@juspay/neurolink 11.18.0 → 11.18.1

package/CHANGELOG.md

@@ -1,9 +1,8 @@
-## [11.18.0](https://github.com/juspay/neurolink/compare/v11.17.3...v11.18.0) (2026-08-22)
+## [11.18.1](https://github.com/juspay/neurolink/compare/v11.18.0...v11.18.1) (2026-08-22)
 
-### Features
+### Bug Fixes
 
-- **(proxy):** add the Gemini CLI door ([9f754a9](https://github.com/juspay/neurolink/commit/9f754a9fec229c42033d35be034a75fbf037f292))
-- **(proxy):** attribute usage to the CLI that spent it ([d13d210](https://github.com/juspay/neurolink/commit/d13d21012086f2fb588b7e9df9b5d4ea9cee7496))
+- **(proxy):** write client configs atomically ([49032fc](https://github.com/juspay/neurolink/commit/49032fc5b1df7b90bfda013d9be71423e358001e))
 
 ## [11.2.3](https://github.com/juspay/neurolink/compare/v11.2.2...v11.2.3) (2026-08-19)
 

package/dist/cli/proxy-clients/claudeCode.js

@@ -8,7 +8,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
-import { isProxyOwnedValue, shouldCaptureSnapshot } from "./snapshot.js";
+import { isProxyOwnedValue, shouldCaptureSnapshot, writeFileAtomic, } from "./snapshot.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.
@@ -63,7 +63,7 @@ export async function setClaudeProxySettings(baseUrl) {
         ANTHROPIC_BASE_URL: baseUrl,
         ENABLE_TOOL_SEARCH: "true",
     };
-    fs.writeFileSync(getClaudeSettingsPath(), JSON.stringify(settings, null, 2));
+    await writeFileAtomic(getClaudeSettingsPath(), JSON.stringify(settings, null, 2));
 }
 export async function clearClaudeProxySettings(expectedBaseUrl) {
     const fs = await import("fs");
@@ -128,7 +128,7 @@ export async function clearClaudeProxySettings(expectedBaseUrl) {
     else {
         settings.env = env;
     }
-    fs.writeFileSync(getClaudeSettingsPath(), JSON.stringify(settings, null, 2));
+    await writeFileAtomic(getClaudeSettingsPath(), JSON.stringify(settings, null, 2));
     return hadBaseUrl || hadToolSearch;
 }
 export const claudeCodeConfigurator = {

package/dist/cli/proxy-clients/codex.js

@@ -7,6 +7,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
+import { writeFileAtomic } from "./snapshot.js";
 //
 // Points the Codex CLI at the proxy by managing `~/.codex/config.toml`:
 //   - appends a marker-delimited `[model_providers.neurolink]` table
@@ -92,7 +93,7 @@ export async function setCodexProxySettings(baseUrl) {
                 ? providerMatch[0]
                 : null;
             fs.mkdirSync(join(homedir(), ".neurolink"), { recursive: true });
-            fs.writeFileSync(getCodexSnapshotPath(), JSON.stringify({ originalProviderLine }, null, 2), { mode: 0o600 });
+            await writeFileAtomic(getCodexSnapshotPath(), JSON.stringify({ originalProviderLine }, null, 2), 0o600);
         }
         let text = stripCodexManagedConfig(original);
         // Set the selector: replace an existing top-level model_provider or insert
@@ -113,7 +114,7 @@ export async function setCodexProxySettings(baseUrl) {
             text = `model_provider = "neurolink"\n${text}`;
         }
         const trimmed = text.replace(/\s*$/, "\n");
-        fs.writeFileSync(getCodexConfigPath(), `${trimmed}\n${buildCodexProviderBlock(baseUrl)}`);
+        await writeFileAtomic(getCodexConfigPath(), `${trimmed}\n${buildCodexProviderBlock(baseUrl)}`);
         return true;
     }
     catch (error) {
@@ -182,7 +183,7 @@ export async function clearCodexProxySettings(expectedBaseUrl) {
             }
             return false;
         }
-        fs.writeFileSync(getCodexConfigPath(), text.replace(/\s*$/, "\n"));
+        await writeFileAtomic(getCodexConfigPath(), text.replace(/\s*$/, "\n"));
         try {
             fs.rmSync(getCodexSnapshotPath(), { force: true });
         }

