 &&
-        Array.isArray(s.deniedReads) && s.deniedReads.length === 0;
+        Array.isArray(s.writableRoots) &&
+        s.writableRoots.length === 0 &&
+        Array.isArray(s.deniedReads) &&
+        s.deniedReads.length === 0;
     if (!isMisWritten)
         return config;
     const next = { ...config };