package/dist/cli/proxy-clients/copilot.js

@@ -24,6 +24,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
+import { writeFileAtomic } from "./snapshot.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.
@@ -61,12 +62,11 @@ export async function setCopilotProxySettings(baseUrl, proxyKey) {
     try {
         const envPath = getCopilotEnvPath();
         fs.mkdirSync(join(homedir(), ".neurolink"), { recursive: true });
-        fs.writeFileSync(envPath, buildCopilotEnvScript(baseUrl, proxyKey || "neurolink-proxy"), { mode: 0o600 });
-        // The mode option above only applies when open() creates the file. On an
-        // overwrite it is ignored, so a pre-existing file keeps whatever
-        // permissions it had — which for a file holding a proxy key could be
-        // world-readable. Enforce it on both paths.
-        fs.chmodSync(envPath, 0o600);
+        // 0600 is applied to the temp file before the rename, so the script never
+        // exists at the destination with wider permissions — not even briefly.
+        // writeFileSync's own mode option would not do this: it applies only when
+        // open() creates the file, so an overwrite kept whatever mode was there.
+        await writeFileAtomic(envPath, buildCopilotEnvScript(baseUrl, proxyKey || "neurolink-proxy"), 0o600);
         return true;
     }
     catch (error) {

package/dist/cli/proxy-clients/openCode.js

@@ -7,7 +7,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
-import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, } from "./snapshot.js";
+import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, writeFileAtomic, } from "./snapshot.js";
 function getOpenCodeConfigDir() {
     // OpenCode resolves this with the unmodified `xdg-basedir` package —
     // `XDG_CONFIG_HOME || ~/.config` — on every platform, macOS included. There
@@ -82,7 +82,7 @@ export async function setOpenCodeProxySettings(baseUrl, proxyKey) {
     provider.neurolink = block;
     config[OPENCODE_WRITTEN_KEY] = cloneForSnapshot(block);
     config.provider = provider;
-    fs.writeFileSync(getOpenCodeConfigPath(), JSON.stringify(config, null, 2));
+    await writeFileAtomic(getOpenCodeConfigPath(), JSON.stringify(config, null, 2));
     return true;
 }
 export async function clearOpenCodeProxySettings(expectedBaseUrl) {
@@ -146,7 +146,7 @@ export async function clearOpenCodeProxySettings(expectedBaseUrl) {
         return false;
     }
     config.provider = provider;
-    fs.writeFileSync(getOpenCodeConfigPath(), JSON.stringify(config, null, 2));
+    await writeFileAtomic(getOpenCodeConfigPath(), JSON.stringify(config, null, 2));
     return hadNeurolink;
 }
 /**

package/dist/cli/proxy-clients/qwenCode.js

@@ -20,7 +20,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
-import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, } from "./snapshot.js";
+import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, writeFileAtomic, } from "./snapshot.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.
@@ -87,7 +87,7 @@ export async function setQwenProxySettings(baseUrl, proxyKey) {
     security.auth = auth;
     settings.security = security;
     settings[QWEN_WRITTEN_KEY] = cloneForSnapshot(auth);
-    fs.writeFileSync(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
+    await writeFileAtomic(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
     return true;
 }
 export async function clearQwenProxySettings(expectedBaseUrl) {
@@ -133,7 +133,7 @@ export async function clearQwenProxySettings(expectedBaseUrl) {
     delete settings[QWEN_ORIGINAL_KEY];
     delete settings[QWEN_WRITTEN_KEY];
     settings.security = security;
-    fs.writeFileSync(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
+    await writeFileAtomic(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
     return true;
 }
 export const qwenCodeConfigurator = {

package/dist/cli/proxy-clients/snapshot.d.ts

@@ -50,3 +50,54 @@ export declare function isProxyOwnedValue(args: {
     written: unknown;
     current: unknown;
 }): boolean;
+/**
+ * Replace a file's contents without ever exposing a partial one.
+ *
+ * `writeFileSync` opens with `O_TRUNC`, so from the truncate until the last
+ * byte lands the user's config is short — and a real config spans several
+ * syscalls, not an instant. Anything reading concurrently, the CLI the config
+ * belongs to included, can load a truncated file; a crash in that window leaves
+ * it truncated permanently. Both Qwen and OpenCode keep live API keys there.
+ *
+ * Writing to a sibling temp file and renaming closes it: `rename(2)` within a
+ * directory is atomic, so a reader sees either the whole old file or the whole
+ * new one. The temp file must be a sibling — a rename across filesystems is a
+ * copy, which reintroduces exactly the window this removes.
+ *
+ * PERMISSIONS ARE THE SUBTLE PART, and getting them wrong here leaks API keys.
+ *
+ * Writing through a temp file changes who decides the destination's mode. A
+ * plain `writeFileSync` over an existing file leaves that file's mode alone, so
+ * a config the user had locked to 0600 stayed 0600. A rename replaces the inode,
+ * so the destination inherits the TEMP file's mode instead — and a temp file
+ * created without an explicit mode lands at 0666 minus umask, i.e. 0644 on a
+ * default system. Left unhandled, making the write atomic would have quietly
+ * widened every credential file it touched from 0600 to 0644.
+ *
+ * So when the caller does not specify a mode, the destination's current mode is
+ * carried over, which reproduces `writeFileSync`'s behaviour exactly; a file
+ * that does not exist yet starts at 0600 rather than whatever umask allows.
+ *
+ * The mode is applied at CREATE time, not after. `writeFileSync` followed by
+ * `chmodSync` would put the credential bytes on disk at 0644 first and tighten
+ * them a moment later — a window a local reader can win. The trailing `chmod`
+ * remains only to pin the exact mode, since umask masks the create mode; by
+ * then the file has never been readable more widely than its final mode.
+ *
+ * On Windows the guarantee holds but the failure mode differs, which is worth
+ * stating because the obvious worry there is the wrong one. Node's `renameSync`
+ * is `MoveFileExW` with `MOVEFILE_REPLACE_EXISTING`; replacing a file on the
+ * same volume is an atomic directory-entry update, so a concurrent reader still
+ * sees the whole old file or the whole new one and never a torn one. What
+ * Windows adds is that the rename can *fail* — `EPERM`/`EBUSY` when a reader
+ * holds the destination open — where POSIX would succeed. That path is safe:
+ * the catch below removes the temp file and rethrows, leaving the previous
+ * config intact for the caller to report on.
+ *
+ * The sibling rule above is what makes that true. `MOVEFILE_COPY_ALLOWED` is
+ * also set, so a cross-volume rename silently degrades to copy-then-delete and
+ * is NOT atomic. Moving the temp file to `os.tmpdir()` would look like a
+ * tidy-up and would quietly restore the exact window this function exists to
+ * close, on Windows only, where nobody here would see it.
+ */
+export declare function writeFileAtomic(filePath: string, contents: string, mode?: number): Promise<void>;

package/dist/cli/proxy-clients/snapshot.js

@@ -95,4 +95,101 @@ export function isProxyOwnedValue(args) {
     }
     return valuesMatch(args.current, args.written);
 }
+/** Distinguishes concurrent writers within one process. */
+let atomicWriteCounter = 0;
+/**
+ * Replace a file's contents without ever exposing a partial one.
+ *
+ * `writeFileSync` opens with `O_TRUNC`, so from the truncate until the last
+ * byte lands the user's config is short — and a real config spans several
+ * syscalls, not an instant. Anything reading concurrently, the CLI the config
+ * belongs to included, can load a truncated file; a crash in that window leaves
+ * it truncated permanently. Both Qwen and OpenCode keep live API keys there.
+ *
+ * Writing to a sibling temp file and renaming closes it: `rename(2)` within a
+ * directory is atomic, so a reader sees either the whole old file or the whole
+ * new one. The temp file must be a sibling — a rename across filesystems is a
+ * copy, which reintroduces exactly the window this removes.
+ *
+ * PERMISSIONS ARE THE SUBTLE PART, and getting them wrong here leaks API keys.
+ *
+ * Writing through a temp file changes who decides the destination's mode. A
+ * plain `writeFileSync` over an existing file leaves that file's mode alone, so
+ * a config the user had locked to 0600 stayed 0600. A rename replaces the inode,
+ * so the destination inherits the TEMP file's mode instead — and a temp file
+ * created without an explicit mode lands at 0666 minus umask, i.e. 0644 on a
+ * default system. Left unhandled, making the write atomic would have quietly
+ * widened every credential file it touched from 0600 to 0644.
+ *
+ * So when the caller does not specify a mode, the destination's current mode is
+ * carried over, which reproduces `writeFileSync`'s behaviour exactly; a file
+ * that does not exist yet starts at 0600 rather than whatever umask allows.
+ *
+ * The mode is applied at CREATE time, not after. `writeFileSync` followed by
+ * `chmodSync` would put the credential bytes on disk at 0644 first and tighten
+ * them a moment later — a window a local reader can win. The trailing `chmod`
+ * remains only to pin the exact mode, since umask masks the create mode; by
+ * then the file has never been readable more widely than its final mode.
+ *
+ * On Windows the guarantee holds but the failure mode differs, which is worth
+ * stating because the obvious worry there is the wrong one. Node's `renameSync`
+ * is `MoveFileExW` with `MOVEFILE_REPLACE_EXISTING`; replacing a file on the
+ * same volume is an atomic directory-entry update, so a concurrent reader still
+ * sees the whole old file or the whole new one and never a torn one. What
+ * Windows adds is that the rename can *fail* — `EPERM`/`EBUSY` when a reader
+ * holds the destination open — where POSIX would succeed. That path is safe:
+ * the catch below removes the temp file and rethrows, leaving the previous
+ * config intact for the caller to report on.
+ *
+ * The sibling rule above is what makes that true. `MOVEFILE_COPY_ALLOWED` is
+ * also set, so a cross-volume rename silently degrades to copy-then-delete and
+ * is NOT atomic. Moving the temp file to `os.tmpdir()` would look like a
+ * tidy-up and would quietly restore the exact window this function exists to
+ * close, on Windows only, where nobody here would see it.
+ */
+export async function writeFileAtomic(filePath, contents, mode) {
+    const fs = await import("fs");
+    const { dirname, join, basename } = await import("path");
+    atomicWriteCounter += 1;
+    const tempPath = join(dirname(filePath), `.${basename(filePath)}.neurolink-${process.pid}-${atomicWriteCounter}.tmp`);
+    // Which step failed changes what the user should do about it: a failed write
+    // is usually a missing directory or a full disk and the config is untouched,
+    // while a failed rename is a locked destination and the config is intact but
+    // stale. The bare errno is the same shape for both, so the stage is recorded
+    // as it advances and named in the rethrow.
+    let stage = "write";
+    // Resolved before the first byte is written — see the permissions note above.
+    let effectiveMode = mode;
+    if (effectiveMode === undefined) {
+        try {
+            effectiveMode = fs.statSync(filePath).mode & 0o777;
+        }
+        catch {
+            effectiveMode = 0o600;
+        }
+    }
+    try {
+        fs.writeFileSync(tempPath, contents, { mode: effectiveMode });
+        stage = "chmod";
+        fs.chmodSync(tempPath, effectiveMode);
+        stage = "rename";
+        fs.renameSync(tempPath, filePath);
+    }
+    catch (error) {
+        // Never leave scratch in the user's config directory.
+        try {
+            fs.rmSync(tempPath, { force: true });
+        }
+        catch {
+            // best effort
+        }
+        const reason = error instanceof Error ? error.message : String(error);
+        // The original is attached as `cause`, not discarded: wrapping moves the
+        // errno off the thrown object, and `cause` is where anything that needs
+        // ENOENT/EPERM finds it. No caller reads it today — every call site either
+        // lets this propagate or swallows it — so nothing breaks, but a future one
+        // should not have to re-derive the syscall from a string.
+        throw new Error(`atomic write to ${filePath} failed at the ${stage} step: ${reason}`, { cause: error });
+    }
+}
 //# sourceMappingURL=snapshot.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "11.18.0",
+  "version": "11.18.1",
   "packageManager": "pnpm@10.15.1",
   "description": "TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and more.",
   "author": {